@goliapkg/sentori-react-native 6.2.1 → 6.3.0

package/src/push.ts

@@ -23,7 +23,7 @@
 
 import { logger, pushSignal } from '@goliapkg/sentori-core'
 
-import { currentUserKey } from './scope.js'
+import { currentUserKey, currentUserTraits, onIdentityChange } from './scope.js'
 
 // AppState is RN-only; we treat it dynamically so the SDK keeps
 // importing cleanly under Bun / web.
@@ -46,6 +46,14 @@ import {
 const STORAGE_KEY = 'sentori.push.ipt'
 
 let _cachedIpt: null | string = null
+// The last token the vendor handed us, kept so a sign-in can re-send
+// the registration without asking the OS for a token again.
+let _lastNativeToken: null | string = null
+let _lastOptions: PushRegisterOptions = {}
+// What the server was last told. A re-registration that would send
+// the same thing is not sent: `user()` is a verb an app may call on
+// every screen, and one HTTP request per call is not free to a host.
+let _lastSentIdentity: string | null = null
 let _drainInterval: ReturnType<typeof setInterval> | null = null
 let _appStateSubscription: { remove: () => void } | null = null
 let _backgrounded = false
@@ -176,9 +184,13 @@ export async function register(opts: PushRegisterOptions = {}): Promise<PushRegi
     const token = await waitForToken(opts.tokenTimeoutMs ?? 8000)
     const ipt = await registerWithServer(cfg, token, opts)
     _cachedIpt = ipt
+    _lastNativeToken = token
+    _lastOptions = opts
     void persistIpt(ipt)
     opts.onToken?.(ipt)
     bindBufferDrain(opts.onMessage, opts.onTap)
+    // From here on, signing in or out updates the row by itself.
+    onIdentityChange(reRegisterAfterIdentityChange)
     return { ok: true, ipt }
   } catch (e) {
     const err = e instanceof Error ? e : new Error(String(e))
@@ -199,6 +211,29 @@ function fail(
   return { ok: false, message, reason }
 }
 
+/**
+ * Send the registration again because the person changed.
+ *
+ * Only for a device that has already registered — the vendor token is
+ * the evidence, the same rule the native SDKs use for a rotated
+ * token. Nothing here throws and nothing here is awaited by the host:
+ * `user()` is synchronous and stays that way.
+ */
+function reRegisterAfterIdentityChange(): void {
+  const token = _lastNativeToken
+  const cfg = tryGetRuntimeConfig()
+  if (token == null || cfg == null) return
+  const identity = JSON.stringify([currentUserKey() ?? null, currentUserTraits() ?? null])
+  if (identity === _lastSentIdentity) return
+  _lastSentIdentity = identity
+  void registerWithServer(cfg, token, _lastOptions).catch((e: unknown) => {
+    // A failed update leaves the row pointing at the previous person,
+    // so the next change must be allowed to try again.
+    _lastSentIdentity = null
+    logger.warn('push', 'updating the device after a sign-in failed', e)
+  })
+}
+
 /** Internal carrier so the helpers below can name which failure they
  *  are without every one of them returning a result object. */
 class PushRegisterError extends Error {
@@ -228,6 +263,9 @@ export async function unregister(): Promise<void> {
     }
   }
   nativePushUnregister()
+  onIdentityChange(undefined)
+  _lastNativeToken = null
+  _lastSentIdentity = null
   _cachedIpt = null
   void clearPersistedIpt()
   teardownBufferDrain()
@@ -310,6 +348,12 @@ async function registerWithServer(
   // out it went nowhere. (Insight asked whether it was stored; it was
   // not — 2026-08-11.)
   if (opts.metadata != null) body.metadata = opts.metadata
+  // Attributes of the person rather than of the device, kept apart so
+  // a build channel called "pro" cannot answer a send aimed at the pro
+  // plan. Absent leaves whatever the row already had; `{}` clears it,
+  // which is what signing out sends.
+  const traits = currentUserTraits()
+  if (traits != null) body.traits = traits
   const res = await fetch(joinUrl(cfg.ingestUrl, '/v1/push/tokens'), {
     method: 'POST',
     headers: {
@@ -545,6 +589,10 @@ export function __resetForTests(): void {
   _onMessage = undefined
   _onTap = undefined
   _ackQueue = []
+  _lastNativeToken = null
+  _lastOptions = {}
+  _lastSentIdentity = null
+  onIdentityChange(undefined)
   teardownBufferDrain()
 }
 

package/src/scope.ts

@@ -9,12 +9,50 @@ let _user: User | null = null;
 let _userKey: string | undefined;
 let _context: Record<string, unknown> = {};
 let _hashGeneration = 0;
+let _traits: Record<string, unknown> | undefined;
+
+// What to tell when the person changes.
+//
+// The device row carries the identity, and until now nothing updated
+// it after registration: an app that registers for push at launch and
+// signs in ten seconds later — which is every app with a login screen
+// — held a row with no user on it for the life of the install. A send
+// aimed at that user reached nobody and reported success.
+//
+// A callback rather than a direct call because push.ts already imports
+// this file; the arrow has to point one way.
+let _onIdentityChange: (() => void) | undefined;
+
+/** Register interest in identity changes. Only push does. */
+export const onIdentityChange = (fn: (() => void) | undefined): void => {
+  _onIdentityChange = fn;
+};
+
+const announce = (): void => {
+  try {
+    _onIdentityChange?.();
+  } catch {
+    // NEVER rule: whatever the listener does, user() returns.
+  }
+};
 
 export const setUser = safeFn('user', function setUser(u: User | null): void {
   _user = u;
   _userKey = undefined;
+  // A call to `user()` describes the person completely, so one made
+  // without traits means they have none — not "leave the last ones".
+  // Absent and empty are different on the wire: absent keeps what the
+  // row has, and a signed-out device that kept them would still be
+  // selectable as whoever just left.
+  _traits = u?.traits == null ? {} : { ...u.traits };
   const generation = ++_hashGeneration;
-  if (u === null) return;
+  if (u === null) {
+    // Signing out is an identity change too, and the one where a
+    // stale row matters most: the device would otherwise keep
+    // answering to the person who just left.
+    announce();
+    return;
+  }
   // The wire carries only a salted hash — raw identity never leaves
   // the device (breadth × depth needs distinctness, not identity).
   // Hashing is async (WebCrypto); the verb stays synchronous and the
@@ -24,6 +62,9 @@ export const setUser = safeFn('user', function setUser(u: User | null): void {
     .then((hashes) => {
       if (generation === _hashGeneration) {
         _userKey = hashes.id ?? hashes.email;
+        // Announced after the hash lands, not before: the whole point
+        // is to send the new key, and the key is what arrives late.
+        announce();
       }
     })
     .catch(() => {
@@ -39,12 +80,20 @@ export const patchContext = safeFn('context', function patchContext(
 
 export const currentUserKey = (): string | undefined => _userKey;
 
+/** The person's attributes, for the device row. Undefined when the
+ *  host has not set any — which is different from `{}`, the value that
+ *  clears them. */
+export const currentUserTraits = (): Record<string, unknown> | undefined =>
+  _traits === undefined ? undefined : { ..._traits };
+
 export const currentContext = (): Record<string, unknown> | undefined =>
   Object.keys(_context).length > 0 ? { ..._context } : undefined;
 
 export const __resetForTests = (): void => {
   _user = null;
   _userKey = undefined;
+  _traits = undefined;
   _context = {};
+  _onIdentityChange = undefined;
   _hashGeneration++;
 };

package/src/transport.ts

@@ -20,7 +20,7 @@ const STORAGE_KEY = '@sentori/pending';
 const MAX_PERSISTED = 1000;
 
 // Pinned to package.json by a test — bump both together.
-const SDK_VERSION = '6.2.1';
+const SDK_VERSION = '6.3.0';
 
 let _queue: WireEvent[] = [];
 let _assertStats = new Map<string, AssertStat>();

package/ios/core/SentoriPush.swift

@@ -1,340 +0,0 @@
-// GENERATED MIRROR — do not edit.
-// Source of truth: sdk/native/ios/Sources/Sentori/SentoriPush.swift
-// Run `node scripts/sync-native-core.mjs` after editing it.
-import Foundation
-
-/// Push, as an app writes it.
-///
-///     let r = await Sentori.push.register()
-///     if case .failure(let reason) = r { … }
-///
-/// The pieces underneath already existed — permission, the
-/// `AppDelegate` swizzle, the token buffer, the tap and foreground
-/// callbacks — and were reachable only through the React Native
-/// bridge. What was missing everywhere but JavaScript is the part
-/// that puts a token on the server, which is the only reason a
-/// registered device is reachable at all.
-///
-/// Asked for by insight (2026-08-11): two apps with no React Native,
-/// blocked, and unwilling to reimplement the HTTP contract because a
-/// second implementation drifts silently on the one path where nobody
-/// is watching.
-@objc(SentoriPush)
-public final class SentoriPush: NSObject {
-
-    /// Why a registration did not produce a device handle. Each value
-    /// asks the host for something different, which is the only
-    /// reason to distinguish them — matching `PushRegisterFailure` in
-    /// the React Native SDK exactly, so the same integration notes
-    /// apply on both.
-    @objc public enum Failure: Int {
-        /// `Sentori.start` has not run. A wiring bug.
-        case notInitialised
-        /// The user said no. Not an error: do not retry on a timer,
-        /// and offer it again from a settings screen.
-        case permissionDenied
-        /// No push entitlement in this build, or a simulator without
-        /// one. Nothing to do at runtime.
-        case noTransport
-        /// The OS never handed back a token inside the window.
-        /// Usually provisioning; retrying later is reasonable.
-        case tokenTimeout
-        /// Sentori answered non-2xx. Settings ▸ Push is where to look.
-        case serverRejected
-
-        public var name: String {
-            switch self {
-            case .notInitialised: return "not-initialised"
-            case .permissionDenied: return "permission-denied"
-            case .noTransport: return "no-transport"
-            case .tokenTimeout: return "token-timeout"
-            case .serverRejected: return "server-rejected"
-            }
-        }
-    }
-
-    /// Registration never throws. A denied permission is an ordinary
-    /// answer, and an opt-in that throws inside someone's view model
-    /// is the failure this SDK's contract with its host is written
-    /// against.
-    public enum Result {
-        /// The `device_tokens` row id. Revoking takes it, and so does
-        /// a targeted send.
-        case success(handle: String)
-        case failure(reason: Failure, message: String)
-
-        public var handle: String? {
-            if case .success(let h) = self { return h }
-            return nil
-        }
-    }
-
-    @objc public static let shared = SentoriPush()
-
-    private let lock = NSLock()
-    private var cachedHandle: String?
-    private var onMessage: (([String: Any]) -> Void)?
-    private var onTap: (([String: Any]) -> Void)?
-    private var drainTimer: DispatchSourceTimer?
-
-    private static let handleKey = "com.sentori.push.handle"
-
-    /// Ask for permission, get a token, register it.
-    ///
-    /// Safe to call on every launch: the OS returns its cached
-    /// decision without re-prompting, and the server upserts on
-    /// `(project, provider, token)`.
-    ///
-    /// Call `Sentori.user` first if the device should be reachable
-    /// from an issue. Without it the registration carries no user key
-    /// and the device receives broadcasts only — the dashboard shows
-    /// that as "N devices, 0 addressable", which is the one symptom
-    /// with no other explanation.
-    @discardableResult
-    public func register(
-        timeout: TimeInterval = 8,
-        onMessage: (([String: Any]) -> Void)? = nil,
-        onTap: (([String: Any]) -> Void)? = nil
-    ) async -> Result {
-        guard let config = SentoriConfig.current else {
-            return .failure(reason: .notInitialised, message: "Sentori.start has not run")
-        }
-
-        // Bind before asking for anything: iOS replays a tap that
-        // happened while the app was not running as soon as the
-        // delegate attaches, and a callback set afterwards misses it.
-        lock.lock()
-        self.onMessage = onMessage
-        self.onTap = onTap
-        lock.unlock()
-
-        let status = await currentOrRequestPermission()
-        // "unavailable" is the native layer saying there is no app
-        // bundle to ask on behalf of — a test host, a CLI, some
-        // extensions. Not a decision the user made.
-        guard let status, status != "unavailable" else {
-            return .failure(reason: .noTransport, message: "no push support in this build")
-        }
-        guard ["granted", "provisional", "ephemeral"].contains(status) else {
-            return .failure(reason: .permissionDenied, message: "push permission '\(status)'")
-        }
-
-        SentoriPushNotifications.shared.registerForRemoteNotifications()
-        guard let token = await waitForToken(timeout: timeout) else {
-            return .failure(
-                reason: .tokenTimeout,
-                message: "no device token within \(Int(timeout))s"
-            )
-        }
-
-        switch await registerWithServer(token: token, config: config) {
-        case .success(let handle):
-            lock.lock()
-            cachedHandle = handle
-            lock.unlock()
-            UserDefaults.standard.set(handle, forKey: Self.handleKey)
-            startDrain()
-            return .success(handle: handle)
-        case .failure(let reason, let message):
-            return .failure(reason: reason, message: message)
-        }
-    }
-
-    /// The handle from an earlier `register`, without a round trip.
-    @objc public func cachedDeviceHandle() -> String? {
-        lock.lock()
-        let h = cachedHandle
-        lock.unlock()
-        return h ?? UserDefaults.standard.string(forKey: Self.handleKey)
-    }
-
-    /// Current permission without prompting. `nil` when there is no
-    /// push support in this build.
-    public func permissionStatus() async -> String? {
-        await withCheckedContinuation { cont in
-            SentoriPushNotifications.shared.currentPermission { cont.resume(returning: $0) }
-        }
-    }
-
-    /// Revoke the handle server-side and stop local delivery.
-    /// Idempotent — repeat calls do nothing.
-    @discardableResult
-    public func unregister() async -> Bool {
-        let handle = cachedDeviceHandle()
-        lock.lock()
-        cachedHandle = nil
-        onMessage = nil
-        onTap = nil
-        drainTimer?.cancel()
-        drainTimer = nil
-        lock.unlock()
-        UserDefaults.standard.removeObject(forKey: Self.handleKey)
-        SentoriPushNotifications.shared.unregisterForRemoteNotifications()
-
-        guard let handle, let config = SentoriConfig.current,
-            let url = URL(string: "\(config.ingestUrl)/v1/push/tokens/\(handle)")
-        else { return false }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "DELETE"
-        request.setValue("Bearer \(config.token)", forHTTPHeaderField: "Authorization")
-        request.timeoutInterval = 15
-        let ok = await withCheckedContinuation { (cont: CheckedContinuation<Bool, Never>) in
-            URLSession.shared.dataTask(with: request) { _, response, _ in
-                let code = (response as? HTTPURLResponse)?.statusCode ?? 0
-                cont.resume(returning: (200..<300).contains(code))
-            }.resume()
-        }
-        return ok
-    }
-
-    // ── internals ─────────────────────────────────────────────────
-
-    private func currentOrRequestPermission() async -> String? {
-        let current = await permissionStatus()
-        // `nil` means no native push at all; asking would not change
-        // that. Anything already decided is returned as decided,
-        // because a second prompt is not something iOS shows anyway.
-        guard let current else { return nil }
-        if current == "undetermined" || current == "notDetermined" {
-            return await withCheckedContinuation { cont in
-                SentoriPushNotifications.shared.requestPermission { cont.resume(returning: $0) }
-            }
-        }
-        return current
-    }
-
-    /// The token arrives asynchronously through the AppDelegate
-    /// swizzle and lands in the native buffer, so this polls it. Any
-    /// notifications or taps that arrive alongside are delivered
-    /// rather than dropped on the floor.
-    private func waitForToken(timeout: TimeInterval) async -> String? {
-        let deadline = Date().addingTimeInterval(timeout)
-        while Date() < deadline {
-            let state = SentoriPushNotifications.shared.drainState()
-            flush(state)
-            if let token = state["token"] as? String { return token }
-            if state["error"] != nil { return nil }
-            try? await Task.sleep(nanoseconds: 200_000_000)
-        }
-        return nil
-    }
-
-    private func registerWithServer(token: String, config: SentoriConfig) async -> Result {
-        guard let url = URL(string: "\(config.ingestUrl)/v1/push/tokens") else {
-            return .failure(reason: .serverRejected, message: "bad ingest url")
-        }
-        var body: [String: Any] = [
-            // `kind`, not `provider`. The React Native SDK sent
-            // `provider` for a year and earned a 422 for every
-            // registration it ever attempted.
-            "kind": "apns",
-            "nativeToken": token,
-            // Sandbox and production APNs are different hosts, and a
-            // token minted against one is rejected by the other.
-            "env": isDebugBuild ? "sandbox" : "production",
-        ]
-        // The same salted-nothing hash every event carries, so the
-        // dashboard can address this device by the person who hit an
-        // issue. Absent until the host calls `Sentori.user`.
-        if let userKey = SentoriScope.userKey { body["userKey"] = userKey }
-
-        guard let payload = try? JSONSerialization.data(withJSONObject: body) else {
-            return .failure(reason: .serverRejected, message: "could not encode registration")
-        }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        request.setValue("Bearer \(config.token)", forHTTPHeaderField: "Authorization")
-        request.setValue("swift/\(SentoriVersion.current)", forHTTPHeaderField: "Sentori-Sdk")
-        request.httpBody = payload
-        request.timeoutInterval = 15
-
-        return await withCheckedContinuation { (cont: CheckedContinuation<Result, Never>) in
-            URLSession.shared.dataTask(with: request) { data, response, error in
-                let code = (response as? HTTPURLResponse)?.statusCode ?? 0
-                guard (200..<300).contains(code) else {
-                    let why = error?.localizedDescription ?? "HTTP \(code)"
-                    cont.resume(
-                        returning: .failure(reason: .serverRejected, message: why))
-                    return
-                }
-                // The handle is the `device_tokens` row id, a bare
-                // uuid. The RN SDK parsed it as an `ipt_*` string no
-                // server has ever returned.
-                guard let data,
-                    let j = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
-                    let handle = j["token_id"] as? String, !handle.isEmpty
-                else {
-                    cont.resume(
-                        returning: .failure(
-                            reason: .serverRejected,
-                            message: "server returned no device token id"))
-                    return
-                }
-                cont.resume(returning: .success(handle: handle))
-            }.resume()
-        }
-    }
-
-    /// 1 Hz while registered. The native side buffers arrivals and
-    /// taps; this hands them to the host.
-    private func startDrain() {
-        lock.lock()
-        defer { lock.unlock() }
-        guard drainTimer == nil else { return }
-        let t = DispatchSource.makeTimerSource(queue: .global(qos: .utility))
-        t.schedule(deadline: .now() + 1, repeating: 1)
-        t.setEventHandler { [weak self] in
-            guard let self else { return }
-            self.flush(SentoriPushNotifications.shared.drainState())
-        }
-        drainTimer = t
-        t.resume()
-    }
-
-    private func flush(_ state: [String: Any]) {
-        lock.lock()
-        let message = onMessage
-        let tap = onTap
-        lock.unlock()
-        guard message != nil || tap != nil else { return }
-
-        let notifications = state["notifications"] as? [[String: Any]] ?? []
-        let taps = state["taps"] as? [[String: Any]] ?? []
-        guard !notifications.isEmpty || !taps.isEmpty else { return }
-
-        // The host's UI lives on the main thread and a notification
-        // callback almost always touches it.
-        DispatchQueue.main.async {
-            notifications.forEach { message?($0) }
-            taps.forEach { tap?($0) }
-        }
-    }
-
-    private var isDebugBuild: Bool {
-        #if DEBUG
-            return true
-        #else
-            return false
-        #endif
-    }
-
-    func __resetForTests() {
-        lock.lock()
-        cachedHandle = nil
-        onMessage = nil
-        onTap = nil
-        drainTimer?.cancel()
-        drainTimer = nil
-        lock.unlock()
-        UserDefaults.standard.removeObject(forKey: Self.handleKey)
-    }
-}
-
-extension Sentori {
-    /// `Sentori.push.register()`, matching `sentori.push.register()`
-    /// in the React Native SDK.
-    public static var push: SentoriPush { SentoriPush.shared }
-}