@sendoracloud/sdk-react-native 1.18.0 → 1.20.0

package/dist/index.cjs

@@ -200,7 +200,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.18.0",
+  version: "1.20.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -705,8 +705,10 @@ var Auth = class {
         if (stashed) prevAnonRefreshToken = stashed;
       }
       if (this.user !== null) await this.wipeLocalIdentity();
-      const payload = { ...input };
+      const { link, ...socialInput } = input;
+      const payload = { ...socialInput };
       if (prevAnonRefreshToken) payload.prevAnonRefreshToken = prevAnonRefreshToken;
+      if (link) payload.linkAnonymous = true;
       const res = await post(
         { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
         "/api/v1/auth-service/login/social",
@@ -729,8 +731,8 @@ var Auth = class {
       return parsed.data.user;
     });
   }
-  signInWithGoogle(code, redirectUri) {
-    return this.loginSocial({ provider: "google", code, redirectUri });
+  signInWithGoogle(code, redirectUri, link) {
+    return this.loginSocial({ provider: "google", code, redirectUri, link });
   }
   signInWithGitHub(code, redirectUri) {
     return this.loginSocial({ provider: "github", code, redirectUri });
@@ -2358,6 +2360,37 @@ var SendoraSDK = class {
   getUserId() {
     return this.userId;
   }
+  /**
+   * Non-throwing, synchronous read of the verified auth principal. Returns
+   * the persisted `AuthUser` (`{ id, email, emailVerified, name, isAnonymous }`)
+   * or `null` when no session is hydrated yet. Zero I/O — a pure in-memory read
+   * of the session restored during `init()` — so it is safe on the very first
+   * API call at cold start: await `init()` once (disk-only, no network), then
+   * read this synchronously, even offline.
+   *
+   * `id` is the JWT `sub` — the durable, server-verified identity to key your
+   * backend data on. Do NOT use `getAnonymousIdSync()` for that (it's a
+   * rotating analytics id). Pair with `isReady()` to tell "still restoring"
+   * apart from "signed out": `null` here while `isReady()` is `false` = init
+   * hasn't finished; `null` while `isReady()` is `true` = genuinely no session.
+   * `isAnonymous` is optional on the wire — test `=== false`, not truthiness.
+   * The access token is re-verified server-side, so reading identity here
+   * (client-untrusted) for UI/routing is safe; never use it as your own
+   * authorization decision.
+   */
+  getUserSync() {
+    return this.ready ? this.auth.getCurrentUser() : null;
+  }
+  /**
+   * Non-throwing, synchronous readiness flag. `true` once `init()` has
+   * resolved (storage hydrated + auth session restored). Gate a cold-start
+   * identity read on this so you never mistake "still restoring the session"
+   * for "signed out" — the loading gate every mobile auth SDK expects
+   * (Firebase's init-null caveat, Clerk's `isLoaded`).
+   */
+  isReady() {
+    return this.ready;
+  }
   /** Toggle consent at runtime — when false, events drop instead of fire. */
   setConsent(granted) {
     this.consentGranted = granted;

package/dist/index.d.cts

@@ -230,16 +230,15 @@ declare class Storage {
  * so a UI double-submit can't mint two anonymous users or interleave
  * a signIn + signOut.
  *
- * Tokens (including the refresh token) persist in AsyncStorage, not
- * the iOS Keychain / Android Keystore. AsyncStorage is unencrypted
- * app-sandbox storage: readable by anyone with filesystem/backup
- * access to a jailbroken/rooted or unlocked device, but isolated from
- * other apps by the OS sandbox. There is NO `secureStorage` adapter
- * option today — earlier docs claimed a Keychain/SecureStore-backed
- * adapter that was never implemented. If you ship a follow-up that
- * moves the refresh token to expo-secure-store / react-native-keychain
- * (optional peer dep, Metro-resolvable static import — never an inline
- * require), keep the `auth_refresh_token` storage key for back-compat.
+ * Tokens (including the refresh token) persist in AsyncStorage BY
+ * DEFAULT — unencrypted app-sandbox storage: isolated from other apps
+ * by the OS sandbox, but readable with filesystem/backup access to a
+ * jailbroken/rooted or unlocked device (OWASP MASVS-L1). Since 1.18.0 an
+ * OPTIONAL `secureStorage` adapter (`Sendora.init({ secureStorage })`,
+ * wired in index.ts) routes the SECURE_KEYS (refresh/access/user) through
+ * an app-supplied Keychain / Keystore adapter, with transparent
+ * plaintext→secure migration; omit it and behaviour is unchanged. The
+ * `auth_refresh_token` storage key stays frozen for back-compat either way.
  *
  * Response payloads are validated non-empty before persisting so a
  * malformed/MITM'd response can't install an `id = ""` user.
@@ -478,8 +477,17 @@ declare class Auth {
             firstName?: string;
             lastName?: string;
         };
+        /**
+         * ADR-025 link-in-place opt-in. When this device is anonymous and you set
+         * `link: true`, an anon→social upgrade KEEPS the same user id (sub) — the
+         * anon account is promoted in place (like Firebase linkWithCredential)
+         * instead of a device-takeover that mints a new id. No effect when the
+         * device isn't anonymous, or when the social identity already belongs to
+         * another account (collision → falls back to takeover/merge).
+         */
+        link?: boolean;
     }): Promise<AuthUser>;
-    signInWithGoogle(code: string, redirectUri: string): Promise<AuthUser>;
+    signInWithGoogle(code: string, redirectUri: string, link?: boolean): Promise<AuthUser>;
     signInWithGitHub(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithApple(input: {
         idToken?: string;
@@ -489,6 +497,8 @@ declare class Auth {
             firstName?: string;
             lastName?: string;
         };
+        /** ADR-025: keep the same user id on an anon→Apple upgrade. See `loginSocial`. */
+        link?: boolean;
     }): Promise<AuthUser>;
     signInWithMicrosoft(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithLinkedIn(code: string, redirectUri: string): Promise<AuthUser>;
@@ -985,6 +995,33 @@ declare class SendoraSDK {
     getAnonymousIdSync(): string | null;
     /** Current identified user id, if any. */
     getUserId(): string | null;
+    /**
+     * Non-throwing, synchronous read of the verified auth principal. Returns
+     * the persisted `AuthUser` (`{ id, email, emailVerified, name, isAnonymous }`)
+     * or `null` when no session is hydrated yet. Zero I/O — a pure in-memory read
+     * of the session restored during `init()` — so it is safe on the very first
+     * API call at cold start: await `init()` once (disk-only, no network), then
+     * read this synchronously, even offline.
+     *
+     * `id` is the JWT `sub` — the durable, server-verified identity to key your
+     * backend data on. Do NOT use `getAnonymousIdSync()` for that (it's a
+     * rotating analytics id). Pair with `isReady()` to tell "still restoring"
+     * apart from "signed out": `null` here while `isReady()` is `false` = init
+     * hasn't finished; `null` while `isReady()` is `true` = genuinely no session.
+     * `isAnonymous` is optional on the wire — test `=== false`, not truthiness.
+     * The access token is re-verified server-side, so reading identity here
+     * (client-untrusted) for UI/routing is safe; never use it as your own
+     * authorization decision.
+     */
+    getUserSync(): AuthUser | null;
+    /**
+     * Non-throwing, synchronous readiness flag. `true` once `init()` has
+     * resolved (storage hydrated + auth session restored). Gate a cold-start
+     * identity read on this so you never mistake "still restoring the session"
+     * for "signed out" — the loading gate every mobile auth SDK expects
+     * (Firebase's init-null caveat, Clerk's `isLoaded`).
+     */
+    isReady(): boolean;
     /** Toggle consent at runtime — when false, events drop instead of fire. */
     setConsent(granted: boolean): void;
     /** Associate a user id + traits with the current anonymous install. */

package/dist/index.d.ts

@@ -230,16 +230,15 @@ declare class Storage {
  * so a UI double-submit can't mint two anonymous users or interleave
  * a signIn + signOut.
  *
- * Tokens (including the refresh token) persist in AsyncStorage, not
- * the iOS Keychain / Android Keystore. AsyncStorage is unencrypted
- * app-sandbox storage: readable by anyone with filesystem/backup
- * access to a jailbroken/rooted or unlocked device, but isolated from
- * other apps by the OS sandbox. There is NO `secureStorage` adapter
- * option today — earlier docs claimed a Keychain/SecureStore-backed
- * adapter that was never implemented. If you ship a follow-up that
- * moves the refresh token to expo-secure-store / react-native-keychain
- * (optional peer dep, Metro-resolvable static import — never an inline
- * require), keep the `auth_refresh_token` storage key for back-compat.
+ * Tokens (including the refresh token) persist in AsyncStorage BY
+ * DEFAULT — unencrypted app-sandbox storage: isolated from other apps
+ * by the OS sandbox, but readable with filesystem/backup access to a
+ * jailbroken/rooted or unlocked device (OWASP MASVS-L1). Since 1.18.0 an
+ * OPTIONAL `secureStorage` adapter (`Sendora.init({ secureStorage })`,
+ * wired in index.ts) routes the SECURE_KEYS (refresh/access/user) through
+ * an app-supplied Keychain / Keystore adapter, with transparent
+ * plaintext→secure migration; omit it and behaviour is unchanged. The
+ * `auth_refresh_token` storage key stays frozen for back-compat either way.
  *
  * Response payloads are validated non-empty before persisting so a
  * malformed/MITM'd response can't install an `id = ""` user.
@@ -478,8 +477,17 @@ declare class Auth {
             firstName?: string;
             lastName?: string;
         };
+        /**
+         * ADR-025 link-in-place opt-in. When this device is anonymous and you set
+         * `link: true`, an anon→social upgrade KEEPS the same user id (sub) — the
+         * anon account is promoted in place (like Firebase linkWithCredential)
+         * instead of a device-takeover that mints a new id. No effect when the
+         * device isn't anonymous, or when the social identity already belongs to
+         * another account (collision → falls back to takeover/merge).
+         */
+        link?: boolean;
     }): Promise<AuthUser>;
-    signInWithGoogle(code: string, redirectUri: string): Promise<AuthUser>;
+    signInWithGoogle(code: string, redirectUri: string, link?: boolean): Promise<AuthUser>;
     signInWithGitHub(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithApple(input: {
         idToken?: string;
@@ -489,6 +497,8 @@ declare class Auth {
             firstName?: string;
             lastName?: string;
         };
+        /** ADR-025: keep the same user id on an anon→Apple upgrade. See `loginSocial`. */
+        link?: boolean;
     }): Promise<AuthUser>;
     signInWithMicrosoft(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithLinkedIn(code: string, redirectUri: string): Promise<AuthUser>;
@@ -985,6 +995,33 @@ declare class SendoraSDK {
     getAnonymousIdSync(): string | null;
     /** Current identified user id, if any. */
     getUserId(): string | null;
+    /**
+     * Non-throwing, synchronous read of the verified auth principal. Returns
+     * the persisted `AuthUser` (`{ id, email, emailVerified, name, isAnonymous }`)
+     * or `null` when no session is hydrated yet. Zero I/O — a pure in-memory read
+     * of the session restored during `init()` — so it is safe on the very first
+     * API call at cold start: await `init()` once (disk-only, no network), then
+     * read this synchronously, even offline.
+     *
+     * `id` is the JWT `sub` — the durable, server-verified identity to key your
+     * backend data on. Do NOT use `getAnonymousIdSync()` for that (it's a
+     * rotating analytics id). Pair with `isReady()` to tell "still restoring"
+     * apart from "signed out": `null` here while `isReady()` is `false` = init
+     * hasn't finished; `null` while `isReady()` is `true` = genuinely no session.
+     * `isAnonymous` is optional on the wire — test `=== false`, not truthiness.
+     * The access token is re-verified server-side, so reading identity here
+     * (client-untrusted) for UI/routing is safe; never use it as your own
+     * authorization decision.
+     */
+    getUserSync(): AuthUser | null;
+    /**
+     * Non-throwing, synchronous readiness flag. `true` once `init()` has
+     * resolved (storage hydrated + auth session restored). Gate a cold-start
+     * identity read on this so you never mistake "still restoring the session"
+     * for "signed out" — the loading gate every mobile auth SDK expects
+     * (Firebase's init-null caveat, Clerk's `isLoaded`).
+     */
+    isReady(): boolean;
     /** Toggle consent at runtime — when false, events drop instead of fire. */
     setConsent(granted: boolean): void;
     /** Associate a user id + traits with the current anonymous install. */

package/dist/index.js

@@ -157,7 +157,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.18.0",
+  version: "1.20.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -662,8 +662,10 @@ var Auth = class {
         if (stashed) prevAnonRefreshToken = stashed;
       }
       if (this.user !== null) await this.wipeLocalIdentity();
-      const payload = { ...input };
+      const { link, ...socialInput } = input;
+      const payload = { ...socialInput };
       if (prevAnonRefreshToken) payload.prevAnonRefreshToken = prevAnonRefreshToken;
+      if (link) payload.linkAnonymous = true;
       const res = await post(
         { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
         "/api/v1/auth-service/login/social",
@@ -686,8 +688,8 @@ var Auth = class {
       return parsed.data.user;
     });
   }
-  signInWithGoogle(code, redirectUri) {
-    return this.loginSocial({ provider: "google", code, redirectUri });
+  signInWithGoogle(code, redirectUri, link) {
+    return this.loginSocial({ provider: "google", code, redirectUri, link });
   }
   signInWithGitHub(code, redirectUri) {
     return this.loginSocial({ provider: "github", code, redirectUri });
@@ -2320,6 +2322,37 @@ var SendoraSDK = class {
   getUserId() {
     return this.userId;
   }
+  /**
+   * Non-throwing, synchronous read of the verified auth principal. Returns
+   * the persisted `AuthUser` (`{ id, email, emailVerified, name, isAnonymous }`)
+   * or `null` when no session is hydrated yet. Zero I/O — a pure in-memory read
+   * of the session restored during `init()` — so it is safe on the very first
+   * API call at cold start: await `init()` once (disk-only, no network), then
+   * read this synchronously, even offline.
+   *
+   * `id` is the JWT `sub` — the durable, server-verified identity to key your
+   * backend data on. Do NOT use `getAnonymousIdSync()` for that (it's a
+   * rotating analytics id). Pair with `isReady()` to tell "still restoring"
+   * apart from "signed out": `null` here while `isReady()` is `false` = init
+   * hasn't finished; `null` while `isReady()` is `true` = genuinely no session.
+   * `isAnonymous` is optional on the wire — test `=== false`, not truthiness.
+   * The access token is re-verified server-side, so reading identity here
+   * (client-untrusted) for UI/routing is safe; never use it as your own
+   * authorization decision.
+   */
+  getUserSync() {
+    return this.ready ? this.auth.getCurrentUser() : null;
+  }
+  /**
+   * Non-throwing, synchronous readiness flag. `true` once `init()` has
+   * resolved (storage hydrated + auth session restored). Gate a cold-start
+   * identity read on this so you never mistake "still restoring the session"
+   * for "signed out" — the loading gate every mobile auth SDK expects
+   * (Firebase's init-null caveat, Clerk's `isLoaded`).
+   */
+  isReady() {
+    return this.ready;
+  }
   /** Toggle consent at runtime — when false, events drop instead of fire. */
   setConsent(granted) {
     this.consentGranted = granted;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",