feat: Purchasely 6.1.0 (anonymous user id, API proxy, Web2App redemption)

[kherembourg]

Brings the React Native SDK to Purchasely 6.1.0: the anonymous user id, the API proxy, the Web2App redemption listener and the two redemption analytics events.

Native pins: iOS pod 6.1.0, Android io.purchasely:*:6.1.0. Package version 6.1.0 on all five npm packages.

Changelog 6.1.0

Added

builder(key).anonymousUserId(id: string, override = false)

Sets the anonymous user id that the SDK reports for this device. id must be a canonical UUID string. The SDK stores it uppercase, and applies it only when the device holds no anonymous id yet unless override is true.

await Purchasely.builder('API_KEY')
    .anonymousUserId('3f2504e0-4f89-11d3-9a0c-0305e82c3301')
    .start()

JavaScript has no UUID type, so the id crosses as a string and each bridge parses it. A value that is not a canonical UUID is refused with a log and the modifier is skipped. start() still succeeds. Android's UUID.fromString accepts a short form that iOS NSUUID refuses, so the Android bridge adds a round-trip check to make both platforms agree on what canonical means.

builder(key).proxy(api: string | null)

Routes Purchasely API traffic through a proxy instead of api.purchasely.io, for a region where that host is unreachable, such as mainland China. Only the API host changes; the paywall host and the tracking host stay on production.

await Purchasely.builder('API_KEY').proxy('https://svc.purchasely.io').start()

Three states, and they are not interchangeable:

Call	Effect
.proxy('https://…')	Routes the API host through the proxy
.proxy(null)	Clears the proxy, back to api.purchasely.io
never called	Leaves the SDK's current setting untouched

api must be an https base URL with a host, and carry no query, fragment or credentials. Start-time only on both platforms; neither native SDK has a runtime setter.

builder(key).webRedemptionListener(cb, appHandlesRedemptionAlert?)

Reports the outcome of a Web2App redemption ({scheme}://ply/redeem/{token}), on the start chain, matching the native shape (webRedemptionDelegate on iOS, webRedemptionListener on Android).

await Purchasely.builder('API_KEY')
    .webRedemptionListener((result) => {
        if (result.isSuccess) unlock(result.context?.subscription)
        else showError(result.errorCode, result.errorMessage)
    }, true) // optional: the app shows the result screen
    .start()

The callback never crosses the bridge. The native side registers itself as the delegate and forwards each outcome as an event, so the modifier only subscribes the JS callback.

It is on the chain for a reason. A redemption can settle during start(), from a cold start that the link itself triggered or a token a previous launch left pending. The modifier subscribes immediately before the native start() call, so that ordering cannot be got wrong. A later call replaces the earlier chain listener rather than stacking a second one, and a builder that is never started subscribes nothing.

Purchasely.addWebRedemptionListener(cb) and removeWebRedemptionListener() remain for an app that must add or replace the listener while the SDK already runs. A redemption settling during start() is then missed.

PLYWebRedemptionResult is { isSuccess, context, replay, errorCode, errorMessage }. context and context.subscription are separately nullable: a success can describe nothing, and a present context can carry no subscription. A failure still reports replay: false and context: null, so the shape never changes.

Three behaviours integrators need:

• replay is true when the server reports the token was already redeemed. It is a verdict about the token, not about the user.
• A redemption deeplink is not subject to allowDeeplink.
• On both platforms, errorMessage for an expired link can carry a masked email address. That hint is personal data. Show it to the user, do not send it to an analytics stack or a crash reporter, and do not make the rule platform-specific. The REDEMPTION_FAILED event drops the hint on iOS and on Android alike.

builder(key).appHandlesRedemptionAlert(handles: boolean)

Decides who shows the outcome. false (the default) keeps the SDK popin and calls the listener after the user acknowledges it. true shows nothing and calls the listener as soon as the redemption settles.

PLYEventName gains 'REDEMPTION_CONSUMED' and 'REDEMPTION_FAILED'

Both are new on the two native platforms in 6.1.0, verified absent in iOS 6.0.1 and Android 6.0.2. PLYEventProperties.redemption carries the payload: token, receipt (id, validation_status), subscriptions limited to active and non-consumable, and purchase_context on success; token and error_code plus a top-level error_message on failure.

SubscriptionSource.WEB_CHECKOUT_STRIPE

Both natives expose a web-checkout source (Android StoreType.WEB_CHECKOUT_STRIPE, iOS PLYSubscriptionSource.stripe) and the JS enum had no member for it. Web2App redemption grants subscriptions from that source, so context.subscription.subscriptionSource is the payload most likely to carry it.

Changed

sdk_public_doc.md documents the four new builder modifiers, the listener, the redemption result, the nullable subscription fields and the subscriptionSource values.

CLAUDE.md: the claim that native tests cannot run in CI was wrong. Android JUnit has run in the build-android job and iOS XCTest in its own job since 2026-07-23. The CI job list was also missing four jobs.

Fixed

A web checkout subscription reported no source. The Android store-type mapping listed four values and StoreType.WEB_CHECKOUT_STRIPE fell into else -> null. iOS passed its raw value through to an enum with no member for it. Fixed on both bridges plus the enum and the constants type.

purchaseToken, nextRenewalDate and cancelledDate are now ?: string | null. The native iOS PLYSubscription has no purchase token property, so the iOS bridge never emitted the key and omits each date when the native value is nil. Android assigns all three unconditionally from nullable fields, so it sends an explicit null. Optional alone was not enough, since it admits undefined but not null. This also affects userSubscriptions() and userSubscriptionsHistory(), which share the mapper.

Action for integrators: typed code that reads purchaseToken without a guard now fails to compile. The fix exposes runtime behaviour that already shipped; it does not change it.

Platform availability

API	iOS	Android
anonymousUserId	yes	yes
proxy, including null to clear	yes	yes
appHandlesRedemptionAlert	yes	yes
webRedemptionListener on the chain	yes	yes
REDEMPTION_CONSUMED / REDEMPTION_FAILED	yes	yes
SubscriptionSource.WEB_CHECKOUT_STRIPE	yes	yes

iOS privacy manifest

The iOS 6.1.0 pod adds three entries to its PrivacyInfo.xcprivacy: PerformanceData, OtherDiagnosticData and CrashData, all AppFunctionality, none linked to the user and none used for tracking. An app that ships this pod inherits them and may need to update its App Store privacy answers.

Test plan

• yarn all:prepare clean, yarn test 283 passed, yarn lint 0 errors, yarn typecheck clean
• Android bridge compiles against io.purchasely:core:6.1.0; 60 JUnit tests pass
• iOS bridge builds against pod 6.1.0; 83 XCTest tests pass
• Both example apps launch and render a Purchasely paywall, on an Android device and an iOS simulator
• Every new test was verified to fail against the behaviour it replaces

Review findings addressed

Two independent reviews ran against this branch. Every finding was verified against the released 6.1.0 sources before acting, and all are fixed:

• The masked email hint was documented as iOS only. It is on both platforms, and the wording would have led integrators to forward personal data to analytics on Android.
• webRedemptionListener subscribed on the spot and dropped the removal handle, so two calls left two live subscriptions and an unstarted builder leaked one.
• removeWebRedemptionListener() left a stale handle, whose later release drove the iOS listener count one too low. RCTEventEmitter calls stopObserving at zero, which clears the flag gating every event the module sends, so analytics and the paywall lifecycle could go silent with their listeners still registered.
• proxy could be set but never cleared.
• proxy was wrongly documented as Android-only; MOB-308 did land in iOS 6.1.0.
• The subscription fields needed | null, not just optional.
• An RCTLogError red-boxed the host app in debug for a skipped option, while Android only logged. Both now warn.

Notes

• The Android PLYRedemptionProperties sealed-interface change needs no bridge work: PurchaselyModule.kt already reads the payload with event.properties.toMap().
• The Console screen preview change and the purchase-context restore need no bridge surface.
• The Android Kotlin floor does not move. The published core-6.1.0 POM pins kotlin-stdlib 2.3.21, as 6.0.x did. A host app still needs a kotlinVersion override.

[greptile-apps]

Greptile Summary

The PR upgrades all five React Native packages and their native dependencies to Purchasely 6.1.0, adding anonymous-user configuration, Android API proxying, Web2App redemption callbacks, and redemption event types.

• Adds matching Android and iOS redemption bridges and start-time options.
• Exposes the new listener, builder APIs, event payloads, and corrected subscription optionality in TypeScript.
• Adds cross-platform tests, example usage, public documentation, version metadata, and safer per-ref E2E concurrency.
• One explicit repository formatting requirement remains unmet in newly added TypeScript code.

Confidence Score: 4/5

The functional changes appear sound, but the explicit repository indentation requirement must be satisfied before merging.

The earlier dependency, subscription-payload, and documentation findings are no longer outstanding: all three threads were manually resolved, and the current code or supplied resolution evidence addresses each issue. The only remaining finding is that newly added TypeScript uses two-space indentation despite both applicable repository guides requiring four spaces.

Files Needing Attention: packages/purchasely/src/index.ts, packages/purchasely/src/types.ts

Important Files Changed

Filename	Overview
packages/purchasely/android/src/main/java/com/reactnativepurchasely/PurchaselyModule.kt	Adds Android 6.1.0 builder options, redemption event mapping, canonical UUID parsing, and shared subscription serialization.
packages/purchasely/ios/PurchaselyRN.m	Adds iOS anonymous-user and redemption configuration plus the cross-platform redemption result event.
packages/purchasely/src/startBuilder.ts	Adds the anonymous-user, Android proxy, and redemption-alert builder APIs and forwards them atomically at startup.
packages/purchasely/src/index.ts	Exposes the Web2App redemption listener API, with new code requiring formatting to meet repository rules.
packages/purchasely/src/types.ts	Adds redemption event/result types and corrects subscription field optionality, with some new indentation conflicting with repository rules.
sdk_public_doc.md	Documents the new 6.1.0 APIs, lifecycle ordering, platform limitations, and redemption privacy considerations.
.github/workflows/e2e-android.yml	Scopes Android E2E concurrency by ref and limits cancellation to superseded pull-request runs.
.github/workflows/e2e-ios.yml	Scopes iOS E2E concurrency by ref and limits cancellation to superseded pull-request runs.

Sequence Diagram

sequenceDiagram
    participant App as React Native app
    participant JS as Purchasely TypeScript API
    participant Bridge as Native bridge
    participant SDK as Purchasely 6.1.0 SDK

    App->>JS: addWebRedemptionListener(callback)
    App->>JS: builder(apiKey).options().start()
    JS->>Bridge: start(..., startOptions)
    Bridge->>SDK: configure UUID/proxy/redemption delegate
    SDK-->>Bridge: settled redemption result
    Bridge-->>JS: WEB_REDEMPTION_LISTENER
    JS-->>App: callback(PLYWebRedemptionResult)

Loading

Prompt To Fix All With AI

### Issue 1
packages/purchasely/src/index.ts:130-193
**Inconsistent TypeScript Indentation**

The new listener declarations and functions use two-space indentation, but the repository guides require four-space indentation. The same pattern appears in the added object properties around lines 611–612 and in `packages/purchasely/src/types.ts` around lines 125–133. This explicit repository requirement must be satisfied before merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (2): Last reviewed commit: "docs: document anonymousUserId, proxy an..." | Re-trigger Greptile}

[kherembourg]

All 3 Greptile findings addressed. Details in the inline threads.

#	Finding	Outcome
1	P1 Unavailable native dependencies	Obsolete. Native 6.1.0 is published (Maven <latest>6.1.0</latest>, CocoaPods 6.1.0). Podfile.lock is genuine pod update Purchasely output (7dd20fd), not hand-written. All 6 build checks pass. No code change.
2	P1 Incomplete iOS subscription payload	Valid. Fixed in 122898b. Root cause is broader: native iOS PLYSubscription has no purchase token property, so the mapper could never emit it. nextRenewalDate and cancelledDate had the same defect and were also fixed. All three are now optional and documented.
3	P2 Public guide omits APIs	Valid. Fixed in 44faad9. sdk_public_doc.md documents anonymousUserId, proxy (Android only) and the redemption listener, including the "add the listener before start()" rule, the appHandlesRedemptionAlert table and the masked-email warning.

Verification after the fixes: yarn test 269 passed, yarn lint 0 errors, yarn typecheck clean. Android bridge compiles against 6.1.0 with 60 unit tests passing; iOS bridge builds with 77 unit tests passing. Both example apps launch and render a Purchasely paywall (Android device and iOS simulator).

Finding 2 is worth a reviewer's attention beyond this PR: making purchaseToken optional means typed client code that reads it without a guard now fails to compile. That exposes a pre-existing iOS runtime behaviour rather than changing it.