@sendoracloud/sdk-react-native 1.41.0 → 1.41.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 1.41.1 — a dead session is `session_expired` again; the server's detail moves to `endReason`
+
+**Fix to a 1.41.0 behaviour change (ADR-023: a new value is additive only for a NEW situation).**
+A session that died on a server-rejected refresh was reported as `session_expired` through
+1.40.0. 1.41.0 reported the server's own verdict as the reason instead (`revoked` / `deleted`),
+which gave two old situations new names: "account deleted on another device" and "sessions
+revoked". Adding a value to a union is additive for the compiler, not for a listener that
+matched the old value. A listener that acted only on `session_expired` (the documented pattern, and
+the RopoLabs template's session-death handler) silently ignored both, leaving the app on a
+signed-in screen where every request fails. Reported by RopoLabs against the published
+tarball before any production install.
+
+- `signed_out.reason` is `session_expired` for EVERY server-rejected refresh, exactly as 1.40.0.
+- New optional `signed_out.endReason`: the server's verdict (`revoked` | `deleted` | `expired` |
+  `reuse` | `unknown`; `evicted` reserved). Present only when the server sent one; absent on
+  `user` / `account_deleted` and from an older backend.
+- `revoked` / `evicted` / `deleted` stay in `AuthSignedOutReason` so code written against 1.41.0
+  compiles; they are never emitted again. If you shipped 1.41.0 with a listener matching them,
+  it keeps compiling and stops firing — match `session_expired` (and read `endReason`).
+- Nothing else changed: same storage, same wipe effects (no anon-id rotation on a session death),
+  same held-slot release rules.
+
+Parity: web 3.24.1 / iOS 5.4.1 / Android 4.26.1. Guard: `test/auth-machine-conformance.test.ts`
+`refresh_dead.current` (every endReason incl. `evicted` / `unknown` / absent → `session_expired` +
+the exact `endReason`, key absent when the server sent none).
+
 ## 1.41.0 — sign-in no longer retires the guest: it is held on the device (ADR-033 wave 1)
 
 **Two semantic changes, both strictly less destructive than before; everything else is additive

package/README.md

@@ -303,7 +303,7 @@ This SDK is on the **1.x line**. Patch bumps (1.x.y → 1.x.z) are backwards-com
 
 ### Auth state is a transition stream, not a health signal
 
-`auth.onAuthStateChanged()` reports confirmed transitions only — `signed_in` (`cause`: `mint` | `sign_in` | `restore` | `link`), `signed_out` (reason `user` | `session_expired` | `account_deleted` | `revoked` | `evicted` | `deleted`), `user_updated`, `guest_held`, `guest_released`, `session_withheld`, `device_takeover`, `deletion_cancelled`. Each subscriber first receives one `initial{status, user}` (1.41.0); with a live session it is followed by the same `signed_in{user}` replay 1.28–1.40 sent (no `cause`), so existing listeners keep working. New code: read `initial` and treat a cause-less `signed_in` right after it as the replay. A transient failure of the background token refresh (offline, timeout, HTTP 429, 5xx) emits **nothing**: the stored refresh token is kept and the refresh retried with backoff, so no state changed. "No event" means "no confirmed transition", never "the session is fine". Only a server-rejected refresh token produces `signed_out(session_expired)`. For liveness, read `getAccessToken()` — `null` means no usable token right now.
+`auth.onAuthStateChanged()` reports confirmed transitions only — `signed_in` (`cause`: `mint` | `sign_in` | `restore` | `link`), `signed_out` (reason `user` | `session_expired` | `account_deleted`; a session the server killed is always `session_expired`, with the server's verdict in `endReason` — `revoked` | `deleted` | `expired` | `reuse` | `unknown` — since 1.41.1), `user_updated`, `guest_held`, `guest_released`, `session_withheld`, `device_takeover`, `deletion_cancelled`. Each subscriber first receives one `initial{status, user}` (1.41.0); with a live session it is followed by the same `signed_in{user}` replay 1.28–1.40 sent (no `cause`), so existing listeners keep working. New code: read `initial` and treat a cause-less `signed_in` right after it as the replay. A transient failure of the background token refresh (offline, timeout, HTTP 429, 5xx) emits **nothing**: the stored refresh token is kept and the refresh retried with backoff, so no state changed. "No event" means "no confirmed transition", never "the session is fine". Only a server-rejected refresh token produces `signed_out(session_expired)`. For liveness, read `getAccessToken()` — `null` means no usable token right now.
 
 `signInAnonymously()` returns the **current** session when one exists, anonymous or identified — it never replaces a signed-in account with a guest. Pass `forceNew: true` to deliberately leave the current session and mint a fresh anonymous one (a guest left this way is held, not lost).
 

package/dist/index.cjs

@@ -263,7 +263,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.41.0",
+  version: "1.41.1",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -2931,7 +2931,7 @@ var Auth = class {
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           if (this.hooks.storage.get(REFRESH_KEY) === sent) {
-            await this.commitAsync({ kind: "clear", reason: signedOutReasonFor(err.endReason), expectRefresh: sent });
+            await this.commitAsync({ kind: "clear", reason: "session_expired", endReason: err.endReason, expectRefresh: sent });
           } else {
             const i = this.held.findIndex((h) => h?.refreshToken === sent);
             if (i !== -1 && err.endReason !== void 0 && RELEASE_HELD_ON_END_REASONS.includes(err.endReason)) {
@@ -3207,7 +3207,9 @@ var Auth = class {
     if (reason === "stale_blob" || reason === "replaced") return { status: "applied", held: false };
     if (reason === "user" && prevRefresh) this.revokeFireAndForget(prevRefresh);
     this.pendingWipeHook = this.wipeLocalIdentity(reason);
-    this.emitAuthState({ event: "signed_out", user: null, reason });
+    this.emitAuthState(
+      tx.endReason !== void 0 ? { event: "signed_out", user: null, reason, endReason: tx.endReason } : { event: "signed_out", user: null, reason }
+    );
     return { status: "applied", held: false };
   }
   /**
@@ -3390,18 +3392,6 @@ var Auth = class {
     else this.hooks.storage.remove(key);
   }
 };
-function signedOutReasonFor(endReason) {
-  switch (endReason) {
-    case "revoked":
-      return "revoked";
-    case "deleted":
-      return "deleted";
-    case "evicted":
-      return "evicted";
-    default:
-      return "session_expired";
-  }
-}
 function isDeadRefreshError(code) {
   if (!code) return false;
   return DEAD_CODES.includes(code);

package/dist/index.d.cts

@@ -761,12 +761,17 @@ interface DeletionCancelledEvent {
  * Why the local session ended.
  *
  * - `user`            — the app called `signOut()` (or `discardWithheld()`).
- * - `session_expired` — the server rejected the stored refresh token with no
- *                       finer reason (or `endReason: expired | reuse | unknown`).
+ * - `session_expired` — the server rejected the stored refresh token. EVERY
+ *                       dead verdict, whatever the server's detail: read the
+ *                       event's `endReason` (`revoked` / `deleted` / `expired` /
+ *                       `reuse` / `unknown`) for that.
  * - `account_deleted` — `deleteAccount()` succeeded.
- * - `revoked` / `evicted` / `deleted` — ADR-033 B11 (additive): the server's
- *                       own `endReason` on the dead-token verdict. `evicted` is
- *                       reserved and not emitted by the backend yet.
+ * - `revoked` / `evicted` / `deleted` — ⚠ emitted by 1.41.0 ONLY, never since
+ *                       1.41.1. 1.41.0 put the server's `endReason` here, which
+ *                       renamed "account deleted elsewhere" / "sessions revoked"
+ *                       (both `session_expired` through 1.40.0) and silently
+ *                       broke listeners matching `session_expired`. Kept in the
+ *                       type so code written against 1.41.0 still compiles.
  *
  * Transient network failures and rate limits never produce any of these.
  * Consumers default-branch (§3.5 NORMATIVE).
@@ -792,10 +797,13 @@ type AuthStateChange = {
     event: "signed_in";
     user: AuthUser;
     cause?: AuthSignedInCause;
-} | {
+}
+/** `endReason` (1.41.1) = the server's own verdict on a dead refresh token; absent on `user` / `account_deleted` and from an older backend. */
+ | {
     event: "signed_out";
     user: null;
     reason: AuthSignedOutReason;
+    endReason?: RefreshEndReason;
 } | {
     event: "device_takeover";
     user: AuthUser | null;

package/dist/index.d.ts

@@ -761,12 +761,17 @@ interface DeletionCancelledEvent {
  * Why the local session ended.
  *
  * - `user`            — the app called `signOut()` (or `discardWithheld()`).
- * - `session_expired` — the server rejected the stored refresh token with no
- *                       finer reason (or `endReason: expired | reuse | unknown`).
+ * - `session_expired` — the server rejected the stored refresh token. EVERY
+ *                       dead verdict, whatever the server's detail: read the
+ *                       event's `endReason` (`revoked` / `deleted` / `expired` /
+ *                       `reuse` / `unknown`) for that.
  * - `account_deleted` — `deleteAccount()` succeeded.
- * - `revoked` / `evicted` / `deleted` — ADR-033 B11 (additive): the server's
- *                       own `endReason` on the dead-token verdict. `evicted` is
- *                       reserved and not emitted by the backend yet.
+ * - `revoked` / `evicted` / `deleted` — ⚠ emitted by 1.41.0 ONLY, never since
+ *                       1.41.1. 1.41.0 put the server's `endReason` here, which
+ *                       renamed "account deleted elsewhere" / "sessions revoked"
+ *                       (both `session_expired` through 1.40.0) and silently
+ *                       broke listeners matching `session_expired`. Kept in the
+ *                       type so code written against 1.41.0 still compiles.
  *
  * Transient network failures and rate limits never produce any of these.
  * Consumers default-branch (§3.5 NORMATIVE).
@@ -792,10 +797,13 @@ type AuthStateChange = {
     event: "signed_in";
     user: AuthUser;
     cause?: AuthSignedInCause;
-} | {
+}
+/** `endReason` (1.41.1) = the server's own verdict on a dead refresh token; absent on `user` / `account_deleted` and from an older backend. */
+ | {
     event: "signed_out";
     user: null;
     reason: AuthSignedOutReason;
+    endReason?: RefreshEndReason;
 } | {
     event: "device_takeover";
     user: AuthUser | null;

package/dist/index.js

@@ -212,7 +212,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.41.0",
+  version: "1.41.1",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -2880,7 +2880,7 @@ var Auth = class {
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           if (this.hooks.storage.get(REFRESH_KEY) === sent) {
-            await this.commitAsync({ kind: "clear", reason: signedOutReasonFor(err.endReason), expectRefresh: sent });
+            await this.commitAsync({ kind: "clear", reason: "session_expired", endReason: err.endReason, expectRefresh: sent });
           } else {
             const i = this.held.findIndex((h) => h?.refreshToken === sent);
             if (i !== -1 && err.endReason !== void 0 && RELEASE_HELD_ON_END_REASONS.includes(err.endReason)) {
@@ -3156,7 +3156,9 @@ var Auth = class {
     if (reason === "stale_blob" || reason === "replaced") return { status: "applied", held: false };
     if (reason === "user" && prevRefresh) this.revokeFireAndForget(prevRefresh);
     this.pendingWipeHook = this.wipeLocalIdentity(reason);
-    this.emitAuthState({ event: "signed_out", user: null, reason });
+    this.emitAuthState(
+      tx.endReason !== void 0 ? { event: "signed_out", user: null, reason, endReason: tx.endReason } : { event: "signed_out", user: null, reason }
+    );
     return { status: "applied", held: false };
   }
   /**
@@ -3339,18 +3341,6 @@ var Auth = class {
     else this.hooks.storage.remove(key);
   }
 };
-function signedOutReasonFor(endReason) {
-  switch (endReason) {
-    case "revoked":
-      return "revoked";
-    case "deleted":
-      return "deleted";
-    case "evicted":
-      return "evicted";
-    default:
-      return "session_expired";
-  }
-}
 function isDeadRefreshError(code) {
   if (!code) return false;
   return DEAD_CODES.includes(code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.41.0",
+  "version": "1.41.1",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",