feat: end the Rokt session when the mParticle user changes

[nickolas-dimitrakas]

Why

The Rokt session is bound to a persisted JWT whose expiry extends on every request, and the kit's identity callbacks have always been empty — so on any integration, a user change never ends a Rokt session, and on shared self-service terminals (kiosks, counter tablets) successive customers silently continue one another's session.

Android counterpart of mParticle/mparticle-apple-sdk#819.

What

The kit now calls Rokt.clearSession() from onIdentifyCompleted / onLoginCompleted / onLogoutCompleted, with the MPID transition typed so only a departing known user ends a session:

Transition	Action	Why
anonymous → known	keep session	same person being identified (unknown on payment page, known on confirmation page) — in-session state survives
known → different known	reset	a different person — the kiosk case
known → anonymous	reset	logout — the recommended clean boundary between customers on shared terminals
anonymous → anonymous	no-op	placeholder churn, nobody was known

"Known" = holds any user identity or is logged in. IdentityType contains user identities only on Android, so identity-set emptiness is a safe anonymity signal. MPID 0 (the unassigned sentinel) is never recorded. onModifyCompleted stays empty — modify() cannot change the MPID.

Dependencies

• Requires a Rokt Android SDK release containing Rokt.clearSession() — ROKT/sdk-android-source#1148. Do not merge before the dependency bump.

Testing

• The identical typed rule on iOS was validated end-to-end on simulators against production: startup identify (anonymous → known) no longer resets; same-user placements share one session; a customer switch mints a new one. The SDK-level reset semantics are covered by unit tests in the SDK PR (538 green).
• Kit-level unit tests for the trigger conditions (first observation, repeated MPID, anonymous→known, MPID 0) are a known follow-up for this repo.

🤖 Generated with Claude Code