@sendoracloud/sdk-react-native 1.33.0 → 1.35.0

package/dist/index.cjs

@@ -48,7 +48,7 @@ var import_react_native_get_random_values = require("react-native-get-random-val
 var import_react_native5 = require("react-native");
 
 // src/storage.ts
-var PREFIX = "sendora_";
+var DEFAULT_PREFIX = "sendora_";
 var asyncStoragePromise = null;
 async function getAsyncStorage() {
   if (asyncStoragePromise) return asyncStoragePromise;
@@ -71,6 +71,12 @@ var Storage = class {
     this.hydrated = false;
     this.secure = opts.secureAdapter ?? null;
     this.secureKeys = new Set(opts.secureKeys ?? []);
+    this.prefix = opts.prefix ?? DEFAULT_PREFIX;
+    this.securePrefix = opts.prefix ?? "";
+  }
+  /** The adapter-facing name for a key. Bare by default; see `prefix`. */
+  secureName(key) {
+    return this.securePrefix + key;
   }
   isSecure(key) {
     return this.secure !== null && this.secureKeys.has(key);
@@ -91,7 +97,7 @@ var Storage = class {
         await this.hydrateSecureKey(k, store);
       } else if (store) {
         try {
-          const v = await store.getItem(PREFIX + k);
+          const v = await store.getItem(this.prefix + k);
           if (v !== null) this.cache.set(k, v);
         } catch {
         }
@@ -102,18 +108,18 @@ var Storage = class {
   /** Read a secure key: adapter first, else migrate legacy plaintext. Never throws. */
   async hydrateSecureKey(k, store) {
     try {
-      const secureVal = await this.secure.getItem(k);
+      const secureVal = await this.secure.getItem(this.secureName(k));
       if (secureVal !== null) {
         this.cache.set(k, secureVal);
         return;
       }
       if (store) {
-        const legacy = await store.getItem(PREFIX + k).catch(() => null);
+        const legacy = await store.getItem(this.prefix + k).catch(() => null);
         if (legacy !== null) {
           this.cache.set(k, legacy);
           try {
-            await this.secure.setItem(k, legacy);
-            await store.removeItem(PREFIX + k).catch(() => {
+            await this.secure.setItem(this.secureName(k), legacy);
+            await store.removeItem(this.prefix + k).catch(() => {
             });
           } catch {
           }
@@ -122,7 +128,7 @@ var Storage = class {
     } catch {
       if (store) {
         try {
-          const legacy = await store.getItem(PREFIX + k);
+          const legacy = await store.getItem(this.prefix + k);
           if (legacy !== null) this.cache.set(k, legacy);
         } catch {
         }
@@ -135,27 +141,27 @@ var Storage = class {
   set(key, value) {
     this.cache.set(key, value);
     if (this.isSecure(key)) {
-      void this.secure.setItem(key, value).catch(() => {
+      void this.secure.setItem(this.secureName(key), value).catch(() => {
         void getAsyncStorage().then((store) => {
-          if (store) store.setItem(PREFIX + key, value).catch(() => {
+          if (store) store.setItem(this.prefix + key, value).catch(() => {
           });
         });
       });
       return;
     }
     void getAsyncStorage().then((store) => {
-      if (store) store.setItem(PREFIX + key, value).catch(() => {
+      if (store) store.setItem(this.prefix + key, value).catch(() => {
       });
     });
   }
   remove(key) {
     this.cache.delete(key);
     if (this.isSecure(key)) {
-      void this.secure.removeItem(key).catch(() => {
+      void this.secure.removeItem(this.secureName(key)).catch(() => {
       });
     }
     void getAsyncStorage().then((store) => {
-      if (store) store.removeItem(PREFIX + key).catch(() => {
+      if (store) store.removeItem(this.prefix + key).catch(() => {
       });
     });
   }
@@ -171,7 +177,7 @@ var Storage = class {
     if (this.secure) {
       for (const k of this.secureKeys) {
         try {
-          await this.secure.removeItem(k);
+          await this.secure.removeItem(this.secureName(k));
         } catch {
         }
       }
@@ -182,13 +188,13 @@ var Storage = class {
     if (typeof store.getAllKeys === "function") {
       try {
         const all = await store.getAllKeys();
-        keys = all.filter((k) => k.startsWith(PREFIX));
+        keys = all.filter((k) => k.startsWith(this.prefix));
       } catch {
         keys = [];
       }
     }
     if (keys.length === 0) {
-      keys = Array.from(this.secureKeys).map((k) => PREFIX + k);
+      keys = Array.from(this.secureKeys).map((k) => this.prefix + k);
     }
     for (const k of keys) {
       try {
@@ -202,7 +208,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.33.0",
+  version: "1.35.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -258,7 +264,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -488,6 +494,8 @@ function classifyAuthErrorKind(code, status) {
       return "account_locked";
     case "CREDENTIAL_IN_USE":
       return "credential_in_use";
+    case "LAST_CREDENTIAL":
+      return "last_credential";
     case "NOT_ANONYMOUS":
     case "FORBIDDEN_NON_ANONYMOUS":
       return "already_identified";
@@ -595,6 +603,27 @@ var Auth = class {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
+    /**
+     * Set once we have PROOF that this device's clock runs fast, which
+     * releases the `exp` guard in `canServeCachedToken`.
+     *
+     * The proof is specific and cannot be faked by a stale deadline: a token
+     * the server minted *seconds ago* reads as already past its own `exp`.
+     * A freshly-issued token is never genuinely expired, so the only
+     * explanation is the clock we measured it with.
+     *
+     * ⚠ NEVER PERSIST THIS. It is re-learned for the cost of one refresh per
+     * process, and a persisted "my clock is fast" belief would outlive the
+     * clock correction that made it false — which is precisely the stale-frame
+     * bug this whole guard exists to close, moved one level up.
+     *
+     * ⚠ Without this escape the `exp` guard alone is a REFRESH LOOP on any
+     * device whose clock is fast by more than the token TTL (default 60 min):
+     * every freshly-minted token would read as already expired, so every
+     * `getAccessToken()` would refresh, forever. That is why the fix is not
+     * simply "require `exp` too".
+     */
+    this.clockSkewConfirmed = false;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
     /**
@@ -686,6 +715,7 @@ var Auth = class {
       }
     }
     this.hydrated = true;
+    if (this.user && this.hooks.storage.get(REFRESH_KEY)) this.startProactiveRefreshCron();
     this.resolveReady();
   }
   getCurrentUser() {
@@ -847,7 +877,11 @@ var Auth = class {
    *
    * Resolution order:
    *  1. Cached token with comfortable life left (>= REFRESH_SAFETY_MS
-   *     skew before exp) → return it. Fast path, no I/O.
+   *     before BOTH the tracked deadline and the token's own `exp`) →
+   *     return it. Fast path, no I/O. See `canServeCachedToken` for why
+   *     both are required and when the second is released.
+   *     Pass `{ forceRefresh: true }` to skip this step when the caller
+   *     knows the tracked deadline is wrong.
    *  2. No cached token AND no refresh token in storage → genuinely
    *     signed out → null.
    *  3. Expired/near-expiry but a refresh chain exists:
@@ -865,14 +899,85 @@ var Auth = class {
    *        the cooldown for an immediate retry on resume.
    *     c. Otherwise → fire the refresh and await it.
    */
-  async getAccessToken() {
-    if (this.accessToken && this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
+  /**
+   * The cached-token guard, and the single place the two deadlines are
+   * combined. Both must agree before a cached token is served:
+   *
+   *  1. the locally-tracked deadline (`Date.now() + expiresIn` at mint) —
+   *     immune to a constantly-wrong clock, blind to a clock that MOVES;
+   *  2. the token's own `exp` — immune to a clock that moves, wrong by the
+   *     full offset on a constantly-wrong clock.
+   *
+   * Guard 2 is released once `clockSkewConfirmed` proves the second failure
+   * mode is the one we are actually in.
+   *
+   * The gap this closes: `accessExpiresAt` is written in the device's clock
+   * frame at mint and PERSISTED. Step the clock backwards between mint and
+   * read — an iPhone acquiring automatic time after a long power-off, a
+   * restore, or a manual set — and the deadline is stale by the size of the
+   * correction, surviving relaunches. The SDK then serves a provably dead
+   * token, every request 401s, and because the fast path returns before
+   * reaching `persist()` or `wipeLocalIdentity()` nothing emits
+   * `signed_out`. Reported by Word Hurdle with a token 1929s past its `exp`.
+   */
+  canServeToken(token, expiresAt, nowMs) {
+    if (!token || !expiresAt) return false;
+    if (nowMs >= expiresAt - REFRESH_SAFETY_MS) return false;
+    if (this.clockSkewConfirmed) return true;
+    return accessTokenExpIsFuture(token, nowMs);
+  }
+  canServeCachedToken(nowMs) {
+    return this.canServeToken(this.accessToken, this.accessExpiresAt, nowMs);
+  }
+  /** Guard 1 alone: does the locally-tracked deadline still claim life? */
+  trackedDeadlineAlive(nowMs) {
+    return !!this.accessToken && !!this.accessExpiresAt && nowMs < this.accessExpiresAt - REFRESH_SAFETY_MS;
+  }
+  /**
+   * Refresh — and when the two deadlines disagree, let the token that comes
+   * back say which one was lying.
+   *
+   * ⚠ THE TIMING IS THE WHOLE MECHANISM, and the obvious placement is wrong.
+   * Learning at every mint site looks equivalent and is not: in the reported
+   * failure the token was MINTED while the clock was fast and only read after
+   * the correction, so a mint-time probe records "clock is fast", and the flag
+   * then waves through the very token the guard exists to refuse. Probing here
+   * — only on a refresh we performed BECAUSE `exp` contradicted a tracked
+   * deadline that still claimed life — separates the two cases, because by now
+   * the clock has either been corrected (fresh token reads live → stale
+   * deadline, guard holds) or is genuinely fast (fresh token still reads dead
+   * → release the guard, one probe, no loop).
+   */
+  async refreshAndReconcile(nowMs) {
+    const reconciling = this.deadlinesDisagree(nowMs);
+    const token = await this.refreshAccessToken();
+    if (reconciling && token) this.learnClockSkewFrom(token, Date.now());
+    return token;
+  }
+  /**
+   * Record whether a token the server issued MOMENTS AGO already reads as
+   * expired. It cannot genuinely be — so a `false` here is proof the device
+   * clock runs fast, and releases the `exp` guard for this process.
+   *
+   * Call this at every site that installs a server-issued token, and only
+   * with a token that just arrived. Handing it a cached token would let a
+   * stale deadline confirm itself.
+   */
+  learnClockSkewFrom(freshToken, nowMs) {
+    if (!accessTokenExpIsFuture(freshToken, nowMs)) this.clockSkewConfirmed = true;
+  }
+  /** True when a cached token is unusable ONLY because its `exp` contradicts a live tracked deadline. */
+  deadlinesDisagree(nowMs) {
+    return this.trackedDeadlineAlive(nowMs) && !this.canServeCachedToken(nowMs);
+  }
+  async getAccessToken(options) {
+    if (!options?.forceRefresh && this.canServeCachedToken(Date.now())) {
       return this.accessToken;
     }
     if (!this.hooks.storage.get(REFRESH_KEY)) return null;
     if (this.refreshInflight) return this.refreshInflight;
     if (Date.now() < this.refreshCooldownUntil) return null;
-    return this.refreshAccessToken();
+    return this.refreshAndReconcile(Date.now());
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
   getAccessTokenSync() {
@@ -1230,6 +1335,56 @@ var Auth = class {
     }
     return { identities: parsed.data.identities ?? [], hasPassword: Boolean(parsed.data.hasPassword) };
   }
+  /**
+   * Remove one linked provider from the signed-in account.
+   *
+   * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+   * next to each entry on a Connected Accounts screen calls.
+   *
+   * ⚠ The server REFUSES to remove the last way into the account, with
+   * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+   * account with no credentials still exists and still holds the user's data,
+   * but nothing can ever authenticate into it again — so this is a permanent
+   * lockout, not an inconvenience. A password counts as a credential.
+   *
+   * Prefer to prevent the tap rather than explain the refusal: read
+   * `listLinkedIdentities()` and disable Disconnect when
+   * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+   * backstop, not the UX.
+   *
+   * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+   * provider is not linked to this account. Removing an already-absent
+   * provider is NOT treated as success — a silent no-op would let a buggy
+   * screen report "disconnected" for a credential that is still attached.
+   */
+  async unlink(provider) {
+    const token = await this.getAccessToken();
+    if (!token) throw new AuthError("NOT_SIGNED_IN", "Sign in before unlinking an identity");
+    const res = await del(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      `/api/v1/auth-service/me/identities/${encodeURIComponent(provider)}`,
+      { Authorization: `Bearer ${token}` }
+    );
+    if (!res) throw new AuthError("NETWORK_ERROR", "Failed to unlink identity");
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+    }
+    if (!parsed.success || !parsed.data) {
+      throw new AuthError(
+        parsed.error?.code ?? "UNLINK_FAILED",
+        parsed.error?.message ?? "Failed to unlink identity",
+        { status: res.status }
+      );
+    }
+    return {
+      provider: parsed.data.provider ?? provider,
+      removed: Number(parsed.data.removed ?? 0),
+      remaining: Number(parsed.data.remaining ?? 0)
+    };
+  }
   /**
    * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
    * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1689,7 +1844,7 @@ var Auth = class {
           const freshExpiresStr = this.hooks.storage.get(TOKEN_EXPIRES_KEY);
           if (freshAccess && freshExpiresStr) {
             const freshExpires = Number(freshExpiresStr);
-            if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
+            if (Number.isFinite(freshExpires) && this.canServeToken(freshAccess, freshExpires, Date.now())) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
               this.refreshFailureCount = 0;
@@ -1756,6 +1911,10 @@ var Auth = class {
     const tick = async () => {
       if (!this.accessToken || !this.accessExpiresAt) return;
       const now = Date.now();
+      if (!this.canServeCachedToken(now)) {
+        await this.refreshAndReconcile(now);
+        return;
+      }
       const lifetimeMs = this.accessExpiresAt - now;
       if (lifetimeMs <= 0) return;
       const guessOriginalMs = Math.max(lifetimeMs, 5 * 6e4);
@@ -1938,6 +2097,7 @@ var Auth = class {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
+    this.clockSkewConfirmed = false;
     this.lastTakeover = null;
     this.lastDeletionCancelled = null;
     this.lastAnonRetirement = null;
@@ -1966,6 +2126,13 @@ function readRotatedTokens(data) {
   if (typeof t.expiresIn !== "number" || t.expiresIn <= 0) return null;
   return { accessToken: t.accessToken, refreshToken: t.refreshToken, expiresIn: t.expiresIn };
 }
+function accessTokenExpIsFuture(token, nowMs) {
+  const claims = decodeJwtPayload(token);
+  if (!claims) return true;
+  const exp = claims.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return true;
+  return nowMs < exp * 1e3;
+}
 function decodeJwtPayload(token) {
   try {
     const parts = token.split(".");
@@ -2655,6 +2822,16 @@ var AUTH_HYDRATE_KEYS = [
 ];
 var SECURE_KEYS = ["auth_refresh_token", "auth_access_token", "auth_user"];
 var PUBLIC_KEY_RE = /^pk_(prod|staging|dev|live|test)_[A-Za-z0-9]{16,}$/;
+var STORAGE_PREFIX_RE = /^[A-Za-z0-9_.-]{1,64}$/;
+function normalizeStoragePrefix(prefix) {
+  if (prefix === void 0) return void 0;
+  if (typeof prefix !== "string" || !STORAGE_PREFIX_RE.test(prefix)) {
+    throw new Error(
+      `[sendora] init: storagePrefix must be 1-64 chars of A-Z a-z 0-9 _ . - (got ${JSON.stringify(prefix)}). Changing it signs the device out, so it is validated rather than ignored.`
+    );
+  }
+  return prefix;
+}
 var MAX_PUSH_TOKEN_BYTES = 4096;
 var MAX_PUSH_METADATA_BYTES = 4096;
 var MAX_USER_ID_LEN = 256;
@@ -2828,8 +3005,13 @@ var SendoraSDK = class {
         `[sendoracloud] apiUrl override active: ${apiUrl} \u2014 confirm this is intentional. Tokens + events will be sent here.`
       );
     }
-    if (config.secureStorage) {
-      this.storage = new Storage({ secureAdapter: config.secureStorage, secureKeys: SECURE_KEYS });
+    if (config.secureStorage || config.storagePrefix !== void 0) {
+      const prefix = normalizeStoragePrefix(config.storagePrefix);
+      this.storage = new Storage({
+        secureAdapter: config.secureStorage,
+        secureKeys: SECURE_KEYS,
+        prefix
+      });
     }
     await this.storage.hydrate([
       ANON_KEY,

package/dist/index.d.cts

@@ -104,6 +104,29 @@ interface SendoraConfig {
      * threat model. It is opt-in: adding it never changes an app that doesn't pass it.
      */
     secureStorage?: SecureStorageAdapter;
+    /**
+     * Namespace every on-device key this SDK owns. Omit for the historical
+     * `sendora_` prefix — the default is byte-identical to prior releases.
+     *
+     * For apps that point one codebase at more than one Sendora project
+     * (staging vs production, a debug build beside a release build). Without
+     * it, both environments share `sendora_*` on the same device: whichever
+     * launched last owns the session, and a debug sign-in can evict the
+     * release build's. A custom `secureStorage` adapter only fixes the half
+     * that goes through the adapter — `auth_access_expires` and the anon id
+     * stay in AsyncStorage and still collide.
+     *
+     * ⚠ CHANGING THIS SIGNS THE DEVICE OUT. Keys are the session's only
+     * durable handle, and the SDK does not migrate between prefixes — a new
+     * prefix reads an empty store and mints a fresh anonymous user. Pick one
+     * per environment before shipping and never change it afterwards. This is
+     * the same frozen-key rule as ADR-023, delegated to you.
+     *
+     * ⚠ Applies to the `secureStorage` adapter too when set (adapter keys are
+     * bare by default). If you already namespace inside your own adapter,
+     * either drop that and use this, or expect `<yours><ours>key`.
+     */
+    storagePrefix?: string;
 }
 /**
  * Async key/value adapter for encrypted-at-rest auth storage. Compatible with a
@@ -178,13 +201,30 @@ type StorageOptions = {
     secureAdapter?: SecureStorageAdapter | null;
     /** Keys routed through `secureAdapter` when it is present. Everything else stays in AsyncStorage. */
     secureKeys?: Iterable<string>;
+    /**
+     * Namespace for every key this SDK owns. Omit for the default `sendora_`.
+     *
+     * ⚠ Asymmetric by necessity, and the asymmetry is what keeps upgrades
+     * safe. When omitted, AsyncStorage keys keep the historical `sendora_`
+     * prefix and secure-adapter keys stay BARE — exactly what shipped before
+     * this option existed, so no installed app loses its session on upgrade.
+     * When supplied, the prefix applies to BOTH stores, because the whole
+     * point is that two environments sharing one device share nothing.
+     */
+    prefix?: string;
 };
 declare class Storage {
     private cache;
     private hydrated;
     private readonly secure;
     private readonly secureKeys;
+    /** Applied to AsyncStorage keys. */
+    private readonly prefix;
+    /** Applied to secure-adapter keys — empty unless a custom prefix was set. */
+    private readonly securePrefix;
     constructor(opts?: StorageOptions);
+    /** The adapter-facing name for a key. Bare by default; see `prefix`. */
+    private secureName;
     private isSecure;
     /**
      * Populate the memory cache from persistent storage. Must be awaited
@@ -402,6 +442,19 @@ type LinkedIdentitiesResponse = {
     identities: LinkedIdentity[];
     hasPassword: boolean;
 };
+/**
+ * Result of removing one provider from the signed-in account.
+ *
+ * `removed` can exceed 1: an account may hold more than one row for a provider
+ * (distinct provider user ids across projects), and unlinking takes all of them
+ * — the floor counts them all as leaving, so reporting only one would be a lie
+ * a caller could act on.
+ */
+type UnlinkResult = {
+    provider: string;
+    removed: number;
+    remaining: number;
+};
 /**
  * Closed set of auth failure categories (1.28.0). Branch on `kind` instead of
  * string-matching the ~20 raw `code`s the backend and transport can produce.
@@ -411,7 +464,7 @@ type LinkedIdentitiesResponse = {
  * OTP, a dismissed Game Center sheet and a 429 all leave `getUserSync()` and
  * the stored refresh token exactly as they were.
  */
-type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "already_identified" | "cancelled" | "config" | "unknown";
+type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "already_identified" | "cancelled" | "config" | "unknown";
 declare class AuthError extends Error {
     code: string;
     /**
@@ -517,6 +570,27 @@ declare class Auth {
     private user;
     private accessToken;
     private accessExpiresAt;
+    /**
+     * Set once we have PROOF that this device's clock runs fast, which
+     * releases the `exp` guard in `canServeCachedToken`.
+     *
+     * The proof is specific and cannot be faked by a stale deadline: a token
+     * the server minted *seconds ago* reads as already past its own `exp`.
+     * A freshly-issued token is never genuinely expired, so the only
+     * explanation is the clock we measured it with.
+     *
+     * ⚠ NEVER PERSIST THIS. It is re-learned for the cost of one refresh per
+     * process, and a persisted "my clock is fast" belief would outlive the
+     * clock correction that made it false — which is precisely the stale-frame
+     * bug this whole guard exists to close, moved one level up.
+     *
+     * ⚠ Without this escape the `exp` guard alone is a REFRESH LOOP on any
+     * device whose clock is fast by more than the token TTL (default 60 min):
+     * every freshly-minted token would read as already expired, so every
+     * `getAccessToken()` would refresh, forever. That is why the fix is not
+     * simply "require `exp` too".
+     */
+    private clockSkewConfirmed;
     private inflight;
     private refreshInflight;
     /**
@@ -686,7 +760,11 @@ declare class Auth {
      *
      * Resolution order:
      *  1. Cached token with comfortable life left (>= REFRESH_SAFETY_MS
-     *     skew before exp) → return it. Fast path, no I/O.
+     *     before BOTH the tracked deadline and the token's own `exp`) →
+     *     return it. Fast path, no I/O. See `canServeCachedToken` for why
+     *     both are required and when the second is released.
+     *     Pass `{ forceRefresh: true }` to skip this step when the caller
+     *     knows the tracked deadline is wrong.
      *  2. No cached token AND no refresh token in storage → genuinely
      *     signed out → null.
      *  3. Expired/near-expiry but a refresh chain exists:
@@ -704,7 +782,62 @@ declare class Auth {
      *        the cooldown for an immediate retry on resume.
      *     c. Otherwise → fire the refresh and await it.
      */
-    getAccessToken(): Promise<string | null>;
+    /**
+     * The cached-token guard, and the single place the two deadlines are
+     * combined. Both must agree before a cached token is served:
+     *
+     *  1. the locally-tracked deadline (`Date.now() + expiresIn` at mint) —
+     *     immune to a constantly-wrong clock, blind to a clock that MOVES;
+     *  2. the token's own `exp` — immune to a clock that moves, wrong by the
+     *     full offset on a constantly-wrong clock.
+     *
+     * Guard 2 is released once `clockSkewConfirmed` proves the second failure
+     * mode is the one we are actually in.
+     *
+     * The gap this closes: `accessExpiresAt` is written in the device's clock
+     * frame at mint and PERSISTED. Step the clock backwards between mint and
+     * read — an iPhone acquiring automatic time after a long power-off, a
+     * restore, or a manual set — and the deadline is stale by the size of the
+     * correction, surviving relaunches. The SDK then serves a provably dead
+     * token, every request 401s, and because the fast path returns before
+     * reaching `persist()` or `wipeLocalIdentity()` nothing emits
+     * `signed_out`. Reported by Word Hurdle with a token 1929s past its `exp`.
+     */
+    private canServeToken;
+    private canServeCachedToken;
+    /** Guard 1 alone: does the locally-tracked deadline still claim life? */
+    private trackedDeadlineAlive;
+    /**
+     * Refresh — and when the two deadlines disagree, let the token that comes
+     * back say which one was lying.
+     *
+     * ⚠ THE TIMING IS THE WHOLE MECHANISM, and the obvious placement is wrong.
+     * Learning at every mint site looks equivalent and is not: in the reported
+     * failure the token was MINTED while the clock was fast and only read after
+     * the correction, so a mint-time probe records "clock is fast", and the flag
+     * then waves through the very token the guard exists to refuse. Probing here
+     * — only on a refresh we performed BECAUSE `exp` contradicted a tracked
+     * deadline that still claimed life — separates the two cases, because by now
+     * the clock has either been corrected (fresh token reads live → stale
+     * deadline, guard holds) or is genuinely fast (fresh token still reads dead
+     * → release the guard, one probe, no loop).
+     */
+    private refreshAndReconcile;
+    /**
+     * Record whether a token the server issued MOMENTS AGO already reads as
+     * expired. It cannot genuinely be — so a `false` here is proof the device
+     * clock runs fast, and releases the `exp` guard for this process.
+     *
+     * Call this at every site that installs a server-issued token, and only
+     * with a token that just arrived. Handing it a cached token would let a
+     * stale deadline confirm itself.
+     */
+    private learnClockSkewFrom;
+    /** True when a cached token is unusable ONLY because its `exp` contradicts a live tracked deadline. */
+    private deadlinesDisagree;
+    getAccessToken(options?: {
+        forceRefresh?: boolean;
+    }): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
     getAccessTokenSync(): string | null;
     /**
@@ -914,6 +1047,29 @@ declare class Auth {
      * `deleteAccount`). Firebase `user.providerData` / Supabase `user.identities`.
      */
     listLinkedIdentities(): Promise<LinkedIdentitiesResponse>;
+    /**
+     * Remove one linked provider from the signed-in account.
+     *
+     * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+     * next to each entry on a Connected Accounts screen calls.
+     *
+     * ⚠ The server REFUSES to remove the last way into the account, with
+     * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+     * account with no credentials still exists and still holds the user's data,
+     * but nothing can ever authenticate into it again — so this is a permanent
+     * lockout, not an inconvenience. A password counts as a credential.
+     *
+     * Prefer to prevent the tap rather than explain the refusal: read
+     * `listLinkedIdentities()` and disable Disconnect when
+     * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+     * backstop, not the UX.
+     *
+     * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+     * provider is not linked to this account. Removing an already-absent
+     * provider is NOT treated as success — a silent no-op would let a buggy
+     * screen report "disconnected" for a credential that is still attached.
+     */
+    unlink(provider: string): Promise<UnlinkResult>;
     /**
      * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
      * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1918,4 +2074,4 @@ declare class SendoraSDK {
 }
 declare const SendoraCloud: SendoraSDK;
 
-export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };
+export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, type UnlinkResult, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };

package/dist/index.d.ts

@@ -104,6 +104,29 @@ interface SendoraConfig {
      * threat model. It is opt-in: adding it never changes an app that doesn't pass it.
      */
     secureStorage?: SecureStorageAdapter;
+    /**
+     * Namespace every on-device key this SDK owns. Omit for the historical
+     * `sendora_` prefix — the default is byte-identical to prior releases.
+     *
+     * For apps that point one codebase at more than one Sendora project
+     * (staging vs production, a debug build beside a release build). Without
+     * it, both environments share `sendora_*` on the same device: whichever
+     * launched last owns the session, and a debug sign-in can evict the
+     * release build's. A custom `secureStorage` adapter only fixes the half
+     * that goes through the adapter — `auth_access_expires` and the anon id
+     * stay in AsyncStorage and still collide.
+     *
+     * ⚠ CHANGING THIS SIGNS THE DEVICE OUT. Keys are the session's only
+     * durable handle, and the SDK does not migrate between prefixes — a new
+     * prefix reads an empty store and mints a fresh anonymous user. Pick one
+     * per environment before shipping and never change it afterwards. This is
+     * the same frozen-key rule as ADR-023, delegated to you.
+     *
+     * ⚠ Applies to the `secureStorage` adapter too when set (adapter keys are
+     * bare by default). If you already namespace inside your own adapter,
+     * either drop that and use this, or expect `<yours><ours>key`.
+     */
+    storagePrefix?: string;
 }
 /**
  * Async key/value adapter for encrypted-at-rest auth storage. Compatible with a
@@ -178,13 +201,30 @@ type StorageOptions = {
     secureAdapter?: SecureStorageAdapter | null;
     /** Keys routed through `secureAdapter` when it is present. Everything else stays in AsyncStorage. */
     secureKeys?: Iterable<string>;
+    /**
+     * Namespace for every key this SDK owns. Omit for the default `sendora_`.
+     *
+     * ⚠ Asymmetric by necessity, and the asymmetry is what keeps upgrades
+     * safe. When omitted, AsyncStorage keys keep the historical `sendora_`
+     * prefix and secure-adapter keys stay BARE — exactly what shipped before
+     * this option existed, so no installed app loses its session on upgrade.
+     * When supplied, the prefix applies to BOTH stores, because the whole
+     * point is that two environments sharing one device share nothing.
+     */
+    prefix?: string;
 };
 declare class Storage {
     private cache;
     private hydrated;
     private readonly secure;
     private readonly secureKeys;
+    /** Applied to AsyncStorage keys. */
+    private readonly prefix;
+    /** Applied to secure-adapter keys — empty unless a custom prefix was set. */
+    private readonly securePrefix;
     constructor(opts?: StorageOptions);
+    /** The adapter-facing name for a key. Bare by default; see `prefix`. */
+    private secureName;
     private isSecure;
     /**
      * Populate the memory cache from persistent storage. Must be awaited
@@ -402,6 +442,19 @@ type LinkedIdentitiesResponse = {
     identities: LinkedIdentity[];
     hasPassword: boolean;
 };
+/**
+ * Result of removing one provider from the signed-in account.
+ *
+ * `removed` can exceed 1: an account may hold more than one row for a provider
+ * (distinct provider user ids across projects), and unlinking takes all of them
+ * — the floor counts them all as leaving, so reporting only one would be a lie
+ * a caller could act on.
+ */
+type UnlinkResult = {
+    provider: string;
+    removed: number;
+    remaining: number;
+};
 /**
  * Closed set of auth failure categories (1.28.0). Branch on `kind` instead of
  * string-matching the ~20 raw `code`s the backend and transport can produce.
@@ -411,7 +464,7 @@ type LinkedIdentitiesResponse = {
  * OTP, a dismissed Game Center sheet and a 429 all leave `getUserSync()` and
  * the stored refresh token exactly as they were.
  */
-type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "already_identified" | "cancelled" | "config" | "unknown";
+type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "already_identified" | "cancelled" | "config" | "unknown";
 declare class AuthError extends Error {
     code: string;
     /**
@@ -517,6 +570,27 @@ declare class Auth {
     private user;
     private accessToken;
     private accessExpiresAt;
+    /**
+     * Set once we have PROOF that this device's clock runs fast, which
+     * releases the `exp` guard in `canServeCachedToken`.
+     *
+     * The proof is specific and cannot be faked by a stale deadline: a token
+     * the server minted *seconds ago* reads as already past its own `exp`.
+     * A freshly-issued token is never genuinely expired, so the only
+     * explanation is the clock we measured it with.
+     *
+     * ⚠ NEVER PERSIST THIS. It is re-learned for the cost of one refresh per
+     * process, and a persisted "my clock is fast" belief would outlive the
+     * clock correction that made it false — which is precisely the stale-frame
+     * bug this whole guard exists to close, moved one level up.
+     *
+     * ⚠ Without this escape the `exp` guard alone is a REFRESH LOOP on any
+     * device whose clock is fast by more than the token TTL (default 60 min):
+     * every freshly-minted token would read as already expired, so every
+     * `getAccessToken()` would refresh, forever. That is why the fix is not
+     * simply "require `exp` too".
+     */
+    private clockSkewConfirmed;
     private inflight;
     private refreshInflight;
     /**
@@ -686,7 +760,11 @@ declare class Auth {
      *
      * Resolution order:
      *  1. Cached token with comfortable life left (>= REFRESH_SAFETY_MS
-     *     skew before exp) → return it. Fast path, no I/O.
+     *     before BOTH the tracked deadline and the token's own `exp`) →
+     *     return it. Fast path, no I/O. See `canServeCachedToken` for why
+     *     both are required and when the second is released.
+     *     Pass `{ forceRefresh: true }` to skip this step when the caller
+     *     knows the tracked deadline is wrong.
      *  2. No cached token AND no refresh token in storage → genuinely
      *     signed out → null.
      *  3. Expired/near-expiry but a refresh chain exists:
@@ -704,7 +782,62 @@ declare class Auth {
      *        the cooldown for an immediate retry on resume.
      *     c. Otherwise → fire the refresh and await it.
      */
-    getAccessToken(): Promise<string | null>;
+    /**
+     * The cached-token guard, and the single place the two deadlines are
+     * combined. Both must agree before a cached token is served:
+     *
+     *  1. the locally-tracked deadline (`Date.now() + expiresIn` at mint) —
+     *     immune to a constantly-wrong clock, blind to a clock that MOVES;
+     *  2. the token's own `exp` — immune to a clock that moves, wrong by the
+     *     full offset on a constantly-wrong clock.
+     *
+     * Guard 2 is released once `clockSkewConfirmed` proves the second failure
+     * mode is the one we are actually in.
+     *
+     * The gap this closes: `accessExpiresAt` is written in the device's clock
+     * frame at mint and PERSISTED. Step the clock backwards between mint and
+     * read — an iPhone acquiring automatic time after a long power-off, a
+     * restore, or a manual set — and the deadline is stale by the size of the
+     * correction, surviving relaunches. The SDK then serves a provably dead
+     * token, every request 401s, and because the fast path returns before
+     * reaching `persist()` or `wipeLocalIdentity()` nothing emits
+     * `signed_out`. Reported by Word Hurdle with a token 1929s past its `exp`.
+     */
+    private canServeToken;
+    private canServeCachedToken;
+    /** Guard 1 alone: does the locally-tracked deadline still claim life? */
+    private trackedDeadlineAlive;
+    /**
+     * Refresh — and when the two deadlines disagree, let the token that comes
+     * back say which one was lying.
+     *
+     * ⚠ THE TIMING IS THE WHOLE MECHANISM, and the obvious placement is wrong.
+     * Learning at every mint site looks equivalent and is not: in the reported
+     * failure the token was MINTED while the clock was fast and only read after
+     * the correction, so a mint-time probe records "clock is fast", and the flag
+     * then waves through the very token the guard exists to refuse. Probing here
+     * — only on a refresh we performed BECAUSE `exp` contradicted a tracked
+     * deadline that still claimed life — separates the two cases, because by now
+     * the clock has either been corrected (fresh token reads live → stale
+     * deadline, guard holds) or is genuinely fast (fresh token still reads dead
+     * → release the guard, one probe, no loop).
+     */
+    private refreshAndReconcile;
+    /**
+     * Record whether a token the server issued MOMENTS AGO already reads as
+     * expired. It cannot genuinely be — so a `false` here is proof the device
+     * clock runs fast, and releases the `exp` guard for this process.
+     *
+     * Call this at every site that installs a server-issued token, and only
+     * with a token that just arrived. Handing it a cached token would let a
+     * stale deadline confirm itself.
+     */
+    private learnClockSkewFrom;
+    /** True when a cached token is unusable ONLY because its `exp` contradicts a live tracked deadline. */
+    private deadlinesDisagree;
+    getAccessToken(options?: {
+        forceRefresh?: boolean;
+    }): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
     getAccessTokenSync(): string | null;
     /**
@@ -914,6 +1047,29 @@ declare class Auth {
      * `deleteAccount`). Firebase `user.providerData` / Supabase `user.identities`.
      */
     listLinkedIdentities(): Promise<LinkedIdentitiesResponse>;
+    /**
+     * Remove one linked provider from the signed-in account.
+     *
+     * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+     * next to each entry on a Connected Accounts screen calls.
+     *
+     * ⚠ The server REFUSES to remove the last way into the account, with
+     * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+     * account with no credentials still exists and still holds the user's data,
+     * but nothing can ever authenticate into it again — so this is a permanent
+     * lockout, not an inconvenience. A password counts as a credential.
+     *
+     * Prefer to prevent the tap rather than explain the refusal: read
+     * `listLinkedIdentities()` and disable Disconnect when
+     * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+     * backstop, not the UX.
+     *
+     * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+     * provider is not linked to this account. Removing an already-absent
+     * provider is NOT treated as success — a silent no-op would let a buggy
+     * screen report "disconnected" for a credential that is still attached.
+     */
+    unlink(provider: string): Promise<UnlinkResult>;
     /**
      * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
      * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1918,4 +2074,4 @@ declare class SendoraSDK {
 }
 declare const SendoraCloud: SendoraSDK;
 
-export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };
+export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, type UnlinkResult, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };

package/dist/index.js

@@ -3,7 +3,7 @@ import "react-native-get-random-values";
 import { Platform } from "react-native";
 
 // src/storage.ts
-var PREFIX = "sendora_";
+var DEFAULT_PREFIX = "sendora_";
 var asyncStoragePromise = null;
 async function getAsyncStorage() {
   if (asyncStoragePromise) return asyncStoragePromise;
@@ -26,6 +26,12 @@ var Storage = class {
     this.hydrated = false;
     this.secure = opts.secureAdapter ?? null;
     this.secureKeys = new Set(opts.secureKeys ?? []);
+    this.prefix = opts.prefix ?? DEFAULT_PREFIX;
+    this.securePrefix = opts.prefix ?? "";
+  }
+  /** The adapter-facing name for a key. Bare by default; see `prefix`. */
+  secureName(key) {
+    return this.securePrefix + key;
   }
   isSecure(key) {
     return this.secure !== null && this.secureKeys.has(key);
@@ -46,7 +52,7 @@ var Storage = class {
         await this.hydrateSecureKey(k, store);
       } else if (store) {
         try {
-          const v = await store.getItem(PREFIX + k);
+          const v = await store.getItem(this.prefix + k);
           if (v !== null) this.cache.set(k, v);
         } catch {
         }
@@ -57,18 +63,18 @@ var Storage = class {
   /** Read a secure key: adapter first, else migrate legacy plaintext. Never throws. */
   async hydrateSecureKey(k, store) {
     try {
-      const secureVal = await this.secure.getItem(k);
+      const secureVal = await this.secure.getItem(this.secureName(k));
       if (secureVal !== null) {
         this.cache.set(k, secureVal);
         return;
       }
       if (store) {
-        const legacy = await store.getItem(PREFIX + k).catch(() => null);
+        const legacy = await store.getItem(this.prefix + k).catch(() => null);
         if (legacy !== null) {
           this.cache.set(k, legacy);
           try {
-            await this.secure.setItem(k, legacy);
-            await store.removeItem(PREFIX + k).catch(() => {
+            await this.secure.setItem(this.secureName(k), legacy);
+            await store.removeItem(this.prefix + k).catch(() => {
             });
           } catch {
           }
@@ -77,7 +83,7 @@ var Storage = class {
     } catch {
       if (store) {
         try {
-          const legacy = await store.getItem(PREFIX + k);
+          const legacy = await store.getItem(this.prefix + k);
           if (legacy !== null) this.cache.set(k, legacy);
         } catch {
         }
@@ -90,27 +96,27 @@ var Storage = class {
   set(key, value) {
     this.cache.set(key, value);
     if (this.isSecure(key)) {
-      void this.secure.setItem(key, value).catch(() => {
+      void this.secure.setItem(this.secureName(key), value).catch(() => {
         void getAsyncStorage().then((store) => {
-          if (store) store.setItem(PREFIX + key, value).catch(() => {
+          if (store) store.setItem(this.prefix + key, value).catch(() => {
           });
         });
       });
       return;
     }
     void getAsyncStorage().then((store) => {
-      if (store) store.setItem(PREFIX + key, value).catch(() => {
+      if (store) store.setItem(this.prefix + key, value).catch(() => {
       });
     });
   }
   remove(key) {
     this.cache.delete(key);
     if (this.isSecure(key)) {
-      void this.secure.removeItem(key).catch(() => {
+      void this.secure.removeItem(this.secureName(key)).catch(() => {
       });
     }
     void getAsyncStorage().then((store) => {
-      if (store) store.removeItem(PREFIX + key).catch(() => {
+      if (store) store.removeItem(this.prefix + key).catch(() => {
       });
     });
   }
@@ -126,7 +132,7 @@ var Storage = class {
     if (this.secure) {
       for (const k of this.secureKeys) {
         try {
-          await this.secure.removeItem(k);
+          await this.secure.removeItem(this.secureName(k));
         } catch {
         }
       }
@@ -137,13 +143,13 @@ var Storage = class {
     if (typeof store.getAllKeys === "function") {
       try {
         const all = await store.getAllKeys();
-        keys = all.filter((k) => k.startsWith(PREFIX));
+        keys = all.filter((k) => k.startsWith(this.prefix));
       } catch {
         keys = [];
       }
     }
     if (keys.length === 0) {
-      keys = Array.from(this.secureKeys).map((k) => PREFIX + k);
+      keys = Array.from(this.secureKeys).map((k) => this.prefix + k);
     }
     for (const k of keys) {
       try {
@@ -157,7 +163,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.33.0",
+  version: "1.35.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -213,7 +219,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -443,6 +449,8 @@ function classifyAuthErrorKind(code, status) {
       return "account_locked";
     case "CREDENTIAL_IN_USE":
       return "credential_in_use";
+    case "LAST_CREDENTIAL":
+      return "last_credential";
     case "NOT_ANONYMOUS":
     case "FORBIDDEN_NON_ANONYMOUS":
       return "already_identified";
@@ -550,6 +558,27 @@ var Auth = class {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
+    /**
+     * Set once we have PROOF that this device's clock runs fast, which
+     * releases the `exp` guard in `canServeCachedToken`.
+     *
+     * The proof is specific and cannot be faked by a stale deadline: a token
+     * the server minted *seconds ago* reads as already past its own `exp`.
+     * A freshly-issued token is never genuinely expired, so the only
+     * explanation is the clock we measured it with.
+     *
+     * ⚠ NEVER PERSIST THIS. It is re-learned for the cost of one refresh per
+     * process, and a persisted "my clock is fast" belief would outlive the
+     * clock correction that made it false — which is precisely the stale-frame
+     * bug this whole guard exists to close, moved one level up.
+     *
+     * ⚠ Without this escape the `exp` guard alone is a REFRESH LOOP on any
+     * device whose clock is fast by more than the token TTL (default 60 min):
+     * every freshly-minted token would read as already expired, so every
+     * `getAccessToken()` would refresh, forever. That is why the fix is not
+     * simply "require `exp` too".
+     */
+    this.clockSkewConfirmed = false;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
     /**
@@ -641,6 +670,7 @@ var Auth = class {
       }
     }
     this.hydrated = true;
+    if (this.user && this.hooks.storage.get(REFRESH_KEY)) this.startProactiveRefreshCron();
     this.resolveReady();
   }
   getCurrentUser() {
@@ -802,7 +832,11 @@ var Auth = class {
    *
    * Resolution order:
    *  1. Cached token with comfortable life left (>= REFRESH_SAFETY_MS
-   *     skew before exp) → return it. Fast path, no I/O.
+   *     before BOTH the tracked deadline and the token's own `exp`) →
+   *     return it. Fast path, no I/O. See `canServeCachedToken` for why
+   *     both are required and when the second is released.
+   *     Pass `{ forceRefresh: true }` to skip this step when the caller
+   *     knows the tracked deadline is wrong.
    *  2. No cached token AND no refresh token in storage → genuinely
    *     signed out → null.
    *  3. Expired/near-expiry but a refresh chain exists:
@@ -820,14 +854,85 @@ var Auth = class {
    *        the cooldown for an immediate retry on resume.
    *     c. Otherwise → fire the refresh and await it.
    */
-  async getAccessToken() {
-    if (this.accessToken && this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
+  /**
+   * The cached-token guard, and the single place the two deadlines are
+   * combined. Both must agree before a cached token is served:
+   *
+   *  1. the locally-tracked deadline (`Date.now() + expiresIn` at mint) —
+   *     immune to a constantly-wrong clock, blind to a clock that MOVES;
+   *  2. the token's own `exp` — immune to a clock that moves, wrong by the
+   *     full offset on a constantly-wrong clock.
+   *
+   * Guard 2 is released once `clockSkewConfirmed` proves the second failure
+   * mode is the one we are actually in.
+   *
+   * The gap this closes: `accessExpiresAt` is written in the device's clock
+   * frame at mint and PERSISTED. Step the clock backwards between mint and
+   * read — an iPhone acquiring automatic time after a long power-off, a
+   * restore, or a manual set — and the deadline is stale by the size of the
+   * correction, surviving relaunches. The SDK then serves a provably dead
+   * token, every request 401s, and because the fast path returns before
+   * reaching `persist()` or `wipeLocalIdentity()` nothing emits
+   * `signed_out`. Reported by Word Hurdle with a token 1929s past its `exp`.
+   */
+  canServeToken(token, expiresAt, nowMs) {
+    if (!token || !expiresAt) return false;
+    if (nowMs >= expiresAt - REFRESH_SAFETY_MS) return false;
+    if (this.clockSkewConfirmed) return true;
+    return accessTokenExpIsFuture(token, nowMs);
+  }
+  canServeCachedToken(nowMs) {
+    return this.canServeToken(this.accessToken, this.accessExpiresAt, nowMs);
+  }
+  /** Guard 1 alone: does the locally-tracked deadline still claim life? */
+  trackedDeadlineAlive(nowMs) {
+    return !!this.accessToken && !!this.accessExpiresAt && nowMs < this.accessExpiresAt - REFRESH_SAFETY_MS;
+  }
+  /**
+   * Refresh — and when the two deadlines disagree, let the token that comes
+   * back say which one was lying.
+   *
+   * ⚠ THE TIMING IS THE WHOLE MECHANISM, and the obvious placement is wrong.
+   * Learning at every mint site looks equivalent and is not: in the reported
+   * failure the token was MINTED while the clock was fast and only read after
+   * the correction, so a mint-time probe records "clock is fast", and the flag
+   * then waves through the very token the guard exists to refuse. Probing here
+   * — only on a refresh we performed BECAUSE `exp` contradicted a tracked
+   * deadline that still claimed life — separates the two cases, because by now
+   * the clock has either been corrected (fresh token reads live → stale
+   * deadline, guard holds) or is genuinely fast (fresh token still reads dead
+   * → release the guard, one probe, no loop).
+   */
+  async refreshAndReconcile(nowMs) {
+    const reconciling = this.deadlinesDisagree(nowMs);
+    const token = await this.refreshAccessToken();
+    if (reconciling && token) this.learnClockSkewFrom(token, Date.now());
+    return token;
+  }
+  /**
+   * Record whether a token the server issued MOMENTS AGO already reads as
+   * expired. It cannot genuinely be — so a `false` here is proof the device
+   * clock runs fast, and releases the `exp` guard for this process.
+   *
+   * Call this at every site that installs a server-issued token, and only
+   * with a token that just arrived. Handing it a cached token would let a
+   * stale deadline confirm itself.
+   */
+  learnClockSkewFrom(freshToken, nowMs) {
+    if (!accessTokenExpIsFuture(freshToken, nowMs)) this.clockSkewConfirmed = true;
+  }
+  /** True when a cached token is unusable ONLY because its `exp` contradicts a live tracked deadline. */
+  deadlinesDisagree(nowMs) {
+    return this.trackedDeadlineAlive(nowMs) && !this.canServeCachedToken(nowMs);
+  }
+  async getAccessToken(options) {
+    if (!options?.forceRefresh && this.canServeCachedToken(Date.now())) {
       return this.accessToken;
     }
     if (!this.hooks.storage.get(REFRESH_KEY)) return null;
     if (this.refreshInflight) return this.refreshInflight;
     if (Date.now() < this.refreshCooldownUntil) return null;
-    return this.refreshAccessToken();
+    return this.refreshAndReconcile(Date.now());
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
   getAccessTokenSync() {
@@ -1185,6 +1290,56 @@ var Auth = class {
     }
     return { identities: parsed.data.identities ?? [], hasPassword: Boolean(parsed.data.hasPassword) };
   }
+  /**
+   * Remove one linked provider from the signed-in account.
+   *
+   * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+   * next to each entry on a Connected Accounts screen calls.
+   *
+   * ⚠ The server REFUSES to remove the last way into the account, with
+   * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+   * account with no credentials still exists and still holds the user's data,
+   * but nothing can ever authenticate into it again — so this is a permanent
+   * lockout, not an inconvenience. A password counts as a credential.
+   *
+   * Prefer to prevent the tap rather than explain the refusal: read
+   * `listLinkedIdentities()` and disable Disconnect when
+   * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+   * backstop, not the UX.
+   *
+   * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+   * provider is not linked to this account. Removing an already-absent
+   * provider is NOT treated as success — a silent no-op would let a buggy
+   * screen report "disconnected" for a credential that is still attached.
+   */
+  async unlink(provider) {
+    const token = await this.getAccessToken();
+    if (!token) throw new AuthError("NOT_SIGNED_IN", "Sign in before unlinking an identity");
+    const res = await del(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      `/api/v1/auth-service/me/identities/${encodeURIComponent(provider)}`,
+      { Authorization: `Bearer ${token}` }
+    );
+    if (!res) throw new AuthError("NETWORK_ERROR", "Failed to unlink identity");
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+    }
+    if (!parsed.success || !parsed.data) {
+      throw new AuthError(
+        parsed.error?.code ?? "UNLINK_FAILED",
+        parsed.error?.message ?? "Failed to unlink identity",
+        { status: res.status }
+      );
+    }
+    return {
+      provider: parsed.data.provider ?? provider,
+      removed: Number(parsed.data.removed ?? 0),
+      remaining: Number(parsed.data.remaining ?? 0)
+    };
+  }
   /**
    * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
    * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1644,7 +1799,7 @@ var Auth = class {
           const freshExpiresStr = this.hooks.storage.get(TOKEN_EXPIRES_KEY);
           if (freshAccess && freshExpiresStr) {
             const freshExpires = Number(freshExpiresStr);
-            if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
+            if (Number.isFinite(freshExpires) && this.canServeToken(freshAccess, freshExpires, Date.now())) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
               this.refreshFailureCount = 0;
@@ -1711,6 +1866,10 @@ var Auth = class {
     const tick = async () => {
       if (!this.accessToken || !this.accessExpiresAt) return;
       const now = Date.now();
+      if (!this.canServeCachedToken(now)) {
+        await this.refreshAndReconcile(now);
+        return;
+      }
       const lifetimeMs = this.accessExpiresAt - now;
       if (lifetimeMs <= 0) return;
       const guessOriginalMs = Math.max(lifetimeMs, 5 * 6e4);
@@ -1893,6 +2052,7 @@ var Auth = class {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
+    this.clockSkewConfirmed = false;
     this.lastTakeover = null;
     this.lastDeletionCancelled = null;
     this.lastAnonRetirement = null;
@@ -1921,6 +2081,13 @@ function readRotatedTokens(data) {
   if (typeof t.expiresIn !== "number" || t.expiresIn <= 0) return null;
   return { accessToken: t.accessToken, refreshToken: t.refreshToken, expiresIn: t.expiresIn };
 }
+function accessTokenExpIsFuture(token, nowMs) {
+  const claims = decodeJwtPayload(token);
+  if (!claims) return true;
+  const exp = claims.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return true;
+  return nowMs < exp * 1e3;
+}
 function decodeJwtPayload(token) {
   try {
     const parts = token.split(".");
@@ -2615,6 +2782,16 @@ var AUTH_HYDRATE_KEYS = [
 ];
 var SECURE_KEYS = ["auth_refresh_token", "auth_access_token", "auth_user"];
 var PUBLIC_KEY_RE = /^pk_(prod|staging|dev|live|test)_[A-Za-z0-9]{16,}$/;
+var STORAGE_PREFIX_RE = /^[A-Za-z0-9_.-]{1,64}$/;
+function normalizeStoragePrefix(prefix) {
+  if (prefix === void 0) return void 0;
+  if (typeof prefix !== "string" || !STORAGE_PREFIX_RE.test(prefix)) {
+    throw new Error(
+      `[sendora] init: storagePrefix must be 1-64 chars of A-Z a-z 0-9 _ . - (got ${JSON.stringify(prefix)}). Changing it signs the device out, so it is validated rather than ignored.`
+    );
+  }
+  return prefix;
+}
 var MAX_PUSH_TOKEN_BYTES = 4096;
 var MAX_PUSH_METADATA_BYTES = 4096;
 var MAX_USER_ID_LEN = 256;
@@ -2788,8 +2965,13 @@ var SendoraSDK = class {
         `[sendoracloud] apiUrl override active: ${apiUrl} \u2014 confirm this is intentional. Tokens + events will be sent here.`
       );
     }
-    if (config.secureStorage) {
-      this.storage = new Storage({ secureAdapter: config.secureStorage, secureKeys: SECURE_KEYS });
+    if (config.secureStorage || config.storagePrefix !== void 0) {
+      const prefix = normalizeStoragePrefix(config.storagePrefix);
+      this.storage = new Storage({
+        secureAdapter: config.secureStorage,
+        secureKeys: SECURE_KEYS,
+        prefix
+      });
     }
     await this.storage.hydrate([
       ANON_KEY,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.33.0",
+  "version": "1.35.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -56,7 +56,7 @@
   "scripts": {
     "build": "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     "typecheck": "tsc --noEmit",
-    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts"
+    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts"
   },
   "devDependencies": {
     "@types/react": "^19.2.16",