@advenue/react-native 1.0.1 → 1.1.1

package/ios/vendor/AdvenuePlatform/ChallengeFetcher.swift

@@ -17,17 +17,29 @@ public struct HttpChallengeFetcher: ChallengeSource {
     self.session = session
   }
 
-  public func challenge(deviceId: String) async throws -> String {
+  /// The exact request this fetcher would send. Public so a test can assert
+  /// the wire shape without a network round trip.
+  ///
+  /// Sends `?platform=ios`: this fetcher is iOS-only by construction, and a
+  /// project-scoped key otherwise cannot resolve a listing on a normal
+  /// two-listing (iOS + Android) product — see `resolveProjectListing` in
+  /// apps/ingestion/src/app.ts, which 400s an ambiguous project key rather
+  /// than guess.
+  public func buildRequest(deviceId: String) -> URLRequest {
     let escaped =
       deviceId.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) ?? deviceId
     var request = URLRequest(
-      url: URL(string: "\(endpoint)/v1/attest/challenge?deviceId=\(escaped)")!)
+      url: URL(string: "\(endpoint)/v1/attest/challenge?deviceId=\(escaped)&platform=ios")!)
     request.httpMethod = "GET"
     request.setValue(apiKey, forHTTPHeaderField: "x-api-key")
     // Matches the deadline the RN SDK uses. Attestation is enrichment: it never
     // holds the install.
     request.timeoutInterval = 5
+    return request
+  }
 
+  public func challenge(deviceId: String) async throws -> String {
+    let request = buildRequest(deviceId: deviceId)
     let (payload, response) = try await session.data(for: request)
     guard let http = response as? HTTPURLResponse,
       (200..<300).contains(http.statusCode)

package/ios/vendor/AdvenuePlatform/ConversionFetcher.swift

@@ -23,13 +23,24 @@ public struct HttpConversionFetcher: ConversionFetcher {
     self.session = session
   }
 
-  public func fetch() async throws -> ConversionResult {
+  /// Sends `?platform=ios`: this fetcher is iOS-only by construction, and a
+  /// project key spans listings, so the server needs the platform to pick the
+  /// one this install was filed under (Y-LINKS-1). Without it the lookup
+  /// refused the project key the dashboard mints, and the deferred deep link
+  /// never arrived.
+  func buildRequest() -> URLRequest {
     let escaped =
       deviceId.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) ?? deviceId
-    var request = URLRequest(url: URL(string: "\(endpoint)/sdk/conversion-data?deviceId=\(escaped)")!)
+    var request = URLRequest(
+      url: URL(string: "\(endpoint)/sdk/conversion-data?deviceId=\(escaped)&platform=ios")!)
     request.httpMethod = "GET"
     request.setValue(apiKey, forHTTPHeaderField: "x-api-key")
     request.timeoutInterval = 15
+    return request
+  }
+
+  public func fetch() async throws -> ConversionResult {
+    let request = buildRequest()
 
     let payload: Data
     let response: URLResponse
@@ -37,7 +48,7 @@ public struct HttpConversionFetcher: ConversionFetcher {
       (payload, response) = try await session.data(for: request)
     } catch {
       // No status to reason about; 408 marks it retryable, as sdk-core does.
-      throw IngestError(status: 408)
+      throw IngestError(status: 408, networkCause: describeNetworkFailure(error))
     }
     guard let http = response as? HTTPURLResponse else { throw IngestError(status: 408) }
     guard (200..<300).contains(http.statusCode) else {

package/ios/vendor/AdvenuePlatform/DeviceInfo.swift

@@ -16,6 +16,25 @@ public func readAppVersion() -> String? {
   return short
 }
 
+/// Whether this process was launched into the background — background fetch,
+/// a silent push, a location relaunch — rather than opened by the user. Read
+/// through the runtime, not `UIApplication.shared`: that symbol is unavailable
+/// in an app extension and merely referencing it there fails to link. False
+/// wherever it cannot be known (an extension, off the main thread, macOS),
+/// which keeps the pre-existing behaviour: the launch is a foreground.
+public func readLaunchedInBackground() -> Bool {
+  #if canImport(UIKit) && !os(watchOS)
+    guard Thread.isMainThread, !Bundle.main.bundlePath.hasSuffix(".appex") else { return false }
+    let selector = NSSelectorFromString("sharedApplication")
+    guard UIApplication.responds(to: selector),
+      let app = UIApplication.perform(selector)?.takeUnretainedValue() as? UIApplication
+    else { return false }
+    return app.applicationState == .background
+  #else
+    return false
+  #endif
+}
+
 /// Device metadata for Meta CAPI `extinfo`.
 ///
 /// Best-effort per field: a field is **omitted**, never defaulted, when its

package/ios/vendor/AdvenuePlatform/HttpTransport.swift

@@ -5,6 +5,10 @@ import Foundation
 struct EventBatch: Encodable {
   let apiKey: String
   let events: [ClientEvent]
+  /// The device clock at THIS send attempt (spec 2026-10-01-data-fidelity D3).
+  /// The server compares it with its receive time to measure the clock offset,
+  /// so it is stamped on every attempt and never persisted with the queue.
+  let sentAt: String
 }
 
 public let DEFAULT_ENDPOINT = "https://ingest.advenue.io"
@@ -49,8 +53,12 @@ public struct HttpTransport: EventTransport, Sendable {
   /// the wire shape — endpoint, headers, body, signature — without a network
   /// round trip, which is the part that has to be right.
   public func buildRequest(_ events: [ClientEvent]) throws -> URLRequest {
+    // One reading for both `sentAt` and the signed timestamp: they describe
+    // the same instant, and two reads could straddle a clock change.
+    let nowMs = clock.nowMs()
     let body = try EventEncoding.canonicalEncoder()
-      .encode(EventBatch(apiKey: apiKey, events: events))
+      .encode(
+        EventBatch(apiKey: apiKey, events: events, sentAt: EventEncoding.iso8601(ms: nowMs)))
     var request = URLRequest(url: URL(string: "\(endpoint)/v1/events")!)
     request.httpMethod = "POST"
     request.setValue("application/json", forHTTPHeaderField: "content-type")
@@ -58,7 +66,7 @@ public struct HttpTransport: EventTransport, Sendable {
     request.timeoutInterval = 15
 
     if let secret = signingSecret {
-      let timestamp = String(clock.nowMs())
+      let timestamp = String(nowMs)
       request.setValue(timestamp, forHTTPHeaderField: "X-Advenue-Timestamp")
       request.setValue(
         signRequest(
@@ -77,8 +85,8 @@ public struct HttpTransport: EventTransport, Sendable {
       (payload, response) = try await session.data(for: request)
     } catch {
       // No status to reason about. 408 marks it retryable, which is what
-      // sdk-core does for the same case.
-      throw IngestError(status: 408)
+      // sdk-core does for the same case; the cause says it was the network.
+      throw IngestError(status: 408, networkCause: describeNetworkFailure(error))
     }
     guard let http = response as? HTTPURLResponse else { throw IngestError(status: 408) }
     guard (200..<300).contains(http.statusCode) else {
@@ -94,3 +102,19 @@ public struct HttpTransport: EventTransport, Sendable {
     }
   }
 }
+
+/// A short, identifier-free name for a failure that produced no response.
+func describeNetworkFailure(_ error: any Error) -> String {
+  guard let urlError = error as? URLError else { return String(describing: type(of: error)) }
+  switch urlError.code {
+  case .notConnectedToInternet: return "not connected to the internet"
+  case .timedOut: return "timed out"
+  case .cannotFindHost, .dnsLookupFailed: return "host not found"
+  case .cannotConnectToHost: return "connection refused"
+  case .networkConnectionLost: return "connection lost"
+  case .secureConnectionFailed, .serverCertificateUntrusted, .serverCertificateHasBadDate,
+    .serverCertificateNotYetValid, .serverCertificateHasUnknownRoot:
+    return "TLS failure"
+  default: return "URLError \(urlError.code.rawValue)"
+  }
+}

package/ios/vendor/AdvenuePlatform/InstallEnrichment.swift

@@ -4,6 +4,10 @@ import Foundation
 /// Spec §5: the install waits this long for enrichment and no longer. Matches
 /// the deadlines the RN SDK already uses (SKAN config 3000 ms).
 public let INSTALL_WINDOW_MS = 3_000
+/// How long past `INSTALL_WINDOW_MS` flushes stay held for a pending install —
+/// the enrichment deadline is checked by a task that still has to be
+/// scheduled and then hop through the command pipe.
+public let INSTALL_HOLD_MARGIN_MS = 2_000
 
 /// What the install event carries beyond the envelope every event has.
 public struct Enrichment: Sendable, Equatable {

package/ios/vendor/AdvenuePlatform/SkanConfigFetcher.swift

@@ -22,12 +22,24 @@ public struct HttpSkanConfigFetcher: SkanConfigSource {
     self.session = session
   }
 
-  public func fetch(etag: String?) async throws -> SkanConfigResult {
-    var request = URLRequest(url: URL(string: "\(endpoint)/v1/sdk-config")!)
+  /// The exact request this fetcher would send. Public so a test can assert
+  /// the wire shape without a network round trip.
+  ///
+  /// Sends `?platform=ios`: this fetcher is iOS-only by construction, and a
+  /// project-scoped key otherwise cannot resolve a listing on a normal
+  /// two-listing (iOS + Android) product — see `resolveProjectListing` in
+  /// apps/ingestion/src/app.ts, which 400s an ambiguous project key rather
+  /// than guess.
+  public func buildRequest(etag: String?) -> URLRequest {
+    var request = URLRequest(url: URL(string: "\(endpoint)/v1/sdk-config?platform=ios")!)
     request.setValue(apiKey, forHTTPHeaderField: "x-api-key")
     if let etag { request.setValue(etag, forHTTPHeaderField: "if-none-match") }
     request.timeoutInterval = Double(SKAN_CONFIG_TIMEOUT_MS) / 1000
+    return request
+  }
 
+  public func fetch(etag: String?) async throws -> SkanConfigResult {
+    let request = buildRequest(etag: etag)
     let (payload, response) = try await session.data(for: request)
     guard let http = response as? HTTPURLResponse else { throw IngestError(status: 408) }
     if http.statusCode == 304 { return .notModified }

package/package.json

@@ -1,9 +1,18 @@
 {
   "name": "@advenue/react-native",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "Advenue MMP React Native SDK — attribution, install tracking, and deep links (bundled iOS/Android Expo native modules)",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/broverse/advenue.git",
+    "directory": "packages/sdk-react-native"
+  },
+  "homepage": "https://advenue.io",
+  "bugs": {
+    "url": "https://github.com/broverse/advenue/issues"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -30,12 +39,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "node scripts/vendor-natives.mjs && node scripts/check-vendored-swift.mjs && tsup && node scripts/check-dist.mjs",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run --minWorkers=1 --maxWorkers=2 && node --test scripts/vendor-natives.test.mjs && node scripts/vendor-natives.mjs && node scripts/check-vendored-swift.mjs",
-    "vendor": "node scripts/vendor-natives.mjs"
-  },
   "dependencies": {},
   "peerDependencies": {
     "@expo/config-plugins": ">=8",
@@ -56,5 +59,11 @@
     "typescript": "^5.7.2",
     "vitest": "^2.1.8"
   },
-  "react-native": "./dist/index.cjs"
-}
+  "react-native": "./dist/index.cjs",
+  "scripts": {
+    "build": "node scripts/vendor-natives.mjs && node scripts/check-vendored-swift.mjs && tsup && node scripts/check-dist.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --minWorkers=1 --maxWorkers=2 && node --test scripts/vendor-natives.test.mjs && node scripts/vendor-natives.mjs && node scripts/check-vendored-swift.mjs",
+    "vendor": "node scripts/vendor-natives.mjs"
+  }
+}

package/src/index.ts

@@ -63,6 +63,8 @@ let started = false;
 let deepLinkSub: DeepLinkHandle | null = null;
 let errorSub: { remove(): void } | null = null;
 let onErrorHook: ((context: string, cause: unknown) => void) | undefined;
+/** `config.debug`: failures are also written to the JS console. */
+let debugLogging = false;
 
 /**
  * `getTrackingConsent` is synchronous in JavaScript and the value lives in the
@@ -105,6 +107,9 @@ function report(context: string, cause: unknown): void {
   } catch {
     // A throwing diagnostics hook must never break the SDK.
   }
+  // Native failures come back through `onAdvenueError`, so this covers both
+  // sides. The native SDKs log their start and sent batches themselves.
+  if (debugLogging) console.warn(`[Advenue] ${context}`, cause);
 }
 
 function requireStarted(): boolean {
@@ -122,6 +127,7 @@ export const Advenue = {
    */
   async initialize(config: RNAdvenueConfig): Promise<void> {
     onErrorHook = config.onError;
+    debugLogging = config.debug === true;
 
     for (const option of IGNORED_OPTIONS) {
       if ((config as unknown as Record<string, unknown>)[option] !== undefined) {
@@ -145,7 +151,11 @@ export const Advenue = {
       signingSecret: config.signingSecret,
       fbAppId: config.fbAppId,
       autoTrackInstall: config.autoTrackInstall !== false,
-      sdkVersion: pkg.version,
+      // Names the wrapper, like Flutter's `advenue_sdk/…`: a bare version reads
+      // like the native SDK's own stamp.
+      sdkVersion: `react-native/${pkg.version}`,
+      debug: config.debug === true,
+      allowInsecureHttp: config.allowInsecureHttp === true,
     });
     started = true;
 

package/src/types.ts

@@ -59,14 +59,12 @@ export interface TrackOptions {
 export interface AdvenueConfig {
   apiKey: string;
   endpoint?: string;
-  platform?: 'ios' | 'android' | 'web' | string;
   /**
    * @deprecated Ignored: the native SDK resolves the app version from the
    * package/bundle. Passing it reports `config.ignored:appVersion` via
    * `onError`. Removed in the next major.
    */
   appVersion?: string;
-  osVersion?: string;
   /** Gates every event on `setTrackingConsent(true)`. */
   requireConsent?: boolean;
   /** Events per request. */
@@ -79,8 +77,20 @@ export interface AdvenueConfig {
    * extracted from it.
    */
   signingSecret?: string;
-  disableAutoSessions?: boolean;
+  /**
+   * **Test only.** Allows an `http://` endpoint — a local self-hosted ingest,
+   * or a test server — which the native SDKs otherwise refuse at initialize.
+   * Never set it in a production build: everything, the API key included,
+   * then travels unencrypted.
+   */
+  allowInsecureHttp?: boolean;
   /** Called when the SDK swallows a best-effort failure. Never receives PII. */
   onError?: (context: string, cause: unknown) => void;
+  /**
+   * Development aid: the native SDKs log their start, every swallowed failure
+   * and each sent batch to Xcode's console / logcat, and every failure is also
+   * written to the JS console as `[Advenue] <context>`. Never logs an
+   * identifier or a payload. Leave off in production; use `onError`.
+   */
   debug?: boolean;
 }