@sendoracloud/sdk-react-native 1.27.0 → 1.30.0

package/dist/index.cjs

@@ -202,7 +202,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.27.0",
+  version: "1.30.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -258,7 +258,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -435,18 +435,119 @@ var AlreadyIdentifiedError = class extends Error {
   }
 };
 var CredentialInUseError = class extends Error {
-  constructor(message = "This credential is already linked to a different account") {
+  constructor(message = "This credential is already linked to a different account", opts) {
     super(message);
+    /** Always `"CREDENTIAL_IN_USE"`. */
+    this.code = "CREDENTIAL_IN_USE";
+    /**
+     * Always `"credential_in_use"`. Carried so this can be handled in the same
+     * `switch (err.kind)` as every other auth failure.
+     *
+     * NOTE this class deliberately does NOT extend `AuthError` — widening
+     * `instanceof AuthError` to include it would silently re-route an upgrading
+     * app that checks `AuthError` before this class. The taxonomy fields are
+     * duplicated instead.
+     */
+    this.kind = "credential_in_use";
+    /** Always false — a different account owns it; retrying changes nothing. */
+    this.retryable = false;
     this.name = "CredentialInUseError";
+    this.provider = opts?.provider;
+    this.collision = opts?.collision;
+    this.status = opts?.status;
   }
 };
+function readCollisionDetails(parsed) {
+  const details = parsed?.error?.details;
+  if (!details || typeof details !== "object") return {};
+  const d = details;
+  return {
+    provider: typeof d.provider === "string" ? d.provider : void 0,
+    collision: d.collision === "identity" || d.collision === "email" ? d.collision : void 0
+  };
+}
+var RETRYABLE_KINDS = /* @__PURE__ */ new Set([
+  "network",
+  "server",
+  "rate_limited",
+  "account_locked"
+]);
+function classifyAuthErrorKind(code, status) {
+  switch (code) {
+    case "NETWORK_ERROR":
+    case "NETWORK_TIMEOUT":
+      return "network";
+    case "PARSE_ERROR":
+      return "server";
+    case "RATE_LIMITED":
+    case "RATE_LIMIT":
+    case "RATE_LIMIT_EXCEEDED":
+    case "QUOTA_EXCEEDED":
+      return "rate_limited";
+    case "ACCOUNT_LOCKED":
+      return "account_locked";
+    case "CREDENTIAL_IN_USE":
+      return "credential_in_use";
+    case "NOT_ANONYMOUS":
+    case "FORBIDDEN_NON_ANONYMOUS":
+      return "already_identified";
+    case "PASSKEY_USER_CANCELLED":
+    case "GAME_CENTER_CANCELLED":
+    case "PLAY_GAMES_CANCELLED":
+    case "SSO_CANCELLED":
+      return "cancelled";
+    case "GAME_CENTER_UNAVAILABLE":
+    case "PLAY_GAMES_UNAVAILABLE":
+    case "ENTITLEMENT_ERROR":
+    case "tier_required":
+      return "config";
+    case "UNAUTHORIZED":
+    case "INVALID_CREDENTIALS":
+    case "INVALID_REFRESH_TOKEN":
+    case "EMAIL_OTP_INVALID":
+    case "MAGIC_LINK_INVALID":
+    case "PASSKEY_RP_MISMATCH":
+    case "NOT_SIGNED_IN":
+      return "invalid_credential";
+    default:
+      break;
+  }
+  if (typeof status === "number") {
+    if (status === 429) return "rate_limited";
+    if (status >= 500) return "server";
+    if (status >= 400) return "invalid_credential";
+  }
+  return "unknown";
+}
 var AuthError = class extends Error {
-  constructor(code, message) {
+  constructor(code, message, opts) {
     super(message);
     this.name = "AuthError";
     this.code = code;
+    this.kind = opts?.kind ?? classifyAuthErrorKind(code, opts?.status);
+    this.retryable = RETRYABLE_KINDS.has(this.kind);
+    this.retryAfterSeconds = opts?.retryAfterSeconds;
+    this.status = opts?.status;
   }
 };
+function asAuthError(err) {
+  if (err instanceof AuthError) return err;
+  if (err instanceof EmailAlreadyTakenError || err instanceof AlreadyIdentifiedError || err instanceof CredentialInUseError) {
+    return err;
+  }
+  const name = err?.name;
+  if (name === "NetworkTimeoutError") {
+    return new AuthError("NETWORK_TIMEOUT", err.message, { kind: "network" });
+  }
+  return new AuthError("UNKNOWN_ERROR", err instanceof Error ? err.message : String(err), {
+    kind: "unknown"
+  });
+}
+function readRetryAfterSeconds(parsed) {
+  const details = parsed?.error?.details;
+  const v = details?.retryAfterSeconds;
+  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
+}
 var GAME_AUTH_NATIVE_MODULE = "SendoraGameAuth";
 async function fetchGameCenterPayloadNative() {
   const mod = requireOptionalNativeModule(GAME_AUTH_NATIVE_MODULE);
@@ -511,6 +612,7 @@ var Auth = class {
     this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
     this.deletionCancelledListeners = /* @__PURE__ */ new Set();
+    this.authStateListeners = /* @__PURE__ */ new Set();
     this.lastDeletionCancelled = null;
     this.lastTakeover = null;
     /**
@@ -521,6 +623,11 @@ var Auth = class {
      * device ended with two user_ids + duplicate pushes (audit s58.203 fix).
      */
     this.pendingAnonTakeover = null;
+    /**
+     * True once `hydrate()` has run. Distinguishes "no session restored YET"
+     * from "genuinely signed out" for `onAuthStateChanged`'s replay-on-subscribe.
+     */
+    this.hydrated = false;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -575,9 +682,9 @@ var Auth = class {
         this.hooks.storage.remove(USER_KEY);
         this.hooks.storage.remove(TOKEN_KEY);
         this.hooks.storage.remove(TOKEN_EXPIRES_KEY);
-        this.hooks.storage.remove(REFRESH_KEY);
       }
     }
+    this.hydrated = true;
     this.resolveReady();
   }
   getCurrentUser() {
@@ -603,6 +710,52 @@ var Auth = class {
       this.takeoverListeners.delete(listener);
     };
   }
+  /**
+   * Subscribe to every auth-state transition (1.28.0) — the single stream that
+   * answers "what happened to my session?". Firebase `onAuthStateChanged` /
+   * Supabase `onAuthStateChange` parity.
+   *
+   * The reason it exists: a session that dies in the BACKGROUND (the server
+   * rejected the stored refresh token) used to emit no signal whatsoever, so
+   * an app could not distinguish it from a deliberate sign-out and only
+   * noticed when `getAccessToken()` began returning null. That transition is
+   * now `{ event: "signed_out", reason: "session_expired" }`.
+   *
+   * Fires the CURRENT state immediately on subscribe once `init()` has
+   * hydrated (a `signed_in` when a session was restored from disk — including
+   * offline, since hydrate is disk-only), so a subscriber never misses the
+   * state it started in. Nothing is emitted for a signed-out cold start.
+   *
+   * A failed sign-in emits NOTHING: the session is unchanged, so there is no
+   * transition to report — the rejected promise is the whole story.
+   *
+   * Listeners are best-effort; a throwing listener is swallowed (dev-logged)
+   * and never affects auth state. Returns an unsubscribe function.
+   */
+  onAuthStateChanged(listener) {
+    this.authStateListeners.add(listener);
+    if (this.hydrated && this.user) {
+      const user = this.user;
+      try {
+        listener({ event: "signed_in", user });
+      } catch (err) {
+        if (this.hooks.debug) console.warn("[Sendora] onAuthStateChanged listener threw", err);
+      }
+    }
+    return () => {
+      this.authStateListeners.delete(listener);
+    };
+  }
+  /** Fan a state change out to subscribers. Never throws. */
+  emitAuthState(change) {
+    for (const listener of this.authStateListeners) {
+      try {
+        listener(change);
+      } catch (err) {
+        if (this.hooks.debug) console.warn("[Sendora] onAuthStateChanged listener threw", err);
+      }
+    }
+  }
   /**
    * Inspect the most recent device-takeover event observed by the
    * SDK. Cleared on signOut. Returns null when no takeover has
@@ -699,8 +852,27 @@ var Auth = class {
   getAccessTokenSync() {
     return this.accessToken;
   }
+  /**
+   * Mint (or return) an anonymous session.
+   *
+   * Reuses the existing anonymous user when there already is one — the same
+   * short-circuit Firebase's `signInAnonymously` performs. Without it, an app
+   * that calls this defensively on every cold launch (the most natural thing
+   * to write) mints a fresh `user_id` each time, and `persist()` overwrites
+   * the stored refresh token — the previous anonymous account's only durable
+   * handle — with no takeover, no webhook and no state event. That is the same
+   * silent progress loss as a failed sign-in wiping the session, except it
+   * happens on a *healthy* network.
+   *
+   * Pass `forceNew: true` to deliberately abandon the current anonymous
+   * session and mint a separate one.
+   */
   signInAnonymously(opts) {
     return this.serialize(async () => {
+      const existing = this.user;
+      if (!opts?.forceNew && existing?.isAnonymous && this.hooks.storage.get(REFRESH_KEY)) {
+        return existing;
+      }
       const data = await this.callAuth("/api/v1/auth-service/anonymous", {
         name: opts?.name,
         metadata: opts?.metadata
@@ -749,7 +921,7 @@ var Auth = class {
             throw new EmailAlreadyTakenError(err.message);
           }
           if (err instanceof AuthError && (err.code === "INVALID_REFRESH" || err.code === "UNAUTHORIZED" || err.code === "REFRESH_EXPIRED")) {
-            await this.wipeLocalIdentity();
+            await this.wipeLocalIdentity("session_expired");
           } else {
             throw err;
           }
@@ -790,10 +962,14 @@ var Auth = class {
       try {
         parsed = await res.json();
       } catch {
-        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`, { status: res.status });
       }
       if (!res.ok || !parsed.success || !parsed.data) {
-        throw new AuthError(parsed.error?.code ?? `HTTP_${res.status}`, parsed.error?.message ?? `HTTP ${res.status}`);
+        throw new AuthError(
+          parsed.error?.code ?? `HTTP_${res.status}`,
+          parsed.error?.message ?? `HTTP ${res.status}`,
+          { status: res.status, retryAfterSeconds: readRetryAfterSeconds(parsed) }
+        );
       }
       const r = parsed.data;
       if (r.mfaRequired === true && typeof r.mfaChallengeToken === "string") {
@@ -820,16 +996,12 @@ var Auth = class {
    */
   loginSocial(input) {
     return this.serialize(async () => {
-      let prevAnonRefreshToken;
-      if (this.user?.isAnonymous) {
-        const stashed = this.hooks.storage.get(REFRESH_KEY);
-        if (stashed) prevAnonRefreshToken = stashed;
-      }
-      if (this.user !== null) await this.wipeLocalIdentity();
-      const { link, ...socialInput } = input;
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+      const { link, onCredentialInUse, ...socialInput } = input;
       const payload = { ...socialInput };
       if (prevAnonRefreshToken) payload.prevAnonRefreshToken = prevAnonRefreshToken;
       if (link) payload.linkAnonymous = true;
+      if (onCredentialInUse) payload.onCredentialInUse = onCredentialInUse;
       const res = await post(
         { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
         "/api/v1/auth-service/login/social",
@@ -840,14 +1012,22 @@ var Auth = class {
       try {
         parsed = await res.json();
       } catch {
-        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`, { status: res.status });
       }
       if (!res.ok || !parsed.success || !isAuthApiResponse(parsed.data)) {
+        if (parsed.error?.code === "CREDENTIAL_IN_USE") {
+          throw new CredentialInUseError(parsed.error.message, {
+            ...readCollisionDetails(parsed),
+            status: res.status
+          });
+        }
         throw new AuthError(
           parsed.error?.code ?? "SOCIAL_LOGIN_FAILED",
-          parsed.error?.message ?? "Social login failed"
+          parsed.error?.message ?? "Social login failed",
+          { status: res.status, retryAfterSeconds: readRetryAfterSeconds(parsed) }
         );
       }
+      if (this.user !== null) await this.wipeLocalIdentity("replaced");
       this.persist(parsed.data);
       return parsed.data.user;
     });
@@ -876,26 +1056,24 @@ var Auth = class {
   signInWithGameCenter(payloadOrOpts, maybeOpts) {
     const path = "/api/v1/auth-service/login/game-center";
     if (payloadOrOpts && "publicKeyUrl" in payloadOrOpts) {
-      return this.gameIdentitySignIn(path, { ...payloadOrOpts }, maybeOpts?.link);
+      return this.gameIdentitySignIn(path, { ...payloadOrOpts }, maybeOpts);
     }
-    const link = payloadOrOpts?.link;
     return this.gameIdentitySignIn(
       path,
       async () => await fetchGameCenterPayloadNative(),
-      link
+      payloadOrOpts
     );
   }
   signInWithPlayGames(payloadOrOpts, maybeOpts) {
     const path = "/api/v1/auth-service/login/play-games";
     if (payloadOrOpts && "serverAuthCode" in payloadOrOpts) {
       const { serverAuthCode } = payloadOrOpts;
-      return this.gameIdentitySignIn(path, { serverAuthCode }, maybeOpts?.link);
+      return this.gameIdentitySignIn(path, { serverAuthCode }, maybeOpts);
     }
-    const link = payloadOrOpts?.link;
     return this.gameIdentitySignIn(
       path,
       async () => await fetchPlayGamesAuthCodeNative(),
-      link
+      payloadOrOpts
     );
   }
   // ============================================================
@@ -966,12 +1144,24 @@ var Auth = class {
     try {
       parsed = await res.json();
     } catch {
-      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`, { status: res.status });
     }
     if (!res.ok || !parsed.success || !parsed.data) {
       const code = parsed.error?.code ?? `HTTP_${res.status}`;
-      if (code === "CREDENTIAL_IN_USE") throw new CredentialInUseError(parsed.error?.message);
-      throw new AuthError(code, parsed.error?.message ?? "Failed to link credential");
+      if (code === "CREDENTIAL_IN_USE") {
+        throw new CredentialInUseError(parsed.error?.message, {
+          ...readCollisionDetails(parsed),
+          status: res.status
+        });
+      }
+      throw new AuthError(code, parsed.error?.message ?? "Failed to link credential", {
+        status: res.status,
+        retryAfterSeconds: readRetryAfterSeconds(parsed)
+      });
+    }
+    if (parsed.data.upgraded && isAuthApiResponse(parsed.data)) {
+      this.persist(parsed.data);
+      return parsed.data.user;
     }
     if (parsed.data.user) this.updateLocalUser(parsed.data.user);
     return parsed.data.user ?? this.user;
@@ -1021,18 +1211,16 @@ var Auth = class {
    * `linkAnonymous` when `link` is set. `persist()` fires `onDeviceTakeover`
    * centrally from `retiredAnonUserId`.
    */
-  gameIdentitySignIn(path, identityBody, link) {
+  gameIdentitySignIn(path, identityBody, opts) {
+    const link = opts?.link;
+    const onCredentialInUse = opts?.onCredentialInUse;
     return this.serialize(async () => {
       const body = typeof identityBody === "function" ? await identityBody() : identityBody;
-      let prevAnonRefreshToken;
-      if (this.user?.isAnonymous) {
-        const stashed = this.hooks.storage.get(REFRESH_KEY);
-        if (stashed) prevAnonRefreshToken = stashed;
-      }
-      if (this.user !== null) await this.wipeLocalIdentity();
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
       const payload = { ...body };
       if (prevAnonRefreshToken) payload.prevAnonRefreshToken = prevAnonRefreshToken;
       if (link) payload.linkAnonymous = true;
+      if (onCredentialInUse) payload.onCredentialInUse = onCredentialInUse;
       const res = await post(
         { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
         path,
@@ -1043,14 +1231,22 @@ var Auth = class {
       try {
         parsed = await res.json();
       } catch {
-        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`, { status: res.status });
       }
       if (!res.ok || !parsed.success || !isAuthApiResponse(parsed.data)) {
+        if (parsed.error?.code === "CREDENTIAL_IN_USE") {
+          throw new CredentialInUseError(parsed.error.message, {
+            ...readCollisionDetails(parsed),
+            status: res.status
+          });
+        }
         throw new AuthError(
           parsed.error?.code ?? "GAME_LOGIN_FAILED",
-          parsed.error?.message ?? "Game sign-in failed"
+          parsed.error?.message ?? "Game sign-in failed",
+          { status: res.status, retryAfterSeconds: readRetryAfterSeconds(parsed) }
         );
       }
+      if (this.user !== null) await this.wipeLocalIdentity("replaced");
       this.persist(parsed.data);
       return parsed.data.user;
     });
@@ -1101,10 +1297,10 @@ var Auth = class {
   verifyMagicLink(token) {
     return this.serialize(async () => {
       const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
-      if (this.user !== null) await this.wipeLocalIdentity();
       const body = { token };
       if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
       const data = await this.callAuth("/api/v1/auth-service/magic-link/verify", body);
+      if (this.user !== null) await this.wipeLocalIdentity("replaced");
       this.persist(data);
       return data.user;
     });
@@ -1125,10 +1321,10 @@ var Auth = class {
   verifyEmailOtp(email, code) {
     return this.serialize(async () => {
       const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
-      if (this.user !== null) await this.wipeLocalIdentity();
       const body = { email, code };
       if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
       const data = await this.callAuth("/api/v1/auth-service/email-otp/verify", body);
+      if (this.user !== null) await this.wipeLocalIdentity("replaced");
       this.persist(data);
       return data.user;
     });
@@ -1284,7 +1480,7 @@ var Auth = class {
       }
     } catch {
     }
-    await this.wipeLocalIdentity();
+    await this.wipeLocalIdentity("account_deleted");
     return out;
   }
   // ============================================================
@@ -1352,7 +1548,6 @@ var Auth = class {
    */
   consumeSsoFragment(callbackUrl) {
     return this.serialize(async () => {
-      if (this.user !== null) await this.wipeLocalIdentity();
       const hashIdx = callbackUrl.indexOf("#");
       const fragment = hashIdx >= 0 ? callbackUrl.slice(hashIdx + 1) : "";
       const params = new URLSearchParams(fragment);
@@ -1366,14 +1561,13 @@ var Auth = class {
         "/api/v1/auth-service/token/refresh",
         { refreshToken: refresh }
       );
-      if (!res || !res.ok) throw new AuthError("SSO_EXCHANGE_FAILED", `HTTP ${res?.status ?? "network"}`);
+      if (!res || !res.ok) throw new AuthError("SSO_EXCHANGE_FAILED", `HTTP ${res?.status ?? "network"}`, { status: res?.status });
       const parsed = await res.json();
-      const access = parsed.data?.accessToken;
-      const newRefresh = parsed.data?.refreshToken;
-      const expiresIn = parsed.data?.expiresIn;
-      if (!parsed.success || !access || !newRefresh || !expiresIn || expiresIn <= 0) {
-        throw new AuthError("SSO_EXCHANGE_FAILED", "Could not exchange OIDC token");
+      const rotated = parsed.success ? readRotatedTokens(parsed.data) : null;
+      if (!rotated) {
+        throw new AuthError("SSO_EXCHANGE_FAILED", "Could not exchange OIDC token", { status: res.status });
       }
+      const { accessToken: access, refreshToken: newRefresh, expiresIn } = rotated;
       const claims = decodeJwtPayload(access);
       const user = {
         id: claims?.sub ?? "",
@@ -1382,6 +1576,7 @@ var Auth = class {
         name: claims?.name ?? null,
         isAnonymous: false
       };
+      if (this.user !== null) await this.wipeLocalIdentity("replaced");
       this.persist({
         user,
         tokens: {
@@ -1417,7 +1612,7 @@ var Auth = class {
   signOut() {
     return this.serialize(async () => {
       const refresh = this.hooks.storage.get(REFRESH_KEY);
-      await this.wipeLocalIdentity();
+      await this.wipeLocalIdentity("user");
       if (refresh) {
         void post(
           { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
@@ -1431,7 +1626,11 @@ var Auth = class {
   serialize(op) {
     const guarded = async () => {
       await this.readyPromise;
-      return op();
+      try {
+        return await op();
+      } catch (err) {
+        throw asAuthError(err);
+      }
     };
     const next = this.inflight.then(guarded, guarded);
     this.inflight = next.catch(() => void 0);
@@ -1456,6 +1655,7 @@ var Auth = class {
     const refreshSnapshot = this.hooks.storage.get(REFRESH_KEY);
     if (!refreshSnapshot) return null;
     this.refreshInflight = (async () => {
+      let sent = refreshSnapshot;
       try {
         const current = this.hooks.storage.get(REFRESH_KEY);
         if (current && current !== refreshSnapshot) {
@@ -1472,20 +1672,28 @@ var Auth = class {
             }
           }
         }
+        sent = current ?? refreshSnapshot;
         const data = await this.callAuth("/api/v1/auth-service/token/refresh", {
-          refreshToken: current ?? refreshSnapshot
+          refreshToken: sent
         });
+        if (!this.tokenStillCurrent(sent)) return null;
         this.accessToken = data.tokens.accessToken;
         this.accessExpiresAt = Date.now() + data.tokens.expiresIn * 1e3;
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        if (this.user === null && isAuthApiResponse(data)) {
+          this.user = data.user;
+          this.hooks.storage.set(USER_KEY, JSON.stringify(data.user));
+          this.hooks.onIdentityChange(data.user.id);
+          this.emitAuthState({ event: "signed_in", user: data.user });
+        }
         this.refreshFailureCount = 0;
         this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
-        if (err instanceof AuthError && isDeadRefreshError(err.code)) {
-          await this.wipeLocalIdentity().catch(() => void 0);
+        if (err instanceof AuthError && isDeadRefreshError(err.code) && this.tokenStillCurrent(sent)) {
+          await this.wipeLocalIdentity("session_expired").catch(() => void 0);
           this.refreshFailureCount = 0;
           this.refreshCooldownUntil = 0;
           return null;
@@ -1599,12 +1807,13 @@ var Auth = class {
     try {
       parsed = await res.json();
     } catch {
-      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`, { status: res.status });
     }
     if (!res.ok || !parsed.success || !parsed.data) {
       throw new AuthError(
         parsed.error?.code ?? `HTTP_${res.status}`,
-        parsed.error?.message ?? `HTTP ${res.status}`
+        parsed.error?.message ?? `HTTP ${res.status}`,
+        { status: res.status, retryAfterSeconds: readRetryAfterSeconds(parsed) }
       );
     }
     const t = parsed.data.tokens;
@@ -1638,12 +1847,13 @@ var Auth = class {
     try {
       parsed = await res.json();
     } catch {
-      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`, { status: res.status });
     }
     if (!res.ok || !parsed.success || !isAuthApiResponse(parsed.data)) {
       throw new AuthError(
         parsed.error?.code ?? `HTTP_${res.status}`,
-        parsed.error?.message ?? `HTTP ${res.status}`
+        parsed.error?.message ?? `HTTP ${res.status}`,
+        { status: res.status, retryAfterSeconds: readRetryAfterSeconds(parsed) }
       );
     }
     return parsed.data;
@@ -1658,14 +1868,46 @@ var Auth = class {
     this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
     this.hooks.onIdentityChange(data.user.id);
     this.startProactiveRefreshCron();
+    this.emitAuthState({ event: "signed_in", user: data.user });
     if (data.retiredAnonUserId) {
       this.fireDeviceTakeover(data.retiredAnonUserId, data.user.id);
+      this.emitAuthState({
+        event: "device_takeover",
+        user: data.user,
+        retiredAnonUserId: data.retiredAnonUserId
+      });
     }
     if (data.reactivatedFromDeletion) {
       this.fireDeletionCancelled(data.user.id);
+      this.emitAuthState({ event: "deletion_cancelled", user: data.user });
     }
   }
-  async wipeLocalIdentity() {
+  /**
+   * Drop the local session.
+   *
+   * `reason` drives the `onAuthStateChanged` emission: a real sign-out reason
+   * emits `signed_out`, while `"replaced"` (the internal pre-`persist()` clear
+   * on a SUCCESSFUL sign-in) emits nothing — subscribers see one `signed_in`,
+   * not a spurious logout/login pair.
+   *
+   * ⚠ Never call this before a fallible network request. A failed sign-in must
+   * leave the caller exactly as it found them; for an anonymous session the
+   * refresh token dropped here is the ONLY durable handle on the account, so a
+   * pre-call wipe that is not followed by a successful `persist()` orphans the
+   * account permanently (offline: deterministically). Capture the anon refresh
+   * into a local, make the call, and wipe only after the response validates.
+   */
+  /**
+   * True when `sent` is still the refresh token on disk — i.e. nothing
+   * replaced or cleared the session while a request carrying it was in
+   * flight. Guards both directions of the refresh race: installing a rotated
+   * token over a session that has since been signed out or replaced, and
+   * wiping a fresh session because an OLD token was rejected.
+   */
+  tokenStillCurrent(sent) {
+    return this.hooks.storage.get(REFRESH_KEY) === sent;
+  }
+  async wipeLocalIdentity(reason = "replaced") {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
@@ -1678,11 +1920,23 @@ var Auth = class {
     this.hooks.storage.remove(REFRESH_KEY);
     this.stopProactiveRefreshCron();
     await this.hooks.onAnonymousWipe();
+    if (reason !== "replaced") {
+      this.emitAuthState({ event: "signed_out", user: null, reason });
+    }
   }
 };
 function isDeadRefreshError(code) {
   if (!code) return false;
-  return code === "INVALID_REFRESH_TOKEN" || code === "HTTP_401" || code === "UNAUTHORIZED" || code === "RATE_LIMIT_EXCEEDED" || code === "RATE_LIMIT";
+  return code === "INVALID_REFRESH_TOKEN";
+}
+function readRotatedTokens(data) {
+  if (!data || typeof data !== "object") return null;
+  const container = data.tokens;
+  const t = container && typeof container === "object" ? container : data;
+  if (typeof t.accessToken !== "string" || !t.accessToken) return null;
+  if (typeof t.refreshToken !== "string" || !t.refreshToken) return null;
+  if (typeof t.expiresIn !== "number" || t.expiresIn <= 0) return null;
+  return { accessToken: t.accessToken, refreshToken: t.refreshToken, expiresIn: t.expiresIn };
 }
 function decodeJwtPayload(token) {
   try {
@@ -3326,10 +3580,16 @@ var SendoraSDK = class {
    * Clear identity + rotate the anonymous id. Call on logout. Awaits
    * the AsyncStorage writes so a caller who kills the app immediately
    * after doesn't leave stale identity on disk.
+   *
+   * Signs out through `auth` rather than just clearing storage: `clearAll()`
+   * removes the auth keys too, so doing it directly left `Auth` holding an
+   * in-memory user and reporting itself signed in while its refresh token was
+   * already gone — with the server-side session never revoked and no
+   * `onAuthStateChanged` emission telling the app the session had ended.
    */
   async reset() {
+    await this.auth.signOut().catch(() => void 0);
     this.userId = null;
-    this.anonId = uuid();
     this.sessionId = "";
     await this.storage.clearAll();
     this.storage.set(ANON_KEY, this.anonId);