@dynamic-labs/react-native-extension 4.91.4 → 4.91.5

package/android/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/embeddedwebview/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/main/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/src/main/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/index.cjs

@@ -35,7 +35,7 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var version = "4.91.4";
+var version = "4.91.5";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {

package/index.js

@@ -13,7 +13,7 @@ import { createURL, getInitialURL, addEventListener, openURL } from 'expo-linkin
 import { openAuthSessionAsync } from 'expo-web-browser';
 import { createPasskey, PasskeyStamper } from '@turnkey/react-native-passkey-stamper';
 
-var version = "4.91.4";
+var version = "4.91.5";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {

package/ios/EmbeddedWebViewController.swift

@@ -28,6 +28,11 @@ public final class EmbeddedWebViewController: NSObject {
   private var pendingNavigationDecisions: [String: (WKNavigationActionPolicy) -> Void] = [:]
   private var navigationTimers: [String: Timer] = [:]
   private var emitterToken: UUID?
+  // Origin pre-approved by `setUrl`. When `decidePolicyFor` sees a top-frame
+  // navigation whose origin matches, it allows it immediately — no JS
+  // round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String?
 
   private override init() {
     super.init()
@@ -65,6 +70,11 @@ public final class EmbeddedWebViewController: NSObject {
     }
     ensureWebView()
     hasLoaded = true
+    // Pre-approve the origin so the first `decidePolicyFor` call can skip
+    // the JS round-trip. On cold boot the JS thread may be too congested to
+    // respond within the 2 s navigation-decision timeout, silently
+    // cancelling the load.
+    preApprovedOrigin = originString(for: parsed)
     webView?.load(URLRequest(url: parsed))
   }
 
@@ -124,6 +134,7 @@ public final class EmbeddedWebViewController: NSObject {
     navigationTimers.values.forEach { $0.invalidate() }
     navigationTimers.removeAll()
     hasLoaded = false
+    preApprovedOrigin = nil
   }
 
   public func postMessage(_ message: String) {
@@ -248,6 +259,24 @@ public final class EmbeddedWebViewController: NSObject {
     return nil
   }
 
+  // Extract the scheme + host + port origin from a URL (e.g.
+  // "https://webview.dynamicauth.com"). Returns nil for URLs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private func originString(for url: URL?) -> String? {
+    guard let url = url, let scheme = url.scheme, let host = url.host else {
+      return nil
+    }
+    if let port = url.port {
+      let isDefaultPort = (scheme == "https" && port == 443) || (scheme == "http" && port == 80)
+      if !isDefaultPort {
+        return "\(scheme)://\(host):\(port)"
+      }
+    }
+    return "\(scheme)://\(host)"
+  }
+
   // Use JSONSerialization to safely encode an arbitrary string as a JS string literal.
   private func jsStringLiteral(_ raw: String) -> String {
     guard
@@ -317,6 +346,17 @@ extension EmbeddedWebViewController: WKNavigationDelegate {
       return
     }
 
+    // Fast-path: if the URL's origin matches the pre-approved origin (set
+    // by `setUrl`), allow immediately. This eliminates the cold-boot race
+    // where the JS thread is too congested to respond to
+    // `onShouldStartLoad` within the 2 s navigation-decision timeout.
+    if let approved = preApprovedOrigin,
+       approved == originString(for: navigationAction.request.url) {
+      preApprovedOrigin = nil
+      decisionHandler(.allow)
+      return
+    }
+
     let id = UUID().uuidString
     pendingNavigationDecisions[id] = decisionHandler
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/react-native-extension",
-  "version": "4.91.4",
+  "version": "4.91.5",
   "main": "./index.cjs",
   "module": "./index.js",
   "types": "./src/index.d.ts",
@@ -18,11 +18,11 @@
     "@turnkey/react-native-passkey-stamper": "1.2.7",
     "@react-native-documents/picker": "^11.0.0",
     "react-native-fs": ">=2.20.0",
-    "@dynamic-labs/assert-package-version": "4.91.4",
-    "@dynamic-labs/client": "4.91.4",
-    "@dynamic-labs/logger": "4.91.4",
-    "@dynamic-labs/message-transport": "4.91.4",
-    "@dynamic-labs/webview-messages": "4.91.4"
+    "@dynamic-labs/assert-package-version": "4.91.5",
+    "@dynamic-labs/client": "4.91.5",
+    "@dynamic-labs/logger": "4.91.5",
+    "@dynamic-labs/message-transport": "4.91.5",
+    "@dynamic-labs/webview-messages": "4.91.5"
   },
   "peerDependencies": {
     "react": ">=18.0.0 <20.0.0",