chore(audience-sample): update sample app for sandbox removal and TestMode

- Remove IsTestKey() (referenced removed Constants.TestKeyPrefix).
- Simplify RefreshStatusBar: all keys route to production; prod-warning now
  shows whenever a key is set without a BaseUrl override.
- Add test-mode Toggle to UXML and wire it through InitForm → BuildAudienceConfig.
- Update SampleAppUi: replace SandboxBaseUrl with ExplicitBaseUrl (prod URL),
  add TestMode element name constant.
- Update live-fire tests: rename/replace prod-warning tests to match new behaviour,
  replace sandbox URL with prod URL in BaseUrl-override test, update stale comments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nattb8

examples/audience/Assets/SampleApp/Resources/AudienceSample.uxml

@@ -78,7 +78,7 @@
                         <ui:VisualElement class="field placeholder-host">
                             <ui:Label class="field-label" text="PUBLISHABLE KEY" />
                             <ui:TextField name="publishable-key" />
-                            <ui:Label class="field-placeholder" text="pk_imapik-test-yourkey" />
+                            <ui:Label class="field-placeholder" text="pk_imapik-yourkey" />
                         </ui:VisualElement>
 
                         <ui:VisualElement class="field">
@@ -99,6 +99,12 @@
                                      text="Mirror SDK internal log output into the in-page event log below." />
                         </ui:VisualElement>
 
+                        <ui:VisualElement class="field">
+                            <ui:Toggle name="test-mode" label="TEST MODE" />
+                            <ui:Label class="helper-text below-field"
+                                     text="Tags all outbound events with test: true so the backend can filter them from production analytics." />
+                        </ui:VisualElement>
+
                         <ui:VisualElement name="mobile-attribution-field" class="field">
                             <ui:Toggle name="enable-mobile-attribution" label="MOBILE ATTRIBUTION" />
                             <ui:Label class="helper-text below-field"
@@ -120,7 +126,7 @@
                             <ui:TextField name="base-url" />
                             <ui:Label class="field-placeholder" text="(derived from key)" />
                             <ui:Label class="helper-text below-field"
-                                     text="Bypass the SDK's prefix-based routing and target a specific backend. Leave empty to derive from the publishable key." />
+                                     text="Target a specific backend. Leave empty to use the production endpoint." />
                         </ui:VisualElement>
 
                         <ui:VisualElement class="advanced-grid">

examples/audience/Assets/SampleApp/Scripts/AudienceSample.UI.cs

@@ -51,6 +51,7 @@ private static readonly (string TabId, string PanelId)[] Tabs =
         // ---- UXML element fields (Setup tab) ----
 
         private TextField _publishableKey, _baseUrl, _flushInterval, _flushSize;
+        private Toggle _testMode;
         private DropdownField _initialConsent;
         private Toggle _debug, _enableMobileAttribution;
         private Button _btnInit, _btnFlush, _btnReset, _btnShutdown, _btnDeleteData, _btnRequestAtt;
@@ -181,6 +182,7 @@ private void BindElements()
             _baseUrl        = Require<TextField>("base-url");
             _initialConsent = Require<DropdownField>("initial-consent");
             _debug                    = Require<Toggle>("debug");
+            _testMode                 = Require<Toggle>("test-mode");
             _enableMobileAttribution  = Require<Toggle>("enable-mobile-attribution");
             // Inject a tick Label — Unity 2021.3 runtime panels render the
             // checked state as a plain coloured square otherwise. USS hides
@@ -610,15 +612,10 @@ private void RefreshStatusBar()
             var key = (_publishableKey.value ?? "").Trim();
             var overrideUrl = (_baseUrl?.value ?? "").Trim();
             bool keyEmpty = string.IsNullOrEmpty(key);
-            bool isTest = !keyEmpty && IsTestKey(key);
             bool hasOverride = !string.IsNullOrEmpty(overrideUrl);
-            // BaseUrl override skips prefix-based routing, so the prod-warning
-            // rule no longer applies (studio is in explicit-target mode).
-            string? derivedFromKey = keyEmpty ? null : (isTest ? Constants.SandboxBaseUrl : Constants.ProductionBaseUrl);
-            string? endpoint = hasOverride ? overrideUrl : derivedFromKey;
-            bool warnState = hasOverride || (!keyEmpty && !isTest);
-            SetStatusCell(_statusEndpoint, endpoint, warnState ? "state-warn" : "state-ok");
-            _prodWarning.EnableInClassList("hidden", hasOverride || keyEmpty || isTest);
+            string? endpoint = hasOverride ? overrideUrl : (keyEmpty ? null : Constants.ProductionBaseUrl);
+            SetStatusCell(_statusEndpoint, endpoint, hasOverride ? "state-warn" : "state-ok");
+            _prodWarning.EnableInClassList("hidden", hasOverride || keyEmpty);
 
             var consent = _initialised ? ImmutableAudience.CurrentConsent : ConsentOrder[Mathf.Clamp(_initialConsent?.index ?? 0, 0, ConsentOrder.Length - 1)];
             int cIdx = Array.IndexOf(ConsentOrder, consent);
@@ -676,16 +673,18 @@ internal readonly struct InitForm
             public readonly string BaseUrl;
             public readonly ConsentLevel Consent;
             public readonly bool Debug;
+            public readonly bool TestMode;
             public readonly bool EnableMobileAttribution;
             public readonly int? FlushIntervalMs;
             public readonly int? FlushSize;
 
-            public InitForm(string publishableKey, string baseUrl, ConsentLevel consent, bool debug, bool enableMobileAttribution, int? flushIntervalMs, int? flushSize)
+            public InitForm(string publishableKey, string baseUrl, ConsentLevel consent, bool debug, bool testMode, bool enableMobileAttribution, int? flushIntervalMs, int? flushSize)
             {
                 PublishableKey = publishableKey;
                 BaseUrl = baseUrl;
                 Consent = consent;
                 Debug = debug;
+                TestMode = testMode;
                 EnableMobileAttribution = enableMobileAttribution;
                 FlushIntervalMs = flushIntervalMs;
                 FlushSize = flushSize;
@@ -702,6 +701,7 @@ internal InitForm CaptureInitForm()
                 baseUrl:                 (_baseUrl.value ?? "").Trim(),
                 consent:                 ConsentOrder[consentIdx],
                 debug:                   _debug.value,
+                testMode:                _testMode.value,
                 enableMobileAttribution: _enableMobileAttribution.value,
                 flushIntervalMs:         flushIntervalMs,
                 flushSize:               flushSize);
@@ -780,9 +780,6 @@ private bool IsAliasReady()
                 && (fromId != toId || (_aliasFromType.value ?? "") != (_aliasToType.value ?? ""));
         }
 
-        private static bool IsTestKey(string? key) =>
-            !string.IsNullOrEmpty(key) && key!.StartsWith(Constants.TestKeyPrefix, StringComparison.Ordinal);
-
         private static void FlashCopied(VisualElement ve)
         {
             ve.AddToClassList("copied");

examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs

@@ -331,9 +331,8 @@ private void OnSdkStateChanged()
         // ---- Config builders ----
 
         // Maps the captured Setup form to AudienceConfig. BaseUrl null → SDK
-        // derives the endpoint from the publishable key prefix (test → sandbox,
-        // else production). The flushInterval clamp emits a warn row when
-        // the user requests <1s.
+        // targets the production endpoint. The flushInterval clamp emits a warn
+        // row when the user requests <1s.
         private AudienceConfig BuildAudienceConfig(InitForm form, Action<AudienceError> onError)
         {
             var config = new AudienceConfig
@@ -342,6 +341,7 @@ private AudienceConfig BuildAudienceConfig(InitForm form, Action<AudienceError>
                 BaseUrl                 = string.IsNullOrEmpty(form.BaseUrl) ? null : form.BaseUrl,
                 Consent                 = form.Consent,
                 Debug                   = form.Debug,
+                TestMode                = form.TestMode,
                 EnableMobileAttribution = form.EnableMobileAttribution,
                 OnError                 = onError,
             };
@@ -364,6 +364,7 @@ private static Dictionary<string, object> BuildConfigEcho(AudienceConfig config)
             {
                 ["consent"]                  = config.Consent.ToString(),
                 ["debug"]                    = config.Debug,
+                ["testMode"]                 = config.TestMode,
                 ["enableMobileAttribution"]  = config.EnableMobileAttribution,
                 ["flushIntervalSeconds"]     = config.FlushIntervalSeconds,
                 ["flushSize"]                = config.FlushSize,
@@ -377,7 +378,7 @@ private static Dictionary<string, object> BuildConfigEcho(AudienceConfig config)
             return echo;
         }
 
-        // Keeps the pk_imapik-test- / pk_imapik- prefix visible; masks the rest.
+        // Keeps the pk_imapik- prefix visible; masks the rest.
         // Caller must guard against null/empty; signature non-nullable so the
         // dictionary insertion in BuildInitConfigEcho doesn't trip CS8601.
         private static string RedactPublishableKey(string key)

examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs

@@ -45,15 +45,13 @@ public void SetUp()
                 System.IO.Directory.Delete(sdkDir, recursive: true);
 
             // Unity's bundled Mono runtime ships a curated root-CA set that
-            // does not include the chain api.sandbox.immutable.com presents,
-            // so HttpClient under Mono2x raises "SSL connection could not be
-            // established" on every Flush. The cert is valid; only Mono's
-            // verification fails. IL2CPP uses the OS CA store and is fine.
+            // may not include the full chain the backend presents, so
+            // HttpClient under Mono2x can raise "SSL connection could not be
+            // established". The cert is valid; only Mono's verification fails.
+            // IL2CPP uses the OS CA store and is fine.
             //
-            // Bypass cert validation IN THE TEST PROCESS ONLY so the same
-            // suite exercises both backends. Production SDK code is
-            // untouched. Acceptable risk: this test process talks only to
-            // sandbox; live-fire payloads carry no real user data.
+            // Bypass cert validation IN THE TEST PROCESS ONLY. Production SDK
+            // code is untouched.
             System.Net.ServicePointManager.ServerCertificateValidationCallback =
                 (_, _, _, _) => true;
 
@@ -331,7 +329,7 @@ public IEnumerator Reset_RegeneratesAnonymousIdAndAcceptsTrack()
         {
             // Reset clears identity + queue and rolls a new anonymousId. A
             // following Track must serialise with the new anonymousId and
-            // round-trip to sandbox without errors.
+            // round-trip to the backend without errors.
             yield return LoadAndInit();
 
             _root!.Q<Button>(SampleAppUi.Buttons.TypedEvent("progression")).Click();
@@ -495,12 +493,11 @@ public IEnumerator TypedEvent_LinkClicked_FlushReportsOk()
         [UnityTest]
         public IEnumerator Init_WithBaseUrlOverride_FlushReportsOk()
         {
-            // Explicit BaseUrl skips the publishable-key prefix routing in
-            // Constants. Same target endpoint here, but the override branch is
-            // a different config setup path that IL2CPP could strip independently.
+            // Explicit BaseUrl exercises the override code path independently
+            // of the default-production path — IL2CPP could strip either branch.
             yield return LoadAndInit(configure: root =>
             {
-                root.Q<TextField>(SampleAppUi.Setup.BaseUrl).value = SampleAppUi.SandboxBaseUrl;
+                root.Q<TextField>(SampleAppUi.Setup.BaseUrl).value = SampleAppUi.ExplicitBaseUrl;
             });
 
             _root!.Q<Button>(SampleAppUi.Buttons.TypedEvent("progression")).Click();
@@ -739,29 +736,30 @@ public IEnumerator IdentityPanel_PopulatesUserIdAfterIdentify()
         }
 
         [UnityTest]
-        public IEnumerator ProdWarning_HiddenForTestKey()
+        public IEnumerator ProdWarning_VisibleForAnyKey()
         {
-            // The default env-var key is a test key (pk_imapik-test-…). The
-            // prod-warning banner should stay hidden after RefreshStatusBar.
+            // All keys route to production. The prod-warning banner must be
+            // visible whenever a key is entered without a BaseUrl override.
             yield return LoadSceneOnly();
             _root!.Q<TextField>(SampleAppUi.Setup.PublishableKey).value = _key;
             yield return null;
 
-            Assert.IsTrue(_root.Q<Label>(SampleAppUi.ProdWarning).ClassListContains(SampleAppUi.HiddenClass),
-                "prod-warning should be hidden when the publishable-key is a test key");
+            Assert.IsFalse(_root.Q<Label>(SampleAppUi.ProdWarning).ClassListContains(SampleAppUi.HiddenClass),
+                "prod-warning should be visible when a publishable-key is entered");
         }
 
         [UnityTest]
-        public IEnumerator ProdWarning_VisibleForNonTestKey()
+        public IEnumerator ProdWarning_HiddenWhenBaseUrlOverrideSet()
         {
-            // A key without the "test-" segment looks production. Don't actually
-            // Init so we don't live-fire to prod; just verify the warning UI.
+            // A BaseUrl override puts the studio in explicit-target mode, so
+            // the prod-warning is suppressed.
             yield return LoadSceneOnly();
-            _root!.Q<TextField>(SampleAppUi.Setup.PublishableKey).value = "pk_imapik-fakeprod-zzzz";
+            _root!.Q<TextField>(SampleAppUi.Setup.PublishableKey).value = _key;
+            _root!.Q<TextField>(SampleAppUi.Setup.BaseUrl).value = SampleAppUi.ExplicitBaseUrl;
             yield return null;
 
-            Assert.IsFalse(_root.Q<Label>(SampleAppUi.ProdWarning).ClassListContains(SampleAppUi.HiddenClass),
-                "prod-warning should be visible when the publishable-key looks like a prod key");
+            Assert.IsTrue(_root.Q<Label>(SampleAppUi.ProdWarning).ClassListContains(SampleAppUi.HiddenClass),
+                "prod-warning should be hidden when a BaseUrl override is set");
         }
     }
 }

examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs

@@ -19,18 +19,18 @@ internal static class SampleAppUi
         // Scene asset name registered in EditorBuildSettings.
         internal const string SceneName = "SampleApp";
 
-        // The env var that carries the sandbox publishable key into the
-        // built player at test time. Test runs inject it on the Unity CLI;
-        // CI wires it from the AUDIENCE_TEST_PUBLISHABLE_KEY repo secret.
+        // The env var that carries the publishable key into the built player at
+        // test time. Test runs inject it on the Unity CLI; CI wires it from
+        // the AUDIENCE_TEST_PUBLISHABLE_KEY repo secret.
         internal const string EnvKey = "AUDIENCE_TEST_PUBLISHABLE_KEY";
 
         // Mirrors AudiencePaths.RootDirName — the SDK persists consent /
         // identity / queue under <persistentDataPath>/imtbl_audience. SetUp
         // wipes this between tests so on-disk state can't leak.
         internal const string SdkPersistedDirName = "imtbl_audience";
 
-        // Mirrors Constants.SandboxBaseUrl — used by the BaseUrl-override test.
-        internal const string SandboxBaseUrl = "https://api.sandbox.immutable.com";
+        // Used by the BaseUrl-override test to exercise the explicit-target code path.
+        internal const string ExplicitBaseUrl = "https://api.immutable.com";
 
         // ---- UXML element names ----
         // All names verified against examples/audience/Assets/SampleApp/Resources/AudienceSample.uxml.
@@ -41,6 +41,7 @@ internal static class Setup
             internal const string InitialConsent = "initial-consent";
             internal const string BaseUrl = "base-url";
             internal const string Debug = "debug";
+            internal const string TestMode = "test-mode";
             internal const string FlushInterval = "flush-interval";
             internal const string FlushSize = "flush-size";
         }