refactor(audience): make identityType mandatory on Identify and Alias

CDP requires identityType on every identify / alias event so it can
match records to the correct identity namespace during data deletion.
Enforce the invariant through the type system end to end:

- `Identify(userId, identityType, traits?)` — identityType is
  non-nullable. The null/empty warn-and-drop block is gone; the type
  signature no longer lies about optionality.
- `Alias(fromId, fromType, toId, toType)` — fromType and toType are
  non-nullable. Same block removed.
- `MessageBuilder.Identify` — identityType parameter is non-nullable
  and always emitted; the conditional that omitted an empty field is
  gone so the wire shape cannot drift.
- `IdentityType.ToLowercaseString()` — casting to an out-of-range
  enum value now throws `ArgumentOutOfRangeException` rather than
  returning null. A silent null used to leak through to a dropped
  event; now the programmer error fails loud at the call site.

Tests repointed: invalid-enum-cast cases assert the throw, and
MessageBuilder tests that passed `null` for identityType now pass a
valid value since the parameter is no longer nullable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Runtime/Events/MessageBuilder.cs

@@ -35,7 +35,7 @@ internal static Dictionary<string, object> Track(
         internal static Dictionary<string, object> Identify(
             string? anonymousId,
             string? userId,
-            string? identityType,
+            string identityType,
             string packageVersion,
             Dictionary<string, object>? traits = null)
         {
@@ -47,8 +47,7 @@ internal static Dictionary<string, object> Identify(
             if (!string.IsNullOrEmpty(userId))
                 msg[MessageFields.UserId] = Truncate(userId, Constants.MaxFieldLength);
 
-            if (!string.IsNullOrEmpty(identityType))
-                msg["identityType"] = Truncate(identityType, Constants.MaxFieldLength);
+            msg["identityType"] = Truncate(identityType, Constants.MaxFieldLength);
 
             if (traits != null && traits.Count > 0)
             {

src/Packages/Audience/Runtime/IdentityType.cs

@@ -17,10 +17,12 @@ public enum IdentityType
 
     internal static class IdentityTypeExtensions
     {
-        // Returns null on unknown casts. The string overloads of Identify /
-        // Alias check for null/empty and drop + warn, so an out-of-range
-        // cast surfaces as a dropped event, not a corrupt wire payload.
-        internal static string? ToLowercaseString(this IdentityType type) => type switch
+        // Throws on unknown casts. The CDP pipeline requires identityType on
+        // every identify / alias event to match records to the correct
+        // identity namespace during data deletion, so an out-of-range cast
+        // must fail loudly rather than ship an event with a missing or
+        // empty namespace.
+        internal static string ToLowercaseString(this IdentityType type) => type switch
         {
             IdentityType.Passport => "passport",
             IdentityType.Steam => "steam",
@@ -30,7 +32,8 @@ internal static class IdentityTypeExtensions
             IdentityType.Discord => "discord",
             IdentityType.Email => "email",
             IdentityType.Custom => "custom",
-            _ => null,
+            _ => throw new System.ArgumentOutOfRangeException(nameof(type), type,
+                "Unknown IdentityType value; cast an out-of-range value."),
         };
     }
 }

src/Packages/Audience/Runtime/ImmutableAudience.cs

@@ -175,7 +175,11 @@ public static void Identify(string userId, IdentityType identityType, Dictionary
 
         // Attach a known user id to subsequent events. String overload for
         // providers not in IdentityType.
-        public static void Identify(string userId, string? identityType, Dictionary<string, object>? traits = null)
+        //
+        // identityType is required: CDP uses it to match identify events to
+        // the correct identity namespace when processing data-deletion
+        // requests, so an event without one cannot be cleaned up.
+        public static void Identify(string userId, string identityType, Dictionary<string, object>? traits = null)
         {
             if (!_initialized) return;
 
@@ -185,11 +189,6 @@ public static void Identify(string userId, string? identityType, Dictionary<stri
                 Log.Warn("Identify called with null or empty userId — dropping.");
                 return;
             }
-            if (string.IsNullOrEmpty(identityType))
-            {
-                Log.Warn("Identify called with null or empty identityType — dropping.");
-                return;
-            }
             if (_consent != ConsentLevel.Full)
             {
                 Log.Warn($"Identify discarded — requires Full consent, current is {_consent}");
@@ -213,7 +212,11 @@ public static void Alias(string fromId, IdentityType fromType, string toId, Iden
 
         // Link two user ids for the same player. String overload for
         // providers not in IdentityType.
-        public static void Alias(string fromId, string? fromType, string toId, string? toType)
+        //
+        // fromType and toType are required: CDP uses them to match alias
+        // events to the correct identity namespaces when processing
+        // data-deletion requests.
+        public static void Alias(string fromId, string fromType, string toId, string toType)
         {
             if (!_initialized) return;
 
@@ -222,11 +225,6 @@ public static void Alias(string fromId, string? fromType, string toId, string? t
                 Log.Warn("Alias called with null or empty fromId/toId — dropping.");
                 return;
             }
-            if (string.IsNullOrEmpty(fromType) || string.IsNullOrEmpty(toType))
-            {
-                Log.Warn("Alias called with null or empty fromType/toType — dropping.");
-                return;
-            }
             if (_consent != ConsentLevel.Full)
             {
                 Log.Warn($"Alias discarded — requires Full consent, current is {_consent}");

src/Packages/Audience/Tests/Runtime/Events/MessageBuilderTests.cs

@@ -75,7 +75,7 @@ public void Alias_AllFourFieldsPresent()
         public void AllMessages_ContextContainsLibraryAndLibraryVersion()
         {
             var track = MessageBuilder.Track("evt", null, null, PackageVersion);
-            var identify = MessageBuilder.Identify(null, "u1", null, PackageVersion);
+            var identify = MessageBuilder.Identify(null, "u1", "steam", PackageVersion);
             var alias = MessageBuilder.Alias("f", "t1", "t", "t2", PackageVersion);
 
             foreach (var msg in new[] { track, identify, alias })
@@ -90,7 +90,7 @@ public void AllMessages_ContextContainsLibraryAndLibraryVersion()
         public void AllMessages_SurfaceIsUnity()
         {
             var track = MessageBuilder.Track("evt", null, null, PackageVersion);
-            var identify = MessageBuilder.Identify(null, "u1", null, PackageVersion);
+            var identify = MessageBuilder.Identify(null, "u1", "steam", PackageVersion);
             var alias = MessageBuilder.Alias("f", "t1", "t", "t2", PackageVersion);
 
             Assert.AreEqual("unity", track["surface"]);

src/Packages/Audience/Tests/Runtime/IdentityTypeTests.cs

@@ -1,3 +1,4 @@
+using System;
 using NUnit.Framework;
 
 namespace Immutable.Audience.Tests
@@ -19,14 +20,15 @@ public void ToLowercaseString_MapsEachEnumValueToLowercaseBackendString(Identity
         }
 
         [Test]
-        public void ToLowercaseString_UnknownValue_ReturnsNull()
+        public void ToLowercaseString_UnknownValue_Throws()
         {
-            // Never-throw contract: an out-of-range cast should not surface an
-            // exception on the game thread. Callers drop the event via their
-            // null/empty check instead.
+            // CDP matches identify / alias events by identityType during data
+            // deletion; an out-of-range cast would otherwise ship an event
+            // with an empty namespace that CDP cannot clean up. Fail loud so
+            // the programmer error surfaces at the call site instead.
             var invalid = (IdentityType)999;
 
-            Assert.IsNull(invalid.ToLowercaseString());
+            Assert.Throws<ArgumentOutOfRangeException>(() => invalid.ToLowercaseString());
         }
     }
 }

src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs

@@ -133,36 +133,29 @@ public void Identify_NullUserId_DoesNotEnqueue()
         }
 
         [Test]
-        public void Identify_InvalidIdentityTypeCast_DoesNotThrow_AndDropsEvent()
+        public void Identify_InvalidIdentityTypeCast_Throws()
         {
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
 
             var invalid = (IdentityType)999;
 
-            Assert.DoesNotThrow(() => ImmutableAudience.Identify("user1", invalid));
-
-            ImmutableAudience.Shutdown();
-            var queueDir = AudiencePaths.QueueDir(_testDir);
-            var contents = Directory.GetFiles(queueDir, "*.json").Select(File.ReadAllText);
-            Assert.IsFalse(contents.Any(c => c.Contains("\"identify\"")),
-                "invalid enum cast must drop the identify event, not enqueue it");
+            Assert.Throws<ArgumentOutOfRangeException>(
+                () => ImmutableAudience.Identify("user1", invalid),
+                "invalid enum cast must throw so a broken call fails loud rather than " +
+                "shipping an identify event CDP cannot match for deletion");
         }
 
         [Test]
-        public void Alias_InvalidIdentityTypeCast_DoesNotThrow_AndDropsEvent()
+        public void Alias_InvalidIdentityTypeCast_Throws()
         {
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
 
             var invalid = (IdentityType)999;
 
-            Assert.DoesNotThrow(() =>
-                ImmutableAudience.Alias("fromId", invalid, "toId", IdentityType.Steam));
-
-            ImmutableAudience.Shutdown();
-            var queueDir = AudiencePaths.QueueDir(_testDir);
-            var contents = Directory.GetFiles(queueDir, "*.json").Select(File.ReadAllText);
-            Assert.IsFalse(contents.Any(c => c.Contains("\"alias\"")),
-                "invalid enum cast must drop the alias event, not enqueue it");
+            Assert.Throws<ArgumentOutOfRangeException>(
+                () => ImmutableAudience.Alias("fromId", invalid, "toId", IdentityType.Steam),
+                "invalid enum cast must throw so a broken alias call fails loud rather " +
+                "than shipping an event CDP cannot match for deletion");
         }
 
         [Test]