@protobase/mobile 0.57.4 → 0.57.6

package/ios/Sources/ProtobaseMobile/BlockedBundles.swift

@@ -0,0 +1,26 @@
+import Foundation
+
+/**
+ * The bundles the stock plugin blocked after rolling them back (`autoBlockRolledBackBundles`): ready() adds the id of
+ * a bundle that never got ready to a comma separated list in its user defaults (LiveUpdate.swift, addBlockedBundleId,
+ * and LiveUpdatePreferences.swift of @capawesome/capacitor-live-update 8.7.1). The stock code reads it only in sync(),
+ * which the guard refuses, so the guard reads it itself.
+ */
+enum BlockedBundles {
+    /** The stock plugin's key: its prefix and key, which its source marks "DO NOT CHANGE". */
+    static let key = "CapawesomeLiveUpdate.blockedBundleIds"
+
+    /**
+     * Whether `value`, the stock list as stored, blocks `bundleId`. The stock code stores nothing until it blocks one,
+     * so none is an empty list; a value of another type, or an entry that is no bundle id, as after a plugin upgrade
+     * that changed its format, is a list the guard cannot read, which blocks every id, so it fails closed.
+     */
+    static func blocks(_ value: Any?, _ bundleId: String) -> Bool {
+        guard let value else { return false }
+        guard let list = value as? String else { return true }
+        if list.isEmpty { return false }
+        let ids = list.split(separator: ",", omittingEmptySubsequences: false).map(String.init)
+        if !ids.allSatisfy(BundlesFolder.isBundleIdShape) { return true }
+        return ids.contains(bundleId)
+    }
+}

package/ios/Sources/ProtobaseMobile/BundleCheck.swift

@@ -0,0 +1,47 @@
+import Foundation
+
+/**
+ * Checks a bundle folder on disk before the app runs it: its statement names its id and is signed with the app's key
+ * for this binary, its manifest is the one the statement names, every file it lists is there with its checksum and
+ * size, and the folder holds nothing else, no link either. Nothing is followed through a link.
+ */
+enum BundleCheck {
+    static func check(_ dir: String, bundleId: String, key: ReleaseKey, binary: ReleaseBinary) throws -> ReleaseStatement {
+        if LocalFile.kind(dir) != .folder { throw BundleRefused("it is no bundle folder") }
+        let statement = try ReleaseStatement.verify(LocalFile.read(dir + "/" + ReleaseStatement.file, limit: ReleaseStatement.maxBytes, "its statement"), bundleId: bundleId, key: key)
+        try binary.accept(statement)
+        let manifest = try ReleaseManifest.verify(LocalFile.read(dir + "/" + ReleaseManifest.file, limit: ReleaseManifest.maxBytes, "its manifest"), statement: statement)
+        var expected: Set<String> = [ReleaseStatement.file, ReleaseManifest.file]
+        for item in manifest.items { expected.insert(item.href) }
+        var budget = expected.count * 2
+        try walk(dir, prefix: "", expected: expected, budget: &budget)
+        for item in manifest.items {
+            let path = dir + "/" + item.href
+            if LocalFile.kind(path) != .file { throw BundleRefused("it lacks \(item.href)") }
+            if try Sha256.of(file: path) != item.checksum || fileSize(path) != item.size { throw BundleRefused("its \(item.href) is not the file its manifest names") }
+        }
+        return statement
+    }
+
+    // Every entry below `dir`, as `prefix` + its name: a file must be expected by its exact name, a folder is walked, a
+    // link or anything else refuses the bundle. `budget` bounds the entries, so a planted tree cannot keep the check busy.
+    private static func walk(_ dir: String, prefix: String, expected: Set<String>, budget: inout Int) throws {
+        guard let names = try? FileManager.default.contentsOfDirectory(atPath: dir) else { throw BundleRefused("it could not be read") }
+        for name in names {
+            budget -= 1
+            if budget < 0 { throw BundleRefused("its folder holds files its manifest does not list") }
+            let path = prefix + name
+            switch LocalFile.kind(dir + "/" + name) {
+            case .folder: try walk(dir + "/" + name, prefix: path + "/", expected: expected, budget: &budget)
+            case .file: if !expected.contains(path) { throw BundleRefused("its folder holds \(path), which its manifest does not list") }
+            case .link: throw BundleRefused("its folder holds a link")
+            case .other, .missing: throw BundleRefused("its folder holds \(path), which is no file")
+            }
+        }
+    }
+
+    private static func fileSize(_ path: String) -> Int64 {
+        var info = stat()
+        return lstat(path, &info) == 0 ? Int64(info.st_size) : -1
+    }
+}

package/ios/Sources/ProtobaseMobile/BundleRefused.swift

@@ -0,0 +1,8 @@
+/** Why the guard refuses a release or a bundle, said as the end of "refused release <id>: …". */
+struct BundleRefused: Error, Equatable {
+    let reason: String
+
+    init(_ reason: String) {
+        self.reason = reason
+    }
+}

package/ios/Sources/ProtobaseMobile/BundleRemoval.swift

@@ -0,0 +1,23 @@
+import Foundation
+
+/** Deletes a folder the guard owns, never following a link out of it: a link is deleted itself. */
+enum BundleRemoval {
+    /** Deletes `target` when it is a direct child of `root`. */
+    static func delete(root: String, target: String) {
+        let parent = URL(fileURLWithPath: target).standardized.deletingLastPathComponent().path
+        guard parent == URL(fileURLWithPath: root).standardized.path else { return }
+        deleteTree(target)
+    }
+
+    private static func deleteTree(_ path: String) {
+        switch LocalFile.kind(path) {
+        case .missing:
+            return
+        case .folder:
+            for name in (try? FileManager.default.contentsOfDirectory(atPath: path)) ?? [] { deleteTree(path + "/" + name) }
+            rmdir(path)
+        case .file, .link, .other:
+            unlink(path)
+        }
+    }
+}

package/ios/Sources/ProtobaseMobile/GuardedLiveUpdatePlugin.swift

@@ -8,11 +8,16 @@ import Capacitor
  * script reaches; page script's input never reaches the stock code, which gets a new call with what the guard built.
  *
  * - The methods the shell needs that take no input get none.
- * - downloadBundle: see LiveUpdateDownload and DownloadBudget.
- * - setNextBundle takes null, which resets to the built-in bundle, or an id naming a bundle (BundlesFolder.isBundleId):
- *   the stock code joins ids to its path unchecked (LiveUpdate.swift, buildBundleURLFor).
- * - Everything else is refused, and so is every method when load() refuses to load (LiveUpdateLoadCheck): the stock
- *   plugin then never loads.
+ * - downloadBundle takes only a manifest from the app's own releases URL, `releasesUrl + "/" + bundleId`, and the guard
+ *   downloads it itself (LiveUpdateGuard, ReleaseDownload), bound by the release's statement to the id, the pinned
+ *   `publicKey`, this binary and its order. A few per run of the app (DownloadBudget).
+ * - Both take a release only above the order of the binary's own files, `builtInOrder`, and neither takes a bundle the
+ *   stock code blocked after rolling it back (BlockedBundles), which it checks only in the refused sync().
+ * - setNextBundle takes an id naming a bundle (BundlesFolder.isBundleId), checks it on disk (BundleCheck) and takes it
+ *   only above the running bundle's order and not below the highest the app downloaded. It is the only way to a
+ *   downloaded bundle: null, which the stock code takes for the built-in files, reset, sync and the rest are refused.
+ * - Everything else is refused, and so is every method when load() refuses to load (LiveUpdateLoadCheck,
+ *   LiveUpdatePins): the stock plugin then never loads.
  */
 @objc(GuardedLiveUpdatePlugin)
 public class GuardedLiveUpdatePlugin: CAPPlugin, CAPBridgedPlugin {
@@ -20,24 +25,59 @@ public class GuardedLiveUpdatePlugin: CAPPlugin, CAPBridgedPlugin {
     public let jsName = "LiveUpdate"
     public let pluginMethods = LiveUpdateMethods.declared.map { CAPPluginMethod(name: $0, returnType: CAPPluginReturnPromise)! }
 
+    // One download at a time.
+    private static let downloads = DispatchQueue(label: "net.protobase.mobile.live-update-downloads")
+
     private var stock: StockLiveUpdate?
-    private var settings: LiveUpdateSettings?
+    private var guarded: LiveUpdateGuard?
 
     override public func load() {
-        start(LiveUpdateSettings(getConfig()), StockLiveUpdate.make())
+        start(LiveUpdateSettings(getConfig()), StockLiveUpdate.make(), appId: Bundle.main.bundleIdentifier, environment: appEnvironment)
     }
 
-    func start(_ settings: LiveUpdateSettings, _ stock: StockLiveUpdate?) {
+    func start(_ settings: LiveUpdateSettings, _ stock: StockLiveUpdate?, appId: String?, environment: (LiveUpdatePins) -> LiveUpdateGuard.Environment) {
         if let reason = LiveUpdateLoadCheck.refusal(settings, stockMethods: stock?.methodNames, stockResponds: { stock?.responds(to: $0) ?? false }) {
             CAPLog.print("⚡️ ", reason)
             return
         }
+        let pins: LiveUpdatePins
+        switch LiveUpdatePins.make(settings, appId: appId) {
+        case .failure(let refusal):
+            CAPLog.print("⚡️ ", refusal.reason)
+            return
+        case .success(let made):
+            pins = made
+        }
         guard let stock else { return }
+        let guarded = LiveUpdateGuard(pins: pins, environment: environment(pins))
+        guarded.clearDownloads()
         stock.load(guardedBy: self)
-        self.settings = settings
+        self.guarded = guarded
         self.stock = stock
     }
 
+    // Where the stock code keeps bundles and the next one (LiveUpdate.swift, bundlesDirectory and defaultServerPathKey)
+    // and Capacitor its built-in files (CAPBridgeViewController.swift, the `public` folder of the app's bundle).
+    private func appEnvironment(_ pins: LiveUpdatePins) -> LiveUpdateGuard.Environment {
+        LiveUpdateGuard.Environment(
+            bundles: BundlesFolder.path,
+            downloads: NSHomeDirectory() + "/Library/NoCloud/protobase_live_update_downloads",
+            builtInFiles: Bundle.main.bundlePath + "/public",
+            defaults: .standard,
+            currentPath: { [weak self] in self?.serverBasePath() },
+            nextPath: { KeyValueStore.standard["serverBasePath", as: String.self] },
+            source: ReleaseFetch(releasesUrl: pins.releasesUrl))
+    }
+
+    private func serverBasePath() -> String? {
+        if Thread.isMainThread { return MainActor.assumeIsolated { readServerBasePath() } }
+        return DispatchQueue.main.sync { MainActor.assumeIsolated { readServerBasePath() } }
+    }
+
+    @MainActor private func readServerBasePath() -> String? {
+        (bridge?.viewController as? CAPBridgeViewController)?.getServerBasePath()
+    }
+
     private func refuse(_ call: CAPPluginCall) {
         Refusal.reject(call, plugin: jsName)
     }
@@ -47,20 +87,35 @@ public class GuardedLiveUpdatePlugin: CAPPlugin, CAPBridgedPlugin {
         stock.forward(call, call.methodName, options: [:])
     }
 
-    // Checked
+    // Guarded
 
     @objc func downloadBundle(_ call: CAPPluginCall) {
-        guard let stock, let settings, let options = LiveUpdateDownload.options(call.options, settings) else { return refuse(call) }
+        guard stock != nil, let guarded, let bundleId = LiveUpdateDownload.bundleId(call.options, releasesUrl: guarded.pins.releasesUrl) else { return refuse(call) }
+        if guarded.isBlocked(bundleId) { return call.reject("LiveUpdate.downloadBundle refused release \(bundleId): it was rolled back") }
         guard DownloadBudget.shared.take() else { return call.reject("LiveUpdate.downloadBundle was called too often in this run of the app") }
-        stock.forward(call, "downloadBundle", options: options)
+        Self.downloads.async {
+            do {
+                try guarded.download(bundleId)
+                call.resolve()
+            } catch let refused as BundleRefused {
+                call.reject("LiveUpdate.downloadBundle refused release \(bundleId): \(refused.reason)")
+            } catch {
+                call.reject("LiveUpdate.downloadBundle could not download release \(bundleId)")
+            }
+        }
     }
 
     @objc func setNextBundle(_ call: CAPPluginCall) {
-        guard let stock else { return refuse(call) }
-        let bundleId = call.options["bundleId"]
-        if bundleId == nil || bundleId is NSNull { return stock.forward(call, "setNextBundle", options: [:]) }
-        guard let bundleId = bundleId as? String, BundlesFolder.isBundleId(bundleId) else { return refuse(call) }
-        stock.forward(call, "setNextBundle", options: ["bundleId": bundleId])
+        guard let stock, let guarded, let bundleId = call.options["bundleId"] as? String, BundlesFolder.isBundleId(bundleId, in: guarded.environment.bundles) else {
+            return refuse(call)
+        }
+        do {
+            try guarded.setNext(bundleId) { stock.forward(call, "setNextBundle", options: ["bundleId": bundleId]) }
+        } catch let refused as BundleRefused {
+            call.reject("LiveUpdate.setNextBundle refused bundle \(bundleId): \(refused.reason)")
+        } catch {
+            call.reject("LiveUpdate.setNextBundle could not check bundle \(bundleId)")
+        }
     }
 
     // Cleared

package/ios/Sources/ProtobaseMobile/Hex.swift

@@ -0,0 +1,39 @@
+import Foundation
+
+/** Lowercase hex, as the server writes hashes and the statement; anything else is refused. */
+enum Hex {
+    private static let digits = Array("0123456789abcdef".utf8)
+
+    static func encode<Bytes: Sequence>(_ bytes: Bytes) -> String where Bytes.Element == UInt8 {
+        var text: [UInt8] = []
+        for byte in bytes {
+            text.append(digits[Int(byte >> 4)])
+            text.append(digits[Int(byte & 0xf)])
+        }
+        return String(decoding: text, as: UTF8.self)
+    }
+
+    static func decode(_ text: String, _ what: String) throws -> Data {
+        let chars = Array(text.utf8)
+        guard chars.count % 2 == 0 else { throw BundleRefused("\(what) is no hex") }
+        var bytes = Data(capacity: chars.count / 2)
+        for i in stride(from: 0, to: chars.count, by: 2) {
+            guard let high = digit(chars[i]), let low = digit(chars[i + 1]) else { throw BundleRefused("\(what) is no hex") }
+            bytes.append(high << 4 | low)
+        }
+        return bytes
+    }
+
+    static func isHex(_ text: String, count: Int) -> Bool {
+        let chars = Array(text.utf8)
+        return chars.count == count && chars.allSatisfy { digit($0) != nil }
+    }
+
+    private static func digit(_ c: UInt8) -> UInt8? {
+        switch c {
+        case UInt8(ascii: "0")...UInt8(ascii: "9"): return c - UInt8(ascii: "0")
+        case UInt8(ascii: "a")...UInt8(ascii: "f"): return c - UInt8(ascii: "a") + 10
+        default: return nil
+        }
+    }
+}

package/ios/Sources/ProtobaseMobile/Json.swift

@@ -0,0 +1,19 @@
+import Foundation
+
+/** What JSONSerialization gives, read strictly: an integer is neither a bool nor a fraction. */
+enum Json {
+    static func parse(_ data: Data) -> Any? {
+        try? JSONSerialization.jsonObject(with: data, options: [])
+    }
+
+    static func integer(_ value: Any?) -> Int64? {
+        guard let number = value as? NSNumber, CFGetTypeID(number) != CFBooleanGetTypeID() else { return nil }
+        switch String(cString: number.objCType) {
+        case "c", "s", "i", "l", "q", "C", "S", "I", "L", "Q":
+            // An unsigned value above Int64's range reads as negative, which every caller refuses.
+            return number.int64Value
+        default:
+            return nil
+        }
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateDownload.swift

@@ -1,19 +1,15 @@
 import Foundation
 
 /**
- * What page script may download: a manifest from the app's own releases URL, `releasesUrl + "/" + bundleId`, with
- * `publicKey` pinned, so the stock code checks the manifest and each file against it with the response's signature
- * (LiveUpdate.swift, downloadAndVerifyFile and verifyFile). A caller's checksum and signature are dropped.
+ * What page script may ask to download: a manifest from the app's own releases URL, `releasesUrl + "/" + bundleId`,
+ * by a bundle id. The guard downloads it itself (ReleaseDownload); a caller's checksum, signature and key are ignored.
  */
 enum LiveUpdateDownload {
-    /** The options the stock code downloads with, or nil when the call is refused. */
-    static func options(_ call: [AnyHashable: Any], _ settings: LiveUpdateSettings) -> [String: Any]? {
-        guard let releasesUrl = settings.releasesUrl, ReleasesUrl.isOwnSource(releasesUrl) else { return nil }
-        guard let publicKey = settings.publicKey, !publicKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else { return nil }
+    /** The bundle id the call asks for, or nil when it is refused. */
+    static func bundleId(_ call: [AnyHashable: Any], releasesUrl: String) -> String? {
         guard call["artifactType"] as? String == "manifest", let bundleId = call["bundleId"] as? String else { return nil }
-        let url = releasesUrl + "/" + bundleId
-        guard BundlesFolder.isBundleIdShape(bundleId), call["url"] as? String == url else { return nil }
-        return ["artifactType": "manifest", "bundleId": bundleId, "url": url]
+        guard BundlesFolder.isBundleIdShape(bundleId), call["url"] as? String == releasesUrl + "/" + bundleId else { return nil }
+        return bundleId
     }
 }
 

package/ios/Sources/ProtobaseMobile/LiveUpdateGuard.swift

@@ -0,0 +1,121 @@
+import Foundation
+
+/**
+ * The guard's decisions on releases, apart from Capacitor so they can be tested: downloading one itself and choosing
+ * the next bundle. One lock covers the highest order downloaded and the choice of the next bundle, for every guard of
+ * the process.
+ */
+final class LiveUpdateGuard {
+    /** What the guard reads of the app and the stock plugin, injected so tests stand in for them. */
+    struct Environment {
+        /** The bundles folder, where the stock code keeps bundles by id. */
+        var bundles: String
+        /** Where downloads are put together, beside the bundles folder on the same volume and outside it. */
+        var downloads: String
+        /** The binary's own files, with the manifest the CLI writes beside them. */
+        var builtInFiles: String
+        var defaults: UserDefaults
+        /** The path the app runs, Capacitor's server base path, or nil. */
+        var currentPath: () -> String?
+        /** The path the app runs at the next start, as the stock code keeps it, or nil for the built-in files. */
+        var nextPath: () -> String?
+        var source: ReleaseSource
+    }
+
+    private static let lock = NSLock()
+
+    let pins: LiveUpdatePins
+    let environment: Environment
+    private var marks: LiveUpdateMarks { LiveUpdateMarks(defaults: environment.defaults) }
+
+    init(pins: LiveUpdatePins, environment: Environment) {
+        self.pins = pins
+        self.environment = environment
+    }
+
+    /** Deletes what a download the app did not finish left. */
+    func clearDownloads() {
+        BundleRemoval.delete(root: (environment.downloads as NSString).deletingLastPathComponent, target: environment.downloads)
+    }
+
+    /** Whether the stock plugin blocked bundle `bundleId` after rolling it back. */
+    func isBlocked(_ bundleId: String) -> Bool {
+        BlockedBundles.blocks(environment.defaults.object(forKey: BlockedBundles.key), bundleId)
+    }
+
+    private func refuseBlocked(_ bundleId: String) throws {
+        if isBlocked(bundleId) { throw BundleRefused("it was rolled back") }
+    }
+
+    /** Downloads release `bundleId`, a bundle id, into the bundles folder, and raises the highest order downloaded. */
+    func download(_ bundleId: String) throws {
+        try refuseBlocked(bundleId)
+        let dir = environment.downloads + "/" + UUID().uuidString
+        defer { BundleRemoval.delete(root: environment.downloads, target: dir) }
+        try FileManager.default.createDirectory(atPath: dir, withIntermediateDirectories: true)
+        try FileManager.default.createDirectory(atPath: environment.bundles, withIntermediateDirectories: true)
+        let current = bundleIdOf(environment.currentPath())
+        let own = OwnFiles.inFolder(current.map { environment.bundles + "/" + $0 } ?? environment.builtInFiles)
+        let highest = try locked { try marks.highest() }
+        let release = ReleaseDownload(source: environment.source, key: pins.key, binary: pins.binary)
+        let statement = try release.download(bundleId, into: dir, own: own, builtIn: pins.builtInOrder, highest: highest)
+        // The same release downloaded before stays; setNextBundle checks it anyway.
+        let target = environment.bundles + "/" + bundleId
+        if LocalFile.kind(target) == .missing && rename(dir, target) != 0 { throw BundleRefused("it could not be moved into place") }
+        try locked { try marks.raise(statement.order) }
+    }
+
+    /**
+     * Checks bundle `bundleId`, which names a bundle folder, on disk, then has `choose` set it as the next bundle, under
+     * the lock: it must not be blocked, it must be above the running bundle's order and the built-in files', and not
+     * below the highest order downloaded. A refused bundle that is neither running nor next is deleted.
+     */
+    func setNext(_ bundleId: String, choose: () -> Void) throws {
+        try locked {
+            do {
+                try refuseBlocked(bundleId)
+                let next = try BundleCheck.check(environment.bundles + "/" + bundleId, bundleId: bundleId, key: pins.key, binary: pins.binary)
+                try ReleaseOrder.acceptNext(next.order, current: currentOrder(), builtIn: pins.builtInOrder, highest: marks.highest())
+            } catch let refused as BundleRefused {
+                if bundleId != self.bundleIdOf(environment.currentPath()) && bundleId != self.bundleIdOf(environment.nextPath()) {
+                    BundleRemoval.delete(root: environment.bundles, target: environment.bundles + "/" + bundleId)
+                }
+                throw refused
+            }
+            choose()
+        }
+    }
+
+    // The running bundle's order: the built-in files', or what its statement says, checked against the key and this
+    // binary. One that cannot be read or checked refuses, rather than falling back to the built-in order.
+    private func currentOrder() throws -> [Int64] {
+        guard let current = bundleIdOf(environment.currentPath()) else { return pins.builtInOrder }
+        do {
+            let file = try LocalFile.read(environment.bundles + "/" + current + "/" + ReleaseStatement.file, limit: ReleaseStatement.maxBytes, "its statement")
+            let statement = try ReleaseStatement.verify(file, bundleId: current, key: pins.key)
+            try pins.binary.accept(statement)
+            return statement.order
+        } catch let refused as BundleRefused {
+            throw BundleRefused("the running bundle's statement could not be checked: \(refused.reason)")
+        }
+    }
+
+    /**
+     * The id of the downloaded bundle at `path`, as the stock code names it (LiveUpdate.swift, getCurrentBundleId), or
+     * nil for the built-in files and any path that is not a bundle folder's.
+     */
+    func bundleIdOf(_ path: String?) -> String? {
+        guard let path, !path.isEmpty else { return nil }
+        let url = URL(fileURLWithPath: path).standardized
+        let name = url.lastPathComponent
+        guard url.deletingLastPathComponent().path == URL(fileURLWithPath: environment.bundles).standardized.path,
+              BundlesFolder.isBundleId(name, in: environment.bundles) else { return nil }
+        return name
+    }
+
+    private func locked<T>(_ body: () throws -> T) rethrows -> T {
+        Self.lock.lock()
+        defer { Self.lock.unlock() }
+        return try body()
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateLoadCheck.swift

@@ -2,7 +2,8 @@
  * Why the guard refuses to load the live updater, or nil. A stock method the guard does not declare means a plugin
  * upgrade added one: no live updater then rather than an open one. Background updates sync with the vendor's cloud
  * outside every method (LiveUpdate.swift, handleLoad); `autoDeleteBundles` and a `readyTimeout` make ready() drop every
- * bundle but the current and next one and roll back a bundle that never gets ready, so page script cannot pin an older one.
+ * bundle but the current and next one and roll back a bundle that never gets ready, so page script cannot pin an
+ * older one. What the guard takes a release by is checked as it is read (LiveUpdatePins).
  */
 enum LiveUpdateLoadCheck {
     static func refusal(_ settings: LiveUpdateSettings, stockMethods: [String]?, stockResponds: (String) -> Bool) -> String? {

package/ios/Sources/ProtobaseMobile/LiveUpdateMarks.swift

@@ -0,0 +1,23 @@
+import Foundation
+
+/**
+ * The highest order the app downloaded, kept in its user defaults, so a downgrade stays refused after a restart. Read
+ * and raised only under the guard's lock. A value the guard cannot read refuses every release rather than counting as
+ * none, which would drop the floor.
+ */
+struct LiveUpdateMarks {
+    static let key = "ProtobaseLiveUpdate.highestOrder"
+
+    let defaults: UserDefaults
+
+    func highest() throws -> [Int64] {
+        guard let value = defaults.object(forKey: Self.key) else { return ReleaseOrder.none }
+        guard let text = value as? String, let order = ReleaseOrder.parse(text) else { throw BundleRefused("the highest order the app downloaded cannot be read") }
+        return order
+    }
+
+    /** Raises the mark to `order` when it is higher. */
+    func raise(_ order: [Int64]) throws {
+        if ReleaseOrder.compare(order, try highest()) > 0 { defaults.set(ReleaseOrder.format(order), forKey: Self.key) }
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateMethods.swift

@@ -3,7 +3,9 @@ enum LiveUpdateMethods {
     /** Forwarded with their input cleared. */
     static let cleared = ["ready", "reload", "getCurrentBundle", "getNextBundle", "getDownloadedBundles", "getVersionCode", "getVersionName"]
     /** Forwarded with only the input the guard checked and built. */
-    static let checked = ["downloadBundle", "setNextBundle"]
+    static let checked = ["setNextBundle"]
+    /** Done by the guard itself, never by the stock code. */
+    static let own = ["downloadBundle"]
     /** Never forwarded: deleting, resetting, the vendor's cloud, config, channel and ids. */
     static let refused = [
         "clearBlockedBundles", "deleteBundle", "fetchChannels", "fetchLatestBundle", "getBlockedBundles", "getBundles", "getChannel",
@@ -11,5 +13,5 @@ enum LiveUpdateMethods {
     ]
 
     static var forwarded: [String] { cleared + checked }
-    static var declared: [String] { forwarded + refused }
+    static var declared: [String] { forwarded + own + refused }
 }

package/ios/Sources/ProtobaseMobile/LiveUpdatePins.swift

@@ -0,0 +1,36 @@
+import Foundation
+
+/** What the guard takes a release by, read from `plugins.LiveUpdate` once its load check passed. */
+struct LiveUpdatePins {
+    let releasesUrl: String
+    let key: ReleaseKey
+    let binary: ReleaseBinary
+    let builtInOrder: [Int64]
+
+    /** The pins, or why the guard refuses to load without them. */
+    static func make(_ settings: LiveUpdateSettings, appId: String?) -> Result<LiveUpdatePins, LoadRefusal> {
+        if !settings.autoBlockRolledBackBundles { return .failure(LoadRefusal("plugins.LiveUpdate.autoBlockRolledBackBundles must be true in a Protobase app")) }
+        guard let builtInOrder = ReleaseOrder.parseBuiltIn(settings.builtInOrder) else {
+            return .failure(LoadRefusal("plugins.LiveUpdate needs the order of the binary's own files, builtInOrder, in a Protobase app: run protobase mobile again"))
+        }
+        guard let releasesUrl = settings.releasesUrl, ReleasesUrl.isOwnSource(releasesUrl) else {
+            return .failure(LoadRefusal("plugins.LiveUpdate.releasesUrl must be an https URL, or http to the device itself, in a Protobase app"))
+        }
+        guard let key = ReleaseKey.parse(settings.publicKey) else { return .failure(LoadRefusal("plugins.LiveUpdate.publicKey must be an RSA public key in a Protobase app")) }
+        guard let fingerprint = settings.fingerprint, Hex.isHex(fingerprint, count: 16), let shellVersion = settings.shellVersion, ReleaseStatement.isVersion(shellVersion) else {
+            return .failure(LoadRefusal("plugins.LiveUpdate needs the binary's fingerprint and shellVersion in a Protobase app: run protobase mobile again"))
+        }
+        guard let appId, !appId.isEmpty else { return .failure(LoadRefusal("LiveUpdate needs the app's bundle identifier")) }
+        let binary = ReleaseBinary(appId: appId, fingerprint: fingerprint, shellVersion: shellVersion)
+        return .success(LiveUpdatePins(releasesUrl: releasesUrl, key: key, binary: binary, builtInOrder: builtInOrder))
+    }
+}
+
+/** Why the guard refuses to load the live updater. */
+struct LoadRefusal: Error {
+    let reason: String
+
+    init(_ reason: String) {
+        self.reason = reason
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateSettings.swift

@@ -2,15 +2,20 @@ import Capacitor
 
 /**
  * The live updater's `plugins.LiveUpdate` settings the guard checks, read with the stock plugin's own keys and defaults
- * (capacitor-live-update's LiveUpdatePlugin.swift, liveUpdateConfig), plus Protobase's `releasesUrl`. They come from
- * capacitor.config.json, which ships in the binary outside the web part, beyond page script and a live update.
+ * (capacitor-live-update's LiveUpdatePlugin.swift, liveUpdateConfig), plus Protobase's `releasesUrl`, `fingerprint`,
+ * `shellVersion` and `builtInOrder`. They come from capacitor.config.json, which ships in the binary outside the web
+ * part, beyond page script and a live update.
  */
 struct LiveUpdateSettings {
     var autoUpdateStrategy: String?
     var autoDeleteBundles: Bool
+    var autoBlockRolledBackBundles: Bool
     var readyTimeout: Int
     var releasesUrl: String?
     var publicKey: String?
+    var fingerprint: String?
+    var shellVersion: String?
+    var builtInOrder: String?
 }
 
 extension LiveUpdateSettings {
@@ -18,8 +23,12 @@ extension LiveUpdateSettings {
         self.init(
             autoUpdateStrategy: config.getString("autoUpdateStrategy", "none"),
             autoDeleteBundles: config.getBoolean("autoDeleteBundles", false),
+            autoBlockRolledBackBundles: config.getBoolean("autoBlockRolledBackBundles", false),
             readyTimeout: config.getInt("readyTimeout", 0),
             releasesUrl: config.getString("releasesUrl"),
-            publicKey: config.getString("publicKey"))
+            publicKey: config.getString("publicKey"),
+            fingerprint: config.getString("fingerprint"),
+            shellVersion: config.getString("shellVersion"),
+            builtInOrder: config.getString("builtInOrder"))
     }
 }

package/ios/Sources/ProtobaseMobile/LocalFile.swift

@@ -0,0 +1,87 @@
+import Foundation
+
+/** Files the guard reads and writes in folders it owns, never through a link: each is checked with lstat and opened with O_NOFOLLOW. */
+enum LocalFile {
+    enum Kind {
+        case file, folder, link, other, missing
+    }
+
+    static func kind(_ path: String) -> Kind {
+        var info = stat()
+        if lstat(path, &info) != 0 { return .missing }
+        switch info.st_mode & S_IFMT {
+        case S_IFREG: return .file
+        case S_IFDIR: return .folder
+        case S_IFLNK: return .link
+        default: return .other
+        }
+    }
+
+    // What was opened, not what the path names by now.
+    private static func isFile(_ fd: Int32) -> Bool {
+        var info = stat()
+        return fstat(fd, &info) == 0 && info.st_mode & S_IFMT == S_IFREG
+    }
+
+    /** The bytes of the regular file `path`, at most `limit`. */
+    static func read(_ path: String, limit: Int, _ what: String) throws -> Data {
+        let fd = open(path, O_RDONLY | O_NOFOLLOW)
+        if fd < 0 { throw BundleRefused("\(what) is missing") }
+        let handle = FileHandle(fileDescriptor: fd, closeOnDealloc: true)
+        guard isFile(fd) else { throw BundleRefused("\(what) is no file") }
+        let data = handle.readData(ofLength: limit + 1)
+        if data.count > limit { throw BundleRefused("\(what) is larger than \(limit) bytes") }
+        return data
+    }
+
+    /** Hands the regular file `path` to `body` in chunks. */
+    static func stream(_ path: String, _ what: String, _ body: (Data) throws -> Void) throws {
+        let fd = open(path, O_RDONLY | O_NOFOLLOW)
+        if fd < 0 { throw BundleRefused("\(what) could not be read") }
+        let handle = FileHandle(fileDescriptor: fd, closeOnDealloc: true)
+        guard isFile(fd) else { throw BundleRefused("\(what) is no file") }
+        while true {
+            let chunk = handle.readData(ofLength: 64 * 1024)
+            if chunk.isEmpty { return }
+            try body(chunk)
+        }
+    }
+
+    /** Writes `data` to the new file `path`. */
+    static func create(_ path: String, _ data: Data) throws {
+        let sink = try FileSink(path, limit: Int64(data.count))
+        try sink.write(data)
+        _ = try sink.finish()
+    }
+}
+
+/**
+ * A new file the guard writes, hashed as it is written and holding at most `limit` bytes: created exclusively and
+ * without following a link, so it never writes through one or over a file already there.
+ */
+final class FileSink {
+    private let handle: FileHandle
+    private let limit: Int64
+    private var hasher = Sha256Hasher()
+    private(set) var size: Int64 = 0
+
+    init(_ path: String, limit: Int64) throws {
+        let fd = open(path, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, 0o600)
+        if fd < 0 { throw BundleRefused("\((path as NSString).lastPathComponent) could not be created") }
+        handle = FileHandle(fileDescriptor: fd, closeOnDealloc: true)
+        self.limit = limit
+    }
+
+    func write(_ data: Data) throws {
+        size += Int64(data.count)
+        if size > limit { throw BundleRefused("a file is larger than its manifest says") }
+        hasher.update(data)
+        try handle.write(contentsOf: data)
+    }
+
+    /** The sha256 of what was written. */
+    func finish() throws -> String {
+        try handle.close()
+        return hasher.finish()
+    }
+}

package/ios/Sources/ProtobaseMobile/OwnFiles.swift

@@ -0,0 +1,29 @@
+import Foundation
+
+/**
+ * The files of the bundle the app runs, by checksum, which a download copies instead of fetching: a downloaded
+ * bundle's folder, or the binary's own files, as the manifest beside them lists them. A copy is hashed again as it
+ * is written, so it is bound by its content to the release's manifest, never by where it came from.
+ */
+struct OwnFiles {
+    /** None: every file is fetched. */
+    static let none = OwnFiles(files: [:])
+
+    private let files: [String: String]
+
+    /** The files of `dir` its own manifest lists, regular files only; none when it has no manifest that parses. */
+    static func inFolder(_ dir: String) -> OwnFiles {
+        guard let bytes = try? LocalFile.read(dir + "/" + ReleaseManifest.file, limit: ReleaseManifest.maxBytes, "its manifest"),
+              let manifest = try? ReleaseManifest.parse(bytes) else { return none }
+        var files: [String: String] = [:]
+        for item in manifest.items where LocalFile.kind(dir + "/" + item.href) == .file {
+            files[item.checksum] = dir + "/" + item.href
+        }
+        return OwnFiles(files: files)
+    }
+
+    /** The path of a file of checksum `checksum`, or nil when the bundle has none. */
+    func path(_ checksum: String) -> String? {
+        files[checksum]
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseBinary.swift

@@ -0,0 +1,21 @@
+/**
+ * This binary: its app id, its native fingerprint and the Protobase version of its shell, from the app's bundle and
+ * capacitor.config.json, beyond page script and a live update. It takes a release only for itself.
+ */
+struct ReleaseBinary {
+    let appId: String
+    let fingerprint: String
+    let shellVersion: String
+
+    /**
+     * Refuses a release for another app or fingerprint, or of a server whose API this shell does not work with: the same
+     * major, and below 1.0 the same minor, as the server's `shellUpdateRequired` says.
+     */
+    func accept(_ statement: ReleaseStatement) throws {
+        if statement.appId != appId { throw BundleRefused("it is a release of another app") }
+        if statement.fingerprint != fingerprint { throw BundleRefused("it is a release for another binary") }
+        let own = ReleaseStatement.majorMinor(shellVersion)
+        let server = ReleaseStatement.majorMinor(statement.shellVersion)
+        if own.0 != server.0 || (server.0 == 0 && own.1 != server.1) { throw BundleRefused("it is a release for another shell version") }
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseDownload.swift

@@ -0,0 +1,55 @@
+import Foundation
+
+/**
+ * Downloads release `bundleId` from `releasesUrl/<id>?href=<file>` into a folder, in place of the stock downloader,
+ * which joins a manifest's hrefs to its path unchecked and checks each file only against its own signature
+ * (LiveUpdate.swift, downloadBundleFiles and verifyFile, of @capawesome/capacitor-live-update 8.7.1). First the
+ * statement, checked against the id, the key, this binary and the highest order the app downloaded; then the manifest,
+ * checked against the statement and every href before any file is fetched; then each file, hashed as it is written
+ * and refused unless it is the one the manifest names. A file the running bundle has with the same checksum
+ * (OwnFiles) is copied from it and hashed again, so it is bound by its content, never by its href.
+ */
+struct ReleaseDownload {
+    let source: ReleaseSource
+    let key: ReleaseKey
+    let binary: ReleaseBinary
+
+    /**
+     * Fills the empty folder `dir` with release `bundleId`, copying what `own` has, and checks it as a whole: its order
+     * above the built-in files' `builtIn` and not below `highest`, the highest the app downloaded. Returns its statement.
+     */
+    func download(_ bundleId: String, into dir: String, own: OwnFiles, builtIn: [Int64], highest: [Int64]) throws -> ReleaseStatement {
+        let statementBytes = try fetch(bundleId, ReleaseStatement.file, limit: ReleaseStatement.maxBytes)
+        let statement = try ReleaseStatement.verify(statementBytes, bundleId: bundleId, key: key)
+        try binary.accept(statement)
+        try ReleaseOrder.acceptDownload(statement.order, builtIn: builtIn, highest: highest)
+        let manifestBytes = try fetch(bundleId, ReleaseManifest.file, limit: ReleaseManifest.maxBytes)
+        let manifest = try ReleaseManifest.verify(manifestBytes, statement: statement)
+        for item in manifest.items {
+            let target = dir + "/" + item.href
+            try FileManager.default.createDirectory(atPath: (target as NSString).deletingLastPathComponent, withIntermediateDirectories: true)
+            if let copy = own.path(item.checksum), (try? write(target, item) { sink in try LocalFile.stream(copy, item.href) { try sink.write($0) } }) == true {
+                continue
+            }
+            unlink(target)
+            let fetched = try write(target, item) { sink in try source.fetch(bundleId: bundleId, href: item.href, limit: item.size) { try sink.write($0) } }
+            if !fetched { throw BundleRefused("its \(item.href) is not the file its manifest names") }
+        }
+        try LocalFile.create(dir + "/" + ReleaseStatement.file, statementBytes)
+        try LocalFile.create(dir + "/" + ReleaseManifest.file, manifestBytes)
+        return try BundleCheck.check(dir, bundleId: bundleId, key: key, binary: binary)
+    }
+
+    // Writes the new file `target` from `fill`; whether it is exactly the file `item` names.
+    private func write(_ target: String, _ item: ReleaseManifest.Item, _ fill: (FileSink) throws -> Void) throws -> Bool {
+        let sink = try FileSink(target, limit: item.size)
+        try fill(sink)
+        return try sink.finish() == item.checksum && sink.size == item.size
+    }
+
+    private func fetch(_ bundleId: String, _ href: String, limit: Int) throws -> Data {
+        var data = Data()
+        try source.fetch(bundleId: bundleId, href: href, limit: Int64(limit)) { data.append($0) }
+        return data
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseFetch.swift

@@ -0,0 +1,100 @@
+import Foundation
+
+/** Where a download takes a release's files from: `releasesUrl/<id>?href=<file>`, at most `limit` bytes, in chunks. */
+protocol ReleaseSource {
+    func fetch(bundleId: String, href: String, limit: Int64, into sink: @escaping (Data) throws -> Void) throws
+}
+
+/** A release could not be fetched: the connection failed or timed out. */
+struct ReleaseFetchFailed: Error {}
+
+/**
+ * Fetches a release's file from the app's own releases URL over a session of its own, with no cache or cookies: only a
+ * 200 of the releases URL itself is an answer, a redirect is never followed, and the transfer stops the moment it
+ * passes its limit. Blocks its caller, which must not be the main thread, until the file is in or refused.
+ */
+final class ReleaseFetch: ReleaseSource {
+    private static let requestTimeout: TimeInterval = 30
+    private static let resourceTimeout: TimeInterval = 600
+    // RFC 3986's unreserved characters; every other byte of an href is percent-encoded, a space as %20.
+    private static let unreserved = CharacterSet(charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~")
+
+    private let releasesUrl: String
+    private let configuration: URLSessionConfiguration
+
+    init(releasesUrl: String, configuration: URLSessionConfiguration = .ephemeral) {
+        self.releasesUrl = releasesUrl
+        configuration.urlCache = nil
+        configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+        configuration.httpCookieStorage = nil
+        configuration.httpShouldSetCookies = false
+        configuration.timeoutIntervalForRequest = Self.requestTimeout
+        configuration.timeoutIntervalForResource = Self.resourceTimeout
+        self.configuration = configuration
+    }
+
+    func url(bundleId: String, href: String) -> URL? {
+        guard let query = href.addingPercentEncoding(withAllowedCharacters: Self.unreserved) else { return nil }
+        return URL(string: releasesUrl + "/" + bundleId + "?href=" + query)
+    }
+
+    func fetch(bundleId: String, href: String, limit: Int64, into sink: @escaping (Data) throws -> Void) throws {
+        guard let url = url(bundleId: bundleId, href: href) else { throw BundleRefused("its \(href) has no address") }
+        let transfer = Transfer(href: href, limit: limit, sink: sink)
+        let queue = OperationQueue()
+        queue.maxConcurrentOperationCount = 1
+        let session = URLSession(configuration: configuration, delegate: transfer, delegateQueue: queue)
+        session.dataTask(with: url).resume()
+        transfer.done.wait()
+        session.invalidateAndCancel()
+        if let failure = transfer.failure { throw failure }
+    }
+}
+
+/** One fetch's state, read and written only on its session's serial delegate queue until `done` is signalled. */
+private final class Transfer: NSObject, URLSessionDataDelegate {
+    let href: String
+    let limit: Int64
+    let sink: (Data) throws -> Void
+    let done = DispatchSemaphore(value: 0)
+    var received: Int64 = 0
+    var failure: Error?
+
+    init(href: String, limit: Int64, sink: @escaping (Data) throws -> Void) {
+        self.href = href
+        self.limit = limit
+        self.sink = sink
+    }
+
+    // A redirect is no answer: with nil the 3xx itself arrives as the response, which is refused below.
+    func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) {
+        completionHandler(nil)
+    }
+
+    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive response: URLResponse, completionHandler: @escaping (URLSession.ResponseDisposition) -> Void) {
+        let status = (response as? HTTPURLResponse)?.statusCode ?? 0
+        if status == 200 { return completionHandler(.allow) }
+        failure = BundleRefused("the server answered \(status) for \(href)")
+        completionHandler(.cancel)
+    }
+
+    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
+        if failure != nil { return }
+        received += Int64(data.count)
+        if received > limit {
+            failure = BundleRefused("its \(href) is larger than \(limit) bytes")
+            return dataTask.cancel()
+        }
+        do {
+            try sink(data)
+        } catch {
+            failure = error
+            dataTask.cancel()
+        }
+    }
+
+    func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {
+        if failure == nil && error != nil { failure = ReleaseFetchFailed() }
+        done.signal()
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseKey.swift

@@ -0,0 +1,79 @@
+import Foundation
+import Security
+
+/**
+ * The key releases are signed with, `plugins.LiveUpdate.publicKey`: an RSA public key as base64 SPKI DER, with or
+ * without PEM's lines, as the CLI writes it. The SPKI is read here, so a key of another type is refused rather than
+ * left to Security; its DER is kept, since a release's id hashes it.
+ */
+struct ReleaseKey {
+    let key: SecKey
+    let spki: Data
+
+    // rsaEncryption, 1.2.840.113549.1.1.1.
+    private static let rsaOid: [UInt8] = [0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01]
+
+    /** The key `text` holds, or nil when it is no RSA SPKI. */
+    static func parse(_ text: String?) -> ReleaseKey? {
+        guard let text else { return nil }
+        let body = text.replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
+            .filter { !$0.isWhitespace }
+        guard !body.isEmpty, let spki = Data(base64Encoded: body), let pkcs1 = rsaPublicKey(inSpki: [UInt8](spki)) else { return nil }
+        let attributes: [CFString: Any] = [kSecAttrKeyType: kSecAttrKeyTypeRSA, kSecAttrKeyClass: kSecAttrKeyClassPublic]
+        guard let key = SecKeyCreateWithData(Data(pkcs1) as CFData, attributes as CFDictionary, nil) else { return nil }
+        return ReleaseKey(key: key, spki: spki)
+    }
+
+    /** Whether `key` signed `message`, RSA PKCS#1 v1.5 with SHA-256, as the server's `sign('sha256', …)`. */
+    func signed(_ message: Data, _ signature: Data) -> Bool {
+        SecKeyVerifySignature(key, .rsaSignatureMessagePKCS1v15SHA256, message as CFData, signature as CFData, nil)
+    }
+
+    // SEQUENCE { SEQUENCE { OID rsaEncryption, NULL }, BIT STRING { 0 unused bits, RSAPublicKey } }, nothing after it.
+    private static func rsaPublicKey(inSpki der: [UInt8]) -> [UInt8]? {
+        var outer = Der(der)
+        guard var spki = outer.read(0x30), outer.atEnd else { return nil }
+        guard var algorithm = spki.read(0x30), let oid = algorithm.read(0x06), oid.rest == rsaOid else { return nil }
+        if !algorithm.atEnd { guard let null = algorithm.read(0x05), null.atEnd, algorithm.atEnd else { return nil } }
+        guard let bits = spki.read(0x03), spki.atEnd, bits.rest.first == 0 else { return nil }
+        let key = Array(bits.rest.dropFirst())
+        var check = Der(key)
+        guard check.read(0x30) != nil, check.atEnd else { return nil }
+        return key
+    }
+}
+
+/** A DER reader over definite lengths only, which is all DER allows. */
+private struct Der {
+    private let bytes: [UInt8]
+    private var at = 0
+
+    init(_ bytes: [UInt8]) {
+        self.bytes = bytes
+    }
+
+    var atEnd: Bool { at == bytes.count }
+    var rest: [UInt8] { Array(bytes[at...]) }
+
+    /** The contents of the next element when its tag is `tag`, moving past it. */
+    mutating func read(_ tag: UInt8) -> Der? {
+        guard at + 2 <= bytes.count, bytes[at] == tag else { return nil }
+        var i = at + 1
+        var length = Int(bytes[i])
+        i += 1
+        if length & 0x80 != 0 {
+            let count = length & 0x7f
+            guard count >= 1, count <= 4, i + count <= bytes.count else { return nil }
+            length = 0
+            for _ in 0..<count {
+                length = length << 8 | Int(bytes[i])
+                i += 1
+            }
+        }
+        guard length <= bytes.count - i else { return nil }
+        let contents = Der(Array(bytes[i..<(i + length)]))
+        at = i + length
+        return contents
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseManifest.swift

@@ -0,0 +1,72 @@
+import Foundation
+
+/**
+ * A release's manifest (`releaseManifestFile` in @protobase/schema): every file by `href`, with its sha256 and size.
+ * Each href is checked as the very string the guard joins to a folder, before any file of it is read or written.
+ */
+struct ReleaseManifest {
+    static let file = "capawesome-live-update-manifest.json"
+    static let maxBytes = 4 * 1024 * 1024
+    static let maxFiles = 10_000
+    static let maxFileBytes: Int64 = 64 * 1024 * 1024
+    static let maxTotalBytes: Int64 = 256 * 1024 * 1024
+    private static let maxHref = 1024
+
+    struct Item {
+        let href: String
+        let checksum: String
+        let size: Int64
+    }
+
+    let items: [Item]
+
+    /** The manifest `bytes` hold, when they are the ones `statement` names. */
+    static func verify(_ bytes: Data, statement: ReleaseStatement) throws -> ReleaseManifest {
+        if Sha256.of(bytes) != statement.manifest { throw BundleRefused("its manifest is not the one its statement names") }
+        return try parse(bytes)
+    }
+
+    /** The manifest `bytes` hold, each href a path inside the folder that holds it. */
+    static func parse(_ bytes: Data) throws -> ReleaseManifest {
+        if bytes.count > maxBytes { throw BundleRefused("its manifest is too large") }
+        guard let entries = Json.parse(bytes) as? [Any] else { throw BundleRefused("its manifest is malformed") }
+        if entries.count > maxFiles { throw BundleRefused("its manifest lists too many files") }
+        var items: [Item] = []
+        var names: Set<String> = [folded(file), folded(ReleaseStatement.file)]
+        var total: Int64 = 0
+        for entry in entries {
+            let item = try self.item(entry)
+            // The volume may ignore case and Unicode normalization, where two such hrefs are one file.
+            if !names.insert(folded(item.href)).inserted { throw BundleRefused("its manifest lists \(item.href) twice, or a name of the updater's") }
+            total += item.size
+            if total > maxTotalBytes { throw BundleRefused("its files are too large") }
+            items.append(item)
+        }
+        return ReleaseManifest(items: items)
+    }
+
+    /** `name` as a volume that ignores case and Unicode normalization sees it. */
+    static func folded(_ name: String) -> String {
+        name.precomposedStringWithCanonicalMapping.folding(options: [.caseInsensitive], locale: nil)
+    }
+
+    private static func item(_ entry: Any) throws -> Item {
+        guard let entry = entry as? [String: Any], entry.count == 3, let href = entry["href"] as? String, let checksum = entry["checksum"] as? String else {
+            throw BundleRefused("its manifest has an entry that is not an href, checksum and size")
+        }
+        if !isRelativePath(href) { throw BundleRefused("its manifest names a file outside its folder") }
+        if !Hex.isHex(checksum, count: 64) { throw BundleRefused("its manifest names no checksum for \(href)") }
+        guard let size = Json.integer(entry["sizeInBytes"]), size >= 0, size <= maxFileBytes else { throw BundleRefused("its manifest names no size for \(href)") }
+        return Item(href: href, checksum: checksum, size: size)
+    }
+
+    // Path components joined by `/`: none empty, `.` or `..`, and no `\` or NUL, so neither an absolute path nor one
+    // that climbs, nor one another platform reads otherwise. Read as bytes, the way the file system reads it: as
+    // characters, a `/` followed by a combining mark is no `/`.
+    static func isRelativePath(_ href: String) -> Bool {
+        let bytes = Array(href.utf8)
+        if bytes.isEmpty || bytes.count > maxHref || bytes.contains(0) || bytes.contains(UInt8(ascii: "\\")) { return false }
+        let dot = UInt8(ascii: ".")
+        return bytes.split(separator: UInt8(ascii: "/"), omittingEmptySubsequences: false).allSatisfy { !$0.isEmpty && Array($0) != [dot] && Array($0) != [dot, dot] }
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseOrder.swift

@@ -0,0 +1,63 @@
+import Foundation
+
+/**
+ * Release orders, compared element by element, a missing element counting as 0, so a later server can add one without
+ * breaking binaries already shipped. Kept as text such as `1800000000000,0`.
+ */
+enum ReleaseOrder {
+    /** No order: below every release, the highest order downloaded before the app downloaded any. */
+    static let none: [Int64] = [0]
+
+    // An order the CLI or the guard writes: up to 8 elements of up to 19 digits, checked for overflow when parsed.
+    private static let text = try! NSRegularExpression(pattern: "^[0-9]{1,19}(,[0-9]{1,19}){0,7}$")
+
+    static func compare(_ a: [Int64], _ b: [Int64]) -> Int {
+        for i in 0..<max(a.count, b.count) {
+            let x = i < a.count ? a[i] : 0
+            let y = i < b.count ? b[i] : 0
+            if x != y { return x < y ? -1 : 1 }
+        }
+        return 0
+    }
+
+    /**
+     * Refuses to download a release of order `order` unless it is above the app's built-in files, `builtIn`, and not
+     * below the highest order the app downloaded, `highest`: equal to it is the same release again, which the app
+     * downloaded and may still have to set as the next bundle.
+     */
+    static func acceptDownload(_ order: [Int64], builtIn: [Int64], highest: [Int64]) throws {
+        if compare(order, builtIn) <= 0 { throw BundleRefused("it is not newer than the app's built-in files") }
+        if compare(order, highest) < 0 { throw BundleRefused("it is older than a release the app downloaded") }
+    }
+
+    /**
+     * Refuses a bundle of order `next` as the next bundle unless it is above the running one's, `current`, and the
+     * built-in files', `builtIn`, and not below the highest order the app downloaded, `highest`.
+     */
+    static func acceptNext(_ next: [Int64], current: [Int64], builtIn: [Int64], highest: [Int64]) throws {
+        if compare(next, current) <= 0 { throw BundleRefused("it is not newer than the bundle the app runs") }
+        if compare(next, builtIn) <= 0 { throw BundleRefused("it is not newer than the app's built-in files") }
+        if compare(next, highest) < 0 { throw BundleRefused("it is older than a release the app downloaded") }
+    }
+
+    static func format(_ order: [Int64]) -> String {
+        order.map(String.init).joined(separator: ",")
+    }
+
+    /** The order `text` holds, or nil when it is no order's text. */
+    static func parse(_ text: String) -> [Int64]? {
+        guard self.text.firstMatch(in: text, range: NSRange(text.startIndex..., in: text)) != nil else { return nil }
+        let parts = text.split(separator: ",").map { Int64($0) }
+        guard parts.allSatisfy({ $0 != nil }) else { return nil }
+        return parts.map { $0! }
+    }
+
+    /**
+     * The order the CLI wrote, `plugins.LiveUpdate.builtInOrder`, or nil when it is missing, malformed or no order above
+     * none, so the guard never runs with a floor of 0.
+     */
+    static func parseBuiltIn(_ text: String?) -> [Int64]? {
+        guard let text, let order = parse(text), compare(order, none) > 0 else { return nil }
+        return order
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleaseStatement.swift

@@ -0,0 +1,60 @@
+import Foundation
+
+/**
+ * A release's statement (`releaseStatementFile` in @protobase/schema): what binds its manifest to its order, the app,
+ * the binary and the shell, signed with the app's key. Only bytes the signature covers are parsed for what they say.
+ */
+struct ReleaseStatement {
+    static let file = "protobase-release.json"
+    static let maxBytes = 64 * 1024
+    private static let context = Data("protobase-mobile-release\n".utf8)
+    private static let keys: Set<String> = ["manifest", "order", "appId", "fingerprint", "shellVersion"]
+    private static let version = try! NSRegularExpression(pattern: "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$")
+    private static let maxOrder = 8
+
+    let manifest: String
+    let order: [Int64]
+    let appId: String
+    let fingerprint: String
+    let shellVersion: String
+
+    /**
+     * The statement `file` holds, when it is the one bundle `bundleId` names, the first 16 hex of the sha256 of its bytes
+     * and of `key`'s SPKI DER, as `composeRelease` derives it, and `key` signed what it says.
+     */
+    static func verify(_ file: Data, bundleId: String, key: ReleaseKey) throws -> ReleaseStatement {
+        if file.count > maxBytes { throw BundleRefused("its statement is too large") }
+        if Sha256.of(file, key.spki).prefix(16) != bundleId { throw BundleRefused("its id does not name its statement and the app's key") }
+        guard let outer = Json.parse(file) as? [String: Any], let payloadHex = outer["payload"] as? String, let signatureHex = outer["signature"] as? String else {
+            throw BundleRefused("its statement is malformed")
+        }
+        let payload = try Hex.decode(payloadHex, "its statement's payload")
+        let signature = try Hex.decode(signatureHex, "its statement's signature")
+        if !key.signed(context + payload, signature) { throw BundleRefused("its statement is not signed with the app's key") }
+        guard let fields = Json.parse(payload) as? [String: Any] else { throw BundleRefused("its statement says nothing it can read") }
+        return try parse(fields)
+    }
+
+    private static func parse(_ payload: [String: Any]) throws -> ReleaseStatement {
+        if Set(payload.keys) != keys { throw BundleRefused("its statement does not say exactly what binds it") }
+        guard let manifest = payload["manifest"] as? String, Hex.isHex(manifest, count: 64) else { throw BundleRefused("its statement names no manifest hash") }
+        guard let appId = payload["appId"] as? String, !appId.isEmpty else { throw BundleRefused("its statement names no app") }
+        guard let fingerprint = payload["fingerprint"] as? String, Hex.isHex(fingerprint, count: 16) else { throw BundleRefused("its statement names no fingerprint") }
+        guard let shellVersion = payload["shellVersion"] as? String, isVersion(shellVersion) else { throw BundleRefused("its statement names no shell version") }
+        guard let parts = payload["order"] as? [Any], (1...maxOrder).contains(parts.count) else { throw BundleRefused("its statement names no order") }
+        let order = parts.map(Json.integer)
+        guard order.allSatisfy({ ($0 ?? -1) >= 0 }) else { throw BundleRefused("its statement names no order") }
+        return ReleaseStatement(manifest: manifest, order: order.map { $0! }, appId: appId, fingerprint: fingerprint, shellVersion: shellVersion)
+    }
+
+    static func isVersion(_ text: String?) -> Bool {
+        guard let text else { return false }
+        return version.firstMatch(in: text, range: NSRange(text.startIndex..., in: text)) != nil
+    }
+
+    /** The major and minor of an x.y.z version `isVersion` accepted. */
+    static func majorMinor(_ version: String) -> (Int64, Int64) {
+        let parts = version.split(separator: ".").map { Int64($0) ?? -1 }
+        return (parts[0], parts[1])
+    }
+}

package/ios/Sources/ProtobaseMobile/Sha256.swift

@@ -0,0 +1,31 @@
+import CryptoKit
+import Foundation
+
+/** sha256 as lowercase hex, of bytes or of a file read in chunks. */
+enum Sha256 {
+    static func of(_ parts: Data...) -> String {
+        var hasher = SHA256()
+        for part in parts { hasher.update(data: part) }
+        return Hex.encode(hasher.finalize())
+    }
+
+    /** The sha256 of the regular file `path`, never read through a link. */
+    static func of(file path: String) throws -> String {
+        var hasher = Sha256Hasher()
+        try LocalFile.stream(path, (path as NSString).lastPathComponent) { hasher.update($0) }
+        return hasher.finish()
+    }
+}
+
+/** sha256 over chunks. */
+struct Sha256Hasher {
+    private var hasher = SHA256()
+
+    mutating func update(_ data: Data) {
+        hasher.update(data: data)
+    }
+
+    func finish() -> String {
+        Hex.encode(hasher.finalize())
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.57.4",
+  "version": "0.57.6",
   "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugins that keep page script away from the session and give the iOS app its bounce; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {
@@ -22,7 +22,7 @@
     "android/build.gradle",
     "icon"
   ],
-  "nativeContract": 7,
+  "nativeContract": 8,
   "capacitor": {
     "ios": {
       "src": "ios"