@advenue/react-native 0.8.0 → 0.9.0

package/android/src/main/java/expo/modules/advenue/AdvenueAndroidModule.kt

@@ -215,10 +215,12 @@ class AdvenueAndroidModule : Module() {
 
     // Play Integrity Standard API — device attestation (G3.1n).
     //
-    // `requestHash` MUST be sha256_hex("<appId>:<deviceId>") — lowercase hex of
-    // SHA-256 over the literal string "<appId>:<deviceId>". The server's
-    // mapIntegrityVerdict (Task 3) re-derives the same string and compares it to
-    // the token's requestHash field; the strings must match byte-for-byte.
+    // `requestHash` MUST be sha256_hex("<deviceId>") — lowercase hex of SHA-256
+    // over the device id alone. The server's mapIntegrityVerdict re-derives the
+    // same string and compares it to the token's requestHash field; the strings
+    // must match byte-for-byte. No app id is hashed in: the token is decoded
+    // against this app's Play package name and must be PLAY_RECOGNIZED, which
+    // binds the app already.
     //
     // The provider is warmed in OnCreate (above). If it is null — because the
     // manifest meta-data key is absent, Play Integrity is unsupported, or warming
@@ -284,6 +286,25 @@ class AdvenueAndroidModule : Module() {
 
       val ctx = appContext.reactContext?.applicationContext
       if (ctx != null) {
+        // Meta CAPI extinfo slots 1-3. versionName is the user-facing version
+        // (slot 2, surfaced as the event's appVersion); the version code is the
+        // build identifier (slot 3). Best-effort: a missing PackageInfo must
+        // not cost the caller the rest of the device metadata.
+        map["packageName"] = ctx.packageName
+        try {
+          val pi = ctx.packageManager.getPackageInfo(ctx.packageName, 0)
+          pi.versionName?.let { map["shortVersion"] = it }
+          @Suppress("DEPRECATION")
+          val code =
+            if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.P) {
+              pi.longVersionCode
+            } else {
+              pi.versionCode.toLong()
+            }
+          map["longVersion"] = code.toString()
+        } catch (_: Exception) {
+          // package info best-effort
+        }
         try {
           val dm = ctx.resources.displayMetrics
           map["screenWidth"] = dm.widthPixels

package/dist/index.cjs

@@ -222,7 +222,7 @@ function sha256Hex(message) {
 // package.json
 var package_default = {
   name: "@advenue/react-native",
-  version: "0.8.0",
+  version: "0.9.0",
   description: "Advenue MMP React Native SDK \u2014 attribution, install tracking, and deep links (bundled iOS/Android Expo native modules)",
   type: "module",
   license: "MIT",
@@ -497,7 +497,7 @@ function resolveDmaConsent() {
   void resolveAdvertisingId().catch((err) => reportError("enrich.advertisingId", err));
   return consent;
 }
-function collectDeviceInfo(natives) {
+function readNativeDeviceInfo(natives) {
   try {
     if (natives.platform === "android" && natives.android?.getDeviceInfo) {
       return natives.android.getDeviceInfo();
@@ -509,6 +509,10 @@ function collectDeviceInfo(natives) {
   }
   return {};
 }
+function collectDeviceInfo(natives) {
+  const { shortVersion: _shortVersion, ...info } = readNativeDeviceInfo(natives);
+  return info;
+}
 function applyAppState(client, status) {
   if (status === "active") {
     client.notifyAppActive();
@@ -527,7 +531,7 @@ var autoInstallPending = false;
 var autoInstallEnabled = true;
 var manualConsentSet = false;
 var tcfCollectionEnabled = false;
-var configuredAppId = null;
+var ATTEST_CHALLENGE_TIMEOUT_MS = 5e3;
 var configuredApiKey = null;
 var configuredEndpoint = import_sdk_core.DEFAULT_ENDPOINT;
 var aemSeenUrlHashes = /* @__PURE__ */ new Set();
@@ -571,7 +575,6 @@ var Advenue = {
       mmkv,
       secureStore: secureMod,
       onDeepLink,
-      appId,
       autoTrackInstall,
       tcfDataCollection,
       ...rest
@@ -581,7 +584,6 @@ var Advenue = {
     tcfCollectionEnabled = tcfDataCollection === true;
     autoInstallEnabled = autoTrackInstall !== false;
     const platform = resolvePlatform(rest.platform);
-    configuredAppId = appId ?? null;
     configuredApiKey = config.apiKey;
     configuredEndpoint = config.endpoint ?? import_sdk_core.DEFAULT_ENDPOINT;
     appStateSub?.remove();
@@ -596,21 +598,26 @@ var Advenue = {
     secureStore = secureMod ? createSecureStore(secureMod) : createNativeSecureStore(iosMod);
     const deviceId = rest.deviceId ?? await (0, import_sdk_core.resolveDurableDeviceId)(storage, secureStore ?? void 0);
     const osVersion = rest.osVersion ?? getOsVersion() ?? void 0;
+    const nativeDeviceInfo = readNativeDeviceInfo({
+      platform,
+      ios: getIosNative(),
+      android: getAndroidNative()
+    });
+    const { shortVersion, ...deviceInfo } = nativeDeviceInfo;
+    const appVersion = rest.appVersion ?? shortVersion ?? void 0;
     instance = new import_sdk_core.AdvenueClient({
       ...rest,
       platform,
       deviceId,
       storage,
-      ...osVersion ? { osVersion } : {}
+      ...osVersion ? { osVersion } : {},
+      ...appVersion ? { appVersion } : {},
+      // Stamped by the SDK, never by the host app — see AdvenueConfig.sdkVersion.
+      sdkVersion: package_default.version
     });
     instance.debugLog(`SDK v${package_default.version} \u2014 events -> ${configuredEndpoint}`);
     if (tcfCollectionEnabled) resolveDmaConsent();
     void resolveAdvertisingId().catch((err) => reportError("enrich.advertisingId", err));
-    const deviceInfo = collectDeviceInfo({
-      platform,
-      ios: getIosNative(),
-      android: getAndroidNative()
-    });
     if (Object.keys(deviceInfo).length > 0) instance.setDeviceInfo(deviceInfo);
     if (!config.disableAutoSessions) {
       const appState = getAppState();
@@ -721,6 +728,9 @@ var Advenue = {
   getDeviceId: () => active().getDeviceId(),
   /** The Advenue ID — alias of getDeviceId (see AdvenueClient.getAdvenueId). */
   getAdvenueId: () => active().getAdvenueId(),
+  /** Which app the server resolved this API key to; null until a batch lands
+   *  (see AdvenueClient.getResolvedAppId). */
+  getResolvedAppId: () => active().getResolvedAppId(),
   shutdown() {
     appStateSub?.remove();
     appStateSub = null;
@@ -734,7 +744,6 @@ var Advenue = {
     autoInstallEnabled = true;
     manualConsentSet = false;
     tcfCollectionEnabled = false;
-    configuredAppId = null;
     configuredApiKey = null;
     configuredEndpoint = import_sdk_core.DEFAULT_ENDPOINT;
     aemSeenUrlHashes.clear();
@@ -812,10 +821,10 @@ async function trackInstall() {
   }
   await resolveAdvertisingId();
   const trackOpts = { type: "install", ...opts };
-  if (configuredAppId && android && typeof android.getIntegrityToken === "function") {
+  if (android && typeof android.getIntegrityToken === "function") {
     try {
       const deviceId = client.getDeviceId();
-      const requestHash = sha256Hex(`${configuredAppId}:${deviceId}`);
+      const requestHash = sha256Hex(deviceId);
       const token = await android.getIntegrityToken(requestHash);
       if (token) {
         trackOpts.attestationToken = token;
@@ -825,13 +834,24 @@ async function trackInstall() {
       reportError("attest.playIntegrity", err);
     }
   }
-  if (configuredAppId && configuredApiKey && ios && typeof ios.attestKey === "function") {
+  if (configuredApiKey && ios && typeof ios.attestKey === "function") {
     try {
       const deviceId = client.getDeviceId();
       const challengeUrl = `${configuredEndpoint}/v1/attest/challenge?deviceId=${encodeURIComponent(deviceId)}`;
-      const challengeRes = await fetch(challengeUrl, {
-        headers: { "x-api-key": configuredApiKey }
-      });
+      const ac = new AbortController();
+      const timer = setTimeout(
+        () => ac.abort(new Error("attest challenge timed out")),
+        ATTEST_CHALLENGE_TIMEOUT_MS
+      );
+      let challengeRes;
+      try {
+        challengeRes = await fetch(challengeUrl, {
+          headers: { "x-api-key": configuredApiKey },
+          signal: ac.signal
+        });
+      } finally {
+        clearTimeout(timer);
+      }
       if (!challengeRes.ok) throw new Error(`challenge HTTP ${challengeRes.status}`);
       const { challenge } = await challengeRes.json();
       const { keyId, attestationObject } = await ios.attestKey(challenge);

package/dist/index.d.cts

@@ -44,6 +44,14 @@ interface MetaInstallReferrerResult {
  * real `DeviceInfo` shape.
  */
 interface AdvenueDeviceInfo {
+    /** Bundle id / package name — Meta CAPI extinfo slot 1. */
+    packageName?: string;
+    /** User-facing app version (CFBundleShortVersionString / versionName) —
+     *  extinfo slot 2. Surfaced as the event's top-level `appVersion`, not as
+     *  part of the deviceInfo blob. */
+    shortVersion?: string;
+    /** Build identifier (CFBundleVersion / versionCode) — extinfo slot 3. */
+    longVersion?: string;
     model?: string;
     locale?: string;
     carrier?: string;
@@ -83,9 +91,11 @@ interface AdvenueAndroidNativeModule {
     /**
      * Play Integrity Standard API token (G3.1n).
      *
-     * `requestHash` MUST be sha256_hex("<appId>:<deviceId>") — lowercase hex SHA-256
-     * of the literal string "<appId>:<deviceId>". The server's mapIntegrityVerdict
-     * re-derives the same string and compares it byte-for-byte.
+     * `requestHash` MUST be sha256_hex("<deviceId>") — lowercase hex SHA-256 of the
+     * device id alone. The server's mapIntegrityVerdict re-derives the same string
+     * and compares it byte-for-byte. No app id is hashed in: the token is decoded
+     * against the app's Play package name and must be PLAY_RECOGNIZED, which binds
+     * the app already.
      *
      * Rejects when:
      *  - ECONFIG: `io.advenue.INTEGRITY_CLOUD_PROJECT_NUMBER` meta-data is absent.
@@ -264,15 +274,19 @@ declare function resolveDmaConsent(): Consent | null;
  * native-side error degrades to an empty object so callers can unconditionally
  * pass the result through.
  */
-declare function collectDeviceInfo(natives: {
+type NativeDeviceInfo = Partial<DeviceInfo> & {
+    shortVersion?: string;
+};
+type DeviceInfoNatives = {
     platform: 'ios' | 'android' | string;
     ios?: {
-        getDeviceInfo?: () => Partial<DeviceInfo>;
+        getDeviceInfo?: () => NativeDeviceInfo;
     } | null;
     android?: {
-        getDeviceInfo?: () => Partial<DeviceInfo>;
+        getDeviceInfo?: () => NativeDeviceInfo;
     } | null;
-}): DeviceInfo;
+};
+declare function collectDeviceInfo(natives: DeviceInfoNatives): DeviceInfo;
 interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platform'> {
     /**
      * Auto-detected from React Native's `Platform.OS` — omit it. Pass explicitly
@@ -287,18 +301,6 @@ interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platform'> {
      * supply storage. When set, it replaces the built-in native storage.
      */
     mmkv?: MMKVLike;
-    /**
-     * G3.1n — Play Integrity (Android) / App Attest (iOS) attestation.
-     *
-     * Your app's Advenue appId (the UUID in Settings → API Keys). When set on
-     * Android, the automatic install obtains a Play Integrity Standard token and
-     * attaches it to the install event. The requestHash is computed as
-     * `sha256Hex("<appId>:<deviceId>")`, matching the server's verification
-     * formula exactly (see `makeDecodeAndroid` in the worker).
-     *
-     * Omit to run without attestation (the server field stays `unavailable`).
-     */
-    appId?: string;
     /**
      * @internal Secure-store override (tests / custom embeddings). The SDK uses
      * its own Keychain-backed native storage on iOS for the reinstall-resilient
@@ -363,6 +365,9 @@ declare const Advenue: {
     getDeviceId: () => string;
     /** The Advenue ID — alias of getDeviceId (see AdvenueClient.getAdvenueId). */
     getAdvenueId: () => string;
+    /** Which app the server resolved this API key to; null until a batch lands
+     *  (see AdvenueClient.getResolvedAppId). */
+    getResolvedAppId: () => string | null;
     shutdown(): void;
 };
 /**

package/dist/index.d.ts

@@ -44,6 +44,14 @@ interface MetaInstallReferrerResult {
  * real `DeviceInfo` shape.
  */
 interface AdvenueDeviceInfo {
+    /** Bundle id / package name — Meta CAPI extinfo slot 1. */
+    packageName?: string;
+    /** User-facing app version (CFBundleShortVersionString / versionName) —
+     *  extinfo slot 2. Surfaced as the event's top-level `appVersion`, not as
+     *  part of the deviceInfo blob. */
+    shortVersion?: string;
+    /** Build identifier (CFBundleVersion / versionCode) — extinfo slot 3. */
+    longVersion?: string;
     model?: string;
     locale?: string;
     carrier?: string;
@@ -83,9 +91,11 @@ interface AdvenueAndroidNativeModule {
     /**
      * Play Integrity Standard API token (G3.1n).
      *
-     * `requestHash` MUST be sha256_hex("<appId>:<deviceId>") — lowercase hex SHA-256
-     * of the literal string "<appId>:<deviceId>". The server's mapIntegrityVerdict
-     * re-derives the same string and compares it byte-for-byte.
+     * `requestHash` MUST be sha256_hex("<deviceId>") — lowercase hex SHA-256 of the
+     * device id alone. The server's mapIntegrityVerdict re-derives the same string
+     * and compares it byte-for-byte. No app id is hashed in: the token is decoded
+     * against the app's Play package name and must be PLAY_RECOGNIZED, which binds
+     * the app already.
      *
      * Rejects when:
      *  - ECONFIG: `io.advenue.INTEGRITY_CLOUD_PROJECT_NUMBER` meta-data is absent.
@@ -264,15 +274,19 @@ declare function resolveDmaConsent(): Consent | null;
  * native-side error degrades to an empty object so callers can unconditionally
  * pass the result through.
  */
-declare function collectDeviceInfo(natives: {
+type NativeDeviceInfo = Partial<DeviceInfo> & {
+    shortVersion?: string;
+};
+type DeviceInfoNatives = {
     platform: 'ios' | 'android' | string;
     ios?: {
-        getDeviceInfo?: () => Partial<DeviceInfo>;
+        getDeviceInfo?: () => NativeDeviceInfo;
     } | null;
     android?: {
-        getDeviceInfo?: () => Partial<DeviceInfo>;
+        getDeviceInfo?: () => NativeDeviceInfo;
     } | null;
-}): DeviceInfo;
+};
+declare function collectDeviceInfo(natives: DeviceInfoNatives): DeviceInfo;
 interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platform'> {
     /**
      * Auto-detected from React Native's `Platform.OS` — omit it. Pass explicitly
@@ -287,18 +301,6 @@ interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platform'> {
      * supply storage. When set, it replaces the built-in native storage.
      */
     mmkv?: MMKVLike;
-    /**
-     * G3.1n — Play Integrity (Android) / App Attest (iOS) attestation.
-     *
-     * Your app's Advenue appId (the UUID in Settings → API Keys). When set on
-     * Android, the automatic install obtains a Play Integrity Standard token and
-     * attaches it to the install event. The requestHash is computed as
-     * `sha256Hex("<appId>:<deviceId>")`, matching the server's verification
-     * formula exactly (see `makeDecodeAndroid` in the worker).
-     *
-     * Omit to run without attestation (the server field stays `unavailable`).
-     */
-    appId?: string;
     /**
      * @internal Secure-store override (tests / custom embeddings). The SDK uses
      * its own Keychain-backed native storage on iOS for the reinstall-resilient
@@ -363,6 +365,9 @@ declare const Advenue: {
     getDeviceId: () => string;
     /** The Advenue ID — alias of getDeviceId (see AdvenueClient.getAdvenueId). */
     getAdvenueId: () => string;
+    /** Which app the server resolved this API key to; null until a batch lands
+     *  (see AdvenueClient.getResolvedAppId). */
+    getResolvedAppId: () => string | null;
     shutdown(): void;
 };
 /**

package/dist/index.js

@@ -218,7 +218,7 @@ function sha256Hex(message) {
 // package.json
 var package_default = {
   name: "@advenue/react-native",
-  version: "0.8.0",
+  version: "0.9.0",
   description: "Advenue MMP React Native SDK \u2014 attribution, install tracking, and deep links (bundled iOS/Android Expo native modules)",
   type: "module",
   license: "MIT",
@@ -493,7 +493,7 @@ function resolveDmaConsent() {
   void resolveAdvertisingId().catch((err) => reportError("enrich.advertisingId", err));
   return consent;
 }
-function collectDeviceInfo(natives) {
+function readNativeDeviceInfo(natives) {
   try {
     if (natives.platform === "android" && natives.android?.getDeviceInfo) {
       return natives.android.getDeviceInfo();
@@ -505,6 +505,10 @@ function collectDeviceInfo(natives) {
   }
   return {};
 }
+function collectDeviceInfo(natives) {
+  const { shortVersion: _shortVersion, ...info } = readNativeDeviceInfo(natives);
+  return info;
+}
 function applyAppState(client, status) {
   if (status === "active") {
     client.notifyAppActive();
@@ -523,7 +527,7 @@ var autoInstallPending = false;
 var autoInstallEnabled = true;
 var manualConsentSet = false;
 var tcfCollectionEnabled = false;
-var configuredAppId = null;
+var ATTEST_CHALLENGE_TIMEOUT_MS = 5e3;
 var configuredApiKey = null;
 var configuredEndpoint = DEFAULT_ENDPOINT;
 var aemSeenUrlHashes = /* @__PURE__ */ new Set();
@@ -567,7 +571,6 @@ var Advenue = {
       mmkv,
       secureStore: secureMod,
       onDeepLink,
-      appId,
       autoTrackInstall,
       tcfDataCollection,
       ...rest
@@ -577,7 +580,6 @@ var Advenue = {
     tcfCollectionEnabled = tcfDataCollection === true;
     autoInstallEnabled = autoTrackInstall !== false;
     const platform = resolvePlatform(rest.platform);
-    configuredAppId = appId ?? null;
     configuredApiKey = config.apiKey;
     configuredEndpoint = config.endpoint ?? DEFAULT_ENDPOINT;
     appStateSub?.remove();
@@ -592,21 +594,26 @@ var Advenue = {
     secureStore = secureMod ? createSecureStore(secureMod) : createNativeSecureStore(iosMod);
     const deviceId = rest.deviceId ?? await resolveDurableDeviceId(storage, secureStore ?? void 0);
     const osVersion = rest.osVersion ?? getOsVersion() ?? void 0;
+    const nativeDeviceInfo = readNativeDeviceInfo({
+      platform,
+      ios: getIosNative(),
+      android: getAndroidNative()
+    });
+    const { shortVersion, ...deviceInfo } = nativeDeviceInfo;
+    const appVersion = rest.appVersion ?? shortVersion ?? void 0;
     instance = new AdvenueClient({
       ...rest,
       platform,
       deviceId,
       storage,
-      ...osVersion ? { osVersion } : {}
+      ...osVersion ? { osVersion } : {},
+      ...appVersion ? { appVersion } : {},
+      // Stamped by the SDK, never by the host app — see AdvenueConfig.sdkVersion.
+      sdkVersion: package_default.version
     });
     instance.debugLog(`SDK v${package_default.version} \u2014 events -> ${configuredEndpoint}`);
     if (tcfCollectionEnabled) resolveDmaConsent();
     void resolveAdvertisingId().catch((err) => reportError("enrich.advertisingId", err));
-    const deviceInfo = collectDeviceInfo({
-      platform,
-      ios: getIosNative(),
-      android: getAndroidNative()
-    });
     if (Object.keys(deviceInfo).length > 0) instance.setDeviceInfo(deviceInfo);
     if (!config.disableAutoSessions) {
       const appState = getAppState();
@@ -717,6 +724,9 @@ var Advenue = {
   getDeviceId: () => active().getDeviceId(),
   /** The Advenue ID — alias of getDeviceId (see AdvenueClient.getAdvenueId). */
   getAdvenueId: () => active().getAdvenueId(),
+  /** Which app the server resolved this API key to; null until a batch lands
+   *  (see AdvenueClient.getResolvedAppId). */
+  getResolvedAppId: () => active().getResolvedAppId(),
   shutdown() {
     appStateSub?.remove();
     appStateSub = null;
@@ -730,7 +740,6 @@ var Advenue = {
     autoInstallEnabled = true;
     manualConsentSet = false;
     tcfCollectionEnabled = false;
-    configuredAppId = null;
     configuredApiKey = null;
     configuredEndpoint = DEFAULT_ENDPOINT;
     aemSeenUrlHashes.clear();
@@ -808,10 +817,10 @@ async function trackInstall() {
   }
   await resolveAdvertisingId();
   const trackOpts = { type: "install", ...opts };
-  if (configuredAppId && android && typeof android.getIntegrityToken === "function") {
+  if (android && typeof android.getIntegrityToken === "function") {
     try {
       const deviceId = client.getDeviceId();
-      const requestHash = sha256Hex(`${configuredAppId}:${deviceId}`);
+      const requestHash = sha256Hex(deviceId);
       const token = await android.getIntegrityToken(requestHash);
       if (token) {
         trackOpts.attestationToken = token;
@@ -821,13 +830,24 @@ async function trackInstall() {
       reportError("attest.playIntegrity", err);
     }
   }
-  if (configuredAppId && configuredApiKey && ios && typeof ios.attestKey === "function") {
+  if (configuredApiKey && ios && typeof ios.attestKey === "function") {
     try {
       const deviceId = client.getDeviceId();
       const challengeUrl = `${configuredEndpoint}/v1/attest/challenge?deviceId=${encodeURIComponent(deviceId)}`;
-      const challengeRes = await fetch(challengeUrl, {
-        headers: { "x-api-key": configuredApiKey }
-      });
+      const ac = new AbortController();
+      const timer = setTimeout(
+        () => ac.abort(new Error("attest challenge timed out")),
+        ATTEST_CHALLENGE_TIMEOUT_MS
+      );
+      let challengeRes;
+      try {
+        challengeRes = await fetch(challengeUrl, {
+          headers: { "x-api-key": configuredApiKey },
+          signal: ac.signal
+        });
+      } finally {
+        clearTimeout(timer);
+      }
       if (!challengeRes.ok) throw new Error(`challenge HTTP ${challengeRes.status}`);
       const { challenge } = await challengeRes.json();
       const { keyId, attestationObject } = await ios.attestKey(challenge);

package/ios/AdvenueIosModule.swift

@@ -249,6 +249,20 @@ public class AdvenueIosModule: Module {
       info["timezone"] = TimeZone.current.identifier
       info["cpuCores"] = ProcessInfo.processInfo.activeProcessorCount
 
+      // Meta CAPI extinfo slots 1-3. CFBundleShortVersionString is the
+      // user-facing version (slot 2, surfaced as the event's appVersion);
+      // CFBundleVersion is the build identifier (slot 3).
+      let bundle = Bundle.main
+      if let bundleId = bundle.bundleIdentifier {
+        info["packageName"] = bundleId
+      }
+      if let short = bundle.infoDictionary?["CFBundleShortVersionString"] as? String {
+        info["shortVersion"] = short
+      }
+      if let build = bundle.infoDictionary?["CFBundleVersion"] as? String {
+        info["longVersion"] = build
+      }
+
       let (screenWidth, screenHeight, screenDensity) = Self.onMainSync { () -> (Int, Int, Double) in
         let screen = UIScreen.main
         return (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@advenue/react-native",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Advenue MMP React Native SDK — attribution, install tracking, and deep links (bundled iOS/Android Expo native modules)",
   "type": "module",
   "license": "MIT",
@@ -30,7 +30,7 @@
   },
   "dependencies": {
     "@advenue/install-referrer": "0.3.0",
-    "@advenue/sdk-core": "0.5.0"
+    "@advenue/sdk-core": "0.6.0"
   },
   "peerDependencies": {
     "@expo/config-plugins": ">=8",
@@ -50,7 +50,7 @@
     "tsup": "^8.5.1",
     "typescript": "^5.7.2",
     "vitest": "^2.1.8",
-    "@advenue/shared": "0.2.0",
+    "@advenue/shared": "0.3.0",
     "@advenue/signing": "0.0.0"
   },
   "react-native": "./dist/index.cjs",

package/src/index.ts

@@ -178,11 +178,18 @@ export function resolveDmaConsent(): Consent | null {
  * native-side error degrades to an empty object so callers can unconditionally
  * pass the result through.
  */
-export function collectDeviceInfo(natives: {
+type NativeDeviceInfo = Partial<DeviceInfo> & { shortVersion?: string };
+
+type DeviceInfoNatives = {
   platform: 'ios' | 'android' | string;
-  ios?: { getDeviceInfo?: () => Partial<DeviceInfo> } | null;
-  android?: { getDeviceInfo?: () => Partial<DeviceInfo> } | null;
-}): DeviceInfo {
+  ios?: { getDeviceInfo?: () => NativeDeviceInfo } | null;
+  android?: { getDeviceInfo?: () => NativeDeviceInfo } | null;
+};
+
+/** The raw native map, `shortVersion` included. Internal: `initialize` needs
+ *  that field for the event's top-level `appVersion`, everyone else wants the
+ *  deviceInfo blob that `collectDeviceInfo` returns. */
+function readNativeDeviceInfo(natives: DeviceInfoNatives): NativeDeviceInfo {
   try {
     if (natives.platform === 'android' && natives.android?.getDeviceInfo) {
       return natives.android.getDeviceInfo();
@@ -196,6 +203,13 @@ export function collectDeviceInfo(natives: {
   return {};
 }
 
+export function collectDeviceInfo(natives: DeviceInfoNatives): DeviceInfo {
+  // shortVersion is the app's own version, carried by the event's `appVersion`
+  // field (extinfo slot 2) — it is not part of the persisted deviceInfo blob.
+  const { shortVersion: _shortVersion, ...info } = readNativeDeviceInfo(natives);
+  return info;
+}
+
 export interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platform'> {
   /**
    * Auto-detected from React Native's `Platform.OS` — omit it. Pass explicitly
@@ -210,18 +224,6 @@ export interface RNAdvenueConfig extends Omit<AdvenueConfig, 'storage' | 'platfo
    * supply storage. When set, it replaces the built-in native storage.
    */
   mmkv?: MMKVLike;
-  /**
-   * G3.1n — Play Integrity (Android) / App Attest (iOS) attestation.
-   *
-   * Your app's Advenue appId (the UUID in Settings → API Keys). When set on
-   * Android, the automatic install obtains a Play Integrity Standard token and
-   * attaches it to the install event. The requestHash is computed as
-   * `sha256Hex("<appId>:<deviceId>")`, matching the server's verification
-   * formula exactly (see `makeDecodeAndroid` in the worker).
-   *
-   * Omit to run without attestation (the server field stays `unavailable`).
-   */
-  appId?: string;
   /**
    * @internal Secure-store override (tests / custom embeddings). The SDK uses
    * its own Keychain-backed native storage on iOS for the reinstall-resilient
@@ -299,9 +301,10 @@ let manualConsentSet = false;
 // Whether the current initialize() opted into TCF auto-collection
 // (RNAdvenueConfig.tcfDataCollection). Reset by initialize()/shutdown().
 let tcfCollectionEnabled = false;
-// G3.1n: app-scoped id for attestation requestHash. Set from RNAdvenueConfig.appId
-// in initialize(). Null when the integrator has not configured attestation.
-let configuredAppId: string | null = null;
+/** Deadline for the App Attest challenge fetch. Enrichment on the install path:
+ *  bounded well under the transport's 15s so a slow host costs the install a
+ *  moment, never the platform socket timeout. */
+const ATTEST_CHALLENGE_TIMEOUT_MS = 5_000;
 // G3.2n: API key + endpoint needed to fetch the App Attest challenge from the
 // server. Stored at module level so trackInstall() can issue the challenge
 // request without reaching into the private AdvenueClient fields.
@@ -386,7 +389,6 @@ export const Advenue = {
       mmkv,
       secureStore: secureMod,
       onDeepLink,
-      appId,
       autoTrackInstall,
       tcfDataCollection,
       ...rest
@@ -398,7 +400,6 @@ export const Advenue = {
     tcfCollectionEnabled = tcfDataCollection === true;
     autoInstallEnabled = autoTrackInstall !== false;
     const platform = resolvePlatform(rest.platform);
-    configuredAppId = appId ?? null;
     configuredApiKey = config.apiKey;
     configuredEndpoint = config.endpoint ?? DEFAULT_ENDPOINT;
     appStateSub?.remove();
@@ -421,12 +422,29 @@ export const Advenue = {
     // Auto-collect the OS release version — it feeds the server's normalized
     // probabilistic fingerprint (spec D1); an explicit config value wins.
     const osVersion = rest.osVersion ?? getOsVersion() ?? undefined;
+    // Native device metadata (Meta CAPI extinfo) — read BEFORE the client is
+    // constructed because the app's short version becomes the event's
+    // `appVersion`, which the client takes at construction time. Best-effort
+    // and synchronous, so no fire-and-forget needed.
+    const nativeDeviceInfo = readNativeDeviceInfo({
+      platform,
+      ios: getIosNative(),
+      android: getAndroidNative(),
+    });
+    const { shortVersion, ...deviceInfo } = nativeDeviceInfo;
+    // Same contract as osVersion: the config wins, the platform fills the gap.
+    // Without this fallback nothing ever set it — every event, and every
+    // device_profiles row, recorded an empty app version.
+    const appVersion = rest.appVersion ?? shortVersion ?? undefined;
     instance = new AdvenueClient({
       ...rest,
       platform,
       deviceId,
       storage,
       ...(osVersion ? { osVersion } : {}),
+      ...(appVersion ? { appVersion } : {}),
+      // Stamped by the SDK, never by the host app — see AdvenueConfig.sdkVersion.
+      sdkVersion: pkg.version,
     });
     // One-line ground truth for "which SDK build talks to which host" — the
     // exact questions a silent integration always raises first.
@@ -436,13 +454,6 @@ export const Advenue = {
     if (tcfCollectionEnabled) resolveDmaConsent();
     // (a) resolve ad-id at init time
     void resolveAdvertisingId().catch((err) => reportError('enrich.advertisingId', err));
-    // Collect native device info (Meta CAPI extinfo) once at init time; a
-    // best-effort, synchronous read, so no fire-and-forget needed.
-    const deviceInfo = collectDeviceInfo({
-      platform,
-      ios: getIosNative(),
-      android: getAndroidNative(),
-    });
     if (Object.keys(deviceInfo).length > 0) instance.setDeviceInfo(deviceInfo);
     if (!config.disableAutoSessions) {
       const appState = getAppState();
@@ -593,6 +604,9 @@ export const Advenue = {
   getDeviceId: () => active().getDeviceId(),
   /** The Advenue ID — alias of getDeviceId (see AdvenueClient.getAdvenueId). */
   getAdvenueId: () => active().getAdvenueId(),
+  /** Which app the server resolved this API key to; null until a batch lands
+   *  (see AdvenueClient.getResolvedAppId). */
+  getResolvedAppId: () => active().getResolvedAppId(),
   shutdown() {
     appStateSub?.remove();
     appStateSub = null;
@@ -606,7 +620,6 @@ export const Advenue = {
     autoInstallEnabled = true;
     manualConsentSet = false;
     tcfCollectionEnabled = false;
-    configuredAppId = null;
     configuredApiKey = null;
     configuredEndpoint = DEFAULT_ENDPOINT;
     aemSeenUrlHashes.clear();
@@ -735,18 +748,20 @@ export async function trackInstall(): Promise<void> {
   // leaves attestation absent; the install is never blocked.
   const trackOpts: TrackOptions = { type: 'install', ...opts };
   if (
-    configuredAppId &&
     android &&
     typeof (android as { getIntegrityToken?: unknown }).getIntegrityToken === 'function'
   ) {
     try {
-      // requestHash = sha256_hex("<appId>:<deviceId>") — must match the server's
+      // requestHash = sha256_hex("<deviceId>") — must match the server's
       // mapIntegrityVerdict computation byte-for-byte (see makeDecodeAndroid in
       // apps/worker/src/attestation-decoders.ts):
-      //   expectedRequestHash = sha256(`${event.appId}:${event.deviceId}`)
-      // configuredAppId must be the app's UUID from the Advenue dashboard.
+      //   expectedRequestHash = sha256(event.deviceId)
+      // No app id is hashed in, deliberately: the token is already decoded
+      // against the app's Play package name and must be PLAY_RECOGNIZED, which
+      // binds the app more tightly than an internal UUID could — and it keeps
+      // the API key as the SDK's only app identity.
       const deviceId = client.getDeviceId();
-      const requestHash = sha256Hex(`${configuredAppId}:${deviceId}`);
+      const requestHash = sha256Hex(deviceId);
       const token = await (
         android as { getIntegrityToken(h: string): Promise<string> }
       ).getIntegrityToken(requestHash);
@@ -763,19 +778,32 @@ export async function trackInstall(): Promise<void> {
   // G3.2n — App Attest attestation (iOS only). Best-effort: any error (no
   // support on simulator, challenge fetch failure, attest failure) leaves
   // attestation absent; the install is NEVER blocked.
-  if (
-    configuredAppId &&
-    configuredApiKey &&
-    ios &&
-    typeof (ios as { attestKey?: unknown }).attestKey === 'function'
-  ) {
+  if (configuredApiKey && ios && typeof (ios as { attestKey?: unknown }).attestKey === 'function') {
     try {
       // Step 1: fetch a one-time server challenge bound to this device.
+      //
+      // Deadline-bounded, like every other SDK fetch (see sdk-core transport):
+      // the install event is only enqueued after this await, and attestation is
+      // attempted on every install — so an unreachable or hung host would
+      // otherwise delay the install by the platform socket timeout, shifting the
+      // recorded install time and the deferred deep link the user is waiting on.
+      // Shorter than the transport's 15s: this is enrichment, not the payload.
       const deviceId = client.getDeviceId();
       const challengeUrl = `${configuredEndpoint}/v1/attest/challenge?deviceId=${encodeURIComponent(deviceId)}`;
-      const challengeRes = await fetch(challengeUrl, {
-        headers: { 'x-api-key': configuredApiKey },
-      });
+      const ac = new AbortController();
+      const timer = setTimeout(
+        () => ac.abort(new Error('attest challenge timed out')),
+        ATTEST_CHALLENGE_TIMEOUT_MS,
+      );
+      let challengeRes: Response;
+      try {
+        challengeRes = await fetch(challengeUrl, {
+          headers: { 'x-api-key': configuredApiKey },
+          signal: ac.signal,
+        });
+      } finally {
+        clearTimeout(timer);
+      }
       if (!challengeRes.ok) throw new Error(`challenge HTTP ${challengeRes.status}`);
       const { challenge } = (await challengeRes.json()) as { challenge: string };
 

package/src/native-types.ts

@@ -35,6 +35,14 @@ export interface MetaInstallReferrerResult {
  * real `DeviceInfo` shape.
  */
 export interface AdvenueDeviceInfo {
+  /** Bundle id / package name — Meta CAPI extinfo slot 1. */
+  packageName?: string;
+  /** User-facing app version (CFBundleShortVersionString / versionName) —
+   *  extinfo slot 2. Surfaced as the event's top-level `appVersion`, not as
+   *  part of the deviceInfo blob. */
+  shortVersion?: string;
+  /** Build identifier (CFBundleVersion / versionCode) — extinfo slot 3. */
+  longVersion?: string;
   model?: string;
   locale?: string;
   carrier?: string;
@@ -73,9 +81,11 @@ export interface AdvenueAndroidNativeModule {
   /**
    * Play Integrity Standard API token (G3.1n).
    *
-   * `requestHash` MUST be sha256_hex("<appId>:<deviceId>") — lowercase hex SHA-256
-   * of the literal string "<appId>:<deviceId>". The server's mapIntegrityVerdict
-   * re-derives the same string and compares it byte-for-byte.
+   * `requestHash` MUST be sha256_hex("<deviceId>") — lowercase hex SHA-256 of the
+   * device id alone. The server's mapIntegrityVerdict re-derives the same string
+   * and compares it byte-for-byte. No app id is hashed in: the token is decoded
+   * against the app's Play package name and must be PLAY_RECOGNIZED, which binds
+   * the app already.
    *
    * Rejects when:
    *  - ECONFIG: `io.advenue.INTEGRITY_CLOUD_PROJECT_NUMBER` meta-data is absent.