@scalebun/react-native 1.11.1 → 2.0.0

package/lib/module/features/ota/OtaOrchestrator.js

@@ -6,7 +6,6 @@ import { otaEventEmitter } from './OtaEventEmitter';
 import { getDeviceCountry, prefetchDeviceCountry } from './geoCountry';
 import { deviceTargetingAttributes } from './deviceAttributes';
 import { resolveInstallationId } from '../../core/id/installationId';
-import { verifyBundleSignature } from './signature';
 import { detectOtaEnvironment } from './environment';
 import { retryWithBackoff, isRetryableNetworkError, HttpStatusError } from './retry';
 import { createStorageBackend } from '../../storage/StorageBackend';
@@ -149,9 +148,10 @@ export class OtaOrchestrator {
   /**
    * Initialize the orchestrator. Checks for boot-guard recovery state.
    *
-   * `signature` is optional: an app that has not adopted signing keeps working
-   * on SHA-256 integrity alone. Once a public key IS configured, a bundle that
-   * cannot be verified is refused rather than installed (OTA-03).
+   * Signature enforcement is no longer a JS concern: signed releases are
+   * verified and staged in NATIVE code against RSA keys embedded in the app
+   * package (SB-OTA-RSA-SHA256-V1), and unsigned releases keep working on
+   * SHA-256 integrity alone. There is nothing for the host to configure here.
    */
   init(config) {
     noThrow(() => {
@@ -164,7 +164,6 @@ export class OtaOrchestrator {
       // them. Config is still refreshed so late signature setup works.
       if (this.initialized) {
         this.bootGuardConfig = config ?? this.bootGuardConfig;
-        this.signatureConfig = config?.signature ?? this.signatureConfig;
         return;
       }
       if (!NativeScaleBunOta) {
@@ -199,7 +198,6 @@ export class OtaOrchestrator {
       this.initialized = true;
       this.enabled = true;
       this.bootGuardConfig = config ?? {};
-      this.signatureConfig = config?.signature;
       __DEV__ && logger.debug(`[OTA] Orchestrator initialized (RN ${this.environment.rnVersionString ?? 'unknown'}` + `${this.environment.bridgeless ? ', bridgeless' : ''}` + `${this.environment.hermes ? `, Hermes HBC v${this.environment.hermesBytecodeVersion ?? '?'}` : ''})`);
 
       // ONE read of the slot state, shared by both boot-time consumers.
@@ -479,12 +477,27 @@ export class OtaOrchestrator {
       // OTA has no bundle for a non-mobile target; claiming Android there would install the wrong one.
       const mobileOS = resolveMobileOS();
       if (!mobileOS) throw new Error('OTA is not supported on this platform');
+      // SDK trust coverage (CICDPAGE §12): report which trusted key IDs are
+      // embedded in this binary so the dashboard can measure key-rotation
+      // adoption. Telemetry only — the server never trusts a key a device claims.
+      // Defensive: optional native method, never let it break a check.
+      let trustedKeyIds;
+      try {
+        const raw = NativeScaleBunOta?.getTrustedKeyIds?.();
+        if (raw) {
+          const arr = JSON.parse(raw);
+          if (Array.isArray(arr) && arr.length) trustedKeyIds = arr.slice(0, 16);
+        }
+      } catch {
+        /* trust reporting is best-effort — never break the update check */
+      }
       const payload = {
         appVersion: requestParams.appVersion,
         platform: mobileOS,
         installationId: requestParams.installationId,
         currentBundleId: this.currentBundle?.id,
         currentBundleHash: this.currentBundle?.sha256,
+        trustedKeyIds,
         channelName: requestParams.channelName,
         // Host-supplied country wins; otherwise the cached edge-Worker lookup
         // fills in (see geoCountry.ts). Undefined when neither knows — the
@@ -618,25 +631,12 @@ export class OtaOrchestrator {
         version: bundle.version
       });
 
-      // ── VERIFY AUTHENTICITY (OTA-03) ─────────────────────────────────────
-      // Before anything touches the disk. SHA-256 proves the bytes arrived
-      // intact; only the signature proves they came from you. Checking after
-      // staging would mean writing unverified code to the slot directory first.
-      const signatureOutcome = await verifyBundleSignature(bundle.sha256, bundle.signature, this.signatureConfig);
-      if (!signatureOutcome.ok) {
-        otaEventEmitter.emitSimple('APPLY_FAILED', bundle.id, {
-          releaseId: bundle.releaseId,
-          error: `Signature check failed: ${signatureOutcome.reason}`,
-          version: bundle.version
-        });
-        return {
-          status: 'ERROR',
-          error: `Bundle signature check failed (${signatureOutcome.reason})`,
-          bundle
-        };
-      }
-
       // ── DOWNLOAD ─────────────────────────────────────────────────────────
+      // Authenticity is enforced NATIVELY now (see the envelope branch below):
+      // SHA-256 proves the bytes arrived intact, and for signed releases the
+      // RSA signature — checked in native code against keys embedded in the app
+      // package — proves they came from you. JS neither pins keys nor verifies
+      // signatures.
       otaEventEmitter.emitSimple('DOWNLOAD_STARTED', bundle.id, {
         releaseId: bundle.releaseId,
         version: bundle.version
@@ -690,46 +690,94 @@ export class OtaOrchestrator {
         }
       });
       let staged = false;
-
-      // Sprint 7: Try patch first if offered, fall back to full bundle
-      if (bundle.patch && NativeScaleBunOta.stagePatch) {
-        __DEV__ && logger.debug(`[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ` + `${(bundle.size / 1024).toFixed(0)} KB full) — trying patch…`);
+      if (bundle.envelope) {
+        // ── NATIVE-ENFORCED VERIFY + STAGE (SB-OTA-RSA-SHA256-V1) ───────────
+        // Hand the whole envelope to native code, which verifies the RSA
+        // signature against the keys EMBEDDED in the app package, then downloads
+        // the artifact, enforces the SIGNED size + SHA-256, and stages it into
+        // the `next` slot — all outside JS. JavaScript never stages bytes it has
+        // not proven authentic. No patch path here: a signed offer is always a
+        // full verified download (native patch is a documented follow-up).
+        const envelopeJson = JSON.stringify({
+          ...bundle.envelope,
+          downloadUrl: bundle.url
+        });
+        let verdict;
         try {
-          staged = await NativeScaleBunOta.stagePatch(bundle.patch.url, bundle.patch.sha256, bundle.sha256 // expected full-bundle hash after patching
-          );
-          if (staged) {
-            patchUsed = true;
-            __DEV__ && logger.debug('[OTA] Patch applied successfully');
-          } else {
-            logger.warn('[OTA] Patch staging returned false — falling back to full bundle');
+          const verdictJson = await NativeScaleBunOta.verifyAndStageRelease(envelopeJson);
+          verdict = JSON.parse(verdictJson);
+        } catch (err) {
+          // A rejected promise (or an unparseable verdict) is machinery failure,
+          // never a valid result — treat it as a hard failure.
+          verdict = {
+            ok: false,
+            code: 'verify_stage_threw',
+            message: err?.message ?? String(err)
+          };
+        }
+        if (!verdict.ok) {
+          unsubscribeProgress();
+          postProgress(0, 'FAILED');
+          logger.error(`[OTA] Native verify/stage refused the release: ${verdict.code ?? 'unknown'}` + `${verdict.message ? ` — ${verdict.message}` : ''}`);
+          otaEventEmitter.emitSimple('APPLY_FAILED', bundle.id, {
+            releaseId: bundle.releaseId,
+            // `error` is mapped onto the wire `errorCode` by deliverOtaEvents —
+            // carry the stable native verdict code there.
+            error: verdict.code ?? 'verify_and_stage_release_failed',
+            version: bundle.version
+          });
+          return {
+            status: 'ERROR',
+            error: `Release verification failed (${verdict.code ?? 'unknown'})`,
+            bundle
+          };
+        }
+        staged = true;
+      } else {
+        // ── LEGACY / UNSIGNED (SHA-256 integrity only) ─────────────────────
+        // No envelope means the app embeds no trusted keys and the release is
+        // unsigned: keep the pre-RSA behaviour so those apps still update.
+
+        // Sprint 7: Try patch first if offered, fall back to full bundle
+        if (bundle.patch && NativeScaleBunOta.stagePatch) {
+          __DEV__ && logger.debug(`[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ` + `${(bundle.size / 1024).toFixed(0)} KB full) — trying patch…`);
+          try {
+            staged = await NativeScaleBunOta.stagePatch(bundle.patch.url, bundle.patch.sha256, bundle.sha256 // expected full-bundle hash after patching
+            );
+            if (staged) {
+              patchUsed = true;
+              __DEV__ && logger.debug('[OTA] Patch applied successfully');
+            } else {
+              logger.warn('[OTA] Patch staging returned false — falling back to full bundle');
+            }
+          } catch (patchErr) {
+            logger.warn(`[OTA] Patch staging failed: ${patchErr.message} — falling back to full bundle`);
           }
-        } catch (patchErr) {
-          logger.warn(`[OTA] Patch staging failed: ${patchErr.message} — falling back to full bundle`);
         }
-      }
 
-      // Full-bundle fallback (or primary path when no patch is available).
-      // Retried with backoff: on a mobile network a transient drop mid-download
-      // is the common case, and previously one failure meant waiting for the
-      // next cold start — often hours away, sometimes never.
-      if (!staged) {
-        try {
-          staged = await retryWithBackoff(async () => {
-            const ok = await NativeScaleBunOta.stageBundle(bundle.url, bundle.sha256);
-            if (!ok) {
-              // Native returns a bare boolean, so a hash mismatch and a
-              // dropped connection are indistinguishable here. Retrying a
-              // genuine mismatch a couple of times is cheap; not retrying a
-              // dropped connection costs the whole update.
-              throw new Error('stageBundle returned false');
-            }
-            return ok;
-          }, {
-            label: `download v${bundle.version}`,
-            attempts: 3
-          });
-        } catch {
-          staged = false;
+        // Full-bundle fallback (or primary path when no patch is available).
+        // Retried with backoff: on a mobile network a transient drop mid-download
+        // is the common case, and previously one failure meant waiting for the
+        // next cold start — often hours away, sometimes never.
+        if (!staged) {
+          try {
+            staged = await retryWithBackoff(async () => {
+              const ok = await NativeScaleBunOta.stageBundle(bundle.url, bundle.sha256);
+              if (!ok) {
+                // Native returns a bare boolean, so a hash mismatch and a
+                // dropped connection are indistinguishable here. Retrying a
+                // genuine mismatch a couple of times is cheap; not retrying a
+                // dropped connection costs the whole update.
+                throw new Error('stageBundle returned false');
+              }
+              return ok;
+            }, {
+              label: `download v${bundle.version}`,
+              attempts: 3
+            });
+          } catch {
+            staged = false;
+          }
         }
       }
       unsubscribeProgress();

package/lib/module/public/ScaleBunFacade.js

@@ -209,17 +209,11 @@ class ScaleBunFacade {
   /**
    * Boot the OTA orchestrator when the init config asks for it.
    *
-   * `publicSigningKey` / `publicSigningKeys` are honoured here so signature
-   * enforcement is reachable from configuration alone. The list form exists
-   * for key ROTATION: a build pinning [old, new] keeps verifying while the
-   * server moves to the new key, so replacing a key never needs an emergency
-   * store release. Both fields merge (deduplicated) into one pinned set.
-   *
-   * Verification comes from `ota.verifySignature` when supplied, else the
-   * built-in @noble-based verifier (optional peers). Pinning keys with
-   * NEITHER available is fail-CLOSED by design (signature.ts) — an update
-   * that cannot be verified is not installed. We say that out loud rather
-   * than letting the app discover it as a silent no-update condition.
+   * Signature enforcement is no longer configured from JS. Signed releases are
+   * verified and staged in NATIVE code against RSA keys embedded in the app
+   * package (SB-OTA-RSA-SHA256-V1); unsigned releases keep working on SHA-256
+   * integrity. There are no signing-key or `verifySignature` options to pass
+   * through — the host embeds its trusted keys natively.
    */
   _maybeStartOta(rawConfig) {
     const ota = rawConfig?.ota;
@@ -231,42 +225,12 @@ class ScaleBunFacade {
       const {
         otaOrchestrator
       } = require('../features/ota/OtaOrchestrator');
-      const rawSingle = ota.publicSigningKey;
-      const rawList = ota.publicSigningKeys;
-      const publicKeys = Array.from(new Set([...(typeof rawSingle === 'string' && rawSingle ? [rawSingle] : []), ...(Array.isArray(rawList) ? rawList : [])].filter(k => typeof k === 'string' && k.trim().length > 0)));
-      // Signing was REQUESTED if a usable key exists, or the host passed a
-      // keys array at all — an empty one included. `publicSigningKeys: []`
-      // is a broken attempt to enable signing, and it must flow through to
-      // signature.ts's fail-closed handling, not silently disable signing.
-      const signingRequested = publicKeys.length > 0 || Array.isArray(rawList);
-      const verifier = ota.verifySignature;
-      if (signingRequested && typeof verifier !== 'function') {
-        // A host verifier is optional since the built-in one landed — the
-        // old unconditional warning here told every correctly-configured
-        // app that its updates would be rejected. Warn only when neither
-        // verifier can actually be resolved.
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const {
-          getBuiltinVerifier
-        } = require('../features/ota/crypto/builtinVerifier');
-        if (!getBuiltinVerifier()) {
-          logger.warn('[ScaleBun] A signing key is pinned but no signature verifier is available. ' + 'Signature checking is fail-closed: updates will be REJECTED until one exists. ' + 'Install the optional peers `@noble/ed25519` + `@noble/hashes` (no further ' + 'code needed), or supply `ota.verifySignature`.');
-        }
-      }
       // `healthyAfterMs` is the field BootGuardConfig actually declares.
       // This passed `healthyTimeoutMs`, which nothing reads, so a host that
       // tuned the boot-guard window silently got the 10s default instead.
       // Both spellings are accepted so the older one keeps working.
       const healthyAfterMs = typeof ota.healthyAfterMs === 'number' ? ota.healthyAfterMs : typeof ota.healthyTimeoutMs === 'number' ? ota.healthyTimeoutMs : undefined;
       otaOrchestrator.init({
-        ...(signingRequested ? {
-          signature: {
-            // Single key stays a plain string — the shape every
-            // existing consumer and test already handles.
-            publicKey: publicKeys.length === 1 ? publicKeys[0] : publicKeys,
-            verifier
-          }
-        } : {}),
         ...(healthyAfterMs !== undefined ? {
           healthyAfterMs
         } : {})

package/lib/typescript/core/config/schema.d.ts

@@ -92,9 +92,6 @@ export interface ScaleBunConfig {
         enabled: boolean;
         checkOnForeground: boolean;
         channelOverride?: string;
-        publicSigningKey?: string;
-        /** Additional pinned keys for rotation; unioned with publicSigningKey. */
-        publicSigningKeys?: string[];
         mandatoryBlocksUi: boolean;
     };
 }

package/lib/typescript/core/constants/version.d.ts

@@ -8,5 +8,5 @@
  * value, so a stale one makes a rollout unobservable — which is the exact problem sending an SDK
  * version was introduced to solve.
  */
-export declare const SDK_VERSION = "1.11.1";
+export declare const SDK_VERSION = "2.0.0";
 //# sourceMappingURL=version.d.ts.map

package/lib/typescript/features/network/index.d.ts

@@ -13,6 +13,24 @@ export interface NetworkMonitoringOptions {
     redactNetwork?: boolean;
     /** SDK backend base URL — used to filter out SDK's own upload calls from capture */
     sdkBaseUrl?: string;
+    /**
+     * Never capture requests whose URL matches (substring or RegExp).
+     *
+     * Parity with the web SDK, which has had this since F-NET. Mobile had no way to exclude a
+     * URL at all, so an app that wanted one endpoint out of its replays had no answer.
+     */
+    denyUrls?: (string | RegExp)[];
+    /**
+     * Keep known telemetry beacons: analytics collectors, ad pixels, IP-enrichment calls.
+     *
+     * Default false — they are dropped before capture. They are not the app, they cost the
+     * device real battery and cellular data to upload, and a beacon that fails counts against
+     * the SESSION HEALTH score. Matching is by hostname only, never by path, so an app route
+     * called /collect is never touched. See features/network/thirdParty.ts.
+     */
+    captureThirdParty?: boolean;
+    /** Replace the built-in beacon host list wholesale. Comma-joined hostname suffixes. */
+    thirdPartyHosts?: string;
 }
 export declare function installNetworkMonitoring(onEvent: (data: any) => void, options?: NetworkMonitoringOptions): void;
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/features/network/thirdParty.d.ts

@@ -0,0 +1,65 @@
+/**
+ * THIRD-PARTY BEACON HOSTS — the one list, and the one matcher, for every layer that drops them.
+ *
+ * WHAT THIS IS FOR
+ * A session on an instrumented site spends most of its network tab on traffic the app did not
+ * meaningfully make: analytics collectors, ad pixels, IP-enrichment calls, tag managers. It is
+ * captured, uploaded, stored and rendered, and none of it answers a question anyone asks a session
+ * replay. One real sign-in screen was 27 requests, most of them beacons.
+ *
+ * It is not only clutter. Session health scores `failedRequests` and `slowRequests`, so a tracker
+ * killed by an ad blocker (a transport error) or one that is simply slow moves a number that is
+ * supposed to describe the APP. That is the part that makes this a correctness fix rather than a
+ * tidy-up.
+ *
+ * WHY HOSTS ONLY, NEVER PATHS
+ * The obvious rules from looking at a network tab are `/collect`, `/p`, `/api/v2/pixel`. Every one
+ * of them is a path that a customer's own API is allowed to have, and dropping a real API call is
+ * far worse than keeping a beacon: the noise is visible and annoying, the missing request is
+ * invisible and misleading. So matching is on the HOSTNAME, with a dot boundary, and a request to
+ * `/collect` on the app's own origin is kept — correctly.
+ *
+ * WHY IT IS A SUFFIX LIST AND NOT A REGEX
+ * Two reasons, both practical. It is applied inside an SDK whose eager bundle is measured in bytes,
+ * and a comma-joined string of suffixes compresses to almost nothing next to an equivalent pattern
+ * source. And it has to be COPIED, byte for byte, into the React Native SDK and into the backend's
+ * ingest path — a list with no syntax is a list that cannot drift in meaning between three
+ * languages' worth of tooling. `third-party:parity` hashes all three copies.
+ *
+ * ZERO IMPORTS, DELIBERATELY. That is what makes the byte-identical copy possible. If an edit here
+ * ever needs an import, the parity gate is the thing that will say so — keep the module pure rather
+ * than weakening the gate.
+ *
+ * WHAT IS DELIBERATELY NOT ON THE LIST
+ * The rule is: a host whose ONLY purpose is to receive telemetry. Everything else stays, because a
+ * dropped request is invisible and a kept one is merely noisy.
+ *
+ *   - Feature-flag and experiment services (LaunchDarkly, Optimizely, Split). Their RESPONSES
+ *     change what the app does, so a failed flag fetch is an application incident and the single
+ *     most useful request in the session.
+ *   - Chat and support widgets (Intercom, Zendesk, Drift). A broken widget is a broken feature the
+ *     user can see.
+ *   - `facebook.com` as a whole. `graph.facebook.com` is an API real apps call; only the pixel
+ *     delivery hosts are listed.
+ *   - CDNs of any kind, even ones that mostly serve tags: they also serve application assets, and
+ *     dropping them would hide a real asset failure.
+ *
+ * When in doubt, leave it out. `denyUrls` stays the per-app escape hatch in both SDKs, and it can
+ * do what this list will not.
+ */
+/**
+ * Known telemetry, advertising and enrichment endpoints, as hostname suffixes.
+ *
+ * One comma-joined string rather than an array: identical meaning, materially smaller once gzipped,
+ * and it keeps the copy in three repos a single line to compare by eye.
+ */
+export declare const THIRD_PARTY_BEACON_HOSTS: string;
+/**
+ * True when `url` is addressed to a known beacon host.
+ *
+ * Deliberately total: an unparseable or relative URL is NOT third party. A relative URL is
+ * same-origin by definition — the app's own call — and guessing on garbage input would drop real
+ * requests for no benefit.
+ */
+export declare function isThirdPartyBeacon(url: string, hosts?: string): boolean;
+//# sourceMappingURL=thirdParty.d.ts.map

package/lib/typescript/features/ota/OtaOrchestrator.d.ts

@@ -1,5 +1,4 @@
 import type { OtaCheckResponse, OtaBundlePayload } from './OtaTypes';
-import { type SignatureConfig } from './signature';
 export interface SyncResult {
     status: 'UP_TO_DATE' | 'UPDATE_INSTALLED' | 'ROLLED_BACK' | 'ERROR';
     bundle?: OtaBundlePayload;
@@ -37,7 +36,6 @@ export declare class OtaOrchestrator {
     private isRestartRequiredState;
     private healthyTimer;
     private bootGuardConfig;
-    private signatureConfig;
     private environment;
     /** One-time boot checks have run in this process (init is idempotent). */
     private initialized;
@@ -45,13 +43,12 @@ export declare class OtaOrchestrator {
     /**
      * Initialize the orchestrator. Checks for boot-guard recovery state.
      *
-     * `signature` is optional: an app that has not adopted signing keeps working
-     * on SHA-256 integrity alone. Once a public key IS configured, a bundle that
-     * cannot be verified is refused rather than installed (OTA-03).
+     * Signature enforcement is no longer a JS concern: signed releases are
+     * verified and staged in NATIVE code against RSA keys embedded in the app
+     * package (SB-OTA-RSA-SHA256-V1), and unsigned releases keep working on
+     * SHA-256 integrity alone. There is nothing for the host to configure here.
      */
-    init(config?: BootGuardConfig & {
-        signature?: SignatureConfig;
-    }): void;
+    init(config?: BootGuardConfig): void;
     /**
      * Read the active slot back into `currentBundle` so the next check reports
      * what this device is genuinely running.

package/lib/typescript/features/ota/OtaTypes.d.ts

@@ -51,6 +51,11 @@ export interface OtaCheckRequest {
     installationId: string;
     currentBundleId?: string;
     currentBundleHash?: string;
+    /**
+     * Trusted key IDs embedded in this app binary, for SDK trust coverage
+     * (CICDPAGE §12). Telemetry only — never a source of server-side trust.
+     */
+    trustedKeyIds?: string[];
     /** Channel to pull from. Omitted means `default`. */
     channelName?: string;
     /** ISO 3166-1 alpha-2. The server fills this from the edge when absent. */
@@ -93,6 +98,23 @@ export interface OtaBundlePayload {
     size: number;
     sha256: string;
     signature?: string;
+    /**
+     * SB-OTA-RSA-SHA256-V1 release envelope. Present on signed releases; carries
+     * the protocol id, the id of the trusted RSA key the release was signed with,
+     * the canonical signed payload, and its signature. When present, the SDK hands
+     * the whole envelope to the native module (`verifyAndStageRelease`), which
+     * verifies the signature against the RSA public keys EMBEDDED in the app
+     * package and then downloads + integrity-checks + stages the artifact — JS
+     * never stages bytes it has not proven authentic, and never pins or verifies a
+     * key itself. Absent on legacy/unsigned releases, which fall back to
+     * `stageBundle` on SHA-256 integrity alone.
+     */
+    envelope?: {
+        protocol: string;
+        keyId: string;
+        signedPayload: string;
+        signature: string;
+    };
     isMandatory: boolean;
     /**
      * How to activate the bundle after install:

package/lib/typescript/public/ScaleBunFacade.d.ts

@@ -69,17 +69,11 @@ declare class ScaleBunFacade {
     /**
      * Boot the OTA orchestrator when the init config asks for it.
      *
-     * `publicSigningKey` / `publicSigningKeys` are honoured here so signature
-     * enforcement is reachable from configuration alone. The list form exists
-     * for key ROTATION: a build pinning [old, new] keeps verifying while the
-     * server moves to the new key, so replacing a key never needs an emergency
-     * store release. Both fields merge (deduplicated) into one pinned set.
-     *
-     * Verification comes from `ota.verifySignature` when supplied, else the
-     * built-in @noble-based verifier (optional peers). Pinning keys with
-     * NEITHER available is fail-CLOSED by design (signature.ts) — an update
-     * that cannot be verified is not installed. We say that out loud rather
-     * than letting the app discover it as a silent no-update condition.
+     * Signature enforcement is no longer configured from JS. Signed releases are
+     * verified and staged in NATIVE code against RSA keys embedded in the app
+     * package (SB-OTA-RSA-SHA256-V1); unsigned releases keep working on SHA-256
+     * integrity. There are no signing-key or `verifySignature` options to pass
+     * through — the host embeds its trusted keys natively.
      */
     private _maybeStartOta;
     /** Guards against overlapping config-driven OTA checks. */

package/lib/typescript/specs/NativeScaleBunOta.d.ts

@@ -22,6 +22,14 @@ export interface Spec extends TurboModule {
      * the bundle URL at launch.
      */
     getActiveBundle(): string | null;
+    /**
+     * JSON array (string) of the trusted key IDs embedded in the app package, e.g.
+     * `["production-2026-01"]`. Reported on OTA check-in for SDK trust coverage
+     * (CICDPAGE §12) so the dashboard can measure key-rotation adoption. This is
+     * telemetry ONLY — the server never trusts a key because a device claims it.
+     * Empty array when no keys are embedded.
+     */
+    getTrustedKeyIds(): string;
     /**
      * Returns JSON with current slot state:
      * { current: { bundleId, version, sha256, installedAt } | null,
@@ -77,28 +85,30 @@ export interface Spec extends TurboModule {
      */
     restartApp(): void;
     /**
-     * Verify a detached ed25519 signature in NATIVE code.
-     *
-     * Exists because the JS verifier runs inside the very bundle it protects —
-     * an attacker who lands one malicious bundle can neuter a JS check for every
-     * update after it. Platform crypto is outside the bundle's reach, and it also
-     * removes the runtime dependency on the optional @noble peers wherever the OS
-     * provides ed25519 (iOS 13+ CryptoKit everywhere; Android API 33+).
+     * Verify a SB-OTA-RSA-SHA256-V1 release envelope in NATIVE code, with no side
+     * effects. `envelopeJson` is the JSON `{ protocol, keyId, signedPayload,
+     * signature, downloadUrl? }` from the check response. Verification uses the
+     * trusted RSA public keys EMBEDDED in the app package (never a key from JS or
+     * the server) and platform `SHA256withRSA` (present on every supported API
+     * level — no API-33 floor).
      *
-     * All three arguments are lowercase hex, pre-validated by the JS caller:
-     * the 32-byte bundle SHA-256 (the signature is over its RAW BYTES, matching
-     * the CLI's signing contract), the 64-byte signature, the 32-byte public key.
-     *
-     * Resolves a verdict STRING, not a boolean, because "the signature is wrong"
-     * and "this OS cannot check" must never collapse into one value:
-     *   'valid'       — signature verifies under the key
-     *   'invalid'     — it does not; the caller must refuse the bundle
-     *   'unavailable' — this OS level has no ed25519 (Android < 33); the caller
-     *                   falls back to the JS verifier
-     * A rejected promise is machinery failure and the caller treats it as
-     * 'unavailable' — never as 'valid'.
+     * Resolves a verdict JSON string: `{ ok: boolean, code?: string, message?,
+     * keyId?, releaseId?, bundleId?, releaseSequence?, artifactSha256?,
+     * artifactSize?, resultArtifactSha256?, fingerprint? }`. A failed check is
+     * `ok:false` with a stable `code`; a rejected promise is machinery failure and
+     * the caller must treat it as a failure, never as valid.
+     */
+    verifyRelease(envelopeJson: string): Promise<string>;
+    /**
+     * Native-ENFORCED install: verify the RSA signature (as `verifyRelease`), then
+     * download the artifact, enforce the SIGNED size + SHA-256, and stage it into
+     * the `next` slot — all natively. JavaScript cannot stage bytes that were not
+     * proven authentic (once trusted keys are embedded, the legacy `stageBundle`
+     * path refuses). Does not activate; call `applyUpdate` to promote per the
+     * install mode. Resolves the same verdict JSON as `verifyRelease` (`ok:true`
+     * once staged).
      */
-    verifyEd25519(messageHex: string, signatureHex: string, publicKeyHex: string): Promise<string>;
+    verifyAndStageRelease(envelopeJson: string): Promise<string>;
 }
 /**
  * Resolved via `get` (not `getEnforcing`) so the SDK degrades gracefully when

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalebun/react-native",
-  "version": "1.11.1",
+  "version": "2.0.0",
   "description": "React Native SDK for ScaleBun",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -70,8 +70,6 @@
   },
   "devDependencies": {
     "@babel/preset-env": "^8.0.2",
-    "@noble/ed25519": "^3.1.0",
-    "@noble/hashes": "^2.3.0",
     "@react-native-community/eslint-config": "^3.2.0",
     "@types/jest": "^29.5.12",
     "@types/node": "^25.3.3",
@@ -96,9 +94,7 @@
     "expo-router": ">=1.0.0",
     "react": ">=18.0.0",
     "react-native": ">=0.74.0",
-    "react-native-view-shot": ">=3.0.0",
-    "@noble/ed25519": ">=2.0.0",
-    "@noble/hashes": ">=2.0.0"
+    "react-native-view-shot": ">=3.0.0"
   },
   "peerDependenciesMeta": {
     "react-native-view-shot": {
@@ -109,19 +105,13 @@
     },
     "expo-router": {
       "optional": true
-    },
-    "@noble/ed25519": {
-      "optional": true
-    },
-    "@noble/hashes": {
-      "optional": true
     }
   },
   "dependencies": {
     "@babel/runtime": "^7.25.0",
     "@jridgewell/sourcemap-codec": "1.5.5",
     "@jridgewell/trace-mapping": "0.3.31",
-    "@scalebun/cli": "^1.11.0"
+    "@scalebun/cli": "^2.0.0"
   },
   "codegenConfig": {
     "name": "ScaleBunSpec",

package/scalebun-react-native.podspec

@@ -13,6 +13,10 @@ Pod::Spec.new do |s|
   # Include .mm (ObjC++) for the New Architecture TurboModule providers added in
   # Phase 2, alongside the existing .h/.m/.swift sources.
   s.source_files = "ios/**/*.{h,m,mm,swift}"
+  # XCTest files ship with the SDK source but must NOT compile into the pod (they
+  # import XCTest and belong in a host app's test target). See the run
+  # instructions in ScaleBunOtaVerifierTests.swift (PROMPT §23).
+  s.exclude_files = "ios/**/*Tests.swift"
 
   # Define a clang module so the generated Swift interop header
   # (`scalebun_react_native-Swift.h`) is emitted and importable from a host