pulse-updates 1.3.10 → 1.5.0

package/src/links.ts

@@ -122,14 +122,6 @@ export interface AnonymousFirstOpenContext {
   /** JavaScript Date#getTimezoneOffset semantics, bounded to real-world UTC offsets. */
   timezoneOffsetMinutes?: number;
   isEmulator?: boolean;
-  /**
-   * The address the person is signed in with, when the host app has one. An install that arrives
-   * with an account does not need to be guessed at: the resolver binds it to the message sent to
-   * that address and skips probabilistic matching entirely. Omitted for signed-out first opens,
-   * and never read from the clipboard or any other ambient source — the app passes what it
-   * already knows, or nothing.
-   */
-  accountEmail?: string;
 }
 
 export type AnonymousFirstOpenResult =
@@ -270,16 +262,15 @@ export interface DeferredLinkClientOptions<Action extends string = DeferredLinkA
   /** Phase-one public campaign exposures are 128-bit hex; account tokens use the wider grammar. */
   isPublicToken?: (token: string) => boolean;
   /**
-   * Whether a first open may name the signed-in account.
+   * Where to read the signed-in address, when the integrator wants a first open to name it.
    *
-   * Off by default, and deliberately a second switch rather than "the host passed one, so send
-   * it": an address is the only piece of the first-open request that identifies a person, and an
-   * integrator adopting Pulse must choose to send it rather than discover later that reading their
-   * own auth state started forwarding addresses. With it on, an install that arrives signed in is
-   * bound to the message sent to that address instead of being inferred from device shape and
-   * timing — the only deterministic signal left where no store referrer survives.
+   * Provide it and an install that arrives already signed in is bound to the message sent to that
+   * address, instead of being inferred from device shape and timing — the only deterministic
+   * signal left where no store referrer survives. Leave it out and nothing about the account is
+   * ever sent: absent is off, so an integrator cannot enable this by accident, and there is no
+   * second switch to keep in sync with it. Read at the moment of the request, never stored.
    */
-  sendAccountEmailOnFirstOpen?: boolean;
+  getAccountEmail?: () => string | null | undefined;
 }
 
 export interface DeferredLinkClient {
@@ -1627,9 +1618,13 @@ export function createPulseLinkClient<Action extends string = DeferredLinkAction
       return 'retry_scheduled';
     }
 
-    const accountEmail = options.sendAccountEmailOnFirstOpen === true
-      ? normalizeAccountEmail(context.accountEmail)
-      : null;
+    let accountEmail: string | null = null;
+    try {
+      accountEmail = normalizeAccountEmail(options.getAccountEmail?.());
+    } catch {
+      // A host that cannot answer right now simply does not name the account; matching carries on.
+      accountEmail = null;
+    }
     const body = {
       appBundleId: context.appBundleId.trim(),
       platform: 'ios' as const,

package/src/subject.ts

@@ -0,0 +1,47 @@
+/** Scalar signals supplied by the host app. Never send contact details or credentials. */
+export type PulseAttributeValue = string | number | boolean | Date | null | undefined;
+export interface PulseUserProfile {
+  id: string;
+  /** Backend account creation time, never installation/update time. */
+  registrationDate?: string | Date | null;
+  attributes?: Record<string, PulseAttributeValue>;
+}
+
+/** Normalize the wire format shared by config and decisions. pulse.* belongs to the server. */
+export function normalizePulseAttributes(
+  attributes?: Record<string, PulseAttributeValue>,
+): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const [rawKey, value] of Object.entries(attributes ?? {})) {
+    const key = rawKey.trim();
+    if (!key || key.length > 128 || key.toLowerCase().startsWith('pulse.') || value == null) continue;
+    let scalar: string;
+    if (value instanceof Date) {
+      if (!Number.isFinite(value.getTime())) continue;
+      scalar = value.toISOString();
+    } else if (typeof value === 'number') {
+      if (!Number.isFinite(value)) continue;
+      scalar = String(value);
+    } else if (typeof value === 'string' || typeof value === 'boolean') scalar = String(value);
+    else continue;
+    if (scalar.length > 1024) continue;
+    result[key] = scalar;
+    if (Object.keys(result).length >= 64) break;
+  }
+  return result;
+}
+
+export function pulseProfileAttributes(profile?: PulseUserProfile): Record<string, string> {
+  const attributes = normalizePulseAttributes(profile?.attributes);
+  if (profile?.registrationDate != null) {
+    // An explicit invalid backend date must not fall back to a conflicting custom value.
+    for (const key of Object.keys(attributes)) if (key.toLowerCase() === 'registeredat') delete attributes[key];
+    const raw = profile.registrationDate;
+    const date = raw instanceof Date ? raw : /^\d{4}-\d{2}-\d{2}(T.*(Z|[+-]\d{2}:\d{2}))?$/i.test(raw) ? new Date(raw) : null;
+    if (date && Number.isFinite(date.getTime())) {
+      if (Object.keys(attributes).length >= 64) delete attributes[Object.keys(attributes)[63]!];
+      attributes.registeredAt = date.toISOString();
+    }
+  }
+  return attributes;
+}