@scalebun/react-native 1.13.0 → 2.0.0

package/ios/Ota/ScaleBunOtaModule.swift

@@ -1,7 +1,6 @@
 import Foundation
 import React
 import CommonCrypto
-import CryptoKit
 
 /**
  * React Native bridge for OTA bundle management (`ScaleBunOta`) on iOS.
@@ -21,6 +20,21 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
 
     private static let slotManager = OtaSlotManager()
 
+    /// Trusted RSA public keys embedded in the app bundle (docs §9). Non-empty
+    /// once the app ships a `ScaleBunOtaKeys.json` resource — which flips staging
+    /// into the native-ENFORCED path (see `stageBundle`).
+    private static let keyRegistry = ScaleBunOtaKeyRegistry.fromBundle()
+
+    /// Device-derived verification context — never taken from JS.
+    private static func buildContext() -> ExpectedContext {
+        ExpectedContext(
+            projectId: keyRegistry.projectId,
+            applicationId: Bundle.main.bundleIdentifier ?? "",
+            currentSequence: slotManager.highestConfirmedSequence(),
+            nowEpochSeconds: Int64(Date().timeIntervalSince1970)
+        )
+    }
+
     static func moduleName() -> String! { "ScaleBunOta" }
 
     @objc static func requiresMainQueueSetup() -> Bool { false }
@@ -73,6 +87,17 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
         return ScaleBunOtaModule.slotManager.slotStateJSON() as NSString
     }
 
+    /// JSON array of the trusted key IDs embedded in this app (SDK trust coverage).
+    @objc(getTrustedKeyIds)
+    func getTrustedKeyIds() -> NSString {
+        let ids = ScaleBunOtaModule.keyRegistry.keyIds()
+        if let data = try? JSONSerialization.data(withJSONObject: ids),
+           let s = String(data: data, encoding: .utf8) {
+            return s as NSString
+        }
+        return "[]"
+    }
+
     @objc(stageBundle:sha256:resolve:reject:)
     /// Stage a bundle into the `next` slot.
     ///
@@ -85,6 +110,16 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
                      sha256: NSString,
                      resolve: @escaping RCTPromiseResolveBlock,
                      reject: @escaping RCTPromiseRejectBlock) {
+        // Native-enforced staging (docs §17): once trusted keys are embedded, the
+        // ONLY way to stage is verifyAndStageRelease, which proves an RSA signature
+        // over the release payload first. SHA-256 integrity alone (what this path
+        // checks) is not authenticity, so a hostile JS bundle cannot use it to
+        // drive an unauthenticated bundle onto the device.
+        if !ScaleBunOtaModule.keyRegistry.isEmpty {
+            NSLog("[ScaleBunOta] stageBundle refused: trusted keys embedded — use verifyAndStageRelease")
+            resolve(false)
+            return
+        }
         let source = sourcePath as String
         let meta: [String: Any] = [
             "sha256": sha256 as String,
@@ -140,6 +175,16 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
                     expectedSha256: NSString,
                     resolve: @escaping RCTPromiseResolveBlock,
                     reject: @escaping RCTPromiseRejectBlock) {
+        // Same native-enforcement as stageBundle: a bsdiff patch staged by hash
+        // alone carries no signature, so once trusted keys are embedded this path
+        // is closed. Result-anchored signed patches are a native follow-up; until
+        // then the SDK falls back to the verified full download. false = "patch
+        // unavailable".
+        if !ScaleBunOtaModule.keyRegistry.isEmpty {
+            NSLog("[ScaleBunOta] stagePatch disabled while trusted keys are embedded — full verified download")
+            resolve(false)
+            return
+        }
         // Patching is relative to the bundle already on disk. With no OTA bundle
         // installed the source would be the app's built-in bundle, which the
         // server did not diff against — so a full download is the correct path.
@@ -255,68 +300,95 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
     }
 
     /**
-     * Verify a detached ed25519 signature with PLATFORM crypto (CryptoKit).
-     *
-     * Why native: the JS verifier lives inside the very bundle it protects —
-     * one malicious bundle can neuter it for every update after. CryptoKit is
-     * outside the bundle's reach, and unlike Android there is no OS floor to
-     * worry about: Curve25519 signing shipped in iOS 13 and the podspec
-     * already requires 13.4.
-     *
-     * Contract (mirrors `src/specs/NativeScaleBunOta.ts`): inputs are
-     * lowercase hex pre-validated by the JS caller; the message is the RAW 32
-     * BYTES of the bundle SHA-256 (the CLI signs digest bytes, not hex text);
-     * resolves 'valid' / 'invalid' / 'unavailable'. A wrong signature is
-     * 'invalid', never a rejection; anything unexpected is 'unavailable' so
-     * machinery failure can never read as a pass.
+     * Verify a SB-OTA-RSA-SHA256-V1 release envelope with PLATFORM crypto
+     * (`SecKeyVerifySignature`) and the EMBEDDED trusted-key registry — no
+     * download, no side effects. Resolves the verdict JSON (`{ ok, code?, keyId?,
+     * releaseId?, bundleId?, releaseSequence?, artifactSha256?, artifactSize?,
+     * resultArtifactSha256?, fingerprint? }`). A failed check is `ok:false` with a
+     * stable `code`, never a rejected promise. Native because the JS verifier
+     * lives inside the very bundle it protects, and the trusted key must come from
+     * the app bundle, not from JS or the server.
      *
-     * ⚪ UNCOMPILED — no macOS toolchain has been available in this workspace
-     * (the standing gap: BsPatch.swift shipped the same way). The algorithm is
-     * pinned by `tools/ed25519-parity` against the live production fixture;
-     * this file still needs one Xcode build before an iOS consumer ships it.
+     * ⚪ Not compiled in this workspace (no macOS toolchain). The RSA/SHA-256
+     * algorithm + wire format are gated by tools/rsa-ota-parity against the shared
+     * fixtures, and ScaleBunOtaVerifierTests is provided to run on a simulator.
      */
-    @objc(verifyEd25519:signatureHex:publicKeyHex:resolve:reject:)
-    func verifyEd25519(_ messageHex: NSString,
-                       signatureHex: NSString,
-                       publicKeyHex: NSString,
+    @objc(verifyRelease:resolve:reject:)
+    func verifyRelease(_ envelopeJson: NSString,
                        resolve: @escaping RCTPromiseResolveBlock,
                        reject: @escaping RCTPromiseRejectBlock) {
-        guard let message = ScaleBunOtaModule.bytesFromHex(messageHex as String),
-              let signature = ScaleBunOtaModule.bytesFromHex(signatureHex as String),
-              let rawKey = ScaleBunOtaModule.bytesFromHex(publicKeyHex as String),
-              rawKey.count == 32 else {
-            // Malformed input from our own caller is not a forgery verdict.
-            resolve("unavailable")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: envelopeJson as String,
+            expected: ScaleBunOtaModule.buildContext(),
+            registry: ScaleBunOtaModule.keyRegistry
+        )
+        resolve(verdict.toJson())
+    }
+
+    /**
+     * Native-ENFORCED install (docs §5, §17): verify the RSA signature against an
+     * embedded key, THEN download, enforce the SIGNED size + SHA-256, and stage
+     * into the `next` slot. JS never stages bytes that were not proven authentic
+     * (once keys are embedded, `stageBundle` refuses). Does not activate —
+     * `applyUpdate` promotes per the install mode. Resolves the verdict JSON.
+     */
+    @objc(verifyAndStageRelease:resolve:reject:)
+    func verifyAndStageRelease(_ envelopeJson: NSString,
+                               resolve: @escaping RCTPromiseResolveBlock,
+                               reject: @escaping RCTPromiseRejectBlock) {
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: envelopeJson as String,
+            expected: ScaleBunOtaModule.buildContext(),
+            registry: ScaleBunOtaModule.keyRegistry
+        )
+        guard verdict.ok, let payload = verdict.payload else {
+            resolve(verdict.toJson())
             return
         }
-        do {
-            let key = try Curve25519.Signing.PublicKey(rawRepresentation: rawKey)
-            resolve(key.isValidSignature(signature, for: message) ? "valid" : "invalid")
-        } catch {
-            // Bytes that are not a curve point cannot have signed anything.
-            resolve("invalid")
+
+        guard let data = (envelopeJson as String).data(using: .utf8),
+              let env = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let url = env["downloadUrl"] as? String, !url.isEmpty else {
+            resolve(Verdict.fail(.DOWNLOAD_FAILED, "envelope has no downloadUrl").toJson())
+            return
         }
-    }
 
-    /// Hex → Data; nil for odd length or a non-hex character.
-    private static func bytesFromHex(_ hex: String) -> Data? {
-        let chars = Array(hex.utf8)
-        guard !chars.isEmpty, chars.count % 2 == 0 else { return nil }
-        var out = Data(capacity: chars.count / 2)
-        for i in stride(from: 0, to: chars.count, by: 2) {
-            guard let hi = ScaleBunOtaModule.hexNibble(chars[i]),
-                  let lo = ScaleBunOtaModule.hexNibble(chars[i + 1]) else { return nil }
-            out.append((hi << 4) | lo)
+        let temp = FileManager.default.temporaryDirectory
+            .appendingPathComponent("scalebun_ota_dl_\(UUID().uuidString)")
+        defer { try? FileManager.default.removeItem(at: temp) }
+
+        guard BundleDownloader.download(urlString: url, destination: temp) else {
+            resolve(Verdict.fail(.DOWNLOAD_FAILED, "download failed").toJson())
+            return
+        }
+        // Size first (cheap) against the SIGNED artifactSize.
+        let attrs = try? FileManager.default.attributesOfItem(atPath: temp.path)
+        let fileSize = (attrs?[.size] as? NSNumber)?.int64Value ?? -1
+        if fileSize != payload.artifactSize {
+            resolve(Verdict.fail(.ARTIFACT_SIZE_MISMATCH, "downloaded size mismatch").toJson())
+            return
         }
-        return out
-    }
 
-    private static func hexNibble(_ c: UInt8) -> UInt8? {
-        switch c {
-        case 0x30...0x39: return c - 0x30            // 0-9
-        case 0x61...0x66: return c - 0x61 + 10       // a-f
-        case 0x41...0x46: return c - 0x41 + 10       // A-F
-        default: return nil
+        // The slot manager streams a SHA-256 and compares against the signed
+        // artifactSha256 (== resultArtifactSha256 for a full artifact), so a wrong
+        // download cannot be staged. meta carries the sequence used by the
+        // anti-downgrade floor once the bundle is confirmed healthy.
+        let meta: [String: Any] = [
+            "sha256": payload.artifactSha256,
+            "releaseSequence": payload.releaseSequence,
+            "bundleId": payload.bundleId,
+            "releaseId": payload.releaseId,
+            "installedAt": Int(Date().timeIntervalSince1970 * 1000)
+        ]
+        let staged = ScaleBunOtaModule.slotManager.stage(
+            sourcePath: temp.path,
+            expectedSha256: payload.artifactSha256,
+            meta: meta
+        )
+        if !staged {
+            resolve(Verdict.fail(.ARTIFACT_HASH_MISMATCH, "staged bytes failed hash check").toJson())
+            return
         }
+        resolve(verdict.toJson())
     }
 }

package/ios/Ota/ScaleBunOtaReleaseVerifier.swift

@@ -0,0 +1,115 @@
+import Foundation
+import Security
+
+/**
+ * SB-OTA-RSA-SHA256-V1 native release verifier for iOS (docs §5) — the mirror of
+ * Android's ScaleBunOtaReleaseVerifier. Runs the authoritative order: strict
+ * decode → registry-only key resolution → `SecKeyVerifySignature` with
+ * `.rsaSignatureMessagePKCS1v15SHA256` over the EXACT signed-payload bytes →
+ * parse → cross-check against the device's own identity + the anti-downgrade
+ * floor. Fails closed and maps every failure to a stable OtaFailureCode.
+ *
+ * The message-level algorithm hashes the payload internally, so the payload is
+ * passed RAW (never pre-hashed — pre-hashing then using a message-level API would
+ * hash twice, PROMPT §11.2).
+ */
+struct ExpectedContext {
+    let projectId: String
+    let applicationId: String   // the app's own bundle identifier
+    let currentSequence: Int64  // anti-downgrade floor
+    let nowEpochSeconds: Int64
+    var platform: String = "ios"
+}
+
+struct Verdict {
+    let ok: Bool
+    let code: OtaFailureCode?
+    let message: String?
+    let payload: SignedRelease?
+    let fingerprint: String?
+
+    static func fail(_ code: OtaFailureCode, _ message: String) -> Verdict {
+        Verdict(ok: false, code: code, message: message, payload: nil, fingerprint: nil)
+    }
+
+    func toJson() -> String {
+        var o: [String: Any] = ["ok": ok]
+        if let c = code { o["code"] = c.rawValue }
+        if let m = message { o["message"] = m }
+        if let f = fingerprint { o["fingerprint"] = f }
+        if let p = payload {
+            o["keyId"] = p.keyId
+            o["releaseId"] = p.releaseId
+            o["bundleId"] = p.bundleId
+            o["releaseSequence"] = p.releaseSequence
+            o["artifactSha256"] = p.artifactSha256
+            o["artifactSize"] = p.artifactSize
+            o["resultArtifactSha256"] = p.resultArtifactSha256
+            o["artifactType"] = p.artifactType
+        }
+        guard let data = try? JSONSerialization.data(withJSONObject: o),
+              let s = String(data: data, encoding: .utf8) else { return "{\"ok\":false,\"code\":\"INTERNAL_VERIFICATION_ERROR\"}" }
+        return s
+    }
+}
+
+enum ScaleBunOtaReleaseVerifier {
+
+    static func verify(envelopeJson: String, expected: ExpectedContext, registry: ScaleBunOtaKeyRegistry) -> Verdict {
+        do {
+            guard let data = envelopeJson.data(using: .utf8),
+                  let env = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+                return .fail(.INVALID_ENVELOPE, "envelope is not JSON")
+            }
+            let proto = (env["protocol"] as? String) ?? ""
+            if proto != OtaProtocol.signatureAlgorithm { return .fail(.UNSUPPORTED_PROTOCOL, "protocol \(proto)") }
+            let signedPayloadB64 = (env["signedPayload"] as? String) ?? ""
+            let signatureB64 = (env["signature"] as? String) ?? ""
+            let envKeyId = (env["keyId"] as? String) ?? ""
+
+            let payloadBytes = try OtaProtocol.decodeBase64Strict(signedPayloadB64, OtaProtocol.maxSignedPayloadBytes, "signedPayload")
+            let signature = try OtaProtocol.decodeBase64Strict(signatureB64, OtaProtocol.maxSignatureBytes, "signature")
+
+            let payloadKeyId = try OtaProtocol.peekKeyId(payloadBytes)
+            if !envKeyId.isEmpty && envKeyId != payloadKeyId {
+                return .fail(.INVALID_ENVELOPE, "envelope keyId disagrees with payload")
+            }
+            guard let key = registry.get(payloadKeyId) else {
+                return .fail(.UNKNOWN_KEY_ID, "no embedded key with id \(payloadKeyId)")
+            }
+
+            // RSA-SHA256 over the EXACT payload bytes, BEFORE parsing.
+            var error: Unmanaged<CFError>?
+            let valid = SecKeyVerifySignature(
+                key.secKey,
+                .rsaSignatureMessagePKCS1v15SHA256,
+                Data(payloadBytes) as CFData,
+                Data(signature) as CFData,
+                &error
+            )
+            if !valid { return .fail(.INVALID_SIGNATURE, "signature did not verify") }
+
+            let payload = try OtaProtocol.parse(payloadBytes)
+
+            if payload.artifactType != "full" { return .fail(.INVALID_SIGNED_PAYLOAD, "signed payload is not a full release") }
+            let projectExpected = registry.projectId.isEmpty ? expected.projectId : registry.projectId
+            if !projectExpected.isEmpty && payload.projectId != projectExpected { return .fail(.PROJECT_MISMATCH, "projectId") }
+            if !expected.applicationId.isEmpty && payload.applicationId != expected.applicationId {
+                return .fail(.APPLICATION_MISMATCH, "applicationId")
+            }
+            if payload.platform != expected.platform { return .fail(.PLATFORM_MISMATCH, "platform") }
+            if payload.expiresAtEpochSeconds != 0 && expected.nowEpochSeconds > payload.expiresAtEpochSeconds {
+                return .fail(.RELEASE_EXPIRED, "release expired")
+            }
+            if payload.releaseSequence < expected.currentSequence {
+                return .fail(.RELEASE_DOWNGRADE_REJECTED, "sequence below current")
+            }
+
+            return Verdict(ok: true, code: nil, message: nil, payload: payload, fingerprint: key.fingerprint)
+        } catch let e as OtaVerifyError {
+            return .fail(e.code, e.message)
+        } catch {
+            return .fail(.INTERNAL_VERIFICATION_ERROR, "\(error)")
+        }
+    }
+}

package/ios/Ota/ScaleBunOtaVerifierTests.swift

@@ -0,0 +1,92 @@
+import XCTest
+@testable import scalebun_react_native
+
+/**
+ * On-device / simulator verification for SB-OTA-RSA-SHA256-V1 (PROMPT §23).
+ *
+ * Proves the shared committed vector (packages/ota-protocol/fixtures — the SAME
+ * bytes the Node codec, backend, JVM harness, and Android test use) verifies with
+ * `SecKeyVerifySignature(.rsaSignatureMessagePKCS1v15SHA256)` and the SPKI→PKCS#1
+ * import path, and that tampering / unknown keys / downgrades are rejected.
+ *
+ * ⚪ Not run in this workspace (no macOS toolchain). Add this file to the host
+ * app's iOS unit-test target and run:  xcodebuild test -scheme <App> -destination
+ * 'platform=iOS Simulator,name=iPhone 15'. Constants are copied verbatim from
+ * fixtures/vectors/full.json.
+ */
+final class ScaleBunOtaVerifierTests: XCTestCase {
+
+    private let signedPayloadB64 =
+        "U0JPVEEwMDEAAQAAABRTQi1PVEEtUlNBLVNIQTI1Ni1WMQAAAAdTSEEtMjU2AAAAFXRlc3QtcnNhLTMwNzItMjAyNi0wMQAAAA5wcm9qX3Rlc3RfMDAwMQAAABVvcmcuc2NhbGVidW4ubGVnYXJhZ2UAAAANcmVsX2Z1bGxfMDAwMQAAAA5ibmRsX2Z1bGxfMDAwMQAAAAdhbmRyb2lkAAAABGZ1bGwAAAAFNC41LjkAAAAGMC43NC4xAAAAAjI0AAAAAAAAACoAAAAAaVW5AAAAAAAAAAAAAAAAAAAAAWD6bpV7WCc0zBI9NJ6rivyixtOu66jZ7EYSJniR99yQMwAAAAAAAAAA+m6Ve1gnNMwSPTSeq4r8osbTruuo2exGEiZ4kffckDM="
+    private let signatureB64 =
+        "jlC7GRLWKXku3cbqtODlFt+qn2CEmS3oHOr9QTopCCzEovUF5a2GRT0PQ5k2C5EX7UGGO0Sv6/WhkznKR9NVEZl6ed0KARHAY8zfwTjin3czx9jpwV9bfsLlxEoKNo9bPfIs3mc0VoHCWOp95hQAotG+GqEwYsXqPruZ43U87qWT0t9/a3QboX+07hPO5vI4fDZQuPeo3W1HmXPKbOB7QGSijtKgKwQNuJHz+etsVsQelDsDofRSpYV92XCheUWWHP7kZKFOCcYUXnVwJcdU0Jhej+22vAESRK2G0CXP3orXE4pASaA3y4wkBQgJAJkcTN/ic1/Wm5BLo7KH+ypK1eo0hnrrLNSh6E+St5NvxlTM3bmxwnwHkPMYVBuOT0fUJy+gbD1/1CPvKakL12vizKwWDYuhfcIGkQUTvP2zCxcqWLfmZ7ZGo6n6WXMX63Vz+IQG0tnx1cp6YqJVIgxqjskQ47sacsfS9QeV5LyJhvBQrDSbpqujo9la8dDzZfDN"
+    private let keyId = "test-rsa-3072-2026-01"
+    private let projectId = "proj_test_0001"
+    private let applicationId = "org.scalebun.legarage"
+
+    private let spkiPem = """
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAt3tfFTPE+lkEbFeYi6zE
++uI+3oJl0HfKtGTh7sr7pSh/uPJq2giF0Uc09ux3Z0i4NlqpOyLmiIrVOgYcWcN+
+/pCl1mh6VmT7nYO3sEhL+HyaIaclCGxvHCJSsaVHH8qQyiCVUypWWKN0L38U4isN
+dJ2x+Wv7iLSZu3oM+ZDyGWCjRLE49jKNl0tfaQX6G1YoyBi1aEu5sWIQ6LjGE4IX
+1AJtOiNoaO9orjVgphA5FDKFFqguhEJrHoSXt3awHaeCYFm/mt+NI6k4sRf59UNx
+hdGh0kVL/6jZncclxueFafOOdfPf+jF3ylTczQhnID7Mg1PdmjXR7cfq7jDdjzfW
+VICJqGt+EhUd92pWrMTa5k3SDin3EetYGJsN7iKLbAl0D6Uy8RfE2mdsF2K6D3EP
+9waHN7vLURCF//TGy84FxPy7vbFgLO4oT07lxaopuGX7vOdONI8qLcFhEAJ9fRVN
+lqPWQGib0iAKE+gLl4CWZen674QZF39fGnOBEz7JsmDfAgMBAAE=
+-----END PUBLIC KEY-----
+"""
+
+    private func registry() throws -> ScaleBunOtaKeyRegistry {
+        let json = "{\"projectId\":\"\(projectId)\",\"keys\":[{\"keyId\":\"\(keyId)\",\"publicKey\":\"\(spkiPem.replacingOccurrences(of: "\n", with: "\\n"))\"}]}"
+        return try ScaleBunOtaKeyRegistry.fromJson(json)
+    }
+
+    private func context(_ currentSequence: Int64 = 0) -> ExpectedContext {
+        ExpectedContext(projectId: projectId, applicationId: applicationId,
+                        currentSequence: currentSequence, nowEpochSeconds: 1_767_225_660)
+    }
+
+    private func envelope(payload: String? = nil, sig: String? = nil) -> String {
+        "{\"protocol\":\"\(OtaProtocol.signatureAlgorithm)\",\"keyId\":\"\(keyId)\"," +
+        "\"signedPayload\":\"\(payload ?? signedPayloadB64)\",\"signature\":\"\(sig ?? signatureB64)\"}"
+    }
+
+    func testGenuineReleaseVerifies() throws {
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: context(), registry: try registry())
+        XCTAssertTrue(v.ok, "expected ok, got \(String(describing: v.code))")
+        XCTAssertEqual(v.payload?.bundleId, "bndl_full_0001")
+        XCTAssertEqual(v.payload?.releaseSequence, 42)
+        XCTAssertEqual(v.payload?.platform, "android") // vector is an android full release
+        XCTAssertEqual(v.payload?.artifactSha256, v.payload?.resultArtifactSha256)
+    }
+
+    func testPlatformMismatchRejected() throws {
+        // Device context is iOS by default; the vector payload is android.
+        var ctx = context(); ctx.platform = "ios"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: ctx, registry: try registry())
+        XCTAssertEqual(v.code, .PLATFORM_MISMATCH)
+    }
+
+    func testTamperedPayloadRejected() throws {
+        let bad = String(signedPayloadB64.dropLast(2)) + (signedPayloadB64.hasSuffix("M=") ? "N=" : "M=")
+        var ctx = context(); ctx.platform = "android"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(payload: bad), expected: ctx, registry: try registry())
+        XCTAssertFalse(v.ok)
+        XCTAssertTrue(v.code == .INVALID_SIGNATURE || v.code == .INVALID_BASE64)
+    }
+
+    func testUnknownKeyRejected() throws {
+        let empty = try ScaleBunOtaKeyRegistry.fromJson("{\"projectId\":\"\(projectId)\",\"keys\":[]}")
+        var ctx = context(); ctx.platform = "android"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: ctx, registry: empty)
+        XCTAssertEqual(v.code, .UNKNOWN_KEY_ID)
+    }
+
+    func testDowngradeRejected() throws {
+        var ctx = context(100); ctx.platform = "android"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: ctx, registry: try registry())
+        XCTAssertEqual(v.code, .RELEASE_DOWNGRADE_REJECTED)
+    }
+}

package/lib/commonjs/core/config/schema.js

@@ -291,18 +291,9 @@ const SHAPE = {
         kind: 'str',
         opt: true
       },
-      publicSigningKey: {
-        kind: 'str',
-        opt: true
-      },
-      // Rotation support: several pinned keys, any of which may verify a
-      // bundle. Ship a build pinning [old, new], re-sign server-side with
-      // new, drop old next release — no emergency store submission when a
-      // key must be replaced. Merged with publicSigningKey by the facade.
-      publicSigningKeys: {
-        kind: 'strArr',
-        opt: true
-      },
+      // No signing-key fields: signed releases are verified natively against
+      // RSA keys embedded in the app package (SB-OTA-RSA-SHA256-V1). JS must
+      // not supply a trusted key.
       mandatoryBlocksUi: bool(false)
     }
   }

package/lib/commonjs/core/constants/version.js

@@ -14,5 +14,5 @@ exports.SDK_VERSION = void 0;
  * value, so a stale one makes a rollout unobservable — which is the exact problem sending an SDK
  * version was introduced to solve.
  */
-const SDK_VERSION = exports.SDK_VERSION = '1.13.0';
+const SDK_VERSION = exports.SDK_VERSION = '2.0.0';
 //# sourceMappingURL=version.js.map

package/lib/commonjs/features/network/NetworkFeature.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.NetworkFeature = void 0;
 var _index = require("./index");
+var _thirdParty = require("./thirdParty");
 var _networkAdapter = require("../replay/integrations/network/networkAdapter");
 var _SessionManager = require("../session/SessionManager");
 var _screenTracking = require("../../debug/screenTracking");
@@ -50,12 +51,28 @@ class NetworkFeature {
       // self-capture loop. Apply the SAME isSdkInternalUrl filter the replay
       // branch below already uses so genuine app requests still flow through.
       const isInternal = isSdkInternalUrl(data.url, this.options.sdkBaseUrl);
-      if (!isInternal) {
+      /**
+       * Beacons and denied URLs leave NO trace, in any lane.
+       *
+       * A network request reaches three places from here: the analytics echo
+       * (`$network_request`), the local replay pipeline, and the backend network endpoint
+       * that becomes the `network_requests` row the session panel renders. Filtering one
+       * and not the others is how a request half-disappears and two counts of the same
+       * call stop agreeing -- so this is applied to all three.
+       *
+       * Kept separate from `isInternal` rather than folded into it: the SDK's own uploads
+       * are already excluded from two of the three lanes and DELIBERATELY still reach the
+       * local replay pipeline. Widening that here would be an unrelated behaviour change
+       * riding along on a filter.
+       */
+      const isBeaconOrDenied = this.options.captureThirdParty !== true && (0, _thirdParty.isThirdPartyBeacon)(data.url, this.options.thirdPartyHosts) || matchesDenyUrl(data.url, this.options.denyUrls);
+      const isExcluded = isInternal || isBeaconOrDenied;
+      if (!isExcluded) {
         this.trackFn('$network_request', data);
       }
 
       // Bridge the raw network event into the Session Replay pipeline
-      if (data.type === 'network') {
+      if (data.type === 'network' && !isBeaconOrDenied) {
         (0, _networkAdapter.reportNetworkRequest)({
           method: data.method,
           url: data.url,
@@ -78,8 +95,10 @@ class NetworkFeature {
         // (correlated by sessionId+timestamp), so we no longer emit
         // NETWORK_REQUEST_* replay events here (that produced duplicate rows
         // and count divergence between replay_events and network_requests).
-        // Skip SDK's own upload calls to prevent recursive event spam.
-        if (!isInternal) {
+        // Skip SDK's own upload calls to prevent recursive event spam, and anything the
+        // beacon/denyUrls filter excluded -- this is the lane that becomes the
+        // network_requests row a person sees on the session panel.
+        if (!isExcluded) {
           const sessionManager = _SessionManager.SessionManager.getExistingInstance();
           if (sessionManager) {
             const backendTransport = sessionManager.getBackendTransport();
@@ -113,9 +132,24 @@ class NetworkFeature {
   }
 }
 
+/**
+ * Substring or RegExp, the same rule as the web SDK's `matchUrl`.
+ *
+ * Spelled out rather than shared because the two SDKs have no common runtime package, and the
+ * rule is two lines. What must NOT differ is the beacon list, which is why that one is a
+ * byte-identical vendored copy with a hash gate rather than a retyped constant.
+ */
+exports.NetworkFeature = NetworkFeature;
+function matchesDenyUrl(url, patterns) {
+  if (!patterns || !patterns.length || !url) return false;
+  for (const p of patterns) {
+    if (typeof p === 'string' ? url.includes(p) : p.test(url)) return true;
+  }
+  return false;
+}
+
 // Returns true if the URL is a ScaleBun SDK internal endpoint that must not be
 // captured — doing so would cause recursive network event spam.
-exports.NetworkFeature = NetworkFeature;
 function isSdkInternalUrl(url, sdkBaseUrl) {
   if (!url) return false;
   try {

package/lib/commonjs/features/network/thirdParty.js

@@ -0,0 +1,90 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.THIRD_PARTY_BEACON_HOSTS = void 0;
+exports.isThirdPartyBeacon = isThirdPartyBeacon;
+/**
+ * THIRD-PARTY BEACON HOSTS — the one list, and the one matcher, for every layer that drops them.
+ *
+ * WHAT THIS IS FOR
+ * A session on an instrumented site spends most of its network tab on traffic the app did not
+ * meaningfully make: analytics collectors, ad pixels, IP-enrichment calls, tag managers. It is
+ * captured, uploaded, stored and rendered, and none of it answers a question anyone asks a session
+ * replay. One real sign-in screen was 27 requests, most of them beacons.
+ *
+ * It is not only clutter. Session health scores `failedRequests` and `slowRequests`, so a tracker
+ * killed by an ad blocker (a transport error) or one that is simply slow moves a number that is
+ * supposed to describe the APP. That is the part that makes this a correctness fix rather than a
+ * tidy-up.
+ *
+ * WHY HOSTS ONLY, NEVER PATHS
+ * The obvious rules from looking at a network tab are `/collect`, `/p`, `/api/v2/pixel`. Every one
+ * of them is a path that a customer's own API is allowed to have, and dropping a real API call is
+ * far worse than keeping a beacon: the noise is visible and annoying, the missing request is
+ * invisible and misleading. So matching is on the HOSTNAME, with a dot boundary, and a request to
+ * `/collect` on the app's own origin is kept — correctly.
+ *
+ * WHY IT IS A SUFFIX LIST AND NOT A REGEX
+ * Two reasons, both practical. It is applied inside an SDK whose eager bundle is measured in bytes,
+ * and a comma-joined string of suffixes compresses to almost nothing next to an equivalent pattern
+ * source. And it has to be COPIED, byte for byte, into the React Native SDK and into the backend's
+ * ingest path — a list with no syntax is a list that cannot drift in meaning between three
+ * languages' worth of tooling. `third-party:parity` hashes all three copies.
+ *
+ * ZERO IMPORTS, DELIBERATELY. That is what makes the byte-identical copy possible. If an edit here
+ * ever needs an import, the parity gate is the thing that will say so — keep the module pure rather
+ * than weakening the gate.
+ *
+ * WHAT IS DELIBERATELY NOT ON THE LIST
+ * The rule is: a host whose ONLY purpose is to receive telemetry. Everything else stays, because a
+ * dropped request is invisible and a kept one is merely noisy.
+ *
+ *   - Feature-flag and experiment services (LaunchDarkly, Optimizely, Split). Their RESPONSES
+ *     change what the app does, so a failed flag fetch is an application incident and the single
+ *     most useful request in the session.
+ *   - Chat and support widgets (Intercom, Zendesk, Drift). A broken widget is a broken feature the
+ *     user can see.
+ *   - `facebook.com` as a whole. `graph.facebook.com` is an API real apps call; only the pixel
+ *     delivery hosts are listed.
+ *   - CDNs of any kind, even ones that mostly serve tags: they also serve application assets, and
+ *     dropping them would hide a real asset failure.
+ *
+ * When in doubt, leave it out. `denyUrls` stays the per-app escape hatch in both SDKs, and it can
+ * do what this list will not.
+ */
+
+/**
+ * Known telemetry, advertising and enrichment endpoints, as hostname suffixes.
+ *
+ * One comma-joined string rather than an array: identical meaning, materially smaller once gzipped,
+ * and it keeps the copy in three repos a single line to compare by eye.
+ */
+const THIRD_PARTY_BEACON_HOSTS = exports.THIRD_PARTY_BEACON_HOSTS = 'google-analytics.com,googletagmanager.com,analytics.google.com,doubleclick.net,googlesyndication.com,' + 'googleadservices.com,app-measurement.com,facebook.net,analytics.tiktok.com,' + 'ads-twitter.com,analytics.twitter.com,ct.pinterest.com,bat.bing.com,px.ads.linkedin.com,tr.snapchat.com,' + 'criteo.com,criteo.net,taboola.com,outbrain.com,adroll.com,adsrvr.org,quantserve.com,scorecardresearch.com,' + 'hotjar.com,hotjar.io,clarity.ms,fullstory.com,mouseflow.com,crazyegg.com,luckyorange.com,inspectlet.com,' + 'segment.io,mixpanel.com,amplitude.com,heap.io,heapanalytics.com,rudderstack.com,posthog.com,' + 'matomo.cloud,plausible.io,simpleanalytics.com,statcounter.com,' + 'appsflyer.com,adjust.com,branch.io,' + 'ipify.org,ipinfo.io,ipapi.co,ip-api.com,geolocation-db.com,cloudflareinsights.com,' + 'nr-data.net,browser-intake-datadoghq.com,sentry.io,bugsnag.com,rollbar.com';
+
+/**
+ * True when `url` is addressed to a known beacon host.
+ *
+ * Deliberately total: an unparseable or relative URL is NOT third party. A relative URL is
+ * same-origin by definition — the app's own call — and guessing on garbage input would drop real
+ * requests for no benefit.
+ */
+function isThirdPartyBeacon(url, hosts) {
+  if (!url) return false;
+  let host = '';
+  try {
+    // A relative URL throws here, which is the answer we want: it is first-party.
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  for (const suffix of (hosts ?? THIRD_PARTY_BEACON_HOSTS).split(',')) {
+    // Dot boundary, so `notevil-facebook.com` does not match `facebook.com` while
+    // `connect.facebook.com` does. The bare-equality arm covers the apex domain itself.
+    if (host === suffix || host.endsWith('.' + suffix)) return true;
+  }
+  return false;
+}
+//# sourceMappingURL=thirdParty.js.map