@sendoracloud/sdk-react-native 1.24.0 → 1.26.0

package/dist/index.cjs

@@ -30,8 +30,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AlreadyIdentifiedError: () => AlreadyIdentifiedError,
   Auth: () => Auth,
   AuthError: () => AuthError,
+  CredentialInUseError: () => CredentialInUseError,
   EmailAlreadyTakenError: () => EmailAlreadyTakenError,
   LinkError: () => LinkError,
   Links: () => Links,
@@ -200,7 +202,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.24.0",
+  version: "1.26.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -256,7 +258,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -426,6 +428,18 @@ var EmailAlreadyTakenError = class extends Error {
     this.name = "EmailAlreadyTakenError";
   }
 };
+var AlreadyIdentifiedError = class extends Error {
+  constructor(message = "Already signed in with an identity; use link*() to add a credential, or sign out first") {
+    super(message);
+    this.name = "AlreadyIdentifiedError";
+  }
+};
+var CredentialInUseError = class extends Error {
+  constructor(message = "This credential is already linked to a different account") {
+    super(message);
+    this.name = "CredentialInUseError";
+  }
+};
 var AuthError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -496,6 +510,8 @@ var Auth = class {
     this.refreshFailureCount = 0;
     this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
+    this.deletionCancelledListeners = /* @__PURE__ */ new Set();
+    this.lastDeletionCancelled = null;
     this.lastTakeover = null;
     /**
      * Anon refresh token captured at `signIn()` time, stashed keyed to the
@@ -608,6 +624,36 @@ var Auth = class {
       }
     }
   }
+  /**
+   * Subscribe to deletion-cancelled events (s58.269): fires when a sign-in
+   * cancelled a pending self-service account deletion within its grace window
+   * (the account is restored, same user_id). Use it to show "your account
+   * deletion was cancelled" + reconcile local state. Fires from signIn /
+   * loginSocial / signInWithGameCenter / signInWithPlayGames. Returns an
+   * unsubscribe function; listener errors are swallowed (best-effort).
+   */
+  onDeletionCancelled(listener) {
+    this.deletionCancelledListeners.add(listener);
+    return () => {
+      this.deletionCancelledListeners.delete(listener);
+    };
+  }
+  /** The most recent deletion-cancelled event this session, or null. Cleared on signOut. */
+  getLastDeletionCancelled() {
+    return this.lastDeletionCancelled;
+  }
+  /** Internal — fan out deletion-cancelled to subscribers + cache the latest. */
+  fireDeletionCancelled(userId) {
+    const evt = { userId, at: /* @__PURE__ */ new Date() };
+    this.lastDeletionCancelled = evt;
+    for (const fn of this.deletionCancelledListeners) {
+      try {
+        fn(evt);
+      } catch (err) {
+        if (this.hooks.debug) console.warn("[sendoracloud] onDeletionCancelled listener threw", err);
+      }
+    }
+  }
   /**
    * Returns a VALID (non-expired) access token, or null.
    *
@@ -696,10 +742,13 @@ var Auth = class {
           this.persist(data);
           return data.user;
         } catch (err) {
+          if (err instanceof AuthError && (err.code === "NOT_ANONYMOUS" || err.code === "FORBIDDEN_NON_ANONYMOUS")) {
+            throw new AlreadyIdentifiedError(err.message);
+          }
           if (err instanceof AuthError && (err.code === "CONFLICT" || err.code === "EMAIL_ALREADY_TAKEN")) {
             throw new EmailAlreadyTakenError(err.message);
           }
-          if (err instanceof AuthError && (err.code === "FORBIDDEN_NON_ANONYMOUS" || err.code === "INVALID_REFRESH" || err.code === "UNAUTHORIZED" || err.code === "REFRESH_EXPIRED")) {
+          if (err instanceof AuthError && (err.code === "INVALID_REFRESH" || err.code === "UNAUTHORIZED" || err.code === "REFRESH_EXPIRED")) {
             await this.wipeLocalIdentity();
           } else {
             throw err;
@@ -849,6 +898,92 @@ var Auth = class {
       link
     );
   }
+  // ============================================================
+  // IDENTITY LINKING (ADR-030) — attach a SECOND credential to the
+  // CURRENT signed-in account, preserving the same user id (sub).
+  // ============================================================
+  //
+  // Unlike signUp() / loginSocial({link}) — which only preserve the sub from
+  // an ANONYMOUS session — these operate on an ALREADY-IDENTIFIED account.
+  // No token rotation (the session is unchanged); they refresh the cached user
+  // object in place. Require a signed-in user (throws NOT_SIGNED_IN otherwise).
+  //
+  // Primary use: ONE account across platforms. A Game Center player on iOS
+  // links email/Google; on Android they sign in with that same credential and
+  // land on the SAME sub, progress intact. Collision (the credential already
+  // belongs to another account) → CredentialInUseError (never merges).
+  /** Link email + password to the current account (sub preserved). */
+  linkEmailPassword(email, password) {
+    return this.linkCredential("/api/v1/auth-service/me/link/email", { email, password });
+  }
+  /** Link an OAuth social identity (verified idToken or code) to the current account. */
+  linkSocial(input) {
+    return this.linkCredential("/api/v1/auth-service/me/link/social", input);
+  }
+  /** Convenience: link a Google identity (native idToken, or web code+redirectUri). */
+  linkGoogle(input) {
+    return this.linkSocial({ provider: "google", ...input });
+  }
+  /** Convenience: link an Apple identity (native idToken, or web code+redirectUri). */
+  linkApple(input) {
+    return this.linkSocial({ provider: "apple", ...input });
+  }
+  /**
+   * Link an Apple Game Center identity to the current account. No-arg drives the
+   * native GameKit fetch (needs `@sendoracloud/sdk-react-native-gaming`); or pass
+   * an explicit payload obtained from your own GameKit bridge.
+   */
+  async linkGameCenter(payload) {
+    const body = payload ?? await fetchGameCenterPayloadNative();
+    return this.linkCredential("/api/v1/auth-service/me/link/game-center", { ...body });
+  }
+  /**
+   * Link a Google Play Games identity to the current account. No-arg drives the
+   * native Play Games fetch; or pass an explicit `{ serverAuthCode }`.
+   */
+  async linkPlayGames(payload) {
+    const body = payload ?? await fetchPlayGamesAuthCodeNative();
+    return this.linkCredential("/api/v1/auth-service/me/link/play-games", { ...body });
+  }
+  /**
+   * Shared link executor. POSTs the verified credential with the caller's
+   * end-user Bearer token, then refreshes the cached user object IN PLACE (no
+   * token rotation — the sub is unchanged). Deliberately NOT wrapped in
+   * serialize(): getAccessToken() serializes internally, so re-entering would
+   * deadlock — same non-serialized posture as deleteAccount().
+   */
+  async linkCredential(path, body) {
+    const token = await this.getAccessToken();
+    if (!token) throw new AuthError("NOT_SIGNED_IN", "Sign in before linking a credential");
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      path,
+      body,
+      { Authorization: `Bearer ${token}` }
+    );
+    if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+    }
+    if (!res.ok || !parsed.success || !parsed.data) {
+      const code = parsed.error?.code ?? `HTTP_${res.status}`;
+      if (code === "CREDENTIAL_IN_USE") throw new CredentialInUseError(parsed.error?.message);
+      throw new AuthError(code, parsed.error?.message ?? "Failed to link credential");
+    }
+    if (parsed.data.user) this.updateLocalUser(parsed.data.user);
+    return parsed.data.user ?? this.user;
+  }
+  /**
+   * Refresh the cached user after a link — the sub is unchanged, so only the
+   * user object + its storage copy are updated (no token/identity rotation).
+   */
+  updateLocalUser(user) {
+    this.user = user;
+    this.hooks.storage.set(USER_KEY, JSON.stringify(user));
+  }
   /**
    * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
    * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1496,12 +1631,16 @@ var Auth = class {
     if (data.retiredAnonUserId) {
       this.fireDeviceTakeover(data.retiredAnonUserId, data.user.id);
     }
+    if (data.reactivatedFromDeletion) {
+      this.fireDeletionCancelled(data.user.id);
+    }
   }
   async wipeLocalIdentity() {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
     this.lastTakeover = null;
+    this.lastDeletionCancelled = null;
     this.pendingAnonTakeover = null;
     this.hooks.storage.remove(USER_KEY);
     this.hooks.storage.remove(TOKEN_KEY);
@@ -3214,8 +3353,10 @@ var SendoraCloud = new SendoraSDK();
 var index_default = SendoraCloud;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AlreadyIdentifiedError,
   Auth,
   AuthError,
+  CredentialInUseError,
   EmailAlreadyTakenError,
   LinkError,
   Links,

package/dist/index.d.cts

@@ -292,6 +292,24 @@ interface GameCenterPayload {
 declare class EmailAlreadyTakenError extends Error {
     constructor(message?: string);
 }
+/**
+ * `signUp()` was called on a session that is ALREADY signed in with an
+ * identity (not anonymous). Creating a second account would orphan the
+ * current one — use `linkEmailPassword()` / `linkGoogle()` / … (ADR-030) to
+ * add the credential to THIS account, or sign out first. Distinct from
+ * `EmailAlreadyTakenError`: the email isn't the problem, the live session is.
+ */
+declare class AlreadyIdentifiedError extends Error {
+    constructor(message?: string);
+}
+/**
+ * A credential you tried to LINK (ADR-030) is already attached to a DIFFERENT
+ * account. Sendora never auto-merges two real accounts — sign in to that
+ * account instead, or link a different credential.
+ */
+declare class CredentialInUseError extends Error {
+    constructor(message?: string);
+}
 declare class AuthError extends Error {
     code: string;
     constructor(code: string, message: string);
@@ -326,6 +344,17 @@ interface DeviceTakeoverEvent {
     /** Local clock at the time the SDK observed the event. */
     at: Date;
 }
+/**
+ * Detail handed to `onDeletionCancelled` subscribers (s58.269). Fires once
+ * per sign-in that cancelled a pending self-service deletion within grace —
+ * the account is restored with the SAME user_id.
+ */
+interface DeletionCancelledEvent {
+    /** The restored user_id (unchanged — this is a status flip, not a remap). */
+    userId: string;
+    /** Local clock at the time the SDK observed the event. */
+    at: Date;
+}
 declare class Auth {
     private hooks;
     private user;
@@ -347,6 +376,8 @@ declare class Auth {
     private refreshFailureCount;
     private refreshCooldownUntil;
     private takeoverListeners;
+    private deletionCancelledListeners;
+    private lastDeletionCancelled;
     private lastTakeover;
     /**
      * Anon refresh token captured at `signIn()` time, stashed keyed to the
@@ -416,6 +447,19 @@ declare class Auth {
     getLastDeviceTakeover(): DeviceTakeoverEvent | null;
     /** Internal — fan out to subscribers + cache the latest. */
     private fireDeviceTakeover;
+    /**
+     * Subscribe to deletion-cancelled events (s58.269): fires when a sign-in
+     * cancelled a pending self-service account deletion within its grace window
+     * (the account is restored, same user_id). Use it to show "your account
+     * deletion was cancelled" + reconcile local state. Fires from signIn /
+     * loginSocial / signInWithGameCenter / signInWithPlayGames. Returns an
+     * unsubscribe function; listener errors are swallowed (best-effort).
+     */
+    onDeletionCancelled(listener: (evt: DeletionCancelledEvent) => void): () => void;
+    /** The most recent deletion-cancelled event this session, or null. Cleared on signOut. */
+    getLastDeletionCancelled(): DeletionCancelledEvent | null;
+    /** Internal — fan out deletion-cancelled to subscribers + cache the latest. */
+    private fireDeletionCancelled;
     /**
      * Returns a VALID (non-expired) access token, or null.
      *
@@ -576,6 +620,62 @@ declare class Auth {
     }, opts?: {
         link?: boolean;
     }): Promise<AuthUser>;
+    /** Link email + password to the current account (sub preserved). */
+    linkEmailPassword(email: string, password: string): Promise<AuthUser>;
+    /** Link an OAuth social identity (verified idToken or code) to the current account. */
+    linkSocial(input: {
+        provider: "google" | "github" | "apple" | "microsoft" | "linkedin" | "facebook" | "twitter" | "discord";
+        code?: string;
+        idToken?: string;
+        redirectUri?: string;
+        codeVerifier?: string;
+        appleName?: {
+            firstName?: string;
+            lastName?: string;
+        };
+    }): Promise<AuthUser>;
+    /** Convenience: link a Google identity (native idToken, or web code+redirectUri). */
+    linkGoogle(input: {
+        idToken?: string;
+        code?: string;
+        redirectUri?: string;
+    }): Promise<AuthUser>;
+    /** Convenience: link an Apple identity (native idToken, or web code+redirectUri). */
+    linkApple(input: {
+        idToken?: string;
+        code?: string;
+        redirectUri?: string;
+        appleName?: {
+            firstName?: string;
+            lastName?: string;
+        };
+    }): Promise<AuthUser>;
+    /**
+     * Link an Apple Game Center identity to the current account. No-arg drives the
+     * native GameKit fetch (needs `@sendoracloud/sdk-react-native-gaming`); or pass
+     * an explicit payload obtained from your own GameKit bridge.
+     */
+    linkGameCenter(payload?: GameCenterPayload): Promise<AuthUser>;
+    /**
+     * Link a Google Play Games identity to the current account. No-arg drives the
+     * native Play Games fetch; or pass an explicit `{ serverAuthCode }`.
+     */
+    linkPlayGames(payload?: {
+        serverAuthCode: string;
+    }): Promise<AuthUser>;
+    /**
+     * Shared link executor. POSTs the verified credential with the caller's
+     * end-user Bearer token, then refreshes the cached user object IN PLACE (no
+     * token rotation — the sub is unchanged). Deliberately NOT wrapped in
+     * serialize(): getAccessToken() serializes internally, so re-entering would
+     * deadlock — same non-serialized posture as deleteAccount().
+     */
+    private linkCredential;
+    /**
+     * Refresh the cached user after a link — the sub is unchanged, so only the
+     * user object + its storage copy are updated (no token/identity rotation).
+     */
+    private updateLocalUser;
     /**
      * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
      * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1551,4 +1651,4 @@ declare class SendoraSDK {
 }
 declare const SendoraCloud: SendoraSDK;
 
-export { type AttachLinkingApiOptions, Auth, AuthError, type AuthTokens, type AuthUser, EmailAlreadyTakenError, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };
+export { AlreadyIdentifiedError, type AttachLinkingApiOptions, Auth, AuthError, type AuthTokens, type AuthUser, CredentialInUseError, EmailAlreadyTakenError, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };

package/dist/index.d.ts

@@ -292,6 +292,24 @@ interface GameCenterPayload {
 declare class EmailAlreadyTakenError extends Error {
     constructor(message?: string);
 }
+/**
+ * `signUp()` was called on a session that is ALREADY signed in with an
+ * identity (not anonymous). Creating a second account would orphan the
+ * current one — use `linkEmailPassword()` / `linkGoogle()` / … (ADR-030) to
+ * add the credential to THIS account, or sign out first. Distinct from
+ * `EmailAlreadyTakenError`: the email isn't the problem, the live session is.
+ */
+declare class AlreadyIdentifiedError extends Error {
+    constructor(message?: string);
+}
+/**
+ * A credential you tried to LINK (ADR-030) is already attached to a DIFFERENT
+ * account. Sendora never auto-merges two real accounts — sign in to that
+ * account instead, or link a different credential.
+ */
+declare class CredentialInUseError extends Error {
+    constructor(message?: string);
+}
 declare class AuthError extends Error {
     code: string;
     constructor(code: string, message: string);
@@ -326,6 +344,17 @@ interface DeviceTakeoverEvent {
     /** Local clock at the time the SDK observed the event. */
     at: Date;
 }
+/**
+ * Detail handed to `onDeletionCancelled` subscribers (s58.269). Fires once
+ * per sign-in that cancelled a pending self-service deletion within grace —
+ * the account is restored with the SAME user_id.
+ */
+interface DeletionCancelledEvent {
+    /** The restored user_id (unchanged — this is a status flip, not a remap). */
+    userId: string;
+    /** Local clock at the time the SDK observed the event. */
+    at: Date;
+}
 declare class Auth {
     private hooks;
     private user;
@@ -347,6 +376,8 @@ declare class Auth {
     private refreshFailureCount;
     private refreshCooldownUntil;
     private takeoverListeners;
+    private deletionCancelledListeners;
+    private lastDeletionCancelled;
     private lastTakeover;
     /**
      * Anon refresh token captured at `signIn()` time, stashed keyed to the
@@ -416,6 +447,19 @@ declare class Auth {
     getLastDeviceTakeover(): DeviceTakeoverEvent | null;
     /** Internal — fan out to subscribers + cache the latest. */
     private fireDeviceTakeover;
+    /**
+     * Subscribe to deletion-cancelled events (s58.269): fires when a sign-in
+     * cancelled a pending self-service account deletion within its grace window
+     * (the account is restored, same user_id). Use it to show "your account
+     * deletion was cancelled" + reconcile local state. Fires from signIn /
+     * loginSocial / signInWithGameCenter / signInWithPlayGames. Returns an
+     * unsubscribe function; listener errors are swallowed (best-effort).
+     */
+    onDeletionCancelled(listener: (evt: DeletionCancelledEvent) => void): () => void;
+    /** The most recent deletion-cancelled event this session, or null. Cleared on signOut. */
+    getLastDeletionCancelled(): DeletionCancelledEvent | null;
+    /** Internal — fan out deletion-cancelled to subscribers + cache the latest. */
+    private fireDeletionCancelled;
     /**
      * Returns a VALID (non-expired) access token, or null.
      *
@@ -576,6 +620,62 @@ declare class Auth {
     }, opts?: {
         link?: boolean;
     }): Promise<AuthUser>;
+    /** Link email + password to the current account (sub preserved). */
+    linkEmailPassword(email: string, password: string): Promise<AuthUser>;
+    /** Link an OAuth social identity (verified idToken or code) to the current account. */
+    linkSocial(input: {
+        provider: "google" | "github" | "apple" | "microsoft" | "linkedin" | "facebook" | "twitter" | "discord";
+        code?: string;
+        idToken?: string;
+        redirectUri?: string;
+        codeVerifier?: string;
+        appleName?: {
+            firstName?: string;
+            lastName?: string;
+        };
+    }): Promise<AuthUser>;
+    /** Convenience: link a Google identity (native idToken, or web code+redirectUri). */
+    linkGoogle(input: {
+        idToken?: string;
+        code?: string;
+        redirectUri?: string;
+    }): Promise<AuthUser>;
+    /** Convenience: link an Apple identity (native idToken, or web code+redirectUri). */
+    linkApple(input: {
+        idToken?: string;
+        code?: string;
+        redirectUri?: string;
+        appleName?: {
+            firstName?: string;
+            lastName?: string;
+        };
+    }): Promise<AuthUser>;
+    /**
+     * Link an Apple Game Center identity to the current account. No-arg drives the
+     * native GameKit fetch (needs `@sendoracloud/sdk-react-native-gaming`); or pass
+     * an explicit payload obtained from your own GameKit bridge.
+     */
+    linkGameCenter(payload?: GameCenterPayload): Promise<AuthUser>;
+    /**
+     * Link a Google Play Games identity to the current account. No-arg drives the
+     * native Play Games fetch; or pass an explicit `{ serverAuthCode }`.
+     */
+    linkPlayGames(payload?: {
+        serverAuthCode: string;
+    }): Promise<AuthUser>;
+    /**
+     * Shared link executor. POSTs the verified credential with the caller's
+     * end-user Bearer token, then refreshes the cached user object IN PLACE (no
+     * token rotation — the sub is unchanged). Deliberately NOT wrapped in
+     * serialize(): getAccessToken() serializes internally, so re-entering would
+     * deadlock — same non-serialized posture as deleteAccount().
+     */
+    private linkCredential;
+    /**
+     * Refresh the cached user after a link — the sub is unchanged, so only the
+     * user object + its storage copy are updated (no token/identity rotation).
+     */
+    private updateLocalUser;
     /**
      * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
      * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1551,4 +1651,4 @@ declare class SendoraSDK {
 }
 declare const SendoraCloud: SendoraSDK;
 
-export { type AttachLinkingApiOptions, Auth, AuthError, type AuthTokens, type AuthUser, EmailAlreadyTakenError, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };
+export { AlreadyIdentifiedError, type AttachLinkingApiOptions, Auth, AuthError, type AuthTokens, type AuthUser, CredentialInUseError, EmailAlreadyTakenError, type IdentifyTraits, type LinkCreateInput, type LinkCreateResult, type LinkData, LinkError, type LinkErrorCode, type LinkMatchInput, type LinkOpenedEvent, type LinkOpenedHandler, type LinkStats, Links, type PushTokenReceipt, type PushTokenRegistration, SendoraCloud, type SendoraConfig, type TrackProperties, computeDeviceFingerprint, SendoraCloud as default, extractShortcodeFromUrl, getPlayInstallReferrer };

package/dist/index.js

@@ -157,7 +157,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.24.0",
+  version: "1.26.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -213,7 +213,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -383,6 +383,18 @@ var EmailAlreadyTakenError = class extends Error {
     this.name = "EmailAlreadyTakenError";
   }
 };
+var AlreadyIdentifiedError = class extends Error {
+  constructor(message = "Already signed in with an identity; use link*() to add a credential, or sign out first") {
+    super(message);
+    this.name = "AlreadyIdentifiedError";
+  }
+};
+var CredentialInUseError = class extends Error {
+  constructor(message = "This credential is already linked to a different account") {
+    super(message);
+    this.name = "CredentialInUseError";
+  }
+};
 var AuthError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -453,6 +465,8 @@ var Auth = class {
     this.refreshFailureCount = 0;
     this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
+    this.deletionCancelledListeners = /* @__PURE__ */ new Set();
+    this.lastDeletionCancelled = null;
     this.lastTakeover = null;
     /**
      * Anon refresh token captured at `signIn()` time, stashed keyed to the
@@ -565,6 +579,36 @@ var Auth = class {
       }
     }
   }
+  /**
+   * Subscribe to deletion-cancelled events (s58.269): fires when a sign-in
+   * cancelled a pending self-service account deletion within its grace window
+   * (the account is restored, same user_id). Use it to show "your account
+   * deletion was cancelled" + reconcile local state. Fires from signIn /
+   * loginSocial / signInWithGameCenter / signInWithPlayGames. Returns an
+   * unsubscribe function; listener errors are swallowed (best-effort).
+   */
+  onDeletionCancelled(listener) {
+    this.deletionCancelledListeners.add(listener);
+    return () => {
+      this.deletionCancelledListeners.delete(listener);
+    };
+  }
+  /** The most recent deletion-cancelled event this session, or null. Cleared on signOut. */
+  getLastDeletionCancelled() {
+    return this.lastDeletionCancelled;
+  }
+  /** Internal — fan out deletion-cancelled to subscribers + cache the latest. */
+  fireDeletionCancelled(userId) {
+    const evt = { userId, at: /* @__PURE__ */ new Date() };
+    this.lastDeletionCancelled = evt;
+    for (const fn of this.deletionCancelledListeners) {
+      try {
+        fn(evt);
+      } catch (err) {
+        if (this.hooks.debug) console.warn("[sendoracloud] onDeletionCancelled listener threw", err);
+      }
+    }
+  }
   /**
    * Returns a VALID (non-expired) access token, or null.
    *
@@ -653,10 +697,13 @@ var Auth = class {
           this.persist(data);
           return data.user;
         } catch (err) {
+          if (err instanceof AuthError && (err.code === "NOT_ANONYMOUS" || err.code === "FORBIDDEN_NON_ANONYMOUS")) {
+            throw new AlreadyIdentifiedError(err.message);
+          }
           if (err instanceof AuthError && (err.code === "CONFLICT" || err.code === "EMAIL_ALREADY_TAKEN")) {
             throw new EmailAlreadyTakenError(err.message);
           }
-          if (err instanceof AuthError && (err.code === "FORBIDDEN_NON_ANONYMOUS" || err.code === "INVALID_REFRESH" || err.code === "UNAUTHORIZED" || err.code === "REFRESH_EXPIRED")) {
+          if (err instanceof AuthError && (err.code === "INVALID_REFRESH" || err.code === "UNAUTHORIZED" || err.code === "REFRESH_EXPIRED")) {
             await this.wipeLocalIdentity();
           } else {
             throw err;
@@ -806,6 +853,92 @@ var Auth = class {
       link
     );
   }
+  // ============================================================
+  // IDENTITY LINKING (ADR-030) — attach a SECOND credential to the
+  // CURRENT signed-in account, preserving the same user id (sub).
+  // ============================================================
+  //
+  // Unlike signUp() / loginSocial({link}) — which only preserve the sub from
+  // an ANONYMOUS session — these operate on an ALREADY-IDENTIFIED account.
+  // No token rotation (the session is unchanged); they refresh the cached user
+  // object in place. Require a signed-in user (throws NOT_SIGNED_IN otherwise).
+  //
+  // Primary use: ONE account across platforms. A Game Center player on iOS
+  // links email/Google; on Android they sign in with that same credential and
+  // land on the SAME sub, progress intact. Collision (the credential already
+  // belongs to another account) → CredentialInUseError (never merges).
+  /** Link email + password to the current account (sub preserved). */
+  linkEmailPassword(email, password) {
+    return this.linkCredential("/api/v1/auth-service/me/link/email", { email, password });
+  }
+  /** Link an OAuth social identity (verified idToken or code) to the current account. */
+  linkSocial(input) {
+    return this.linkCredential("/api/v1/auth-service/me/link/social", input);
+  }
+  /** Convenience: link a Google identity (native idToken, or web code+redirectUri). */
+  linkGoogle(input) {
+    return this.linkSocial({ provider: "google", ...input });
+  }
+  /** Convenience: link an Apple identity (native idToken, or web code+redirectUri). */
+  linkApple(input) {
+    return this.linkSocial({ provider: "apple", ...input });
+  }
+  /**
+   * Link an Apple Game Center identity to the current account. No-arg drives the
+   * native GameKit fetch (needs `@sendoracloud/sdk-react-native-gaming`); or pass
+   * an explicit payload obtained from your own GameKit bridge.
+   */
+  async linkGameCenter(payload) {
+    const body = payload ?? await fetchGameCenterPayloadNative();
+    return this.linkCredential("/api/v1/auth-service/me/link/game-center", { ...body });
+  }
+  /**
+   * Link a Google Play Games identity to the current account. No-arg drives the
+   * native Play Games fetch; or pass an explicit `{ serverAuthCode }`.
+   */
+  async linkPlayGames(payload) {
+    const body = payload ?? await fetchPlayGamesAuthCodeNative();
+    return this.linkCredential("/api/v1/auth-service/me/link/play-games", { ...body });
+  }
+  /**
+   * Shared link executor. POSTs the verified credential with the caller's
+   * end-user Bearer token, then refreshes the cached user object IN PLACE (no
+   * token rotation — the sub is unchanged). Deliberately NOT wrapped in
+   * serialize(): getAccessToken() serializes internally, so re-entering would
+   * deadlock — same non-serialized posture as deleteAccount().
+   */
+  async linkCredential(path, body) {
+    const token = await this.getAccessToken();
+    if (!token) throw new AuthError("NOT_SIGNED_IN", "Sign in before linking a credential");
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      path,
+      body,
+      { Authorization: `Bearer ${token}` }
+    );
+    if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+    }
+    if (!res.ok || !parsed.success || !parsed.data) {
+      const code = parsed.error?.code ?? `HTTP_${res.status}`;
+      if (code === "CREDENTIAL_IN_USE") throw new CredentialInUseError(parsed.error?.message);
+      throw new AuthError(code, parsed.error?.message ?? "Failed to link credential");
+    }
+    if (parsed.data.user) this.updateLocalUser(parsed.data.user);
+    return parsed.data.user ?? this.user;
+  }
+  /**
+   * Refresh the cached user after a link — the sub is unchanged, so only the
+   * user object + its storage copy are updated (no token/identity rotation).
+   */
+  updateLocalUser(user) {
+    this.user = user;
+    this.hooks.storage.set(USER_KEY, JSON.stringify(user));
+  }
   /**
    * Shared gaming-identity sign-in. Mirrors `loginSocial`'s anon-takeover +
    * ADR-025 link-in-place handling: reads the anon refresh BEFORE wiping local
@@ -1453,12 +1586,16 @@ var Auth = class {
     if (data.retiredAnonUserId) {
       this.fireDeviceTakeover(data.retiredAnonUserId, data.user.id);
     }
+    if (data.reactivatedFromDeletion) {
+      this.fireDeletionCancelled(data.user.id);
+    }
   }
   async wipeLocalIdentity() {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
     this.lastTakeover = null;
+    this.lastDeletionCancelled = null;
     this.pendingAnonTakeover = null;
     this.hooks.storage.remove(USER_KEY);
     this.hooks.storage.remove(TOKEN_KEY);
@@ -3175,8 +3312,10 @@ var SendoraSDK = class {
 var SendoraCloud = new SendoraSDK();
 var index_default = SendoraCloud;
 export {
+  AlreadyIdentifiedError,
   Auth,
   AuthError,
+  CredentialInUseError,
   EmailAlreadyTakenError,
   LinkError,
   Links,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -56,7 +56,7 @@
   "scripts": {
     "build": "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     "typecheck": "tsc --noEmit",
-    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts"
+    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts"
   },
   "devDependencies": {
     "@types/react": "^19.2.16",