@sendoracloud/sdk-react-native 1.34.0 → 1.36.0

package/dist/index.cjs

@@ -65,6 +65,12 @@ async function getAsyncStorage() {
   })();
   return asyncStoragePromise;
 }
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(message);
+}
 var Storage = class {
   constructor(opts = {}) {
     this.cache = /* @__PURE__ */ new Map();
@@ -73,6 +79,12 @@ var Storage = class {
     this.secureKeys = new Set(opts.secureKeys ?? []);
     this.prefix = opts.prefix ?? DEFAULT_PREFIX;
     this.securePrefix = opts.prefix ?? "";
+    if (this.secure === null && this.secureKeys.size > 0) {
+      warnOnce(
+        "no-secure-adapter",
+        "[sendora] No `secureStorage` adapter supplied \u2014 auth tokens (refresh token, access token, cached user) will be stored in PLAIN AsyncStorage, which is included in iOS/Android device backups. Pass `secureStorage` in init() with a Keychain/Keystore-backed adapter (e.g. expo-secure-store). The session still persists either way; this is about where the token rests."
+      );
+    }
   }
   /** The adapter-facing name for a key. Bare by default; see `prefix`. */
   secureName(key) {
@@ -126,6 +138,10 @@ var Storage = class {
         }
       }
     } catch {
+      warnOnce(
+        "secure-read-degraded",
+        "[sendora] The `secureStorage` adapter failed on read; falling back to plain AsyncStorage for this session. Tokens are preserved but no longer encrypted at rest. Check your adapter."
+      );
       if (store) {
         try {
           const legacy = await store.getItem(this.prefix + k);
@@ -142,6 +158,10 @@ var Storage = class {
     this.cache.set(key, value);
     if (this.isSecure(key)) {
       void this.secure.setItem(this.secureName(key), value).catch(() => {
+        warnOnce(
+          "secure-write-degraded",
+          "[sendora] The `secureStorage` adapter failed on write; this value fell back to plain AsyncStorage. The session is preserved but this token is no longer encrypted at rest. Check your adapter."
+        );
         void getAsyncStorage().then((store) => {
           if (store) store.setItem(this.prefix + key, value).catch(() => {
           });
@@ -208,7 +228,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.34.0",
+  version: "1.36.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -264,7 +284,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -494,6 +514,14 @@ function classifyAuthErrorKind(code, status) {
       return "account_locked";
     case "CREDENTIAL_IN_USE":
       return "credential_in_use";
+    case "LAST_CREDENTIAL":
+      return "last_credential";
+    // ⚠ MUST be a code case, not a status one. The tail of this function is
+    // `if (status >= 400) return "invalid_credential"`, which would otherwise
+    // claim the 403 and report a step-up refusal as a bad credential —
+    // documented as "needs NEW input", which is the opposite of the truth.
+    case "RECENT_AUTH_REQUIRED":
+      return "recent_auth_required";
     case "NOT_ANONYMOUS":
     case "FORBIDDEN_NON_ANONYMOUS":
       return "already_identified";
@@ -1333,6 +1361,56 @@ var Auth = class {
     }
     return { identities: parsed.data.identities ?? [], hasPassword: Boolean(parsed.data.hasPassword) };
   }
+  /**
+   * Remove one linked provider from the signed-in account.
+   *
+   * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+   * next to each entry on a Connected Accounts screen calls.
+   *
+   * ⚠ The server REFUSES to remove the last way into the account, with
+   * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+   * account with no credentials still exists and still holds the user's data,
+   * but nothing can ever authenticate into it again — so this is a permanent
+   * lockout, not an inconvenience. A password counts as a credential.
+   *
+   * Prefer to prevent the tap rather than explain the refusal: read
+   * `listLinkedIdentities()` and disable Disconnect when
+   * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+   * backstop, not the UX.
+   *
+   * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+   * provider is not linked to this account. Removing an already-absent
+   * provider is NOT treated as success — a silent no-op would let a buggy
+   * screen report "disconnected" for a credential that is still attached.
+   */
+  async unlink(provider) {
+    const token = await this.getAccessToken();
+    if (!token) throw new AuthError("NOT_SIGNED_IN", "Sign in before unlinking an identity");
+    const res = await del(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      `/api/v1/auth-service/me/identities/${encodeURIComponent(provider)}`,
+      { Authorization: `Bearer ${token}` }
+    );
+    if (!res) throw new AuthError("NETWORK_ERROR", "Failed to unlink identity");
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+    }
+    if (!parsed.success || !parsed.data) {
+      throw new AuthError(
+        parsed.error?.code ?? "UNLINK_FAILED",
+        parsed.error?.message ?? "Failed to unlink identity",
+        { status: res.status }
+      );
+    }
+    return {
+      provider: parsed.data.provider ?? provider,
+      removed: Number(parsed.data.removed ?? 0),
+      remaining: Number(parsed.data.remaining ?? 0)
+    };
+  }
   /**
    * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
    * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1530,13 +1608,24 @@ var Auth = class {
     const data = await this.unwrap(res, "MFA_CONFIRM_FAILED");
     return Boolean(data.confirmed);
   }
+  /**
+   * Disable MFA.
+   *
+   * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+   * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+   *
+   * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+   * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+   * surface — the app reported MFA as off while TOTP stayed enrolled.
+   */
   async disableMfa() {
-    await post(
+    const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/mfa/disable",
       {},
       this.bearerHeaders()
     );
+    await this.unwrap(res, "MFA_DISABLE_FAILED");
   }
   // ============================================================
   // DEVICE SESSIONS (Bearer-authenticated)
@@ -1551,19 +1640,28 @@ var Auth = class {
     const parsed = await res.json();
     return Array.isArray(parsed.data) ? parsed.data : [];
   }
+  /**
+   * Revoke one of the caller's own sessions ("sign out that device").
+   * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+   * that reports success on a failure is the one place a user acts on the claim
+   * and then stops worrying.
+   */
   async revokeSession(sessionId) {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       `/api/v1/auth-service/sessions/me/${encodeURIComponent(sessionId)}`,
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_FAILED");
   }
+  /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
   async revokeAllSessions() {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sessions/me",
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_ALL_FAILED");
   }
   /**
    * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).
@@ -1729,7 +1827,10 @@ var Auth = class {
     if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
     const parsed = await res.json().catch(() => ({}));
     if (!res.ok || !parsed.success) {
-      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`);
+      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`, {
+        status: res.status,
+        retryAfterSeconds: readRetryAfterSeconds(parsed)
+      });
     }
     return parsed.data;
   }

package/dist/index.d.cts

@@ -442,6 +442,19 @@ type LinkedIdentitiesResponse = {
     identities: LinkedIdentity[];
     hasPassword: boolean;
 };
+/**
+ * Result of removing one provider from the signed-in account.
+ *
+ * `removed` can exceed 1: an account may hold more than one row for a provider
+ * (distinct provider user ids across projects), and unlinking takes all of them
+ * — the floor counts them all as leaving, so reporting only one would be a lie
+ * a caller could act on.
+ */
+type UnlinkResult = {
+    provider: string;
+    removed: number;
+    remaining: number;
+};
 /**
  * Closed set of auth failure categories (1.28.0). Branch on `kind` instead of
  * string-matching the ~20 raw `code`s the backend and transport can produce.
@@ -451,7 +464,7 @@ type LinkedIdentitiesResponse = {
  * OTP, a dismissed Game Center sheet and a 429 all leave `getUserSync()` and
  * the stored refresh token exactly as they were.
  */
-type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "already_identified" | "cancelled" | "config" | "unknown";
+type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "recent_auth_required" | "already_identified" | "cancelled" | "config" | "unknown";
 declare class AuthError extends Error {
     code: string;
     /**
@@ -1034,6 +1047,29 @@ declare class Auth {
      * `deleteAccount`). Firebase `user.providerData` / Supabase `user.identities`.
      */
     listLinkedIdentities(): Promise<LinkedIdentitiesResponse>;
+    /**
+     * Remove one linked provider from the signed-in account.
+     *
+     * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+     * next to each entry on a Connected Accounts screen calls.
+     *
+     * ⚠ The server REFUSES to remove the last way into the account, with
+     * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+     * account with no credentials still exists and still holds the user's data,
+     * but nothing can ever authenticate into it again — so this is a permanent
+     * lockout, not an inconvenience. A password counts as a credential.
+     *
+     * Prefer to prevent the tap rather than explain the refusal: read
+     * `listLinkedIdentities()` and disable Disconnect when
+     * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+     * backstop, not the UX.
+     *
+     * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+     * provider is not linked to this account. Removing an already-absent
+     * provider is NOT treated as success — a silent no-op would let a buggy
+     * screen report "disconnected" for a credential that is still attached.
+     */
+    unlink(provider: string): Promise<UnlinkResult>;
     /**
      * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
      * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1073,6 +1109,16 @@ declare class Auth {
         recoveryCodes: string[];
     }>;
     confirmMfa(code: string): Promise<boolean>;
+    /**
+     * Disable MFA.
+     *
+     * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+     * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+     *
+     * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+     * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+     * surface — the app reported MFA as off while TOTP stayed enrolled.
+     */
     disableMfa(): Promise<void>;
     listMySessions(): Promise<Array<{
         id: string;
@@ -1081,7 +1127,14 @@ declare class Auth {
         lastUsedAt: string | null;
         createdAt: string;
     }>>;
+    /**
+     * Revoke one of the caller's own sessions ("sign out that device").
+     * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+     * that reports success on a failure is the one place a user acts on the claim
+     * and then stops worrying.
+     */
     revokeSession(sessionId: string): Promise<void>;
+    /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
     revokeAllSessions(): Promise<void>;
     /**
      * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).
@@ -2038,4 +2091,4 @@ declare class SendoraSDK {
 }
 declare const SendoraCloud: SendoraSDK;
 
-export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };
+export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, type UnlinkResult, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };

package/dist/index.d.ts

@@ -442,6 +442,19 @@ type LinkedIdentitiesResponse = {
     identities: LinkedIdentity[];
     hasPassword: boolean;
 };
+/**
+ * Result of removing one provider from the signed-in account.
+ *
+ * `removed` can exceed 1: an account may hold more than one row for a provider
+ * (distinct provider user ids across projects), and unlinking takes all of them
+ * — the floor counts them all as leaving, so reporting only one would be a lie
+ * a caller could act on.
+ */
+type UnlinkResult = {
+    provider: string;
+    removed: number;
+    remaining: number;
+};
 /**
  * Closed set of auth failure categories (1.28.0). Branch on `kind` instead of
  * string-matching the ~20 raw `code`s the backend and transport can produce.
@@ -451,7 +464,7 @@ type LinkedIdentitiesResponse = {
  * OTP, a dismissed Game Center sheet and a 429 all leave `getUserSync()` and
  * the stored refresh token exactly as they were.
  */
-type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "already_identified" | "cancelled" | "config" | "unknown";
+type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "recent_auth_required" | "already_identified" | "cancelled" | "config" | "unknown";
 declare class AuthError extends Error {
     code: string;
     /**
@@ -1034,6 +1047,29 @@ declare class Auth {
      * `deleteAccount`). Firebase `user.providerData` / Supabase `user.identities`.
      */
     listLinkedIdentities(): Promise<LinkedIdentitiesResponse>;
+    /**
+     * Remove one linked provider from the signed-in account.
+     *
+     * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+     * next to each entry on a Connected Accounts screen calls.
+     *
+     * ⚠ The server REFUSES to remove the last way into the account, with
+     * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+     * account with no credentials still exists and still holds the user's data,
+     * but nothing can ever authenticate into it again — so this is a permanent
+     * lockout, not an inconvenience. A password counts as a credential.
+     *
+     * Prefer to prevent the tap rather than explain the refusal: read
+     * `listLinkedIdentities()` and disable Disconnect when
+     * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+     * backstop, not the UX.
+     *
+     * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+     * provider is not linked to this account. Removing an already-absent
+     * provider is NOT treated as success — a silent no-op would let a buggy
+     * screen report "disconnected" for a credential that is still attached.
+     */
+    unlink(provider: string): Promise<UnlinkResult>;
     /**
      * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
      * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1073,6 +1109,16 @@ declare class Auth {
         recoveryCodes: string[];
     }>;
     confirmMfa(code: string): Promise<boolean>;
+    /**
+     * Disable MFA.
+     *
+     * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+     * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+     *
+     * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+     * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+     * surface — the app reported MFA as off while TOTP stayed enrolled.
+     */
     disableMfa(): Promise<void>;
     listMySessions(): Promise<Array<{
         id: string;
@@ -1081,7 +1127,14 @@ declare class Auth {
         lastUsedAt: string | null;
         createdAt: string;
     }>>;
+    /**
+     * Revoke one of the caller's own sessions ("sign out that device").
+     * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+     * that reports success on a failure is the one place a user acts on the claim
+     * and then stops worrying.
+     */
     revokeSession(sessionId: string): Promise<void>;
+    /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
     revokeAllSessions(): Promise<void>;
     /**
      * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).
@@ -2038,4 +2091,4 @@ declare class SendoraSDK {
 }
 declare const SendoraCloud: SendoraSDK;
 
-export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };
+export { AlreadyIdentifiedError, type AnonRetirementOutcome, type AttachLinkingApiOptions, Auth, AuthError, type AuthErrorKind, type AuthSignedOutReason, type AuthStateChange, type AuthTokens, type AuthUser, type CredentialCollisionPolicy, CredentialInUseError, type DeletionCancelledEvent, type DeviceTakeoverEvent, EmailAlreadyTakenError, type GameSignInOptions, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, type LinkedIdentitiesResponse, type LinkedIdentity, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, type UnlinkResult, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };

package/dist/index.js

@@ -20,6 +20,12 @@ async function getAsyncStorage() {
   })();
   return asyncStoragePromise;
 }
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(message);
+}
 var Storage = class {
   constructor(opts = {}) {
     this.cache = /* @__PURE__ */ new Map();
@@ -28,6 +34,12 @@ var Storage = class {
     this.secureKeys = new Set(opts.secureKeys ?? []);
     this.prefix = opts.prefix ?? DEFAULT_PREFIX;
     this.securePrefix = opts.prefix ?? "";
+    if (this.secure === null && this.secureKeys.size > 0) {
+      warnOnce(
+        "no-secure-adapter",
+        "[sendora] No `secureStorage` adapter supplied \u2014 auth tokens (refresh token, access token, cached user) will be stored in PLAIN AsyncStorage, which is included in iOS/Android device backups. Pass `secureStorage` in init() with a Keychain/Keystore-backed adapter (e.g. expo-secure-store). The session still persists either way; this is about where the token rests."
+      );
+    }
   }
   /** The adapter-facing name for a key. Bare by default; see `prefix`. */
   secureName(key) {
@@ -81,6 +93,10 @@ var Storage = class {
         }
       }
     } catch {
+      warnOnce(
+        "secure-read-degraded",
+        "[sendora] The `secureStorage` adapter failed on read; falling back to plain AsyncStorage for this session. Tokens are preserved but no longer encrypted at rest. Check your adapter."
+      );
       if (store) {
         try {
           const legacy = await store.getItem(this.prefix + k);
@@ -97,6 +113,10 @@ var Storage = class {
     this.cache.set(key, value);
     if (this.isSecure(key)) {
       void this.secure.setItem(this.secureName(key), value).catch(() => {
+        warnOnce(
+          "secure-write-degraded",
+          "[sendora] The `secureStorage` adapter failed on write; this value fell back to plain AsyncStorage. The session is preserved but this token is no longer encrypted at rest. Check your adapter."
+        );
         void getAsyncStorage().then((store) => {
           if (store) store.setItem(this.prefix + key, value).catch(() => {
           });
@@ -163,7 +183,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.34.0",
+  version: "1.36.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -219,7 +239,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -449,6 +469,14 @@ function classifyAuthErrorKind(code, status) {
       return "account_locked";
     case "CREDENTIAL_IN_USE":
       return "credential_in_use";
+    case "LAST_CREDENTIAL":
+      return "last_credential";
+    // ⚠ MUST be a code case, not a status one. The tail of this function is
+    // `if (status >= 400) return "invalid_credential"`, which would otherwise
+    // claim the 403 and report a step-up refusal as a bad credential —
+    // documented as "needs NEW input", which is the opposite of the truth.
+    case "RECENT_AUTH_REQUIRED":
+      return "recent_auth_required";
     case "NOT_ANONYMOUS":
     case "FORBIDDEN_NON_ANONYMOUS":
       return "already_identified";
@@ -1288,6 +1316,56 @@ var Auth = class {
     }
     return { identities: parsed.data.identities ?? [], hasPassword: Boolean(parsed.data.hasPassword) };
   }
+  /**
+   * Remove one linked provider from the signed-in account.
+   *
+   * The write half of `listLinkedIdentities()` — what a "Disconnect" button
+   * next to each entry on a Connected Accounts screen calls.
+   *
+   * ⚠ The server REFUSES to remove the last way into the account, with
+   * `AuthError` `code: "LAST_CREDENTIAL"` / `kind: "last_credential"`. An
+   * account with no credentials still exists and still holds the user's data,
+   * but nothing can ever authenticate into it again — so this is a permanent
+   * lockout, not an inconvenience. A password counts as a credential.
+   *
+   * Prefer to prevent the tap rather than explain the refusal: read
+   * `listLinkedIdentities()` and disable Disconnect when
+   * `identities.length + (hasPassword ? 1 : 0) <= 1`. The error is the
+   * backstop, not the UX.
+   *
+   * Throws `NOT_SIGNED_IN` when there is no session, and `NOT_FOUND` when the
+   * provider is not linked to this account. Removing an already-absent
+   * provider is NOT treated as success — a silent no-op would let a buggy
+   * screen report "disconnected" for a credential that is still attached.
+   */
+  async unlink(provider) {
+    const token = await this.getAccessToken();
+    if (!token) throw new AuthError("NOT_SIGNED_IN", "Sign in before unlinking an identity");
+    const res = await del(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      `/api/v1/auth-service/me/identities/${encodeURIComponent(provider)}`,
+      { Authorization: `Bearer ${token}` }
+    );
+    if (!res) throw new AuthError("NETWORK_ERROR", "Failed to unlink identity");
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+    }
+    if (!parsed.success || !parsed.data) {
+      throw new AuthError(
+        parsed.error?.code ?? "UNLINK_FAILED",
+        parsed.error?.message ?? "Failed to unlink identity",
+        { status: res.status }
+      );
+    }
+    return {
+      provider: parsed.data.provider ?? provider,
+      removed: Number(parsed.data.removed ?? 0),
+      remaining: Number(parsed.data.remaining ?? 0)
+    };
+  }
   /**
    * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
    * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1485,13 +1563,24 @@ var Auth = class {
     const data = await this.unwrap(res, "MFA_CONFIRM_FAILED");
     return Boolean(data.confirmed);
   }
+  /**
+   * Disable MFA.
+   *
+   * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+   * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+   *
+   * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+   * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+   * surface — the app reported MFA as off while TOTP stayed enrolled.
+   */
   async disableMfa() {
-    await post(
+    const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/mfa/disable",
       {},
       this.bearerHeaders()
     );
+    await this.unwrap(res, "MFA_DISABLE_FAILED");
   }
   // ============================================================
   // DEVICE SESSIONS (Bearer-authenticated)
@@ -1506,19 +1595,28 @@ var Auth = class {
     const parsed = await res.json();
     return Array.isArray(parsed.data) ? parsed.data : [];
   }
+  /**
+   * Revoke one of the caller's own sessions ("sign out that device").
+   * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+   * that reports success on a failure is the one place a user acts on the claim
+   * and then stops worrying.
+   */
   async revokeSession(sessionId) {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       `/api/v1/auth-service/sessions/me/${encodeURIComponent(sessionId)}`,
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_FAILED");
   }
+  /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
   async revokeAllSessions() {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sessions/me",
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_ALL_FAILED");
   }
   /**
    * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).
@@ -1684,7 +1782,10 @@ var Auth = class {
     if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
     const parsed = await res.json().catch(() => ({}));
     if (!res.ok || !parsed.success) {
-      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`);
+      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`, {
+        status: res.status,
+        retryAfterSeconds: readRetryAfterSeconds(parsed)
+      });
     }
     return parsed.data;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.34.0",
+  "version": "1.36.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -56,7 +56,7 @@
   "scripts": {
     "build": "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     "typecheck": "tsc --noEmit",
-    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts"
+    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts"
   },
   "devDependencies": {
     "@types/react": "^19.2.16",