@hot-updater/react-native 1.0.4 → 1.0.6

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -285,7 +285,7 @@ public protocol BundleStorageService {
     func prepareLaunch(bundle: Bundle, pendingRecovery: PendingCrashRecovery?) -> LaunchSelection
 
     // Bundle update
-    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL?, assets: [String: ChangedAssetDescriptor], progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void)
+    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL?, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver?, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void)
     func stageReleaseSelection(_ selection: PersistedSelection) -> Bool
     func acceptReleaseCatalog(catalogId: String, scopeKey: String, generation: Int64, catalogHash: String, channel: String, selectionContextHash: String) -> Bool
     func getActiveUpdateState() -> [String: Any]
@@ -336,6 +336,12 @@ public extension BundleStorageService {
 
 class BundleFileStorageService: BundleStorageService {
     private static let maximumSafeByteSize: Int64 = 9_007_199_254_740_991
+    /// Files downloaded at once when the archive is not used.
+    static let parallelFileDownloads = 16
+    /// What one request costs beyond the first `parallelFileDownloads`, in
+    /// bytes: each waits a round trip for a free slot, about 100 ms, which at
+    /// 5 MB/s over 16 slots is the time of 32 KiB.
+    private static let requestOverheadByteSize: Int64 = 32 * 1024
 
     private struct ActiveBundleMetadataSnapshot {
         let activeBundleId: String
@@ -1168,7 +1174,15 @@ class BundleFileStorageService: BundleStorageService {
         guard !overheadUnderflowed,
               tarOverhead >= 0 else { return false }
 
-        if archive.downloadByteSize <= individualLowerBound {
+        // Many small files cost more in requests than in bytes.
+        let requestOverhead = Int64(max(0, downloads.count - Self.parallelFileDownloads))
+            * Self.requestOverheadByteSize
+        let (individualCost, costOverflowed) = individualLowerBound
+            .addingReportingOverflow(requestOverhead)
+        guard !costOverflowed,
+              individualCost <= Self.maximumSafeByteSize else { return false }
+
+        if archive.downloadByteSize <= individualCost {
             return true
         }
 
@@ -1176,7 +1190,7 @@ class BundleFileStorageService: BundleStorageService {
               !hasOfferedPatch else {
             return false
         }
-        let (archiveBound, boundOverflowed) = individualLowerBound
+        let (archiveBound, boundOverflowed) = individualCost
             .addingReportingOverflow(tarOverhead)
         guard !boundOverflowed,
               archiveBound <= Self.maximumSafeByteSize else { return false }
@@ -2015,7 +2029,7 @@ class BundleFileStorageService: BundleStorageService {
      * @param progressHandler Callback for download and extraction progress (0.0 to 1.0)
      * @param completion Callback with result of the operation
      */
-    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL? = nil, assets: [String: ChangedAssetDescriptor], progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void) {
+    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL? = nil, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver? = nil, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void) {
         // Check if bundle is in crashed history
         if getCrashHistory().contains(bundleId) {
             NSLog("[BundleStorage] Bundle '\(bundleId)' is in crashed history, rejecting update")
@@ -2038,6 +2052,7 @@ class BundleFileStorageService: BundleStorageService {
                 manifestFileHash: manifestFileHash,
                 archiveUrl: archiveUrl,
                 changedAssets: assets,
+                fileResolver: fileResolver,
                 storeDir: storeDir,
                 progressHandler: progressHandler,
                 completion: completion
@@ -2045,6 +2060,35 @@ class BundleFileStorageService: BundleStorageService {
         }
     }
 
+    /// Asks `fileResolver` for the URLs of `downloads`, in requests of at
+    /// most `artifactFilesRequestLimit` paths.
+    private func resolveFileUrls(
+        fileResolver: ArtifactFileResolver,
+        downloads: inout [String: ChangedAssetDescriptor]
+    ) throws {
+        let paths = downloads.keys.sorted()
+        for start in stride(from: 0, to: paths.count, by: artifactFilesRequestLimit) {
+            let chunk = Array(paths[start..<min(start + artifactFilesRequestLimit, paths.count)])
+            let files: [String: ResolvedArtifactFile]
+            do {
+                files = try fileResolver.resolve(paths: chunk)
+            } catch {
+                throw BundleStorageError.downloadFailed(error)
+            }
+            for path in chunk {
+                guard let file = files[path], let descriptor = downloads[path] else {
+                    throw BundleStorageError.invalidBundle
+                }
+                downloads[path] = ChangedAssetDescriptor(
+                    fileUrl: file.url,
+                    fileHash: descriptor.fileHash,
+                    fileCompression: file.compression,
+                    patch: descriptor.patch
+                )
+            }
+        }
+    }
+
     /// How the per-file install produced one file.
     private enum AssetInstallOutcome {
         case patched
@@ -2490,6 +2534,7 @@ class BundleFileStorageService: BundleStorageService {
         manifestFileHash: String,
         archiveUrl: URL?,
         changedAssets: [String: ChangedAssetDescriptor],
+        fileResolver: ArtifactFileResolver?,
         storeDir: String,
         progressHandler: @escaping (UpdateProgressPayload) -> Void,
         completion: @escaping (Result<UpdateDelivery, Error>) -> Void
@@ -2576,20 +2621,43 @@ class BundleFileStorageService: BundleStorageService {
             else {
                 throw BundleStorageError.invalidBundle
             }
-            // Validate the entire wire contract even when every byte can be reused.
-            guard Set(targetManifest.assets.keys) == Set(changedAssets.keys) else {
-                throw BundleStorageError.invalidBundle
+            if fileResolver == nil {
+                // Legacy: artifact protocol v1, where every file comes with its URL.
+                // Validate the entire wire contract even when every byte can be reused.
+                guard Set(targetManifest.assets.keys) == Set(changedAssets.keys) else {
+                    throw BundleStorageError.invalidBundle
+                }
+            } else {
+                // In v2, `assets` holds only the Hermes patch.
+                guard Set(changedAssets.keys).isSubset(of: Set(targetManifest.assets.keys)) else {
+                    throw BundleStorageError.invalidBundle
+                }
             }
             for (path, asset) in targetManifest.assets {
                 guard FileUtilities.normalizedRelativePath(from: path) == path,
-                      path != "manifest.json",
-                      let descriptor = changedAssets[path],
-                      descriptor.fileUrl != nil,
-                      descriptor.fileHash.caseInsensitiveCompare(asset.fileHash) == .orderedSame else {
+                      path != "manifest.json" else {
                     throw BundleStorageError.invalidBundle
                 }
+                if fileResolver == nil {
+                    guard let descriptor = changedAssets[path],
+                          descriptor.fileUrl != nil,
+                          descriptor.fileHash.caseInsensitiveCompare(asset.fileHash) == .orderedSame else {
+                        throw BundleStorageError.invalidBundle
+                    }
+                }
                 _ = try FileUtilities.fileURL(for: path, destinationRoot: tmpDir)
             }
+            // In v2, the manifest names every file; URLs come once the install
+            // knows which files it downloads.
+            let plannedAssets: [String: ChangedAssetDescriptor] = fileResolver == nil
+                ? changedAssets
+                : targetManifest.assets.reduce(into: [:]) { planned, entry in
+                    planned[entry.key] = ChangedAssetDescriptor(
+                        fileUrl: nil,
+                        fileHash: entry.value.fileHash,
+                        patch: changedAssets[entry.key]?.patch
+                    )
+                }
 
             // Downloads, patches, and extraction below classify their own errors.
             failurePhase = .storage
@@ -2642,7 +2710,7 @@ class BundleFileStorageService: BundleStorageService {
                     }
                     continue
                 }
-                downloads[assetPath] = changedAssets[assetPath]
+                downloads[assetPath] = plannedAssets[assetPath]
             }
 
             var archiveInstalled = false
@@ -2677,11 +2745,18 @@ class BundleFileStorageService: BundleStorageService {
             }
 
             if !archiveInstalled {
+                if let fileResolver {
+                    failurePhase = .transfer
+                    failureResource = .file
+                    try resolveFileUrls(fileResolver: fileResolver, downloads: &downloads)
+                    failurePhase = .storage
+                    failureResource = nil
+                }
                 diffFiles = createDiffProgressFiles(changedAssets: downloads)
                 emitDiffProgress(progressHandler: progressHandler, phase: "downloading", files: diffFiles)
                 let progressLock = NSLock()
                 let workers = OperationQueue()
-                workers.maxConcurrentOperationCount = 4
+                workers.maxConcurrentOperationCount = Self.parallelFileDownloads
                 var installError: Error?
                 var installOutcomes: [AssetInstallOutcome] = []
                 for progressFile in diffFiles {

package/ios/HotUpdater/Internal/HotUpdater.mm

@@ -9,17 +9,41 @@
 #include <signal.h>
 #include <unistd.h>
 
+#if defined(SWIFT_PACKAGE)
+// Swift Package Manager: the Swift classes, through the protocols they conform
+// to (see HotUpdaterInterface.h).
+#import "HotUpdaterInterface.h"
+typedef NSObject<HotUpdaterImplInterface> HotUpdaterImpl;
+typedef NSObject<HotUpdaterConfigInterface> HotUpdaterConfig;
+#else
 #if __has_include("HotUpdater/HotUpdater-Swift.h")
 #import "HotUpdater/HotUpdater-Swift.h"
 #else
 #import "HotUpdater-Swift.h"
 #endif
 
+static HotUpdaterImpl *HotUpdaterMakeImpl(void)
+{
+  return [[HotUpdaterImpl alloc] init];
+}
+
+static NSString *HotUpdaterAppVersion(void)
+{
+  return [HotUpdaterImpl appVersion];
+}
+
+static HotUpdaterConfig *HotUpdaterSharedConfig(void)
+{
+  return [HotUpdaterConfig shared];
+}
+#endif
+
 @interface HotUpdater (InternalSharedImpl)
 + (HotUpdaterImpl *)sharedImpl;
-+ (NSString *)generateUUIDv7FromTimestamp:(uint64_t)timestampMs;
 @end
 
+extern "C" NSString *HotUpdaterBuildMinBundleId(void);
+
 namespace {
 constexpr size_t kHotUpdaterMaxBundleIdLength = 128;
 const int kHotUpdaterSignals[] = {SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP};
@@ -207,61 +231,11 @@ extern "C" BOOL HotUpdaterPerformRecoveryReload(void)
 
 extern "C" NSString *HotUpdaterGetMinBundleId(void)
 {
-  static NSString *uuid = nil;
-  static dispatch_once_t onceToken;
-  dispatch_once(&onceToken, ^{
 #if DEBUG
-    uuid = @"00000000-0000-0000-0000-000000000000";
+  return @"00000000-0000-0000-0000-000000000000";
 #else
-    // Step 1: Use the HOT_UPDATER_MIN_BUNDLE_ID build setting, which the
-    // hot-updater CLI passes to xcodebuild and the Info.plist slot it adds
-    // (`$(HOT_UPDATER_MIN_BUNDLE_ID)`) carries into the app, as Android
-    // takes -PMIN_BUNDLE_ID.
-    NSString *customValue = [[NSBundle mainBundle] objectForInfoDictionaryKey:@"HOT_UPDATER_MIN_BUNDLE_ID"];
-    if ([customValue isKindOfClass:[NSString class]]) {
-      NSString *trimmed = [customValue stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]];
-      // An unset build setting leaves the slot empty or unexpanded; anything
-      // but a UUID falls back to the compile time below.
-      NSUUID *parsed = trimmed.length > 0 ? [[NSUUID alloc] initWithUUIDString:trimmed] : nil;
-      if (parsed) {
-        uuid = parsed.UUIDString.lowercaseString;
-        RCTLogInfo(@"[HotUpdater.mm] Using MIN_BUNDLE_ID from the HOT_UPDATER_MIN_BUNDLE_ID build setting: %@", uuid);
-        return;
-      }
-      if (trimmed.length > 0 && ![trimmed isEqualToString:@"$(HOT_UPDATER_MIN_BUNDLE_ID)"]) {
-        RCTLogWarn(@"[HotUpdater.mm] Ignoring HOT_UPDATER_MIN_BUNDLE_ID %@: not a UUID", trimmed);
-      }
-    }
-
-    // Step 2: Fall back to the compile time (26-hour subtraction)
-    RCTLogInfo(@"[HotUpdater.mm] No HOT_UPDATER_MIN_BUNDLE_ID build setting, using the compile time");
-
-    NSString *compileDateStr = [NSString stringWithFormat:@"%s %s", __DATE__, __TIME__];
-    NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
-
-    // Parse __DATE__ __TIME__ as UTC to ensure consistent timezone handling across all build environments
-    [formatter setTimeZone:[NSTimeZone timeZoneWithName:@"UTC"]];
-    [formatter setLocale:[[NSLocale alloc] initWithLocaleIdentifier:@"en_US_POSIX"]];
-    [formatter setDateFormat:@"MMM d yyyy HH:mm:ss"];
-    NSDate *buildDate = [formatter dateFromString:compileDateStr];
-    if (!buildDate) {
-      RCTLogWarn(@"[HotUpdater.mm] Could not parse build date: %@", compileDateStr);
-      uuid = @"00000000-0000-0000-0000-000000000000";
-      return;
-    }
-
-    // Subtract 26 hours (93600 seconds) to ensure MIN_BUNDLE_ID is always in the past
-    // This guarantees that uuidv7-based bundleIds (generated at runtime) will always be newer than MIN_BUNDLE_ID
-    // Why 26 hours? Global timezone range spans from UTC-12 to UTC+14 (total 26 hours)
-    // By subtracting 26 hours, MIN_BUNDLE_ID becomes a safe "past timestamp" regardless of build timezone
-    // Example: Build at 15:00 in any timezone -> parse as 15:00 UTC -> subtract 26h -> 13:00 UTC (previous day)
-    NSTimeInterval adjustedTimestamp = [buildDate timeIntervalSince1970] - 93600.0;
-    uint64_t buildTimestampMs = (uint64_t)(adjustedTimestamp * 1000.0);
-
-    uuid = [HotUpdater generateUUIDv7FromTimestamp:buildTimestampMs];
+  return HotUpdaterBuildMinBundleId();
 #endif
-  });
-  return uuid;
 }
 
 extern "C" void *HotUpdaterCopyMinBundleId(void)
@@ -405,54 +379,22 @@ RCT_EXPORT_MODULE();
     static HotUpdaterImpl *_sharedImpl = nil;
     static dispatch_once_t onceToken;
     dispatch_once(&onceToken, ^{
-        _sharedImpl = [[HotUpdaterImpl alloc] init];
+        _sharedImpl = HotUpdaterMakeImpl();
     });
     return _sharedImpl;
 }
 
 #pragma mark - React Native Constants (Keep getMinBundleId, delegate others)
 
-// Returns the minimum bundle ID string, either from Info.plist or generated from build timestamp
+// Returns the bundle ID of the bundle this build ships (MIN_BUNDLE_ID)
 - (NSString *)getMinBundleId {
      return HotUpdaterGetMinBundleId();
 }
 
-// Helper method: Generate UUID v7 from timestamp (milliseconds)
-+ (NSString *)generateUUIDv7FromTimestamp:(uint64_t)timestampMs {
-    unsigned char bytes[16];
-
-    // UUID v7 format: timestamp_ms (48 bits) + ver (4 bits) + random (12 bits) + variant (2 bits) + random (62 bits)
-    bytes[0] = (timestampMs >> 40) & 0xFF;
-    bytes[1] = (timestampMs >> 32) & 0xFF;
-    bytes[2] = (timestampMs >> 24) & 0xFF;
-    bytes[3] = (timestampMs >> 16) & 0xFF;
-    bytes[4] = (timestampMs >> 8) & 0xFF;
-    bytes[5] = timestampMs & 0xFF;
-
-    // Version 7
-    bytes[6] = 0x70;
-    bytes[7] = 0x00;
-
-    // Variant bits (10xxxxxx)
-    bytes[8] = 0x80;
-    bytes[9] = 0x00;
-
-    // Remaining bytes (zeros for deterministic MIN_BUNDLE_ID)
-    for (int i = 10; i < 16; i++) {
-        bytes[i] = 0x00;
-    }
-
-    return [NSString stringWithFormat:
-            @"%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-            bytes[0], bytes[1], bytes[2], bytes[3], bytes[4], bytes[5], bytes[6], bytes[7],
-            bytes[8], bytes[9], bytes[10], bytes[11], bytes[12], bytes[13], bytes[14], bytes[15]];
-}
-
-
 - (NSDictionary *)_buildConstantsDictionary {
     return @{
         @"MIN_BUNDLE_ID": [self getMinBundleId] ?: [NSNull null],
-        @"APP_VERSION": [HotUpdaterImpl appVersion] ?: [NSNull null],
+        @"APP_VERSION": HotUpdaterAppVersion() ?: [NSNull null],
         @"CHANNEL": [[HotUpdater sharedImpl] getChannel] ?: [NSNull null],
         @"DEFAULT_CHANNEL": [[HotUpdater sharedImpl] getDefaultChannel] ?: [NSNull null],
         @"FINGERPRINT_HASH": [[HotUpdater sharedImpl] getFingerprintHash] ?: [NSNull null]
@@ -484,7 +426,7 @@ RCT_EXPORT_MODULE();
                            publicKey:(NSString *)publicKey
                              channel:(NSString *)channel
                         isolationKey:(NSString *)isolationKey {
-    HotUpdaterConfig *config = [HotUpdaterConfig shared];
+    HotUpdaterConfig *config = HotUpdaterSharedConfig();
     [config configureWithFingerprintHash:fingerprintHash publicKey:publicKey channel:channel isolationKey:isolationKey];
 }
 
@@ -590,6 +532,15 @@ RCT_EXPORT_MODULE();
     if (params.selection()) {
         paramDict[@"selection"] = params.selection();
     }
+    if (params.filesUrl()) {
+        paramDict[@"filesUrl"] = params.filesUrl();
+    }
+    if (params.requestHeaders()) {
+        paramDict[@"requestHeaders"] = params.requestHeaders();
+    }
+    if (params.requestTimeout().has_value()) {
+        paramDict[@"requestTimeout"] = @(params.requestTimeout().value());
+    }
 
     HotUpdaterImpl *impl = [HotUpdater sharedImpl];
     [impl updateBundle:paramDict resolver:resolve rejecter:reject];
@@ -710,7 +661,7 @@ RCT_EXPORT_MODULE();
     HotUpdaterImpl *impl = [HotUpdater sharedImpl];
     return facebook::react::typedConstants<JS::NativeHotUpdater::Constants::Builder>({
         .MIN_BUNDLE_ID = [self getMinBundleId],
-        .APP_VERSION = [HotUpdaterImpl appVersion],
+        .APP_VERSION = HotUpdaterAppVersion(),
         .CHANNEL = [impl getChannel],
         .DEFAULT_CHANNEL = [impl getDefaultChannel],
         .FINGERPRINT_HASH = [impl getFingerprintHash],

package/ios/HotUpdater/Internal/HotUpdaterImpl.swift

@@ -260,7 +260,7 @@ private func hotUpdaterGetMinBundleId() -> String {
      * @param reject Promise reject callback; download and install failures
      *   carry `stage`, `reason`, and their details in the error's userInfo
      */
-    public func updateBundle(_ params: NSDictionary?,
+    public func updateBundle(_ params: [AnyHashable: Any]?,
                                          resolver resolve: @escaping RCTPromiseResolveBlock,
                                          rejecter reject: @escaping RCTPromiseRejectBlock) {
         
@@ -316,11 +316,8 @@ private func hotUpdaterGetMinBundleId() -> String {
                 return
             }
             let assets = assetsPayload.reduce(into: [String: ChangedAssetDescriptor]()) { partialResult, entry in
-                guard let fileHash = entry.value["fileHash"] as? String,
-                      !fileHash.isEmpty
-                else {
-                    return
-                }
+                // In artifact protocol v2, an entry holds only the Hermes patch.
+                let fileHash = entry.value["fileHash"] as? String ?? ""
 
                 let patchPayload = entry.value["patch"] as? [String: Any]
                 let patch = patchPayload.flatMap { payload -> BsdiffPatchDescriptor? in
@@ -346,7 +343,8 @@ private func hotUpdaterGetMinBundleId() -> String {
                 let filePayload = entry.value["file"] as? [String: Any]
                 let fileUrl = (filePayload?["url"] as? String).flatMap { URL(string: $0) }
                 let fileCompression = filePayload?["compression"] as? String
-                guard fileUrl != nil || patch != nil else {
+                guard fileUrl != nil || patch != nil,
+                      !fileHash.isEmpty || fileUrl == nil else {
                     return
                 }
 
@@ -357,6 +355,22 @@ private func hotUpdaterGetMinBundleId() -> String {
                     patch: patch
                 )
             }
+            var fileResolver: ArtifactFileResolver?
+            if let filesUrlString = data["filesUrl"] as? String {
+                guard let filesUrl = URL(string: filesUrlString) else {
+                    let error = UpdateFailure.invalidResponse.with(resource: .file).error(
+                        description: "Invalid 'filesUrl' provided: \(filesUrlString)"
+                    )
+                    reject("INVALID_FILE_URL", error.localizedDescription, error)
+                    return
+                }
+                // The update check's headers, which the artifact files request repeats.
+                let headers = (data["requestHeaders"] as? [String: Any] ?? [:])
+                    .compactMapValues { $0 as? String }
+                let timeout = (data["requestTimeout"] as? NSNumber).map { $0.doubleValue / 1000 }
+                    .flatMap { $0 > 0 ? $0 : nil } ?? HTTPArtifactFileResolver.defaultTimeout
+                fileResolver = HTTPArtifactFileResolver(filesUrl: filesUrl, headers: headers, timeout: timeout)
+            }
             let selection = (data["selection"] as? [String: Any]).flatMap(Self.parseSelection)
             if let selection, !bundleStorage.stageReleaseSelection(selection) {
                 // Not an update failure, so the rejection carries no stage or reason.
@@ -371,7 +385,7 @@ private func hotUpdaterGetMinBundleId() -> String {
             NSLog("[HotUpdaterImpl] updateBundle called with bundleId: \(bundleId), manifestUrl: \(manifestUrl.absoluteString)")
 
             // Heavy work is delegated to bundle storage service with safe error handling
-            bundleStorage.updateBundle(bundleId: bundleId, manifestUrl: manifestUrl, manifestFileHash: manifestFileHash, archiveUrl: archiveUrl, assets: assets, progressHandler: { payload in
+            bundleStorage.updateBundle(bundleId: bundleId, manifestUrl: manifestUrl, manifestFileHash: manifestFileHash, archiveUrl: archiveUrl, assets: assets, fileResolver: fileResolver, progressHandler: { payload in
                 DispatchQueue.main.async {
                     NotificationCenter.default.post(
                         name: .updateProgressDidChange,
@@ -448,7 +462,7 @@ private func hotUpdaterGetMinBundleId() -> String {
         )
     }
 
-    public func acceptReleaseCatalog(_ params: NSDictionary?) -> Bool {
+    public func acceptReleaseCatalog(_ params: [AnyHashable: Any]?) -> Bool {
         guard let data = params as? [String: Any],
               let catalogId = data["catalogId"] as? String,
               let scopeKey = data["scopeKey"] as? String,
@@ -507,7 +521,7 @@ private func hotUpdaterGetMinBundleId() -> String {
         }
     }
 
-    public func isReleaseSelectionCurrent(_ params: NSDictionary?) -> Bool {
+    public func isReleaseSelectionCurrent(_ params: [AnyHashable: Any]?) -> Bool {
         guard let data = params as? [String: Any],
               let catalogId = data["catalogId"] as? String,
               let scopeKey = data["scopeKey"] as? String,
@@ -528,7 +542,7 @@ private func hotUpdaterGetMinBundleId() -> String {
     }
 
     public func commitReleaseSelection(
-        _ params: NSDictionary?,
+        _ params: [AnyHashable: Any]?,
         resolver resolve: @escaping RCTPromiseResolveBlock,
         rejecter reject: @escaping RCTPromiseRejectBlock
     ) {

package/ios/HotUpdater/Internal/HotUpdaterInterface.swift

@@ -0,0 +1,26 @@
+#if SWIFT_PACKAGE
+import Foundation
+import HotUpdaterInterface
+
+// Swift Package Manager only: the Objective-C++ module reaches these classes
+// through the protocols in HotUpdaterInterface.h, and these conformances make
+// the compiler check that the classes still match them.
+extension HotUpdaterImpl: HotUpdaterImplInterface {}
+
+extension HotUpdaterConfig: HotUpdaterConfigInterface {}
+
+@_cdecl("HotUpdaterMakeImpl")
+public func hotUpdaterMakeImpl() -> HotUpdaterImplInterface {
+    HotUpdaterImpl()
+}
+
+@_cdecl("HotUpdaterAppVersion")
+public func hotUpdaterAppVersion() -> NSString? {
+    HotUpdaterImpl.appVersion as NSString?
+}
+
+@_cdecl("HotUpdaterSharedConfig")
+public func hotUpdaterSharedConfig() -> HotUpdaterConfigInterface {
+    HotUpdaterConfig.shared
+}
+#endif

package/ios/HotUpdater/Internal/HotUpdaterMinBundleId.m

@@ -0,0 +1,10 @@
+#import <Foundation/Foundation.h>
+
+// Generated before every compile by ios/scripts/generate-min-bundle-id.zsh,
+// so this file is the only one rebuilt when the value changes.
+#import "HotUpdaterBuildMinBundleId.h"
+
+NSString *HotUpdaterBuildMinBundleId(void)
+{
+  return @HOT_UPDATER_BUILD_MIN_BUNDLE_ID;
+}

package/ios/HotUpdater/Package.swift

@@ -0,0 +1,88 @@
+// swift-tools-version: 5.10
+import PackageDescription
+
+let coreSources = [
+    "ArtifactFileResolver.swift",
+    "FileUtilities.swift",
+    "BrotliFileDecompressor.swift",
+    "TarArchiveExtractor.swift",
+    "BundleFileStorageService.swift",
+    "BuiltInAssetResolver.swift",
+    "BundleMetadata.swift",
+    "FileManagerService.swift",
+    "HashUtils.swift",
+    "HotUpdaterConfig.swift",
+    "KeyValueStorageService.swift",
+    "NotificationExtension.swift",
+    "ReleaseCatalogCacheService.swift",
+    "SignatureVerifier.swift",
+    "UpdateFailure.swift",
+    "URLSessionDownloadService.swift",
+    "VersionedPreferencesService.swift",
+]
+
+let coreExcludedFiles = [
+    "BsdiffPatchBridge.h",
+    "BsdiffPatchBridge.mm",
+    "CohortService.swift",
+    "HotUpdater-Bridging-Header.h",
+    "HotUpdater.mm",
+    "HotUpdaterImpl.swift",
+    "HotUpdaterInterface.swift",
+    "HotUpdaterMinBundleId.m",
+]
+
+let bsdiffPatchBridgeExcludedFiles =
+    coreSources + coreExcludedFiles.filter {
+        $0 != "BsdiffPatchBridge.h" && $0 != "BsdiffPatchBridge.mm"
+    }
+
+let package = Package(
+    name: "HotUpdater",
+    platforms: [
+        .iOS(.v13),
+        .macOS(.v10_15)
+    ],
+    products: [
+        .library(
+            name: "HotUpdaterCore",
+            targets: ["HotUpdaterCore"]
+        )
+    ],
+    dependencies: [],
+    targets: [
+        .target(
+            name: "HotUpdaterRecovery",
+            path: "Recovery",
+            exclude: ["HotUpdaterRecoveryHooks.mm"],
+            sources: ["HotUpdaterRecovery.mm"],
+            publicHeadersPath: ".",
+            cxxSettings: [.define("RCT_NEW_ARCH_ENABLED")]
+        ),
+        .target(
+            name: "HotUpdaterBsdiffPatch",
+            path: "Internal",
+            exclude: bsdiffPatchBridgeExcludedFiles,
+            sources: ["BsdiffPatchBridge.mm"],
+            publicHeadersPath: ".",
+            linkerSettings: [
+                .linkedFramework("Foundation"),
+                .linkedLibrary("bz2"),
+            ]
+        ),
+        // React Native's full native module cannot be built through SPM yet,
+        // but the pure-Swift update core can be.
+        .target(
+            name: "HotUpdaterCore",
+            dependencies: ["HotUpdaterBsdiffPatch"],
+            path: "Internal",
+            exclude: coreExcludedFiles,
+            sources: coreSources
+        ),
+        .testTarget(
+            name: "HotUpdaterTest",
+            dependencies: ["HotUpdaterCore", "HotUpdaterRecovery"],
+            path: "Test"
+        ),
+    ]
+) 

package/ios/Plugins/HotUpdaterMinBundleIdPlugin/HotUpdaterMinBundleIdPlugin.swift

@@ -0,0 +1,28 @@
+import Foundation
+import PackagePlugin
+
+// Runs ios/scripts/generate-min-bundle-id.zsh before every build of the target,
+// the SwiftPM counterpart of the podspec's script phase. The script writes a
+// Swift file defining HotUpdaterBuildMinBundleId(), which HotUpdater.mm calls.
+@main
+struct HotUpdaterMinBundleIdPlugin: BuildToolPlugin {
+    func createBuildCommands(context: PluginContext, target: Target) throws -> [Command] {
+        let script = context.package.directoryURL
+            .appending(path: "ios/scripts/generate-min-bundle-id.zsh")
+        let outputDirectory = context.pluginWorkDirectoryURL
+            .appending(path: "MinBundleId")
+        var environment: [String: String] = [:]
+        if let minBundleId = ProcessInfo.processInfo.environment["HOT_UPDATER_MIN_BUNDLE_ID"] {
+            environment["HOT_UPDATER_MIN_BUNDLE_ID"] = minBundleId
+        }
+        return [
+            .prebuildCommand(
+                displayName: "[HotUpdater] Generate MIN_BUNDLE_ID",
+                executable: URL(filePath: "/bin/zsh"),
+                arguments: [script.path(percentEncoded: false), "--swift", outputDirectory.path(percentEncoded: false)],
+                environment: environment,
+                outputFilesDirectory: outputDirectory
+            ),
+        ]
+    }
+}