[boehlerlukas]

Implements the Project ID contract (7 Nov 2026) for iOS and ports the identity fix from GleapSDK/JavaScript-SDK#208.

1. "SDK key" is now "Project ID"

• New: +[Gleap initializeWithProjectId:] (Swift Gleap.initialize(withProjectId:)) and the projectId property.
• Deprecated aliases that keep working: +[Gleap initializeWithToken:] (Swift initialize(withToken:)) now calls initializeWithProjectId:, and the token property reads and writes projectId. Both are marked __attribute__((deprecated)). That is a compiler warning only, with no runtime log.
• The value is unchanged, so every existing key keeps working.
• Internal reads use projectId. The README, the example app and log lines ("already initialized with this Project ID", "check your Project ID") use the new name. The Api-Token header, the apiKey WebSocket query parameter and the sdkKey field sent to the widget are wire names and stay as they are.

2. The JWT provider restores a signed session after a relaunch

The gap existed. setUserJwt keeps the token in memory only. After a relaunch on a Signed project, /sessions answered identity: { mode: 'signed', signed: false } and the grant was dropped. requestSignedGrantIfNeeded returned early because there was no lastIdentifyAction with a hash. A provider set with setUserJwtProvider was only asked when a token expired, so the user stayed unsigned.

Fix (GleapSessionHelper identifyWithProviderForSignedModeIfNeeded, called after the /sessions answer in startSessionWith: and from setUserJwtProvider:). The provider is asked once per app launch (signedModeProviderAsked, reset in clearSession) when all of these hold:

• the answer says Signed mode and the identified session has no grant (signedGrantMissingFor:)
• no token or user hash is at hand (lastIdentifyAction without a hash)
• no identify is queued or in flight
• a provider is set

The token goes through setUserJwt:, the normal path. That identify is the one signed identify of the session (signedGrantRequestedFor), so there is never a loop. Other behaviour:

• The gate's guards still apply: one call at a time, 10 s timeout, 30 s pause after a failure.
• A nil token sends nothing.
• A logout (sessionEpoch), an identify from the app, or a grant that arrives while the provider runs drops its token.
• A token for another user goes through the existing identity_mismatch recovery.
• Header docs, README and CHANGELOG describe the new behaviour.

Tests

New GleapSignedModeProviderTests, 11 tests:

• the provider is asked once and the identify carries its token, and the grant comes back
• repeated unsigned answers never loop
• a nil token sends nothing and the provider is not asked again
• no provider means no identify
• a provider set after the session answer is asked
• no provider call for a Classic answer, an anonymous session or a live grant
• a token from the app is sent instead of asking the provider
• a logout while the provider runs drops its token
• the deprecated token property aliases projectId

GleapRemoteConfigTests now uses initialize(withProjectId:), and one re-initialize goes through the deprecated initializeWithToken: (called through the runtime, so the build stays warning-free). With the restore disabled, the 5 positive provider tests fail. The other 6 cover the guards and pass either way.

Results

• xcodebuild test -scheme Gleap on the iPhone 18 Pro simulator (Xcode 27.2): 166 tests, 0 failures.
• pod lib lint was not run locally; CI runs it.

Versioning

Gleap.podspec, SDK_VERSION and CHANGELOG.md move to 19.5.0. This is a minor bump for the new initialize(withProjectId:) API; Android goes to 19.5.0 too to stay in sync. Nothing is tagged or pushed to CocoaPods trunk.

For the wrapper SDKs

• Call initializeWithProjectId: when building against native 19.5.0 or later. To support older native versions too, check [Gleap respondsToSelector:@selector(initializeWithProjectId:)] and fall back to initializeWithToken:, which works everywhere.
• The restore logic is native. Wrappers need no logic change; their provider bridge just has to answer within 10 s, pass nil on failure, and work whether it is set before or after initialize.

🤖 Generated with Claude Code