@dynamic-labs/react-native-extension 4.91.4 → 4.91.6

package/android/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/main/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/src/main/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/android/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.
@@ -66,6 +66,12 @@ object EmbeddedWebViewController {
   // prompting JS again — avoiding a potential approval loop.
   private var bypassUrl: String? = null
 
+  // Origin pre-approved by `setUrl`. When `shouldOverrideUrlLoading` sees a
+  // top-frame navigation whose origin matches, it allows it immediately — no
+  // JS round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String? = null
+
   private var emitterToken: java.util.UUID? = null
 
   // Module-side hook: assign the emitter under a token. The token lets
@@ -108,6 +114,11 @@ object EmbeddedWebViewController {
         return@runOnMain
       }
       val webView = ensureWebView() ?: return@runOnMain
+      // Pre-approve the origin so the first `shouldOverrideUrlLoading` call
+      // can skip the JS round-trip. On cold boot the JS thread may be too
+      // congested to respond within the navigation-decision timeout, silently
+      // cancelling the load.
+      preApprovedOrigin = originString(android.net.Uri.parse(url))
       webView.loadUrl(url)
     }
   }
@@ -280,6 +291,7 @@ object EmbeddedWebViewController {
     pendingTimeouts.values.forEach { mainHandler.removeCallbacks(it) }
     pendingTimeouts.clear()
     bypassUrl = null
+    preApprovedOrigin = null
   }
 
   private fun runOnMain(action: () -> Unit) {
@@ -332,6 +344,7 @@ object EmbeddedWebViewController {
       val isAllowedTopFrameScheme =
         scheme == "https" || (httpAllowed && scheme == "http")
       if (!isAllowedTopFrameScheme) {
+        preApprovedOrigin = null
         emitLoadError(
           url = url,
           code = -1,
@@ -342,6 +355,17 @@ object EmbeddedWebViewController {
         return true
       }
 
+      // Fast-path: if the URL's origin matches the pre-approved origin (set
+      // by `setUrl`), allow immediately. This eliminates the cold-boot race
+      // where the JS thread is too congested to respond to
+      // `onShouldStartLoad` within the navigation-decision timeout.
+      val approved = preApprovedOrigin
+      if (approved != null && approved == originString(request.url)) {
+        preApprovedOrigin = null
+        bypassUrl = url
+        return false
+      }
+
       val id = UUID.randomUUID().toString()
       pendingNavigationUrls[id] = url
 
@@ -486,6 +510,22 @@ object EmbeddedWebViewController {
     }
   }
 
+  // Extract the scheme + host + port origin from a URI (e.g.
+  // "https://webview.dynamicauth.com"). Returns null for URIs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private fun originString(uri: android.net.Uri?): String? {
+    val scheme = uri?.scheme ?: return null
+    val host = uri.host ?: return null
+    val port = uri.port
+
+    val shouldIncludePort = port != -1 &&
+      !((scheme == "https" && port == 443) || (scheme == "http" && port == 80))
+
+    return if (shouldIncludePort) "$scheme://$host:$port" else "$scheme://$host"
+  }
+
   // Refuse target=_blank / window.open popups (matches react-native-webview's
   // `setSupportMultipleWindows={false}` semantics: there's nowhere reasonable
   // to open the new window inside the overlay).

package/index.cjs

@@ -35,7 +35,7 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var version = "4.91.4";
+var version = "4.91.6";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {
@@ -1002,6 +1002,7 @@ const setupEmbeddedWebView = ({
   let recoveryTimer = null;
   let hasFailed = false;
   let hasEmittedSuccessLog = false;
+  let tornDown = false;
   const clearLoadingTimer = () => {
     if (loadingTimer !== null) {
       clearTimeout(loadingTimer);
@@ -1023,6 +1024,7 @@ const setupEmbeddedWebView = ({
     hasFailed = true;
     clearLoadingTimer();
     clearRecoveryTimer();
+    logger.debug(`[EmbeddedWebView] raiseFailure phase=${phase}`);
     const meta = phaseTimers.getMeta({
       phase
     });
@@ -1064,6 +1066,7 @@ const setupEmbeddedWebView = ({
   const handleSdkReady = message => {
     if (message.origin !== 'webview') return;
     if (message.type !== webviewMessages.sdkHasLoadedEventName) return;
+    logger.debug('[EmbeddedWebView] SDK ready signal received');
     clearRecoveryTimer();
     if (hasEmittedSuccessLog || hasFailed) return;
     hasEmittedSuccessLog = true;
@@ -1099,11 +1102,13 @@ const setupEmbeddedWebView = ({
       isTopFrame: event.isTopFrame,
       url: event.url
     }, builtUrl);
+    logger.debug(`[EmbeddedWebView] onShouldStartLoad id=${event.id} url=${event.url} isTopFrame=${event.isTopFrame} allow=${allow}`);
     native.respondToShouldStartLoad(event.id, allow).catch(err => {
       logger.warn('EmbeddedWebView.respondToShouldStartLoad failed', err);
     });
   });
   const onLoadStartSub = native.addListener('onLoadStart', () => {
+    logger.debug('[EmbeddedWebView] onLoadStart');
     phaseTimers.recordEvent('load_start');
     // Re-arm both timers on every load_start. A retry from the native
     // side (e.g. a redirect, or a reload after a transient failure)
@@ -1116,10 +1121,12 @@ const setupEmbeddedWebView = ({
     }, _loadingTimeoutMs);
   });
   const onLoadSub = native.addListener('onLoad', () => {
+    logger.debug('[EmbeddedWebView] onLoad (response committed)');
     phaseTimers.recordEvent('load');
     clearLoadingTimer();
   });
   const onLoadEndSub = native.addListener('onLoadEnd', () => {
+    logger.debug('[EmbeddedWebView] onLoadEnd (page finished)');
     phaseTimers.recordEvent('load_end');
     clearLoadingTimer();
     clearRecoveryTimer();
@@ -1128,6 +1135,7 @@ const setupEmbeddedWebView = ({
     }, _recoveryTimeoutMs);
   });
   const onLoadErrorSub = native.addListener('onLoadError', event => {
+    logger.debug(`[EmbeddedWebView] onLoadError domain=${event.domain} code=${event.code} url=${event.url}`);
     phaseTimers.recordEvent('native_error');
     logger.warn('EmbeddedWebView load error', event);
     raiseFailure('embedded_native_error', {
@@ -1147,13 +1155,28 @@ const setupEmbeddedWebView = ({
   // without emitting onLoadError — leaving onLoadStart (and therefore the
   // timer) never triggered. The onLoadStart handler clears and re-arms this
   // timer when it fires, so behaviour after onLoadStart is unchanged.
+  logger.debug(`[EmbeddedWebView] arming loading timer (${_loadingTimeoutMs}ms) before setUrl`);
   loadingTimer = setTimeout(() => {
+    logger.debug('[EmbeddedWebView] loading timer fired — raising html_load failure');
     raiseFailure('html_load');
   }, _loadingTimeoutMs);
-  native.setUrl(builtUrl.toString()).catch(err => {
-    logger.warn('EmbeddedWebView.setUrl failed', err);
-  });
+  // Defer setUrl by one event-loop tick so the JS thread has fully settled
+  // after listener registration. On cold boot the main thread is congested
+  // with bundle evaluation — yielding here gives pending microtasks and
+  // native bridge batches a chance to flush before the native side starts
+  // firing navigation events that require a JS round-trip response.
+  const warmupTimer = setTimeout(() => {
+    var _a;
+    if (tornDown) return;
+    logger.debug(`[EmbeddedWebView] calling setUrl: ${builtUrl.toString()}`);
+    (_a = native.setUrl(builtUrl.toString())) === null || _a === void 0 ? void 0 : _a.catch(err => {
+      logger.warn('EmbeddedWebView.setUrl failed', err);
+    });
+  }, 0);
   return () => {
+    logger.debug('[EmbeddedWebView] teardown — removing listeners');
+    tornDown = true;
+    clearTimeout(warmupTimer);
     clearLoadingTimer();
     clearRecoveryTimer();
     removeVisibilityHandler();

package/index.js

@@ -13,7 +13,7 @@ import { createURL, getInitialURL, addEventListener, openURL } from 'expo-linkin
 import { openAuthSessionAsync } from 'expo-web-browser';
 import { createPasskey, PasskeyStamper } from '@turnkey/react-native-passkey-stamper';
 
-var version = "4.91.4";
+var version = "4.91.6";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {
@@ -980,6 +980,7 @@ const setupEmbeddedWebView = ({
   let recoveryTimer = null;
   let hasFailed = false;
   let hasEmittedSuccessLog = false;
+  let tornDown = false;
   const clearLoadingTimer = () => {
     if (loadingTimer !== null) {
       clearTimeout(loadingTimer);
@@ -1001,6 +1002,7 @@ const setupEmbeddedWebView = ({
     hasFailed = true;
     clearLoadingTimer();
     clearRecoveryTimer();
+    logger.debug(`[EmbeddedWebView] raiseFailure phase=${phase}`);
     const meta = phaseTimers.getMeta({
       phase
     });
@@ -1042,6 +1044,7 @@ const setupEmbeddedWebView = ({
   const handleSdkReady = message => {
     if (message.origin !== 'webview') return;
     if (message.type !== sdkHasLoadedEventName) return;
+    logger.debug('[EmbeddedWebView] SDK ready signal received');
     clearRecoveryTimer();
     if (hasEmittedSuccessLog || hasFailed) return;
     hasEmittedSuccessLog = true;
@@ -1077,11 +1080,13 @@ const setupEmbeddedWebView = ({
       isTopFrame: event.isTopFrame,
       url: event.url
     }, builtUrl);
+    logger.debug(`[EmbeddedWebView] onShouldStartLoad id=${event.id} url=${event.url} isTopFrame=${event.isTopFrame} allow=${allow}`);
     native.respondToShouldStartLoad(event.id, allow).catch(err => {
       logger.warn('EmbeddedWebView.respondToShouldStartLoad failed', err);
     });
   });
   const onLoadStartSub = native.addListener('onLoadStart', () => {
+    logger.debug('[EmbeddedWebView] onLoadStart');
     phaseTimers.recordEvent('load_start');
     // Re-arm both timers on every load_start. A retry from the native
     // side (e.g. a redirect, or a reload after a transient failure)
@@ -1094,10 +1099,12 @@ const setupEmbeddedWebView = ({
     }, _loadingTimeoutMs);
   });
   const onLoadSub = native.addListener('onLoad', () => {
+    logger.debug('[EmbeddedWebView] onLoad (response committed)');
     phaseTimers.recordEvent('load');
     clearLoadingTimer();
   });
   const onLoadEndSub = native.addListener('onLoadEnd', () => {
+    logger.debug('[EmbeddedWebView] onLoadEnd (page finished)');
     phaseTimers.recordEvent('load_end');
     clearLoadingTimer();
     clearRecoveryTimer();
@@ -1106,6 +1113,7 @@ const setupEmbeddedWebView = ({
     }, _recoveryTimeoutMs);
   });
   const onLoadErrorSub = native.addListener('onLoadError', event => {
+    logger.debug(`[EmbeddedWebView] onLoadError domain=${event.domain} code=${event.code} url=${event.url}`);
     phaseTimers.recordEvent('native_error');
     logger.warn('EmbeddedWebView load error', event);
     raiseFailure('embedded_native_error', {
@@ -1125,13 +1133,28 @@ const setupEmbeddedWebView = ({
   // without emitting onLoadError — leaving onLoadStart (and therefore the
   // timer) never triggered. The onLoadStart handler clears and re-arms this
   // timer when it fires, so behaviour after onLoadStart is unchanged.
+  logger.debug(`[EmbeddedWebView] arming loading timer (${_loadingTimeoutMs}ms) before setUrl`);
   loadingTimer = setTimeout(() => {
+    logger.debug('[EmbeddedWebView] loading timer fired — raising html_load failure');
     raiseFailure('html_load');
   }, _loadingTimeoutMs);
-  native.setUrl(builtUrl.toString()).catch(err => {
-    logger.warn('EmbeddedWebView.setUrl failed', err);
-  });
+  // Defer setUrl by one event-loop tick so the JS thread has fully settled
+  // after listener registration. On cold boot the main thread is congested
+  // with bundle evaluation — yielding here gives pending microtasks and
+  // native bridge batches a chance to flush before the native side starts
+  // firing navigation events that require a JS round-trip response.
+  const warmupTimer = setTimeout(() => {
+    var _a;
+    if (tornDown) return;
+    logger.debug(`[EmbeddedWebView] calling setUrl: ${builtUrl.toString()}`);
+    (_a = native.setUrl(builtUrl.toString())) === null || _a === void 0 ? void 0 : _a.catch(err => {
+      logger.warn('EmbeddedWebView.setUrl failed', err);
+    });
+  }, 0);
   return () => {
+    logger.debug('[EmbeddedWebView] teardown — removing listeners');
+    tornDown = true;
+    clearTimeout(warmupTimer);
     clearLoadingTimer();
     clearRecoveryTimer();
     removeVisibilityHandler();

package/ios/EmbeddedWebViewController.swift

@@ -2,7 +2,7 @@ import UIKit
 import WebKit
 
 private let scriptHandlerName = "dynamicEmbeddedWebView"
-private let navigationDecisionTimeout: TimeInterval = 2.0
+private let navigationDecisionTimeout: TimeInterval = 5.0
 
 // Cleartext http is only permitted in debug builds (e.g. Metro at
 // http://localhost:4202). Release builds reject http top-frame and sub-frame
@@ -28,6 +28,11 @@ public final class EmbeddedWebViewController: NSObject {
   private var pendingNavigationDecisions: [String: (WKNavigationActionPolicy) -> Void] = [:]
   private var navigationTimers: [String: Timer] = [:]
   private var emitterToken: UUID?
+  // Origin pre-approved by `setUrl`. When `decidePolicyFor` sees a top-frame
+  // navigation whose origin matches, it allows it immediately — no JS
+  // round-trip required. Cleared after first use so subsequent navigations
+  // still go through the JS allowlist.
+  private var preApprovedOrigin: String?
 
   private override init() {
     super.init()
@@ -65,6 +70,11 @@ public final class EmbeddedWebViewController: NSObject {
     }
     ensureWebView()
     hasLoaded = true
+    // Pre-approve the origin so the first `decidePolicyFor` call can skip
+    // the JS round-trip. On cold boot the JS thread may be too congested to
+    // respond within the 2 s navigation-decision timeout, silently
+    // cancelling the load.
+    preApprovedOrigin = originString(for: parsed)
     webView?.load(URLRequest(url: parsed))
   }
 
@@ -124,6 +134,7 @@ public final class EmbeddedWebViewController: NSObject {
     navigationTimers.values.forEach { $0.invalidate() }
     navigationTimers.removeAll()
     hasLoaded = false
+    preApprovedOrigin = nil
   }
 
   public func postMessage(_ message: String) {
@@ -248,6 +259,24 @@ public final class EmbeddedWebViewController: NSObject {
     return nil
   }
 
+  // Extract the scheme + host + port origin from a URL (e.g.
+  // "https://webview.dynamicauth.com"). Returns nil for URLs without a host.
+  // Default ports (443 for HTTPS, 80 for HTTP) are omitted so that
+  // "https://example.com" and "https://example.com:443" produce the same
+  // origin string.
+  private func originString(for url: URL?) -> String? {
+    guard let url = url, let scheme = url.scheme, let host = url.host else {
+      return nil
+    }
+    if let port = url.port {
+      let isDefaultPort = (scheme == "https" && port == 443) || (scheme == "http" && port == 80)
+      if !isDefaultPort {
+        return "\(scheme)://\(host):\(port)"
+      }
+    }
+    return "\(scheme)://\(host)"
+  }
+
   // Use JSONSerialization to safely encode an arbitrary string as a JS string literal.
   private func jsStringLiteral(_ raw: String) -> String {
     guard
@@ -317,6 +346,17 @@ extension EmbeddedWebViewController: WKNavigationDelegate {
       return
     }
 
+    // Fast-path: if the URL's origin matches the pre-approved origin (set
+    // by `setUrl`), allow immediately. This eliminates the cold-boot race
+    // where the JS thread is too congested to respond to
+    // `onShouldStartLoad` within the 2 s navigation-decision timeout.
+    if let approved = preApprovedOrigin,
+       approved == originString(for: navigationAction.request.url) {
+      preApprovedOrigin = nil
+      decisionHandler(.allow)
+      return
+    }
+
     let id = UUID().uuidString
     pendingNavigationDecisions[id] = decisionHandler
 
@@ -326,6 +366,17 @@ extension EmbeddedWebViewController: WKNavigationDelegate {
         if let handler = self.pendingNavigationDecisions.removeValue(forKey: id) {
           self.navigationTimers.removeValue(forKey: id)?.invalidate()
           handler(.cancel)
+          // Surface an explicit load error so the SDK's error path runs
+          // immediately instead of waiting for the 20 s html_load timer.
+          // Matches Android's EmbeddedWebViewNavigationTimeout behavior.
+          let timeoutMs = Int(navigationDecisionTimeout * 1000)
+          self.eventEmitter?("onLoadError", [
+            "url": url,
+            "code": -1,
+            "domain": "EmbeddedWebViewNavigationTimeout",
+            "description": "Navigation decision timed out after \(timeoutMs)ms",
+            "isProvisional": true,
+          ])
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/react-native-extension",
-  "version": "4.91.4",
+  "version": "4.91.6",
   "main": "./index.cjs",
   "module": "./index.js",
   "types": "./src/index.d.ts",
@@ -18,11 +18,11 @@
     "@turnkey/react-native-passkey-stamper": "1.2.7",
     "@react-native-documents/picker": "^11.0.0",
     "react-native-fs": ">=2.20.0",
-    "@dynamic-labs/assert-package-version": "4.91.4",
-    "@dynamic-labs/client": "4.91.4",
-    "@dynamic-labs/logger": "4.91.4",
-    "@dynamic-labs/message-transport": "4.91.4",
-    "@dynamic-labs/webview-messages": "4.91.4"
+    "@dynamic-labs/assert-package-version": "4.91.6",
+    "@dynamic-labs/client": "4.91.6",
+    "@dynamic-labs/logger": "4.91.6",
+    "@dynamic-labs/message-transport": "4.91.6",
+    "@dynamic-labs/webview-messages": "4.91.6"
   },
   "peerDependencies": {
     "react": ">=18.0.0 <20.0.0",