@advenue/react-native 0.6.0 → 0.6.2

package/dist/index.d.cts

@@ -0,0 +1,346 @@
+import { StorageAdapter, SecureStorageAdapter, DeepLink, AdvenueConfig, AdvenueClient, TrackOptions, Consent, DeviceInfo } from '@advenue/sdk-core';
+export { AdvenueConfig, Consent, DeepLink, TrackOptions } from '@advenue/sdk-core';
+
+/**
+ * Minimal structural type for the bits of `react-native-mmkv`'s MMKV instance
+ * we use. Declared locally so this package needs no react-native types at
+ * compile time — the app injects a real `new MMKV()` instance at runtime.
+ */
+interface MMKVLike {
+    set(key: string, value: string): void;
+    getString(key: string): string | undefined;
+    delete(key: string): void;
+}
+/** Wraps an MMKV instance as an Advenue StorageAdapter (synchronous, fast). */
+declare function createMMKVStorage(mmkv: MMKVLike): StorageAdapter;
+
+interface InstallReferrerResult {
+    referrer: string;
+    /** Device-clock: referrerClickTimestampSeconds. */
+    clickTimestamp: number;
+    /** Device-clock: installBeginTimestampSeconds. */
+    installTimestamp: number;
+    /**
+     * Server-clock: referrerClickTimestampServerSeconds (G1 fraud trust —
+     * referrerTrust:'server'). 0 = unverified; absent on older native builds.
+     */
+    clickServerTimestamp?: number;
+    /** Server-clock: installBeginTimestampServerSeconds. 0 = unverified. */
+    installServerTimestamp?: number;
+    googlePlayInstant: boolean;
+}
+interface MetaInstallReferrerResult {
+    installReferrer: string;
+    isClickThrough: boolean;
+    actualTimestamp: number;
+    /** Which Meta app served the referrer (e.g. com.facebook.katana). */
+    provider: string;
+}
+/**
+ * Device metadata for Meta CAPI `extinfo` (Task 3n). Structurally mirrors
+ * `DeviceInfo` from `@advenue/shared` — kept as a local subset type (rather
+ * than importing that package) so this native-module-only package stays
+ * dependency-free; the RN facade's `collectDeviceInfo()` merges it into the
+ * real `DeviceInfo` shape.
+ */
+interface AdvenueDeviceInfo {
+    model?: string;
+    locale?: string;
+    carrier?: string;
+    timezone?: string;
+    screenWidth?: number;
+    screenHeight?: number;
+    screenDensity?: number;
+    cpuCores?: number;
+    totalStorageGb?: number;
+    freeStorageGb?: number;
+}
+interface AdvenueAndroidNativeModule {
+    /** Raw Play Install Referrer; parse with @advenue/install-referrer. */
+    getInstallReferrer(): Promise<InstallReferrerResult | null>;
+    /**
+     * Meta install referrer (null when no Facebook/Instagram app is installed);
+     * parse with parseMetaInstallReferrer from @advenue/install-referrer.
+     */
+    getMetaInstallReferrer(): Promise<MetaInstallReferrerResult | null>;
+    /** Google Advertising ID (GAID) + limit-ad-tracking flag; null when unavailable. */
+    getAdvertisingId(): Promise<{
+        id: string;
+        limitAdTracking: boolean;
+    } | null>;
+    /** App Set ID — non-advertising, developer-scoped fallback id; null when unavailable. */
+    getAppSetId(): Promise<string | null>;
+    /**
+     * Play Integrity Standard API token (G3.1n).
+     *
+     * `requestHash` MUST be sha256_hex("<appId>:<deviceId>") — lowercase hex SHA-256
+     * of the literal string "<appId>:<deviceId>". The server's mapIntegrityVerdict
+     * re-derives the same string and compares it byte-for-byte.
+     *
+     * Rejects when:
+     *  - ECONFIG: `io.advenue.INTEGRITY_CLOUD_PROJECT_NUMBER` meta-data is absent.
+     *  - EUNSUPPORTED: Play Services unavailable or provider warming failed.
+     *  - EINTEGRITY: Play returned an API-level error (network, quota, etc.).
+     *
+     * The JS bridge treats any rejection as "no attestation" and omits the token
+     * from the install event — rejection must never block the install track call.
+     */
+    getIntegrityToken(requestHash: string): Promise<string>;
+    /**
+     * Device metadata (model, locale, screen, cpu, storage, timezone) used to
+     * populate Meta CAPI `extinfo` (Task 3n). Synchronous, best-effort — the JS
+     * facade (`collectDeviceInfo`) treats a thrown error as "unavailable" and
+     * degrades to `{}` rather than blocking anything.
+     */
+    getDeviceInfo(): AdvenueDeviceInfo;
+    /**
+     * Built-in SDK storage (SharedPreferences `io.advenue.sdk`, MODE_PRIVATE) —
+     * the durable offline buffer + SDK state, so the app never supplies storage.
+     * Optional: absent on native builds predating this capability; the RN facade
+     * feature-detects and falls back to in-memory buffering. (No secure variant:
+     * Android has no reinstall-durable store — a reinstall legitimately re-fires
+     * the install, which the backend per-device window deduplicates.)
+     */
+    storageGetItem?(key: string): string | null;
+    storageSetItem?(key: string, value: string): void;
+    storageRemoveItem?(key: string): void;
+    /**
+     * Android SSAID (Settings.Secure.ANDROID_ID) — signing-key-scoped, stable
+     * across reinstalls. The RN facade reads it ONLY when no usable GAID exists
+     * (Adjust-style fallback) and it is used strictly as a first-party
+     * fraud/dedup + reinstall-detection signal, never for ad attribution (Play
+     * policy). Optional: absent on older native builds; feature-detected.
+     */
+    getAndroidId?(): string | null;
+}
+type TrackingAuthorizationStatus = 'notDetermined' | 'restricted' | 'denied' | 'authorized';
+interface AdvenueIosNativeModule {
+    registerAppForAttribution(): void;
+    /**
+     * Conversion value: fine 0–63, coarse 'low'|'medium'|'high'. Updates the
+     * SKAN 4.0 postback, and on iOS 17.4+ the AdAttributionKit postback too.
+     */
+    updateConversionValue(fineValue: number, coarse: string, lockWindow: boolean): Promise<void>;
+    /** Apple Search Ads attribution token (resolve server-side). */
+    getAttributionToken(): Promise<string | null>;
+    /**
+     * Shows the ATT consent prompt; requires NSUserTrackingUsageDescription in
+     * the app's Info.plist. Resolves with the resulting status.
+     */
+    requestTrackingAuthorization(): Promise<TrackingAuthorizationStatus>;
+    getTrackingAuthorizationStatus(): TrackingAuthorizationStatus;
+    getAdvertisingId(): Promise<string | null>;
+    /** Vendor-scoped device id (IDFV) — available without ATT; a fallback anchor. */
+    getIdentifierForVendor(): string | null;
+    /** Clipboard match token (advmatch:<id>) for deterministic deferred deep linking; null if absent. */
+    getPasteboardMatchToken(): string | null;
+    /**
+     * G3.2n — App Attest. Generates (or reuses a keychain-cached) DCAppAttest
+     * key, computes clientDataHash = SHA-256(challenge), and calls
+     * DCAppAttestService.attestKey. Resolves { keyId, attestationObject } where
+     * attestationObject is a base64-encoded CBOR attestation for the server.
+     * Rejects with code EUNSUPPORTED on simulators (isSupported == false).
+     */
+    attestKey(challenge: string): Promise<{
+        keyId: string;
+        attestationObject: string;
+    }>;
+    /**
+     * G3.3n — DeviceCheck. Calls DCDevice.current.generateToken to obtain the
+     * opaque base64 token that identifies this physical device to the Apple
+     * DeviceCheck API. The server queries/updates the persistent 2-bit per-device
+     * flag to detect reinstall abuse. Rejects with code EUNSUPPORTED on devices
+     * where DCDevice.current.isSupported is false (simulator, Catalyst, etc.).
+     */
+    getDeviceCheckToken(): Promise<string>;
+    /**
+     * Device metadata (model, locale, screen, cpu, storage, timezone) used to
+     * populate Meta CAPI `extinfo` (Task 3n). Synchronous, best-effort — the JS
+     * facade (`collectDeviceInfo`) treats a thrown error as "unavailable" and
+     * degrades to `{}` rather than blocking anything.
+     */
+    getDeviceInfo(): AdvenueDeviceInfo;
+    /**
+     * Built-in SDK storage (UserDefaults suite `io.advenue.sdk`) — the durable
+     * offline buffer + SDK state, so the app never supplies storage. Optional:
+     * absent on native builds predating this capability; the RN facade
+     * feature-detects and falls back to in-memory buffering.
+     */
+    storageGetItem?(key: string): string | null;
+    storageSetItem?(key: string, value: string): void;
+    storageRemoveItem?(key: string): void;
+    /**
+     * Built-in secure storage (Keychain, kSecAttrAccessibleAfterFirstUnlock,
+     * ThisDeviceOnly) — survives app reinstall, which is what makes the device
+     * identity and the install guard reinstall-resilient (Adjust-style).
+     * Optional: absent on older native builds; feature-detected.
+     */
+    secureGetItem?(key: string): string | null;
+    secureSetItem?(key: string, value: string): void;
+    secureRemoveItem?(key: string): void;
+}
+
+/**
+ * Minimal structural type for the bits of `expo-secure-store` we use. Declared
+ * locally so this package needs no expo types at compile time — the app passes
+ * the module (`import * as SecureStore from 'expo-secure-store'`) at runtime.
+ */
+interface SecureStoreLike {
+    getItemAsync(key: string): Promise<string | null>;
+    setItemAsync(key: string, value: string): Promise<void>;
+    /** Optional — forwarded so GDPR erasure can wipe the durable entries. */
+    deleteItemAsync?(key: string): Promise<void>;
+}
+/** Wraps expo-secure-store as an Advenue SecureStorageAdapter (async, durable). */
+declare function createSecureStore(secureStore: SecureStoreLike): SecureStorageAdapter;
+
+/**
+ * Parses an OS-delivered link (Universal Link, App Link, or custom scheme) into
+ * the unified {@link DeepLink} shape. The `deepLinkValue` is a best-effort path
+ * (host + path for custom schemes, path for http(s)); the raw `url` is always
+ * provided so the host app can parse it itself when needed.
+ */
+declare function parseDirectLink(url: string): DeepLink;
+
+/**
+ * Lazy access to the native modules that ship inside this package (ios/ and
+ * android/, registered via expo-module.config.json). Host-module resolution
+ * goes through native-require.cjs so Metro sees literal requires (see the
+ * comment there); `requireNativeModule` throws when the native side isn't
+ * built (Expo Go, web, missing pods), so calls stay inside try/catch.
+ */
+declare function getIosNative(): AdvenueIosNativeModule | null;
+declare function getAndroidNative(): AdvenueAndroidNativeModule | null;
+
+/**
+ * Resolves the device advertising id (IDFA on iOS, GAID on Android), gates it
+ * on ATT authorization status (iOS) / limitAdTracking flag (Android), and on
+ * DMA consent when the user is subject to GDPR.  Pushes the result — or an
+ * empty object to clear — into the active client via `setAdvertisingId`.
+ *
+ * Fire-and-forget at call sites; errors are suppressed internally.
+ */
+declare function resolveAdvertisingId(): Promise<void>;
+/**
+ * Collects native device metadata (model, locale, screen, cpu, storage, timezone)
+ * used to populate Meta CAPI `extinfo`. Reads from the platform-appropriate
+ * native module's `getDeviceInfo()`; returns `{}` when the native module or the
+ * method is unavailable (bare React Native without the native SDK, web, Expo
+ * Go, or an older native build predating this method). Never throws — any
+ * native-side error degrades to an empty object so callers can unconditionally
+ * pass the result through.
+ */
+declare function collectDeviceInfo(natives: {
+    platform: 'ios' | 'android' | string;
+    ios?: {
+        getDeviceInfo?: () => Partial<DeviceInfo>;
+    } | null;
+    android?: {
+        getDeviceInfo?: () => Partial<DeviceInfo>;
+    } | null;
+}): DeviceInfo;
+/**
+ * iOS clipboard-match deferred deep linking: reads the `advmatch:<id>` token the
+ * link redirector wrote to the pasteboard and exchanges it for the deep link — a
+ * DETERMINISTIC match (no IDFA, no fingerprinting). Returns null off iOS, when
+ * there's no token, or without consent. (Reading the pasteboard shows the iOS
+ * paste banner — the user-visible, privacy-forward deferred path.)
+ */
+declare function resolveClipboardMatch(): Promise<DeepLink | null>;
+interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platform'> {
+    /**
+     * Auto-detected from React Native's `Platform.OS` — omit it. Pass explicitly
+     * only outside a React Native runtime (tests, custom embeddings); `ios` and
+     * `android` map verbatim, any other RN target (web, desktop) reports as
+     * `web`.
+     */
+    platform?: AdvenueConfig['platform'];
+    /**
+     * @internal Storage override (tests / custom embeddings). The SDK persists
+     * via its own native modules (UserDefaults/SharedPreferences) — apps never
+     * supply storage. When set, it replaces the built-in native storage.
+     */
+    mmkv?: MMKVLike;
+    /**
+     * G3.1n — Play Integrity (Android) / App Attest (iOS) attestation.
+     *
+     * Your app's Advenue appId (the UUID in Settings → API Keys). When set on
+     * Android, the automatic install obtains a Play Integrity Standard token and
+     * attaches it to the install event. The requestHash is computed as
+     * `sha256Hex("<appId>:<deviceId>")`, matching the server's verification
+     * formula exactly (see `makeDecodeAndroid` in the worker).
+     *
+     * Omit to run without attestation (the server field stays `unavailable`).
+     */
+    appId?: string;
+    /**
+     * @internal Secure-store override (tests / custom embeddings). The SDK uses
+     * its own Keychain-backed native storage on iOS for the reinstall-resilient
+     * device identity — apps never supply a secure store. When set, it replaces
+     * the built-in Keychain adapter.
+     */
+    secureStore?: SecureStoreLike;
+    /**
+     * Unified deep-link callback (AppsFlyer UDL style). Fires for both direct
+     * Universal/App Links (the OS opened the app via a link) and deferred deep
+     * links (resolved after an attributed install). The SDK never navigates — the
+     * host app reads `link.deepLinkValue` and routes. Inspect `link.isDeferred`
+     * to distinguish the two. Omit to disable deep-link handling entirely.
+     */
+    onDeepLink?: (link: DeepLink) => void;
+    /**
+     * @internal Test hook — disables the automatic install fired by
+     * `initialize()`. Install tracking is always automatic in production (there
+     * is no public `trackInstall`); tests turn it off to exercise the internal
+     * install path deterministically.
+     */
+    autoTrackInstall?: boolean;
+}
+/**
+ * Maps a React Native AppState status to the client's session lifecycle hooks.
+ * Exported for testing. 'inactive' (transient on iOS) is intentionally ignored
+ * so brief interruptions (Control Center, incoming call) don't end the session.
+ */
+declare function applyAppState(client: Pick<AdvenueClient, 'notifyAppActive' | 'notifyAppBackground'>, status: string): void;
+/**
+ * React Native entry point. Wires MMKV-backed offline buffering automatically
+ * and re-exports the same track surface as the core SDK.
+ */
+declare const Advenue: {
+    initialize(config: RNAdvenueConfig): Promise<AdvenueClient>;
+    track: (name: string, properties?: Record<string, unknown>, opts?: TrackOptions) => void;
+    /**
+     * Shows the iOS ATT prompt (resolves 'authorized' immediately on Android/web,
+     * where ATT doesn't exist) and forwards the result to the consent gate.
+     */
+    requestTrackingAuthorization(): Promise<TrackingAuthorizationStatus>;
+    setTrackingConsent(granted: boolean): void;
+    getTrackingConsent: () => boolean;
+    /** GDPR/CCPA erasure: stop tracking and wipe local identifiers/queue. */
+    forgetMe(): void;
+    setConsentData(consent: Consent): void;
+    getConsentData: () => {
+        isUserSubjectToGDPR: boolean;
+        hasConsentForDataUsage?: boolean | undefined;
+        hasConsentForAdsPersonalization?: boolean | undefined;
+        hasConsentForAdStorage?: boolean | undefined;
+    } | null;
+    flush: () => Promise<void>;
+    getDeviceId: () => string;
+    shutdown(): void;
+};
+/**
+ * Tracks the install event enriched with native attribution data: Play + Meta
+ * install referrers on Android, SKAdNetwork registration on iOS. Fired
+ * automatically by `initialize()` (or its consent deferral); when a
+ * `secureStore` is wired it fires at most once per device (reinstall-resilient
+ * on iOS via Keychain; Android re-fires after a reinstall, which is
+ * unavoidable post-GAID).
+ *
+ * @internal Exported for tests only — install tracking is automatic and this
+ * function is deliberately NOT on the `Advenue` facade. Do not call it from
+ * app code.
+ */
+declare function trackInstall(): Promise<void>;
+
+export { Advenue, type AdvenueAndroidNativeModule, type AdvenueDeviceInfo, type AdvenueIosNativeModule, type InstallReferrerResult, type MMKVLike, type MetaInstallReferrerResult, type RNAdvenueConfig, type SecureStoreLike, type TrackingAuthorizationStatus, applyAppState, collectDeviceInfo, createMMKVStorage, createSecureStore, getAndroidNative, getIosNative, parseDirectLink, resolveAdvertisingId, resolveClipboardMatch, trackInstall };

package/dist/index.d.ts

@@ -204,10 +204,10 @@ declare function parseDirectLink(url: string): DeepLink;
 
 /**
  * Lazy access to the native modules that ship inside this package (ios/ and
- * android/, registered via expo-module.config.json). `requireNativeModule`
- * throws when the native side isn't built (Expo Go, web, missing pods), so
- * resolution happens inside try/catch — never at module scope.
- * expo-modules-core is resolved from the consuming app's Expo install.
+ * android/, registered via expo-module.config.json). Host-module resolution
+ * goes through native-require.cjs so Metro sees literal requires (see the
+ * comment there); `requireNativeModule` throws when the native side isn't
+ * built (Expo Go, web, missing pods), so calls stay inside try/catch.
  */
 declare function getIosNative(): AdvenueIosNativeModule | null;
 declare function getAndroidNative(): AdvenueAndroidNativeModule | null;

package/dist/index.js

@@ -1,12 +1,69 @@
-import { parseInstallReferrer, extractReferrerProperties, parseMetaInstallReferrer } from '@advenue/install-referrer';
-import { DEVICE_ID_KEY, DEFAULT_ENDPOINT, MemoryStorage, resolveDurableDeviceId, AdvenueClient } from '@advenue/sdk-core';
-
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/native-require.cjs
+var require_native_require = __commonJS({
+  "src/native-require.cjs"(exports, module) {
+    "use strict";
+    module.exports.requireExpoModulesCore = function requireExpoModulesCore2() {
+      try {
+        return __require("expo-modules-core");
+      } catch {
+        return null;
+      }
+    };
+    module.exports.requireReactNative = function requireReactNative2() {
+      try {
+        return __require("react-native");
+      } catch {
+        return null;
+      }
+    };
+  }
+});
+
+// src/index.ts
+import {
+  extractReferrerProperties,
+  parseInstallReferrer,
+  parseMetaInstallReferrer
+} from "@advenue/install-referrer";
+import {
+  AdvenueClient,
+  DEFAULT_ENDPOINT,
+  DEVICE_ID_KEY,
+  MemoryStorage,
+  resolveDurableDeviceId
+} from "@advenue/sdk-core";
 
 // ../shared/src/match-token.ts
 var MATCH_TOKEN_PREFIX = "advmatch:";
@@ -165,6 +222,70 @@ function sha256Hex(message) {
   return toHex(sha256Bytes(enc.encode(message)));
 }
 
+// package.json
+var package_default = {
+  name: "@advenue/react-native",
+  version: "0.6.2",
+  description: "Advenue MMP React Native SDK \u2014 attribution, install tracking, and deep links (bundled iOS/Android Expo native modules)",
+  type: "module",
+  license: "MIT",
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      "react-native": "./dist/index.cjs",
+      require: "./dist/index.cjs",
+      default: "./dist/index.js"
+    },
+    "./plugin": "./plugin/index.js"
+  },
+  files: [
+    "dist",
+    "src",
+    "plugin",
+    "scripts",
+    "ios",
+    "android",
+    "expo-module.config.json",
+    "!**/*.test.ts"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsup && node scripts/check-dist.mjs",
+    typecheck: "tsc --noEmit",
+    test: "vitest run"
+  },
+  dependencies: {
+    "@advenue/install-referrer": "workspace:*",
+    "@advenue/sdk-core": "workspace:*"
+  },
+  peerDependencies: {
+    "@expo/config-plugins": ">=8",
+    react: ">=18.2",
+    "react-native": ">=0.74",
+    "expo-modules-core": "*"
+  },
+  peerDependenciesMeta: {
+    "@expo/config-plugins": {
+      optional: true
+    },
+    "expo-modules-core": {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@advenue/shared": "workspace:*",
+    "@advenue/signing": "workspace:*",
+    tsup: "^8.5.1",
+    typescript: "^5.7.2",
+    vitest: "^2.1.8"
+  },
+  "react-native": "./dist/index.cjs"
+};
+
 // src/deep-links.ts
 function parseDirectLink(url) {
   let deepLinkValue = "";
@@ -215,39 +336,43 @@ function createMMKVStorage(mmkv) {
 }
 
 // src/native.ts
+var import_native_require = __toESM(require_native_require(), 1);
 function getIosNative() {
   try {
-    const core = __require("expo-modules-core");
-    return core.requireNativeModule("AdvenueIos");
+    const core = (0, import_native_require.requireExpoModulesCore)();
+    return core ? core.requireNativeModule("AdvenueIos") : null;
   } catch {
     return null;
   }
 }
 function getAndroidNative() {
   try {
-    const core = __require("expo-modules-core");
-    return core.requireNativeModule("AdvenueAndroid");
+    const core = (0, import_native_require.requireExpoModulesCore)();
+    return core ? core.requireNativeModule("AdvenueAndroid") : null;
   } catch {
     return null;
   }
 }
 function getPlatformOS() {
   try {
-    return __require("react-native").Platform.OS ?? null;
+    const rn = (0, import_native_require.requireReactNative)();
+    return rn?.Platform.OS ?? null;
   } catch {
     return null;
   }
 }
 function getAppState() {
   try {
-    return __require("react-native").AppState;
+    const rn = (0, import_native_require.requireReactNative)();
+    return rn?.AppState ?? null;
   } catch {
     return null;
   }
 }
 function getLinking() {
   try {
-    return __require("react-native").Linking;
+    const rn = (0, import_native_require.requireReactNative)();
+    return rn?.Linking ?? null;
   } catch {
     return null;
   }
@@ -428,6 +553,7 @@ var Advenue = {
     secureStore = secureMod ? createSecureStore(secureMod) : createNativeSecureStore(iosMod);
     const deviceId = rest.deviceId ?? await resolveDurableDeviceId(storage, secureStore ?? void 0);
     instance = new AdvenueClient({ ...rest, platform, deviceId, storage });
+    instance.debugLog(`SDK v${package_default.version} \u2014 events -> ${configuredEndpoint}`);
     void resolveAdvertisingId().catch((err) => reportError("enrich.advertisingId", err));
     const deviceInfo = collectDeviceInfo({
       platform,
@@ -680,5 +806,16 @@ async function trackInstall() {
     }
   }
 }
-
-export { Advenue, applyAppState, collectDeviceInfo, createMMKVStorage, createSecureStore, getAndroidNative, getIosNative, parseDirectLink, resolveAdvertisingId, resolveClipboardMatch, trackInstall };
+export {
+  Advenue,
+  applyAppState,
+  collectDeviceInfo,
+  createMMKVStorage,
+  createSecureStore,
+  getAndroidNative,
+  getIosNative,
+  parseDirectLink,
+  resolveAdvertisingId,
+  resolveClipboardMatch,
+  trackInstall
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@advenue/react-native",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Advenue MMP React Native SDK — attribution, install tracking, and deep links (bundled iOS/Android Expo native modules)",
   "type": "module",
   "license": "MIT",
@@ -9,6 +9,8 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
+      "react-native": "./dist/index.cjs",
+      "require": "./dist/index.cjs",
       "default": "./dist/index.js"
     },
     "./plugin": "./plugin/index.js"
@@ -17,6 +19,7 @@
     "dist",
     "src",
     "plugin",
+    "scripts",
     "ios",
     "android",
     "expo-module.config.json",
@@ -47,11 +50,12 @@
     "tsup": "^8.5.1",
     "typescript": "^5.7.2",
     "vitest": "^2.1.8",
-    "@advenue/shared": "0.1.0",
-    "@advenue/signing": "0.0.0"
+    "@advenue/signing": "0.0.0",
+    "@advenue/shared": "0.1.0"
   },
+  "react-native": "./dist/index.cjs",
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node scripts/check-dist.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   }

package/scripts/check-dist.mjs

@@ -0,0 +1,31 @@
+// Publish guard for the Metro __require regression: the CJS build Metro
+// consumes must keep `require("...")` literals (statically analyzable) and
+// must never contain esbuild's `__require` shim. Runs as part of `pnpm build`
+// so a bad dist can never reach npm again.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const cjsPath = fileURLToPath(new URL('../dist/index.cjs', import.meta.url));
+const cjs = readFileSync(cjsPath, 'utf8');
+
+const problems = [];
+// Flag __require CALL SITES with a module-string argument (the Metro-invisible
+// shim calls). esbuild's __commonJS helper legitimately names its inner
+// function `__require()` — a definition, not a dynamic require — so a bare
+// name match would false-positive.
+if (/__require\(\s*["']/.test(cjs)) {
+  problems.push('dist/index.cjs contains esbuild __require shim calls — Metro cannot resolve them');
+}
+for (const mod of ['expo-modules-core', 'react-native']) {
+  // Negative lookbehind: `__require("x")` must NOT satisfy the literal check —
+  // that substring trap is exactly how the original regression slipped through.
+  if (!new RegExp(String.raw`(?<![\w$])require\((?:"${mod}"|'${mod}')\)`).test(cjs)) {
+    problems.push(`dist/index.cjs is missing a genuine literal require("${mod}")`);
+  }
+}
+
+if (problems.length > 0) {
+  console.error(`check-dist failed:\n- ${problems.join('\n- ')}`);
+  process.exit(1);
+}
+console.log('check-dist ok: CJS requires are literal, no __require shims');

package/src/index.ts

@@ -19,6 +19,7 @@ import {
 } from '@advenue/sdk-core';
 import { parseMatchToken } from '@advenue/shared/match-token';
 import { sha256Hex } from '@advenue/signing';
+import pkg from '../package.json' with { type: 'json' };
 import { type DeepLinkHandle, setupDeepLinks } from './deep-links';
 import { type MMKVLike, createMMKVStorage } from './mmkv-storage';
 import {
@@ -371,6 +372,9 @@ export const Advenue = {
     const deviceId =
       rest.deviceId ?? (await resolveDurableDeviceId(storage, secureStore ?? undefined));
     instance = new AdvenueClient({ ...rest, platform, deviceId, storage });
+    // One-line ground truth for "which SDK build talks to which host" — the
+    // exact questions a silent integration always raises first.
+    instance.debugLog(`SDK v${pkg.version} — events -> ${configuredEndpoint}`);
     // (a) resolve ad-id at init time
     void resolveAdvertisingId().catch((err) => reportError('enrich.advertisingId', err));
     // Collect native device info (Meta CAPI extinfo) once at init time; a