@scalebun/react-native 1.4.0 → 1.6.0

package/bin/scalebun.js

@@ -22,6 +22,7 @@
 const fs = require('fs');
 const path = require('path');
 const codemod = require('./lib/iosCodemod');
+const androidCodemod = require('./lib/androidCodemod');
 
 const MIN_BRIDGELESS_RNFIREBASE_MAJOR = 18;
 
@@ -597,6 +598,215 @@ function runInitIos(argv) {
     process.exit(0);
 }
 
+// ─── `init android` — MainApplication OTA wiring + checklist ──────────────────
+
+function findAndroidDir() {
+    const androidDir = path.join(CWD, 'android');
+    return exists(androidDir) ? androidDir : null;
+}
+
+/** [major, minor] of the installed react-native, or null. */
+function rnMinor() {
+    const v = pkgVersion('react-native');
+    if (!v) return null;
+    const parts = v.split('.').map((n) => parseInt(n, 10));
+    return [parts[0] || 0, parts[1] || 0];
+}
+
+/**
+ * Detect Android setup that the codemod cannot apply — the checklist items
+ * (Firebase config, gradle plugin, manifest permissions, the New-Arch OTA
+ * version gate). Mirrors detectIosCapabilities.
+ */
+function detectAndroidCapabilities(androidDir) {
+    const rnVersion = pkgVersion('react-native');
+    const minor = rnMinor();
+
+    const gradleProps = readText(path.join(androidDir, 'gradle.properties')) || '';
+    const newArch = /(^|\n)\s*newArchEnabled\s*=\s*true/.test(gradleProps);
+
+    // Bridgeless ignored getJSBundleFile() until RN 0.76.1 — an OTA update installs
+    // and silently never runs on 0.74/0.75/0.76.0 with New Arch on.
+    const otaDeadZone =
+        newArch &&
+        minor != null &&
+        minor[0] === 0 &&
+        (minor[1] === 74 || minor[1] === 75 || (rnVersion || '').startsWith('0.76.0'));
+
+    const hasGoogleServicesJson = exists(path.join(androidDir, 'app', 'google-services.json'));
+
+    const manifestPath = path.join(androidDir, 'app', 'src', 'main', 'AndroidManifest.xml');
+    const manifest = readText(manifestPath) || '';
+    const hasPostNotifications = /android\.permission\.POST_NOTIFICATIONS/.test(manifest);
+    const hasChannelMeta = /default_notification_channel_id/.test(manifest);
+
+    return {
+        rnVersion,
+        newArch,
+        otaDeadZone,
+        hasGoogleServicesJson,
+        manifestExists: !!readText(manifestPath),
+        hasPostNotifications,
+        hasChannelMeta,
+    };
+}
+
+function printAndroidChecklist(caps) {
+    console.log('');
+    console.log(paint('Android setup (verify / apply by hand — cannot be safely automated)', C.bold));
+
+    if (caps.otaDeadZone) {
+        console.log(
+            '  ' + FAIL() + ' ' +
+                paint(
+                    `React Native ${caps.rnVersion} + New Architecture: OTA updates CANNOT LOAD.`,
+                    C.red,
+                ),
+        );
+        console.log(
+            paint(
+                '      Bridgeless ignored getJSBundleFile() until RN 0.76.1. Upgrade to >= 0.76.1,\n' +
+                    '      or set newArchEnabled=false. Until then updates install but never run.',
+                C.dim,
+            ),
+        );
+    }
+
+    line(caps.hasGoogleServicesJson ? OK() : WARN(), 'google-services.json', caps.hasGoogleServicesJson ? 'present' : null);
+    line(caps.hasPostNotifications ? OK() : WARN(), 'POST_NOTIFICATIONS perm', caps.hasPostNotifications ? 'declared' : null);
+    line(caps.hasChannelMeta ? OK() : WARN(), 'default channel meta', caps.hasChannelMeta ? 'declared' : null);
+
+    const todo = [];
+    if (!caps.hasGoogleServicesJson) {
+        todo.push(
+            'For push: add ' + paint('android/app/google-services.json', C.cyan) +
+                ' (Firebase console), apply the Google Services gradle plugin, and add ' +
+                paint('@react-native-firebase/messaging', C.cyan) + ' for real tokens.',
+        );
+    }
+    if (caps.manifestExists && !caps.hasPostNotifications) {
+        todo.push(
+            'Declare the Android 13+ permission in AndroidManifest.xml: ' +
+                paint('<uses-permission android:name="android.permission.POST_NOTIFICATIONS" />', C.cyan),
+        );
+    }
+    if (caps.manifestExists && !caps.hasChannelMeta) {
+        todo.push(
+            'Declare a default FCM channel meta-data ' +
+                '(com.google.firebase.messaging.default_notification_channel_id) so backgrounded ' +
+                'notifications have a channel.',
+        );
+    }
+
+    if (todo.length) {
+        console.log('');
+        console.log(paint('Push follow-ups (skip if you only use OTA)', C.bold + C.yellow));
+        todo.forEach((t, i) => console.log(`  ${i + 1}. ${t}`));
+    }
+}
+
+function runInitAndroid(argv) {
+    const flags = new Set(argv);
+    const isCheck = flags.has('--check');
+    const isDryRun = flags.has('--dry-run');
+
+    const androidDir = findAndroidDir();
+    if (!androidDir) {
+        console.error(paint('✗ No android/ directory found.', C.red));
+        console.error('  Run this from a React Native project root (the folder containing android/).');
+        process.exit(2);
+    }
+
+    const found = androidCodemod.findMainApplication(androidDir, fs, path);
+    if (!found) {
+        console.error(paint('✗ Could not find MainApplication.kt or .java under android/app/src/main.', C.red));
+        console.error('  This project uses a non-standard layout — wire OTA bundle resolution manually.');
+        process.exit(2);
+    }
+
+    const minor = rnMinor();
+    const rel = path.relative(CWD, found.path);
+    console.log('');
+    console.log(paint('ScaleBun init android', C.bold + C.cyan));
+    console.log(`  MainApplication: ${paint(rel, C.cyan)} (${found.kind})`);
+
+    // Java: not auto-patched — print clear manual instructions, fail non-zero.
+    if (found.kind === 'java') {
+        console.log('');
+        console.log(androidCodemod.javaInstructions(minor));
+        printAndroidChecklist(detectAndroidCapabilities(androidDir));
+        process.exit(isCheck ? 1 : 2);
+    }
+
+    const original = readText(found.path) || '';
+
+    // --check: verify, never write.
+    if (isCheck) {
+        const a = androidCodemod.analyzeKotlin(original);
+        const wired = androidCodemod.isFullyWiredKotlin(original, minor);
+        console.log('');
+        console.log(paint('OTA wiring status', C.bold));
+        line(a.hasImport ? OK() : FAIL(), 'ScaleBunOtaModule import', a.hasImport ? 'present' : null);
+        line(a.hasBundleWiring ? OK() : FAIL(), 'getJSBundleFile wiring', a.hasBundleWiring ? 'present' : null);
+        if (androidCodemod.isReactHostEra(minor)) {
+            line(a.hasJsBundleFilePathArg ? OK() : FAIL(), 'jsBundleFilePath arg (RN >= 0.82)', a.hasJsBundleFilePathArg ? 'present' : null);
+        }
+        printAndroidChecklist(detectAndroidCapabilities(androidDir));
+        console.log('');
+        if (wired) {
+            console.log(paint('✓ MainApplication is wired for ScaleBun OTA bundle resolution.', C.green));
+            process.exit(0);
+        }
+        console.log(paint('✗ MainApplication is missing OTA bundle wiring. Run `npx scalebun init android`.', C.red));
+        process.exit(1);
+    }
+
+    const result = androidCodemod.patchKotlin(original, { minor });
+
+    if (!result.changed) {
+        console.log('');
+        if (result.manual.length) {
+            console.log(paint('Could not auto-apply — wire it by hand:', C.bold + C.yellow));
+            result.manual.forEach((m) => console.log(m));
+        } else {
+            console.log(paint('✓ Already wired — no changes needed (idempotent).', C.green));
+        }
+        printAndroidChecklist(detectAndroidCapabilities(androidDir));
+        process.exit(result.manual.length ? 1 : 0);
+    }
+
+    console.log('');
+    console.log(paint(isDryRun ? 'Planned changes (--dry-run, nothing written)' : 'Changes', C.bold));
+    result.summary.forEach((sline, i) => console.log(`  ${i + 1}. ${sline}`));
+    if (result.manual.length) {
+        console.log('');
+        console.log(paint('Could not auto-apply (edit by hand)', C.bold + C.yellow));
+        result.manual.forEach((m) => console.log(m));
+    }
+
+    if (isDryRun) {
+        console.log('');
+        console.log(paint('Dry run — no files written. Re-run without --dry-run to apply.', C.dim));
+        printAndroidChecklist(detectAndroidCapabilities(androidDir));
+        process.exit(0);
+    }
+
+    // Apply. Never stage / commit — only edits the working-tree file.
+    fs.writeFileSync(found.path, result.source, 'utf8');
+    console.log('');
+    console.log(paint(`✓ Patched ${rel}`, C.green));
+    console.log(paint('  (working-tree edit only — nothing staged or committed)', C.dim));
+
+    printAndroidChecklist(detectAndroidCapabilities(androidDir));
+
+    console.log('');
+    console.log(paint('Next:', C.bold));
+    console.log('  Rebuild the native app (a JS reload does not load the newly-wired native path):');
+    console.log(paint('    npx react-native run-android   # or your gradle build', C.dim));
+    console.log('');
+    process.exit(0);
+}
+
 // ─── entry ──────────────────────────────────────────────────────────────────
 
 function main() {
@@ -610,9 +820,11 @@ function main() {
             const target = argv[1];
             if (target === 'ios') {
                 runInitIos(argv.slice(2));
+            } else if (target === 'android') {
+                runInitAndroid(argv.slice(2));
             } else {
                 console.error(`Unknown init target: ${target ?? '(none)'}`);
-                console.error('Usage: npx scalebun init ios [--check | --dry-run]');
+                console.error('Usage: npx scalebun init <ios|android> [--check | --dry-run]');
                 process.exit(2);
             }
             break;
@@ -621,21 +833,101 @@ function main() {
         case 'help':
         case '--help':
         case '-h':
-            console.log('');
-            console.log(paint('ScaleBun SDK CLI', C.bold));
-            console.log('');
-            console.log('Usage:');
-            console.log('  npx scalebun doctor              Diagnose push-notification setup');
-            console.log('  npx scalebun init ios            Wire the iOS AppDelegate for Direct APNs');
-            console.log('  npx scalebun init ios --check    Verify hooks exist (exit 1 if missing)');
-            console.log('  npx scalebun init ios --dry-run  Preview changes without writing');
-            console.log('');
+            printFullHelp();
             break;
         default:
-            console.error(`Unknown command: ${cmd}`);
-            console.error('Run `npx scalebun help` for usage.');
-            process.exit(2);
+            // TWO PACKAGES, ONE COMMAND NAME.
+            //
+            // The OTA commands (login, ota publish, releases, rollout, quickstart…)
+            // live in @scalebun/cli, which declares the SAME `scalebun` bin as this
+            // package. Every doc and generated CI pipeline says `npx scalebun ota
+            // publish`, so whichever package won the bin race decided whether that
+            // worked — and when this one won, a new user's very first command died
+            // with "Unknown command: ota" and no way to find out why.
+            //
+            // Delegate instead of guessing: if @scalebun/cli is installed, run it.
+            // If not, say exactly what to install rather than what went wrong.
+            delegateToOtaCli(argv);
     }
 }
 
+/** Resolve the bundled @scalebun/cli compiled entry, or null when absent. */
+function resolveOtaCli() {
+    try {
+        return require.resolve('@scalebun/cli/lib/index.js', {
+            paths: [process.cwd(), __dirname],
+        });
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Hand the invocation to @scalebun/cli, preserving argv and exit code.
+ * Falls back to an actionable install instruction when it is not present.
+ */
+function delegateToOtaCli(argv) {
+    const cliEntry = resolveOtaCli();
+
+    if (!cliEntry) {
+        const cmd = argv[0];
+        console.error('');
+        console.error(`"${cmd}" is an OTA command, provided by @scalebun/cli.`);
+        console.error('');
+        console.error('@scalebun/cli ships as a dependency of @scalebun/react-native, so it');
+        console.error('should already be present. It could not be resolved — your install may');
+        console.error('be incomplete or the dependency was pruned.');
+        console.error('');
+        console.error('Reinstall dependencies, then re-run:');
+        console.error('  npm install');
+        console.error(`  npx scalebun ${argv.join(' ')}`);
+        console.error('');
+        console.error('(Or install it explicitly:  npm i -D @scalebun/cli)');
+        console.error('');
+        process.exit(2);
+    }
+
+    const { spawnSync } = require('child_process');
+    const res = spawnSync(process.execPath, [cliEntry, ...argv], {
+        stdio: 'inherit',
+    });
+    process.exit(res.status ?? 1);
+}
+
+/**
+ * Print the full command surface: the SDK-setup commands this package handles
+ * directly, followed by the complete @scalebun/cli command tree.
+ *
+ * The CLI tree is rendered by delegating to `@scalebun/cli --help` rather than a
+ * hardcoded list, so it is a single source of truth and cannot drift. When the
+ * CLI cannot be resolved (should not happen — it is a dependency) we fall back to
+ * a prose note instead of an error, since this is a help screen.
+ */
+function printFullHelp() {
+    console.log('');
+    console.log(paint('ScaleBun SDK CLI', C.bold));
+    console.log('');
+    console.log(paint('SDK setup (bundled with @scalebun/react-native):', C.bold));
+    console.log('  npx scalebun doctor                  Diagnose push-notification setup');
+    console.log('  npx scalebun init ios                Wire the iOS AppDelegate for Direct APNs');
+    console.log('  npx scalebun init android            Wire Android MainApplication for OTA bundle loading');
+    console.log(paint('    add --check to verify (exit 1 if missing) or --dry-run to preview', C.dim));
+    console.log('');
+
+    const cliEntry = resolveOtaCli();
+    if (!cliEntry) {
+        console.log(paint('OTA & account commands:', C.bold));
+        console.log('  Provided by @scalebun/cli (login, quickstart, apps, ota publish,');
+        console.log('  releases, rollout…). It ships with this package but could not be');
+        console.log('  resolved — run `npm install`, then `npx scalebun --help` again.');
+        console.log('');
+        return;
+    }
+
+    console.log(paint('OTA & account commands (from @scalebun/cli):', C.bold));
+    const { spawnSync } = require('child_process');
+    spawnSync(process.execPath, [cliEntry, '--help'], { stdio: 'inherit' });
+    console.log('');
+}
+
 main();

package/dist/scalebun.full.js

@@ -489,7 +489,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "lib/module/core/constants/version.js"() {
     "use strict";
-    SDK_VERSION = "1.4.0";
+    SDK_VERSION = "1.6.0";
   }
 });
 
@@ -10041,6 +10041,10 @@ function enableDebug(config) {
       __DEV__ && logger.debug("Debug already enabled, skipping");
       return;
     }
+    if (!__DEV__ && !config.allowInRelease) {
+      logger.warn("[ScaleBun] Debug connection refused in a release build. The debug transport is unencrypted (ws://) and carries captured traffic and the shared secret in cleartext, so it is development-only by default. If you genuinely need it in a release build, set `allowInRelease: true` \u2014 and do not ship that to users.");
+      return;
+    }
     if (!isDevToolsBundled()) {
       logger.warn("[ScaleBun] debugConnection was configured, but the desktop-debugger tooling is not in this bundle. It is excluded by default (the ScaleBun desktop app is not yet released); opt in with `withScaleBun(config, { features: { devTools: true } })` in metro.config.js. All other SDK behaviour is unaffected.");
       return;
@@ -10550,89 +10554,6 @@ var init_nativeCrashBridge = __esm({
   }
 });
 
-// lib/module/analytics/batching.js
-function chunkEvents(events, size = MAX_BATCH_EVENTS) {
-  const cap = Math.max(1, Math.min(size, MAX_BATCH_EVENTS));
-  if (events.length <= cap) return events.length ? [events.slice()] : [];
-  const out = [];
-  for (let i = 0; i < events.length; i += cap) {
-    out.push(events.slice(i, i + cap));
-  }
-  return out;
-}
-function clampBatchSize(configured, fallback) {
-  const n = typeof configured === "number" && configured > 0 ? configured : fallback;
-  return Math.max(1, Math.min(n, MAX_BATCH_EVENTS));
-}
-function batchIdempotencyKey(eventIds) {
-  let h = 2166136261;
-  const joined = eventIds.join("
");
-  for (let i = 0; i < joined.length; i++) {
-    h ^= joined.charCodeAt(i);
-    h = Math.imul(h, 16777619) >>> 0;
-  }
-  return `sdk-${eventIds.length}-${h.toString(16).padStart(8, "0")}`;
-}
-var MAX_BATCH_EVENTS;
-var init_batching = __esm({
-  "lib/module/analytics/batching.js"() {
-    "use strict";
-    MAX_BATCH_EVENTS = 500;
-  }
-});
-
-// lib/module/analytics/automaticEvents.js
-function compactProperties(properties) {
-  const out = {
-    capture_source: "automatic"
-  };
-  for (const [key, value] of Object.entries(properties ?? {})) {
-    if (value !== void 0) out[key] = value;
-  }
-  return out;
-}
-function emitAutomaticEvent(name, properties) {
-  const event = {
-    name,
-    properties: compactProperties(properties)
-  };
-  if (listeners.size === 0) {
-    pending3.push(event);
-    if (pending3.length > MAX_PENDING2) pending3.shift();
-    return;
-  }
-  for (const listener of listeners) {
-    try {
-      listener(event);
-    } catch {
-    }
-  }
-}
-function subscribeAutomaticEvents(listener) {
-  listeners.add(listener);
-  if (pending3.length > 0) {
-    const buffered = pending3.splice(0, pending3.length);
-    for (const event of buffered) {
-      try {
-        listener(event);
-      } catch {
-      }
-    }
-  }
-  return () => {
-    listeners.delete(listener);
-  };
-}
-var listeners, pending3, MAX_PENDING2;
-var init_automaticEvents = __esm({
-  "lib/module/analytics/automaticEvents.js"() {
-    "use strict";
-    listeners = /* @__PURE__ */ new Set();
-    pending3 = [];
-    MAX_PENDING2 = 50;
-  }
-});
-
 // lib/module/crypto/hmacSha256.js
 function utf8(str3) {
   const out = [];
@@ -10749,6 +10670,89 @@ var init_hmacSha256 = __esm({
   }
 });
 
+// lib/module/analytics/batching.js
+function chunkEvents(events, size = MAX_BATCH_EVENTS) {
+  const cap = Math.max(1, Math.min(size, MAX_BATCH_EVENTS));
+  if (events.length <= cap) return events.length ? [events.slice()] : [];
+  const out = [];
+  for (let i = 0; i < events.length; i += cap) {
+    out.push(events.slice(i, i + cap));
+  }
+  return out;
+}
+function clampBatchSize(configured, fallback) {
+  const n = typeof configured === "number" && configured > 0 ? configured : fallback;
+  return Math.max(1, Math.min(n, MAX_BATCH_EVENTS));
+}
+function batchIdempotencyKey(eventIds) {
+  let h = 2166136261;
+  const joined = eventIds.join("
");
+  for (let i = 0; i < joined.length; i++) {
+    h ^= joined.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return `sdk-${eventIds.length}-${h.toString(16).padStart(8, "0")}`;
+}
+var MAX_BATCH_EVENTS;
+var init_batching = __esm({
+  "lib/module/analytics/batching.js"() {
+    "use strict";
+    MAX_BATCH_EVENTS = 500;
+  }
+});
+
+// lib/module/analytics/automaticEvents.js
+function compactProperties(properties) {
+  const out = {
+    capture_source: "automatic"
+  };
+  for (const [key, value] of Object.entries(properties ?? {})) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function emitAutomaticEvent(name, properties) {
+  const event = {
+    name,
+    properties: compactProperties(properties)
+  };
+  if (listeners.size === 0) {
+    pending3.push(event);
+    if (pending3.length > MAX_PENDING2) pending3.shift();
+    return;
+  }
+  for (const listener of listeners) {
+    try {
+      listener(event);
+    } catch {
+    }
+  }
+}
+function subscribeAutomaticEvents(listener) {
+  listeners.add(listener);
+  if (pending3.length > 0) {
+    const buffered = pending3.splice(0, pending3.length);
+    for (const event of buffered) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  return () => {
+    listeners.delete(listener);
+  };
+}
+var listeners, pending3, MAX_PENDING2;
+var init_automaticEvents = __esm({
+  "lib/module/analytics/automaticEvents.js"() {
+    "use strict";
+    listeners = /* @__PURE__ */ new Set();
+    pending3 = [];
+    MAX_PENDING2 = 50;
+  }
+});
+
 // lib/module/analytics/EventTracker.js
 function uuid() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
@@ -11114,6 +11118,38 @@ var init_EventTracker = __esm({
   }
 });
 
+// lib/module/core/id/installationId.js
+function resolveInstallationId() {
+  try {
+    const storage3 = createStorageBackend();
+    const existing = storage3.get(K_INSTALLATION_ID);
+    if (existing) return existing;
+    const id = `inst-${randomSegment()}${randomSegment()}`;
+    storage3.set(K_INSTALLATION_ID, id);
+    return id;
+  } catch {
+    return `inst-ephemeral-${randomSegment()}`;
+  }
+}
+function randomSegment() {
+  try {
+    const g = globalThis;
+    if (g.crypto?.getRandomValues) {
+      const bytes = g.crypto.getRandomValues(new Uint8Array(6));
+      return Array.from(bytes).map((b) => b.toString(36).padStart(2, "0")).join("").slice(0, 8);
+    }
+  } catch {
+  }
+  return Math.random().toString(36).slice(2, 10).padEnd(8, "0");
+}
+var init_installationId = __esm({
+  "lib/module/core/id/installationId.js"() {
+    "use strict";
+    init_StorageBackend();
+    init_EventTracker();
+  }
+});
+
 // lib/module/features/engage/engageSignals.js
 var EngageSignalBus, engageSignals;
 var init_engageSignals = __esm({
@@ -11573,18 +11609,6 @@ function subscribeNativeProgress(onTick) {
     };
   }
 }
-function resolveInstallationId() {
-  try {
-    const storage3 = createStorageBackend();
-    const existing = storage3.get(K_INSTALLATION_ID);
-    if (existing) return existing;
-    const id = `inst-${Math.random().toString(36).slice(2, 10)}${Math.random().toString(36).slice(2, 10)}`;
-    storage3.set(K_INSTALLATION_ID, id);
-    return id;
-  } catch {
-    return `inst-ephemeral-${Math.random().toString(36).slice(2, 10)}`;
-  }
-}
 async function deliverOtaEvents(params) {
   const events = otaEventEmitter.flush();
   if (!events.length) return;
@@ -11634,7 +11658,7 @@ var init_OtaOrchestrator = __esm({
     init_OtaEventEmitter();
     init_geoCountry();
     init_deviceAttributes();
-    init_EventTracker();
+    init_installationId();
     init_signature();
     init_environment();
     init_retry();
@@ -15374,6 +15398,7 @@ function decodeManual(base64) {
 }
 
 // lib/module/features/session/BackendSessionAdapter.js
+init_installationId();
 init_version();
 init_bridgeAdapter();
 init_nativeModule();
@@ -15509,6 +15534,13 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
       const payload = {
         sessionId: session.sessionId,
         deviceId: session.deviceId,
+        // The canonical per-install id — the SAME value OTA events are
+        // reported under, and a DIFFERENT value from deviceId. The
+        // backend stores it on the Device so release health can join a
+        // bundle's installs to that device's sessions. Without it, crash
+        // impact for a release resolves to "no data" for every device
+        // that never registered for push.
+        installationId: resolveInstallationId(),
         startedAt: session.startedAt,
         // Link the recording row to the always-on analytics row so the
         // dashboard can join them. track() events land on the analytics