pulse-updates 1.0.10 → 1.0.12

package/ios/PulseUpdates/AppLauncher/PulseAppLauncher.swift

@@ -284,33 +284,12 @@ final class PulseAppLauncher {
         // Get bundle path using FileManager (handles deep nested paths)
         DispatchQueue.global(qos: .userInitiated).async {
             let bundleRoot = Bundle.main.bundlePath
-            let fileManager = FileManager.default
-            let ext = assetType.components(separatedBy: "/").last ?? "png"
-            var sourcePath: String? = nil
-
-            // 1. Try in assets folder with subdirectory path
-            if let dir = match.nsBundleDir, !dir.isEmpty {
-                let path = "\(bundleRoot)/assets/\(dir)/\(bundleFilename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    sourcePath = path
-                }
-            }
-
-            // 2. Try without assets/ prefix
-            if sourcePath == nil, let dir = match.nsBundleDir, !dir.isEmpty {
-                let path = "\(bundleRoot)/\(dir)/\(bundleFilename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    sourcePath = path
-                }
-            }
-
-            // 3. Try at root
-            if sourcePath == nil {
-                let path = "\(bundleRoot)/\(bundleFilename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    sourcePath = path
-                }
-            }
+            let sourcePath = findBundledAssetPath(
+                bundleRoot: bundleRoot,
+                filename: bundleFilename,
+                assetType: assetType,
+                nsBundleDir: match.nsBundleDir
+            )
 
             guard let finalSourcePath = sourcePath else {
                 self.launcherQueue.async {
@@ -360,10 +339,10 @@ final class PulseAppLauncher {
                 // Download file
                 let data = try Data(contentsOf: remoteUrl)
 
-                // Verify hash if expected
+                // Verify hash if expected (hex, matching the manifest/DB encoding).
                 if let expectedHash = asset.expectedHash {
-                    let actualHash = PulseCrypto.sha256Base64(data)
-                    if actualHash != expectedHash {
+                    let actualHash = PulseCrypto.sha256Hex(data)
+                    if actualHash != expectedHash.lowercased() {
                         self.launcherQueue.async {
                             completion(false, PulseLauncherError.hashMismatch(expected: expectedHash, actual: actualHash))
                         }
@@ -414,7 +393,6 @@ final class PulseAppLauncher {
 
         var map: [String: String] = [:]
         let bundleRoot = Bundle.main.bundlePath
-        let fileManager = FileManager.default
 
         for asset in embedded.assets where !asset.isLaunchAsset {
             guard let filename = asset.nsBundleFilename,
@@ -422,33 +400,12 @@ final class PulseAppLauncher {
                 continue
             }
 
-            // Get file extension from type (e.g., "image/png" -> "png")
-            let ext = assetType.components(separatedBy: "/").last ?? "png"
-            var bundlePath: String? = nil
-
-            // 1. Try in assets folder with subdirectory path (RN stores assets here)
-            if let dir = asset.nsBundleDir, !dir.isEmpty {
-                let path = "\(bundleRoot)/assets/\(dir)/\(filename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    bundlePath = path
-                }
-            }
-
-            // 2. Try without assets/ prefix
-            if bundlePath == nil, let dir = asset.nsBundleDir, !dir.isEmpty {
-                let path = "\(bundleRoot)/\(dir)/\(filename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    bundlePath = path
-                }
-            }
-
-            // 3. Try at root
-            if bundlePath == nil {
-                let path = "\(bundleRoot)/\(filename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    bundlePath = path
-                }
-            }
+            let bundlePath = findBundledAssetPath(
+                bundleRoot: bundleRoot,
+                filename: filename,
+                assetType: assetType,
+                nsBundleDir: asset.nsBundleDir
+            )
 
             if let path = bundlePath {
                 let url = URL(fileURLWithPath: path).absoluteString
@@ -621,15 +578,20 @@ struct PulseDefaultSelectionPolicy: PulseSelectionPolicy {
 
     /// Select the best update to launch
     /// Priority: 1) Ready updates (newest by commitTime), 2) Embedded updates (fallback)
+    /// Excludes updates that failed to launch and were never confirmed good
+    /// (failedLaunchCount > 0 && successfulLaunchCount == 0) so a bad update can't be re-selected.
     func selectUpdateToLaunch(from updates: [PulseUpdate]) -> PulseUpdate? {
+        // Exclude updates that failed to launch and were never confirmed good.
+        let healthy = updates.filter { !($0.failedLaunchCount > 0 && $0.successfulLaunchCount == 0) }
+
         // First, try to find the newest ready (downloaded) update
-        let readyUpdates = updates.filter { $0.status == .ready }
+        let readyUpdates = healthy.filter { $0.status == .ready }
         if let newest = readyUpdates.sorted(by: { $0.commitTime > $1.commitTime }).first {
             return newest
         }
 
-        // Fall back to embedded update
-        return updates.first { $0.status == .embedded }
+        // Fall back to embedded update (embedded is always launchable).
+        return healthy.first { $0.status == .embedded } ?? updates.first { $0.status == .embedded }
     }
 
     /// Select updates to delete - keeps launched update and one backup
@@ -671,12 +633,14 @@ struct PulseDefaultSelectionPolicy: PulseSelectionPolicy {
 // MARK: - Crypto Helper
 
 struct PulseCrypto {
-    static func sha256Base64(_ data: Data) -> String {
+    /// Lowercase hex SHA-256. Manifests and the asset DB store hashes as hex, so all
+    /// integrity comparisons must use hex (not base64).
+    static func sha256Hex(_ data: Data) -> String {
         var hash = [UInt8](repeating: 0, count: Int(CC_SHA256_DIGEST_LENGTH))
         data.withUnsafeBytes {
             _ = CC_SHA256($0.baseAddress, CC_LONG(data.count), &hash)
         }
-        return Data(hash).base64EncodedString()
+        return hash.map { String(format: "%02x", $0) }.joined()
     }
 }
 

package/ios/PulseUpdates/PulseController.swift

@@ -4,6 +4,64 @@
 
 import Foundation
 import Network
+import CryptoKit
+
+// MARK: - Asset Path Resolution
+
+/// Find a bundled asset file by filename and type.
+/// Handles MIME types ("image/png"), plain extensions ("riv", "png"), and "unknown" type.
+/// Falls back to scanning the directory for files matching the filename prefix.
+internal func findBundledAssetPath(
+    bundleRoot: String,
+    filename: String,
+    assetType: String,
+    nsBundleDir: String?
+) -> String? {
+    let fileManager = FileManager.default
+
+    // Derive extension from type
+    let ext: String
+    if assetType.contains("/") {
+        // MIME type: extract after "/" (e.g., "image/png" -> "png")
+        ext = assetType.components(separatedBy: "/").last ?? "png"
+    } else if assetType != "unknown" {
+        // Plain extension (e.g., "riv", "png")
+        ext = assetType
+    } else {
+        ext = "unknown"
+    }
+
+    // Build search directories
+    var searchDirs: [String] = []
+    if let dir = nsBundleDir, !dir.isEmpty {
+        searchDirs.append("\(bundleRoot)/assets/\(dir)")
+        searchDirs.append("\(bundleRoot)/\(dir)")
+    }
+    searchDirs.append(bundleRoot)
+
+    // Try with the derived extension
+    if ext != "unknown" {
+        for dir in searchDirs {
+            let path = "\(dir)/\(filename).\(ext)"
+            if fileManager.fileExists(atPath: path) {
+                return path
+            }
+        }
+    }
+
+    // Fallback: scan directories for files matching the filename prefix
+    // This handles "unknown" type and any other extension mismatches (e.g., .riv files
+    // in builds where the embedded manifest had type="unknown" for non-standard assets)
+    for dir in searchDirs {
+        if let files = try? fileManager.contentsOfDirectory(atPath: dir) {
+            for file in files where file.hasPrefix("\(filename).") && file != "\(filename)." {
+                return "\(dir)/\(file)"
+            }
+        }
+    }
+
+    return nil
+}
 
 // MARK: - Controller Delegate
 
@@ -53,6 +111,24 @@ public final class PulseController {
     /// Remote load status for error recovery
     public private(set) var remoteLoadStatus: PulseRemoteLoadStatus = .idle
 
+    /// Stable, anonymous per-install device id (persisted in the pulse dir). Used to bucket staged
+    /// rollouts server-side via the Pulse-Device-Id header and to attribute telemetry events.
+    private var _deviceId: String?
+    public var deviceId: String {
+        if let id = _deviceId { return id }
+        let file = directory.appendingPathComponent("device_id")
+        if let data = try? Data(contentsOf: file),
+           let s = String(data: data, encoding: .utf8) {
+            let trimmed = s.trimmingCharacters(in: .whitespacesAndNewlines)
+            if !trimmed.isEmpty { _deviceId = trimmed; return trimmed }
+        }
+        let id = UUID().uuidString
+        do { try id.data(using: .utf8)?.write(to: file) }
+        catch { pulseLog("deviceId: persist failed (\(error.localizedDescription)); a new id will be used next launch") }
+        _deviceId = id
+        return id
+    }
+
     // MARK: - Private Properties
 
     private var database: PulseDatabase?
@@ -107,7 +183,8 @@ public final class PulseController {
             launchWaitMs: (info?["PulseUpdatesLaunchWaitMs"] as? Int) ?? 0,
             channel: info?["PulseUpdatesChannel"] as? String,
             signingKeyId: info?["PulseUpdatesSigningKeyId"] as? String,
-            signingPublicKey: info?["PulseUpdatesSigningPublicKey"] as? String
+            signingPublicKey: info?["PulseUpdatesSigningPublicKey"] as? String,
+            requireSignature: (info?["PulseUpdatesRequireSignature"] as? Bool) ?? PulseUpdatesConfig.defaultRequireSignature
         )
     }
 
@@ -172,6 +249,20 @@ public final class PulseController {
 
         // Synchronously select the best update for launch
         selectBestUpdateSync()
+
+        // Wire crash-recovery on the getBundleURL launch path. This path never calls start(), so
+        // without this the RCT fatal handler / RCTContentDidAppear observer would never install and
+        // failed/successful launch recording (and rollback) would never run.
+        if errorRecovery == nil {
+            errorRecovery = PulseErrorRecovery()
+            errorRecovery?.delegate = self
+            errorRecovery?.startMonitoring()
+        }
+
+        // Seed launch-in-progress tracking for the selected update before the first root view renders.
+        if let updateId = launchedUpdate?.updateId {
+            try? database?.recordLaunchStart(updateId: updateId)
+        }
     }
 
     /// Synchronously select the best update (used for initial launch)
@@ -211,6 +302,16 @@ public final class PulseController {
                 let exists = FileManager.default.fileExists(atPath: bundlePath.path)
                 pulseLog("selectBestUpdateSync: bundlePath exists=\(exists)")
 
+                // Re-verify the on-disk bundle against its content-addressed hash before handing it
+                // to React Native. File existence alone is not enough — a truncated/tampered/partial
+                // bundle must not be launched.
+                if exists, !bundleFileMatchesHash(at: bundlePath, expectedHash: bundleHash) {
+                    pulseLogError("selectBestUpdateSync: bundle hash mismatch for \(selectedUpdate.updateId), marking failed and falling back to embedded")
+                    try? database.setStatus(.failed, forUpdateId: selectedUpdate.updateId)
+                    launchEmbedded()
+                    return
+                }
+
                 if exists {
                     launchAssetUrl = bundlePath
                     isEmbeddedLaunch = false
@@ -246,6 +347,22 @@ public final class PulseController {
         }
     }
 
+    /// Re-hash an on-disk bundle file and compare against its expected content-addressed hash
+    /// (lowercased hex SHA-256). Returns true only when the file exists and its digest matches.
+    private func bundleFileMatchesHash(at fileUrl: URL, expectedHash: String) -> Bool {
+        guard let handle = try? FileHandle(forReadingFrom: fileUrl) else { return false }
+        defer { try? handle.close() }
+
+        var hasher = SHA256()
+        while true {
+            let chunk = try? handle.read(upToCount: 1024 * 1024)
+            guard let data = chunk, !data.isEmpty else { break }
+            hasher.update(data: data)
+        }
+        let actual = hasher.finalize().map { String(format: "%02x", $0) }.joined()
+        return actual == expectedHash.lowercased()
+    }
+
     /// Build localAssets map for an OTA update (downloaded + embedded fallbacks)
     /// Store BOTH hash AND path-based keys for maximum compatibility:
     /// - hash: for SHA256 hash lookup (how expo-asset looks up)
@@ -305,40 +422,18 @@ public final class PulseController {
 
         var assets: [String: String] = [:]
         let bundleRoot = Bundle.main.bundlePath
-        let fileManager = FileManager.default
 
         for asset in manifest.assets where !asset.isLaunchAsset {
             guard let filename = asset.nsBundleFilename, let assetType = asset.type else {
                 continue
             }
 
-            // Get file extension from type (e.g., "image/png" -> "png")
-            let ext = assetType.components(separatedBy: "/").last ?? "png"
-            var bundlePath: String? = nil
-
-            // 1. Try in assets folder with subdirectory path (RN stores assets here)
-            if let dir = asset.nsBundleDir, !dir.isEmpty {
-                let path = "\(bundleRoot)/assets/\(dir)/\(filename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    bundlePath = path
-                }
-            }
-
-            // 2. Try without assets/ prefix
-            if bundlePath == nil, let dir = asset.nsBundleDir, !dir.isEmpty {
-                let path = "\(bundleRoot)/\(dir)/\(filename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    bundlePath = path
-                }
-            }
-
-            // 3. Try at root
-            if bundlePath == nil {
-                let path = "\(bundleRoot)/\(filename).\(ext)"
-                if fileManager.fileExists(atPath: path) {
-                    bundlePath = path
-                }
-            }
+            let bundlePath = findBundledAssetPath(
+                bundleRoot: bundleRoot,
+                filename: filename,
+                assetType: assetType,
+                nsBundleDir: asset.nsBundleDir
+            )
 
             if let path = bundlePath {
                 let localUri = URL(fileURLWithPath: path).absoluteString
@@ -535,6 +630,7 @@ public final class PulseController {
                 }
 
                 self.lastCheckManifest = otaManifest
+                self.reportEvent("check", updateId: otaManifest.updateId)
                 pulseLog("checkForUpdate: cached manifest for fetch (ota=\(otaCommitTime) > embedded=\(embeddedCommitTime))")
             }
             completion(result)
@@ -593,6 +689,12 @@ public final class PulseController {
             self.pendingFetchCallbacks.removeAll()
             self.fetchLock.unlock()
 
+            // A freshly downloaded update marks this device "served" on the server, which is what
+            // gates its launch outcomes into the crash-rate auto-rollback.
+            if case .success(let fetchResult) = result, fetchResult.isNew {
+                self.reportEvent("download", updateId: fetchResult.manifest?.updateId)
+            }
+
             // Call original completion
             completion(result)
 
@@ -619,12 +721,44 @@ public final class PulseController {
     public func markAppReady() {
         if let updateId = launchedUpdate?.updateId {
             try? database?.recordSuccessfulLaunch(updateId: updateId)
+            if !isEmbeddedLaunch { reportEvent("launch_success", updateId: updateId) }
         }
 
         // Run reaper after successful launch
         runReaper()
     }
 
+    /// Fire-and-forget device telemetry to the server's /pulse/events endpoint (async URLSession, so
+    /// it never blocks). Best-effort: failures are logged, never silently swallowed, and never affect
+    /// the app. The server marks a device "served" on the "download" event — only served devices count
+    /// toward crash-rate auto-rollback — and uses launch_success/launch_failure to drive that rate.
+    /// appSlug + base are derived from the manifest URL (.../pulse/manifest/{appSlug}).
+    private func reportEvent(_ type: String, updateId: String?) {
+        guard let updateId = updateId, !updateId.isEmpty, let config = config else { return }
+        let marker = "/pulse/manifest/"
+        guard let range = config.updateUrl.range(of: marker) else {
+            pulseLog("reportEvent(\(type)): updateUrl '\(config.updateUrl)' has no \(marker) — skipping")
+            return
+        }
+        let base = String(config.updateUrl[..<range.lowerBound])
+        let appSlug = String(config.updateUrl[range.upperBound...].prefix(while: { $0 != "/" && $0 != "?" }))
+        guard let eventsUrl = URL(string: "\(base)/pulse/events") else { return }
+        let body: [String: Any] = ["appSlug": appSlug, "updateId": updateId, "deviceId": deviceId, "type": type]
+        guard let httpBody = try? JSONSerialization.data(withJSONObject: body) else { return }
+        var req = URLRequest(url: eventsUrl)
+        req.httpMethod = "POST"
+        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        req.timeoutInterval = 5
+        req.httpBody = httpBody
+        URLSession.shared.dataTask(with: req) { _, response, error in
+            if let error = error {
+                pulseLog("reportEvent(\(type)) failed: \(error.localizedDescription)")
+            } else if let http = response as? HTTPURLResponse, !(200...299).contains(http.statusCode) {
+                pulseLog("reportEvent(\(type)) -> HTTP \(http.statusCode)")
+            }
+        }.resume()
+    }
+
     /// Report a fatal error for error recovery handling
     public func reportError(_ error: NSError) {
         errorRecovery?.handle(error: error)
@@ -680,37 +814,15 @@ public final class PulseController {
             var foundCount = 0
             var notFoundCount = 0
             let bundleRoot = Bundle.main.bundlePath
-            let fileManager = FileManager.default
 
             for asset in manifest.assets {
                 if let filename = asset.nsBundleFilename, let assetType = asset.type {
-                    // Get file extension from type (e.g., "image/png" -> "png")
-                    let ext = assetType.components(separatedBy: "/").last ?? "png"
-                    var bundlePath: String? = nil
-
-                    // 1. Try in assets folder with subdirectory path (RN stores assets here)
-                    if let dir = asset.nsBundleDir, !dir.isEmpty {
-                        let path = "\(bundleRoot)/assets/\(dir)/\(filename).\(ext)"
-                        if fileManager.fileExists(atPath: path) {
-                            bundlePath = path
-                        }
-                    }
-
-                    // 2. Try without assets/ prefix
-                    if bundlePath == nil, let dir = asset.nsBundleDir, !dir.isEmpty {
-                        let path = "\(bundleRoot)/\(dir)/\(filename).\(ext)"
-                        if fileManager.fileExists(atPath: path) {
-                            bundlePath = path
-                        }
-                    }
-
-                    // 3. Try at root
-                    if bundlePath == nil {
-                        let path = "\(bundleRoot)/\(filename).\(ext)"
-                        if fileManager.fileExists(atPath: path) {
-                            bundlePath = path
-                        }
-                    }
+                    let bundlePath = findBundledAssetPath(
+                        bundleRoot: bundleRoot,
+                        filename: filename,
+                        assetType: assetType,
+                        nsBundleDir: asset.nsBundleDir
+                    )
 
                     if let path = bundlePath {
                         embeddedAssetHashes[asset.hash.lowercased()] = URL(fileURLWithPath: path)
@@ -856,7 +968,30 @@ public final class PulseController {
 
     private func rollbackToPreviousUpdate() {
         pulseLog("Rolling back to previous update")
-        // Implementation depends on error recovery strategy
+
+        // Mark the currently launched update as failed so the selection policy excludes it
+        // (failedLaunchCount > 0 && successfulLaunchCount == 0) on the next selection.
+        if let updateId = launchedUpdate?.updateId, !(launchedUpdate?.isEmbedded ?? true) {
+            try? database?.recordFailedLaunch(updateId: updateId)
+            try? database?.setStatus(.failed, forUpdateId: updateId)
+            reportEvent("launch_failure", updateId: updateId)
+            pulseLog("rollbackToPreviousUpdate: marked \(updateId) failed")
+        }
+
+        // Clear the current selection and re-select the best remaining update (previous-good, else embedded).
+        launchAssetUrl = nil
+        launchedUpdate = nil
+        launchedManifestJson = nil
+        isEmbeddedLaunch = true
+        localAssets = [:]
+
+        selectBestUpdateSync()
+        if launchAssetUrl == nil {
+            launchEmbedded()
+        }
+
+        // Ask React Native to reload with the rolled-back bundle.
+        NotificationCenter.default.post(name: NSNotification.Name("PulseUpdatesReloadRequest"), object: nil)
     }
 
     private func runReaper() {
@@ -1048,8 +1183,31 @@ final class PulseRemoteLoader {
                     return
                 }
 
-                // Verify signature if required
-                if config.signingPublicKey != nil {
+                // Signature gate (fail-closed in release).
+                // If signatures are required but no key material is configured, or the
+                // manifest is unsigned, REFUSE the update so the app keeps running the
+                // embedded/known-good bundle instead of applying an unverified one.
+                let hasKeyMaterial = config.signingPublicKey != nil && config.signingKeyId != nil
+                if config.requireSignature {
+                    guard hasKeyMaterial else {
+                        pulseLogError("REFUSING remote update \(manifest.updateId): requireSignature is enabled but signingPublicKey/signingKeyId are not configured. Falling back to the embedded bundle. Configure PulseUpdatesSigningPublicKey and PulseUpdatesSigningKeyId, or set PulseUpdatesRequireSignature=NO to intentionally allow unsigned updates.")
+                        completion(.failure(PulseUpdatesError.signatureRequiredButMissing))
+                        return
+                    }
+                    guard manifest.signature != nil else {
+                        pulseLogError("REFUSING remote update \(manifest.updateId): requireSignature is enabled but the manifest carries no signature. Falling back to the embedded bundle.")
+                        completion(.failure(PulseUpdatesError.signatureRequiredButMissing))
+                        return
+                    }
+                    guard verifyManifestSignature(manifest: manifest, manifestJson: data, config: config) else {
+                        completion(.failure(PulseUpdatesError.signatureVerificationFailed))
+                        return
+                    }
+                } else if hasKeyMaterial, manifest.signature != nil {
+                    // Signatures not strictly required (e.g. DEBUG), but key material is
+                    // present, so still verify WHEN a signature is provided. An unsigned
+                    // manifest is allowed through here (verifyManifestSignature would reject
+                    // a nil signature, which would wrongly block unsigned DEBUG updates).
                     guard verifyManifestSignature(manifest: manifest, manifestJson: data, config: config) else {
                         completion(.failure(PulseUpdatesError.signatureVerificationFailed))
                         return
@@ -1128,6 +1286,9 @@ final class PulseRemoteLoader {
         request.setValue("2", forHTTPHeaderField: "Pulse-Protocol-Version")
         request.setValue("ios", forHTTPHeaderField: "X-Pulse-Platform")
         request.setValue(config.runtimeVersion, forHTTPHeaderField: "X-Pulse-Runtime-Version")
+        // Stable device id so the server can bucket this device into staged rollouts (without it,
+        // a device is held back from any partial rollout until it reaches 100%).
+        request.setValue(PulseController.shared.deviceId, forHTTPHeaderField: "Pulse-Device-Id")
 
         if let channel = config.channel {
             request.setValue(channel, forHTTPHeaderField: "X-Pulse-Channel-Name")

package/ios/PulseUpdates/PulseTypes.swift

@@ -14,6 +14,10 @@ public struct PulseUpdatesConfig {
     public let channel: String?
     public let signingKeyId: String?
     public let signingPublicKey: String?
+    /// When true, remote updates MUST carry a valid Ed25519 signature and the
+    /// app MUST be configured with signingKeyId/signingPublicKey, otherwise the
+    /// update is refused (fail-closed). Defaults to true in release builds.
+    public let requireSignature: Bool
     public let scopeKey: String
 
     public init(
@@ -24,7 +28,8 @@ public struct PulseUpdatesConfig {
         launchWaitMs: Int = 0,
         channel: String? = nil,
         signingKeyId: String? = nil,
-        signingPublicKey: String? = nil
+        signingPublicKey: String? = nil,
+        requireSignature: Bool = PulseUpdatesConfig.defaultRequireSignature
     ) {
         self.enabled = enabled
         self.updateUrl = updateUrl
@@ -34,9 +39,21 @@ public struct PulseUpdatesConfig {
         self.channel = channel
         self.signingKeyId = signingKeyId
         self.signingPublicKey = signingPublicKey
+        self.requireSignature = requireSignature
         // Use update URL host as scope key (like Expo)
         self.scopeKey = URL(string: updateUrl)?.host ?? "default"
     }
+
+    /// Default for requireSignature: fail-closed in release, fail-open only in DEBUG.
+    /// Callers that don't pass requireSignature (e.g. the JS-driven configure bridge)
+    /// inherit this release-secure default automatically.
+    public static var defaultRequireSignature: Bool {
+        #if DEBUG
+        return false
+        #else
+        return true
+        #endif
+    }
 }
 
 // MARK: - Manifest Models
@@ -214,6 +231,7 @@ public enum PulseUpdatesError: Error, LocalizedError {
     case networkError(underlying: Error)
     case invalidManifest(reason: String)
     case signatureVerificationFailed
+    case signatureRequiredButMissing
     case hashMismatch(expected: String, actual: String)
     case downloadFailed(underlying: Error)
     case noUpdateAvailable
@@ -233,6 +251,8 @@ public enum PulseUpdatesError: Error, LocalizedError {
             return "Invalid manifest: \(reason)"
         case .signatureVerificationFailed:
             return "Signature verification failed"
+        case .signatureRequiredButMissing:
+            return "Signature required but missing: the SDK is configured to require signed updates but no signing key is configured or the manifest is unsigned"
         case .hashMismatch(let expected, let actual):
             return "Hash mismatch: expected \(expected), got \(actual)"
         case .downloadFailed(let error):

package/lib/typescript/types.d.ts

@@ -47,6 +47,16 @@ export interface PulseUpdatesConfig {
     channel?: string;
     signingKeyId?: string;
     signingPublicKey?: string;
+    /**
+     * When true, manifests must carry a valid Ed25519 signature verifying against
+     * `signingPublicKey`; unsigned or unverifiable manifests are rejected (fail-closed).
+     *
+     * NATIVE-CONFIG ONLY: this is read from the Info.plist / AndroidManifest
+     * `PulseUpdatesRequireSignature` meta-data (defaults to `true` in release) and is NOT
+     * accepted by `configure()` — setting it here has no effect. Configure signing via the
+     * native config so a release can never silently flip to refuse-all from JS.
+     */
+    requireSignature?: boolean;
 }
 export interface PulseUpdatesState {
     isEnabled: boolean;

package/lib/typescript/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,cAAc,CAAC;IAG3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,gBAAgB,EAAE,aAAa,GAAG,IAAI,CAAC;IACvC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC5C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,cAAc,CAAC;IAG3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,gBAAgB,EAAE,aAAa,GAAG,IAAI,CAAC;IACvC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC5C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "OTA updates for React Native - lightweight alternative to expo-updates",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -26,7 +26,10 @@
     "build": "bob build",
     "prepare": "bob build",
     "test": "node --test tests/*.test.js",
-    "publish-update": "node scripts/publish.js publish"
+    "publish-update": "node scripts/publish.mjs publish"
+  },
+  "engines": {
+    "node": ">=18"
   },
   "keywords": [
     "react-native",
@@ -36,19 +39,18 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://git.spicysparks.com/SpicySparks/Pulse-Client.git"
+    "url": "https://github.com/pulse-updates/pulse-updates.git"
   },
-  "author": "Lyra",
+  "author": "Pulse Updates",
   "license": "MIT",
   "peerDependencies": {
-    "react": "*",
-    "react-native": "*"
+    "react": ">=18.2.0",
+    "react-native": ">=0.76.0"
   },
   "devDependencies": {
     "@types/react": "^18.2.0",
-    "@types/react-native": "^0.72.0",
     "react": "^18.2.0",
-    "react-native": "^0.73.0",
+    "react-native": "^0.83.0",
     "react-native-builder-bob": "^0.23.0",
     "typescript": "^5.0.0"
   },