@scalebun/react-native 1.13.0 → 2.0.0

package/src/core/config/schema.ts

@@ -201,12 +201,9 @@ const SHAPE: Record<string, Field> = {
             enabled: bool(false),
             checkOnForeground: bool(true),
             channelOverride: { kind: 'str', opt: true },
-            publicSigningKey: { kind: 'str', opt: true },
-            // Rotation support: several pinned keys, any of which may verify a
-            // bundle. Ship a build pinning [old, new], re-sign server-side with
-            // new, drop old next release — no emergency store submission when a
-            // key must be replaced. Merged with publicSigningKey by the facade.
-            publicSigningKeys: { kind: 'strArr', opt: true },
+            // No signing-key fields: signed releases are verified natively against
+            // RSA keys embedded in the app package (SB-OTA-RSA-SHA256-V1). JS must
+            // not supply a trusted key.
             mandatoryBlocksUi: bool(false),
         },
     },
@@ -405,9 +402,6 @@ export interface ScaleBunConfig {
         enabled: boolean;
         checkOnForeground: boolean;
         channelOverride?: string;
-        publicSigningKey?: string;
-        /** Additional pinned keys for rotation; unioned with publicSigningKey. */
-        publicSigningKeys?: string[];
         mandatoryBlocksUi: boolean;
     };
 }

package/src/core/constants/version.ts

@@ -8,4 +8,4 @@
  * value, so a stale one makes a rollout unobservable — which is the exact problem sending an SDK
  * version was introduced to solve.
  */
-export const SDK_VERSION = '1.13.0';
+export const SDK_VERSION = '2.0.0';

package/src/features/network/NetworkFeature.ts

@@ -25,6 +25,7 @@
 
 import type { IFeature, FeatureContext } from '../../core/contracts/IFeature';
 import { installNetworkMonitoring, type NetworkMonitoringOptions } from './index';
+import { isThirdPartyBeacon } from './thirdParty';
 import { reportNetworkRequest } from '../replay/integrations/network/networkAdapter';
 import { SessionManager } from '../session/SessionManager';
 import { getTrackedScreen } from '../../debug/screenTracking';
@@ -53,13 +54,32 @@ export class NetworkFeature implements IFeature {
             // self-capture loop. Apply the SAME isSdkInternalUrl filter the replay
             // branch below already uses so genuine app requests still flow through.
             const isInternal = isSdkInternalUrl(data.url, this.options.sdkBaseUrl);
+            /**
+             * Beacons and denied URLs leave NO trace, in any lane.
+             *
+             * A network request reaches three places from here: the analytics echo
+             * (`$network_request`), the local replay pipeline, and the backend network endpoint
+             * that becomes the `network_requests` row the session panel renders. Filtering one
+             * and not the others is how a request half-disappears and two counts of the same
+             * call stop agreeing -- so this is applied to all three.
+             *
+             * Kept separate from `isInternal` rather than folded into it: the SDK's own uploads
+             * are already excluded from two of the three lanes and DELIBERATELY still reach the
+             * local replay pipeline. Widening that here would be an unrelated behaviour change
+             * riding along on a filter.
+             */
+            const isBeaconOrDenied =
+                (this.options.captureThirdParty !== true &&
+                    isThirdPartyBeacon(data.url, this.options.thirdPartyHosts)) ||
+                matchesDenyUrl(data.url, this.options.denyUrls);
+            const isExcluded = isInternal || isBeaconOrDenied;
 
-            if (!isInternal) {
+            if (!isExcluded) {
                 this.trackFn('$network_request', data);
             }
 
             // Bridge the raw network event into the Session Replay pipeline
-            if (data.type === 'network') {
+            if (data.type === 'network' && !isBeaconOrDenied) {
                 reportNetworkRequest({
                     method: data.method,
                     url: data.url,
@@ -82,8 +102,10 @@ export class NetworkFeature implements IFeature {
                 // (correlated by sessionId+timestamp), so we no longer emit
                 // NETWORK_REQUEST_* replay events here (that produced duplicate rows
                 // and count divergence between replay_events and network_requests).
-                // Skip SDK's own upload calls to prevent recursive event spam.
-                if (!isInternal) {
+                // Skip SDK's own upload calls to prevent recursive event spam, and anything the
+                // beacon/denyUrls filter excluded -- this is the lane that becomes the
+                // network_requests row a person sees on the session panel.
+                if (!isExcluded) {
                     const sessionManager = SessionManager.getExistingInstance();
                     if (sessionManager) {
                         const backendTransport = sessionManager.getBackendTransport();
@@ -119,6 +141,21 @@ export class NetworkFeature implements IFeature {
     }
 }
 
+/**
+ * Substring or RegExp, the same rule as the web SDK's `matchUrl`.
+ *
+ * Spelled out rather than shared because the two SDKs have no common runtime package, and the
+ * rule is two lines. What must NOT differ is the beacon list, which is why that one is a
+ * byte-identical vendored copy with a hash gate rather than a retyped constant.
+ */
+function matchesDenyUrl(url: string, patterns?: (string | RegExp)[]): boolean {
+    if (!patterns || !patterns.length || !url) return false;
+    for (const p of patterns) {
+        if (typeof p === 'string' ? url.includes(p) : p.test(url)) return true;
+    }
+    return false;
+}
+
 // Returns true if the URL is a ScaleBun SDK internal endpoint that must not be
 // captured — doing so would cause recursive network event spam.
 function isSdkInternalUrl(url: string, sdkBaseUrl?: string): boolean {

package/src/features/network/index.ts

@@ -18,6 +18,24 @@ export interface NetworkMonitoringOptions {
     redactNetwork?: boolean;
     /** SDK backend base URL — used to filter out SDK's own upload calls from capture */
     sdkBaseUrl?: string;
+    /**
+     * Never capture requests whose URL matches (substring or RegExp).
+     *
+     * Parity with the web SDK, which has had this since F-NET. Mobile had no way to exclude a
+     * URL at all, so an app that wanted one endpoint out of its replays had no answer.
+     */
+    denyUrls?: (string | RegExp)[];
+    /**
+     * Keep known telemetry beacons: analytics collectors, ad pixels, IP-enrichment calls.
+     *
+     * Default false — they are dropped before capture. They are not the app, they cost the
+     * device real battery and cellular data to upload, and a beacon that fails counts against
+     * the SESSION HEALTH score. Matching is by hostname only, never by path, so an app route
+     * called /collect is never touched. See features/network/thirdParty.ts.
+     */
+    captureThirdParty?: boolean;
+    /** Replace the built-in beacon host list wholesale. Comma-joined hostname suffixes. */
+    thirdPartyHosts?: string;
 }
 
 export function installNetworkMonitoring(

package/src/features/network/thirdParty.ts

@@ -0,0 +1,92 @@
+/**
+ * THIRD-PARTY BEACON HOSTS — the one list, and the one matcher, for every layer that drops them.
+ *
+ * WHAT THIS IS FOR
+ * A session on an instrumented site spends most of its network tab on traffic the app did not
+ * meaningfully make: analytics collectors, ad pixels, IP-enrichment calls, tag managers. It is
+ * captured, uploaded, stored and rendered, and none of it answers a question anyone asks a session
+ * replay. One real sign-in screen was 27 requests, most of them beacons.
+ *
+ * It is not only clutter. Session health scores `failedRequests` and `slowRequests`, so a tracker
+ * killed by an ad blocker (a transport error) or one that is simply slow moves a number that is
+ * supposed to describe the APP. That is the part that makes this a correctness fix rather than a
+ * tidy-up.
+ *
+ * WHY HOSTS ONLY, NEVER PATHS
+ * The obvious rules from looking at a network tab are `/collect`, `/p`, `/api/v2/pixel`. Every one
+ * of them is a path that a customer's own API is allowed to have, and dropping a real API call is
+ * far worse than keeping a beacon: the noise is visible and annoying, the missing request is
+ * invisible and misleading. So matching is on the HOSTNAME, with a dot boundary, and a request to
+ * `/collect` on the app's own origin is kept — correctly.
+ *
+ * WHY IT IS A SUFFIX LIST AND NOT A REGEX
+ * Two reasons, both practical. It is applied inside an SDK whose eager bundle is measured in bytes,
+ * and a comma-joined string of suffixes compresses to almost nothing next to an equivalent pattern
+ * source. And it has to be COPIED, byte for byte, into the React Native SDK and into the backend's
+ * ingest path — a list with no syntax is a list that cannot drift in meaning between three
+ * languages' worth of tooling. `third-party:parity` hashes all three copies.
+ *
+ * ZERO IMPORTS, DELIBERATELY. That is what makes the byte-identical copy possible. If an edit here
+ * ever needs an import, the parity gate is the thing that will say so — keep the module pure rather
+ * than weakening the gate.
+ *
+ * WHAT IS DELIBERATELY NOT ON THE LIST
+ * The rule is: a host whose ONLY purpose is to receive telemetry. Everything else stays, because a
+ * dropped request is invisible and a kept one is merely noisy.
+ *
+ *   - Feature-flag and experiment services (LaunchDarkly, Optimizely, Split). Their RESPONSES
+ *     change what the app does, so a failed flag fetch is an application incident and the single
+ *     most useful request in the session.
+ *   - Chat and support widgets (Intercom, Zendesk, Drift). A broken widget is a broken feature the
+ *     user can see.
+ *   - `facebook.com` as a whole. `graph.facebook.com` is an API real apps call; only the pixel
+ *     delivery hosts are listed.
+ *   - CDNs of any kind, even ones that mostly serve tags: they also serve application assets, and
+ *     dropping them would hide a real asset failure.
+ *
+ * When in doubt, leave it out. `denyUrls` stays the per-app escape hatch in both SDKs, and it can
+ * do what this list will not.
+ */
+
+/**
+ * Known telemetry, advertising and enrichment endpoints, as hostname suffixes.
+ *
+ * One comma-joined string rather than an array: identical meaning, materially smaller once gzipped,
+ * and it keeps the copy in three repos a single line to compare by eye.
+ */
+export const THIRD_PARTY_BEACON_HOSTS =
+  'google-analytics.com,googletagmanager.com,analytics.google.com,doubleclick.net,googlesyndication.com,' +
+  'googleadservices.com,app-measurement.com,facebook.net,analytics.tiktok.com,' +
+  'ads-twitter.com,analytics.twitter.com,ct.pinterest.com,bat.bing.com,px.ads.linkedin.com,tr.snapchat.com,' +
+  'criteo.com,criteo.net,taboola.com,outbrain.com,adroll.com,adsrvr.org,quantserve.com,scorecardresearch.com,' +
+  'hotjar.com,hotjar.io,clarity.ms,fullstory.com,mouseflow.com,crazyegg.com,luckyorange.com,inspectlet.com,' +
+  'segment.io,mixpanel.com,amplitude.com,heap.io,heapanalytics.com,rudderstack.com,posthog.com,' +
+  'matomo.cloud,plausible.io,simpleanalytics.com,statcounter.com,' +
+  'appsflyer.com,adjust.com,branch.io,' +
+  'ipify.org,ipinfo.io,ipapi.co,ip-api.com,geolocation-db.com,cloudflareinsights.com,' +
+  'nr-data.net,browser-intake-datadoghq.com,sentry.io,bugsnag.com,rollbar.com';
+
+/**
+ * True when `url` is addressed to a known beacon host.
+ *
+ * Deliberately total: an unparseable or relative URL is NOT third party. A relative URL is
+ * same-origin by definition — the app's own call — and guessing on garbage input would drop real
+ * requests for no benefit.
+ */
+export function isThirdPartyBeacon(url: string, hosts?: string): boolean {
+  if (!url) return false;
+  let host = '';
+  try {
+    // A relative URL throws here, which is the answer we want: it is first-party.
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  for (const suffix of (hosts ?? THIRD_PARTY_BEACON_HOSTS).split(',')) {
+    // Dot boundary, so `notevil-facebook.com` does not match `facebook.com` while
+    // `connect.facebook.com` does. The bare-equality arm covers the apex domain itself.
+    if (host === suffix || host.endsWith('.' + suffix)) return true;
+  }
+  return false;
+}

package/src/features/ota/OtaOrchestrator.ts

@@ -14,7 +14,6 @@ import { otaEventEmitter } from './OtaEventEmitter';
 import { getDeviceCountry, prefetchDeviceCountry } from './geoCountry';
 import { deviceTargetingAttributes } from './deviceAttributes';
 import { resolveInstallationId } from '../../core/id/installationId';
-import { verifyBundleSignature, type SignatureConfig } from './signature';
 import { detectOtaEnvironment, type OtaEnvironment } from './environment';
 import { retryWithBackoff, isRetryableNetworkError, HttpStatusError } from './retry';
 import { createStorageBackend, type StorageBackend } from '../../storage/StorageBackend';
@@ -191,7 +190,6 @@ export class OtaOrchestrator {
   private isRestartRequiredState = false;
   private healthyTimer: ReturnType<typeof setTimeout> | null = null;
   private bootGuardConfig: BootGuardConfig = {};
-  private signatureConfig: SignatureConfig | undefined;
   private environment: OtaEnvironment | null = null;
   /** One-time boot checks have run in this process (init is idempotent). */
   private initialized = false;
@@ -200,11 +198,12 @@ export class OtaOrchestrator {
   /**
    * Initialize the orchestrator. Checks for boot-guard recovery state.
    *
-   * `signature` is optional: an app that has not adopted signing keeps working
-   * on SHA-256 integrity alone. Once a public key IS configured, a bundle that
-   * cannot be verified is refused rather than installed (OTA-03).
+   * Signature enforcement is no longer a JS concern: signed releases are
+   * verified and staged in NATIVE code against RSA keys embedded in the app
+   * package (SB-OTA-RSA-SHA256-V1), and unsigned releases keep working on
+   * SHA-256 integrity alone. There is nothing for the host to configure here.
    */
-  init(config?: BootGuardConfig & { signature?: SignatureConfig }): void {
+  init(config?: BootGuardConfig): void {
     noThrow(() => {
       // Idempotent: init() runs its one-time checks ONCE per process. Found
       // live — a host that calls init() again after installing an update (any
@@ -215,7 +214,6 @@ export class OtaOrchestrator {
       // them. Config is still refreshed so late signature setup works.
       if (this.initialized) {
         this.bootGuardConfig = config ?? this.bootGuardConfig;
-        this.signatureConfig = config?.signature ?? this.signatureConfig;
         return;
       }
 
@@ -259,7 +257,6 @@ export class OtaOrchestrator {
       this.initialized = true;
       this.enabled = true;
       this.bootGuardConfig = config ?? {};
-      this.signatureConfig = config?.signature;
       __DEV__ && logger.debug(
         `[OTA] Orchestrator initialized (RN ${this.environment.rnVersionString ?? 'unknown'}` +
           `${this.environment.bridgeless ? ', bridgeless' : ''}` +
@@ -595,12 +592,27 @@ export class OtaOrchestrator {
       // OTA has no bundle for a non-mobile target; claiming Android there would install the wrong one.
       const mobileOS = resolveMobileOS();
       if (!mobileOS) throw new Error('OTA is not supported on this platform');
+      // SDK trust coverage (CICDPAGE §12): report which trusted key IDs are
+      // embedded in this binary so the dashboard can measure key-rotation
+      // adoption. Telemetry only — the server never trusts a key a device claims.
+      // Defensive: optional native method, never let it break a check.
+      let trustedKeyIds: string[] | undefined;
+      try {
+        const raw = NativeScaleBunOta?.getTrustedKeyIds?.();
+        if (raw) {
+          const arr = JSON.parse(raw);
+          if (Array.isArray(arr) && arr.length) trustedKeyIds = arr.slice(0, 16);
+        }
+      } catch {
+        /* trust reporting is best-effort — never break the update check */
+      }
       const payload: OtaCheckRequest = {
         appVersion: requestParams.appVersion,
         platform: mobileOS,
         installationId: requestParams.installationId,
         currentBundleId: this.currentBundle?.id,
         currentBundleHash: this.currentBundle?.sha256,
+        trustedKeyIds,
         channelName: requestParams.channelName,
         // Host-supplied country wins; otherwise the cached edge-Worker lookup
         // fills in (see geoCountry.ts). Undefined when neither knows — the
@@ -747,29 +759,12 @@ export class OtaOrchestrator {
         version: bundle.version,
       });
 
-      // ── VERIFY AUTHENTICITY (OTA-03) ─────────────────────────────────────
-      // Before anything touches the disk. SHA-256 proves the bytes arrived
-      // intact; only the signature proves they came from you. Checking after
-      // staging would mean writing unverified code to the slot directory first.
-      const signatureOutcome = await verifyBundleSignature(
-        bundle.sha256,
-        bundle.signature,
-        this.signatureConfig,
-      );
-      if (!signatureOutcome.ok) {
-        otaEventEmitter.emitSimple('APPLY_FAILED', bundle.id, {
-          releaseId: bundle.releaseId,
-          error: `Signature check failed: ${signatureOutcome.reason}`,
-          version: bundle.version,
-        });
-        return {
-          status: 'ERROR',
-          error: `Bundle signature check failed (${signatureOutcome.reason})`,
-          bundle,
-        };
-      }
-
       // ── DOWNLOAD ─────────────────────────────────────────────────────────
+      // Authenticity is enforced NATIVELY now (see the envelope branch below):
+      // SHA-256 proves the bytes arrived intact, and for signed releases the
+      // RSA signature — checked in native code against keys embedded in the app
+      // package — proves they came from you. JS neither pins keys nor verifies
+      // signatures.
       otaEventEmitter.emitSimple('DOWNLOAD_STARTED', bundle.id, {
         releaseId: bundle.releaseId,
         version: bundle.version,
@@ -824,51 +819,102 @@ export class OtaOrchestrator {
 
       let staged = false;
 
-      // Sprint 7: Try patch first if offered, fall back to full bundle
-      if (bundle.patch && NativeScaleBunOta.stagePatch) {
-        __DEV__ && logger.debug(
-          `[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ` +
-            `${(bundle.size / 1024).toFixed(0)} KB full) — trying patch…`,
-        );
+      if (bundle.envelope) {
+        // ── NATIVE-ENFORCED VERIFY + STAGE (SB-OTA-RSA-SHA256-V1) ───────────
+        // Hand the whole envelope to native code, which verifies the RSA
+        // signature against the keys EMBEDDED in the app package, then downloads
+        // the artifact, enforces the SIGNED size + SHA-256, and stages it into
+        // the `next` slot — all outside JS. JavaScript never stages bytes it has
+        // not proven authentic. No patch path here: a signed offer is always a
+        // full verified download (native patch is a documented follow-up).
+        const envelopeJson = JSON.stringify({ ...bundle.envelope, downloadUrl: bundle.url });
+        let verdict: {
+          ok?: boolean;
+          code?: string;
+          message?: string;
+        };
         try {
-          staged = await NativeScaleBunOta.stagePatch(
-            bundle.patch.url,
-            bundle.patch.sha256,
-            bundle.sha256, // expected full-bundle hash after patching
+          const verdictJson = await NativeScaleBunOta.verifyAndStageRelease(envelopeJson);
+          verdict = JSON.parse(verdictJson);
+        } catch (err: any) {
+          // A rejected promise (or an unparseable verdict) is machinery failure,
+          // never a valid result — treat it as a hard failure.
+          verdict = { ok: false, code: 'verify_stage_threw', message: err?.message ?? String(err) };
+        }
+
+        if (!verdict.ok) {
+          unsubscribeProgress();
+          postProgress(0, 'FAILED');
+          logger.error(
+            `[OTA] Native verify/stage refused the release: ${verdict.code ?? 'unknown'}` +
+              `${verdict.message ? ` — ${verdict.message}` : ''}`,
           );
-          if (staged) {
-            patchUsed = true;
-            __DEV__ && logger.debug('[OTA] Patch applied successfully');
-          } else {
-            logger.warn('[OTA] Patch staging returned false — falling back to full bundle');
-          }
-        } catch (patchErr: any) {
-          logger.warn(`[OTA] Patch staging failed: ${patchErr.message} — falling back to full bundle`);
+          otaEventEmitter.emitSimple('APPLY_FAILED', bundle.id, {
+            releaseId: bundle.releaseId,
+            // `error` is mapped onto the wire `errorCode` by deliverOtaEvents —
+            // carry the stable native verdict code there.
+            error: verdict.code ?? 'verify_and_stage_release_failed',
+            version: bundle.version,
+          });
+          return {
+            status: 'ERROR',
+            error: `Release verification failed (${verdict.code ?? 'unknown'})`,
+            bundle,
+          };
         }
-      }
 
-      // Full-bundle fallback (or primary path when no patch is available).
-      // Retried with backoff: on a mobile network a transient drop mid-download
-      // is the common case, and previously one failure meant waiting for the
-      // next cold start — often hours away, sometimes never.
-      if (!staged) {
-        try {
-          staged = await retryWithBackoff(
-            async () => {
-              const ok = await NativeScaleBunOta!.stageBundle(bundle.url, bundle.sha256);
-              if (!ok) {
-                // Native returns a bare boolean, so a hash mismatch and a
-                // dropped connection are indistinguishable here. Retrying a
-                // genuine mismatch a couple of times is cheap; not retrying a
-                // dropped connection costs the whole update.
-                throw new Error('stageBundle returned false');
-              }
-              return ok;
-            },
-            { label: `download v${bundle.version}`, attempts: 3 },
+        staged = true;
+      } else {
+        // ── LEGACY / UNSIGNED (SHA-256 integrity only) ─────────────────────
+        // No envelope means the app embeds no trusted keys and the release is
+        // unsigned: keep the pre-RSA behaviour so those apps still update.
+
+        // Sprint 7: Try patch first if offered, fall back to full bundle
+        if (bundle.patch && NativeScaleBunOta.stagePatch) {
+          __DEV__ && logger.debug(
+            `[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ` +
+              `${(bundle.size / 1024).toFixed(0)} KB full) — trying patch…`,
           );
-        } catch {
-          staged = false;
+          try {
+            staged = await NativeScaleBunOta.stagePatch(
+              bundle.patch.url,
+              bundle.patch.sha256,
+              bundle.sha256, // expected full-bundle hash after patching
+            );
+            if (staged) {
+              patchUsed = true;
+              __DEV__ && logger.debug('[OTA] Patch applied successfully');
+            } else {
+              logger.warn('[OTA] Patch staging returned false — falling back to full bundle');
+            }
+          } catch (patchErr: any) {
+            logger.warn(`[OTA] Patch staging failed: ${patchErr.message} — falling back to full bundle`);
+          }
+        }
+
+        // Full-bundle fallback (or primary path when no patch is available).
+        // Retried with backoff: on a mobile network a transient drop mid-download
+        // is the common case, and previously one failure meant waiting for the
+        // next cold start — often hours away, sometimes never.
+        if (!staged) {
+          try {
+            staged = await retryWithBackoff(
+              async () => {
+                const ok = await NativeScaleBunOta!.stageBundle(bundle.url, bundle.sha256);
+                if (!ok) {
+                  // Native returns a bare boolean, so a hash mismatch and a
+                  // dropped connection are indistinguishable here. Retrying a
+                  // genuine mismatch a couple of times is cheap; not retrying a
+                  // dropped connection costs the whole update.
+                  throw new Error('stageBundle returned false');
+                }
+                return ok;
+              },
+              { label: `download v${bundle.version}`, attempts: 3 },
+            );
+          } catch {
+            staged = false;
+          }
         }
       }
 

package/src/features/ota/OtaTypes.ts

@@ -54,6 +54,11 @@ export interface OtaCheckRequest {
   installationId: string;
   currentBundleId?: string;
   currentBundleHash?: string;
+  /**
+   * Trusted key IDs embedded in this app binary, for SDK trust coverage
+   * (CICDPAGE §12). Telemetry only — never a source of server-side trust.
+   */
+  trustedKeyIds?: string[];
 
   // ── C1: channel + targeting context ────────────────────────────────────────
   // The backend DTO has accepted all of these since Sprint 9. The SDK declared
@@ -112,7 +117,24 @@ export interface OtaBundlePayload {
   url: string;         // presigned GET — short-TTL
   size: number;
   sha256: string;
-  signature?: string;  // ed25519 detached signature (hex)
+  signature?: string;  // ed25519 detached signature (hex) — legacy, unused by native RSA path
+  /**
+   * SB-OTA-RSA-SHA256-V1 release envelope. Present on signed releases; carries
+   * the protocol id, the id of the trusted RSA key the release was signed with,
+   * the canonical signed payload, and its signature. When present, the SDK hands
+   * the whole envelope to the native module (`verifyAndStageRelease`), which
+   * verifies the signature against the RSA public keys EMBEDDED in the app
+   * package and then downloads + integrity-checks + stages the artifact — JS
+   * never stages bytes it has not proven authentic, and never pins or verifies a
+   * key itself. Absent on legacy/unsigned releases, which fall back to
+   * `stageBundle` on SHA-256 integrity alone.
+   */
+  envelope?: {
+    protocol: string;
+    keyId: string;
+    signedPayload: string;
+    signature: string;
+  };
   isMandatory: boolean;
   /**
    * How to activate the bundle after install:

package/src/public/ScaleBunFacade.ts

@@ -275,17 +275,11 @@ class ScaleBunFacade {
     /**
      * Boot the OTA orchestrator when the init config asks for it.
      *
-     * `publicSigningKey` / `publicSigningKeys` are honoured here so signature
-     * enforcement is reachable from configuration alone. The list form exists
-     * for key ROTATION: a build pinning [old, new] keeps verifying while the
-     * server moves to the new key, so replacing a key never needs an emergency
-     * store release. Both fields merge (deduplicated) into one pinned set.
-     *
-     * Verification comes from `ota.verifySignature` when supplied, else the
-     * built-in @noble-based verifier (optional peers). Pinning keys with
-     * NEITHER available is fail-CLOSED by design (signature.ts) — an update
-     * that cannot be verified is not installed. We say that out loud rather
-     * than letting the app discover it as a silent no-update condition.
+     * Signature enforcement is no longer configured from JS. Signed releases are
+     * verified and staged in NATIVE code against RSA keys embedded in the app
+     * package (SB-OTA-RSA-SHA256-V1); unsigned releases keep working on SHA-256
+     * integrity. There are no signing-key or `verifySignature` options to pass
+     * through — the host embeds its trusted keys natively.
      */
     private _maybeStartOta(rawConfig: any): void {
         const ota = rawConfig?.ota;
@@ -295,38 +289,6 @@ class ScaleBunFacade {
             // module (or touch the native spec) at import time.
             // eslint-disable-next-line @typescript-eslint/no-var-requires
             const { otaOrchestrator } = require('../features/ota/OtaOrchestrator');
-            const rawSingle = ota.publicSigningKey;
-            const rawList = ota.publicSigningKeys;
-            const publicKeys = Array.from(
-                new Set(
-                    [
-                        ...(typeof rawSingle === 'string' && rawSingle ? [rawSingle] : []),
-                        ...(Array.isArray(rawList) ? rawList : []),
-                    ].filter((k: unknown): k is string => typeof k === 'string' && k.trim().length > 0),
-                ),
-            );
-            // Signing was REQUESTED if a usable key exists, or the host passed a
-            // keys array at all — an empty one included. `publicSigningKeys: []`
-            // is a broken attempt to enable signing, and it must flow through to
-            // signature.ts's fail-closed handling, not silently disable signing.
-            const signingRequested = publicKeys.length > 0 || Array.isArray(rawList);
-            const verifier = ota.verifySignature;
-            if (signingRequested && typeof verifier !== 'function') {
-                // A host verifier is optional since the built-in one landed — the
-                // old unconditional warning here told every correctly-configured
-                // app that its updates would be rejected. Warn only when neither
-                // verifier can actually be resolved.
-                // eslint-disable-next-line @typescript-eslint/no-var-requires
-                const { getBuiltinVerifier } = require('../features/ota/crypto/builtinVerifier');
-                if (!getBuiltinVerifier()) {
-                    logger.warn(
-                        '[ScaleBun] A signing key is pinned but no signature verifier is available. ' +
-                            'Signature checking is fail-closed: updates will be REJECTED until one exists. ' +
-                            'Install the optional peers `@noble/ed25519` + `@noble/hashes` (no further ' +
-                            'code needed), or supply `ota.verifySignature`.',
-                    );
-                }
-            }
             // `healthyAfterMs` is the field BootGuardConfig actually declares.
             // This passed `healthyTimeoutMs`, which nothing reads, so a host that
             // tuned the boot-guard window silently got the 10s default instead.
@@ -339,16 +301,6 @@ class ScaleBunFacade {
                       : undefined;
 
             otaOrchestrator.init({
-                ...(signingRequested
-                    ? {
-                          signature: {
-                              // Single key stays a plain string — the shape every
-                              // existing consumer and test already handles.
-                              publicKey: publicKeys.length === 1 ? publicKeys[0] : publicKeys,
-                              verifier,
-                          },
-                      }
-                    : {}),
                 ...(healthyAfterMs !== undefined ? { healthyAfterMs } : {}),
             });
             logger.info('[ScaleBun] OTA enabled from init config.');