docs: note TWA/Auth Tab and ephemeral browsing limitations; revert deepEqual change

- Document that Auth Tab and TWA are mutually exclusive (TWA takes
  precedence) and that ephemeral browsing works only on a plain Custom
  Tab, so ephemeralSession is not honored under Auth Tab or TWA.
- Link the underlying issue (#1584) where Auth Tab is discussed.
- Revert the unrelated == -> === change in deepEqual.ts to match
  v6-development.

Author: NandanPrabhu

EXAMPLES.md

@@ -2783,7 +2783,7 @@ On Android, web authentication defaults to a Custom Tab, which shows a read-only
 
 > **Platform Support:** Android only. This option is ignored on iOS and web.
 
-> **Note:** Since v6, Android web authentication uses **Auth Tab** by default — a Custom Tab launch mode that delivers proper `ActivityResult` callbacks instead of inferring cancellation from lifecycle events. This fixes the spurious `USER_CANCELLED` error when users tap Chrome's minimize button (Chrome 122+). Auth Tab requires **Chrome 137 or later**; on older browser versions it automatically falls back to a standard Custom Tab. Auth Tab is the default launch mode for regular Custom Tabs, whereas TWA is opt-in and renders full-screen with no URL bar. Because they use different launch mechanisms, enabling `useTrustedWebActivity: true` makes TWA take precedence and Auth Tab is not used.
+> **Note:** Since v6, Android web authentication uses **Auth Tab** by default — a Custom Tab launch mode that delivers proper `ActivityResult` callbacks instead of inferring cancellation from lifecycle events. This fixes the spurious `USER_CANCELLED` error ([#1584](https://github.com/auth0/react-native-auth0/issues/1584)) when users tap Chrome's minimize button (Chrome 122+). Auth Tab requires **Chrome 137 or later**; on older browser versions it automatically falls back to a standard Custom Tab. Auth Tab is the default launch mode for regular Custom Tabs, whereas TWA is opt-in and renders full-screen with no URL bar. Because they use different launch mechanisms, enabling `useTrustedWebActivity: true` makes TWA take precedence and Auth Tab is not used. Note also that ephemeral browsing works only on a plain Custom Tab — neither Auth Tab nor TWA supports it — so [`ephemeralSession: true`](#ephemeral-sessions) only takes effect when the flow falls back to a plain Custom Tab.
 
 ### Required setup
 
@@ -2849,7 +2849,7 @@ Pass `ephemeralSession: true` to run web authentication in an isolated browser s
 
 > **Platform Support:** iOS and Android. This option is ignored on web.
 
-> **Warning:** On Android, `ephemeralSession` and [`useTrustedWebActivity`](#trusted-web-activity-android) are effectively mutually exclusive. A Trusted Web Activity does not support ephemeral browsing, so if you enable both, TWA takes precedence and the session will **not** be ephemeral. Pick one.
+> **Warning:** On Android, ephemeral browsing is only supported on a plain Custom Tab. Neither [Auth Tab](#trusted-web-activity-android) (the default launch mode since v6) nor a [Trusted Web Activity](#trusted-web-activity-android) supports it, so `ephemeralSession` only takes effect when the browser falls back to a plain Custom Tab — for example on a browser too old for Auth Tab. On Chrome 137+ (where Auth Tab is used) or when `useTrustedWebActivity: true` is set, the session will **not** be ephemeral.
 
 > **Note:** Android support for ephemeral sessions was added in v6. In earlier versions the option was accepted but only took effect on iOS.
 

MIGRATION_GUIDE.md

@@ -199,11 +199,11 @@ await authorize(
 );
 ```
 
-Two further Android caveats: the fallback above means you should keep calling `clearSession` unless you can guarantee the browser honours the ephemeral request, and `ephemeralSession` has no effect when `useTrustedWebActivity` is also enabled (a Trusted Web Activity cannot browse ephemerally, so TWA wins). See [Ephemeral Sessions](EXAMPLES.md#ephemeral-sessions) for details.
+Two further Android caveats: the fallback above means you should keep calling `clearSession` unless you can guarantee the browser honours the ephemeral request, and ephemeral browsing is only supported on a plain Custom Tab — neither Auth Tab (the new default, see below) nor a Trusted Web Activity can browse ephemerally. So `ephemeralSession` only takes effect when the browser falls back to a plain Custom Tab (e.g. a browser too old for Auth Tab); on Chrome 137+ or with `useTrustedWebActivity` enabled, the session is not ephemeral. See [Ephemeral Sessions](EXAMPLES.md#ephemeral-sessions) for details.
 
 #### Auth Tab is now the default Android web authentication launch mode
 
-Auth0.Android 4.0's Auth Tab launch path delivers a real `ActivityResult` from the Custom Tab instead of inferring cancellation from activity lifecycle events. This fixes a long-standing Android bug where tapping Chrome's minimize button (available in Chrome 122+) would incorrectly reject `authorize()` with `USER_CANCELLED` while leaving the browser alive as a "zombie" — so when the user returned and completed login, the redirect was dropped and credentials never arrived.
+Auth0.Android 4.0's Auth Tab launch path delivers a real `ActivityResult` from the Custom Tab instead of inferring cancellation from activity lifecycle events. This fixes a long-standing Android bug ([#1584](https://github.com/auth0/react-native-auth0/issues/1584)) where tapping Chrome's minimize button (available in Chrome 122+) would incorrectly reject `authorize()` with `USER_CANCELLED` while leaving the browser alive as a "zombie" — so when the user returned and completed login, the redirect was dropped and credentials never arrived.
 
 **What changed:** `authorize()` and `clearSession()` now call `withAuthTab()` by default on Android. The iOS flow is unchanged; web is unaffected.
 

src/core/utils/deepEqual.ts

@@ -2,9 +2,9 @@ export function deepEqual<T>(x: T, y: T): boolean {
   if (x === y) {
     return true;
   } else if (
-    typeof x === 'object' &&
+    typeof x == 'object' &&
     x != null &&
-    typeof y === 'object' &&
+    typeof y == 'object' &&
     y != null
   ) {
     if (Object.keys(x).length != Object.keys(y).length) return false;