@scalebun/react-native 1.13.0 → 2.0.1

package/ios/Ota/ScaleBunOtaModule.swift

@@ -1,7 +1,6 @@
 import Foundation
 import React
 import CommonCrypto
-import CryptoKit
 
 /**
  * React Native bridge for OTA bundle management (`ScaleBunOta`) on iOS.
@@ -21,6 +20,21 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
 
     private static let slotManager = OtaSlotManager()
 
+    /// Trusted RSA public keys embedded in the app bundle (docs §9). Non-empty
+    /// once the app ships a `ScaleBunOtaKeys.json` resource — which flips staging
+    /// into the native-ENFORCED path (see `stageBundle`).
+    private static let keyRegistry = ScaleBunOtaKeyRegistry.fromBundle()
+
+    /// Device-derived verification context — never taken from JS.
+    private static func buildContext() -> ExpectedContext {
+        ExpectedContext(
+            projectId: keyRegistry.projectId,
+            applicationId: Bundle.main.bundleIdentifier ?? "",
+            currentSequence: slotManager.highestConfirmedSequence(),
+            nowEpochSeconds: Int64(Date().timeIntervalSince1970)
+        )
+    }
+
     static func moduleName() -> String! { "ScaleBunOta" }
 
     @objc static func requiresMainQueueSetup() -> Bool { false }
@@ -73,6 +87,17 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
         return ScaleBunOtaModule.slotManager.slotStateJSON() as NSString
     }
 
+    /// JSON array of the trusted key IDs embedded in this app (SDK trust coverage).
+    @objc(getTrustedKeyIds)
+    func getTrustedKeyIds() -> NSString {
+        let ids = ScaleBunOtaModule.keyRegistry.keyIds()
+        if let data = try? JSONSerialization.data(withJSONObject: ids),
+           let s = String(data: data, encoding: .utf8) {
+            return s as NSString
+        }
+        return "[]"
+    }
+
     @objc(stageBundle:sha256:resolve:reject:)
     /// Stage a bundle into the `next` slot.
     ///
@@ -85,6 +110,16 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
                      sha256: NSString,
                      resolve: @escaping RCTPromiseResolveBlock,
                      reject: @escaping RCTPromiseRejectBlock) {
+        // Native-enforced staging (docs §17): once trusted keys are embedded, the
+        // ONLY way to stage is verifyAndStageRelease, which proves an RSA signature
+        // over the release payload first. SHA-256 integrity alone (what this path
+        // checks) is not authenticity, so a hostile JS bundle cannot use it to
+        // drive an unauthenticated bundle onto the device.
+        if !ScaleBunOtaModule.keyRegistry.isEmpty {
+            NSLog("[ScaleBunOta] stageBundle refused: trusted keys embedded — use verifyAndStageRelease")
+            resolve(false)
+            return
+        }
         let source = sourcePath as String
         let meta: [String: Any] = [
             "sha256": sha256 as String,
@@ -140,6 +175,16 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
                     expectedSha256: NSString,
                     resolve: @escaping RCTPromiseResolveBlock,
                     reject: @escaping RCTPromiseRejectBlock) {
+        // Same native-enforcement as stageBundle: a bsdiff patch staged by hash
+        // alone carries no signature, so once trusted keys are embedded this path
+        // is closed. Result-anchored signed patches are a native follow-up; until
+        // then the SDK falls back to the verified full download. false = "patch
+        // unavailable".
+        if !ScaleBunOtaModule.keyRegistry.isEmpty {
+            NSLog("[ScaleBunOta] stagePatch disabled while trusted keys are embedded — full verified download")
+            resolve(false)
+            return
+        }
         // Patching is relative to the bundle already on disk. With no OTA bundle
         // installed the source would be the app's built-in bundle, which the
         // server did not diff against — so a full download is the correct path.
@@ -255,68 +300,95 @@ class ScaleBunOtaModule: NSObject, RCTBridgeModule {
     }
 
     /**
-     * Verify a detached ed25519 signature with PLATFORM crypto (CryptoKit).
-     *
-     * Why native: the JS verifier lives inside the very bundle it protects —
-     * one malicious bundle can neuter it for every update after. CryptoKit is
-     * outside the bundle's reach, and unlike Android there is no OS floor to
-     * worry about: Curve25519 signing shipped in iOS 13 and the podspec
-     * already requires 13.4.
-     *
-     * Contract (mirrors `src/specs/NativeScaleBunOta.ts`): inputs are
-     * lowercase hex pre-validated by the JS caller; the message is the RAW 32
-     * BYTES of the bundle SHA-256 (the CLI signs digest bytes, not hex text);
-     * resolves 'valid' / 'invalid' / 'unavailable'. A wrong signature is
-     * 'invalid', never a rejection; anything unexpected is 'unavailable' so
-     * machinery failure can never read as a pass.
+     * Verify a SB-OTA-RSA-SHA256-V1 release envelope with PLATFORM crypto
+     * (`SecKeyVerifySignature`) and the EMBEDDED trusted-key registry — no
+     * download, no side effects. Resolves the verdict JSON (`{ ok, code?, keyId?,
+     * releaseId?, bundleId?, releaseSequence?, artifactSha256?, artifactSize?,
+     * resultArtifactSha256?, fingerprint? }`). A failed check is `ok:false` with a
+     * stable `code`, never a rejected promise. Native because the JS verifier
+     * lives inside the very bundle it protects, and the trusted key must come from
+     * the app bundle, not from JS or the server.
      *
-     * ⚪ UNCOMPILED — no macOS toolchain has been available in this workspace
-     * (the standing gap: BsPatch.swift shipped the same way). The algorithm is
-     * pinned by `tools/ed25519-parity` against the live production fixture;
-     * this file still needs one Xcode build before an iOS consumer ships it.
+     * ⚪ Not compiled in this workspace (no macOS toolchain). The RSA/SHA-256
+     * algorithm + wire format are gated by tools/rsa-ota-parity against the shared
+     * fixtures, and ScaleBunOtaVerifierTests is provided to run on a simulator.
      */
-    @objc(verifyEd25519:signatureHex:publicKeyHex:resolve:reject:)
-    func verifyEd25519(_ messageHex: NSString,
-                       signatureHex: NSString,
-                       publicKeyHex: NSString,
+    @objc(verifyRelease:resolve:reject:)
+    func verifyRelease(_ envelopeJson: NSString,
                        resolve: @escaping RCTPromiseResolveBlock,
                        reject: @escaping RCTPromiseRejectBlock) {
-        guard let message = ScaleBunOtaModule.bytesFromHex(messageHex as String),
-              let signature = ScaleBunOtaModule.bytesFromHex(signatureHex as String),
-              let rawKey = ScaleBunOtaModule.bytesFromHex(publicKeyHex as String),
-              rawKey.count == 32 else {
-            // Malformed input from our own caller is not a forgery verdict.
-            resolve("unavailable")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: envelopeJson as String,
+            expected: ScaleBunOtaModule.buildContext(),
+            registry: ScaleBunOtaModule.keyRegistry
+        )
+        resolve(verdict.toJson())
+    }
+
+    /**
+     * Native-ENFORCED install (docs §5, §17): verify the RSA signature against an
+     * embedded key, THEN download, enforce the SIGNED size + SHA-256, and stage
+     * into the `next` slot. JS never stages bytes that were not proven authentic
+     * (once keys are embedded, `stageBundle` refuses). Does not activate —
+     * `applyUpdate` promotes per the install mode. Resolves the verdict JSON.
+     */
+    @objc(verifyAndStageRelease:resolve:reject:)
+    func verifyAndStageRelease(_ envelopeJson: NSString,
+                               resolve: @escaping RCTPromiseResolveBlock,
+                               reject: @escaping RCTPromiseRejectBlock) {
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: envelopeJson as String,
+            expected: ScaleBunOtaModule.buildContext(),
+            registry: ScaleBunOtaModule.keyRegistry
+        )
+        guard verdict.ok, let payload = verdict.payload else {
+            resolve(verdict.toJson())
             return
         }
-        do {
-            let key = try Curve25519.Signing.PublicKey(rawRepresentation: rawKey)
-            resolve(key.isValidSignature(signature, for: message) ? "valid" : "invalid")
-        } catch {
-            // Bytes that are not a curve point cannot have signed anything.
-            resolve("invalid")
+
+        guard let data = (envelopeJson as String).data(using: .utf8),
+              let env = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let url = env["downloadUrl"] as? String, !url.isEmpty else {
+            resolve(Verdict.fail(.DOWNLOAD_FAILED, "envelope has no downloadUrl").toJson())
+            return
         }
-    }
 
-    /// Hex → Data; nil for odd length or a non-hex character.
-    private static func bytesFromHex(_ hex: String) -> Data? {
-        let chars = Array(hex.utf8)
-        guard !chars.isEmpty, chars.count % 2 == 0 else { return nil }
-        var out = Data(capacity: chars.count / 2)
-        for i in stride(from: 0, to: chars.count, by: 2) {
-            guard let hi = ScaleBunOtaModule.hexNibble(chars[i]),
-                  let lo = ScaleBunOtaModule.hexNibble(chars[i + 1]) else { return nil }
-            out.append((hi << 4) | lo)
+        let temp = FileManager.default.temporaryDirectory
+            .appendingPathComponent("scalebun_ota_dl_\(UUID().uuidString)")
+        defer { try? FileManager.default.removeItem(at: temp) }
+
+        guard BundleDownloader.download(urlString: url, destination: temp) else {
+            resolve(Verdict.fail(.DOWNLOAD_FAILED, "download failed").toJson())
+            return
+        }
+        // Size first (cheap) against the SIGNED artifactSize.
+        let attrs = try? FileManager.default.attributesOfItem(atPath: temp.path)
+        let fileSize = (attrs?[.size] as? NSNumber)?.int64Value ?? -1
+        if fileSize != payload.artifactSize {
+            resolve(Verdict.fail(.ARTIFACT_SIZE_MISMATCH, "downloaded size mismatch").toJson())
+            return
         }
-        return out
-    }
 
-    private static func hexNibble(_ c: UInt8) -> UInt8? {
-        switch c {
-        case 0x30...0x39: return c - 0x30            // 0-9
-        case 0x61...0x66: return c - 0x61 + 10       // a-f
-        case 0x41...0x46: return c - 0x41 + 10       // A-F
-        default: return nil
+        // The slot manager streams a SHA-256 and compares against the signed
+        // artifactSha256 (== resultArtifactSha256 for a full artifact), so a wrong
+        // download cannot be staged. meta carries the sequence used by the
+        // anti-downgrade floor once the bundle is confirmed healthy.
+        let meta: [String: Any] = [
+            "sha256": payload.artifactSha256,
+            "releaseSequence": payload.releaseSequence,
+            "bundleId": payload.bundleId,
+            "releaseId": payload.releaseId,
+            "installedAt": Int(Date().timeIntervalSince1970 * 1000)
+        ]
+        let staged = ScaleBunOtaModule.slotManager.stage(
+            sourcePath: temp.path,
+            expectedSha256: payload.artifactSha256,
+            meta: meta
+        )
+        if !staged {
+            resolve(Verdict.fail(.ARTIFACT_HASH_MISMATCH, "staged bytes failed hash check").toJson())
+            return
         }
+        resolve(verdict.toJson())
     }
 }

package/ios/Ota/ScaleBunOtaReleaseVerifier.swift

@@ -0,0 +1,115 @@
+import Foundation
+import Security
+
+/**
+ * SB-OTA-RSA-SHA256-V1 native release verifier for iOS (docs §5) — the mirror of
+ * Android's ScaleBunOtaReleaseVerifier. Runs the authoritative order: strict
+ * decode → registry-only key resolution → `SecKeyVerifySignature` with
+ * `.rsaSignatureMessagePKCS1v15SHA256` over the EXACT signed-payload bytes →
+ * parse → cross-check against the device's own identity + the anti-downgrade
+ * floor. Fails closed and maps every failure to a stable OtaFailureCode.
+ *
+ * The message-level algorithm hashes the payload internally, so the payload is
+ * passed RAW (never pre-hashed — pre-hashing then using a message-level API would
+ * hash twice, PROMPT §11.2).
+ */
+struct ExpectedContext {
+    let projectId: String
+    let applicationId: String   // the app's own bundle identifier
+    let currentSequence: Int64  // anti-downgrade floor
+    let nowEpochSeconds: Int64
+    var platform: String = "ios"
+}
+
+struct Verdict {
+    let ok: Bool
+    let code: OtaFailureCode?
+    let message: String?
+    let payload: SignedRelease?
+    let fingerprint: String?
+
+    static func fail(_ code: OtaFailureCode, _ message: String) -> Verdict {
+        Verdict(ok: false, code: code, message: message, payload: nil, fingerprint: nil)
+    }
+
+    func toJson() -> String {
+        var o: [String: Any] = ["ok": ok]
+        if let c = code { o["code"] = c.rawValue }
+        if let m = message { o["message"] = m }
+        if let f = fingerprint { o["fingerprint"] = f }
+        if let p = payload {
+            o["keyId"] = p.keyId
+            o["releaseId"] = p.releaseId
+            o["bundleId"] = p.bundleId
+            o["releaseSequence"] = p.releaseSequence
+            o["artifactSha256"] = p.artifactSha256
+            o["artifactSize"] = p.artifactSize
+            o["resultArtifactSha256"] = p.resultArtifactSha256
+            o["artifactType"] = p.artifactType
+        }
+        guard let data = try? JSONSerialization.data(withJSONObject: o),
+              let s = String(data: data, encoding: .utf8) else { return "{\"ok\":false,\"code\":\"INTERNAL_VERIFICATION_ERROR\"}" }
+        return s
+    }
+}
+
+enum ScaleBunOtaReleaseVerifier {
+
+    static func verify(envelopeJson: String, expected: ExpectedContext, registry: ScaleBunOtaKeyRegistry) -> Verdict {
+        do {
+            guard let data = envelopeJson.data(using: .utf8),
+                  let env = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+                return .fail(.INVALID_ENVELOPE, "envelope is not JSON")
+            }
+            let proto = (env["protocol"] as? String) ?? ""
+            if proto != OtaProtocol.signatureAlgorithm { return .fail(.UNSUPPORTED_PROTOCOL, "protocol \(proto)") }
+            let signedPayloadB64 = (env["signedPayload"] as? String) ?? ""
+            let signatureB64 = (env["signature"] as? String) ?? ""
+            let envKeyId = (env["keyId"] as? String) ?? ""
+
+            let payloadBytes = try OtaProtocol.decodeBase64Strict(signedPayloadB64, OtaProtocol.maxSignedPayloadBytes, "signedPayload")
+            let signature = try OtaProtocol.decodeBase64Strict(signatureB64, OtaProtocol.maxSignatureBytes, "signature")
+
+            let payloadKeyId = try OtaProtocol.peekKeyId(payloadBytes)
+            if !envKeyId.isEmpty && envKeyId != payloadKeyId {
+                return .fail(.INVALID_ENVELOPE, "envelope keyId disagrees with payload")
+            }
+            guard let key = registry.get(payloadKeyId) else {
+                return .fail(.UNKNOWN_KEY_ID, "no embedded key with id \(payloadKeyId)")
+            }
+
+            // RSA-SHA256 over the EXACT payload bytes, BEFORE parsing.
+            var error: Unmanaged<CFError>?
+            let valid = SecKeyVerifySignature(
+                key.secKey,
+                .rsaSignatureMessagePKCS1v15SHA256,
+                Data(payloadBytes) as CFData,
+                Data(signature) as CFData,
+                &error
+            )
+            if !valid { return .fail(.INVALID_SIGNATURE, "signature did not verify") }
+
+            let payload = try OtaProtocol.parse(payloadBytes)
+
+            if payload.artifactType != "full" { return .fail(.INVALID_SIGNED_PAYLOAD, "signed payload is not a full release") }
+            let projectExpected = registry.projectId.isEmpty ? expected.projectId : registry.projectId
+            if !projectExpected.isEmpty && payload.projectId != projectExpected { return .fail(.PROJECT_MISMATCH, "projectId") }
+            if !expected.applicationId.isEmpty && payload.applicationId != expected.applicationId {
+                return .fail(.APPLICATION_MISMATCH, "applicationId")
+            }
+            if payload.platform != expected.platform { return .fail(.PLATFORM_MISMATCH, "platform") }
+            if payload.expiresAtEpochSeconds != 0 && expected.nowEpochSeconds > payload.expiresAtEpochSeconds {
+                return .fail(.RELEASE_EXPIRED, "release expired")
+            }
+            if payload.releaseSequence < expected.currentSequence {
+                return .fail(.RELEASE_DOWNGRADE_REJECTED, "sequence below current")
+            }
+
+            return Verdict(ok: true, code: nil, message: nil, payload: payload, fingerprint: key.fingerprint)
+        } catch let e as OtaVerifyError {
+            return .fail(e.code, e.message)
+        } catch {
+            return .fail(.INTERNAL_VERIFICATION_ERROR, "\(error)")
+        }
+    }
+}

package/ios/Ota/ScaleBunOtaVerifierTests.swift

@@ -0,0 +1,92 @@
+import XCTest
+@testable import scalebun_react_native
+
+/**
+ * On-device / simulator verification for SB-OTA-RSA-SHA256-V1 (PROMPT §23).
+ *
+ * Proves the shared committed vector (packages/ota-protocol/fixtures — the SAME
+ * bytes the Node codec, backend, JVM harness, and Android test use) verifies with
+ * `SecKeyVerifySignature(.rsaSignatureMessagePKCS1v15SHA256)` and the SPKI→PKCS#1
+ * import path, and that tampering / unknown keys / downgrades are rejected.
+ *
+ * ⚪ Not run in this workspace (no macOS toolchain). Add this file to the host
+ * app's iOS unit-test target and run:  xcodebuild test -scheme <App> -destination
+ * 'platform=iOS Simulator,name=iPhone 15'. Constants are copied verbatim from
+ * fixtures/vectors/full.json.
+ */
+final class ScaleBunOtaVerifierTests: XCTestCase {
+
+    private let signedPayloadB64 =
+        "U0JPVEEwMDEAAQAAABRTQi1PVEEtUlNBLVNIQTI1Ni1WMQAAAAdTSEEtMjU2AAAAFXRlc3QtcnNhLTMwNzItMjAyNi0wMQAAAA5wcm9qX3Rlc3RfMDAwMQAAABVvcmcuc2NhbGVidW4ubGVnYXJhZ2UAAAANcmVsX2Z1bGxfMDAwMQAAAA5ibmRsX2Z1bGxfMDAwMQAAAAdhbmRyb2lkAAAABGZ1bGwAAAAFNC41LjkAAAAGMC43NC4xAAAAAjI0AAAAAAAAACoAAAAAaVW5AAAAAAAAAAAAAAAAAAAAAWD6bpV7WCc0zBI9NJ6rivyixtOu66jZ7EYSJniR99yQMwAAAAAAAAAA+m6Ve1gnNMwSPTSeq4r8osbTruuo2exGEiZ4kffckDM="
+    private let signatureB64 =
+        "jlC7GRLWKXku3cbqtODlFt+qn2CEmS3oHOr9QTopCCzEovUF5a2GRT0PQ5k2C5EX7UGGO0Sv6/WhkznKR9NVEZl6ed0KARHAY8zfwTjin3czx9jpwV9bfsLlxEoKNo9bPfIs3mc0VoHCWOp95hQAotG+GqEwYsXqPruZ43U87qWT0t9/a3QboX+07hPO5vI4fDZQuPeo3W1HmXPKbOB7QGSijtKgKwQNuJHz+etsVsQelDsDofRSpYV92XCheUWWHP7kZKFOCcYUXnVwJcdU0Jhej+22vAESRK2G0CXP3orXE4pASaA3y4wkBQgJAJkcTN/ic1/Wm5BLo7KH+ypK1eo0hnrrLNSh6E+St5NvxlTM3bmxwnwHkPMYVBuOT0fUJy+gbD1/1CPvKakL12vizKwWDYuhfcIGkQUTvP2zCxcqWLfmZ7ZGo6n6WXMX63Vz+IQG0tnx1cp6YqJVIgxqjskQ47sacsfS9QeV5LyJhvBQrDSbpqujo9la8dDzZfDN"
+    private let keyId = "test-rsa-3072-2026-01"
+    private let projectId = "proj_test_0001"
+    private let applicationId = "org.scalebun.legarage"
+
+    private let spkiPem = """
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAt3tfFTPE+lkEbFeYi6zE
++uI+3oJl0HfKtGTh7sr7pSh/uPJq2giF0Uc09ux3Z0i4NlqpOyLmiIrVOgYcWcN+
+/pCl1mh6VmT7nYO3sEhL+HyaIaclCGxvHCJSsaVHH8qQyiCVUypWWKN0L38U4isN
+dJ2x+Wv7iLSZu3oM+ZDyGWCjRLE49jKNl0tfaQX6G1YoyBi1aEu5sWIQ6LjGE4IX
+1AJtOiNoaO9orjVgphA5FDKFFqguhEJrHoSXt3awHaeCYFm/mt+NI6k4sRf59UNx
+hdGh0kVL/6jZncclxueFafOOdfPf+jF3ylTczQhnID7Mg1PdmjXR7cfq7jDdjzfW
+VICJqGt+EhUd92pWrMTa5k3SDin3EetYGJsN7iKLbAl0D6Uy8RfE2mdsF2K6D3EP
+9waHN7vLURCF//TGy84FxPy7vbFgLO4oT07lxaopuGX7vOdONI8qLcFhEAJ9fRVN
+lqPWQGib0iAKE+gLl4CWZen674QZF39fGnOBEz7JsmDfAgMBAAE=
+-----END PUBLIC KEY-----
+"""
+
+    private func registry() throws -> ScaleBunOtaKeyRegistry {
+        let json = "{\"projectId\":\"\(projectId)\",\"keys\":[{\"keyId\":\"\(keyId)\",\"publicKey\":\"\(spkiPem.replacingOccurrences(of: "\n", with: "\\n"))\"}]}"
+        return try ScaleBunOtaKeyRegistry.fromJson(json)
+    }
+
+    private func context(_ currentSequence: Int64 = 0) -> ExpectedContext {
+        ExpectedContext(projectId: projectId, applicationId: applicationId,
+                        currentSequence: currentSequence, nowEpochSeconds: 1_767_225_660)
+    }
+
+    private func envelope(payload: String? = nil, sig: String? = nil) -> String {
+        "{\"protocol\":\"\(OtaProtocol.signatureAlgorithm)\",\"keyId\":\"\(keyId)\"," +
+        "\"signedPayload\":\"\(payload ?? signedPayloadB64)\",\"signature\":\"\(sig ?? signatureB64)\"}"
+    }
+
+    func testGenuineReleaseVerifies() throws {
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: context(), registry: try registry())
+        XCTAssertTrue(v.ok, "expected ok, got \(String(describing: v.code))")
+        XCTAssertEqual(v.payload?.bundleId, "bndl_full_0001")
+        XCTAssertEqual(v.payload?.releaseSequence, 42)
+        XCTAssertEqual(v.payload?.platform, "android") // vector is an android full release
+        XCTAssertEqual(v.payload?.artifactSha256, v.payload?.resultArtifactSha256)
+    }
+
+    func testPlatformMismatchRejected() throws {
+        // Device context is iOS by default; the vector payload is android.
+        var ctx = context(); ctx.platform = "ios"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: ctx, registry: try registry())
+        XCTAssertEqual(v.code, .PLATFORM_MISMATCH)
+    }
+
+    func testTamperedPayloadRejected() throws {
+        let bad = String(signedPayloadB64.dropLast(2)) + (signedPayloadB64.hasSuffix("M=") ? "N=" : "M=")
+        var ctx = context(); ctx.platform = "android"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(payload: bad), expected: ctx, registry: try registry())
+        XCTAssertFalse(v.ok)
+        XCTAssertTrue(v.code == .INVALID_SIGNATURE || v.code == .INVALID_BASE64)
+    }
+
+    func testUnknownKeyRejected() throws {
+        let empty = try ScaleBunOtaKeyRegistry.fromJson("{\"projectId\":\"\(projectId)\",\"keys\":[]}")
+        var ctx = context(); ctx.platform = "android"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: ctx, registry: empty)
+        XCTAssertEqual(v.code, .UNKNOWN_KEY_ID)
+    }
+
+    func testDowngradeRejected() throws {
+        var ctx = context(100); ctx.platform = "android"
+        let v = ScaleBunOtaReleaseVerifier.verify(envelopeJson: envelope(), expected: ctx, registry: try registry())
+        XCTAssertEqual(v.code, .RELEASE_DOWNGRADE_REJECTED)
+    }
+}

package/ios/ReplaySdk.swift

@@ -1,4 +1,5 @@
 import Foundation
+import React
 import UIKit
 
 /// Main ReplaySdk native module (RCTEventEmitter subclass).
@@ -32,12 +33,57 @@ class ReplaySdk: RCTEventEmitter {
     }
 
     /// Attach native touch tracking to the key window.
-    /// Called from initialize() after a short delay to ensure the window is ready.
+    ///
+    /// RETRIED, AND RE-ATTACHED ON FOREGROUND — because the previous one-shot version is the most
+    /// likely explanation for iOS capturing coordinates on 0.4% of interactions where Android
+    /// manages 15.3%.
+    ///
+    /// It ran exactly once, 500 ms after `initialize()`. If `getKeyWindow()` returned nil at that
+    /// instant it logged a warning and never tried again, so native touch tracking was off for the
+    /// WHOLE app session. A cold start behind a heavy JS bundle, a slow device, or a scene-based
+    /// app whose key window is not the one that existed at +500 ms — any of those and no touch is
+    /// ever tracked. Losing that race once lost it permanently.
+    ///
+    /// Android never had the problem because it attaches from a lifecycle hook
+    /// (`ReplaySdkModule.onHostResume`), so every foreground corrects an attach that was too early.
+    /// This mirrors that: bounded retries for the cold-start race, plus a foreground observer that
+    /// attaches if a previous attempt never succeeded. `attach` is idempotent —
+    /// `guard !isActive else { return }` — so a redundant call costs nothing and cannot install a
+    /// second gesture recognizer.
+    ///
+    /// WHAT THIS DOES NOT FIX, stated because that same guard is why: a key window that CHANGES
+    /// after a successful attach. `attach` returns early on `isActive` without comparing the
+    /// window, so the tracker stays bound to the original one and the foreground observer cannot
+    /// help. That needs a detach-and-rebind inside `InteractionTracker`, which is a larger change
+    /// than the race this addresses. The cold-start race is the dominant cause — it costs the whole
+    /// session every time it is lost — and it is fixed here; the window-change case remains open.
     private func activateNativeTracking() {
+        scheduleAttach(attemptsRemaining: 10)
+        NotificationCenter.default.addObserver(
+            self,
+            selector: #selector(reattachNativeTracking),
+            name: UIApplication.didBecomeActiveNotification,
+            object: nil
+        )
+    }
+
+    /// Try to attach, and try again shortly if there is no key window yet.
+    ///
+    /// Ten attempts at 500 ms covers about five seconds of startup, which is far longer than a
+    /// window takes to appear and short enough that a genuinely window-less process stops asking.
+    /// The last failure is logged at warn so a host that never gets tracking is told, rather than
+    /// discovering it as an empty heatmap.
+    private func scheduleAttach(attemptsRemaining: Int) {
         DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { [weak self] in
             guard let self = self else { return }
             guard let window = Self.getKeyWindow() else {
-                ReplayLogger.warn("Native tracking: no key window available")
+                if attemptsRemaining > 1 {
+                    self.scheduleAttach(attemptsRemaining: attemptsRemaining - 1)
+                } else {
+                    ReplayLogger.warn(
+                        "Native tracking: no key window after repeated attempts — touch capture is off"
+                    )
+                }
                 return
             }
             self.interactionTracker.attach(to: window, sendEvent: { [weak self] name, payload in
@@ -46,6 +92,23 @@ class ReplaySdk: RCTEventEmitter {
         }
     }
 
+    /// Re-attach when the app becomes active, mirroring Android's `onHostResume`.
+    @objc private func reattachNativeTracking() {
+        guard let window = Self.getKeyWindow() else { return }
+        interactionTracker.attach(to: window, sendEvent: { [weak self] name, payload in
+            self?.sendEvent(withName: name, body: payload)
+        })
+    }
+
+    /// Matches what the other two observer-registering modules here do
+    /// (`SessionManager`, `ScaleBunProfilerModule`). A native module usually outlives the app's
+    /// interesting lifetime and selector observers have been zeroing-weak since iOS 9, so this is
+    /// hygiene rather than a crash fix — but being the one file that registers and never removes is
+    /// how a convention quietly stops being one.
+    deinit {
+        NotificationCenter.default.removeObserver(self)
+    }
+
     private static func getKeyWindow() -> UIWindow? {
         return WindowResolver.keyWindow()
     }

package/lib/commonjs/bootstrap/SDKBootstrapper.js

@@ -80,6 +80,15 @@ class SDKBootstrapper {
     // apiBaseUrl is LOCKED: whatever an integrator passed (or the schema default) is
     // discarded here so the SDK can never be repointed away from the ScaleBun cloud.
     // Change DEFAULT_API_BASE_URL at build time to target a different backend.
+    // Say so when we discard it. The value was accepted by the schema, silently
+    // overwritten here, and the SDK then talked to a different server than the
+    // integrator configured — with no log, no warning, and no error. Someone
+    // pointing the SDK at a staging or local backend would watch requests arrive
+    // at production and have nothing to go on.
+    const requestedApiBaseUrl = rawConfig?.apiBaseUrl;
+    if (typeof requestedApiBaseUrl === 'string' && requestedApiBaseUrl && requestedApiBaseUrl !== _endpoints.DEFAULT_API_BASE_URL) {
+      _internalLogger.logger.warn(`[ScaleBun] Ignoring apiBaseUrl '${requestedApiBaseUrl}' — the endpoint is ` + `locked at build time and this build targets ${_endpoints.DEFAULT_API_BASE_URL}. To ` + `target another backend, change DEFAULT_API_BASE_URL in the SDK source and ` + `rebuild.`);
+    }
     this.config.apiBaseUrl = _endpoints.DEFAULT_API_BASE_URL;
     // Explicit logLevel wins; otherwise debug:true implies verbose 'debug'.
     if (this.config.logLevel) {
@@ -319,6 +328,27 @@ class SDKBootstrapper {
     await this.featureRegistry.initializeAll(featureContext);
 
     // ── Session Replay Initialization (Core) ───────────────
+    /**
+    * RN-3 zero-config scroll instrumentation, opt-in.
+    *
+    * Placed before replay init because it patches a module export and must be in place before the
+    * host renders its first scroll view. Reports rather than assumes: the equivalent React
+    * Navigation hook once claimed success it had not verified and left a whole pipeline silently
+    * empty, so a failure here is said out loud with a reason an integrator can act on.
+    */
+    if (this.config.autoInstrumentScrollViews === true) {
+      try {
+        const {
+          autoInstrumentScrollViews
+        } = require('../features/journey/autoInstrumentScroll');
+        const outcome = autoInstrumentScrollViews();
+        if (!outcome.installed) {
+          _internalLogger.logger.warn('[Bootstrap] autoInstrumentScrollViews was requested but could not be ' + 'installed: ' + outcome.reason + ' — taps will carry no content depth.');
+        } else {
+          __DEV__ && _internalLogger.logger.debug('[Bootstrap] ScrollView auto-instrumentation installed');
+        }
+      } catch {/* no-throw */}
+    }
     if (features.replay !== false) {
       try {
         __DEV__ && _internalLogger.logger.debug('[Bootstrap] Initializing unified SessionManager');

package/lib/commonjs/core/config/schema.js

@@ -275,6 +275,22 @@ const SHAPE = {
     }
   },
   captureInteractionHeatmap: bool(true),
+  /**
+   * RN-3 zero-config: patch React Native's ScrollView export so EVERY scroll view reports its
+   * offset, not just ones wrapped in ScaleBunScrollView.
+   *
+   * DEFAULT FALSE, unlike captureInteractionHeatmap above, and the difference is deliberate.
+   * That flag changes what the SDK records about the host; this one changes what the HOST
+   * RENDERS — every scroll view in the app, including ones inside third-party libraries the app
+   * did not write, starts routing through an SDK component. The failure mode is not a wrong
+   * number in a dashboard, it is the host's UI behaving differently because an analytics SDK
+   * replaced a primitive. That is a decision an integrator makes deliberately, not one they
+   * discover afterwards.
+   *
+   * With it off, a plain <ScrollView> yields no content depth and the tap says so
+   * (scroll_source: 'none') rather than defaulting its offset to 0.
+   */
+  autoInstrumentScrollViews: bool(false),
   // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
   // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,
   // so capturing it is the host's explicit choice, not a silent default. When true and a
@@ -291,18 +307,9 @@ const SHAPE = {
         kind: 'str',
         opt: true
       },
-      publicSigningKey: {
-        kind: 'str',
-        opt: true
-      },
-      // Rotation support: several pinned keys, any of which may verify a
-      // bundle. Ship a build pinning [old, new], re-sign server-side with
-      // new, drop old next release — no emergency store submission when a
-      // key must be replaced. Merged with publicSigningKey by the facade.
-      publicSigningKeys: {
-        kind: 'strArr',
-        opt: true
-      },
+      // No signing-key fields: signed releases are verified natively against
+      // RSA keys embedded in the app package (SB-OTA-RSA-SHA256-V1). JS must
+      // not supply a trusted key.
       mandatoryBlocksUi: bool(false)
     }
   }

package/lib/commonjs/core/constants/version.js

@@ -14,5 +14,5 @@ exports.SDK_VERSION = void 0;
  * value, so a stale one makes a rollout unobservable — which is the exact problem sending an SDK
  * version was introduced to solve.
  */
-const SDK_VERSION = exports.SDK_VERSION = '1.13.0';
+const SDK_VERSION = exports.SDK_VERSION = '2.0.1';
 //# sourceMappingURL=version.js.map