@scalebun/react-native 1.13.0 → 2.0.0

package/dist/scalebun.full.js

@@ -89,9 +89,9 @@ var init_internalLogger = __esm({
       }
       /** Set level from the public string name used in config (e.g. 'warn'). */
       setLevelByName(name) {
-        const resolved3 = LEVEL_BY_NAME[name];
-        if (resolved3 !== void 0) {
-          this.level = resolved3;
+        const resolved = LEVEL_BY_NAME[name];
+        if (resolved !== void 0) {
+          this.level = resolved;
         }
       }
       /** Current numeric level — exposed for callers that branch on dev verbosity. */
@@ -605,7 +605,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "lib/module/core/constants/version.js"() {
     "use strict";
-    SDK_VERSION = "1.13.0";
+    SDK_VERSION = "2.0.0";
   }
 });
 
@@ -11697,322 +11697,6 @@ var init_deviceAttributes = __esm({
   }
 });
 
-// lib/module/features/ota/crypto/loadEd25519.js
-function loadEd25519() {
-  try {
-    const mod = require("@noble/ed25519");
-    const ed = mod?.default ?? mod;
-    if (typeof ed?.verifyAsync === "function" || typeof ed?.verify === "function") {
-      return ed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-var init_loadEd25519 = __esm({
-  "lib/module/features/ota/crypto/loadEd25519.js"() {
-    "use strict";
-  }
-});
-
-// lib/module/features/ota/crypto/loadSha512.js
-function loadSha512() {
-  try {
-    const mod = require("@noble/hashes/sha2.js");
-    const sha512 = mod?.sha512 ?? mod?.default?.sha512;
-    return typeof sha512 === "function" ? sha512 : null;
-  } catch {
-    return null;
-  }
-}
-var init_loadSha512 = __esm({
-  "lib/module/features/ota/crypto/loadSha512.js"() {
-    "use strict";
-  }
-});
-
-// lib/module/features/ota/crypto/builtinVerifier.js
-var builtinVerifier_exports = {};
-__export(builtinVerifier_exports, {
-  _resetBuiltinVerifier: () => _resetBuiltinVerifier,
-  decodeSignature: () => decodeSignature,
-  getBuiltinVerifier: () => getBuiltinVerifier
-});
-function hexToBytes(hex) {
-  const clean2 = hex.trim().toLowerCase().replace(/^0x/, "");
-  if (clean2.length === 0 || clean2.length % 2 !== 0 || /[^0-9a-f]/.test(clean2)) return null;
-  const out = new Uint8Array(clean2.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(clean2.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-function base64ToBytes2(b64) {
-  const s = b64.trim().replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
-  if (s.length === 0) return null;
-  const out = [];
-  let buffer = 0;
-  let bits = 0;
-  for (const ch of s) {
-    const idx = B64_ALPHABET2.indexOf(ch);
-    if (idx === -1) return null;
-    buffer = buffer << 6 | idx;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      out.push(buffer >> bits & 255);
-    }
-  }
-  return Uint8Array.from(out);
-}
-function decodeSignature(sig) {
-  const trimmed = sig.trim();
-  if (/^(0x)?[0-9a-fA-F]{128}$/.test(trimmed)) {
-    const hex2 = hexToBytes(trimmed);
-    if (hex2 && hex2.length === ED25519_SIGNATURE_BYTES) return hex2;
-  }
-  const b64 = base64ToBytes2(trimmed);
-  if (b64 && b64.length === ED25519_SIGNATURE_BYTES) return b64;
-  const hex = hexToBytes(trimmed);
-  if (hex && hex.length === ED25519_SIGNATURE_BYTES) return hex;
-  return null;
-}
-function wireSha512(ed, sha512) {
-  const concat2 = (parts) => {
-    if (parts.length === 1) return parts[0];
-    let total = 0;
-    for (const p of parts) total += p.length;
-    const out = new Uint8Array(total);
-    let off = 0;
-    for (const p of parts) {
-      out.set(p, off);
-      off += p.length;
-    }
-    return out;
-  };
-  const sync = (...msgs) => sha512(concat2(msgs));
-  const asyncFn = async (...msgs) => sha512(concat2(msgs));
-  let wired = false;
-  try {
-    if (ed.hashes && typeof ed.hashes === "object") {
-      if (typeof ed.hashes.sha512 !== "function") ed.hashes.sha512 = sync;
-      if (typeof ed.hashes.sha512Async !== "function") ed.hashes.sha512Async = asyncFn;
-      wired = typeof ed.hashes.sha512 === "function";
-    }
-  } catch {
-  }
-  try {
-    if (ed.etc && typeof ed.etc === "object") {
-      if (typeof ed.etc.sha512Sync !== "function") ed.etc.sha512Sync = sync;
-      if (typeof ed.etc.sha512Async !== "function") ed.etc.sha512Async = asyncFn;
-      wired = wired || typeof ed.etc.sha512Sync === "function";
-    }
-  } catch {
-  }
-  return wired;
-}
-function getBuiltinVerifier() {
-  if (resolved !== void 0) return resolved;
-  const ed = loadEd25519();
-  const sha512 = loadSha512();
-  if (!ed || !sha512) {
-    resolved = null;
-    return null;
-  }
-  if (!wireSha512(ed, sha512)) {
-    logger.error("[OTA] @noble/ed25519 is installed but its SHA-512 provider could not be wired (unrecognised version shape). Supply `ota.verifySignature` yourself, or pin a @noble/ed25519 version this SDK supports.");
-    resolved = null;
-    return null;
-  }
-  resolved = async ({
-    messageHex,
-    signature,
-    publicKey
-  }) => {
-    const message = hexToBytes(messageHex);
-    const pub = hexToBytes(publicKey);
-    const sig = decodeSignature(signature);
-    if (!message) {
-      logger.error("[OTA] Bundle SHA-256 is not valid hex \u2014 refusing to stage.");
-      return false;
-    }
-    if (!pub || pub.length !== ED25519_PUBLIC_KEY_BYTES) {
-      logger.error(`[OTA] ota.publicSigningKey must be ${ED25519_PUBLIC_KEY_BYTES} bytes of hex (${ED25519_PUBLIC_KEY_BYTES * 2} characters) \u2014 got ${pub ? `${pub.length} bytes` : "a value that is not hex"}.`);
-      return false;
-    }
-    if (!sig) {
-      logger.error("[OTA] Bundle signature is not a 64-byte hex/base64 value.");
-      return false;
-    }
-    try {
-      if (typeof ed.verify === "function") return ed.verify(sig, message, pub);
-      if (typeof ed.verifyAsync === "function") return await ed.verifyAsync(sig, message, pub);
-      return false;
-    } catch {
-      return false;
-    }
-  };
-  __DEV__ && logger.debug("[OTA] Using built-in ed25519 verifier (@noble/ed25519 detected).");
-  return resolved;
-}
-function _resetBuiltinVerifier() {
-  resolved = void 0;
-}
-var ED25519_SIGNATURE_BYTES, ED25519_PUBLIC_KEY_BYTES, B64_ALPHABET2, resolved;
-var init_builtinVerifier = __esm({
-  "lib/module/features/ota/crypto/builtinVerifier.js"() {
-    "use strict";
-    init_loadEd25519();
-    init_loadSha512();
-    init_internalLogger();
-    ED25519_SIGNATURE_BYTES = 64;
-    ED25519_PUBLIC_KEY_BYTES = 32;
-    B64_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  }
-});
-
-// lib/module/features/ota/crypto/nativeVerifier.js
-function bytesToHex(bytes) {
-  let out = "";
-  for (const b of bytes) out += b.toString(16).padStart(2, "0");
-  return out;
-}
-function normalizeHex(value, expectedChars) {
-  const clean2 = value.trim().toLowerCase().replace(/^0x/, "");
-  if (clean2.length !== expectedChars || /[^0-9a-f]/.test(clean2)) return null;
-  return clean2;
-}
-function getNativeVerifier() {
-  if (resolved2 !== void 0) return resolved2;
-  const native = NativeScaleBunOta_default;
-  if (!native || typeof native.verifyEd25519 !== "function") {
-    resolved2 = null;
-    return null;
-  }
-  resolved2 = async ({
-    messageHex,
-    signature,
-    publicKey
-  }) => {
-    const message = normalizeHex(messageHex, 64);
-    const key = normalizeHex(publicKey, ED25519_PUBLIC_KEY_HEX_CHARS);
-    const sigBytes = decodeSignature(signature);
-    if (!message || !key || !sigBytes) {
-      logger.error("[OTA] Signature inputs malformed (bundle hash, signature, or public key) \u2014 refusing to stage.");
-      return false;
-    }
-    let verdict;
-    try {
-      verdict = await native.verifyEd25519(message, bytesToHex(sigBytes), key);
-    } catch (err) {
-      logger.warn(`[OTA] Native ed25519 verify failed to run: ${err?.message ?? err}`);
-      verdict = "unavailable";
-    }
-    if (verdict === "valid") return true;
-    if (verdict === "invalid") return false;
-    const builtin = getBuiltinVerifier();
-    if (builtin) {
-      return builtin({
-        messageHex,
-        signature,
-        publicKey
-      });
-    }
-    throw new Error("ed25519 unavailable: this OS has no native implementation (Android < 13) and the optional peers @noble/ed25519 + @noble/hashes are not installed.");
-  };
-  __DEV__ && logger.debug("[OTA] Using native ed25519 verifier (platform crypto).");
-  return resolved2;
-}
-var ED25519_PUBLIC_KEY_HEX_CHARS, resolved2;
-var init_nativeVerifier = __esm({
-  "lib/module/features/ota/crypto/nativeVerifier.js"() {
-    "use strict";
-    init_NativeScaleBunOta();
-    init_internalLogger();
-    init_builtinVerifier();
-    ED25519_PUBLIC_KEY_HEX_CHARS = 64;
-  }
-});
-
-// lib/module/features/ota/signature.js
-async function verifyBundleSignature(bundleSha256, signature, config) {
-  const rawKey = config?.publicKey;
-  const keys = (Array.isArray(rawKey) ? rawKey : rawKey ? [rawKey] : []).filter((k) => typeof k === "string" && k.trim().length > 0);
-  if (rawKey === void 0 || rawKey === "" || rawKey === null) {
-    if (!warnedNotConfigured) {
-      warnedNotConfigured = true;
-      logger.warn("[OTA] No signing public key configured \u2014 bundles are accepted on SHA-256 integrity alone. Configure `ota.publicSigningKey` to enforce authenticity.");
-    }
-    return {
-      ok: true,
-      reason: "not_configured"
-    };
-  }
-  if (keys.length === 0) {
-    logger.error("[OTA] Signing key config resolves to zero usable keys (empty array or blank strings) \u2014 refusing to stage. Remove the config to disable signing, or pin at least one real key.");
-    return {
-      ok: false,
-      reason: "no_keys"
-    };
-  }
-  if (!signature) {
-    logger.error("[OTA] Bundle has no signature but a signing key is configured \u2014 refusing to stage.");
-    return {
-      ok: false,
-      reason: "missing_signature"
-    };
-  }
-  const verifier = typeof config?.verifier === "function" ? config.verifier : getNativeVerifier() ?? getBuiltinVerifier();
-  if (!verifier) {
-    logger.error("[OTA] A signing key is configured but no signature verifier is available \u2014 refusing to stage. Either install the optional peers `@noble/ed25519` and `@noble/hashes` (the SDK then verifies with no further code), or provide your own `ota.verifySignature`.");
-    return {
-      ok: false,
-      reason: "no_verifier"
-    };
-  }
-  let sawThrow = false;
-  let sawCompletion = false;
-  for (const key of keys) {
-    try {
-      const valid = await verifier({
-        messageHex: bundleSha256,
-        signature,
-        publicKey: key
-      });
-      sawCompletion = true;
-      if (valid) return {
-        ok: true,
-        reason: "verified"
-      };
-    } catch (err) {
-      sawThrow = true;
-      logger.error(`[OTA] Signature verifier threw: ${err?.message ?? err}`);
-    }
-  }
-  if (sawThrow && !sawCompletion) {
-    return {
-      ok: false,
-      reason: "verifier_threw"
-    };
-  }
-  logger.error(keys.length > 1 ? `[OTA] Bundle signature is INVALID under all ${keys.length} pinned keys \u2014 refusing to stage.` : "[OTA] Bundle signature is INVALID \u2014 refusing to stage.");
-  return {
-    ok: false,
-    reason: "invalid_signature"
-  };
-}
-var warnedNotConfigured;
-var init_signature = __esm({
-  "lib/module/features/ota/signature.js"() {
-    "use strict";
-    init_internalLogger();
-    init_builtinVerifier();
-    init_nativeVerifier();
-    warnedNotConfigured = false;
-  }
-});
-
 // lib/module/features/ota/environment.js
 function compare(a, b) {
   if (a.major !== b.major) return a.major - b.major;
@@ -12258,7 +11942,6 @@ var init_OtaOrchestrator = __esm({
     init_geoCountry();
     init_deviceAttributes();
     init_installationId();
-    init_signature();
     init_environment();
     init_retry();
     init_StorageBackend();
@@ -12286,15 +11969,15 @@ var init_OtaOrchestrator = __esm({
       /**
        * Initialize the orchestrator. Checks for boot-guard recovery state.
        *
-       * `signature` is optional: an app that has not adopted signing keeps working
-       * on SHA-256 integrity alone. Once a public key IS configured, a bundle that
-       * cannot be verified is refused rather than installed (OTA-03).
+       * Signature enforcement is no longer a JS concern: signed releases are
+       * verified and staged in NATIVE code against RSA keys embedded in the app
+       * package (SB-OTA-RSA-SHA256-V1), and unsigned releases keep working on
+       * SHA-256 integrity alone. There is nothing for the host to configure here.
        */
       init(config) {
         noThrow(() => {
           if (this.initialized) {
             this.bootGuardConfig = config ?? this.bootGuardConfig;
-            this.signatureConfig = config?.signature ?? this.signatureConfig;
             return;
           }
           if (!NativeScaleBunOta_default) {
@@ -12316,7 +11999,6 @@ var init_OtaOrchestrator = __esm({
           this.initialized = true;
           this.enabled = true;
           this.bootGuardConfig = config ?? {};
-          this.signatureConfig = config?.signature;
           __DEV__ && logger.debug(`[OTA] Orchestrator initialized (RN ${this.environment.rnVersionString ?? "unknown"}${this.environment.bridgeless ? ", bridgeless" : ""}${this.environment.hermes ? `, Hermes HBC v${this.environment.hermesBytecodeVersion ?? "?"}` : ""})`);
           const slotState = this.readSlotState();
           this.hydrateCurrentBundleFromSlots(slotState);
@@ -12503,12 +12185,22 @@ var init_OtaOrchestrator = __esm({
           const env = this.environment ?? detectOtaEnvironment();
           const mobileOS = resolveMobileOS();
           if (!mobileOS) throw new Error("OTA is not supported on this platform");
+          let trustedKeyIds;
+          try {
+            const raw = NativeScaleBunOta_default?.getTrustedKeyIds?.();
+            if (raw) {
+              const arr2 = JSON.parse(raw);
+              if (Array.isArray(arr2) && arr2.length) trustedKeyIds = arr2.slice(0, 16);
+            }
+          } catch {
+          }
           const payload = {
             appVersion: requestParams.appVersion,
             platform: mobileOS,
             installationId: requestParams.installationId,
             currentBundleId: this.currentBundle?.id,
             currentBundleHash: this.currentBundle?.sha256,
+            trustedKeyIds,
             channelName: requestParams.channelName,
             // Host-supplied country wins; otherwise the cached edge-Worker lookup
             // fills in (see geoCountry.ts). Undefined when neither knows — the
@@ -12622,19 +12314,6 @@ var init_OtaOrchestrator = __esm({
             releaseId: bundle.releaseId,
             version: bundle.version
           });
-          const signatureOutcome = await verifyBundleSignature(bundle.sha256, bundle.signature, this.signatureConfig);
-          if (!signatureOutcome.ok) {
-            otaEventEmitter.emitSimple("APPLY_FAILED", bundle.id, {
-              releaseId: bundle.releaseId,
-              error: `Signature check failed: ${signatureOutcome.reason}`,
-              version: bundle.version
-            });
-            return {
-              status: "ERROR",
-              error: `Bundle signature check failed (${signatureOutcome.reason})`,
-              bundle
-            };
-          }
           otaEventEmitter.emitSimple("DOWNLOAD_STARTED", bundle.id, {
             releaseId: bundle.releaseId,
             version: bundle.version
@@ -12682,39 +12361,75 @@ var init_OtaOrchestrator = __esm({
             }
           });
           let staged = false;
-          if (bundle.patch && NativeScaleBunOta_default.stagePatch) {
-            __DEV__ && logger.debug(`[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ${(bundle.size / 1024).toFixed(0)} KB full) \u2014 trying patch\u2026`);
+          if (bundle.envelope) {
+            const envelopeJson = JSON.stringify({
+              ...bundle.envelope,
+              downloadUrl: bundle.url
+            });
+            let verdict;
             try {
-              staged = await NativeScaleBunOta_default.stagePatch(
-                bundle.patch.url,
-                bundle.patch.sha256,
-                bundle.sha256
-                // expected full-bundle hash after patching
-              );
-              if (staged) {
-                patchUsed = true;
-                __DEV__ && logger.debug("[OTA] Patch applied successfully");
-              } else {
-                logger.warn("[OTA] Patch staging returned false \u2014 falling back to full bundle");
-              }
-            } catch (patchErr) {
-              logger.warn(`[OTA] Patch staging failed: ${patchErr.message} \u2014 falling back to full bundle`);
+              const verdictJson = await NativeScaleBunOta_default.verifyAndStageRelease(envelopeJson);
+              verdict = JSON.parse(verdictJson);
+            } catch (err) {
+              verdict = {
+                ok: false,
+                code: "verify_stage_threw",
+                message: err?.message ?? String(err)
+              };
             }
-          }
-          if (!staged) {
-            try {
-              staged = await retryWithBackoff(async () => {
-                const ok = await NativeScaleBunOta_default.stageBundle(bundle.url, bundle.sha256);
-                if (!ok) {
-                  throw new Error("stageBundle returned false");
-                }
-                return ok;
-              }, {
-                label: `download v${bundle.version}`,
-                attempts: 3
+            if (!verdict.ok) {
+              unsubscribeProgress();
+              postProgress(0, "FAILED");
+              logger.error(`[OTA] Native verify/stage refused the release: ${verdict.code ?? "unknown"}${verdict.message ? ` \u2014 ${verdict.message}` : ""}`);
+              otaEventEmitter.emitSimple("APPLY_FAILED", bundle.id, {
+                releaseId: bundle.releaseId,
+                // `error` is mapped onto the wire `errorCode` by deliverOtaEvents —
+                // carry the stable native verdict code there.
+                error: verdict.code ?? "verify_and_stage_release_failed",
+                version: bundle.version
               });
-            } catch {
-              staged = false;
+              return {
+                status: "ERROR",
+                error: `Release verification failed (${verdict.code ?? "unknown"})`,
+                bundle
+              };
+            }
+            staged = true;
+          } else {
+            if (bundle.patch && NativeScaleBunOta_default.stagePatch) {
+              __DEV__ && logger.debug(`[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ${(bundle.size / 1024).toFixed(0)} KB full) \u2014 trying patch\u2026`);
+              try {
+                staged = await NativeScaleBunOta_default.stagePatch(
+                  bundle.patch.url,
+                  bundle.patch.sha256,
+                  bundle.sha256
+                  // expected full-bundle hash after patching
+                );
+                if (staged) {
+                  patchUsed = true;
+                  __DEV__ && logger.debug("[OTA] Patch applied successfully");
+                } else {
+                  logger.warn("[OTA] Patch staging returned false \u2014 falling back to full bundle");
+                }
+              } catch (patchErr) {
+                logger.warn(`[OTA] Patch staging failed: ${patchErr.message} \u2014 falling back to full bundle`);
+              }
+            }
+            if (!staged) {
+              try {
+                staged = await retryWithBackoff(async () => {
+                  const ok = await NativeScaleBunOta_default.stageBundle(bundle.url, bundle.sha256);
+                  if (!ok) {
+                    throw new Error("stageBundle returned false");
+                  }
+                  return ok;
+                }, {
+                  label: `download v${bundle.version}`,
+                  attempts: 3
+                });
+              } catch {
+                staged = false;
+              }
             }
           }
           unsubscribeProgress();
@@ -14840,18 +14555,9 @@ var SHAPE = {
         kind: "str",
         opt: true
       },
-      publicSigningKey: {
-        kind: "str",
-        opt: true
-      },
-      // Rotation support: several pinned keys, any of which may verify a
-      // bundle. Ship a build pinning [old, new], re-sign server-side with
-      // new, drop old next release — no emergency store submission when a
-      // key must be replaced. Merged with publicSigningKey by the facade.
-      publicSigningKeys: {
-        kind: "strArr",
-        opt: true
-      },
+      // No signing-key fields: signed releases are verified natively against
+      // RSA keys embedded in the app package (SB-OTA-RSA-SHA256-V1). JS must
+      // not supply a trusted key.
       mandatoryBlocksUi: bool(false)
     }
   }
@@ -15654,6 +15360,23 @@ function installNetworkMonitoring(onEvent, options = {}) {
   });
 }
 
+// lib/module/features/network/thirdParty.js
+var THIRD_PARTY_BEACON_HOSTS = "google-analytics.com,googletagmanager.com,analytics.google.com,doubleclick.net,googlesyndication.com,googleadservices.com,app-measurement.com,facebook.net,analytics.tiktok.com,ads-twitter.com,analytics.twitter.com,ct.pinterest.com,bat.bing.com,px.ads.linkedin.com,tr.snapchat.com,criteo.com,criteo.net,taboola.com,outbrain.com,adroll.com,adsrvr.org,quantserve.com,scorecardresearch.com,hotjar.com,hotjar.io,clarity.ms,fullstory.com,mouseflow.com,crazyegg.com,luckyorange.com,inspectlet.com,segment.io,mixpanel.com,amplitude.com,heap.io,heapanalytics.com,rudderstack.com,posthog.com,matomo.cloud,plausible.io,simpleanalytics.com,statcounter.com,appsflyer.com,adjust.com,branch.io,ipify.org,ipinfo.io,ipapi.co,ip-api.com,geolocation-db.com,cloudflareinsights.com,nr-data.net,browser-intake-datadoghq.com,sentry.io,bugsnag.com,rollbar.com";
+function isThirdPartyBeacon(url, hosts) {
+  if (!url) return false;
+  let host = "";
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  for (const suffix of (hosts ?? THIRD_PARTY_BEACON_HOSTS).split(",")) {
+    if (host === suffix || host.endsWith("." + suffix)) return true;
+  }
+  return false;
+}
+
 // lib/module/features/network/NetworkFeature.js
 init_networkAdapter();
 init_SessionManager();
@@ -15669,10 +15392,12 @@ var NetworkFeature = class {
     if (this.active) return;
     installNetworkMonitoring((data) => {
       const isInternal = isSdkInternalUrl(data.url, this.options.sdkBaseUrl);
-      if (!isInternal) {
+      const isBeaconOrDenied = this.options.captureThirdParty !== true && isThirdPartyBeacon(data.url, this.options.thirdPartyHosts) || matchesDenyUrl(data.url, this.options.denyUrls);
+      const isExcluded = isInternal || isBeaconOrDenied;
+      if (!isExcluded) {
         this.trackFn("$network_request", data);
       }
-      if (data.type === "network") {
+      if (data.type === "network" && !isBeaconOrDenied) {
         reportNetworkRequest({
           method: data.method,
           url: data.url,
@@ -15688,7 +15413,7 @@ var NetworkFeature = class {
           requestBody: data.requestBody,
           responseBody: data.responseBody
         });
-        if (!isInternal) {
+        if (!isExcluded) {
           const sessionManager = SessionManager.getExistingInstance();
           if (sessionManager) {
             const backendTransport = sessionManager.getBackendTransport();
@@ -15719,6 +15444,13 @@ var NetworkFeature = class {
     return this.active;
   }
 };
+function matchesDenyUrl(url, patterns) {
+  if (!patterns || !patterns.length || !url) return false;
+  for (const p of patterns) {
+    if (typeof p === "string" ? url.includes(p) : p.test(url)) return true;
+  }
+  return false;
+}
 function isSdkInternalUrl(url, sdkBaseUrl) {
   if (!url) return false;
   try {
@@ -20311,17 +20043,11 @@ var ScaleBunFacade = class _ScaleBunFacade {
   /**
    * Boot the OTA orchestrator when the init config asks for it.
    *
-   * `publicSigningKey` / `publicSigningKeys` are honoured here so signature
-   * enforcement is reachable from configuration alone. The list form exists
-   * for key ROTATION: a build pinning [old, new] keeps verifying while the
-   * server moves to the new key, so replacing a key never needs an emergency
-   * store release. Both fields merge (deduplicated) into one pinned set.
-   *
-   * Verification comes from `ota.verifySignature` when supplied, else the
-   * built-in @noble-based verifier (optional peers). Pinning keys with
-   * NEITHER available is fail-CLOSED by design (signature.ts) — an update
-   * that cannot be verified is not installed. We say that out loud rather
-   * than letting the app discover it as a silent no-update condition.
+   * Signature enforcement is no longer configured from JS. Signed releases are
+   * verified and staged in NATIVE code against RSA keys embedded in the app
+   * package (SB-OTA-RSA-SHA256-V1); unsigned releases keep working on SHA-256
+   * integrity. There are no signing-key or `verifySignature` options to pass
+   * through — the host embeds its trusted keys natively.
    */
   _maybeStartOta(rawConfig) {
     const ota = rawConfig?.ota;
@@ -20330,29 +20056,8 @@ var ScaleBunFacade = class _ScaleBunFacade {
       const {
         otaOrchestrator: otaOrchestrator2
       } = (init_OtaOrchestrator(), __toCommonJS(OtaOrchestrator_exports));
-      const rawSingle = ota.publicSigningKey;
-      const rawList = ota.publicSigningKeys;
-      const publicKeys = Array.from(new Set([...typeof rawSingle === "string" && rawSingle ? [rawSingle] : [], ...Array.isArray(rawList) ? rawList : []].filter((k) => typeof k === "string" && k.trim().length > 0)));
-      const signingRequested = publicKeys.length > 0 || Array.isArray(rawList);
-      const verifier = ota.verifySignature;
-      if (signingRequested && typeof verifier !== "function") {
-        const {
-          getBuiltinVerifier: getBuiltinVerifier2
-        } = (init_builtinVerifier(), __toCommonJS(builtinVerifier_exports));
-        if (!getBuiltinVerifier2()) {
-          logger.warn("[ScaleBun] A signing key is pinned but no signature verifier is available. Signature checking is fail-closed: updates will be REJECTED until one exists. Install the optional peers `@noble/ed25519` + `@noble/hashes` (no further code needed), or supply `ota.verifySignature`.");
-        }
-      }
       const healthyAfterMs = typeof ota.healthyAfterMs === "number" ? ota.healthyAfterMs : typeof ota.healthyTimeoutMs === "number" ? ota.healthyTimeoutMs : void 0;
       otaOrchestrator2.init({
-        ...signingRequested ? {
-          signature: {
-            // Single key stays a plain string — the shape every
-            // existing consumer and test already handles.
-            publicKey: publicKeys.length === 1 ? publicKeys[0] : publicKeys,
-            verifier
-          }
-        } : {},
         ...healthyAfterMs !== void 0 ? {
           healthyAfterMs
         } : {}
@@ -24310,11 +24015,11 @@ var normalizedWheelValue = (value) => value.toLowerCase().replace(/\s+/g, " ").t
 function resolveWheelOutcome(segments, source) {
   const identity = wheelOutcomeIdentity(source);
   const index = findWheelOutcomeIndex(segments, identity);
-  const resolved3 = index >= 0;
+  const resolved = index >= 0;
   return {
-    index: resolved3 ? index : 0,
-    label: identity.resultLabel || (resolved3 ? segments[index]?.fullLabel ?? "" : ""),
-    resolved: resolved3
+    index: resolved ? index : 0,
+    label: identity.resultLabel || (resolved ? segments[index]?.fullLabel ?? "" : ""),
+    resolved
   };
 }
 function SpinWheelInApp(props) {
@@ -33173,8 +32878,8 @@ function EngagePromptProvider({
         __DEV__ && logger.debug("[Engage] no eligible in-app message to render");
         return false;
       }
-      const resolved3 = selectInAppVariant(message, getDeviceId());
-      activeInAppVariantRef.current = message.experiment?.enabled ? resolved3 : null;
+      const resolved = selectInAppVariant(message, getDeviceId());
+      activeInAppVariantRef.current = message.experiment?.enabled ? resolved : null;
       store.recordImpression(message.id, Date.now(), message.revision);
       setActiveInApp(message);
       return true;