Add preventUniversalLinks prop to sandbox hosts from UL handoff

[artemlitch]

Summary

Adds a preventUniversalLinks prop (iOS) that lists hosts whose top-frame navigations should be sandboxed from Universal Link handoff. For listed hosts, the navigation is canceled in decidePolicyForNavigationAction and re-issued via [webView loadRequest:] — the only nav type iOS reliably does not consider for UL handoff.

Why

When iOS triggers a Universal Link handoff mid-flow inside a WebView, the user is yanked into the linked third-party app and the embedded flow breaks. Most commonly hit in embedded auth: e.g. a Goodreads sign-in WebView whose post-Amazon-SSO redirect lands on a UL-eligible URL like /ap-handler/sign-in?IDP=lwa, sending the user into the installed Goodreads app.

iOS does not expose a way to predict UL handoff at the navigation delegate — UL is decided in WebKit's process before decidePolicyForNavigationAction: fires.

API

<WebView preventUniversalLinks={['goodreads.com']} ... />

• Match is domain-suffix with a dot boundary: 'goodreads.com' covers goodreads.com, www.goodreads.com, and any subdomain — but not evilgoodreads.com.
• Takes a host list rather than a boolean because reissuing every top-frame nav unconditionally breaks anything that's not a plain GET — POST form bodies are stripped by NSURLRequest in the navigation action, and reissuing single-use OAuth codes (Amazon callbacks etc.) double-consumes them.
• An associated-object flag on the WKWebView instance breaks the cancel/reissue loop.

Files

• apple/RNCWebViewImpl.{h,m} — cancel/reissue logic with loop guard
• apple/RNCWebView.mm — Fabric prop array conversion (mirrors suppressMenuItems pattern)
• apple/RNCWebViewManager.mm — Paper prop registration
• src/RNCWebViewNativeComponent.ts, src/WebViewTypes.ts — TS spec + JSDoc
• lib/* — rebuilt to match

Test plan

Verified end-to-end on a physical iPhone via the Bookwise consumer (readwiseio/rekindled#9205):

• Fresh sign-in via Amazon SSO → import completes
• Rescan after killing & reopening the app → import completes
• WebView never hands off to the Goodreads app

🤖 Generated with Claude Code