feat(with-privy): add account linking and one-liner Privy identify

[yosriady]

Demonstrates Privy account linking and how Formo clusters a multi-wallet Privy user into a single user.

Important

Draft — blocked on the SDK release. This example uses formo.identify(user, { privy: true }), added in getformo/sdk#304 and not yet published. package.json therefore requires @formo/analytics ^1.34.0, so CI's pnpm install --frozen-lockfile will fail until that version is on npm. Once it publishes: run pnpm install in with-privy/ to refresh the lockfile, then mark this ready for review.

The problem

A Privy user is one account (a DID) with many linked wallets. Formo's analytics is address-keyed, so one person with 8 wallets becomes 8 Formo users — retention, conversion, and user counts are all wrong.

What changed

src/components/LinkedAccounts.tsx (new) — the account-linking surface:

• useLinkAccount with link buttons for 15 account types. Already-linked types are hidden, except wallets and passkeys, which Privy allows many of.
• Per-account unlink routed to the matching Privy method. unlinkOAuth covers both built-in <provider>_oauth types and custom custom:<provider> ones. Types with no unlink method (custom_auth, guest) are disabled rather than left to throw, and unlink is disabled entirely when one account remains, since Privy requires a user to keep at least one.
• A live parsePrivyProperties(user) preview showing exactly what identify() sends.

src/app/page.tsx — replaces the manual parsePrivyProperties loop with the one-liner:

formo.identify(user, { privy: true, activeAddress });

This identifies every linked wallet under the user's DID in one call. Only the active wallet takes over event attribution; the rest are recorded for clustering.

Two React details worth reviewing

• The identify effect depends on the active address string, not the useWallets() array — that array is a new reference on many renders and would re-run the effect every render.
• The link callbacks deliberately do not re-identify. user is reactive, so the effect already re-runs after every link/unlink; identifying from a callback can run against a pre-link user and emit a redundant, out-of-order identify just before the effect emits the correct one.

Verification

tsc --noEmit clean and next build succeeds against a local build of the SDK branch.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.