@scalebun/react-native 1.4.0 → 1.5.0

package/android/src/main/java/com/scalebun/rn/ota/BsPatch.kt

@@ -0,0 +1,182 @@
+package com.scalebun.rn.ota
+
+import java.io.ByteArrayOutputStream
+import java.util.zip.Inflater
+
+/**
+ * bspatch — reconstructs a bundle from a previous bundle plus a delta.
+ *
+ * WHAT WAS WRONG. `stagePatch` resolved `false` unconditionally on both
+ * platforms, so the whole delta pipeline was decorative: the server generated
+ * patches, the check response advertised them, the orchestrator asked for
+ * them, and the device always fell back to a full download. Nobody ever
+ * downloaded less than the entire bundle.
+ *
+ * FORMAT (produced by the backend's `bsdiff.ts`; all integers little-endian):
+ *
+ *   0   8   magic "SBDIFF01"
+ *   8   4   target size — the exact number of bytes this must produce
+ *   12  4   deflated control-block length
+ *   16  4   inflated control-block length
+ *   20  4   deflated diff-block length
+ *   24  4   inflated diff-block length
+ *   28  4   deflated extra-block length
+ *   32  4   inflated extra-block length
+ *   36  .   deflate(control) ++ deflate(diff) ++ deflate(extra)
+ *
+ * Control is a run of (addLen, extraLen, seek) int32 triples. `addLen` bytes
+ * are read from the diff block and added, bytewise mod 256, to the source at
+ * the current read cursor; `extraLen` bytes are copied verbatim from the extra
+ * block; then the source cursor moves by the signed `seek`.
+ *
+ * WHY RAW DEFLATE. Android has `java.util.zip` and iOS has the Compression
+ * framework; neither ships zstd. On real Hermes bundles zstd-19 beat deflate-9
+ * by 0.3 percentage points (95.79% vs 95.51%) — not worth a native dependency
+ * on two platforms forever. See the backend module for the measurements.
+ *
+ * EVERY FIELD HERE IS UNTRUSTED. The patch arrives over the network, so a
+ * malformed or hostile one must fail cleanly rather than index out of bounds.
+ * Each run is bounds-checked against all four buffers before it is used, and
+ * the caller still verifies the SHA-256 of the result before anything is
+ * promoted — this routine producing the wrong bytes can never install them.
+ */
+internal object BsPatch {
+
+    private const val MAGIC = "SBDIFF01"
+    private const val HEADER_BYTES = 36
+
+    /** Refuse absurd allocations from a corrupt header (bundles are single-digit MB). */
+    private const val MAX_TARGET_BYTES = 256 * 1024 * 1024
+
+    class PatchFormatException(message: String) : Exception(message)
+
+    private fun u32(b: ByteArray, off: Int): Long =
+        (b[off].toLong() and 0xff) or
+            ((b[off + 1].toLong() and 0xff) shl 8) or
+            ((b[off + 2].toLong() and 0xff) shl 16) or
+            ((b[off + 3].toLong() and 0xff) shl 24)
+
+    private fun i32(b: ByteArray, off: Int): Int =
+        (b[off].toInt() and 0xff) or
+            ((b[off + 1].toInt() and 0xff) shl 8) or
+            ((b[off + 2].toInt() and 0xff) shl 16) or
+            ((b[off + 3].toInt() and 0xff) shl 24)
+
+    /** Raw DEFLATE (no zlib header) — matches Node's `deflateRawSync`. */
+    private fun inflateRaw(data: ByteArray, offset: Int, length: Int): ByteArray {
+        val inflater = Inflater(true)
+        try {
+            inflater.setInput(data, offset, length)
+            val out = ByteArrayOutputStream(maxOf(length * 4, 1024))
+            val buf = ByteArray(64 * 1024)
+            while (true) {
+                val n = inflater.inflate(buf)
+                if (n > 0) {
+                    out.write(buf, 0, n)
+                    continue
+                }
+                // ORDER MATTERS. A block that legitimately decodes to zero bytes
+                // — an empty extra block, which happens whenever a patch is one
+                // unbroken run — also reports needsInput() once the stream is
+                // consumed. Testing needsInput() first therefore rejected valid
+                // patches as truncated; `finished()` has to be asked first.
+                if (inflater.finished()) break
+                if (inflater.needsInput() || inflater.needsDictionary()) {
+                    throw PatchFormatException("compressed block is truncated")
+                }
+            }
+            return out.toByteArray()
+        } finally {
+            inflater.end()
+        }
+    }
+
+    /**
+     * Apply [patch] to [source], returning the reconstructed bundle.
+     *
+     * @throws PatchFormatException if the patch is malformed, truncated, or
+     *   inconsistent with [source]. Callers treat this as "fall back to a full
+     *   download", never as a fatal error.
+     */
+    fun apply(source: ByteArray, patch: ByteArray): ByteArray {
+        if (patch.size < HEADER_BYTES) throw PatchFormatException("patch too short")
+        val magic = String(patch, 0, 8, Charsets.ISO_8859_1)
+        if (magic != MAGIC) throw PatchFormatException("bad patch magic '$magic'")
+
+        val targetSizeL = u32(patch, 8)
+        val cLen = u32(patch, 12)
+        val cRaw = u32(patch, 16)
+        val dLen = u32(patch, 20)
+        val dRaw = u32(patch, 24)
+        val eLen = u32(patch, 28)
+        val eRaw = u32(patch, 32)
+
+        if (targetSizeL > MAX_TARGET_BYTES) {
+            throw PatchFormatException("declared target size $targetSizeL is implausible")
+        }
+        if (cRaw > MAX_TARGET_BYTES || dRaw > MAX_TARGET_BYTES || eRaw > MAX_TARGET_BYTES) {
+            throw PatchFormatException("declared block size is implausible")
+        }
+        if (HEADER_BYTES + cLen + dLen + eLen != patch.size.toLong()) {
+            throw PatchFormatException("block lengths do not match patch size")
+        }
+        val targetSize = targetSizeL.toInt()
+
+        var off = HEADER_BYTES
+        val control = inflateRaw(patch, off, cLen.toInt()); off += cLen.toInt()
+        val diff = inflateRaw(patch, off, dLen.toInt()); off += dLen.toInt()
+        val extra = inflateRaw(patch, off, eLen.toInt())
+
+        // A block that inflates to a size other than the declared one is
+        // corrupt; iOS sizes its buffers from these numbers, so Android holds
+        // the format to the same contract rather than trusting the stream.
+        if (control.size.toLong() != cRaw) throw PatchFormatException("control block size mismatch")
+        if (diff.size.toLong() != dRaw) throw PatchFormatException("diff block size mismatch")
+        if (extra.size.toLong() != eRaw) throw PatchFormatException("extra block size mismatch")
+
+        if (control.size % 12 != 0) {
+            throw PatchFormatException("control block is not a whole number of triples")
+        }
+
+        val out = ByteArray(targetSize)
+        var newpos = 0
+        var oldpos = 0
+        var dpos = 0
+        var epos = 0
+
+        var c = 0
+        while (c < control.size) {
+            val addLen = i32(control, c)
+            val extraLen = i32(control, c + 4)
+            val seek = i32(control, c + 8)
+            c += 12
+
+            if (addLen < 0 || extraLen < 0) throw PatchFormatException("negative run length")
+            if (newpos + addLen > targetSize) throw PatchFormatException("add run overruns target")
+            if (dpos + addLen > diff.size) throw PatchFormatException("add run overruns diff block")
+            if (oldpos < 0 || oldpos + addLen > source.size) {
+                throw PatchFormatException("add run overruns source")
+            }
+
+            for (i in 0 until addLen) {
+                out[newpos + i] = ((diff[dpos + i].toInt() + source[oldpos + i].toInt()) and 0xff).toByte()
+            }
+            newpos += addLen
+            oldpos += addLen
+            dpos += addLen
+
+            if (newpos + extraLen > targetSize) throw PatchFormatException("extra run overruns target")
+            if (epos + extraLen > extra.size) throw PatchFormatException("extra run overruns extra block")
+            System.arraycopy(extra, epos, out, newpos, extraLen)
+            newpos += extraLen
+            epos += extraLen
+
+            oldpos += seek
+        }
+
+        if (newpos != targetSize) {
+            throw PatchFormatException("patch produced $newpos bytes, declared $targetSize")
+        }
+        return out
+    }
+}

package/android/src/main/java/com/scalebun/rn/ota/ScaleBunOtaModule.kt

@@ -191,20 +191,21 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
     }
 
     /**
-     * Binary-patch staging (S7-NAT-1) — NOT IMPLEMENTED on Android.
+     * Binary-patch staging (S7-NAT-1).
      *
-     * [SlotManager] has no patch/bspatch path, so there is nothing to apply a diff
-     * with. The JS contract in `src/specs/NativeScaleBunOta.ts` defines `false` as
-     * "patching unavailable — fall back to a full-bundle download", which is exactly
-     * the honest answer here; OtaOrchestrator then downloads the whole bundle and the
-     * update still lands. Resolving false (rather than rejecting) keeps that fallback
-     * on its documented path instead of surfacing an error the caller must special-case.
+     * Downloads a delta, reconstructs the full bundle from the currently
+     * installed one, and hands the result to the ordinary staging path — so a
+     * patched bundle passes exactly the same SHA-256 and slot-promotion checks
+     * as a fully downloaded one. [expectedSha256] is the hash of the COMPLETE
+     * bundle, which is what makes a bad patch unable to install: reconstruct
+     * the wrong bytes and staging rejects them.
      *
-     * This override must exist regardless: on the New Architecture the codegen base
-     * (`NativeScaleBunOtaSpec`, generated from the JS spec) declares `stagePatch`
-     * abstract, so omitting it fails Kotlin compilation for every new-arch consumer.
-     *
-     * Replace the body with a real bspatch once SlotManager grows patch support.
+     * Resolves `false` — never rejects — for every "cannot patch" case, because
+     * `src/specs/NativeScaleBunOta.ts` defines false as "patching unavailable,
+     * fall back to a full download". The update still lands, just larger. The
+     * cases are: no OTA bundle installed yet (nothing to patch against — the
+     * first install is always full), a patch that does not match its own
+     * advertised hash, and a malformed patch.
      */
     @ReactMethod
     override fun stagePatch(
@@ -213,7 +214,81 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
         expectedSha256: String,
         promise: Promise,
     ) {
-        promise.resolve(false)
+        var downloadedPatch: File? = null
+        var rebuilt: File? = null
+        try {
+            // Patching is relative to the bundle already on disk. With no OTA
+            // bundle installed the source would be the APK's built-in asset,
+            // which the server did not diff against — so there is nothing valid
+            // to apply and a full download is the correct path.
+            val currentBundle = slotManager.currentBundlePath()
+            if (currentBundle == null || !currentBundle.exists()) {
+                android.util.Log.i(NAME, "stagePatch: no current OTA bundle to patch — full download")
+                promise.resolve(false)
+                return
+            }
+
+            val temp = File(reactApplicationContext.cacheDir, "scalebun_ota_patch_${System.nanoTime()}")
+            downloadedPatch = temp
+            if (!BundleDownloader.download(patchUrl, temp, ::emitProgress)) {
+                promise.resolve(false)
+                return
+            }
+
+            val patchBytes = temp.readBytes()
+
+            // Verify the patch against its own hash before parsing it. This is
+            // cheap and keeps obviously-corrupt input away from the parser.
+            val actualPatchSha = sha256Hex(patchBytes)
+            if (!actualPatchSha.equals(patchSha256, ignoreCase = true)) {
+                android.util.Log.w(NAME, "stagePatch: patch hash mismatch — full download")
+                promise.resolve(false)
+                return
+            }
+
+            val sourceBytes = currentBundle.readBytes()
+            val rebuiltBytes = try {
+                BsPatch.apply(sourceBytes, patchBytes)
+            } catch (e: BsPatch.PatchFormatException) {
+                android.util.Log.w(NAME, "stagePatch: ${e.message} — full download")
+                promise.resolve(false)
+                return
+            }
+
+            val out = File(reactApplicationContext.cacheDir, "scalebun_ota_rebuilt_${System.nanoTime()}")
+            rebuilt = out
+            out.writeBytes(rebuiltBytes)
+
+            val meta = JSONObject()
+            meta.put("sha256", expectedSha256)
+            meta.put("installedAt", System.currentTimeMillis())
+            meta.put("patched", true)
+
+            // SlotManager re-hashes and compares against the full-bundle hash;
+            // a mis-applied patch cannot get past this.
+            val success = slotManager.stage(out, expectedSha256, meta)
+            if (!success) {
+                android.util.Log.w(NAME, "stagePatch: rebuilt bundle failed verification — full download")
+            }
+            promise.resolve(success)
+        } catch (e: Exception) {
+            // Any unexpected failure is still just "no patch" — the caller has
+            // a working full-download path and a rejected promise would turn a
+            // recoverable situation into a failed update.
+            android.util.Log.w(NAME, "stagePatch: ${e.message} — full download")
+            promise.resolve(false)
+        } finally {
+            downloadedPatch?.delete()
+            rebuilt?.delete()
+        }
+    }
+
+    private fun sha256Hex(bytes: ByteArray): String {
+        val digest = java.security.MessageDigest.getInstance("SHA-256")
+        val hash = digest.digest(bytes)
+        val sb = StringBuilder(hash.size * 2)
+        for (b in hash) sb.append(String.format("%02x", b))
+        return sb.toString()
     }
 
     @ReactMethod

package/android/src/oldarch/java/com/scalebun/rn/crash/ScaleBunCrashSpec.kt

@@ -18,4 +18,20 @@ abstract class ScaleBunCrashSpec(reactContext: ReactApplicationContext) :
     abstract fun install(promise: Promise)
     abstract fun crashNow(promise: Promise)
     abstract fun drainPendingCrash(promise: Promise)
+
+    /**
+     * These two were added to the JS spec and to [ScaleBunCrashModule] without
+     * being added here, and the omission is invisible on the New Architecture:
+     * there the base is GENERATED from the JS spec, so it grew the methods
+     * automatically. On the Old Architecture this file IS the base and it has
+     * to be edited by hand — so `ScaleBunCrashModule` was overriding two
+     * methods that did not exist, and the SDK failed to compile for every
+     * old-arch consumer with "'setActiveSessionId' overrides nothing".
+     *
+     * Any change to `src/specs/NativeScaleBunCrash.ts` has to be mirrored here.
+     * That is the cost of the two-base design described above; the alternative
+     * is that old-arch apps silently stop building.
+     */
+    abstract fun setActiveSessionId(sessionId: String?, promise: Promise)
+    abstract fun clearPendingCrash(crashId: String?, promise: Promise)
 }

package/bin/scalebun.js

@@ -630,12 +630,64 @@ function main() {
             console.log('  npx scalebun init ios --check    Verify hooks exist (exit 1 if missing)');
             console.log('  npx scalebun init ios --dry-run  Preview changes without writing');
             console.log('');
+            console.log('OTA commands (login, quickstart, ota publish, releases, rollout…)');
+            console.log('ship with this package (via the bundled @scalebun/cli) and are');
+            console.log('forwarded automatically — no extra install needed.');
+            console.log('');
             break;
         default:
-            console.error(`Unknown command: ${cmd}`);
-            console.error('Run `npx scalebun help` for usage.');
-            process.exit(2);
+            // TWO PACKAGES, ONE COMMAND NAME.
+            //
+            // The OTA commands (login, ota publish, releases, rollout, quickstart…)
+            // live in @scalebun/cli, which declares the SAME `scalebun` bin as this
+            // package. Every doc and generated CI pipeline says `npx scalebun ota
+            // publish`, so whichever package won the bin race decided whether that
+            // worked — and when this one won, a new user's very first command died
+            // with "Unknown command: ota" and no way to find out why.
+            //
+            // Delegate instead of guessing: if @scalebun/cli is installed, run it.
+            // If not, say exactly what to install rather than what went wrong.
+            delegateToOtaCli(argv);
     }
 }
 
+/**
+ * Hand the invocation to @scalebun/cli, preserving argv and exit code.
+ * Falls back to an actionable install instruction when it is not present.
+ */
+function delegateToOtaCli(argv) {
+    let cliEntry = null;
+    try {
+        cliEntry = require.resolve('@scalebun/cli/lib/index.js', {
+            paths: [process.cwd(), __dirname],
+        });
+    } catch {
+        cliEntry = null;
+    }
+
+    if (!cliEntry) {
+        const cmd = argv[0];
+        console.error('');
+        console.error(`"${cmd}" is an OTA command, provided by @scalebun/cli.`);
+        console.error('');
+        console.error('@scalebun/cli ships as a dependency of @scalebun/react-native, so it');
+        console.error('should already be present. It could not be resolved — your install may');
+        console.error('be incomplete or the dependency was pruned.');
+        console.error('');
+        console.error('Reinstall dependencies, then re-run:');
+        console.error('  npm install');
+        console.error(`  npx scalebun ${argv.join(' ')}`);
+        console.error('');
+        console.error('(Or install it explicitly:  npm i -D @scalebun/cli)');
+        console.error('');
+        process.exit(2);
+    }
+
+    const { spawnSync } = require('child_process');
+    const res = spawnSync(process.execPath, [cliEntry, ...argv], {
+        stdio: 'inherit',
+    });
+    process.exit(res.status ?? 1);
+}
+
 main();

package/dist/scalebun.full.js

@@ -489,7 +489,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "lib/module/core/constants/version.js"() {
     "use strict";
-    SDK_VERSION = "1.4.0";
+    SDK_VERSION = "1.5.0";
   }
 });
 
@@ -10041,6 +10041,10 @@ function enableDebug(config) {
       __DEV__ && logger.debug("Debug already enabled, skipping");
       return;
     }
+    if (!__DEV__ && !config.allowInRelease) {
+      logger.warn("[ScaleBun] Debug connection refused in a release build. The debug transport is unencrypted (ws://) and carries captured traffic and the shared secret in cleartext, so it is development-only by default. If you genuinely need it in a release build, set `allowInRelease: true` \u2014 and do not ship that to users.");
+      return;
+    }
     if (!isDevToolsBundled()) {
       logger.warn("[ScaleBun] debugConnection was configured, but the desktop-debugger tooling is not in this bundle. It is excluded by default (the ScaleBun desktop app is not yet released); opt in with `withScaleBun(config, { features: { devTools: true } })` in metro.config.js. All other SDK behaviour is unaffected.");
       return;
@@ -10550,89 +10554,6 @@ var init_nativeCrashBridge = __esm({
   }
 });
 
-// lib/module/analytics/batching.js
-function chunkEvents(events, size = MAX_BATCH_EVENTS) {
-  const cap = Math.max(1, Math.min(size, MAX_BATCH_EVENTS));
-  if (events.length <= cap) return events.length ? [events.slice()] : [];
-  const out = [];
-  for (let i = 0; i < events.length; i += cap) {
-    out.push(events.slice(i, i + cap));
-  }
-  return out;
-}
-function clampBatchSize(configured, fallback) {
-  const n = typeof configured === "number" && configured > 0 ? configured : fallback;
-  return Math.max(1, Math.min(n, MAX_BATCH_EVENTS));
-}
-function batchIdempotencyKey(eventIds) {
-  let h = 2166136261;
-  const joined = eventIds.join("
");
-  for (let i = 0; i < joined.length; i++) {
-    h ^= joined.charCodeAt(i);
-    h = Math.imul(h, 16777619) >>> 0;
-  }
-  return `sdk-${eventIds.length}-${h.toString(16).padStart(8, "0")}`;
-}
-var MAX_BATCH_EVENTS;
-var init_batching = __esm({
-  "lib/module/analytics/batching.js"() {
-    "use strict";
-    MAX_BATCH_EVENTS = 500;
-  }
-});
-
-// lib/module/analytics/automaticEvents.js
-function compactProperties(properties) {
-  const out = {
-    capture_source: "automatic"
-  };
-  for (const [key, value] of Object.entries(properties ?? {})) {
-    if (value !== void 0) out[key] = value;
-  }
-  return out;
-}
-function emitAutomaticEvent(name, properties) {
-  const event = {
-    name,
-    properties: compactProperties(properties)
-  };
-  if (listeners.size === 0) {
-    pending3.push(event);
-    if (pending3.length > MAX_PENDING2) pending3.shift();
-    return;
-  }
-  for (const listener of listeners) {
-    try {
-      listener(event);
-    } catch {
-    }
-  }
-}
-function subscribeAutomaticEvents(listener) {
-  listeners.add(listener);
-  if (pending3.length > 0) {
-    const buffered = pending3.splice(0, pending3.length);
-    for (const event of buffered) {
-      try {
-        listener(event);
-      } catch {
-      }
-    }
-  }
-  return () => {
-    listeners.delete(listener);
-  };
-}
-var listeners, pending3, MAX_PENDING2;
-var init_automaticEvents = __esm({
-  "lib/module/analytics/automaticEvents.js"() {
-    "use strict";
-    listeners = /* @__PURE__ */ new Set();
-    pending3 = [];
-    MAX_PENDING2 = 50;
-  }
-});
-
 // lib/module/crypto/hmacSha256.js
 function utf8(str3) {
   const out = [];
@@ -10749,6 +10670,89 @@ var init_hmacSha256 = __esm({
   }
 });
 
+// lib/module/analytics/batching.js
+function chunkEvents(events, size = MAX_BATCH_EVENTS) {
+  const cap = Math.max(1, Math.min(size, MAX_BATCH_EVENTS));
+  if (events.length <= cap) return events.length ? [events.slice()] : [];
+  const out = [];
+  for (let i = 0; i < events.length; i += cap) {
+    out.push(events.slice(i, i + cap));
+  }
+  return out;
+}
+function clampBatchSize(configured, fallback) {
+  const n = typeof configured === "number" && configured > 0 ? configured : fallback;
+  return Math.max(1, Math.min(n, MAX_BATCH_EVENTS));
+}
+function batchIdempotencyKey(eventIds) {
+  let h = 2166136261;
+  const joined = eventIds.join("
");
+  for (let i = 0; i < joined.length; i++) {
+    h ^= joined.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return `sdk-${eventIds.length}-${h.toString(16).padStart(8, "0")}`;
+}
+var MAX_BATCH_EVENTS;
+var init_batching = __esm({
+  "lib/module/analytics/batching.js"() {
+    "use strict";
+    MAX_BATCH_EVENTS = 500;
+  }
+});
+
+// lib/module/analytics/automaticEvents.js
+function compactProperties(properties) {
+  const out = {
+    capture_source: "automatic"
+  };
+  for (const [key, value] of Object.entries(properties ?? {})) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function emitAutomaticEvent(name, properties) {
+  const event = {
+    name,
+    properties: compactProperties(properties)
+  };
+  if (listeners.size === 0) {
+    pending3.push(event);
+    if (pending3.length > MAX_PENDING2) pending3.shift();
+    return;
+  }
+  for (const listener of listeners) {
+    try {
+      listener(event);
+    } catch {
+    }
+  }
+}
+function subscribeAutomaticEvents(listener) {
+  listeners.add(listener);
+  if (pending3.length > 0) {
+    const buffered = pending3.splice(0, pending3.length);
+    for (const event of buffered) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  return () => {
+    listeners.delete(listener);
+  };
+}
+var listeners, pending3, MAX_PENDING2;
+var init_automaticEvents = __esm({
+  "lib/module/analytics/automaticEvents.js"() {
+    "use strict";
+    listeners = /* @__PURE__ */ new Set();
+    pending3 = [];
+    MAX_PENDING2 = 50;
+  }
+});
+
 // lib/module/analytics/EventTracker.js
 function uuid() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
@@ -11114,6 +11118,38 @@ var init_EventTracker = __esm({
   }
 });
 
+// lib/module/core/id/installationId.js
+function resolveInstallationId() {
+  try {
+    const storage3 = createStorageBackend();
+    const existing = storage3.get(K_INSTALLATION_ID);
+    if (existing) return existing;
+    const id = `inst-${randomSegment()}${randomSegment()}`;
+    storage3.set(K_INSTALLATION_ID, id);
+    return id;
+  } catch {
+    return `inst-ephemeral-${randomSegment()}`;
+  }
+}
+function randomSegment() {
+  try {
+    const g = globalThis;
+    if (g.crypto?.getRandomValues) {
+      const bytes = g.crypto.getRandomValues(new Uint8Array(6));
+      return Array.from(bytes).map((b) => b.toString(36).padStart(2, "0")).join("").slice(0, 8);
+    }
+  } catch {
+  }
+  return Math.random().toString(36).slice(2, 10).padEnd(8, "0");
+}
+var init_installationId = __esm({
+  "lib/module/core/id/installationId.js"() {
+    "use strict";
+    init_StorageBackend();
+    init_EventTracker();
+  }
+});
+
 // lib/module/features/engage/engageSignals.js
 var EngageSignalBus, engageSignals;
 var init_engageSignals = __esm({
@@ -11573,18 +11609,6 @@ function subscribeNativeProgress(onTick) {
     };
   }
 }
-function resolveInstallationId() {
-  try {
-    const storage3 = createStorageBackend();
-    const existing = storage3.get(K_INSTALLATION_ID);
-    if (existing) return existing;
-    const id = `inst-${Math.random().toString(36).slice(2, 10)}${Math.random().toString(36).slice(2, 10)}`;
-    storage3.set(K_INSTALLATION_ID, id);
-    return id;
-  } catch {
-    return `inst-ephemeral-${Math.random().toString(36).slice(2, 10)}`;
-  }
-}
 async function deliverOtaEvents(params) {
   const events = otaEventEmitter.flush();
   if (!events.length) return;
@@ -11634,7 +11658,7 @@ var init_OtaOrchestrator = __esm({
     init_OtaEventEmitter();
     init_geoCountry();
     init_deviceAttributes();
-    init_EventTracker();
+    init_installationId();
     init_signature();
     init_environment();
     init_retry();
@@ -15374,6 +15398,7 @@ function decodeManual(base64) {
 }
 
 // lib/module/features/session/BackendSessionAdapter.js
+init_installationId();
 init_version();
 init_bridgeAdapter();
 init_nativeModule();
@@ -15509,6 +15534,13 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
       const payload = {
         sessionId: session.sessionId,
         deviceId: session.deviceId,
+        // The canonical per-install id — the SAME value OTA events are
+        // reported under, and a DIFFERENT value from deviceId. The
+        // backend stores it on the Device so release health can join a
+        // bundle's installs to that device's sessions. Without it, crash
+        // impact for a release resolves to "no data" for every device
+        // that never registered for push.
+        installationId: resolveInstallationId(),
         startedAt: session.startedAt,
         // Link the recording row to the always-on analytics row so the
         // dashboard can join them. track() events land on the analytics