@sendoracloud/sdk-react-native 1.30.0 → 1.32.0

package/dist/index.cjs

@@ -202,7 +202,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.30.0",
+  version: "1.32.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -697,9 +697,21 @@ var Auth = class {
    * keyed by the anonymous id — your own users table, an analytics
    * cache, an audience filter — without needing a webhook receiver.
    *
-   * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
-   * `verifyEmailOtp`, `passkey authentication`, and SSO completion
-   * (via `consumeSsoFragment`). Returns an unsubscribe function.
+   * Fires on EVERY identified sign-in path — `signIn`, `loginSocial`,
+   * `signInWithGameCenter`, `signInWithPlayGames`, `challengeMfa`,
+   * `verifyMagicLink`, `verifyEmailOtp`, passkey authentication, and SSO
+   * completion (`consumeSsoFragment`) — because it is fired centrally from
+   * `persist()` whenever the response carries `retiredAnonUserId`.
+   *
+   * ⚠ The two gaming paths are the ones that matter most here, and were
+   * missing from this list before 1.31.0. When the presented player identity
+   * already belongs to another account, the sign-in ADOPTS that account and
+   * the anonymous account on this device is retired — its row is DELETED
+   * server-side. This listener is the only client-side signal that happened;
+   * the call itself resolves successfully. If you would rather it not happen
+   * at all, pass `onCredentialInUse: "reject"`.
+   *
+   * Returns an unsubscribe function.
    *
    * Listeners are best-effort: errors thrown inside them are swallowed
    * + logged in dev mode. Auth state never depends on listener success.

package/dist/index.d.cts

@@ -348,20 +348,27 @@ declare class CredentialInUseError extends Error {
 }
 /**
  * What a sign-in should do when the credential you present already belongs to
- * an account (1.30.0).
+ * an account.
  *
- * - `"adopt"` (default — and what every earlier release did unconditionally):
- *   sign in to that account. This is the reinstall-recovery path: a Game Center
- *   / Play Games player identity survives a reinstall server-side, so the
- *   "collision" is usually the SAME person's earlier account. If this device is
- *   anonymous, that anonymous account is retired — **its row is deleted** — and
- *   `onDeviceTakeover` fires with its id.
- * - `"reject"`: throw `CredentialInUseError` and change nothing at all. Use it
- *   when the local anonymous session holds progress you are not willing to
- *   trade. Mirrors Firebase `linkWithCredential`
- *   (`auth/credential-already-in-use`) and Supabase `linkIdentity`.
+ * **You usually want the default — omit this.** Since 1.32.0 the default is
+ * safe by construction: adopt the other account silently when nothing would be
+ * destroyed, and refuse when something would be.
  *
- * `"reject"` blocks the switch; it does not merge the two accounts. To offer
+ * - **Fresh install / no guest session** → nothing to lose, so it adopts. This
+ *   is the reinstall-recovery path: a Game Center / Play Games identity
+ *   survives a reinstall server-side, so the "collision" is usually the SAME
+ *   person's earlier account, and they get it back. Never refused.
+ * - **Live guest session** → adopting would retire it (**its row is deleted**
+ *   and `onDeviceTakeover` fires). Refused with `CredentialInUseError` so you
+ *   can ask the player instead of the SDK guessing on their behalf.
+ *
+ * Override in either direction:
+ *
+ * - `"adopt"` — always adopt, even when it deletes the guest account. This is
+ *   what every release before 1.30.0 did unconditionally.
+ * - `"reject"` — always throw on a collision, even a harmless one.
+ *
+ * ⚠ A refusal blocks the switch; it does not merge the two accounts. To offer
  * "use my other account", catch the error and re-call with `"adopt"`, then
  * migrate your own data from `onDeviceTakeover`'s `retiredAnonUserId`.
  */
@@ -377,7 +384,8 @@ type GameSignInOptions = {
     link?: boolean;
     /**
      * What to do when the player identity already belongs to an account.
-     * Default `"adopt"`. See {@link CredentialCollisionPolicy}.
+     * **Omit it** — the default refuses only when a live guest session would be
+     * deleted. See {@link CredentialCollisionPolicy}.
      */
     onCredentialInUse?: CredentialCollisionPolicy;
 };
@@ -583,9 +591,21 @@ declare class Auth {
      * keyed by the anonymous id — your own users table, an analytics
      * cache, an audience filter — without needing a webhook receiver.
      *
-     * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
-     * `verifyEmailOtp`, `passkey authentication`, and SSO completion
-     * (via `consumeSsoFragment`). Returns an unsubscribe function.
+     * Fires on EVERY identified sign-in path — `signIn`, `loginSocial`,
+     * `signInWithGameCenter`, `signInWithPlayGames`, `challengeMfa`,
+     * `verifyMagicLink`, `verifyEmailOtp`, passkey authentication, and SSO
+     * completion (`consumeSsoFragment`) — because it is fired centrally from
+     * `persist()` whenever the response carries `retiredAnonUserId`.
+     *
+     * ⚠ The two gaming paths are the ones that matter most here, and were
+     * missing from this list before 1.31.0. When the presented player identity
+     * already belongs to another account, the sign-in ADOPTS that account and
+     * the anonymous account on this device is retired — its row is DELETED
+     * server-side. This listener is the only client-side signal that happened;
+     * the call itself resolves successfully. If you would rather it not happen
+     * at all, pass `onCredentialInUse: "reject"`.
+     *
+     * Returns an unsubscribe function.
      *
      * Listeners are best-effort: errors thrown inside them are swallowed
      * + logged in dev mode. Auth state never depends on listener success.
@@ -754,9 +774,9 @@ declare class Auth {
         link?: boolean;
         /**
          * What to do if this social identity (or its verified email) already
-         * belongs to an account. Default `"adopt"` = sign in to it, retiring this
-         * device's anonymous account. `"reject"` throws `CredentialInUseError` and
-         * leaves everything untouched. See {@link CredentialCollisionPolicy}.
+         * belongs to an account. **Omit it** — the default adopts when nothing
+         * would be destroyed and refuses when a live guest session would be
+         * deleted. See {@link CredentialCollisionPolicy}.
          */
         onCredentialInUse?: CredentialCollisionPolicy;
     }): Promise<AuthUser>;

package/dist/index.d.ts

@@ -348,20 +348,27 @@ declare class CredentialInUseError extends Error {
 }
 /**
  * What a sign-in should do when the credential you present already belongs to
- * an account (1.30.0).
+ * an account.
  *
- * - `"adopt"` (default — and what every earlier release did unconditionally):
- *   sign in to that account. This is the reinstall-recovery path: a Game Center
- *   / Play Games player identity survives a reinstall server-side, so the
- *   "collision" is usually the SAME person's earlier account. If this device is
- *   anonymous, that anonymous account is retired — **its row is deleted** — and
- *   `onDeviceTakeover` fires with its id.
- * - `"reject"`: throw `CredentialInUseError` and change nothing at all. Use it
- *   when the local anonymous session holds progress you are not willing to
- *   trade. Mirrors Firebase `linkWithCredential`
- *   (`auth/credential-already-in-use`) and Supabase `linkIdentity`.
+ * **You usually want the default — omit this.** Since 1.32.0 the default is
+ * safe by construction: adopt the other account silently when nothing would be
+ * destroyed, and refuse when something would be.
  *
- * `"reject"` blocks the switch; it does not merge the two accounts. To offer
+ * - **Fresh install / no guest session** → nothing to lose, so it adopts. This
+ *   is the reinstall-recovery path: a Game Center / Play Games identity
+ *   survives a reinstall server-side, so the "collision" is usually the SAME
+ *   person's earlier account, and they get it back. Never refused.
+ * - **Live guest session** → adopting would retire it (**its row is deleted**
+ *   and `onDeviceTakeover` fires). Refused with `CredentialInUseError` so you
+ *   can ask the player instead of the SDK guessing on their behalf.
+ *
+ * Override in either direction:
+ *
+ * - `"adopt"` — always adopt, even when it deletes the guest account. This is
+ *   what every release before 1.30.0 did unconditionally.
+ * - `"reject"` — always throw on a collision, even a harmless one.
+ *
+ * ⚠ A refusal blocks the switch; it does not merge the two accounts. To offer
  * "use my other account", catch the error and re-call with `"adopt"`, then
  * migrate your own data from `onDeviceTakeover`'s `retiredAnonUserId`.
  */
@@ -377,7 +384,8 @@ type GameSignInOptions = {
     link?: boolean;
     /**
      * What to do when the player identity already belongs to an account.
-     * Default `"adopt"`. See {@link CredentialCollisionPolicy}.
+     * **Omit it** — the default refuses only when a live guest session would be
+     * deleted. See {@link CredentialCollisionPolicy}.
      */
     onCredentialInUse?: CredentialCollisionPolicy;
 };
@@ -583,9 +591,21 @@ declare class Auth {
      * keyed by the anonymous id — your own users table, an analytics
      * cache, an audience filter — without needing a webhook receiver.
      *
-     * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
-     * `verifyEmailOtp`, `passkey authentication`, and SSO completion
-     * (via `consumeSsoFragment`). Returns an unsubscribe function.
+     * Fires on EVERY identified sign-in path — `signIn`, `loginSocial`,
+     * `signInWithGameCenter`, `signInWithPlayGames`, `challengeMfa`,
+     * `verifyMagicLink`, `verifyEmailOtp`, passkey authentication, and SSO
+     * completion (`consumeSsoFragment`) — because it is fired centrally from
+     * `persist()` whenever the response carries `retiredAnonUserId`.
+     *
+     * ⚠ The two gaming paths are the ones that matter most here, and were
+     * missing from this list before 1.31.0. When the presented player identity
+     * already belongs to another account, the sign-in ADOPTS that account and
+     * the anonymous account on this device is retired — its row is DELETED
+     * server-side. This listener is the only client-side signal that happened;
+     * the call itself resolves successfully. If you would rather it not happen
+     * at all, pass `onCredentialInUse: "reject"`.
+     *
+     * Returns an unsubscribe function.
      *
      * Listeners are best-effort: errors thrown inside them are swallowed
      * + logged in dev mode. Auth state never depends on listener success.
@@ -754,9 +774,9 @@ declare class Auth {
         link?: boolean;
         /**
          * What to do if this social identity (or its verified email) already
-         * belongs to an account. Default `"adopt"` = sign in to it, retiring this
-         * device's anonymous account. `"reject"` throws `CredentialInUseError` and
-         * leaves everything untouched. See {@link CredentialCollisionPolicy}.
+         * belongs to an account. **Omit it** — the default adopts when nothing
+         * would be destroyed and refuses when a live guest session would be
+         * deleted. See {@link CredentialCollisionPolicy}.
          */
         onCredentialInUse?: CredentialCollisionPolicy;
     }): Promise<AuthUser>;

package/dist/index.js

@@ -157,7 +157,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.30.0",
+  version: "1.32.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -652,9 +652,21 @@ var Auth = class {
    * keyed by the anonymous id — your own users table, an analytics
    * cache, an audience filter — without needing a webhook receiver.
    *
-   * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
-   * `verifyEmailOtp`, `passkey authentication`, and SSO completion
-   * (via `consumeSsoFragment`). Returns an unsubscribe function.
+   * Fires on EVERY identified sign-in path — `signIn`, `loginSocial`,
+   * `signInWithGameCenter`, `signInWithPlayGames`, `challengeMfa`,
+   * `verifyMagicLink`, `verifyEmailOtp`, passkey authentication, and SSO
+   * completion (`consumeSsoFragment`) — because it is fired centrally from
+   * `persist()` whenever the response carries `retiredAnonUserId`.
+   *
+   * ⚠ The two gaming paths are the ones that matter most here, and were
+   * missing from this list before 1.31.0. When the presented player identity
+   * already belongs to another account, the sign-in ADOPTS that account and
+   * the anonymous account on this device is retired — its row is DELETED
+   * server-side. This listener is the only client-side signal that happened;
+   * the call itself resolves successfully. If you would rather it not happen
+   * at all, pass `onCredentialInUse: "reject"`.
+   *
+   * Returns an unsubscribe function.
    *
    * Listeners are best-effort: errors thrown inside them are swallowed
    * + logged in dev mode. Auth state never depends on listener success.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.30.0",
+  "version": "1.32.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",