@scalebun/react-native 1.10.6 → 1.11.0

package/lib/commonjs/features/ota/signature.js

@@ -6,6 +6,8 @@ Object.defineProperty(exports, "__esModule", {
 exports._resetSignatureWarnings = _resetSignatureWarnings;
 exports.verifyBundleSignature = verifyBundleSignature;
 var _internalLogger = require("../../core/logger/internalLogger");
+var _builtinVerifier = require("./crypto/builtinVerifier");
+var _nativeVerifier = require("./crypto/nativeVerifier");
 /**
  * Bundle signature verification (OTA-03).
  *
@@ -19,10 +21,17 @@ var _internalLogger = require("../../core/logger/internalLogger");
  * download and nothing else. On a platform whose entire purpose is remote code
  * delivery, that is the control that matters most.
  *
- * WHY IT IS SHAPED LIKE THIS. The SDK ships zero third-party runtime
- * dependencies, and React Native has no built-in ed25519. So verification is
- * delegated to a host-provided verifier when one is installed, and the SDK's job
- * is to decide — unambiguously — what happens when there is not one.
+ * WHY IT IS SHAPED LIKE THIS. React Native has no built-in ed25519, so the
+ * verification primitive has to come from somewhere. It is resolved in order:
+ * a host-supplied verifier, else the built-in one assembled from the OPTIONAL
+ * `@noble/ed25519` + `@noble/hashes` peers, else nothing — and the SDK's job is
+ * to decide, unambiguously, what happens in that last case.
+ *
+ * The built-in path exists because requiring every adopter to hand-write a
+ * verifier put the most security-critical operation in the product in code the
+ * SDK could neither test nor audit, and made a routine dependency bump able to
+ * silently stop all updates. See `crypto/builtinVerifier.ts`. Signing stays
+ * opt-in, and apps that never adopt it carry no curve arithmetic.
  *
  * THE POLICY, which is the important part:
  *
@@ -52,10 +61,16 @@ let warnedNotConfigured = false;
  * different operational events and must not collapse into one.
  */
 async function verifyBundleSignature(bundleSha256, signature, config) {
-  const publicKey = config?.publicKey;
+  const rawKey = config?.publicKey;
+
+  // Normalize to a list. A single non-empty string is the pre-rotation config
+  // shape and behaves exactly as before; an array pins several keys at once.
+  const keys = (Array.isArray(rawKey) ? rawKey : rawKey ? [rawKey] : []).filter(k => typeof k === 'string' && k.trim().length > 0);
 
-  // Signing not adopted by this app — nothing to enforce.
-  if (!publicKey) {
+  // Signing not adopted by this app — nothing to enforce. Parity note: a
+  // falsy single value (undefined, '') has always meant "not configured" and
+  // still does.
+  if (rawKey === undefined || rawKey === '' || rawKey === null) {
     if (!warnedNotConfigured) {
       warnedNotConfigured = true;
       _internalLogger.logger.warn('[OTA] No signing public key configured — bundles are accepted on SHA-256 ' + 'integrity alone. Configure `ota.publicSigningKey` to enforce authenticity.');
@@ -66,6 +81,19 @@ async function verifyBundleSignature(bundleSha256, signature, config) {
     };
   }
 
+  // The host PROVIDED a key config that resolves to zero usable keys — an
+  // empty array, or an array of blank strings. That is a broken attempt to
+  // enable signing, not an absence of one, and the two must not collapse:
+  // treating `publicSigningKeys: []` as "not configured" would let a config
+  // mistake silently downgrade an app to unverified installs. Fail closed.
+  if (keys.length === 0) {
+    _internalLogger.logger.error('[OTA] Signing key config resolves to zero usable keys (empty array or blank ' + 'strings) — refusing to stage. Remove the config to disable signing, or pin ' + 'at least one real key.');
+    return {
+      ok: false,
+      reason: 'no_keys'
+    };
+  }
+
   // The app opted in, so a bundle without a signature is a refusal, not a pass.
   if (!signature) {
     _internalLogger.logger.error('[OTA] Bundle has no signature but a signing key is configured — refusing to stage.');
@@ -74,38 +102,70 @@ async function verifyBundleSignature(bundleSha256, signature, config) {
       reason: 'missing_signature'
     };
   }
-  if (typeof config?.verifier !== 'function') {
-    _internalLogger.logger.error('[OTA] A signing key is configured but no signature verifier is available — ' + 'refusing to stage. Provide `ota.verifySignature` so signatures can be checked.');
+
+  // Resolution order, and the order matters:
+  //   1. A host-supplied verifier ALWAYS wins. A team with its own crypto
+  //      policy must be able to override whatever the SDK would otherwise pick.
+  //   2. Otherwise the NATIVE verifier (CryptoKit / Android 13+ platform
+  //      ed25519). Preferred over the JS one because it runs outside the
+  //      bundle it protects and needs no optional peers; on OS levels without
+  //      ed25519 it delegates to the builtin internally.
+  //   3. Otherwise the built-in @noble verifier, if the optional peers are
+  //      installed. This is the path that removes ~100 lines of hand-written
+  //      crypto plumbing from every app that adopts signing.
+  //   4. Otherwise reject, because a configured key is a request for
+  //      enforcement and quietly installing unverified code would turn a
+  //      security feature into a placebo.
+  const verifier = typeof config?.verifier === 'function' ? config.verifier : (0, _nativeVerifier.getNativeVerifier)() ?? (0, _builtinVerifier.getBuiltinVerifier)();
+  if (!verifier) {
+    _internalLogger.logger.error('[OTA] A signing key is configured but no signature verifier is available — ' + 'refusing to stage. Either install the optional peers ' + '`@noble/ed25519` and `@noble/hashes` (the SDK then verifies with no ' + 'further code), or provide your own `ota.verifySignature`.');
     return {
       ok: false,
       reason: 'no_verifier'
     };
   }
-  try {
-    const valid = await config.verifier({
-      messageHex: bundleSha256,
-      signature,
-      publicKey
-    });
-    if (!valid) {
-      _internalLogger.logger.error('[OTA] Bundle signature is INVALID — refusing to stage.');
-      return {
-        ok: false,
-        reason: 'invalid_signature'
+
+  // Try every pinned key; any single match accepts. The verifier contract is
+  // unchanged (one key per call) so host-supplied verifiers keep working.
+  //
+  // Outcome labelling when nothing matched, and why it matters: if at least
+  // one verifier call RAN TO COMPLETION and said no, the bundle failed
+  // verification — 'invalid_signature'. Only when EVERY call threw is the
+  // machinery itself suspect — 'verifier_threw'. Collapsing those (e.g. by
+  // letting the last key's throw win) would point an investigation at the
+  // host's verifier when the actual event was a forged bundle, or vice versa.
+  let sawThrow = false;
+  let sawCompletion = false;
+  for (const key of keys) {
+    try {
+      const valid = await verifier({
+        messageHex: bundleSha256,
+        signature,
+        publicKey: key
+      });
+      sawCompletion = true;
+      if (valid) return {
+        ok: true,
+        reason: 'verified'
       };
+    } catch (err) {
+      // A throwing verifier is treated as a failed verification for this key,
+      // never as a pass — but the remaining keys still get their chance.
+      sawThrow = true;
+      _internalLogger.logger.error(`[OTA] Signature verifier threw: ${err?.message ?? err}`);
     }
-    return {
-      ok: true,
-      reason: 'verified'
-    };
-  } catch (err) {
-    // A throwing verifier is treated as a failed verification, never as a pass.
-    _internalLogger.logger.error(`[OTA] Signature verifier threw: ${err?.message ?? err}`);
+  }
+  if (sawThrow && !sawCompletion) {
     return {
       ok: false,
       reason: 'verifier_threw'
     };
   }
+  _internalLogger.logger.error(keys.length > 1 ? `[OTA] Bundle signature is INVALID under all ${keys.length} pinned keys — refusing to stage.` : '[OTA] Bundle signature is INVALID — refusing to stage.');
+  return {
+    ok: false,
+    reason: 'invalid_signature'
+  };
 }
 
 /** Test seam — resets the once-per-process "not configured" warning. */

package/lib/commonjs/features/session/JourneyEventPipeline.js

@@ -70,26 +70,27 @@ class JourneyEventPipeline {
   emit(type, opts) {
     try {
       const key = `${type}:${opts?.subtype ?? ''}`;
-      const now = Date.now();
-      if (key === this.lastEventKey && now - this.lastEventTs < this.config.dedupeWindowMs) {
+      const receivedAt = Date.now();
+      const occurredAt = opts?.timestamp ?? receivedAt;
+      if (key === this.lastEventKey && receivedAt - this.lastEventTs < this.config.dedupeWindowMs) {
         // Within dedup window — allow high-confidence native events to
         // REPLACE a prior low-confidence JS event for the same gesture.
         // This prevents the race where JS fires first and the pipeline
         // drops the native event that has more accurate coordinates.
         const incomingConfidence = opts?.payload?.confidence;
         if (incomingConfidence === 'high' && this.lastEventConfidence !== 'high') {
-          this._replaceLastEvent(key, now, opts);
+          this._replaceLastEvent(key, receivedAt, opts);
         }
         return null;
       }
       this.lastEventKey = key;
-      this.lastEventTs = now;
+      this.lastEventTs = receivedAt;
       this.lastEventConfidence = opts?.payload?.confidence ?? null;
       const event = {
         eventId: generateEventId(),
         sessionId: this.sessionId,
         journeyId: opts?.journeyId,
-        ts: now,
+        ts: occurredAt,
         type,
         subtype: opts?.subtype,
         severity: opts?.severity ?? inferSeverity(type),

package/lib/commonjs/features/session/SessionManager.js

@@ -17,6 +17,8 @@ var _bridgeAdapter = require("../replay/bridge/adapters/bridgeAdapter");
 var _redaction = require("../../debug/redaction");
 var _calibrationContext = require("../journey/calibrationContext");
 var _device = require("../../core/context/device");
+var _automaticEvents = require("../../analytics/automaticEvents");
+var _interactionProtocol = require("../journey/interactionProtocol");
 /**
  * ScaleBun SDK — Session Manager
  *
@@ -35,12 +37,6 @@ var _device = require("../../core/context/device");
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 
-/**
- * Max analytics-lane heatmap interactions emitted per foreground (analytics
- * session) window. Bounds ingest volume now that capture defaults ON; enough to
- * resolve hotspot density, the long tail is dropped (drop-newest beyond cap).
- */
-const HEATMAP_MAX_INTERACTIONS_PER_WINDOW = 200;
 // ─── Singleton ──────────────────────────────────────────────────────────────
 
 let _instance = null;
@@ -56,15 +52,6 @@ class SessionManager {
    * lane even when no replay recording is active. Additive, opt-in (default off).
    */
   _captureInteractionHeatmap = false;
-  /**
-   * Sampling cap for the analytics-lane heatmap emission. Now that capture is
-   * ON by default, an unbounded one-event-per-gesture stream could materially
-   * inflate ingest volume. We cap emitted interactions per analytics-session
-   * window (finalize-scoped per foreground): the first N gestures define the
-   * hotspot shape; the long tail is dropped. Resets when the window changes.
-   */
-  _heatmapWindowSessionId = null;
-  _heatmapWindowCount = 0;
   session = null;
   active = false;
   timeoutTimer = null;
@@ -666,21 +653,11 @@ class SessionManager {
    *     injected sensitive keys (e.g. a label) are stripped before transport.
    *   - Never throws.
    */
-  _emitInteractionToAnalytics(gestureType, payload) {
-    if (!this._captureInteractionHeatmap) return;
-    if (this.active) return; // recording lane already carries this tap
+  _emitInteractionToAnalytics(gestureType, payload, occurredAt, screenName) {
+    if (!this._captureInteractionHeatmap) return false;
+    if (this.active) return false; // recording lane already carries this tap
     const adapter = this._backendTransport;
-    if (!adapter) return;
-
-    // Per-foreground sampling cap. Reset the counter when the analytics
-    // session window rolls over, then drop anything past the cap.
-    const windowId = adapter.analyticsSessionId ?? '';
-    if (windowId !== this._heatmapWindowSessionId) {
-      this._heatmapWindowSessionId = windowId;
-      this._heatmapWindowCount = 0;
-    }
-    if (this._heatmapWindowCount >= HEATMAP_MAX_INTERACTIONS_PER_WINDOW) return;
-    this._heatmapWindowCount++;
+    if (!adapter) return false;
     try {
       // Normalize coords in place (same logic as the recording lane).
       this._normalizeInteractionPayload(payload);
@@ -707,16 +684,18 @@ class SessionManager {
         eventId: (0, _sessionId.generateEventId)(),
         // sessionId is (re)stamped by the analytics lane at flush time.
         sessionId: adapter.analyticsSessionId ?? '',
-        ts: Date.now(),
+        ts: occurredAt,
         type: 'USER_ACTION',
         subtype: `gesture:${gestureType}`,
-        screen: this._lastKnownScreen ?? undefined,
+        screen: screenName ?? this._lastKnownScreen ?? undefined,
         payload: safePayload,
         source: 'user'
       };
       adapter.trackEvent(event);
+      return true;
     } catch (err) {
       _internalLogger.logger.error('[SessionManager] heatmap analytics emit failed:', err);
+      return false;
     }
   }
 
@@ -936,13 +915,14 @@ class SessionManager {
    * Notify of a user interaction. Called by ScaleBunDebugRoot touch handlers.
    * Also triggers frame capture for desktop-initiated recordings.
    */
-  onUserAction(subtype, payload) {
+  onUserAction(subtype, payload, context) {
     if (!this.active) return; // Defense-in-depth: no emission when recording is OFF
     this.emitEvent('USER_ACTION', {
       subtype,
-      screen: this._lastKnownScreen ?? undefined,
+      screen: context?.screen ?? this._lastKnownScreen ?? undefined,
       payload,
-      source: 'user'
+      source: 'user',
+      timestamp: context?.timestamp
     });
     // NOTE: Do NOT call captureManager.onInteraction() here.
     // emitEvent() already triggers onInteraction() for USER_ACTION events (line ~405).
@@ -957,7 +937,8 @@ class SessionManager {
     // Exact-duplicate suppression — see _lastGestureSig. Signature is the gesture type plus
     // raw coordinates verbatim; String() keeps undefined coords distinct from 0 (a payload
     // with no coords never collides with a real origin tap).
-    const dedupSig = `${gestureType}|${String(details?.x)}|${String(details?.y)}|${String(details?.endX)}|${String(details?.endY)}`;
+    const suppliedInteractionId = details?.interactionId;
+    const dedupSig = suppliedInteractionId ? `id:${suppliedInteractionId}` : `${gestureType}|${String(details?.x)}|${String(details?.y)}|${String(details?.endX)}|${String(details?.endY)}`;
     const nowTs = Date.now();
     if (dedupSig === this._lastGestureSig && nowTs - this._lastGestureTs <= SessionManager.GESTURE_DEDUP_WINDOW_MS) {
       this._lastGestureTs = nowTs; // a burst of 3 stays suppressed even if gaps chain past the window
@@ -969,7 +950,15 @@ class SessionManager {
     // Build the canonical gesture payload ONCE so the recording lane and the
     // (additive) analytics lane carry byte-identical keys (normalizedX/Y,
     // gestureType, etc.). Same object shape that was previously inlined.
+    const interactionId = suppliedInteractionId ?? (0, _interactionProtocol.generateInteractionId)();
+    const occurredAt = details?.occurredAt ?? Date.now();
+    const stateStatus = details?.stateStatus ?? (details?.ui ? 'captured_nonempty' : 'not_captured');
     const payload = {
+      interaction_id: interactionId,
+      interaction_protocol: details?.interactionProtocol ?? _interactionProtocol.INTERACTION_PROTOCOL_VERSION,
+      state_status: stateStatus,
+      ui: details?.ui,
+      target_id: details?.targetId,
       gestureType,
       x: details?.x,
       y: details?.y,
@@ -1014,9 +1003,16 @@ class SessionManager {
     // when the flag is OFF, no backend transport is attached, or recording is
     // active (the recording path below already carries this tap). Uses a fresh
     // payload clone so analytics normalization never mutates the recording one.
-    this._emitInteractionToAnalytics(gestureType, {
+    const analyticsReplayCarrier = this._emitInteractionToAnalytics(gestureType, {
       ...payload
-    });
+    }, occurredAt, details?.screenName);
+    const replayCarrier = !!this._backendTransport && (this.active || analyticsReplayCarrier);
+    if (details?.emitAutomaticAnalytics) {
+      try {
+        const safePayload = (0, _redaction.redactBody)(payload);
+        (0, _automaticEvents.emitAutomaticEvent)('element_interacted', (0, _interactionProtocol.automaticInteractionProperties)(safePayload, details?.screenName ?? this._lastKnownScreen ?? undefined, replayCarrier), occurredAt);
+      } catch {/* automatic projection must never affect interaction capture */}
+    }
     if (!this.active) return; // Defense-in-depth: no emission when recording is OFF
     // The subtype becomes `ReplayEvent.label`, which is what the Events explorer GROUPS BY. Naming
     // the tapped control here is what splits taps per control instead of collapsing every tap in the
@@ -1026,7 +1022,10 @@ class SessionManager {
     // ⚠️ `gestureType` also travels in the payload, and the backend's `resolveGesture` reads THAT
     // first — so enriching the label cannot change heatmap gesture classification.
     const target = typeof details?.target === 'string' ? details.target.trim() : '';
-    this.onUserAction(target ? `gesture:${gestureType} · ${target}` : `gesture:${gestureType}`, payload);
+    this.onUserAction(target ? `gesture:${gestureType} · ${target}` : `gesture:${gestureType}`, payload, {
+      screen: details?.screenName,
+      timestamp: occurredAt
+    });
   }
 
   /**

package/lib/commonjs/metro/serializerCompose.js

@@ -83,6 +83,9 @@ function discoverArtifacts(packageRoot) {
   return out;
 }
 
+/** One-shot guard so an Expo build does not print the pass-through notice per bundle. */
+let warnedUnknownShape = false;
+
 /**
  * Build the composing serializer. `hostSerializer` is the app's own customSerializer, if any.
  */
@@ -94,6 +97,35 @@ function createComposingSerializer(artifacts, internals, hostSerializer) {
       const hostResult = await hostSerializer(entryPoint, preModules, graph, options);
       if (typeof hostResult === 'string') {
         code = hostResult;
+      } else if (hostResult && typeof hostResult.code !== 'string') {
+        /**
+         * A shape this wrapper does not understand — pass it back UNTOUCHED.
+         *
+         * Expo is the case that matters. `expo/metro-config` installs a
+         * serializer returning `{ artifacts: [...] }`, a multi-artifact
+         * shape with no top-level `code`. Reading `.code` off it yielded
+         * undefined, and returning `{ code: undefined, map }` made every
+         * `expo export:embed` die with:
+         *
+         *   Serializer did not return expected format. The project copy
+         *   of `expo/metro-config` may be out of date.
+         *
+         * — a message that sends you to upgrade Expo, which is not the
+         * problem. The result: `withScaleBun` broke PRODUCTION BUNDLING
+         * FOR EVERY EXPO APP, and the SDK's own marketing test app could
+         * not build. Found by bundling it.
+         *
+         * Passing it through costs ScaleBun's source-map composition on
+         * Expo (OTA stack traces stay mapped to the bundle rather than to
+         * original sources). That is a real loss and strictly better than
+         * a build that cannot run at all. Composing INTO an artifact
+         * array is the follow-up; it must not be guessed at here.
+         */
+        if (!warnedUnknownShape) {
+          warnedUnknownShape = true;
+          console.warn('[ScaleBun/metro] The host serializer returned a shape this SDK does not ' + 'compose (Expo returns { artifacts }). Passing it through unchanged — ' + 'the build is correct, but ScaleBun source-map composition is skipped.');
+        }
+        return hostResult;
       } else {
         code = hostResult.code;
         try {

package/lib/commonjs/public/ScaleBunFacade.js

@@ -215,12 +215,17 @@ class ScaleBunFacade {
   /**
    * Boot the OTA orchestrator when the init config asks for it.
    *
-   * `publicSigningKey` is honoured here so signature enforcement is reachable
-   * from configuration alone. The SDK ships no ed25519 implementation, so a
-   * host that pins a key must also supply `ota.verifySignature`; pinning a key
-   * without a verifier is fail-CLOSED by design (signature.ts) — an update
-   * that cannot be verified is not installed. We say that out loud rather than
-   * letting the app discover it as a silent no-update condition.
+   * `publicSigningKey` / `publicSigningKeys` are honoured here so signature
+   * enforcement is reachable from configuration alone. The list form exists
+   * for key ROTATION: a build pinning [old, new] keeps verifying while the
+   * server moves to the new key, so replacing a key never needs an emergency
+   * store release. Both fields merge (deduplicated) into one pinned set.
+   *
+   * Verification comes from `ota.verifySignature` when supplied, else the
+   * built-in @noble-based verifier (optional peers). Pinning keys with
+   * NEITHER available is fail-CLOSED by design (signature.ts) — an update
+   * that cannot be verified is not installed. We say that out loud rather
+   * than letting the app discover it as a silent no-update condition.
    */
   _maybeStartOta(rawConfig) {
     const ota = rawConfig?.ota;
@@ -232,15 +237,34 @@ class ScaleBunFacade {
       const {
         otaOrchestrator
       } = require('../features/ota/OtaOrchestrator');
-      const publicKey = ota.publicSigningKey;
+      const rawSingle = ota.publicSigningKey;
+      const rawList = ota.publicSigningKeys;
+      const publicKeys = Array.from(new Set([...(typeof rawSingle === 'string' && rawSingle ? [rawSingle] : []), ...(Array.isArray(rawList) ? rawList : [])].filter(k => typeof k === 'string' && k.trim().length > 0)));
+      // Signing was REQUESTED if a usable key exists, or the host passed a
+      // keys array at all — an empty one included. `publicSigningKeys: []`
+      // is a broken attempt to enable signing, and it must flow through to
+      // signature.ts's fail-closed handling, not silently disable signing.
+      const signingRequested = publicKeys.length > 0 || Array.isArray(rawList);
       const verifier = ota.verifySignature;
-      if (publicKey && typeof verifier !== 'function') {
-        _internalLogger.logger.warn('[ScaleBun] ota.publicSigningKey is set but ota.verifySignature is not a function. ' + 'Signature checking is fail-closed: updates will be REJECTED until a verifier is supplied.');
+      if (signingRequested && typeof verifier !== 'function') {
+        // A host verifier is optional since the built-in one landed — the
+        // old unconditional warning here told every correctly-configured
+        // app that its updates would be rejected. Warn only when neither
+        // verifier can actually be resolved.
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const {
+          getBuiltinVerifier
+        } = require('../features/ota/crypto/builtinVerifier');
+        if (!getBuiltinVerifier()) {
+          _internalLogger.logger.warn('[ScaleBun] A signing key is pinned but no signature verifier is available. ' + 'Signature checking is fail-closed: updates will be REJECTED until one exists. ' + 'Install the optional peers `@noble/ed25519` + `@noble/hashes` (no further ' + 'code needed), or supply `ota.verifySignature`.');
+        }
       }
       otaOrchestrator.init({
-        ...(publicKey ? {
+        ...(signingRequested ? {
           signature: {
-            publicKey,
+            // Single key stays a plain string — the shape every
+            // existing consumer and test already handles.
+            publicKey: publicKeys.length === 1 ? publicKeys[0] : publicKeys,
             verifier
           }
         } : {}),
@@ -477,6 +501,45 @@ class ScaleBunFacade {
   }
 
   /** Convenience: emit a Phase 1 purchase event (revenue + currency + transaction_id). */
+  /**
+   * Declare which UI state the user is looking at, so taps are attributed to the surface they
+   * happened on rather than averaged across every variant of the screen.
+   *
+   *     ScaleBun.setUiState('filter-sheet', 'open');
+   *     ScaleBun.setUiState('checkout-step', 'payment');
+   *
+   * Call it when the state CHANGES — the value is read at tap time, so it only has to be right by
+   * the time the next tap lands. On React Native this is the ONLY source of UI state: unlike the web,
+   * there is no queryable accessibility tree that says a sheet is up, and guessing would produce a
+   * state key that is right on some apps and silently wrong on others.
+   *
+   * Names and values are identifiers, not content: they become query keys in the dashboard, so a
+   * person's name or a cart total does not belong in one. `;`, `:` and `|` are stripped and both
+   * halves are capped at 32 characters.
+   */
+  setUiState(name, value) {
+    try {
+      const {
+        setUiState
+      } = require('../features/journey/uiState');
+      setUiState(name, value);
+    } catch {/* no-throw: a state declaration must never break the host */}
+  }
+
+  /**
+   * Stop reporting a UI state dimension — or, with no argument, all of them.
+   *
+   * Clear on screen unmount. A declaration left behind follows the user onto a surface where it means
+   * nothing, and every tap there is filed under a state that was not on screen.
+   */
+  clearUiState(name) {
+    try {
+      const {
+        clearUiState
+      } = require('../features/journey/uiState');
+      clearUiState(name);
+    } catch {/* no-throw */}
+  }
   trackPurchase(input) {
     (0, _crashSafe.noThrow)(() => this._eventTracker?.trackPurchase(input));
   }

package/lib/module/analytics/EventTracker.js

@@ -98,7 +98,7 @@ export class EventTracker {
     this.started = true;
     if (this.cfg.automaticEventTracking) {
       this.automaticEventsUnsubscribe = subscribeAutomaticEvents(event => {
-        this.track(event.name, event.properties);
+        this.track(event.name, event.properties, event.timestamp);
       });
     }
     if (this.cfg.autoLifecycleEvents) {
@@ -221,9 +221,9 @@ export class EventTracker {
 
   // ─── tracking ────────────────────────────────────────────────────────────
 
-  track(eventName, properties) {
+  track(eventName, properties, timestamp) {
     try {
-      this.enqueue(this.buildEnvelope(eventName, properties));
+      this.enqueue(this.buildEnvelope(eventName, properties, timestamp));
       try {
         this.cfg.onEvent?.(eventName);
       } catch {/* no-throw */}
@@ -360,7 +360,7 @@ export class EventTracker {
 
   // ─── internals ─────────────────────────────────────────────────────────────
 
-  buildEnvelope(eventName, properties) {
+  buildEnvelope(eventName, properties, timestamp) {
     const ctx = this.cfg.context ?? {};
     let canonicalSessionId;
     try {
@@ -371,7 +371,7 @@ export class EventTracker {
     const env = {
       event_id: uuid(),
       event_name: eventName,
-      event_time: Date.now(),
+      event_time: timestamp ?? Date.now(),
       app_id: this.cfg.appId,
       platform: this.cfg.platform ?? resolveEventPlatform(),
       installation_id: this.installationId,

package/lib/module/analytics/automaticEvents.js

@@ -19,10 +19,11 @@ function compactProperties(properties) {
   }
   return out;
 }
-export function emitAutomaticEvent(name, properties) {
+export function emitAutomaticEvent(name, properties, timestamp) {
   const event = {
     name,
-    properties: compactProperties(properties)
+    properties: compactProperties(properties),
+    timestamp
   };
   if (listeners.size === 0) {
     pending.push(event);

package/lib/module/core/config/schema.js

@@ -289,6 +289,14 @@ const SHAPE = {
         kind: 'str',
         opt: true
       },
+      // Rotation support: several pinned keys, any of which may verify a
+      // bundle. Ship a build pinning [old, new], re-sign server-side with
+      // new, drop old next release — no emergency store submission when a
+      // key must be replaced. Merged with publicSigningKey by the facade.
+      publicSigningKeys: {
+        kind: 'strArr',
+        opt: true
+      },
       mandatoryBlocksUi: bool(false)
     }
   }
@@ -328,7 +336,7 @@ function parseField(field, input, path, issues) {
       present: true
     };
     // Required with no default (matches the base schemas' type errors on undefined).
-    return fail(field.kind === 'bool' ? 'Expected boolean, received undefined' : field.kind === 'num' ? 'Expected number, received undefined' : field.kind === 'str' ? 'Expected string, received undefined' : field.kind === 'enum' ? "Invalid enum value. Expected " + field.values.map(v => `'${v}'`).join(' | ') : 'Expected object, received undefined');
+    return fail(field.kind === 'bool' ? 'Expected boolean, received undefined' : field.kind === 'num' ? 'Expected number, received undefined' : field.kind === 'str' ? 'Expected string, received undefined' : field.kind === 'strArr' ? 'Expected array, received undefined' : field.kind === 'enum' ? "Invalid enum value. Expected " + field.values.map(v => `'${v}'`).join(' | ') : 'Expected object, received undefined');
   }
   switch (field.kind) {
     case 'any':
@@ -354,6 +362,31 @@ function parseField(field, input, path, issues) {
         value: input,
         present: true
       };
+    case 'strArr':
+      {
+        // Mirrors the vendored ArraySchema exactly: element failures are
+        // reported at their index and fail the whole field (no partial
+        // arrays reach the output).
+        if (!Array.isArray(input)) return fail(`Expected array, received ${typeofName(input)}`);
+        let allOk = true;
+        for (let i = 0; i < input.length; i++) {
+          if (typeof input[i] !== 'string') {
+            issues.push({
+              path: [...path, i],
+              message: `Expected string, received ${typeofName(input[i])}`
+            });
+            allOk = false;
+          }
+        }
+        return allOk ? {
+          ok: true,
+          value: [...input],
+          present: true
+        } : {
+          ok: false,
+          present: true
+        };
+      }
     case 'num':
       if (typeof input !== 'number' || Number.isNaN(input)) {
         return fail(`Expected number, received ${typeofName(input)}`);

package/lib/module/core/constants/version.js

@@ -1,7 +1,12 @@
 /**
  * ScaleBun SDK version. Sent with the session-start envelope so the dashboard
  * can attribute telemetry to the SDK build that produced it.
- * Keep in sync with package.json "version".
+ * Keep in sync with package.json "version" — `version.test.ts` fails when they drift.
+ *
+ * Why the test matters: the 1.11.0 bump missed this line, so the build would have reported itself as
+ * 1.10.6. Every "is the release live, and on what share of traffic" question is answered from this
+ * value, so a stale one makes a rollout unobservable — which is the exact problem sending an SDK
+ * version was introduced to solve.
  */
-export const SDK_VERSION = '1.10.6';
+export const SDK_VERSION = '1.11.0';
 //# sourceMappingURL=version.js.map