@scalebun/react-native 1.13.0 → 2.0.1

package/dist/scalebun.full.js

@@ -89,9 +89,9 @@ var init_internalLogger = __esm({
       }
       /** Set level from the public string name used in config (e.g. 'warn'). */
       setLevelByName(name) {
-        const resolved3 = LEVEL_BY_NAME[name];
-        if (resolved3 !== void 0) {
-          this.level = resolved3;
+        const resolved = LEVEL_BY_NAME[name];
+        if (resolved !== void 0) {
+          this.level = resolved;
         }
       }
       /** Current numeric level — exposed for callers that branch on dev verbosity. */
@@ -605,7 +605,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "lib/module/core/constants/version.js"() {
     "use strict";
-    SDK_VERSION = "1.13.0";
+    SDK_VERSION = "2.0.1";
   }
 });
 
@@ -3461,6 +3461,15 @@ var init_AutoScreenDetector = __esm({
       _manualScreen = null;
       _manualScreenTs = 0;
       _autoScreen = null;
+      /**
+       * When `_autoScreen` was last written.
+       *
+       * Needed so `getCurrentScreen()` can prefer whichever source spoke MOST RECENTLY.
+       * Without a timestamp the only comparison available was "is the manual value still
+       * fresh", which is a different question and gave the wrong answer — see the note on
+       * `_currentScreen()`.
+       */
+      _autoScreenTs = 0;
       /** `name#key` of the last auto-detected screen VISIT — see _extractActiveVisit. */
       _autoVisitSig = null;
       _navigationRef = null;
@@ -3528,6 +3537,7 @@ var init_AutoScreenDetector = __esm({
           if (this.isManualScreenActive()) return;
           if (name !== this._autoScreen) {
             this._autoScreen = name;
+            this._autoScreenTs = Date.now();
             this._autoVisitSig = name;
             this._emitScreenChange(name, "heuristic");
           }
@@ -3535,8 +3545,19 @@ var init_AutoScreenDetector = __esm({
         }
       }
       /**
-       * Check if a manual screen is currently active.
-       * Used by auto-detection to yield to manual overrides.
+       * Should a WRITER defer to the manual screen right now?
+       *
+       * THIS IS A PRECEDENCE GATE, NOT A VALIDITY TEST, and conflating the two was a real
+       * bug. Its job is what the cooldown constant says: for a short window after a manual
+       * beacon fires, an auto source must not overwrite it — the poller runs every 1500 ms
+       * and would otherwise clobber a fresh declaration with whatever it inferred.
+       *
+       * `getCurrentScreen()` used to reuse this as "is the manual screen still the current
+       * screen", which made a declared screen READABLE for only 2000 ms. Nothing called
+       * `setManualScreen` in production, so the effect was latent — but the moment the
+       * `<ScaleBunScreen>` beacon was wired to it (RN-8), every tap more than two seconds
+       * after a screen mounted would have lost its name, which is very nearly every tap. A
+       * fix that introduced that would have been worse than the gap it closed.
        */
       isManualScreenActive() {
         if (!this._manualScreen) return false;
@@ -3582,6 +3603,7 @@ var init_AutoScreenDetector = __esm({
                       const visit = this._extractActiveVisit(state);
                       if (visit && this._visitSig(visit) !== this._autoVisitSig) {
                         this._autoScreen = visit.name;
+                        this._autoScreenTs = Date.now();
                         this._autoVisitSig = this._visitSig(visit);
                         this._emitScreenChange(visit.name, "navRef");
                       }
@@ -3600,6 +3622,7 @@ var init_AutoScreenDetector = __esm({
               const visit = this._extractActiveVisit(state);
               if (visit) {
                 this._autoScreen = visit.name;
+                this._autoScreenTs = Date.now();
                 this._autoVisitSig = this._visitSig(visit);
                 this._emitScreenChange(visit.name, "navRef");
               }
@@ -3630,6 +3653,7 @@ var init_AutoScreenDetector = __esm({
                 const visit = this._extractActiveVisit(state);
                 if (visit && this._visitSig(visit) !== this._autoVisitSig) {
                   this._autoScreen = visit.name;
+                  this._autoScreenTs = Date.now();
                   this._autoVisitSig = this._visitSig(visit);
                   this._emitScreenChange(visit.name, "heuristic");
                 }
@@ -3728,7 +3752,7 @@ var init_AutoScreenDetector = __esm({
           if (!reactNav || reactNav.__scalebunAutoHooked) return;
           const detector = this;
           let installed2 = 0;
-          const redefine = (key, value) => {
+          const redefine2 = (key, value) => {
             try {
               Object.defineProperty(reactNav, key, {
                 value,
@@ -3778,7 +3802,7 @@ var init_AutoScreenDetector = __esm({
               });
             });
             Wrapped.displayName = "ScaleBunNavigationContainer";
-            if (redefine("NavigationContainer", Wrapped)) installed2++;
+            if (redefine2("NavigationContainer", Wrapped)) installed2++;
           }
           if (typeof reactNav.createNavigationContainerRef === "function") {
             const originalCreate = reactNav.createNavigationContainerRef;
@@ -3790,7 +3814,7 @@ var init_AutoScreenDetector = __esm({
               }
               return ref;
             };
-            if (redefine("createNavigationContainerRef", patchedCreate)) installed2++;
+            if (redefine2("createNavigationContainerRef", patchedCreate)) installed2++;
           }
           if (typeof reactNav.useNavigationContainerRef === "function") {
             const originalHook = reactNav.useNavigationContainerRef;
@@ -3802,7 +3826,7 @@ var init_AutoScreenDetector = __esm({
               }
               return ref;
             };
-            if (redefine("useNavigationContainerRef", patchedHook)) installed2++;
+            if (redefine2("useNavigationContainerRef", patchedHook)) installed2++;
           }
           this._autoHookInstalled = installed2 > 0;
           try {
@@ -3851,15 +3875,58 @@ var init_AutoScreenDetector = __esm({
         this._listeners = [];
         this._manualScreen = null;
         this._autoScreen = null;
+        this._autoScreenTs = 0;
         this._navigationRef = null;
         _instance = null;
       }
       /** Get the current best-known screen name */
       getCurrentScreen() {
-        if (this._manualScreen && this.isManualScreenActive()) {
-          return this._manualScreen;
+        return this._currentScreen().name;
+      }
+      /**
+       * WHERE the current screen name came from, or 'none'.
+       *
+       * Recorded on every interaction (RN-8) so low screen coverage is DIAGNOSABLE rather
+       * than merely visible. Production shows 13.8% of Android interactions carrying a
+       * screen and 0.5% on iOS, and those numbers cannot today distinguish three different
+       * causes: the app never instrumented anything, the app instrumented manually and the
+       * value never reached interactions, or auto-detection ran and failed. Those have
+       * different owners and different fixes, and guessing between them is how a P0 stays
+       * open.
+       */
+      getCurrentScreenSource() {
+        return this._currentScreen().source;
+      }
+      /**
+       * LAST WRITER WINS between the manual beacon and auto-detection.
+       *
+       * A screen declared by `<ScaleBunScreen name>` stays current until something else
+       * declares a different one — that is what mounting a screen means. It does not
+       * expire, which is the correction here: the previous rule returned the manual name
+       * only while it was under 2000 ms old and then silently fell back to the auto value,
+       * which in a manually-instrumented app is `null`.
+       *
+       * Comparing timestamps rather than hard-coding a priority also handles the real
+       * interleaving: an app can use React Navigation for most screens AND drop a manual
+       * beacon on one modal, and whichever spoke last is the truth.
+       */
+      _currentScreen() {
+        const manual = this._manualScreen;
+        const auto = this._autoScreen;
+        if (manual && (!auto || this._manualScreenTs >= this._autoScreenTs)) {
+          return {
+            name: manual,
+            source: "manual"
+          };
         }
-        return this._autoScreen;
+        if (auto) return {
+          name: auto,
+          source: "navigation"
+        };
+        return {
+          name: null,
+          source: "none"
+        };
       }
       // ─── Internal ───────────────────────────────────────────────────────
       _emitScreenChange(name, source) {
@@ -5740,17 +5807,54 @@ var init_automaticEvents = __esm({
 function generateInteractionId() {
   return `ixj-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 }
-function nearestInteractionStart(starts, occurredAt, toleranceMs = 1500) {
-  let best;
-  let bestDelta = toleranceMs + 1;
-  for (const start of starts) {
+function correlateInteraction(starts, occurredAt, toleranceMs = CORRELATION_TOLERANCE_MS, marginMs = CORRELATION_MARGIN_MS) {
+  const candidates = [];
+  for (let i = 0; i < starts.length; i++) {
+    const start = starts[i];
+    if (!start) continue;
     const delta = Math.abs(start.occurredAt - occurredAt);
-    if (delta < bestDelta) {
-      best = start;
-      bestDelta = delta;
+    if (delta <= toleranceMs) candidates.push({
+      index: i,
+      delta
+    });
+  }
+  if (candidates.length === 0) {
+    return {
+      index: -1,
+      outcome: "none",
+      deltaMs: null,
+      runnerUpDeltaMs: null
+    };
+  }
+  candidates.sort((a, b) => a.delta - b.delta || a.index - b.index);
+  const best = candidates[0];
+  const runnerUp = candidates[1];
+  if (runnerUp && runnerUp.delta - best.delta < marginMs) {
+    return {
+      index: -1,
+      outcome: "ambiguous",
+      deltaMs: best.delta,
+      runnerUpDeltaMs: runnerUp.delta
+    };
+  }
+  return {
+    start: starts[best.index],
+    index: best.index,
+    outcome: "exact",
+    deltaMs: best.delta,
+    runnerUpDeltaMs: runnerUp ? runnerUp.delta : null
+  };
+}
+function pruneInteractionStarts(starts, now2, toleranceMs = CORRELATION_TOLERANCE_MS) {
+  let removed = 0;
+  for (let i = starts.length - 1; i >= 0; i--) {
+    const start = starts[i];
+    if (!start || now2 - start.occurredAt > toleranceMs) {
+      starts.splice(i, 1);
+      removed++;
     }
   }
-  return bestDelta <= toleranceMs ? best : void 0;
+  return removed;
 }
 function automaticInteractionProperties(payload, screenName, canonicalMirror) {
   return {
@@ -5768,11 +5872,13 @@ function automaticInteractionProperties(payload, screenName, canonicalMirror) {
     canonical_mirror: canonicalMirror || void 0
   };
 }
-var INTERACTION_PROTOCOL_VERSION;
+var INTERACTION_PROTOCOL_VERSION, CORRELATION_TOLERANCE_MS, CORRELATION_MARGIN_MS;
 var init_interactionProtocol = __esm({
   "lib/module/features/journey/interactionProtocol.js"() {
     "use strict";
     INTERACTION_PROTOCOL_VERSION = 1;
+    CORRELATION_TOLERANCE_MS = 1500;
+    CORRELATION_MARGIN_MS = 100;
   }
 });
 
@@ -6515,6 +6621,69 @@ var init_SessionManager = __esm({
           state_status: stateStatus,
           ui: details?.ui,
           target_id: details?.targetId,
+          /**
+           * RN-6 — shipped with the row so the join is auditable instead of assumed.
+           *
+           * Without it, an interaction with no `target_id` is ambiguous in the worst way:
+           * it could mean the control genuinely had no identity, or that the correlation
+           * refused and the identity exists but could not be attributed. Those are
+           * different defects with different owners, and the accounting lane cannot give
+           * an honest unplaceable REASON without knowing which.
+           *
+           * Undefined on the JS-fallback path (no native event, so nothing was joined),
+           * which is itself the correct answer there rather than a fabricated 'exact'.
+           */
+          correlation: details?.correlation,
+          correlation_delta_ms: details?.correlationDeltaMs,
+          correlation_runner_up_delta_ms: details?.correlationRunnerUpDeltaMs,
+          /**
+           * RN-1/RN-2 — stored alongside `target_id` so a reader can tell an authored
+           * identifier from a structural inference. 'path' means the app authored no testID
+           * and the identity was derived from component names, which is useful but will
+           * change under refactoring; a dashboard that presents the two identically invites
+           * someone to trust a key that is about to move.
+           */
+          target_source: details?.targetSource,
+          /**
+           * RN-8 — stored so "13.8% of interactions have a screen" becomes answerable.
+           * 'none' means the app instrumented nothing the SDK could see; 'manual' means a
+           * <ScaleBunScreen> beacon; 'navigation' means the React Navigation hook. Three
+           * different owners behind one number that today has none.
+           */
+          screen_source: details?.screenSource,
+          /**
+           * RN-13 — what makes "the heat is on this control" checkable instead of assumed.
+           * Absent when the control could not be measured synchronously, which is a fact worth
+           * storing: an unmeasurable control and a mis-placed tap are different findings.
+           */
+          target_rect: details?.targetRect,
+          /**
+           * RN-3 — the backend already reads scrollX/scrollY off the payload into the fact
+           * table's own columns (it has done since the web SDK, which sends `sx`/`sy`), so
+           * these need no migration. Mobile simply never sent them.
+           *
+           * `scroll_source` says whether an offset was available at all: 'none' means the app
+           * uses a plain <ScrollView> rather than the SDK's wrapper, which is a coverage gap in
+           * the integration and not a tap at the top of a list.
+           */
+          scrollX: details?.scrollX,
+          scrollY: details?.scrollY,
+          scroll_source: details?.scrollSource,
+          /**
+           * RN-4 — what stops a recycled native view merging two different rows into one
+           * hotspot. The key is the app's own keyExtractor output, so it is stable across
+           * scrolling and across sessions; the index is carried so a recycled slot (same index,
+           * different key) can be proven rather than inferred.
+           */
+          item_key: details?.itemKey,
+          item_index: details?.itemIndex,
+          /**
+           * RN-15 — where in the control, not just which control. Turns "they tapped Add to
+           * Cart" into "they tapped its left edge", which is what tells you whether a hit area
+           * is right. Outside 0..1 is a hitSlop tap and is kept as such.
+           */
+          local_u: details?.localU,
+          local_v: details?.localV,
           gestureType,
           x: details?.x,
           y: details?.y,
@@ -8553,8 +8722,8 @@ var init_PerformanceTransport = __esm({
       setSink(sink) {
         this.sink = sink;
         if (sink && this.buffer.length > 0) {
-          const pending4 = this.buffer.splice(0);
-          for (const msg of pending4) {
+          const pending5 = this.buffer.splice(0);
+          for (const msg of pending5) {
             try {
               sink.send(msg);
             } catch {
@@ -9327,8 +9496,8 @@ var init_ProfilerTransport = __esm({
       setSink(sink) {
         this.sink = sink;
         if (sink && this.buffer.length > 0) {
-          const pending4 = this.buffer.splice(0);
-          for (const msg of pending4) {
+          const pending5 = this.buffer.splice(0);
+          for (const msg of pending5) {
             try {
               sink.send(msg);
             } catch {
@@ -10216,10 +10385,10 @@ function requestExport(transport, enabled, presetOrOptions) {
         return;
       }
       const timer = setTimeout(() => {
-        const pending4 = _pendingExports.get(requestId);
-        if (pending4) {
+        const pending5 = _pendingExports.get(requestId);
+        if (pending5) {
           _pendingExports.delete(requestId);
-          pending4.resolve({
+          pending5.resolve({
             success: false,
             error: `Export timed out after ${EXPORT_TIMEOUT_MS / 1e3}s`
           });
@@ -10261,14 +10430,14 @@ function handleExportResult(args) {
   try {
     const requestId = args.requestId;
     if (!requestId) return;
-    const pending4 = _pendingExports.get(requestId);
-    if (!pending4) {
+    const pending5 = _pendingExports.get(requestId);
+    if (!pending5) {
       logger.warn(`[ExportBridge] Received result for unknown requestId: ${requestId}`);
       return;
     }
-    clearTimeout(pending4.timer);
+    clearTimeout(pending5.timer);
     _pendingExports.delete(requestId);
-    pending4.resolve({
+    pending5.resolve({
       success: args.success ?? false,
       filePath: args.filePath,
       error: args.error,
@@ -10279,9 +10448,9 @@ function handleExportResult(args) {
   }
 }
 function teardownExports() {
-  for (const [, pending4] of _pendingExports) {
-    clearTimeout(pending4.timer);
-    pending4.reject(new Error("Debug disabled \u2014 export cancelled"));
+  for (const [, pending5] of _pendingExports) {
+    clearTimeout(pending5.timer);
+    pending5.reject(new Error("Debug disabled \u2014 export cancelled"));
   }
   _pendingExports.clear();
 }
@@ -11489,6 +11658,174 @@ var init_installationId = __esm({
   }
 });
 
+// lib/module/features/journey/scrollContext.js
+var scrollContext_exports = {};
+__export(scrollContext_exports, {
+  SCROLL_OFFSET_TTL_MS: () => SCROLL_OFFSET_TTL_MS,
+  clearScrollOffsets: () => clearScrollOffsets,
+  nativeTagOf: () => nativeTagOf,
+  nearestRecordedOffset: () => nearestRecordedOffset,
+  recordScrollOffset: () => recordScrollOffset,
+  trackedScrollerCount: () => trackedScrollerCount
+});
+function nativeTagOf(node) {
+  if (!node || typeof node !== "object") return null;
+  const n = node;
+  const tag = typeof n.__nativeTag === "number" ? n.__nativeTag : n._nativeTag;
+  return typeof tag === "number" && Number.isFinite(tag) ? tag : null;
+}
+function recordScrollOffset(tag, x, y, now2 = Date.now()) {
+  if (tag === null || !Number.isFinite(x) || !Number.isFinite(y)) return;
+  offsets.set(tag, {
+    x,
+    y,
+    at: now2
+  });
+  if (offsets.size > MAX_TRACKED_SCROLLERS) {
+    let oldestTag = null;
+    let oldestAt = Infinity;
+    for (const [k, v] of offsets) {
+      if (v.at < oldestAt) {
+        oldestAt = v.at;
+        oldestTag = k;
+      }
+    }
+    if (oldestTag !== null) offsets.delete(oldestTag);
+  }
+}
+function nearestRecordedOffset(ancestorTags, now2 = Date.now()) {
+  for (const tag of ancestorTags) {
+    if (tag === null) continue;
+    const hit = offsets.get(tag);
+    if (!hit) continue;
+    if (now2 - hit.at > SCROLL_OFFSET_TTL_MS) {
+      offsets.delete(tag);
+      continue;
+    }
+    return {
+      x: hit.x,
+      y: hit.y,
+      tag
+    };
+  }
+  return null;
+}
+function clearScrollOffsets() {
+  offsets.clear();
+}
+function trackedScrollerCount() {
+  return offsets.size;
+}
+var SCROLL_OFFSET_TTL_MS, MAX_TRACKED_SCROLLERS, offsets;
+var init_scrollContext = __esm({
+  "lib/module/features/journey/scrollContext.js"() {
+    "use strict";
+    SCROLL_OFFSET_TTL_MS = 5 * 6e4;
+    MAX_TRACKED_SCROLLERS = 32;
+    offsets = /* @__PURE__ */ new Map();
+  }
+});
+
+// lib/module/features/journey/autoInstrumentScroll.js
+var autoInstrumentScroll_exports = {};
+__export(autoInstrumentScroll_exports, {
+  autoInstrumentScrollViews: () => autoInstrumentScrollViews,
+  resetAutoInstrumentForTests: () => resetAutoInstrumentForTests
+});
+function redefine(target, key, value) {
+  try {
+    Object.defineProperty(target, key, {
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value
+    });
+    return target[key] === value;
+  } catch {
+    return false;
+  }
+}
+function instrument(Original, React14) {
+  const Wrapped = React14.forwardRef((props, ref) => {
+    const onScroll = (event) => {
+      try {
+        const target = event?.nativeEvent?.target;
+        const offset = event?.nativeEvent?.contentOffset;
+        if (offset) {
+          recordScrollOffset(typeof target === "number" ? target : nativeTagOf(target), offset.x, offset.y);
+        }
+      } catch {
+      }
+      try {
+        props?.onScroll?.(event);
+      } catch (e) {
+        setTimeout(() => {
+          throw e;
+        }, 0);
+      }
+    };
+    const throttle = props?.scrollEventThrottle ?? 16;
+    return React14.createElement(Original, {
+      ...props,
+      scrollEventThrottle: throttle,
+      onScroll,
+      ref
+    });
+  });
+  Wrapped.displayName = "ScaleBunAutoScrollView";
+  return Wrapped;
+}
+function autoInstrumentScrollViews() {
+  if (alreadyPatched) return {
+    installed: true
+  };
+  try {
+    const RN = require("react-native");
+    const React14 = require("react");
+    const Original = RN.ScrollView;
+    if (typeof Original !== "function" && typeof Original !== "object") {
+      return {
+        installed: false,
+        reason: "react-native has no ScrollView export to wrap"
+      };
+    }
+    if (Original.__scalebunInstrumented) {
+      alreadyPatched = true;
+      return {
+        installed: true
+      };
+    }
+    const Wrapped = instrument(Original, React14);
+    Wrapped.__scalebunInstrumented = true;
+    if (!redefine(RN, "ScrollView", Wrapped)) {
+      return {
+        installed: false,
+        reason: "react-native's ScrollView export could not be replaced \u2014 it is a getter with no configurable descriptor on this bundler. Use ScaleBunScrollView explicitly instead."
+      };
+    }
+    alreadyPatched = true;
+    return {
+      installed: true
+    };
+  } catch (e) {
+    return {
+      installed: false,
+      reason: e?.message ?? "unknown failure"
+    };
+  }
+}
+function resetAutoInstrumentForTests() {
+  alreadyPatched = false;
+}
+var alreadyPatched;
+var init_autoInstrumentScroll = __esm({
+  "lib/module/features/journey/autoInstrumentScroll.js"() {
+    "use strict";
+    init_scrollContext();
+    alreadyPatched = false;
+  }
+});
+
 // lib/module/features/engage/engageSignals.js
 var EngageSignalBus, engageSignals;
 var init_engageSignals = __esm({
@@ -11697,322 +12034,6 @@ var init_deviceAttributes = __esm({
   }
 });
 
-// lib/module/features/ota/crypto/loadEd25519.js
-function loadEd25519() {
-  try {
-    const mod = require("@noble/ed25519");
-    const ed = mod?.default ?? mod;
-    if (typeof ed?.verifyAsync === "function" || typeof ed?.verify === "function") {
-      return ed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-var init_loadEd25519 = __esm({
-  "lib/module/features/ota/crypto/loadEd25519.js"() {
-    "use strict";
-  }
-});
-
-// lib/module/features/ota/crypto/loadSha512.js
-function loadSha512() {
-  try {
-    const mod = require("@noble/hashes/sha2.js");
-    const sha512 = mod?.sha512 ?? mod?.default?.sha512;
-    return typeof sha512 === "function" ? sha512 : null;
-  } catch {
-    return null;
-  }
-}
-var init_loadSha512 = __esm({
-  "lib/module/features/ota/crypto/loadSha512.js"() {
-    "use strict";
-  }
-});
-
-// lib/module/features/ota/crypto/builtinVerifier.js
-var builtinVerifier_exports = {};
-__export(builtinVerifier_exports, {
-  _resetBuiltinVerifier: () => _resetBuiltinVerifier,
-  decodeSignature: () => decodeSignature,
-  getBuiltinVerifier: () => getBuiltinVerifier
-});
-function hexToBytes(hex) {
-  const clean2 = hex.trim().toLowerCase().replace(/^0x/, "");
-  if (clean2.length === 0 || clean2.length % 2 !== 0 || /[^0-9a-f]/.test(clean2)) return null;
-  const out = new Uint8Array(clean2.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(clean2.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-function base64ToBytes2(b64) {
-  const s = b64.trim().replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
-  if (s.length === 0) return null;
-  const out = [];
-  let buffer = 0;
-  let bits = 0;
-  for (const ch of s) {
-    const idx = B64_ALPHABET2.indexOf(ch);
-    if (idx === -1) return null;
-    buffer = buffer << 6 | idx;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      out.push(buffer >> bits & 255);
-    }
-  }
-  return Uint8Array.from(out);
-}
-function decodeSignature(sig) {
-  const trimmed = sig.trim();
-  if (/^(0x)?[0-9a-fA-F]{128}$/.test(trimmed)) {
-    const hex2 = hexToBytes(trimmed);
-    if (hex2 && hex2.length === ED25519_SIGNATURE_BYTES) return hex2;
-  }
-  const b64 = base64ToBytes2(trimmed);
-  if (b64 && b64.length === ED25519_SIGNATURE_BYTES) return b64;
-  const hex = hexToBytes(trimmed);
-  if (hex && hex.length === ED25519_SIGNATURE_BYTES) return hex;
-  return null;
-}
-function wireSha512(ed, sha512) {
-  const concat2 = (parts) => {
-    if (parts.length === 1) return parts[0];
-    let total = 0;
-    for (const p of parts) total += p.length;
-    const out = new Uint8Array(total);
-    let off = 0;
-    for (const p of parts) {
-      out.set(p, off);
-      off += p.length;
-    }
-    return out;
-  };
-  const sync = (...msgs) => sha512(concat2(msgs));
-  const asyncFn = async (...msgs) => sha512(concat2(msgs));
-  let wired = false;
-  try {
-    if (ed.hashes && typeof ed.hashes === "object") {
-      if (typeof ed.hashes.sha512 !== "function") ed.hashes.sha512 = sync;
-      if (typeof ed.hashes.sha512Async !== "function") ed.hashes.sha512Async = asyncFn;
-      wired = typeof ed.hashes.sha512 === "function";
-    }
-  } catch {
-  }
-  try {
-    if (ed.etc && typeof ed.etc === "object") {
-      if (typeof ed.etc.sha512Sync !== "function") ed.etc.sha512Sync = sync;
-      if (typeof ed.etc.sha512Async !== "function") ed.etc.sha512Async = asyncFn;
-      wired = wired || typeof ed.etc.sha512Sync === "function";
-    }
-  } catch {
-  }
-  return wired;
-}
-function getBuiltinVerifier() {
-  if (resolved !== void 0) return resolved;
-  const ed = loadEd25519();
-  const sha512 = loadSha512();
-  if (!ed || !sha512) {
-    resolved = null;
-    return null;
-  }
-  if (!wireSha512(ed, sha512)) {
-    logger.error("[OTA] @noble/ed25519 is installed but its SHA-512 provider could not be wired (unrecognised version shape). Supply `ota.verifySignature` yourself, or pin a @noble/ed25519 version this SDK supports.");
-    resolved = null;
-    return null;
-  }
-  resolved = async ({
-    messageHex,
-    signature,
-    publicKey
-  }) => {
-    const message = hexToBytes(messageHex);
-    const pub = hexToBytes(publicKey);
-    const sig = decodeSignature(signature);
-    if (!message) {
-      logger.error("[OTA] Bundle SHA-256 is not valid hex \u2014 refusing to stage.");
-      return false;
-    }
-    if (!pub || pub.length !== ED25519_PUBLIC_KEY_BYTES) {
-      logger.error(`[OTA] ota.publicSigningKey must be ${ED25519_PUBLIC_KEY_BYTES} bytes of hex (${ED25519_PUBLIC_KEY_BYTES * 2} characters) \u2014 got ${pub ? `${pub.length} bytes` : "a value that is not hex"}.`);
-      return false;
-    }
-    if (!sig) {
-      logger.error("[OTA] Bundle signature is not a 64-byte hex/base64 value.");
-      return false;
-    }
-    try {
-      if (typeof ed.verify === "function") return ed.verify(sig, message, pub);
-      if (typeof ed.verifyAsync === "function") return await ed.verifyAsync(sig, message, pub);
-      return false;
-    } catch {
-      return false;
-    }
-  };
-  __DEV__ && logger.debug("[OTA] Using built-in ed25519 verifier (@noble/ed25519 detected).");
-  return resolved;
-}
-function _resetBuiltinVerifier() {
-  resolved = void 0;
-}
-var ED25519_SIGNATURE_BYTES, ED25519_PUBLIC_KEY_BYTES, B64_ALPHABET2, resolved;
-var init_builtinVerifier = __esm({
-  "lib/module/features/ota/crypto/builtinVerifier.js"() {
-    "use strict";
-    init_loadEd25519();
-    init_loadSha512();
-    init_internalLogger();
-    ED25519_SIGNATURE_BYTES = 64;
-    ED25519_PUBLIC_KEY_BYTES = 32;
-    B64_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  }
-});
-
-// lib/module/features/ota/crypto/nativeVerifier.js
-function bytesToHex(bytes) {
-  let out = "";
-  for (const b of bytes) out += b.toString(16).padStart(2, "0");
-  return out;
-}
-function normalizeHex(value, expectedChars) {
-  const clean2 = value.trim().toLowerCase().replace(/^0x/, "");
-  if (clean2.length !== expectedChars || /[^0-9a-f]/.test(clean2)) return null;
-  return clean2;
-}
-function getNativeVerifier() {
-  if (resolved2 !== void 0) return resolved2;
-  const native = NativeScaleBunOta_default;
-  if (!native || typeof native.verifyEd25519 !== "function") {
-    resolved2 = null;
-    return null;
-  }
-  resolved2 = async ({
-    messageHex,
-    signature,
-    publicKey
-  }) => {
-    const message = normalizeHex(messageHex, 64);
-    const key = normalizeHex(publicKey, ED25519_PUBLIC_KEY_HEX_CHARS);
-    const sigBytes = decodeSignature(signature);
-    if (!message || !key || !sigBytes) {
-      logger.error("[OTA] Signature inputs malformed (bundle hash, signature, or public key) \u2014 refusing to stage.");
-      return false;
-    }
-    let verdict;
-    try {
-      verdict = await native.verifyEd25519(message, bytesToHex(sigBytes), key);
-    } catch (err) {
-      logger.warn(`[OTA] Native ed25519 verify failed to run: ${err?.message ?? err}`);
-      verdict = "unavailable";
-    }
-    if (verdict === "valid") return true;
-    if (verdict === "invalid") return false;
-    const builtin = getBuiltinVerifier();
-    if (builtin) {
-      return builtin({
-        messageHex,
-        signature,
-        publicKey
-      });
-    }
-    throw new Error("ed25519 unavailable: this OS has no native implementation (Android < 13) and the optional peers @noble/ed25519 + @noble/hashes are not installed.");
-  };
-  __DEV__ && logger.debug("[OTA] Using native ed25519 verifier (platform crypto).");
-  return resolved2;
-}
-var ED25519_PUBLIC_KEY_HEX_CHARS, resolved2;
-var init_nativeVerifier = __esm({
-  "lib/module/features/ota/crypto/nativeVerifier.js"() {
-    "use strict";
-    init_NativeScaleBunOta();
-    init_internalLogger();
-    init_builtinVerifier();
-    ED25519_PUBLIC_KEY_HEX_CHARS = 64;
-  }
-});
-
-// lib/module/features/ota/signature.js
-async function verifyBundleSignature(bundleSha256, signature, config) {
-  const rawKey = config?.publicKey;
-  const keys = (Array.isArray(rawKey) ? rawKey : rawKey ? [rawKey] : []).filter((k) => typeof k === "string" && k.trim().length > 0);
-  if (rawKey === void 0 || rawKey === "" || rawKey === null) {
-    if (!warnedNotConfigured) {
-      warnedNotConfigured = true;
-      logger.warn("[OTA] No signing public key configured \u2014 bundles are accepted on SHA-256 integrity alone. Configure `ota.publicSigningKey` to enforce authenticity.");
-    }
-    return {
-      ok: true,
-      reason: "not_configured"
-    };
-  }
-  if (keys.length === 0) {
-    logger.error("[OTA] Signing key config resolves to zero usable keys (empty array or blank strings) \u2014 refusing to stage. Remove the config to disable signing, or pin at least one real key.");
-    return {
-      ok: false,
-      reason: "no_keys"
-    };
-  }
-  if (!signature) {
-    logger.error("[OTA] Bundle has no signature but a signing key is configured \u2014 refusing to stage.");
-    return {
-      ok: false,
-      reason: "missing_signature"
-    };
-  }
-  const verifier = typeof config?.verifier === "function" ? config.verifier : getNativeVerifier() ?? getBuiltinVerifier();
-  if (!verifier) {
-    logger.error("[OTA] A signing key is configured but no signature verifier is available \u2014 refusing to stage. Either install the optional peers `@noble/ed25519` and `@noble/hashes` (the SDK then verifies with no further code), or provide your own `ota.verifySignature`.");
-    return {
-      ok: false,
-      reason: "no_verifier"
-    };
-  }
-  let sawThrow = false;
-  let sawCompletion = false;
-  for (const key of keys) {
-    try {
-      const valid = await verifier({
-        messageHex: bundleSha256,
-        signature,
-        publicKey: key
-      });
-      sawCompletion = true;
-      if (valid) return {
-        ok: true,
-        reason: "verified"
-      };
-    } catch (err) {
-      sawThrow = true;
-      logger.error(`[OTA] Signature verifier threw: ${err?.message ?? err}`);
-    }
-  }
-  if (sawThrow && !sawCompletion) {
-    return {
-      ok: false,
-      reason: "verifier_threw"
-    };
-  }
-  logger.error(keys.length > 1 ? `[OTA] Bundle signature is INVALID under all ${keys.length} pinned keys \u2014 refusing to stage.` : "[OTA] Bundle signature is INVALID \u2014 refusing to stage.");
-  return {
-    ok: false,
-    reason: "invalid_signature"
-  };
-}
-var warnedNotConfigured;
-var init_signature = __esm({
-  "lib/module/features/ota/signature.js"() {
-    "use strict";
-    init_internalLogger();
-    init_builtinVerifier();
-    init_nativeVerifier();
-    warnedNotConfigured = false;
-  }
-});
-
 // lib/module/features/ota/environment.js
 function compare(a, b) {
   if (a.major !== b.major) return a.major - b.major;
@@ -12240,10 +12261,10 @@ async function deliverOtaEvents(params) {
       })
     });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    __DEV__ && logger.debug(`[OTA] Delivered ${items.length} telemetry event(s)`);
+    logger.debug(`[OTA] Delivered ${items.length} telemetry event(s)`);
   } catch (err) {
     for (const e of events) otaEventEmitter.emit(e);
-    __DEV__ && logger.debug(`[OTA] Telemetry delivery failed (will retry next sync): ${err?.message}`);
+    logger.debug(`[OTA] Telemetry delivery failed (will retry next sync): ${err?.message}`);
   }
 }
 var import_react_native34, PROGRESS_POST_INTERVAL_MS, DEFAULT_HEALTHY_AFTER_MS, OtaOrchestrator, otaOrchestrator;
@@ -12258,7 +12279,6 @@ var init_OtaOrchestrator = __esm({
     init_geoCountry();
     init_deviceAttributes();
     init_installationId();
-    init_signature();
     init_environment();
     init_retry();
     init_StorageBackend();
@@ -12277,6 +12297,8 @@ var init_OtaOrchestrator = __esm({
         return this.currentBundle;
       }
       isRestartRequiredState = false;
+      /** Root/jailbreak indicators observed at init; empty when none found. */
+      integrityIndicators = [];
       healthyTimer = null;
       bootGuardConfig = {};
       environment = null;
@@ -12286,15 +12308,15 @@ var init_OtaOrchestrator = __esm({
       /**
        * Initialize the orchestrator. Checks for boot-guard recovery state.
        *
-       * `signature` is optional: an app that has not adopted signing keeps working
-       * on SHA-256 integrity alone. Once a public key IS configured, a bundle that
-       * cannot be verified is refused rather than installed (OTA-03).
+       * Signature enforcement is no longer a JS concern: signed releases are
+       * verified and staged in NATIVE code against RSA keys embedded in the app
+       * package (SB-OTA-RSA-SHA256-V1), and unsigned releases keep working on
+       * SHA-256 integrity alone. There is nothing for the host to configure here.
        */
       init(config) {
         noThrow(() => {
           if (this.initialized) {
             this.bootGuardConfig = config ?? this.bootGuardConfig;
-            this.signatureConfig = config?.signature ?? this.signatureConfig;
             return;
           }
           if (!NativeScaleBunOta_default) {
@@ -12311,18 +12333,27 @@ var init_OtaOrchestrator = __esm({
             logger.warn("[OTA] Running bridgeless but the React Native version could not be determined. If this app is below RN 0.76.1, OTA updates will install and never load.");
           }
           if (this.environment.requiresReactHostIntegration) {
-            __DEV__ && logger.debug("[OTA] React Native >= 0.82 detected. The only valid Android integration is getDefaultReactHost(..., jsBundleFilePath = ScaleBunOtaModule.getJSBundleFile(ctx)) \u2014 ReactNativeHost and its getJSBundleFile() override no longer exist.");
+            logger.debug("[OTA] React Native >= 0.82 detected. The only valid Android integration is getDefaultReactHost(..., jsBundleFilePath = ScaleBunOtaModule.getJSBundleFile(ctx)) \u2014 ReactNativeHost and its getJSBundleFile() override no longer exist.");
           }
           this.initialized = true;
           this.enabled = true;
+          try {
+            const raw = NativeScaleBunOta_default?.getDeviceIntegrity?.();
+            this.integrityIndicators = raw ? JSON.parse(raw) : [];
+            if (this.integrityIndicators.length > 0) {
+              logger.warn(`[OTA] Device integrity indicators present: ${this.integrityIndicators.join(", ")}. Updates still install and are still signature-verified, but an installed bundle on this device can be modified by other privileged processes.`);
+            }
+          } catch {
+            this.integrityIndicators = [];
+          }
           this.bootGuardConfig = config ?? {};
-          this.signatureConfig = config?.signature;
-          __DEV__ && logger.debug(`[OTA] Orchestrator initialized (RN ${this.environment.rnVersionString ?? "unknown"}${this.environment.bridgeless ? ", bridgeless" : ""}${this.environment.hermes ? `, Hermes HBC v${this.environment.hermesBytecodeVersion ?? "?"}` : ""})`);
+          logger.debug(`[OTA] Orchestrator initialized (RN ${this.environment.rnVersionString ?? "unknown"}${this.environment.bridgeless ? ", bridgeless" : ""}${this.environment.hermes ? `, Hermes HBC v${this.environment.hermesBytecodeVersion ?? "?"}` : ""})`);
           const slotState = this.readSlotState();
           this.hydrateCurrentBundleFromSlots(slotState);
           void prefetchDeviceCountry();
           this.checkBootGuardRecovery(slotState);
           this.verifyRunningBundleIdentity();
+          this.startBootGuardHeartbeat(slotState);
         });
       }
       /**
@@ -12353,13 +12384,13 @@ var init_OtaOrchestrator = __esm({
               releaseId: record4.releaseId ?? void 0,
               sha256: record4.sha256
             };
-            __DEV__ && logger.debug(`[OTA] Running bundle v${record4.version} (${record4.bundleId})`);
+            logger.debug(`[OTA] Running bundle v${record4.version} (${record4.bundleId})`);
             return;
           }
           this.currentBundle = {
             sha256: current.sha256
           };
-          __DEV__ && logger.debug(`[OTA] Running an OTA bundle (sha ${String(current.sha256).slice(0, 12)}\u2026) with no local install record.`);
+          logger.debug(`[OTA] Running an OTA bundle (sha ${String(current.sha256).slice(0, 12)}\u2026) with no local install record.`);
         } catch {
         }
       }
@@ -12389,7 +12420,7 @@ var init_OtaOrchestrator = __esm({
         }
         if (!record4.identityToken) return;
         if (running === record4.identityToken) {
-          __DEV__ && logger.debug("[OTA] Install verified \u2014 running bundle matches what was installed.");
+          logger.debug("[OTA] Install verified \u2014 running bundle matches what was installed.");
           this.retireIdentityToken(record4);
           return;
         }
@@ -12492,6 +12523,13 @@ var init_OtaOrchestrator = __esm({
       isEnabled() {
         return this.enabled;
       }
+      /**
+       * Root/jailbreak indicators detected on this device, as stable reason strings.
+       * Empty means nothing was detected — not proof the device is clean.
+       */
+      deviceIntegrityIndicators() {
+        return [...this.integrityIndicators];
+      }
       isRestartRequired() {
         return this.isRestartRequiredState;
       }
@@ -12503,12 +12541,22 @@ var init_OtaOrchestrator = __esm({
           const env = this.environment ?? detectOtaEnvironment();
           const mobileOS = resolveMobileOS();
           if (!mobileOS) throw new Error("OTA is not supported on this platform");
+          let trustedKeyIds;
+          try {
+            const raw = NativeScaleBunOta_default?.getTrustedKeyIds?.();
+            if (raw) {
+              const arr2 = JSON.parse(raw);
+              if (Array.isArray(arr2) && arr2.length) trustedKeyIds = arr2.slice(0, 16);
+            }
+          } catch {
+          }
           const payload = {
             appVersion: requestParams.appVersion,
             platform: mobileOS,
             installationId: requestParams.installationId,
             currentBundleId: this.currentBundle?.id,
             currentBundleHash: this.currentBundle?.sha256,
+            trustedKeyIds,
             channelName: requestParams.channelName,
             // Host-supplied country wins; otherwise the cached edge-Worker lookup
             // fills in (see geoCountry.ts). Undefined when neither knows — the
@@ -12575,7 +12623,7 @@ var init_OtaOrchestrator = __esm({
               error: "OTA native module disabled or missing"
             };
           }
-          __DEV__ && logger.debug("[OTA] Sync started\u2026");
+          logger.debug("[OTA] Sync started\u2026");
           if (this.currentBundle?.id) {
             otaEventEmitter.emitSimple("CHECK", this.currentBundle.id, {
               releaseId: this.currentBundle.releaseId,
@@ -12584,7 +12632,7 @@ var init_OtaOrchestrator = __esm({
           }
           const checkRes = await this.checkForUpdate(params);
           if (checkRes.action === "NONE") {
-            __DEV__ && logger.debug("[OTA] App is up to date");
+            logger.debug("[OTA] App is up to date");
             this.startBootGuardHeartbeat();
             return {
               status: "UP_TO_DATE"
@@ -12622,25 +12670,12 @@ var init_OtaOrchestrator = __esm({
             releaseId: bundle.releaseId,
             version: bundle.version
           });
-          const signatureOutcome = await verifyBundleSignature(bundle.sha256, bundle.signature, this.signatureConfig);
-          if (!signatureOutcome.ok) {
-            otaEventEmitter.emitSimple("APPLY_FAILED", bundle.id, {
-              releaseId: bundle.releaseId,
-              error: `Signature check failed: ${signatureOutcome.reason}`,
-              version: bundle.version
-            });
-            return {
-              status: "ERROR",
-              error: `Bundle signature check failed (${signatureOutcome.reason})`,
-              bundle
-            };
-          }
           otaEventEmitter.emitSimple("DOWNLOAD_STARTED", bundle.id, {
             releaseId: bundle.releaseId,
             version: bundle.version
           });
           const downloadStart = Date.now();
-          __DEV__ && logger.debug(`[OTA] Downloading update v${bundle.version}\u2026`);
+          logger.debug(`[OTA] Downloading update v${bundle.version}\u2026`);
           let lastPostAt = 0;
           const postProgress = (bytesRead, status) => {
             const total = bundle.size > 0 ? bundle.size : Math.max(bytesRead, 1);
@@ -12682,39 +12717,75 @@ var init_OtaOrchestrator = __esm({
             }
           });
           let staged = false;
-          if (bundle.patch && NativeScaleBunOta_default.stagePatch) {
-            __DEV__ && logger.debug(`[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ${(bundle.size / 1024).toFixed(0)} KB full) \u2014 trying patch\u2026`);
+          if (bundle.envelope) {
+            const envelopeJson = JSON.stringify({
+              ...bundle.envelope,
+              downloadUrl: bundle.url
+            });
+            let verdict;
             try {
-              staged = await NativeScaleBunOta_default.stagePatch(
-                bundle.patch.url,
-                bundle.patch.sha256,
-                bundle.sha256
-                // expected full-bundle hash after patching
-              );
-              if (staged) {
-                patchUsed = true;
-                __DEV__ && logger.debug("[OTA] Patch applied successfully");
-              } else {
-                logger.warn("[OTA] Patch staging returned false \u2014 falling back to full bundle");
-              }
-            } catch (patchErr) {
-              logger.warn(`[OTA] Patch staging failed: ${patchErr.message} \u2014 falling back to full bundle`);
+              const verdictJson = await NativeScaleBunOta_default.verifyAndStageRelease(envelopeJson);
+              verdict = JSON.parse(verdictJson);
+            } catch (err) {
+              verdict = {
+                ok: false,
+                code: "verify_stage_threw",
+                message: err?.message ?? String(err)
+              };
             }
-          }
-          if (!staged) {
-            try {
-              staged = await retryWithBackoff(async () => {
-                const ok = await NativeScaleBunOta_default.stageBundle(bundle.url, bundle.sha256);
-                if (!ok) {
-                  throw new Error("stageBundle returned false");
-                }
-                return ok;
-              }, {
-                label: `download v${bundle.version}`,
-                attempts: 3
+            if (!verdict.ok) {
+              unsubscribeProgress();
+              postProgress(0, "FAILED");
+              logger.error(`[OTA] Native verify/stage refused the release: ${verdict.code ?? "unknown"}${verdict.message ? ` \u2014 ${verdict.message}` : ""}`);
+              otaEventEmitter.emitSimple("APPLY_FAILED", bundle.id, {
+                releaseId: bundle.releaseId,
+                // `error` is mapped onto the wire `errorCode` by deliverOtaEvents —
+                // carry the stable native verdict code there.
+                error: verdict.code ?? "verify_and_stage_release_failed",
+                version: bundle.version
               });
-            } catch {
-              staged = false;
+              return {
+                status: "ERROR",
+                error: `Release verification failed (${verdict.code ?? "unknown"})`,
+                bundle
+              };
+            }
+            staged = true;
+          } else {
+            if (bundle.patch && NativeScaleBunOta_default.stagePatch) {
+              logger.debug(`[OTA] Patch available (${(bundle.patch.size / 1024).toFixed(0)} KB vs ${(bundle.size / 1024).toFixed(0)} KB full) \u2014 trying patch\u2026`);
+              try {
+                staged = await NativeScaleBunOta_default.stagePatch(
+                  bundle.patch.url,
+                  bundle.patch.sha256,
+                  bundle.sha256
+                  // expected full-bundle hash after patching
+                );
+                if (staged) {
+                  patchUsed = true;
+                  logger.debug("[OTA] Patch applied successfully");
+                } else {
+                  logger.warn("[OTA] Patch staging returned false \u2014 falling back to full bundle");
+                }
+              } catch (patchErr) {
+                logger.warn(`[OTA] Patch staging failed: ${patchErr.message} \u2014 falling back to full bundle`);
+              }
+            }
+            if (!staged) {
+              try {
+                staged = await retryWithBackoff(async () => {
+                  const ok = await NativeScaleBunOta_default.stageBundle(bundle.url, bundle.sha256);
+                  if (!ok) {
+                    throw new Error("stageBundle returned false");
+                  }
+                  return ok;
+                }, {
+                  label: `download v${bundle.version}`,
+                  attempts: 3
+                });
+              } catch {
+                staged = false;
+              }
             }
           }
           unsubscribeProgress();
@@ -12761,7 +12832,7 @@ var init_OtaOrchestrator = __esm({
             releaseId: bundle.releaseId,
             version: bundle.version
           });
-          __DEV__ && logger.debug(`[OTA] Update v${bundle.version} installed successfully!`);
+          logger.debug(`[OTA] Update v${bundle.version} installed successfully!`);
           await deliverOtaEvents(params);
           const installMode = bundle.installMode ?? "ON_NEXT_RESTART";
           if (params.autoRestart || installMode === "IMMEDIATE") {
@@ -12792,24 +12863,23 @@ var init_OtaOrchestrator = __esm({
        * native boot-guard marker. If JS crashes before the timer fires, the
        * marker stays set and native code reverts on next cold start.
        */
-      startBootGuardHeartbeat() {
+      startBootGuardHeartbeat(preRead) {
         if (!NativeScaleBunOta_default) return;
         if (this.healthyTimer) {
           clearTimeout(this.healthyTimer);
           this.healthyTimer = null;
         }
         try {
-          const stateJson = NativeScaleBunOta_default.getSlotState();
-          const state = JSON.parse(stateJson);
-          if (!state.bootMarkerPresent) {
+          const state = preRead !== void 0 ? preRead : JSON.parse(NativeScaleBunOta_default.getSlotState());
+          if (!state?.bootMarkerPresent) {
             return;
           }
           const healthyMs = this.bootGuardConfig.healthyAfterMs ?? DEFAULT_HEALTHY_AFTER_MS;
-          __DEV__ && logger.debug(`[OTA] Boot guard active \u2014 marking healthy after ${healthyMs}ms`);
+          logger.debug(`[OTA] Boot guard active \u2014 marking healthy after ${healthyMs}ms`);
           this.healthyTimer = setTimeout(() => {
             noThrow(() => {
               NativeScaleBunOta_default?.markHealthy();
-              __DEV__ && logger.info("[OTA] Boot guard cleared \u2014 bundle marked healthy \u2713");
+              logger.info("[OTA] Boot guard cleared \u2014 bundle marked healthy \u2713");
               this.healthyTimer = null;
               const running = this.currentBundle;
               if (running?.id) {
@@ -12855,11 +12925,11 @@ var init_OtaOrchestrator = __esm({
               } catch {
               }
               this.resumeRestartArmed = false;
-              __DEV__ && logger.info("[OTA] App resumed \u2014 activating the staged update now");
+              logger.info("[OTA] App resumed \u2014 activating the staged update now");
               this.restart();
             }
           });
-          __DEV__ && logger.debug("[OTA] Update staged \u2014 will activate on next resume (ON_NEXT_RESUME)");
+          logger.debug("[OTA] Update staged \u2014 will activate on next resume (ON_NEXT_RESUME)");
         } catch {
           this.resumeRestartArmed = false;
         }
@@ -12876,7 +12946,7 @@ var init_OtaOrchestrator = __esm({
        */
       restart() {
         noThrow(() => {
-          __DEV__ && logger.info("[OTA] Triggering app restart\u2026");
+          logger.info("[OTA] Triggering app restart\u2026");
           if (NativeScaleBunOta_default && typeof NativeScaleBunOta_default.restartApp === "function") {
             NativeScaleBunOta_default.restartApp();
           } else if (import_react_native34.DevSettings && typeof import_react_native34.DevSettings.reload === "function") {
@@ -12895,17 +12965,25 @@ var init_OtaOrchestrator = __esm({
 var uiState_exports = {};
 __export(uiState_exports, {
   clearUiState: () => clearUiState,
+  onUiStateChange: () => onUiStateChange,
+  resetUiStateListeners: () => resetUiStateListeners,
   setUiState: () => setUiState,
+  uiStateListenerCount: () => uiStateListenerCount,
   uiStateSignature: () => uiStateSignature
 });
 function setUiState(name, value) {
   const n = clean(name);
   const v = clean(value);
-  if (n && v) declared.set(n, v);
+  if (!n || !v) return;
+  if (declared.get(n) === v) return;
+  declared.set(n, v);
+  notifyChanged();
 }
 function clearUiState(name) {
+  const before = declared.size;
   if (name === void 0) declared.clear();
   else declared.delete(clean(name));
+  if (declared.size !== before) notifyChanged();
 }
 function uiStateSignature() {
   if (!declared.size) return void 0;
@@ -12918,12 +12996,42 @@ function uiStateSignature() {
   }
   return signature || void 0;
 }
-var declared, clean;
+function onUiStateChange(listener) {
+  listeners2.add(listener);
+  return () => {
+    listeners2.delete(listener);
+  };
+}
+function resetUiStateListeners() {
+  listeners2.clear();
+  if (pending4 !== null) {
+    clearTimeout(pending4);
+    pending4 = null;
+  }
+}
+function uiStateListenerCount() {
+  return listeners2.size;
+}
+function notifyChanged() {
+  if (pending4 !== null) return;
+  pending4 = setTimeout(() => {
+    pending4 = null;
+    for (const listener of listeners2) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+  }, 0);
+}
+var declared, clean, listeners2, pending4;
 var init_uiState = __esm({
   "lib/module/features/journey/uiState.js"() {
     "use strict";
     declared = /* @__PURE__ */ new Map();
     clean = (s) => typeof s === "string" ? s.replace(/[;:|]/g, "").trim().slice(0, 32) : "";
+    listeners2 = /* @__PURE__ */ new Set();
+    pending4 = null;
   }
 });
 
@@ -14824,6 +14932,22 @@ var SHAPE = {
     }
   },
   captureInteractionHeatmap: bool(true),
+  /**
+   * RN-3 zero-config: patch React Native's ScrollView export so EVERY scroll view reports its
+   * offset, not just ones wrapped in ScaleBunScrollView.
+   *
+   * DEFAULT FALSE, unlike captureInteractionHeatmap above, and the difference is deliberate.
+   * That flag changes what the SDK records about the host; this one changes what the HOST
+   * RENDERS — every scroll view in the app, including ones inside third-party libraries the app
+   * did not write, starts routing through an SDK component. The failure mode is not a wrong
+   * number in a dashboard, it is the host's UI behaving differently because an analytics SDK
+   * replaced a primitive. That is a decision an integrator makes deliberately, not one they
+   * discover afterwards.
+   *
+   * With it off, a plain <ScrollView> yields no content depth and the tap says so
+   * (scroll_source: 'none') rather than defaulting its offset to 0.
+   */
+  autoInstrumentScrollViews: bool(false),
   // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
   // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,
   // so capturing it is the host's explicit choice, not a silent default. When true and a
@@ -14840,18 +14964,9 @@ var SHAPE = {
         kind: "str",
         opt: true
       },
-      publicSigningKey: {
-        kind: "str",
-        opt: true
-      },
-      // Rotation support: several pinned keys, any of which may verify a
-      // bundle. Ship a build pinning [old, new], re-sign server-side with
-      // new, drop old next release — no emergency store submission when a
-      // key must be replaced. Merged with publicSigningKey by the facade.
-      publicSigningKeys: {
-        kind: "strArr",
-        opt: true
-      },
+      // No signing-key fields: signed releases are verified natively against
+      // RSA keys embedded in the app package (SB-OTA-RSA-SHA256-V1). JS must
+      // not supply a trusted key.
       mandatoryBlocksUi: bool(false)
     }
   }
@@ -15654,6 +15769,23 @@ function installNetworkMonitoring(onEvent, options = {}) {
   });
 }
 
+// lib/module/features/network/thirdParty.js
+var THIRD_PARTY_BEACON_HOSTS = "google-analytics.com,googletagmanager.com,analytics.google.com,doubleclick.net,googlesyndication.com,googleadservices.com,app-measurement.com,facebook.net,analytics.tiktok.com,ads-twitter.com,analytics.twitter.com,ct.pinterest.com,bat.bing.com,px.ads.linkedin.com,tr.snapchat.com,criteo.com,criteo.net,taboola.com,outbrain.com,adroll.com,adsrvr.org,quantserve.com,scorecardresearch.com,hotjar.com,hotjar.io,clarity.ms,fullstory.com,mouseflow.com,crazyegg.com,luckyorange.com,inspectlet.com,segment.io,mixpanel.com,amplitude.com,heap.io,heapanalytics.com,rudderstack.com,posthog.com,matomo.cloud,plausible.io,simpleanalytics.com,statcounter.com,appsflyer.com,adjust.com,branch.io,ipify.org,ipinfo.io,ipapi.co,ip-api.com,geolocation-db.com,cloudflareinsights.com,nr-data.net,browser-intake-datadoghq.com,sentry.io,bugsnag.com,rollbar.com";
+function isThirdPartyBeacon(url, hosts) {
+  if (!url) return false;
+  let host = "";
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  for (const suffix of (hosts ?? THIRD_PARTY_BEACON_HOSTS).split(",")) {
+    if (host === suffix || host.endsWith("." + suffix)) return true;
+  }
+  return false;
+}
+
 // lib/module/features/network/NetworkFeature.js
 init_networkAdapter();
 init_SessionManager();
@@ -15669,10 +15801,12 @@ var NetworkFeature = class {
     if (this.active) return;
     installNetworkMonitoring((data) => {
       const isInternal = isSdkInternalUrl(data.url, this.options.sdkBaseUrl);
-      if (!isInternal) {
+      const isBeaconOrDenied = this.options.captureThirdParty !== true && isThirdPartyBeacon(data.url, this.options.thirdPartyHosts) || matchesDenyUrl(data.url, this.options.denyUrls);
+      const isExcluded = isInternal || isBeaconOrDenied;
+      if (!isExcluded) {
         this.trackFn("$network_request", data);
       }
-      if (data.type === "network") {
+      if (data.type === "network" && !isBeaconOrDenied) {
         reportNetworkRequest({
           method: data.method,
           url: data.url,
@@ -15688,7 +15822,7 @@ var NetworkFeature = class {
           requestBody: data.requestBody,
           responseBody: data.responseBody
         });
-        if (!isInternal) {
+        if (!isExcluded) {
           const sessionManager = SessionManager.getExistingInstance();
           if (sessionManager) {
             const backendTransport = sessionManager.getBackendTransport();
@@ -15719,6 +15853,13 @@ var NetworkFeature = class {
     return this.active;
   }
 };
+function matchesDenyUrl(url, patterns) {
+  if (!patterns || !patterns.length || !url) return false;
+  for (const p of patterns) {
+    if (typeof p === "string" ? url.includes(p) : p.test(url)) return true;
+  }
+  return false;
+}
 function isSdkInternalUrl(url, sdkBaseUrl) {
   if (!url) return false;
   try {
@@ -17021,22 +17162,22 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
    * lose the snapshot entirely. `imageData.length` is the base64 length, which is within ~1% of the
    * serialized cost and needs no extra pass.
    */
-  static _selectFramesToPersist(pending4) {
+  static _selectFramesToPersist(pending5) {
     const isKeyframe = (b) => b.frame.frameType !== "delta";
     const size = (b) => b.imageData?.length ?? 0;
     const keep = [];
     let budget = _BackendSessionAdapter.MAX_PERSIST_BYTES;
     const maxCount = _BackendSessionAdapter.MAX_FRAMES_PER_BATCH;
-    for (let i = pending4.length - 1; i >= 0; i--) {
-      const b = pending4[i];
+    for (let i = pending5.length - 1; i >= 0; i--) {
+      const b = pending5[i];
       if (!isKeyframe(b)) continue;
       const cost = size(b);
       if (cost > budget || keep.length >= maxCount) continue;
       budget -= cost;
       keep.push(b);
     }
-    for (let i = pending4.length - 1; i >= 0; i--) {
-      const b = pending4[i];
+    for (let i = pending5.length - 1; i >= 0; i--) {
+      const b = pending5[i];
       if (isKeyframe(b)) continue;
       const cost = size(b);
       if (cost > budget || keep.length >= maxCount) continue;
@@ -17469,6 +17610,10 @@ var SDKBootstrapper = class {
       return null;
     }
     this.config = result.data;
+    const requestedApiBaseUrl = rawConfig?.apiBaseUrl;
+    if (typeof requestedApiBaseUrl === "string" && requestedApiBaseUrl && requestedApiBaseUrl !== DEFAULT_API_BASE_URL) {
+      logger.warn(`[ScaleBun] Ignoring apiBaseUrl '${requestedApiBaseUrl}' \u2014 the endpoint is locked at build time and this build targets ${DEFAULT_API_BASE_URL}. To target another backend, change DEFAULT_API_BASE_URL in the SDK source and rebuild.`);
+    }
     this.config.apiBaseUrl = DEFAULT_API_BASE_URL;
     if (this.config.logLevel) {
       logger.setLevelByName(this.config.logLevel);
@@ -17633,6 +17778,20 @@ var SDKBootstrapper = class {
       }));
     }
     await this.featureRegistry.initializeAll(featureContext);
+    if (this.config.autoInstrumentScrollViews === true) {
+      try {
+        const {
+          autoInstrumentScrollViews: autoInstrumentScrollViews2
+        } = (init_autoInstrumentScroll(), __toCommonJS(autoInstrumentScroll_exports));
+        const outcome = autoInstrumentScrollViews2();
+        if (!outcome.installed) {
+          logger.warn("[Bootstrap] autoInstrumentScrollViews was requested but could not be installed: " + outcome.reason + " \u2014 taps will carry no content depth.");
+        } else {
+          __DEV__ && logger.debug("[Bootstrap] ScrollView auto-instrumentation installed");
+        }
+      } catch {
+      }
+    }
     if (features.replay !== false) {
       try {
         __DEV__ && logger.debug("[Bootstrap] Initializing unified SessionManager");
@@ -20276,14 +20435,14 @@ var ScaleBunFacade = class _ScaleBunFacade {
           this._apiBaseUrl = result.config.apiBaseUrl;
           this._maybeStartEventTracker(rawConfig);
           if (this._pendingIdentity) {
-            const pending4 = this._pendingIdentity;
+            const pending5 = this._pendingIdentity;
             this._pendingIdentity = null;
-            this.identify(pending4.userId, pending4.traits);
+            this.identify(pending5.userId, pending5.traits);
           }
           const realQueue = coreContainer.get("PersistentQueue");
           const buffered = this._preInitBuffer.popBatch(this._preInitBuffer.length());
           if (buffered.length > 0) {
-            __DEV__ && logger.debug(`[ScaleBun] Draining ${buffered.length} pre-init events into persistent queue`);
+            logger.debug(`[ScaleBun] Draining ${buffered.length} pre-init events into persistent queue`);
             for (const envelope of buffered) {
               realQueue.add(envelope);
             }
@@ -20311,17 +20470,11 @@ var ScaleBunFacade = class _ScaleBunFacade {
   /**
    * Boot the OTA orchestrator when the init config asks for it.
    *
-   * `publicSigningKey` / `publicSigningKeys` are honoured here so signature
-   * enforcement is reachable from configuration alone. The list form exists
-   * for key ROTATION: a build pinning [old, new] keeps verifying while the
-   * server moves to the new key, so replacing a key never needs an emergency
-   * store release. Both fields merge (deduplicated) into one pinned set.
-   *
-   * Verification comes from `ota.verifySignature` when supplied, else the
-   * built-in @noble-based verifier (optional peers). Pinning keys with
-   * NEITHER available is fail-CLOSED by design (signature.ts) — an update
-   * that cannot be verified is not installed. We say that out loud rather
-   * than letting the app discover it as a silent no-update condition.
+   * Signature enforcement is no longer configured from JS. Signed releases are
+   * verified and staged in NATIVE code against RSA keys embedded in the app
+   * package (SB-OTA-RSA-SHA256-V1); unsigned releases keep working on SHA-256
+   * integrity. There are no signing-key or `verifySignature` options to pass
+   * through — the host embeds its trusted keys natively.
    */
   _maybeStartOta(rawConfig) {
     const ota = rawConfig?.ota;
@@ -20330,29 +20483,8 @@ var ScaleBunFacade = class _ScaleBunFacade {
       const {
         otaOrchestrator: otaOrchestrator2
       } = (init_OtaOrchestrator(), __toCommonJS(OtaOrchestrator_exports));
-      const rawSingle = ota.publicSigningKey;
-      const rawList = ota.publicSigningKeys;
-      const publicKeys = Array.from(new Set([...typeof rawSingle === "string" && rawSingle ? [rawSingle] : [], ...Array.isArray(rawList) ? rawList : []].filter((k) => typeof k === "string" && k.trim().length > 0)));
-      const signingRequested = publicKeys.length > 0 || Array.isArray(rawList);
-      const verifier = ota.verifySignature;
-      if (signingRequested && typeof verifier !== "function") {
-        const {
-          getBuiltinVerifier: getBuiltinVerifier2
-        } = (init_builtinVerifier(), __toCommonJS(builtinVerifier_exports));
-        if (!getBuiltinVerifier2()) {
-          logger.warn("[ScaleBun] A signing key is pinned but no signature verifier is available. Signature checking is fail-closed: updates will be REJECTED until one exists. Install the optional peers `@noble/ed25519` + `@noble/hashes` (no further code needed), or supply `ota.verifySignature`.");
-        }
-      }
       const healthyAfterMs = typeof ota.healthyAfterMs === "number" ? ota.healthyAfterMs : typeof ota.healthyTimeoutMs === "number" ? ota.healthyTimeoutMs : void 0;
       otaOrchestrator2.init({
-        ...signingRequested ? {
-          signature: {
-            // Single key stays a plain string — the shape every
-            // existing consumer and test already handles.
-            publicKey: publicKeys.length === 1 ? publicKeys[0] : publicKeys,
-            verifier
-          }
-        } : {},
         ...healthyAfterMs !== void 0 ? {
           healthyAfterMs
         } : {}
@@ -20401,7 +20533,9 @@ var ScaleBunFacade = class _ScaleBunFacade {
       }
       const clientKey = this._clientKey;
       const apiUrl = this._apiBaseUrl;
-      if (!clientKey || !apiUrl) return;
+      if (!clientKey || !apiUrl) {
+        return;
+      }
       this._otaCheckInFlight = true;
       try {
         const info = await bridgeAdapter.getDeviceInfo();
@@ -20452,7 +20586,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
       if (!dbgConfig) return;
       dbgConfig.__skipDeprecationWarning = true;
       this.enableDebug(dbgConfig);
-      __DEV__ && logger.info("[ScaleBun] Debug auto-connected via init({ debug }).");
+      logger.info("[ScaleBun] Debug auto-connected via init({ debug }).");
     } catch (err) {
       logger.warn("[ScaleBun] Auto debug connection failed:", err?.message);
     }
@@ -20466,7 +20600,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
       const apiBaseUrl = this._apiBaseUrl;
       if (!enabled || !appId || !clientKey || !apiBaseUrl) {
         if (enabled && !appId) {
-          __DEV__ && logger.info("[ScaleBun] Envelope event tracking disabled \u2014 no appId in init config.");
+          logger.info("[ScaleBun] Envelope event tracking disabled \u2014 no appId in init config.");
         }
         return;
       }
@@ -20516,7 +20650,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
         onEvent: (eventName, revenue) => this._skanManager?.onEvent(eventName, revenue)
       });
       this._eventTracker.start();
-      __DEV__ && logger.info("[ScaleBun] Envelope event tracking started \u2192 /v1/batch.");
+      logger.info("[ScaleBun] Envelope event tracking started \u2192 /v1/batch.");
       this._applyNativeDeviceContext(this._eventTracker);
       this._captureInstallReferrer(this._eventTracker);
       const tracker = this._eventTracker;
@@ -21150,7 +21284,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
       const cfg = await (this._getEngageTransport()?.fetchEngageConfig(context) ?? Promise.resolve(null));
       const messages = cfg?.inAppMessages ?? [];
       const previews = messages.filter((m) => m.preview === true || m.isTest === true);
-      __DEV__ && logger.info(`[Engage] debugFetchInAppMessages \u2192 ${messages.length} message(s), ${previews.length} test preview(s)`);
+      logger.info(`[Engage] debugFetchInAppMessages \u2192 ${messages.length} message(s), ${previews.length} test preview(s)`);
       return messages;
     },
     /** Upload a survey/NPS/feedback response (idempotent, rides the outbox). */
@@ -21426,7 +21560,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
         logger.warn("SDK not initialized. Event dropped:", name);
         return;
       }
-      __DEV__ && logger.debug("Tracking event:", name);
+      logger.debug("Tracking event:", name);
       engageSignals.emit(name, payload);
       const adapter = SessionManager.getExistingInstance()?.getBackendTransport();
       if (!isUploadedSessionEvent(name)) {
@@ -21555,7 +21689,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
         await Promise.all([this._eventTracker?.flush() ?? Promise.resolve(), adapter?.flushAnalytics() ?? Promise.resolve()]);
         return;
       }
-      __DEV__ && logger.debug("Flushing events from persistent queue...");
+      logger.debug("Flushing events from persistent queue...");
       const httpClient = coreContainer.get("HttpClient");
       await flushQueue(this._getQueue(), httpClient, getDeviceId());
     });
@@ -21577,9 +21711,9 @@ var ScaleBunFacade = class _ScaleBunFacade {
       const bootstrapPerfFeature = getPerformanceFeature();
       if (bootstrapPerfFeature) {
         this._performanceFeature = bootstrapPerfFeature;
-        __DEV__ && logger.debug("Performance feature linked from bootstrap");
+        logger.debug("Performance feature linked from bootstrap");
       }
-      __DEV__ && logger.info("Debug enabled");
+      logger.info("Debug enabled");
     });
   }
   /** Disable the debug subsystem and clean up */
@@ -21722,14 +21856,14 @@ var ScaleBunFacade = class _ScaleBunFacade {
         return false;
       }
       sm.startSession(metadata);
-      __DEV__ && logger.info("session.start() \u2705 sessionId:", sm.currentSessionId);
+      logger.info("session.start() \u2705 sessionId:", sm.currentSessionId);
       return true;
     },
     end: (reason) => {
       const sm = SessionManager.getExistingInstance();
       if (!sm || !sm.isActive) return false;
       sm.endSession(reason);
-      __DEV__ && logger.info("session.end() \u2705");
+      logger.info("session.end() \u2705");
       return true;
     },
     emitEvent: (type, data) => {
@@ -21782,7 +21916,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
         ...this._privacyConfig,
         ...config
       };
-      __DEV__ && logger.debug("[report] Privacy config updated");
+      logger.debug("[report] Privacy config updated");
     },
     /** Set branding for exported reports. */
     setBranding: (config) => {
@@ -21790,7 +21924,7 @@ var ScaleBunFacade = class _ScaleBunFacade {
         ...this._brandingConfig,
         ...config
       };
-      __DEV__ && logger.debug("[report] Branding config updated");
+      logger.debug("[report] Branding config updated");
     },
     /** Get current privacy config. */
     getPrivacy: () => ({
@@ -21837,9 +21971,9 @@ var ScaleBunFacade = class _ScaleBunFacade {
           AutoScreenDetector: AutoScreenDetector2
         } = (init_AutoScreenDetector(), __toCommonJS(AutoScreenDetector_exports));
         AutoScreenDetector2.getInstance().setNavigationRef(ref);
-        __DEV__ && logger.info("[ScaleBun] Navigation ref set \u2192 auto screen detection active");
+        logger.info("[ScaleBun] Navigation ref set \u2192 auto screen detection active");
       } catch (err) {
-        __DEV__ && logger.debug("[ScaleBun] Navigation ref stashed (detector not ready):", err?.message);
+        logger.debug("[ScaleBun] Navigation ref stashed (detector not ready):", err?.message);
       }
     });
   }
@@ -22146,8 +22280,8 @@ function installEngageTriggerEngine(deps) {
     if (!cachedConfig) return;
     configReady = true;
     const now2 = Date.now();
-    const pending4 = recent.splice(0);
-    for (const e of pending4) {
+    const pending5 = recent.splice(0);
+    for (const e of pending5) {
       const age = now2 - e.at;
       if (age > RECENT_TTL_MS) continue;
       const remaining = delayMsForTrigger(cachedConfig, e.options.trigger) - age;
@@ -23412,11 +23546,11 @@ var keyOf = (value) => value.trim();
 var validRect = (rect) => [rect.x, rect.y, rect.width, rect.height].every(Number.isFinite) && rect.width > 0 && rect.height > 0;
 function createEngageAnchorRegistry() {
   const entries = /* @__PURE__ */ new Map();
-  const listeners2 = /* @__PURE__ */ new Map();
+  const listeners3 = /* @__PURE__ */ new Map();
   const notify = (rawKey) => {
     const key = keyOf(rawKey);
     if (!key) return;
-    listeners2.get(key)?.forEach((listener) => listener());
+    listeners3.get(key)?.forEach((listener) => listener());
   };
   return {
     register(rawKey, node) {
@@ -23458,12 +23592,12 @@ function createEngageAnchorRegistry() {
       const key = keyOf(rawKey);
       if (!key) return () => {
       };
-      const set = listeners2.get(key) ?? /* @__PURE__ */ new Set();
+      const set = listeners3.get(key) ?? /* @__PURE__ */ new Set();
       set.add(listener);
-      listeners2.set(key, set);
+      listeners3.set(key, set);
       return () => {
         set.delete(listener);
-        if (set.size === 0) listeners2.delete(key);
+        if (set.size === 0) listeners3.delete(key);
       };
     },
     notify
@@ -24310,11 +24444,11 @@ var normalizedWheelValue = (value) => value.toLowerCase().replace(/\s+/g, " ").t
 function resolveWheelOutcome(segments, source) {
   const identity = wheelOutcomeIdentity(source);
   const index = findWheelOutcomeIndex(segments, identity);
-  const resolved3 = index >= 0;
+  const resolved = index >= 0;
   return {
-    index: resolved3 ? index : 0,
-    label: identity.resultLabel || (resolved3 ? segments[index]?.fullLabel ?? "" : ""),
-    resolved: resolved3
+    index: resolved ? index : 0,
+    label: identity.resultLabel || (resolved ? segments[index]?.fullLabel ?? "" : ""),
+    resolved
   };
 }
 function SpinWheelInApp(props) {
@@ -32572,10 +32706,10 @@ var import_jsx_runtime6 = require("react/jsx-runtime");
 var keyOf2 = (value) => value.trim();
 function createEngageInlinePlacementRegistry() {
   const slots = /* @__PURE__ */ new Map();
-  const pending4 = /* @__PURE__ */ new Map();
-  const listeners2 = /* @__PURE__ */ new Map();
+  const pending5 = /* @__PURE__ */ new Map();
+  const listeners3 = /* @__PURE__ */ new Map();
   const notify = (key) => {
-    listeners2.get(key)?.forEach((listener) => listener());
+    listeners3.get(key)?.forEach((listener) => listener());
   };
   return {
     register(rawKey, sink) {
@@ -32592,7 +32726,7 @@ function createEngageInlinePlacementRegistry() {
         sink,
         token
       });
-      sink(pending4.get(key) ?? null);
+      sink(pending5.get(key) ?? null);
       if (!previous) notify(key);
       return () => {
         if (slots.get(key)?.token !== token) return;
@@ -32603,7 +32737,7 @@ function createEngageInlinePlacementRegistry() {
     deliver(rawKey, delivery) {
       const key = keyOf2(rawKey);
       if (!key) return false;
-      pending4.set(key, delivery);
+      pending5.set(key, delivery);
       const slot = slots.get(key);
       slot?.sink(delivery);
       return slot !== void 0;
@@ -32611,9 +32745,9 @@ function createEngageInlinePlacementRegistry() {
     clear(rawKey, messageId) {
       const key = keyOf2(rawKey);
       if (!key) return;
-      const current = pending4.get(key);
+      const current = pending5.get(key);
       if (!current || messageId !== void 0 && current.message?.id !== messageId) return;
-      pending4.delete(key);
+      pending5.delete(key);
       slots.get(key)?.sink(null);
     },
     has(rawKey) {
@@ -32624,12 +32758,12 @@ function createEngageInlinePlacementRegistry() {
       const key = keyOf2(rawKey);
       if (!key) return () => {
       };
-      const set = listeners2.get(key) ?? /* @__PURE__ */ new Set();
+      const set = listeners3.get(key) ?? /* @__PURE__ */ new Set();
       set.add(listener);
-      listeners2.set(key, set);
+      listeners3.set(key, set);
       return () => {
         set.delete(listener);
-        if (set.size === 0) listeners2.delete(key);
+        if (set.size === 0) listeners3.delete(key);
       };
     }
   };
@@ -33173,8 +33307,8 @@ function EngagePromptProvider({
         __DEV__ && logger.debug("[Engage] no eligible in-app message to render");
         return false;
       }
-      const resolved3 = selectInAppVariant(message, getDeviceId());
-      activeInAppVariantRef.current = message.experiment?.enabled ? resolved3 : null;
+      const resolved = selectInAppVariant(message, getDeviceId());
+      activeInAppVariantRef.current = message.experiment?.enabled ? resolved : null;
       store.recordImpression(message.id, Date.now(), message.revision);
       setActiveInApp(message);
       return true;
@@ -33418,6 +33552,7 @@ var import_react_native43 = require("react-native");
 // lib/module/features/journey/touchTarget.js
 var MAX_DEPTH = 12;
 var MAX_LEN = 60;
+var MAX_PATH_SEGMENTS = 4;
 function str2(v) {
   if (typeof v !== "string") return void 0;
   const s = v.trim();
@@ -33449,41 +33584,136 @@ function fiberOf(event) {
   const e = event;
   const direct = e._targetInst;
   if (direct && typeof direct === "object") return direct;
-  const target = e.target;
-  if (target && typeof target === "object") {
-    const handle = target._internalFiberInstanceHandleDEV ?? target._internalInstanceHandle;
+  const target = e.target ?? e.nativeEvent?.target;
+  if (target) {
+    const handle = target._internalInstanceHandle ?? target._targetInst;
     if (handle && typeof handle === "object") return handle;
   }
   return null;
 }
-function resolveTouchTarget(event, maxDepth = MAX_DEPTH) {
+function resolveTouchTarget(event, optsOrMaxDepth = {}) {
+  const opts = typeof optsOrMaxDepth === "number" ? {
+    maxDepth: optsOrMaxDepth
+  } : optsOrMaxDepth;
+  const maxDepth = opts.maxDepth ?? MAX_DEPTH;
   let f = fiberOf(event);
   if (!f) return null;
   const out = {};
+  const segments = [];
+  const ancestors = [];
   let depth = 0;
   try {
     while (f && depth < maxDepth) {
       const props = f.memoizedProps;
       if (props) {
-        out.accessibilityLabel ??= str2(props.accessibilityLabel);
+        const beforeTestId = out.testID;
         out.testID ??= str2(props.testID);
-        out.text ??= textChild(props);
+        if (!beforeTestId && out.testID) out.node = f.stateNode;
+        if (typeof props.cellKey === "string" && props.cellKey) {
+          out.itemKey ??= str2(props.cellKey);
+          if (typeof props.index === "number" && Number.isFinite(props.index)) {
+            out.itemIndex ??= props.index;
+          }
+        }
+        if (opts.includeText) {
+          out.accessibilityLabel ??= str2(props.accessibilityLabel);
+          out.text ??= textChild(props);
+        }
       }
-      out.component ??= componentName(f);
-      if (out.accessibilityLabel && out.testID) break;
+      if (f.stateNode) ancestors.push(f.stateNode);
+      const name = componentName(f);
+      if (name) {
+        out.component ??= name;
+        if (segments[segments.length - 1] !== name && segments.length < MAX_PATH_SEGMENTS) {
+          segments.push(name);
+        }
+      }
+      if (out.testID && segments.length >= MAX_PATH_SEGMENTS) break;
       f = f.return ?? null;
       depth++;
     }
   } catch {
   }
-  return out.accessibilityLabel || out.testID || out.text || out.component ? out : null;
+  if (segments.length) out.path = segments.join("<");
+  if (!out.node) out.node = fiberOf(event)?.stateNode;
+  if (ancestors.length) out.ancestors = ancestors;
+  return out.testID || out.path || out.component || out.accessibilityLabel || out.text || out.itemKey ? out : null;
 }
 function describeTouchTarget(t) {
   if (!t) return void 0;
-  return t.accessibilityLabel || t.testID || t.text || t.component;
+  return t.testID || t.path || t.component;
+}
+function targetIdentity(t) {
+  if (!t) return {
+    source: "none"
+  };
+  if (t.testID) return {
+    id: t.testID,
+    source: "testID"
+  };
+  if (t.path) return {
+    id: t.path,
+    source: "path"
+  };
+  if (t.component) return {
+    id: t.component,
+    source: "component"
+  };
+  return {
+    source: "none"
+  };
+}
+
+// lib/module/features/journey/targetGeometry.js
+function readRectSync(node) {
+  if (!node || typeof node !== "object") return null;
+  const n = node;
+  const fn = typeof n.unstable_getBoundingClientRect === "function" ? n.unstable_getBoundingClientRect : typeof n.getBoundingClientRect === "function" ? n.getBoundingClientRect : null;
+  if (!fn) return null;
+  try {
+    const r = fn.call(n);
+    if (!r) return null;
+    const {
+      x,
+      y,
+      width,
+      height
+    } = r;
+    if (![x, y, width, height].every((v) => typeof v === "number" && Number.isFinite(v))) return null;
+    if (width <= 0 || height <= 0) return null;
+    return {
+      x,
+      y,
+      width,
+      height
+    };
+  } catch {
+    return null;
+  }
+}
+function normalizeRect(rect, base) {
+  if (!rect || !base || base.w <= 0 || base.h <= 0) return null;
+  const out = {
+    x: rect.x / base.w,
+    y: rect.y / base.h,
+    width: rect.width / base.w,
+    height: rect.height / base.h
+  };
+  if (![out.x, out.y, out.width, out.height].every((v) => Number.isFinite(v))) return null;
+  return out;
+}
+function localPoint(rect, nx, ny) {
+  if (!rect || rect.width <= 0 || rect.height <= 0) return null;
+  if (typeof nx !== "number" || typeof ny !== "number") return null;
+  if (!Number.isFinite(nx) || !Number.isFinite(ny)) return null;
+  return {
+    u: (nx - rect.x) / rect.width,
+    v: (ny - rect.y) / rect.height
+  };
 }
 
 // lib/module/features/journey/ScaleBunDebugRoot.js
+init_scrollContext();
 init_device();
 init_interactionProtocol();
 var import_jsx_runtime8 = require("react/jsx-runtime");
@@ -33495,6 +33725,7 @@ function getBootstrap() {
   return _bootstrap;
 }
 var JourneyContext = /* @__PURE__ */ (0, import_react9.createContext)(null);
+var UI_STATE_CAPTURE_MIN_INTERVAL_MS = 1e3;
 function ScaleBunDebugRoot({
   children,
   navigationRef,
@@ -33673,6 +33904,28 @@ function ScaleBunDebugRoot({
       clearTimeout(timer);
     };
   }, [navigationRef]);
+  (0, import_react9.useEffect)(() => {
+    let lastCaptureTs = 0;
+    const {
+      onUiStateChange: onUiStateChange2
+    } = (init_uiState(), __toCommonJS(uiState_exports));
+    const unsubscribe = onUiStateChange2(() => {
+      const now2 = Date.now();
+      if (now2 - lastCaptureTs < UI_STATE_CAPTURE_MIN_INTERVAL_MS) return;
+      lastCaptureTs = now2;
+      try {
+        const {
+          SessionManager: SessionManager2
+        } = (init_SessionManager(), __toCommonJS(SessionManager_exports));
+        const sm = SessionManager2.getExistingInstance();
+        if (sm && typeof sm.captureManualFrame === "function") {
+          void sm.captureManualFrame();
+        }
+      } catch {
+      }
+    });
+    return unsubscribe;
+  }, []);
   const lastNativeTouchTsRef = (0, import_react9.useRef)(0);
   const nativeTrackingConfirmedRef = (0, import_react9.useRef)(false);
   const touchStartRef = (0, import_react9.useRef)(null);
@@ -33689,10 +33942,15 @@ function ScaleBunDebugRoot({
           lastNativeTouchTsRef.current = Date.now();
           nativeTrackingConfirmedRef.current = true;
           const nativeOccurredAt = typeof event.occurredAt === "number" ? event.occurredAt : (typeof event.timestamp === "number" ? event.timestamp : Date.now()) - (typeof event.durationMs === "number" ? event.durationMs : 0);
-          const start = nearestInteractionStart(interactionStartsRef.current, nativeOccurredAt);
+          pruneInteractionStarts(interactionStartsRef.current, nativeOccurredAt);
+          const correlation = correlateInteraction(interactionStartsRef.current, nativeOccurredAt);
+          const start = correlation.start;
+          if (correlation.index >= 0) {
+            interactionStartsRef.current.splice(correlation.index, 1);
+          }
           if (start) {
-            const pending4 = pendingJsEmitsRef.current.get(start.interactionId);
-            if (pending4 !== void 0) clearTimeout(pending4);
+            const pending5 = pendingJsEmitsRef.current.get(start.interactionId);
+            if (pending5 !== void 0) clearTimeout(pending5);
             pendingJsEmitsRef.current.delete(start.interactionId);
           }
           const {
@@ -33715,11 +33973,62 @@ function ScaleBunDebugRoot({
             interactionId: event.interactionId || start?.interactionId || generateInteractionId(),
             interactionProtocol: event.interactionProtocol || INTERACTION_PROTOCOL_VERSION,
             occurredAt: nativeOccurredAt,
+            /**
+             * RN-6 — THESE FIVE FIELDS ARE THE ONLY ONES THE JOIN CARRIES, AND
+             * THEREFORE THE ONLY ONES A BAD JOIN CAN FALSIFY.
+             *
+             * Coordinates below come from native and are right regardless. So a
+             * mispairing does not produce visibly broken data: it produces heat
+             * in the correct position attributed to the wrong control, in the
+             * wrong UI state, on the wrong screen. Every field is individually
+             * well-formed and nothing downstream can tell.
+             *
+             * When the correlation is not 'exact' they are left UNDEFINED rather
+             * than filled from a best guess. An interaction with no target is
+             * honest and visibly incomplete — the accounting lane can count it as
+             * unplaceable and say why. An interaction with the WRONG target is
+             * indistinguishable from a correct one and silently corrupts every
+             * aggregate it enters. `null` is not `0`, and a guess is not a
+             * measurement.
+             */
             ui: start?.ui,
             stateStatus: start?.stateStatus ?? "not_captured",
             target: start?.target,
             targetId: start?.targetId,
+            targetSource: start?.targetSource,
             screenName: start?.screenName,
+            screenSource: start?.screenSource ?? "none",
+            targetRect: start?.targetRect,
+            /**
+             * RN-15 — WHERE IN THE CONTROL, computed where both halves exist: the
+             * point comes from the native event and the rect was measured at
+             * finger-down, in the same capture base. Pairing them here rather than
+             * downstream stops anything later reaching for a different rect.
+             */
+            ...(() => {
+              const lp = localPoint(start?.targetRect ?? null, event.normalizedX, event.normalizedY);
+              return lp ? {
+                localU: lp.u,
+                localV: lp.v
+              } : {};
+            })(),
+            scrollX: start?.scrollX,
+            scrollY: start?.scrollY,
+            scrollSource: start?.scrollSource ?? "none",
+            itemKey: start?.itemKey,
+            itemIndex: start?.itemIndex,
+            /**
+             * The join's own verdict, shipped with the row so it is auditable
+             * rather than a claim made in a comment. 'ambiguous' and 'none' are
+             * deliberately distinguished: 'none' means the JS handler never fired
+             * (a real capture gap on this platform), 'ambiguous' means it fired
+             * more than once too close together to attribute. Those have
+             * different fixes, and collapsing them would hide which one is
+             * actually happening in production.
+             */
+            correlation: correlation.outcome,
+            correlationDeltaMs: correlation.deltaMs,
+            correlationRunnerUpDeltaMs: correlation.runnerUpDeltaMs,
             emitAutomaticAnalytics: start?.emitAutomaticAnalytics ?? captureAutomaticInteractions,
             x: event.rawX,
             y: event.rawY,
@@ -33791,6 +34100,7 @@ function ScaleBunDebugRoot({
       const target = resolveTouchTarget(e);
       let ui;
       let screenName;
+      let screenSource = "none";
       try {
         const {
           uiStateSignature: uiStateSignature2
@@ -33802,7 +34112,9 @@ function ScaleBunDebugRoot({
         const {
           AutoScreenDetector: AutoScreenDetector2
         } = (init_AutoScreenDetector(), __toCommonJS(AutoScreenDetector_exports));
-        screenName = AutoScreenDetector2.getInstance().getCurrentScreen() || void 0;
+        const detector = AutoScreenDetector2.getInstance();
+        screenName = detector.getCurrentScreen() || void 0;
+        screenSource = screenName ? detector.getCurrentScreenSource() : "none";
       } catch {
       }
       const start = {
@@ -33812,9 +34124,91 @@ function ScaleBunDebugRoot({
         y: touch.pageY,
         locationX: touch.locationX,
         locationY: touch.locationY,
+        /**
+         * RN-1 + RN-2 — the identity that is persisted, and it is now code-derived.
+         *
+         * `describeTouchTarget` returns `testID` -> structural path -> component name,
+         * and never a caption or an accessibilityLabel. Before RN-2 it preferred free
+         * text, so this line was writing user data ("Pay EGP 1,442", an order row
+         * labelled with an email address, a contact's name) into the analytics store —
+         * and, because `target` is an aggregation key, splitting one button into one
+         * bucket per person at the same time.
+         *
+         * `targetId` used to be `target?.testID` alone, which is `undefined` in the
+         * overwhelming majority of apps — no testIDs authored — so the field the
+         * backend keys on was empty almost always. It now falls back to the structural
+         * path, with `targetSource` recording WHICH it got.
+         */
         target: describeTouchTarget(target),
-        targetId: target?.testID,
+        targetId: targetIdentity(target).id,
+        /**
+         * WHICH KIND of identity this is, because they are not equally trustworthy: a
+         * `testID` is a promise from the app's authors that this control is this
+         * control; a `path` is an inference that breaks when the tree is refactored.
+         * Without this the accounting lane cannot distinguish "the control had no
+         * identity" from "the identity is a structural guess", and both would render
+         * as an equally confident target.
+         */
+        targetSource: targetIdentity(target).source,
+        /* RN-4 — row identity from the app's own keyExtractor; see touchTarget.ts. */
+        itemKey: target?.itemKey,
+        itemIndex: target?.itemIndex,
+        /**
+         * RN-13 — the control's rectangle, so `heat ∈ target` is decidable.
+         *
+         * Read SYNCHRONOUSLY here, in the same tick as the touch, and normalized against
+         * the SAME measured root the tap's own coordinates use. Both halves matter:
+         *
+         *   - A callback measurement (`measureInWindow`) would resolve after this handler
+         *     returns, so the rect attached to a tap could be the previous tap's, with
+         *     nothing afterwards able to tell. `targetGeometry` refuses to guess: it reads
+         *     now or reports null.
+         *   - Normalizing against a window size instead of the root view is off by the
+         *     status bar on most devices, which would read as "the heat is just outside
+         *     the button" everywhere rather than as a measurement bug.
+         *
+         * `measureRoot()` is called first because the cached root rect is populated
+         * asynchronously at mount; without it the first taps of a session normalize
+         * against nothing and get a null rect for a reason that has nothing to do with
+         * the control.
+         */
+        /**
+         * RN-3 — WHERE IN THE CONTENT, not just where on the glass.
+         *
+         * Two taps at the same screen coordinate one viewport apart are two different
+         * controls. Without an offset they merge into one hotspot, and the heatmap shows
+         * heavy engagement at a position where, in content terms, nothing in particular
+         * is. The offset is also a CACHE dimension — two scroll states of one route must
+         * not share a backdrop — so its absence corrupts the picture as well as the count.
+         *
+         * `ancestors` is innermost-first, so this takes the NEAREST scroller that has a
+         * recorded position: a tap inside a horizontal carousel belongs to the carousel's
+         * content, not to how far the page behind it had scrolled.
+         *
+         * Null when no ancestor has one — never zero. Zero is a real scroll position (the
+         * top of a list), and reporting it for "unknown" would place every unmeasured tap
+         * at the top of its content, indistinguishable from a genuine tap there.
+         */
+        ...(() => {
+          const hit = nearestRecordedOffset((target?.ancestors ?? []).map((n) => nativeTagOf(n)));
+          return hit ? {
+            scrollX: hit.x,
+            scrollY: hit.y,
+            scrollSource: "wrapper"
+          } : {
+            scrollSource: "none"
+          };
+        })(),
+        targetRect: (() => {
+          measureRoot();
+          const root = rootRectRef.current;
+          return normalizeRect(readRectSync(target?.node), root ? {
+            w: root.w,
+            h: root.h
+          } : null) ?? void 0;
+        })(),
         screenName,
+        screenSource,
         ui,
         stateStatus: ui ? "captured_nonempty" : "not_instrumented",
         emitAutomaticAnalytics: captureAutomaticInteractions
@@ -33851,7 +34245,12 @@ function ScaleBunDebugRoot({
       }
       measureRoot();
       const rootRect = rootRectRef.current;
-      const tapped = start?.target ?? describeTouchTarget(resolveTouchTarget(e));
+      const freshTarget = start ? null : resolveTouchTarget(e);
+      const tapped = start?.target ?? describeTouchTarget(freshTarget);
+      const identity = start ? {
+        id: start.targetId,
+        source: start.targetSource
+      } : targetIdentity(freshTarget);
       const gestureDetails = {
         target: tapped,
         interactionId: start?.interactionId ?? generateInteractionId(),
@@ -33859,8 +34258,16 @@ function ScaleBunDebugRoot({
         occurredAt: start?.occurredAt ?? Date.now(),
         ui: start?.ui,
         stateStatus: start?.stateStatus ?? "not_captured",
-        targetId: start?.targetId,
+        targetId: identity.id,
+        targetSource: identity.source,
         screenName: start?.screenName,
+        screenSource: start?.screenSource ?? "none",
+        targetRect: start?.targetRect,
+        scrollX: start?.scrollX,
+        scrollY: start?.scrollY,
+        scrollSource: start?.scrollSource ?? "none",
+        itemKey: start?.itemKey,
+        itemIndex: start?.itemIndex,
         emitAutomaticAnalytics: start?.emitAutomaticAnalytics ?? captureAutomaticInteractions,
         x: start?.x ?? touch.pageX,
         y: start?.y ?? touch.pageY,
@@ -33876,6 +34283,11 @@ function ScaleBunDebugRoot({
         const ny = Math.max(0, Math.min(1, (start?.y ?? touch.pageY) / rootRect.h));
         gestureDetails.normalizedX = nx;
         gestureDetails.normalizedY = ny;
+        const lp = localPoint(start?.targetRect ?? null, nx, ny);
+        if (lp) {
+          gestureDetails.localU = lp.u;
+          gestureDetails.localV = lp.v;
+        }
         gestureDetails.normalizedPrecomputed = true;
         gestureDetails.viewportWidth = rootRect.w;
         gestureDetails.viewportHeight = rootRect.h;
@@ -34004,6 +34416,13 @@ function useScaleBunScreen(name) {
       }
     } catch {
     }
+    try {
+      const {
+        AutoScreenDetector: AutoScreenDetector2
+      } = (init_AutoScreenDetector(), __toCommonJS(AutoScreenDetector_exports));
+      AutoScreenDetector2.getInstance().setManualScreen(name);
+    } catch {
+    }
     try {
       const bs = getBootstrap();
       const perfFeature = bs?.getPerformanceFeature?.();
@@ -34154,6 +34573,18 @@ var ScaleBunScrollView = /* @__PURE__ */ import_react12.default.forwardRef(funct
       }
     } catch {
     }
+    try {
+      const {
+        recordScrollOffset: recordScrollOffset2,
+        nativeTagOf: nativeTagOf2
+      } = (init_scrollContext(), __toCommonJS(scrollContext_exports));
+      const {
+        contentOffset,
+        target
+      } = event.nativeEvent;
+      recordScrollOffset2(typeof target === "number" ? target : nativeTagOf2(target), contentOffset.x, contentOffset.y);
+    } catch {
+    }
     if (userOnScroll) {
       userOnScroll(event);
     }