@sendoracloud/sdk-react-native 1.41.0 → 1.41.2

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.41.2 — claiming or restoring a held guest works on a real phone
+
+**Fix (reported by TapMap: `merge()` / `claimHeldGuest()` returned 401 on an iPhone after every sign-in).** Before the server fix (e09c86dc, already live), `/token/refresh` preferred the `sd_rt` refresh cookie over the token in the request body. A phone keeps a native cookie jar, and after a sign-in that jar holds the ACCOUNT's cookie — so refreshing a HELD guest's token was answered for the account, and the SDK wrote the account's token into the guest's slot. The device lost its only copy of the guest's credential; `claimHeldGuest()` / `merge()` then failed with 401 and `restoreHeldGuest()` released the guest. The guest's account was never touched on the server.
+
+- **No cookies.** Every SDK request now sends `credentials: "omit"`, so React Native's native cookie jar is neither read nor written (iOS `HTTPShouldHandleCookies = NO`, Android `CookieJar.NO_COOKIES`). The SDK never used cookies — it authenticates with the API key header and tokens in the body.
+- **Identity check on a held refresh.** A held guest's refresh must come back for that guest. A response for anyone else now throws `HELD_GUEST_IDENTITY_MISMATCH` and changes nothing: the slot keeps the guest's own token, no `/merge`, nothing installed, nothing released.
+- No action needed for apps on 1.41.0 / 1.41.1: the server fix already covers them. Upgrade for the belt-and-braces. Same fix in web 3.24.2 / iOS 5.4.2 / Android 4.26.2.
+
+## 1.41.1 — a dead session is `session_expired` again; the server's detail moves to `endReason`
+
+**Fix to a 1.41.0 behaviour change (ADR-023: a new value is additive only for a NEW situation).**
+A session that died on a server-rejected refresh was reported as `session_expired` through
+1.40.0. 1.41.0 reported the server's own verdict as the reason instead (`revoked` / `deleted`),
+which gave two old situations new names: "account deleted on another device" and "sessions
+revoked". Adding a value to a union is additive for the compiler, not for a listener that
+matched the old value. A listener that acted only on `session_expired` (the documented pattern, and
+the RopoLabs template's session-death handler) silently ignored both, leaving the app on a
+signed-in screen where every request fails. Reported by RopoLabs against the published
+tarball before any production install.
+
+- `signed_out.reason` is `session_expired` for EVERY server-rejected refresh, exactly as 1.40.0.
+- New optional `signed_out.endReason`: the server's verdict (`revoked` | `deleted` | `expired` |
+  `reuse` | `unknown`; `evicted` reserved). Present only when the server sent one; absent on
+  `user` / `account_deleted` and from an older backend.
+- `revoked` / `evicted` / `deleted` stay in `AuthSignedOutReason` so code written against 1.41.0
+  compiles; they are never emitted again. If you shipped 1.41.0 with a listener matching them,
+  it keeps compiling and stops firing — match `session_expired` (and read `endReason`).
+- Nothing else changed: same storage, same wipe effects (no anon-id rotation on a session death),
+  same held-slot release rules.
+
+Parity: web 3.24.1 / iOS 5.4.1 / Android 4.26.1. Guard: `test/auth-machine-conformance.test.ts`
+`refresh_dead.current` (every endReason incl. `evicted` / `unknown` / absent → `session_expired` +
+the exact `endReason`, key absent when the server sent none).
+
 ## 1.41.0 — sign-in no longer retires the guest: it is held on the device (ADR-033 wave 1)
 
 **Two semantic changes, both strictly less destructive than before; everything else is additive

package/README.md

@@ -303,7 +303,7 @@ This SDK is on the **1.x line**. Patch bumps (1.x.y → 1.x.z) are backwards-com
 
 ### Auth state is a transition stream, not a health signal
 
-`auth.onAuthStateChanged()` reports confirmed transitions only — `signed_in` (`cause`: `mint` | `sign_in` | `restore` | `link`), `signed_out` (reason `user` | `session_expired` | `account_deleted` | `revoked` | `evicted` | `deleted`), `user_updated`, `guest_held`, `guest_released`, `session_withheld`, `device_takeover`, `deletion_cancelled`. Each subscriber first receives one `initial{status, user}` (1.41.0); with a live session it is followed by the same `signed_in{user}` replay 1.28–1.40 sent (no `cause`), so existing listeners keep working. New code: read `initial` and treat a cause-less `signed_in` right after it as the replay. A transient failure of the background token refresh (offline, timeout, HTTP 429, 5xx) emits **nothing**: the stored refresh token is kept and the refresh retried with backoff, so no state changed. "No event" means "no confirmed transition", never "the session is fine". Only a server-rejected refresh token produces `signed_out(session_expired)`. For liveness, read `getAccessToken()` — `null` means no usable token right now.
+`auth.onAuthStateChanged()` reports confirmed transitions only — `signed_in` (`cause`: `mint` | `sign_in` | `restore` | `link`), `signed_out` (reason `user` | `session_expired` | `account_deleted`; a session the server killed is always `session_expired`, with the server's verdict in `endReason` — `revoked` | `deleted` | `expired` | `reuse` | `unknown` — since 1.41.1), `user_updated`, `guest_held`, `guest_released`, `session_withheld`, `device_takeover`, `deletion_cancelled`. Each subscriber first receives one `initial{status, user}` (1.41.0); with a live session it is followed by the same `signed_in{user}` replay 1.28–1.40 sent (no `cause`), so existing listeners keep working. New code: read `initial` and treat a cause-less `signed_in` right after it as the replay. A transient failure of the background token refresh (offline, timeout, HTTP 429, 5xx) emits **nothing**: the stored refresh token is kept and the refresh retried with backoff, so no state changed. "No event" means "no confirmed transition", never "the session is fine". Only a server-rejected refresh token produces `signed_out(session_expired)`. For liveness, read `getAccessToken()` — `null` means no usable token right now.
 
 `signInAnonymously()` returns the **current** session when one exists, anonymous or identified — it never replaces a signed-in account with a guest. Pass `forceNew: true` to deliberately leave the current session and mint a fresh anonymous one (a guest left this way is held, not lost).
 

package/dist/index.cjs

@@ -263,7 +263,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.41.0",
+  version: "1.41.2",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -320,7 +320,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts && tsx test/held-identity.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -391,7 +391,18 @@ async function request(opts, method, path, body, extraHeaders, reqOpts) {
         ...extraHeaders ?? {}
       },
       body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: controller.signal
+      signal: controller.signal,
+      // ⚠ NO COOKIES (s58.360). The SDK authenticates with the x-api-key header
+      // and tokens in the body — never a cookie. But RN's fetch keeps a NATIVE
+      // cookie jar unless told otherwise (`XMLHttpRequest.withCredentials`
+      // defaults to true → iOS `HTTPShouldHandleCookies`; Android's OkHttp jar),
+      // so every `sd_rt` the server set was replayed on the next
+      // /token/refresh. After a sign-in that cookie is the ACCOUNT's, and the
+      // server preferred it over the HELD GUEST's token in the body: a claim
+      // refreshed the account and wrote its token into the guest's slot. The
+      // server now answers for the body (e09c86dc); this keeps the SDK out of
+      // that class regardless of what any endpoint prefers.
+      credentials: "omit"
     });
   } catch (err) {
     clearTimeout(timer);
@@ -2810,6 +2821,14 @@ var Auth = class {
     const rotated = readRotatedTokens(parsed.data);
     if (!rotated) throw new AuthError("PARSE_ERROR", "refresh response carried no token pair", { status: res.status });
     const d = parsed.data;
+    const answeredFor = isAuthUserShape(d?.user) ? d.user.id : this.userFromClaims(rotated.accessToken).id;
+    if (answeredFor && answeredFor !== slot.userId) {
+      throw new AuthError(
+        "HELD_GUEST_IDENTITY_MISMATCH",
+        "The held guest's refresh was answered for a different account; nothing was changed",
+        { kind: "unknown", status: res.status }
+      );
+    }
     const user = isAuthUserShape(d?.user) ? d.user : { ...this.userFromClaims(rotated.accessToken), id: slot.userId, isAnonymous: true };
     const persisted = this.commit({ kind: "slot_tokens", slot: i, sent, refreshToken: rotated.refreshToken });
     if (persisted.status !== "applied") return { outcome: "kept" };
@@ -2931,7 +2950,7 @@ var Auth = class {
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           if (this.hooks.storage.get(REFRESH_KEY) === sent) {
-            await this.commitAsync({ kind: "clear", reason: signedOutReasonFor(err.endReason), expectRefresh: sent });
+            await this.commitAsync({ kind: "clear", reason: "session_expired", endReason: err.endReason, expectRefresh: sent });
           } else {
             const i = this.held.findIndex((h) => h?.refreshToken === sent);
             if (i !== -1 && err.endReason !== void 0 && RELEASE_HELD_ON_END_REASONS.includes(err.endReason)) {
@@ -3207,7 +3226,9 @@ var Auth = class {
     if (reason === "stale_blob" || reason === "replaced") return { status: "applied", held: false };
     if (reason === "user" && prevRefresh) this.revokeFireAndForget(prevRefresh);
     this.pendingWipeHook = this.wipeLocalIdentity(reason);
-    this.emitAuthState({ event: "signed_out", user: null, reason });
+    this.emitAuthState(
+      tx.endReason !== void 0 ? { event: "signed_out", user: null, reason, endReason: tx.endReason } : { event: "signed_out", user: null, reason }
+    );
     return { status: "applied", held: false };
   }
   /**
@@ -3390,18 +3411,6 @@ var Auth = class {
     else this.hooks.storage.remove(key);
   }
 };
-function signedOutReasonFor(endReason) {
-  switch (endReason) {
-    case "revoked":
-      return "revoked";
-    case "deleted":
-      return "deleted";
-    case "evicted":
-      return "evicted";
-    default:
-      return "session_expired";
-  }
-}
 function isDeadRefreshError(code) {
   if (!code) return false;
   return DEAD_CODES.includes(code);

package/dist/index.d.cts

@@ -761,12 +761,17 @@ interface DeletionCancelledEvent {
  * Why the local session ended.
  *
  * - `user`            — the app called `signOut()` (or `discardWithheld()`).
- * - `session_expired` — the server rejected the stored refresh token with no
- *                       finer reason (or `endReason: expired | reuse | unknown`).
+ * - `session_expired` — the server rejected the stored refresh token. EVERY
+ *                       dead verdict, whatever the server's detail: read the
+ *                       event's `endReason` (`revoked` / `deleted` / `expired` /
+ *                       `reuse` / `unknown`) for that.
  * - `account_deleted` — `deleteAccount()` succeeded.
- * - `revoked` / `evicted` / `deleted` — ADR-033 B11 (additive): the server's
- *                       own `endReason` on the dead-token verdict. `evicted` is
- *                       reserved and not emitted by the backend yet.
+ * - `revoked` / `evicted` / `deleted` — ⚠ emitted by 1.41.0 ONLY, never since
+ *                       1.41.1. 1.41.0 put the server's `endReason` here, which
+ *                       renamed "account deleted elsewhere" / "sessions revoked"
+ *                       (both `session_expired` through 1.40.0) and silently
+ *                       broke listeners matching `session_expired`. Kept in the
+ *                       type so code written against 1.41.0 still compiles.
  *
  * Transient network failures and rate limits never produce any of these.
  * Consumers default-branch (§3.5 NORMATIVE).
@@ -792,10 +797,13 @@ type AuthStateChange = {
     event: "signed_in";
     user: AuthUser;
     cause?: AuthSignedInCause;
-} | {
+}
+/** `endReason` (1.41.1) = the server's own verdict on a dead refresh token; absent on `user` / `account_deleted` and from an older backend. */
+ | {
     event: "signed_out";
     user: null;
     reason: AuthSignedOutReason;
+    endReason?: RefreshEndReason;
 } | {
     event: "device_takeover";
     user: AuthUser | null;

package/dist/index.d.ts

@@ -761,12 +761,17 @@ interface DeletionCancelledEvent {
  * Why the local session ended.
  *
  * - `user`            — the app called `signOut()` (or `discardWithheld()`).
- * - `session_expired` — the server rejected the stored refresh token with no
- *                       finer reason (or `endReason: expired | reuse | unknown`).
+ * - `session_expired` — the server rejected the stored refresh token. EVERY
+ *                       dead verdict, whatever the server's detail: read the
+ *                       event's `endReason` (`revoked` / `deleted` / `expired` /
+ *                       `reuse` / `unknown`) for that.
  * - `account_deleted` — `deleteAccount()` succeeded.
- * - `revoked` / `evicted` / `deleted` — ADR-033 B11 (additive): the server's
- *                       own `endReason` on the dead-token verdict. `evicted` is
- *                       reserved and not emitted by the backend yet.
+ * - `revoked` / `evicted` / `deleted` — ⚠ emitted by 1.41.0 ONLY, never since
+ *                       1.41.1. 1.41.0 put the server's `endReason` here, which
+ *                       renamed "account deleted elsewhere" / "sessions revoked"
+ *                       (both `session_expired` through 1.40.0) and silently
+ *                       broke listeners matching `session_expired`. Kept in the
+ *                       type so code written against 1.41.0 still compiles.
  *
  * Transient network failures and rate limits never produce any of these.
  * Consumers default-branch (§3.5 NORMATIVE).
@@ -792,10 +797,13 @@ type AuthStateChange = {
     event: "signed_in";
     user: AuthUser;
     cause?: AuthSignedInCause;
-} | {
+}
+/** `endReason` (1.41.1) = the server's own verdict on a dead refresh token; absent on `user` / `account_deleted` and from an older backend. */
+ | {
     event: "signed_out";
     user: null;
     reason: AuthSignedOutReason;
+    endReason?: RefreshEndReason;
 } | {
     event: "device_takeover";
     user: AuthUser | null;

package/dist/index.js

@@ -212,7 +212,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.41.0",
+  version: "1.41.2",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -269,7 +269,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts && tsx test/held-identity.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -340,7 +340,18 @@ async function request(opts, method, path, body, extraHeaders, reqOpts) {
         ...extraHeaders ?? {}
       },
       body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: controller.signal
+      signal: controller.signal,
+      // ⚠ NO COOKIES (s58.360). The SDK authenticates with the x-api-key header
+      // and tokens in the body — never a cookie. But RN's fetch keeps a NATIVE
+      // cookie jar unless told otherwise (`XMLHttpRequest.withCredentials`
+      // defaults to true → iOS `HTTPShouldHandleCookies`; Android's OkHttp jar),
+      // so every `sd_rt` the server set was replayed on the next
+      // /token/refresh. After a sign-in that cookie is the ACCOUNT's, and the
+      // server preferred it over the HELD GUEST's token in the body: a claim
+      // refreshed the account and wrote its token into the guest's slot. The
+      // server now answers for the body (e09c86dc); this keeps the SDK out of
+      // that class regardless of what any endpoint prefers.
+      credentials: "omit"
     });
   } catch (err) {
     clearTimeout(timer);
@@ -2759,6 +2770,14 @@ var Auth = class {
     const rotated = readRotatedTokens(parsed.data);
     if (!rotated) throw new AuthError("PARSE_ERROR", "refresh response carried no token pair", { status: res.status });
     const d = parsed.data;
+    const answeredFor = isAuthUserShape(d?.user) ? d.user.id : this.userFromClaims(rotated.accessToken).id;
+    if (answeredFor && answeredFor !== slot.userId) {
+      throw new AuthError(
+        "HELD_GUEST_IDENTITY_MISMATCH",
+        "The held guest's refresh was answered for a different account; nothing was changed",
+        { kind: "unknown", status: res.status }
+      );
+    }
     const user = isAuthUserShape(d?.user) ? d.user : { ...this.userFromClaims(rotated.accessToken), id: slot.userId, isAnonymous: true };
     const persisted = this.commit({ kind: "slot_tokens", slot: i, sent, refreshToken: rotated.refreshToken });
     if (persisted.status !== "applied") return { outcome: "kept" };
@@ -2880,7 +2899,7 @@ var Auth = class {
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           if (this.hooks.storage.get(REFRESH_KEY) === sent) {
-            await this.commitAsync({ kind: "clear", reason: signedOutReasonFor(err.endReason), expectRefresh: sent });
+            await this.commitAsync({ kind: "clear", reason: "session_expired", endReason: err.endReason, expectRefresh: sent });
           } else {
             const i = this.held.findIndex((h) => h?.refreshToken === sent);
             if (i !== -1 && err.endReason !== void 0 && RELEASE_HELD_ON_END_REASONS.includes(err.endReason)) {
@@ -3156,7 +3175,9 @@ var Auth = class {
     if (reason === "stale_blob" || reason === "replaced") return { status: "applied", held: false };
     if (reason === "user" && prevRefresh) this.revokeFireAndForget(prevRefresh);
     this.pendingWipeHook = this.wipeLocalIdentity(reason);
-    this.emitAuthState({ event: "signed_out", user: null, reason });
+    this.emitAuthState(
+      tx.endReason !== void 0 ? { event: "signed_out", user: null, reason, endReason: tx.endReason } : { event: "signed_out", user: null, reason }
+    );
     return { status: "applied", held: false };
   }
   /**
@@ -3339,18 +3360,6 @@ var Auth = class {
     else this.hooks.storage.remove(key);
   }
 };
-function signedOutReasonFor(endReason) {
-  switch (endReason) {
-    case "revoked":
-      return "revoked";
-    case "deleted":
-      return "deleted";
-    case "evicted":
-      return "evicted";
-    default:
-      return "session_expired";
-  }
-}
 function isDeadRefreshError(code) {
   if (!code) return false;
   return DEAD_CODES.includes(code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.41.0",
+  "version": "1.41.2",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -57,7 +57,7 @@
   "scripts": {
     "build": "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     "typecheck": "tsc --noEmit",
-    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts"
+    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts && tsx test/held-identity.test.ts"
   },
   "devDependencies": {
     "@types/react": "^19.2.16",