@exodus/react-native-bundle-loader 0.2.0-exodus.1 → 0.2.0-exodus.3

package/README.md

@@ -9,7 +9,7 @@ Loads a remote React Native JS bundle, with optional **hash-pinned integrity ver
 
 Loading a remote JS bundle is, by construction, remote code execution inside the host app. **This library is intended for internal/development builds only — do not ship it in store builds without an out-of-band, statically-stripped feature flag.** See `SECURITY.md`.
 
-The `loadVerified()` API closes the dominant runtime risk: it fetches the bundle bytes itself, hashes them with `@exodus/crypto`, compares the hash to a caller-supplied digest in constant time, and only then asks the bridge to reload from the verified bytes. Anything that mutates the response between fetch and reload is rejected.
+The `loadVerified()` API closes the dominant runtime risk: it downloads the bundle natively, hashes the bytes with platform crypto (iOS: `CommonCrypto CC_SHA256`, Android: `MessageDigest SHA-256`), compares the hash to a caller-supplied digest in constant time, and only then loads the verified bytes from app-private storage. Anything that mutates the response between fetch and reload is rejected.
 
 ## Installation
 
@@ -23,7 +23,7 @@ iOS:
 cd ios && pod install
 ```
 
-Android: `BundleLoaderPackage` is autolinked.
+Android: requires both Gradle wiring and host app changes — see [Android integration](#android-integration) below.
 
 ## Usage
 
@@ -43,11 +43,12 @@ Behavior:
 
 - The URL must use the `https:` scheme.
 - The expected sha256 must be a 64-character hex string.
-- The bytes are fetched, hashed in JS using `@exodus/crypto/hash`, and compared to the expected hash with a constant-time comparison.
-- On match, the bytes are written to the platform's app-private cache (iOS: `NSTemporaryDirectory()` with `NSDataWritingFileProtectionComplete`; Android: `Context.getCacheDir()`) and the bridge is reloaded from the local file path.
-- On mismatch, an error is thrown and the bridge is left untouched.
+- Download, SHA-256 hashing, and constant-time comparison all happen in native code. This avoids the Hermes `RangeError` that JS-side `response.arrayBuffer()` causes on large bundles (≥ ~70 MB).
+- On match, the bytes are written to app-private storage and the bundle is loaded (see platform notes below).
+- On mismatch, an error is thrown and the current bundle is left untouched.
+- The remote bundle is active for **one session only**. The next cold start returns to the local bundle — matching the behaviour consumers expect from a developer preview tool.
 
-Works on iOS and Android. The hash check happens in JS before any native call, so the integrity contract is identical on both platforms.
+Works on iOS and Android.
 
 ### Unverified loading
 
@@ -87,12 +88,105 @@ Example: `https://example.ngrok.io/index.bundle?dev=false&platform=ios&excludeSo
 | `loadVerified(url, sha256)` | ✅  | ✅      |
 | `runningMode()`             | ✅  | ✅      |
 
-### How the in-process swap works
+### How bundle loading works
 
-- **iOS** writes the bundle to `NSTemporaryDirectory()` and sets the bridge's `bundleURL` via KVC (`[bridge setValue:url forKey:@"bundleURL"]`), then calls `[bridge reload]`.
-- **Android** writes the bundle to `Context.getCacheDir()`, builds a `JSBundleLoader.createFileLoader(path)`, swaps it into the private `mBundleLoader` field on `ReactInstanceManager` via reflection, and calls `recreateReactContextInBackground()`.
+**iOS** downloads and verifies the bundle natively via `NSURLSession` + `CommonCrypto CC_SHA256`, writes it to `NSTemporaryDirectory()` with `NSDataWritingFileProtectionComplete`, then sets the bridge's `bundleURL` via KVC (`[bridge setValue:url forKey:@"bundleURL"]`) and calls `[bridge reload]`. This is an in-process reload: the old bridge is torn down and a new one is created with the cached file. Because iOS uses ARC, the old bridge's memory (including the Hermes runtime) is freed immediately when the bridge reference is released, before the new runtime allocates — no double-memory peak.
 
-Both mechanisms touch private/internal React Native surface and could break on a major RN upgrade. See `SECURITY.md`. The Android implementation requires the host app to implement `ReactApplication` (the standard React Native template does).
+**Android** uses a process restart instead of an in-process bridge swap. The reason: Android's ART garbage collector is non-deterministic. When a new React context is created alongside an existing one, ART does not guarantee the old Hermes runtime's native heap is freed before the new runtime allocates. On real-world bundle sizes (~50 MB of Hermes bytecode) this causes OOM. The process restart avoids the problem entirely by ensuring only one runtime is ever live.
+
+After download and hash verification, the module:
+
+1. Writes the bundle to `Context.getCacheDir()/verified-bundle.jsbundle`.
+2. Sets a one-shot flag in `SharedPreferences` (`"BundleLoader"` / `"pending_remote_bundle"`), using a synchronous `commit()` so the flag survives the imminent process kill.
+3. Restarts the process via `startActivity` + `Process.killProcess`.
+
+On the next launch, the host app reads the flag, disables Metro (so `ReactInstanceManager` does not query the packager and ignore the file — confirmed necessary by bytecode analysis of RN 0.78), and serves `verified-bundle.jsbundle` as the JS bundle for this session. The flag is consumed on first use so subsequent restarts return to Metro.
+
+## Android integration
+
+Because Android requires host app changes that cannot be encapsulated in the module itself, the following manual steps are required.
+
+### 1. Gradle wiring
+
+`settings.gradle` — include the subproject conditionally (the module is a `devDependency`; prod CI runs `yarn install --production` and the directory won't exist):
+
+```groovy
+def bundleLoaderDir = new File(rootProject.projectDir, '../node_modules/@exodus/react-native-bundle-loader/android')
+if (bundleLoaderDir.exists()) {
+    include ':@exodus_react-native-bundle-loader'
+    project(':@exodus_react-native-bundle-loader').projectDir = bundleLoaderDir
+}
+```
+
+`app/build.gradle` — depend only in debug builds:
+
+```groovy
+if (new File("$rootDir/../node_modules/@exodus/react-native-bundle-loader/android").exists()) {
+    debugImplementation project(':@exodus_react-native-bundle-loader')
+}
+```
+
+### 2. Register the package
+
+In `MainApplication.java`, inside `getPackages()`, add the package via reflection so a missing module (absent in prod CI) doesn't cause a compile-time error:
+
+```java
+if (BuildConfig.DEBUG) {
+    // devDependency absent in prod CI (yarn install --production); reflection avoids a compile-time import
+    try {
+        packages.add((ReactPackage) Class.forName("com.reactnativebundleloader.BundleLoaderPackage")
+                .getDeclaredConstructor().newInstance());
+    } catch (ReflectiveOperationException e) {
+        throw new RuntimeException(e);
+    }
+}
+```
+
+### 3. Hook bundle loading into ReactNativeHost
+
+Add these three methods to your `ReactNativeHost` anonymous subclass in `MainApplication.java`:
+
+```java
+import java.io.File;
+
+// ...
+
+@Override
+public boolean getUseDeveloperSupport() {
+    if (BuildConfig.DEBUG && hasPendingRemoteBundle()) {
+        // Must disable dev support: when enabled and Metro is reachable,
+        // ReactInstanceManager queries the packager and ignores getJSBundleFile().
+        return false;
+    }
+    // No pending bundle — clear the active flag so runningMode() returns LOCAL.
+    getSharedPreferences("BundleLoader", MODE_PRIVATE)
+            .edit().remove("active_remote_bundle").apply();
+    return BuildConfig.DEBUG;
+}
+
+@Override
+protected String getJSBundleFile() {
+    if (BuildConfig.DEBUG && hasPendingRemoteBundle()) {
+        File cachedBundle = new File(getCacheDir(), "verified-bundle.jsbundle");
+        if (cachedBundle.exists()) {
+            // Consume the one-shot latch: next restart goes back to Metro.
+            getSharedPreferences("BundleLoader", MODE_PRIVATE).edit()
+                    .remove("pending_remote_bundle")
+                    .putBoolean("active_remote_bundle", true)
+                    .apply();
+            return cachedBundle.getAbsolutePath();
+        }
+    }
+    return null;
+}
+
+private boolean hasPendingRemoteBundle() {
+    return getSharedPreferences("BundleLoader", MODE_PRIVATE)
+            .getBoolean("pending_remote_bundle", false);
+}
+```
+
+The SharedPreferences keys (`"BundleLoader"`, `"pending_remote_bundle"`, `"active_remote_bundle"`) must match the constants defined in `BundleLoaderModule` (`PREFS_NAME`, `PREFS_PENDING_KEY`, `PREFS_ACTIVE_KEY`).
 
 ## Provenance
 

package/SECURITY.md

@@ -15,9 +15,9 @@ This library exists to load and execute a remote JavaScript bundle inside the ho
 
 | Surface                                     | Upstream `0.1.0`                                        | This fork                                                                                                                          |
 | ------------------------------------------- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
-| Bundle integrity                            | None — bridge fetches whatever the URL serves           | `loadVerified(url, sha256)` fetches bytes in JS, hashes with `@exodus/crypto`, compares constant-time, only then reloads from disk |
+| Bundle integrity                            | None — bridge fetches whatever the URL serves           | `loadVerified(url, sha256)` downloads bytes natively (iOS: `NSURLSession`, Android: `HttpURLConnection`), hashes with platform crypto (iOS: `CommonCrypto CC_SHA256`, Android: `MessageDigest SHA-256`), compares in constant-time, writes to app-private storage, and reloads the bridge from the local file — closing the TOCTOU window between fetch and load |
 | `BundlePrompt` default URL                  | Hardcoded `cdn.jsdelivr.net/gh/jusbrasil/...` (deleted) | Empty — operator must type a URL                                                                                                   |
-| Scheme enforcement                          | None — accepts `http://`, `file://`, etc.               | `https://` required at the JS boundary; native iOS `load:` re-checks                                                               |
+| Scheme enforcement                          | None — accepts `http://`, `file://`, etc.               | `https://` required at the JS boundary; both native `load` implementations re-check before touching the network                     |
 | Verified bundle on-disk protection (iOS)    | n/a                                                     | Written with `NSDataWritingFileProtectionComplete`                                                                                 |
 | Lockfile                                    | Not shipped                                             | `yarn.lock` committed; `.yarnrc` enforces `--frozen-lockfile`                                                                      |
 | Dependency version pinning                  | Carets (`^`)                                            | All direct deps pinned to exact versions; `.npmrc` `save-exact=true`                                                               |
@@ -35,15 +35,15 @@ This library exists to load and execute a remote JavaScript bundle inside the ho
 
 - **The bridge `bundleURL` setter is a KVC write** on iOS (`[bridge setValue:url forKey:@"bundleURL"]`) to a non-public RN property. Behavior could change on an RN upgrade and silently no-op the loader.
 - **The Android bundle swap reflects on a private field.** `ReactInstanceManager.mBundleLoader` has no public setter, so we use `Field.setAccessible(true)` to install a fresh `JSBundleLoader.createFileLoader(...)` before calling `recreateReactContextInBackground()`. The field name has been stable across RN 0.62–0.74 but is not part of the public API; an RN upgrade could rename or remove it, in which case `loadVerified`/`load` will throw `NoSuchFieldException` rather than silently no-op.
-- **`@exodus/crypto/hash` runs in JS on the JS thread.** Bundles are typically a few MB; hashing time is acceptable. We deliberately keep hashing in JS so the threat-model contract — "Exodus crypto verifies, and the verified bytes are what we hand to native" — is auditable in TypeScript and identical on iOS and Android.
-- **`timingSafeEqual()` is currently inlined** as a small constant-time XOR loop. The threat model anticipates this moving to a future `@exodus/crypto` export. The inlined version is functionally equivalent and lives in `src/index.tsx`.
+- **Hash verification runs in native code, not JS.** `loadVerifiedFromUrl` uses `CommonCrypto CC_SHA256` (iOS) and `MessageDigest SHA-256` (Android) with a constant-time XOR comparison loop in native code. This avoids a Hermes `RangeError: Maximum regex stack depth reached` that the previous JS-side `response.arrayBuffer()` path hit on bundles ≥ ~70 MB. The trade-off is that the integrity contract is no longer auditable as TypeScript.
+- **`timingSafeEqual` is an inlined XOR loop in native code.** Both `ios/BundleLoader.m` and `android/src/main/java/com/reactnativebundleloader/BundleLoaderModule.java` XOR all byte pairs into an accumulator and reject the bundle if the accumulator is non-zero.
 
 ## Release process
 
 This package has no CI/CD. Maintainers cut releases manually from a developer machine:
 
 ```sh
-yarn preflight   # lint + typecheck + test + verify-pack
+yarn preflight   # lint + typecheck + JS tests + Android JVM tests + iOS XCTests + verify-pack
 npm publish --access public
 ```
 

package/android/build.gradle

@@ -116,4 +116,7 @@ def reactNativeArtifactVersion = rootProject.ext.has('reactNativeVersion') ? roo
 
 dependencies {
   api "com.facebook.react:react-native:${reactNativeArtifactVersion}"
+
+  testImplementation 'junit:junit:4.13.2'
+  testImplementation 'com.squareup.okhttp3:mockwebserver:4.12.0'
 }

package/android/gradle.properties

@@ -1,3 +1,4 @@
 BundleLoader_compileSdkVersion=33
 BundleLoader_buildToolsVersion=33.0.2
 BundleLoader_targetSdkVersion=33
+android.useAndroidX=true

package/android/src/main/java/com/reactnativebundleloader/BundleLoaderModule.java

@@ -1,13 +1,13 @@
 package com.reactnativebundleloader;
 
-import android.util.Base64;
+import android.content.Context;
+import android.content.Intent;
+import android.content.SharedPreferences;
 import android.util.Log;
 
 import androidx.annotation.NonNull;
 
 import com.facebook.react.ReactApplication;
-import com.facebook.react.ReactInstanceManager;
-import com.facebook.react.bridge.JSBundleLoader;
 import com.facebook.react.bridge.Promise;
 import com.facebook.react.bridge.ReactApplicationContext;
 import com.facebook.react.bridge.ReactContextBaseJavaModule;
@@ -17,19 +17,25 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.lang.reflect.Field;
 import java.net.HttpURLConnection;
 import java.net.URL;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 
 public class BundleLoaderModule extends ReactContextBaseJavaModule {
 
   private static final String TAG = "BundleLoader";
-  private static final String BUNDLE_FILENAME = "verified-bundle.jsbundle";
+  // Host app references these as string literals (library is debugImplementation only).
+  static final String BUNDLE_FILENAME = "verified-bundle.jsbundle";
+  static final String PREFS_NAME = "BundleLoader";
+  static final String PREFS_PENDING_KEY = "pending_remote_bundle";
+  static final String PREFS_ACTIVE_KEY = "active_remote_bundle";
+  // Metro/APK source URL captured at load time for correct asset resolution after restart.
+  static final String PREFS_METRO_SOURCE_URL_KEY = "metro_source_url";
+
   private static final int CONNECT_TIMEOUT_MS = 30_000;
   private static final int READ_TIMEOUT_MS = 30_000;
-  private static final int MAX_BUNDLE_BYTES = 64 * 1024 * 1024;
-
-  private static volatile boolean remoteLoaded = false;
+  static final long MAX_BUNDLE_BYTES = 64L * 1024L * 1024L;
 
   BundleLoaderModule(ReactApplicationContext context) {
     super(context);
@@ -43,7 +49,7 @@ public class BundleLoaderModule extends ReactContextBaseJavaModule {
 
   @ReactMethod
   public void load(final String url) {
-    if (url == null || !url.startsWith("https://")) {
+    if (!isHttps(url)) {
       Log.e(TAG, "Bundle URL must use the https scheme");
       return;
     }
@@ -51,8 +57,19 @@ public class BundleLoaderModule extends ReactContextBaseJavaModule {
       @Override
       public void run() {
         try {
-          File bundleFile = downloadToCache(url);
-          swapBundleLoaderAndReload(bundleFile);
+          File targetFile = new File(
+              getReactApplicationContext().getCacheDir(),
+              BUNDLE_FILENAME
+          );
+          downloadToCache(
+              url,
+              targetFile,
+              CONNECT_TIMEOUT_MS,
+              READ_TIMEOUT_MS,
+              MAX_BUNDLE_BYTES
+          );
+          setPendingFlag();
+          restartApp();
         } catch (Exception e) {
           Log.e(TAG, "load(" + url + ") failed", e);
         }
@@ -61,92 +78,218 @@ public class BundleLoaderModule extends ReactContextBaseJavaModule {
   }
 
   @ReactMethod
-  public void loadFromBase64(String base64, Promise promise) {
+  public void loadVerifiedFromUrl(final String url, final String expectedSha256, final Promise promise) {
+    if (!isHttps(url)) {
+      promise.reject("E_INVALID_URL", "Bundle URL must use the https scheme");
+      return;
+    }
+
+    final byte[] expectedDigest;
     try {
-      byte[] data = Base64.decode(base64, Base64.DEFAULT);
-      if (data == null || data.length == 0) {
-        promise.reject("E_INVALID_BASE64", "Invalid base64 input");
-        return;
-      }
-      File bundleFile = new File(
-          getReactApplicationContext().getCacheDir(),
-          BUNDLE_FILENAME
-      );
-      try (FileOutputStream out = new FileOutputStream(bundleFile)) {
-        out.write(data);
-      }
-      swapBundleLoaderAndReload(bundleFile);
-      promise.resolve(null);
-    } catch (Exception e) {
-      promise.reject("E_LOAD_FAILED", e.getMessage(), e);
+      expectedDigest = parseHexSha256(expectedSha256);
+    } catch (IllegalArgumentException e) {
+      promise.reject("E_INVALID_HASH", e.getMessage());
+      return;
     }
+
+    new Thread(new Runnable() {
+      @Override
+      public void run() {
+        try {
+          File targetFile = new File(
+              getReactApplicationContext().getCacheDir(),
+              BUNDLE_FILENAME
+          );
+          byte[] actualDigest = downloadAndHashToCache(
+              url,
+              targetFile,
+              CONNECT_TIMEOUT_MS,
+              READ_TIMEOUT_MS,
+              MAX_BUNDLE_BYTES
+          );
+          if (!timingSafeEquals(actualDigest, expectedDigest)) {
+            promise.reject("E_HASH_MISMATCH", "Bundle hash mismatch — refusing to load");
+            return;
+          }
+          // Resolve before killing the process so the JS side receives the result.
+          promise.resolve(null);
+          setPendingFlag();
+          restartApp();
+        } catch (Exception e) {
+          promise.reject("E_LOAD_FAILED", e.getMessage(), e);
+        }
+      }
+    }, "BundleLoader-loadVerifiedFromUrl").start();
   }
 
   @ReactMethod
   public void runningMode(Promise promise) {
-    promise.resolve(remoteLoaded ? "REMOTE" : "LOCAL");
+    SharedPreferences prefs = getReactApplicationContext()
+        .getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE);
+    promise.resolve(prefs.getBoolean(PREFS_ACTIVE_KEY, false) ? "REMOTE" : "LOCAL");
+  }
+
+  private void setPendingFlag() {
+    SharedPreferences.Editor editor = getReactApplicationContext()
+        .getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+        .edit()
+        .putBoolean(PREFS_PENDING_KEY, true);
+
+    // Store scriptURL for asset resolution after restart: Metro URL if available,
+    // asset:/// otherwise (genesis/release — assets served from APK).
+    String sourceUrl = getMetroSourceUrl();
+    editor.putString(PREFS_METRO_SOURCE_URL_KEY,
+        sourceUrl != null ? sourceUrl : "asset:///index.android.bundle");
+
+    // commit() not apply() — write must reach disk before killProcess().
+    editor.commit();
+  }
+
+  private String getMetroSourceUrl() {
+    try {
+      ReactApplication app = (ReactApplication) getReactApplicationContext().getApplicationContext();
+      String url = app.getReactNativeHost()
+          .getReactInstanceManager()
+          .getDevSupportManager()
+          .getSourceUrl();
+      return (url != null && !url.isEmpty()) ? url : null;
+    } catch (Exception e) {
+      return null;
+    }
   }
 
-  private File downloadToCache(String urlString) throws IOException {
+  /** Kills and relaunches the process. Avoids running two Hermes runtimes simultaneously. */
+  private void restartApp() {
+    Context context = getReactApplicationContext();
+    Intent intent = context.getPackageManager()
+        .getLaunchIntentForPackage(context.getPackageName());
+    if (intent != null) {
+      intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);
+      context.startActivity(intent);
+    }
+    android.os.Process.killProcess(android.os.Process.myPid());
+  }
+
+  /** Package-private for testing. */
+  static boolean isHttps(String url) {
+    return url != null && url.startsWith("https://");
+  }
+
+  /** Parses a 64-char hex string into a 32-byte digest. Package-private for testing. */
+  static byte[] parseHexSha256(String hex) {
+    if (hex == null || hex.length() != 64) {
+      throw new IllegalArgumentException("Expected SHA-256 must be a 64-character hex string");
+    }
+    byte[] out = new byte[32];
+    for (int i = 0; i < 32; i++) {
+      int hi = Character.digit(hex.charAt(i * 2), 16);
+      int lo = Character.digit(hex.charAt(i * 2 + 1), 16);
+      if (hi < 0 || lo < 0) {
+        throw new IllegalArgumentException("Expected SHA-256 contains invalid hex characters");
+      }
+      out[i] = (byte) ((hi << 4) | lo);
+    }
+    return out;
+  }
+
+  /** Constant-time equality check to prevent timing attacks. Package-private for testing. */
+  static boolean timingSafeEquals(byte[] a, byte[] b) {
+    if (a.length != b.length) return false;
+    int diff = 0;
+    for (int i = 0; i < a.length; i++) {
+      diff |= a[i] ^ b[i];
+    }
+    return diff == 0;
+  }
+
+  /**
+   * Downloads into {@code targetFile} and returns its SHA-256 digest.
+   * No redirects; non-200 throws; body capped at {@code maxBytes}. Package-private for testing.
+   */
+  static byte[] downloadAndHashToCache(
+      String urlString,
+      File targetFile,
+      int connectTimeoutMs,
+      int readTimeoutMs,
+      long maxBytes
+  ) throws IOException {
+    MessageDigest digest;
+    try {
+      digest = MessageDigest.getInstance("SHA-256");
+    } catch (NoSuchAlgorithmException e) {
+      throw new IOException("SHA-256 not available: " + e.getMessage(), e);
+    }
+
     URL url = new URL(urlString);
     HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-    conn.setConnectTimeout(CONNECT_TIMEOUT_MS);
-    conn.setReadTimeout(READ_TIMEOUT_MS);
-    // Disallow follow-redirects so an HTTPS URL cannot transparently downgrade to HTTP.
+    conn.setConnectTimeout(connectTimeoutMs);
+    conn.setReadTimeout(readTimeoutMs);
     conn.setInstanceFollowRedirects(false);
     try {
       int code = conn.getResponseCode();
       if (code != HttpURLConnection.HTTP_OK) {
         throw new IOException("Bundle fetch failed: HTTP " + code);
       }
-      File file = new File(
-          getReactApplicationContext().getCacheDir(),
-          BUNDLE_FILENAME
-      );
       long total = 0;
       try (InputStream in = conn.getInputStream();
-           FileOutputStream out = new FileOutputStream(file)) {
+           FileOutputStream out = new FileOutputStream(targetFile)) {
         byte[] buf = new byte[8192];
         int n;
         while ((n = in.read(buf)) != -1) {
           total += n;
-          if (total > MAX_BUNDLE_BYTES) {
-            throw new IOException(
-                "Bundle exceeds " + MAX_BUNDLE_BYTES + " bytes"
-            );
+          if (total > maxBytes) {
+            throw new IOException("Bundle exceeds " + maxBytes + " bytes");
           }
           out.write(buf, 0, n);
+          digest.update(buf, 0, n);
         }
       }
-      return file;
+      return digest.digest();
     } finally {
       conn.disconnect();
     }
   }
 
-  private void swapBundleLoaderAndReload(File bundleFile) throws Exception {
-    ReactApplication app = (ReactApplication)
-        getReactApplicationContext().getApplicationContext();
-    final ReactInstanceManager instanceManager =
-        app.getReactNativeHost().getReactInstanceManager();
-
-    JSBundleLoader bundleLoader =
-        JSBundleLoader.createFileLoader(bundleFile.getAbsolutePath());
-
-    // mBundleLoader is private on ReactInstanceManager and there is no public
-    // setter. The host app's ReactNativeHost wires the initial loader at
-    // construction; we swap it in-place so the next reload picks up our file.
-    Field field = ReactInstanceManager.class.getDeclaredField("mBundleLoader");
-    field.setAccessible(true);
-    field.set(instanceManager, bundleLoader);
-
-    remoteLoaded = true;
-
-    getReactApplicationContext().runOnUiQueueThread(new Runnable() {
-      @Override
-      public void run() {
-        instanceManager.recreateReactContextInBackground();
+  /**
+   * Downloads into {@code targetFile}. No redirects; non-200 throws; body capped at
+   * {@code maxBytes}. Package-private for testing.
+   */
+  static File downloadToCache(
+      String urlString,
+      File targetFile,
+      int connectTimeoutMs,
+      int readTimeoutMs,
+      long maxBytes
+  ) throws IOException {
+    URL url = new URL(urlString);
+    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+    conn.setConnectTimeout(connectTimeoutMs);
+    conn.setReadTimeout(readTimeoutMs);
+    // Disallow follow-redirects so an HTTPS URL cannot transparently downgrade to HTTP.
+    conn.setInstanceFollowRedirects(false);
+    try {
+      int code = conn.getResponseCode();
+      if (code != HttpURLConnection.HTTP_OK) {
+        throw new IOException("Bundle fetch failed: HTTP " + code);
+      }
+      long total = 0;
+      try (InputStream in = conn.getInputStream();
+           FileOutputStream out = new FileOutputStream(targetFile)) {
+        byte[] buf = new byte[8192];
+        int n;
+        while ((n = in.read(buf)) != -1) {
+          total += n;
+          if (total > maxBytes) {
+            throw new IOException(
+                "Bundle exceeds " + maxBytes + " bytes"
+            );
+          }
+          out.write(buf, 0, n);
+        }
       }
-    });
+      return targetFile;
+    } finally {
+      conn.disconnect();
+    }
   }
 }

package/ios/BundleLoader.h

@@ -1,6 +1,9 @@
 #import <React/RCTBridgeModule.h>
 #import <React/RCTRootView.h>
 
+// NSUserDefaults key storing the pending remote bundle URL for loadSourceForBridge:.
+extern NSString * const RNBundleLoaderPendingURLKey;
+
 @interface BundleLoader : NSObject <RCTBridgeModule>
 
 @end

package/ios/BundleLoader.m

@@ -1,4 +1,7 @@
 #import "BundleLoader.h"
+#import <CommonCrypto/CommonDigest.h>
+
+NSString * const RNBundleLoaderPendingURLKey = @"RNBundleLoaderPendingURL";
 
 @implementation BundleLoader
 
@@ -8,16 +11,16 @@ RCT_EXPORT_MODULE()
 
 - (void)setBundleURLAndReload:(NSURL *)url
 {
-  [_bridge setValue:url forKey:@"bundleURL"];
+  [[NSUserDefaults standardUserDefaults] setURL:url forKey:RNBundleLoaderPendingURLKey];
+  [[NSUserDefaults standardUserDefaults] synchronize];
   [_bridge reload];
 }
 
 RCT_EXPORT_METHOD(runningMode:(RCTPromiseResolveBlock)resolve
                   rejecter:(RCTPromiseRejectBlock)reject)
 {
-  NSString *scheme = [[_bridge bundleURL] scheme];
-  BOOL isRemote = [scheme isEqualToString:@"https"];
-  resolve(isRemote ? @"REMOTE" : @"LOCAL");
+  NSURL *pending = [[NSUserDefaults standardUserDefaults] URLForKey:RNBundleLoaderPendingURLKey];
+  resolve(pending ? @"REMOTE" : @"LOCAL");
 }
 
 RCT_EXPORT_METHOD(load:(NSURL *)url)
@@ -30,32 +33,92 @@ RCT_EXPORT_METHOD(load:(NSURL *)url)
   });
 }
 
-RCT_EXPORT_METHOD(loadFromBase64:(NSString *)base64
+// Downloads the bundle at `urlString`, verifies its SHA-256 digest against
+// `expectedHex` using a constant-time byte comparison, then writes it to the
+// sandbox temp directory and reloads the bridge — all in native code to avoid
+// the Hermes RangeError that JS-side response.arrayBuffer() causes on large
+// bundles (~70 MB+).
+RCT_EXPORT_METHOD(loadVerifiedFromUrl:(NSString *)urlString
+                  expectedSha256:(NSString *)expectedHex
                   resolver:(RCTPromiseResolveBlock)resolve
                   rejecter:(RCTPromiseRejectBlock)reject)
 {
-  NSData *data = [[NSData alloc] initWithBase64EncodedString:base64
-                                                     options:0];
-  if (data == nil) {
-    reject(@"E_INVALID_BASE64", @"Invalid base64 input", nil);
+  NSURL *url = [NSURL URLWithString:urlString];
+  if (![[url scheme] isEqualToString:@"https"]) {
+    reject(@"E_INVALID_URL", @"Bundle URL must use the https scheme", nil);
     return;
   }
 
-  NSString *path = [NSTemporaryDirectory()
-      stringByAppendingPathComponent:@"verified-bundle.jsbundle"];
-  NSError *err = nil;
-  if (![data writeToFile:path
-                options:NSDataWritingAtomic | NSDataWritingFileProtectionComplete
-                  error:&err]) {
-    reject(@"E_WRITE_FAILED", err.localizedDescription, err);
+  if (expectedHex.length != 64) {
+    reject(@"E_INVALID_HASH", @"Expected SHA-256 must be a 64-character hex string", nil);
     return;
   }
 
-  NSURL *fileURL = [NSURL fileURLWithPath:path];
-  dispatch_async(dispatch_get_main_queue(), ^{
-    [self setBundleURLAndReload:fileURL];
-    resolve(nil);
-  });
+  // Parse hex string to raw bytes up-front so we can reject early on bad input.
+  const char *cStr = [expectedHex UTF8String];
+  uint8_t expectedDigestBuf[CC_SHA256_DIGEST_LENGTH];
+  for (int i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) {
+    char buf[3] = { cStr[i * 2], cStr[i * 2 + 1], '\0' };
+    char *end;
+    unsigned long val = strtoul(buf, &end, 16);
+    if (end != buf + 2) {
+      reject(@"E_INVALID_HASH", @"Expected SHA-256 contains invalid hex characters", nil);
+      return;
+    }
+    expectedDigestBuf[i] = (uint8_t)val;
+  }
+  // Wrap in NSData so the block can capture it as an object pointer.
+  NSData *expectedData = [NSData dataWithBytes:expectedDigestBuf length:CC_SHA256_DIGEST_LENGTH];
+
+  NSURLSessionDataTask *task = [[NSURLSession sharedSession]
+      dataTaskWithURL:url
+    completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
+    if (error) {
+      reject(@"E_FETCH_FAILED", error.localizedDescription, error);
+      return;
+    }
+
+    NSHTTPURLResponse *http = (NSHTTPURLResponse *)response;
+    if (http.statusCode < 200 || http.statusCode >= 300) {
+      reject(@"E_FETCH_FAILED",
+             [NSString stringWithFormat:@"Bundle fetch failed: HTTP %ld", (long)http.statusCode],
+             nil);
+      return;
+    }
+
+    // Compute SHA-256 of the downloaded bytes.
+    uint8_t actualDigest[CC_SHA256_DIGEST_LENGTH];
+    CC_SHA256(data.bytes, (CC_LONG)data.length, actualDigest);
+
+    // Constant-time comparison: XOR all byte pairs and check the accumulator.
+    const uint8_t *expected = (const uint8_t *)expectedData.bytes;
+    uint8_t diff = 0;
+    for (int i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) {
+      diff |= actualDigest[i] ^ expected[i];
+    }
+    if (diff != 0) {
+      reject(@"E_HASH_MISMATCH", @"Bundle hash mismatch — refusing to load", nil);
+      return;
+    }
+
+    NSString *path = [NSTemporaryDirectory()
+        stringByAppendingPathComponent:@"verified-bundle.jsbundle"];
+    NSError *writeError = nil;
+    if (![data writeToFile:path
+                  options:NSDataWritingAtomic | NSDataWritingFileProtectionComplete
+                    error:&writeError]) {
+      reject(@"E_WRITE_FAILED", writeError.localizedDescription, writeError);
+      return;
+    }
+
+    NSURL *fileURL = [NSURL fileURLWithPath:path];
+    dispatch_async(dispatch_get_main_queue(), ^{
+      [self setBundleURLAndReload:fileURL];
+      resolve(nil);
+    });
+  }];
+
+  [task resume];
 }
 
 @end

package/ios/BundleLoader.xcodeproj/project.pbxproj

@@ -7,9 +7,11 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
-
-
+		24CE545938292C60A5CCE9C6 /* BundleLoader.m in Sources */ = {isa = PBXBuildFile; fileRef = D86256900CD7CE9D4230C8F0 /* BundleLoader.m */; };
 		5E555C0D2413F4C50049A1A2 /* BundleLoader.mm in Sources */ = {isa = PBXBuildFile; fileRef = B3E7B5891CC2AC0600A0062D /* BundleLoader.mm */; };
+		92B2598D965DC32AAF3C04DC /* RCTShim.m in Sources */ = {isa = PBXBuildFile; fileRef = 57BC896F9AB3CF10CC9A982D /* RCTShim.m */; };
+		B69ED17115D9C485D9548941 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 8D436DEAC2A4CBEA60395C01 /* Foundation.framework */; };
+		E40411861DEA09400E90C294 /* BundleLoaderTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 652EEA1023B3EC9464EE6AB7 /* BundleLoaderTests.m */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXCopyFilesBuildPhase section */
@@ -26,14 +28,25 @@
 
 /* Begin PBXFileReference section */
 		134814201AA4EA6300B7C361 /* libBundleLoader.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libBundleLoader.a; sourceTree = BUILT_PRODUCTS_DIR; };
-
-
+		41DDBD47E9DE312B7A311653 /* Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
+		57BC896F9AB3CF10CC9A982D /* RCTShim.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = RCTShim.m; sourceTree = "<group>"; };
+		652EEA1023B3EC9464EE6AB7 /* BundleLoaderTests.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = BundleLoaderTests.m; sourceTree = "<group>"; };
+		8D436DEAC2A4CBEA60395C01 /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS18.0.sdk/System/Library/Frameworks/Foundation.framework; sourceTree = DEVELOPER_DIR; };
+		A2704714B0CBE9056A0C7575 /* BundleLoaderTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = BundleLoaderTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		B3E7B5881CC2AC0600A0062D /* BundleLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BundleLoader.h; sourceTree = "<group>"; };
 		B3E7B5891CC2AC0600A0062D /* BundleLoader.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BundleLoader.mm; sourceTree = "<group>"; };
-
+		D86256900CD7CE9D4230C8F0 /* BundleLoader.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = BundleLoader.m; path = ../BundleLoader.m; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
+		4B47E8930D88164ED0964EE4 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				B69ED17115D9C485D9548941 /* Foundation.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		58B511D81A9E6C8500147676 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -44,6 +57,14 @@
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
+		0ED20A3ECAA42A9D0C0DF4B7 /* Frameworks */ = {
+			isa = PBXGroup;
+			children = (
+				84C5FDD66827346FEB6301E0 /* iOS */,
+			);
+			name = Frameworks;
+			sourceTree = "<group>";
+		};
 		134814211AA4EA7D00B7C361 /* Products */ = {
 			isa = PBXGroup;
 			children = (
@@ -55,15 +76,35 @@
 		58B511D21A9E6C8500147676 = {
 			isa = PBXGroup;
 			children = (
-
-
 				B3E7B5881CC2AC0600A0062D /* BundleLoader.h */,
 				B3E7B5891CC2AC0600A0062D /* BundleLoader.mm */,
-
 				134814211AA4EA7D00B7C361 /* Products */,
+				8561C764A29C0D1EEB7A96AF /* BundleLoaderTests */,
+				A2704714B0CBE9056A0C7575 /* BundleLoaderTests.xctest */,
+				0ED20A3ECAA42A9D0C0DF4B7 /* Frameworks */,
 			);
 			sourceTree = "<group>";
 		};
+		84C5FDD66827346FEB6301E0 /* iOS */ = {
+			isa = PBXGroup;
+			children = (
+				8D436DEAC2A4CBEA60395C01 /* Foundation.framework */,
+			);
+			name = iOS;
+			sourceTree = "<group>";
+		};
+		8561C764A29C0D1EEB7A96AF /* BundleLoaderTests */ = {
+			isa = PBXGroup;
+			children = (
+				D86256900CD7CE9D4230C8F0 /* BundleLoader.m */,
+				652EEA1023B3EC9464EE6AB7 /* BundleLoaderTests.m */,
+				57BC896F9AB3CF10CC9A982D /* RCTShim.m */,
+				41DDBD47E9DE312B7A311653 /* Info.plist */,
+			);
+			name = BundleLoaderTests;
+			path = BundleLoaderTests;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
@@ -84,6 +125,24 @@
 			productReference = 134814201AA4EA6300B7C361 /* libBundleLoader.a */;
 			productType = "com.apple.product-type.library.static";
 		};
+		907A5308750D4F32A1FEED66 /* BundleLoaderTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = F1BFF3F804D83A453070B922 /* Build configuration list for PBXNativeTarget "BundleLoaderTests" */;
+			buildPhases = (
+				A1532518EC7CA226B14679F7 /* Generate React header shim */,
+				B462B17BA89D4AE0FF1ECED6 /* Sources */,
+				4B47E8930D88164ED0964EE4 /* Frameworks */,
+				0E0C7AEDC338098073E25692 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = BundleLoaderTests;
+			productName = BundleLoaderTests;
+			productReference = A2704714B0CBE9056A0C7575 /* BundleLoaderTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
 /* End PBXNativeTarget section */
 
 /* Begin PBXProject section */
@@ -112,19 +171,58 @@
 			projectRoot = "";
 			targets = (
 				58B511DA1A9E6C8500147676 /* BundleLoader */,
+				907A5308750D4F32A1FEED66 /* BundleLoaderTests */,
 			);
 		};
 /* End PBXProject section */
 
+/* Begin PBXResourcesBuildPhase section */
+		0E0C7AEDC338098073E25692 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXShellScriptBuildPhase section */
+		A1532518EC7CA226B14679F7 /* Generate React header shim */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			name = "Generate React header shim";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "#!/bin/bash\nset -euo pipefail\nRN_HEADERS_ROOT=\"${SRCROOT}/../node_modules/react-native/React\"\nOUT=\"${DERIVED_FILE_DIR}/RNHeaders/React\"\nmkdir -p \"$OUT\"\nif [ ! -d \"$RN_HEADERS_ROOT\" ]; then\n  echo \"error: react-native headers not found at $RN_HEADERS_ROOT\" >&2\n  exit 1\nfi\n# Flatten every .h under React/{Base,Modules,...} into the shim dir as symlinks.\nfind \"$RN_HEADERS_ROOT\" -type f -name '*.h' | while read -r f; do\n  name=$(basename \"$f\")\n  # Only link the first occurrence we encounter -- duplicates would error otherwise.\n  if [ ! -e \"$OUT/$name\" ]; then\n    ln -sf \"$f\" \"$OUT/$name\"\n  fi\ndone\n";
+		};
+/* End PBXShellScriptBuildPhase section */
+
 /* Begin PBXSourcesBuildPhase section */
 		58B511D71A9E6C8500147676 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-
-
 				5E555C0D2413F4C50049A1A2 /* BundleLoader.mm in Sources */,
-
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		B462B17BA89D4AE0FF1ECED6 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				24CE545938292C60A5CCE9C6 /* BundleLoader.m in Sources */,
+				E40411861DEA09400E90C294 /* BundleLoaderTests.m in Sources */,
+				92B2598D965DC32AAF3C04DC /* RCTShim.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -237,7 +335,6 @@
 				OTHER_LDFLAGS = "-ObjC";
 				PRODUCT_NAME = BundleLoader;
 				SKIP_INSTALL = YES;
-
 			};
 			name = Debug;
 		};
@@ -254,7 +351,63 @@
 				OTHER_LDFLAGS = "-ObjC";
 				PRODUCT_NAME = BundleLoader;
 				SKIP_INSTALL = YES;
-
+			};
+			name = Release;
+		};
+		6B16E681D8B4E49389D63BCC /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"DEBUG=1",
+					"$(inherited)",
+				);
+				GCC_WARN_INHIBIT_ALL_WARNINGS = NO;
+				GENERATE_INFOPLIST_FILE = NO;
+				HEADER_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(SRCROOT)",
+					"$(DERIVED_FILE_DIR)/RNHeaders",
+				);
+				INFOPLIST_FILE = BundleLoaderTests/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
+				ONLY_ACTIVE_ARCH = YES;
+				PRODUCT_BUNDLE_IDENTIFIER = "com.exodus.react-native-bundle-loader.tests";
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
+				TARGETED_DEVICE_FAMILY = "1,2";
+				USE_HEADERMAP = YES;
+			};
+			name = Debug;
+		};
+		DEB50DA86E5EBCD7FE39B7FF /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				GCC_WARN_INHIBIT_ALL_WARNINGS = NO;
+				GENERATE_INFOPLIST_FILE = NO;
+				HEADER_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(SRCROOT)",
+					"$(DERIVED_FILE_DIR)/RNHeaders",
+				);
+				INFOPLIST_FILE = BundleLoaderTests/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
+				ONLY_ACTIVE_ARCH = YES;
+				PRODUCT_BUNDLE_IDENTIFIER = "com.exodus.react-native-bundle-loader.tests";
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
+				TARGETED_DEVICE_FAMILY = "1,2";
+				USE_HEADERMAP = YES;
+				VALIDATE_PRODUCT = YES;
 			};
 			name = Release;
 		};
@@ -279,6 +432,15 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		F1BFF3F804D83A453070B922 /* Build configuration list for PBXNativeTarget "BundleLoaderTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				DEB50DA86E5EBCD7FE39B7FF /* Release */,
+				6B16E681D8B4E49389D63BCC /* Debug */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 /* End XCConfigurationList section */
 	};
 	rootObject = 58B511D31A9E6C8500147676 /* Project object */;

package/lib/commonjs/index.js

@@ -11,12 +11,6 @@ var _react = _interopRequireWildcard(require("react"));
 
 var _reactNative = require("react-native");
 
-var _hash = require("@exodus/crypto/hash");
-
-var _hex = require("@exodus/bytes/hex.js");
-
-var _base = require("@exodus/bytes/base64.js");
-
 function _getRequireWildcardCache() { if (typeof WeakMap !== "function") return null; var cache = new WeakMap(); _getRequireWildcardCache = function () { return cache; }; return cache; }
 
 function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
@@ -42,18 +36,6 @@ function assertSafeUrl(url) {
   }
 }
 
-function timingSafeEqualBytes(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  /* eslint-disable no-bitwise */
-
-  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
-  /* eslint-enable no-bitwise */
-
-
-  return diff === 0;
-}
-
 async function loadVerified(url, expectedSha256Hex) {
   assertSafeUrl(url);
 
@@ -61,28 +43,13 @@ async function loadVerified(url, expectedSha256Hex) {
     throw new Error('Expected sha256 must be a 64-character hex string');
   }
 
-  const expected = (0, _hex.fromHex)(expectedSha256Hex);
-  const response = await fetch(url);
-
-  if (!response.ok) {
-    throw new Error("Bundle fetch failed: HTTP ".concat(response.status));
-  }
-
-  const buffer = await response.arrayBuffer();
-  const bytes = new Uint8Array(buffer);
-  const actual = await (0, _hash.hash)('sha256', bytes, 'uint8');
-
-  if (!timingSafeEqualBytes(actual, expected)) {
-    throw new Error('Bundle hash mismatch — refusing to load');
-  }
-
   const native = getNative();
 
-  if (typeof native.loadFromBase64 !== 'function') {
-    throw new Error('Native loadFromBase64 not available. Rebuild the host app after upgrading.');
+  if (typeof native.loadVerifiedFromUrl !== 'function') {
+    throw new Error('loadVerifiedFromUrl is not available on this platform. Rebuild the host app with the latest native module.');
   }
 
-  await native.loadFromBase64((0, _base.toBase64)(bytes));
+  await native.loadVerifiedFromUrl(url, expectedSha256Hex);
 }
 
 function loadUnverified(url) {

package/lib/module/index.js

@@ -1,9 +1,6 @@
 /** @format */
 import React, { useCallback, useState } from 'react';
 import { Alert, Modal, NativeModules, StyleSheet, Text, TextInput, TouchableOpacity, View } from 'react-native';
-import { hash } from '@exodus/crypto/hash';
-import { fromHex } from '@exodus/bytes/hex.js';
-import { toBase64 } from '@exodus/bytes/base64.js';
 
 function getNative() {
   const m = NativeModules.BundleLoader;
@@ -25,18 +22,6 @@ function assertSafeUrl(url) {
   }
 }
 
-function timingSafeEqualBytes(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  /* eslint-disable no-bitwise */
-
-  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
-  /* eslint-enable no-bitwise */
-
-
-  return diff === 0;
-}
-
 export async function loadVerified(url, expectedSha256Hex) {
   assertSafeUrl(url);
 
@@ -44,28 +29,13 @@ export async function loadVerified(url, expectedSha256Hex) {
     throw new Error('Expected sha256 must be a 64-character hex string');
   }
 
-  const expected = fromHex(expectedSha256Hex);
-  const response = await fetch(url);
-
-  if (!response.ok) {
-    throw new Error("Bundle fetch failed: HTTP ".concat(response.status));
-  }
-
-  const buffer = await response.arrayBuffer();
-  const bytes = new Uint8Array(buffer);
-  const actual = await hash('sha256', bytes, 'uint8');
-
-  if (!timingSafeEqualBytes(actual, expected)) {
-    throw new Error('Bundle hash mismatch — refusing to load');
-  }
-
   const native = getNative();
 
-  if (typeof native.loadFromBase64 !== 'function') {
-    throw new Error('Native loadFromBase64 not available. Rebuild the host app after upgrading.');
+  if (typeof native.loadVerifiedFromUrl !== 'function') {
+    throw new Error('loadVerifiedFromUrl is not available on this platform. Rebuild the host app with the latest native module.');
   }
 
-  await native.loadFromBase64(toBase64(bytes));
+  await native.loadVerifiedFromUrl(url, expectedSha256Hex);
 }
 
 function loadUnverified(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/react-native-bundle-loader",
-  "version": "0.2.0-exodus.1",
+  "version": "0.2.0-exodus.3",
   "description": "Loads a remote React Native JS bundle.",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -40,11 +40,13 @@
   ],
   "scripts": {
     "test": "jest",
+    "test:android": "cd android && ./gradlew test",
+    "test:ios": "xcodebuild test -project ios/BundleLoader.xcodeproj -scheme BundleLoaderTests -destination 'platform=iOS Simulator,OS=18.4,name=iPhone 16' CODE_SIGNING_ALLOWED=NO -quiet",
     "typescript": "tsc --noEmit",
     "lint": "eslint \"**/*.{js,ts,tsx}\"",
     "prepare": "bob build",
     "verify-pack": "rm -rf _pack && mkdir _pack && yarn prepare && npm pack --pack-destination _pack && tar -tzf _pack/*.tgz | LC_ALL=C sort | sed 's|^package/||' | diff -u .npm-tarball-allowlist -",
-    "preflight": "yarn lint && yarn typescript && yarn test --ci --runInBand && yarn verify-pack"
+    "preflight": "yarn lint && yarn typescript && yarn test --ci --runInBand && yarn test:android && yarn test:ios && yarn verify-pack"
   },
   "engines": {
     "node": ">=18.18"
@@ -74,10 +76,7 @@
     "url": "https://github.com/ExodusForks/react-native-bundle-loader/issues"
   },
   "homepage": "https://github.com/ExodusForks/react-native-bundle-loader#readme",
-  "dependencies": {
-    "@exodus/bytes": "1.15.0",
-    "@exodus/crypto": "1.0.0-rc.34"
-  },
+  "dependencies": {},
   "devDependencies": {
     "@react-native-community/bob": "0.16.2",
     "@react-native-community/eslint-config": "2.0.0",

package/react-native-bundle-loader.podspec

@@ -14,6 +14,11 @@ Pod::Spec.new do |s|
   s.source       = { :git => "https://github.com/ExodusForks/react-native-bundle-loader.git", :tag => "v#{s.version}" }
 
   s.source_files = "ios/**/*.{h,m,mm}"
+  # Exclude unit-test sources so consumers don't get test code in their app.
+  # Note: npm consumers never see these files (the package.json `files`
+  # allowlist excludes `ios/BundleLoaderTests/`); this guard is for
+  # CocoaPods consumers that fetch from git.
+  s.exclude_files = "ios/BundleLoaderTests/**/*"
 
   s.dependency "React-Core"
 end

package/src/index.tsx

@@ -12,15 +12,12 @@ import {
   TouchableOpacity,
   View,
 } from 'react-native';
-import { hash } from '@exodus/crypto/hash';
-import { fromHex } from '@exodus/bytes/hex.js';
-import { toBase64 } from '@exodus/bytes/base64.js';
 
 export type RunningMode = 'LOCAL' | 'REMOTE';
 
 type NativeBundleLoader = {
   load(url: string): void;
-  loadFromBase64?(base64: string): Promise<void>;
+  loadVerifiedFromUrl?(url: string, sha256: string): Promise<void>;
   runningMode(): Promise<RunningMode>;
 };
 
@@ -46,15 +43,6 @@ function assertSafeUrl(url: string): void {
   }
 }
 
-function timingSafeEqualBytes(a: Uint8Array, b: Uint8Array): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  /* eslint-disable no-bitwise */
-  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
-  /* eslint-enable no-bitwise */
-  return diff === 0;
-}
-
 export async function loadVerified(
   url: string,
   expectedSha256Hex: string
@@ -66,27 +54,16 @@ export async function loadVerified(
   ) {
     throw new Error('Expected sha256 must be a 64-character hex string');
   }
-  const expected = fromHex(expectedSha256Hex);
-
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new Error(`Bundle fetch failed: HTTP ${response.status}`);
-  }
-  const buffer = await response.arrayBuffer();
-  const bytes = new Uint8Array(buffer);
-  const actual = await hash('sha256', bytes, 'uint8');
-
-  if (!timingSafeEqualBytes(actual, expected)) {
-    throw new Error('Bundle hash mismatch — refusing to load');
-  }
 
   const native = getNative();
-  if (typeof native.loadFromBase64 !== 'function') {
+
+  if (typeof native.loadVerifiedFromUrl !== 'function') {
     throw new Error(
-      'Native loadFromBase64 not available. Rebuild the host app after upgrading.'
+      'loadVerifiedFromUrl is not available on this platform. Rebuild the host app with the latest native module.'
     );
   }
-  await native.loadFromBase64(toBase64(bytes));
+
+  await native.loadVerifiedFromUrl(url, expectedSha256Hex);
 }
 
 function loadUnverified(url: string): void {