@rovq/react-native 0.1.0 → 0.2.0

package/ios/Engine/PackageDownloader.swift

@@ -7,7 +7,8 @@ private let requestTimeout: TimeInterval = 30
 /// hash is what makes the file trustworthy.
 public final class PackageDownloader {
     private let allowInsecureURLs: Bool
-    private let freeSpace: (URL) -> Int64
+    /// Room left in a folder. Replaced in tests.
+    let freeSpace: (URL) -> Int64
 
     /// - Parameter allowInsecureURLs: allows http:// for local development only.
     public init(
@@ -29,15 +30,23 @@ public final class PackageDownloader {
     /// good only once the whole file matches the signed hash, so a partial or wrong file can
     /// never be mistaken for a good one.
     ///
-    /// - Parameter onProgress: receives bytes received so far and the total.
+    /// - Parameters:
+    ///   - hash: the signed SHA-256 of the whole file.
+    ///   - size: the signed size of the whole file.
+    ///   - extraSpace: room needed beyond the file itself, such as for extracting it.
+    ///   - onProgress: receives bytes received so far and the total.
     func download(
         url: String,
-        manifest: VerifiedManifest,
+        hash: String,
+        size: Int64,
         target: URL,
+        extraSpace: Int64 = 0,
         onProgress: @escaping (Int64, Int64) -> Void = { _, _ in }
     ) throws {
+        let expected = Expected(hash: hash, size: size)
         do {
-            try downloadToFile(url: url, manifest: manifest, target: target, onProgress: onProgress)
+            try downloadToFile(
+                url: url, expected: expected, target: target, extraSpace: extraSpace, onProgress: onProgress)
         } catch {
             if (error as? RovqError)?.code != .downloadFailed {
                 try? FileManager.default.removeItem(at: target)
@@ -46,10 +55,17 @@ public final class PackageDownloader {
         }
     }
 
+    /// The signed facts a download must end up matching.
+    private struct Expected {
+        let hash: String
+        let size: Int64
+    }
+
     private func downloadToFile(
         url: String,
-        manifest: VerifiedManifest,
+        expected: Expected,
         target: URL,
+        extraSpace: Int64,
         onProgress: @escaping (Int64, Int64) -> Void
     ) throws {
         guard let parsed = URL(string: url), let scheme = parsed.scheme?.lowercased() else {
@@ -60,15 +76,17 @@ public final class PackageDownloader {
         }
 
         var digest = SHA256()
-        let existing = try readExisting(target: target, manifest: manifest, digest: &digest)
-        // Extracting needs room too, and its size is unknown until then, so this asks for the
-        // package twice. A package can still expand further, and extraction reports that.
-        let needed = manifest.packageSize - existing + manifest.packageSize
+        let existing = try readExisting(target: target, expected: expected, digest: &digest)
+        let needed = expected.size - existing + extraSpace
         if freeSpace(target.deletingLastPathComponent()) < needed {
             throw RovqError(.storageFailed, "Not enough free space for this update")
         }
-        if existing == manifest.packageSize {
-            try verifyHash(digest, manifest: manifest)
+        if existing == expected.size {
+            // An empty file has nothing to download, but must still exist.
+            if existing == 0, !FileManager.default.createFile(atPath: target.path, contents: nil) {
+                throw RovqError(.storageFailed, "Could not create the file")
+            }
+            try verifyHash(digest, expected: expected)
             return
         }
         if existing == 0, !FileManager.default.createFile(atPath: target.path, contents: nil) {
@@ -80,7 +98,7 @@ public final class PackageDownloader {
         defer { try? output.close() }
 
         let delegate = DownloadDelegate(
-            expectedSize: manifest.packageSize,
+            expectedSize: expected.size,
             existing: existing,
             digest: digest,
             output: output,
@@ -106,19 +124,19 @@ public final class PackageDownloader {
         }
         // A lost connection can look like a normal end of file, so a short download counts as
         // a network failure, which is worth retrying.
-        if delegate.received < manifest.packageSize {
+        if delegate.received < expected.size {
             throw RovqError(.downloadFailed, "The download ended early")
         }
-        try verifyHash(delegate.digest, manifest: manifest)
+        try verifyHash(delegate.digest, expected: expected)
     }
 
     /// Returns how many bytes are already there, after adding them to `digest`.
-    private func readExisting(target: URL, manifest: VerifiedManifest, digest: inout SHA256) throws -> Int64 {
+    private func readExisting(target: URL, expected: Expected, digest: inout SHA256) throws -> Int64 {
         let files = FileManager.default
         guard files.fileExists(atPath: target.path),
             let size = (try? files.attributesOfItem(atPath: target.path))?[.size] as? Int64
         else { return 0 }
-        if size > manifest.packageSize {
+        if size > expected.size {
             try? files.removeItem(at: target)
             return 0
         }
@@ -130,9 +148,9 @@ public final class PackageDownloader {
         return size
     }
 
-    private func verifyHash(_ digest: SHA256, manifest: VerifiedManifest) throws {
+    private func verifyHash(_ digest: SHA256, expected: Expected) throws {
         let hash = digest.finalize().map { String(format: "%02x", $0) }.joined()
-        if hash != manifest.packageHash {
+        if hash != expected.hash {
             throw RovqError(.hashMismatch, "Download does not match the signed hash")
         }
     }

package/ios/Engine/RovqEngine.swift

@@ -25,6 +25,9 @@ public struct EngineConfig {
     /// Key IDs and their Base64 public keys, built into the app.
     public let trustedKeys: [String: String]
     public let allowInsecureURLs: Bool
+    /// The app bundle. A release made of files reuses the assets in it instead of downloading
+    /// them again.
+    public let builtInFolder: URL?
 
     public init(
         apiURL: String,
@@ -33,7 +36,8 @@ public struct EngineConfig {
         binaryVersion: String,
         binaryId: String,
         trustedKeys: [String: String],
-        allowInsecureURLs: Bool = false
+        allowInsecureURLs: Bool = false,
+        builtInFolder: URL? = nil
     ) {
         self.apiURL = apiURL
         self.deploymentKey = deploymentKey
@@ -42,6 +46,7 @@ public struct EngineConfig {
         self.binaryId = binaryId
         self.trustedKeys = trustedKeys
         self.allowInsecureURLs = allowInsecureURLs
+        self.builtInFolder = builtInFolder
     }
 }
 
@@ -133,7 +138,8 @@ public final class RovqEngine {
         installer = UpdateInstaller(
             rootFolder: rootFolder,
             verifier: verifier,
-            downloader: PackageDownloader(allowInsecureURLs: config.allowInsecureURLs)
+            downloader: PackageDownloader(allowInsecureURLs: config.allowInsecureURLs),
+            builtInFolder: config.builtInFolder
         )
         try? FileManager.default.createDirectory(at: rootFolder, withIntermediateDirectories: true)
         RovqEngine.excludeFromBackup(rootFolder)
@@ -445,8 +451,15 @@ public final class RovqEngine {
             }
         }
         do {
+            let deviceId = status().deviceId
             let installed = try installer.install(
-                offer: offered, highestSequence: highestSequence, onProgress: onProgress)
+                offer: offered,
+                highestSequence: highestSequence,
+                fileLinks: { [service, config] releaseId, hashes in
+                    try service.fileLinks(
+                        deploymentKey: config.deploymentKey, deviceId: deviceId, releaseId: releaseId, hashes: hashes)
+                },
+                onProgress: onProgress)
             let manifest = installed.manifest
             lock.lock()
             defer { lock.unlock() }

package/ios/Engine/UpdateInstaller.swift

@@ -1,13 +1,19 @@
+import CryptoKit
 import Foundation
 
+// Download links last an hour, so they are fetched a few files at a time, just before use.
+private let linkBatchSize = 20
+private let emptyFileHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+
 /// What the server offered. None of this is trusted until the manifest has been verified.
 public struct OfferedUpdate: Equatable {
     public let manifest: String
     public let signature: String
     public let keyId: String
-    public let downloadURL: String
+    /// Only for a ZIP package. A release made of files is fetched file by file.
+    public let downloadURL: String?
 
-    public init(manifest: String, signature: String, keyId: String, downloadURL: String) {
+    public init(manifest: String, signature: String, keyId: String, downloadURL: String?) {
         self.manifest = manifest
         self.signature = signature
         self.keyId = keyId
@@ -22,6 +28,9 @@ public struct InstalledRelease: Equatable {
     public let bundleFile: URL
 }
 
+/// Asks the server for download links, by hash, for files of one release.
+public typealias FileLinks = (_ releaseId: String, _ hashes: [String]) throws -> [String: String]
+
 /// Takes an offered update to a verified folder on disk, without activating it.
 ///
 /// Each release gets its own folder, which keeps the design the same as Android, and makes
@@ -31,25 +40,38 @@ public final class UpdateInstaller {
     private let workFolder: URL
     // Outside the work folder, because a partial download must survive a failure or a restart.
     private let partialFolder: URL
+    /// The app's own files, where assets sit at the same paths as in a package.
+    private let builtInFolder: URL?
     private let verifier: ManifestVerifier
     private let downloader: PackageDownloader
     private let extractor = SafePackageExtractor()
     private let lock = NSLock()
 
-    /// - Parameter rootFolder: a folder only the engine uses, inside the app's private storage.
-    public init(rootFolder: URL, verifier: ManifestVerifier, downloader: PackageDownloader) {
+    /// - Parameters:
+    ///   - rootFolder: a folder only the engine uses, inside the app's private storage.
+    ///   - builtInFolder: the app bundle, whose files can be reused instead of downloaded.
+    public init(
+        rootFolder: URL,
+        verifier: ManifestVerifier,
+        downloader: PackageDownloader,
+        builtInFolder: URL? = nil
+    ) {
         updatesFolder = rootFolder.appendingPathComponent("updates")
         workFolder = rootFolder.appendingPathComponent("work")
         partialFolder = rootFolder.appendingPathComponent("partial")
+        self.builtInFolder = builtInFolder
         self.verifier = verifier
         self.downloader = downloader
     }
 
-    /// - Parameter highestSequence: the highest sequence this device has accepted in this stream.
+    /// - Parameters:
+    ///   - highestSequence: the highest sequence this device has accepted in this stream.
+    ///   - fileLinks: download links for a release made of files.
     /// - Throws: `RovqError` if any step fails. Nothing is left behind in that case.
     public func install(
         offer: OfferedUpdate,
         highestSequence: Int64,
+        fileLinks: FileLinks = { _, _ in throw RovqError(.downloadFailed, "No way to fetch files") },
         onProgress: @escaping (Int64, Int64) -> Void = { _, _ in }
     ) throws -> InstalledRelease {
         lock.lock()
@@ -67,7 +89,13 @@ public final class UpdateInstaller {
         // Folders appear only through the atomic rename below, so one that exists is complete.
         var isFolder: ObjCBool = false
         if !FileManager.default.fileExists(atPath: folder.path, isDirectory: &isFolder) || !isFolder.boolValue {
-            try installFiles(offer: offer, manifest: manifest, folder: folder, onProgress: onProgress)
+            if let files = manifest.files {
+                try installFileList(
+                    files, releaseId: manifest.releaseId, folder: folder, fileLinks: fileLinks,
+                    onProgress: onProgress)
+            } else {
+                try installZip(offer: offer, manifest: manifest, folder: folder, onProgress: onProgress)
+            }
         }
         return InstalledRelease(
             manifest: manifest,
@@ -76,51 +104,245 @@ public final class UpdateInstaller {
         )
     }
 
-    private func installFiles(
-        offer: OfferedUpdate,
-        manifest: VerifiedManifest,
-        folder: URL,
-        onProgress: @escaping (Int64, Int64) -> Void
-    ) throws {
+    /// Creates an empty work folder for assembling a release, and the folders around it.
+    private func startWork() throws -> URL {
         let files = FileManager.default
         // Removes anything an earlier run left when the app was killed or the phone lost power.
         try? files.removeItem(at: workFolder)
-        let extracted = workFolder.appendingPathComponent("extracted", isDirectory: true)
+        let assembled = workFolder.appendingPathComponent("extracted", isDirectory: true)
         do {
-            try files.createDirectory(at: extracted, withIntermediateDirectories: true)
+            try files.createDirectory(at: assembled, withIntermediateDirectories: true)
             try files.createDirectory(at: updatesFolder, withIntermediateDirectories: true)
             try files.createDirectory(at: partialFolder, withIntermediateDirectories: true)
         } catch {
             throw RovqError(.storageFailed, "Could not create the engine folders")
         }
-        defer { try? files.removeItem(at: workFolder) }
+        return assembled
+    }
 
-        let packageFile = partialFolder.appendingPathComponent("\(manifest.packageHash).zip")
-        // Only the current offer is worth finishing.
+    /// Only the current offer is worth finishing.
+    private func removePartialFiles(except keep: Set<String>) {
+        let files = FileManager.default
         for file in (try? files.contentsOfDirectory(at: partialFolder, includingPropertiesForKeys: nil)) ?? []
-        where file.lastPathComponent != packageFile.lastPathComponent {
+        where !keep.contains(file.lastPathComponent) {
             try? files.removeItem(at: file)
         }
+    }
+
+    private func moveIntoPlace(_ assembled: URL, _ folder: URL) throws {
+        do {
+            try FileManager.default.moveItem(at: assembled, to: folder)
+        } catch {
+            throw RovqError(.storageFailed, "Could not move the release into place")
+        }
+    }
+
+    private func installZip(
+        offer: OfferedUpdate,
+        manifest: VerifiedManifest,
+        folder: URL,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        guard let downloadURL = offer.downloadURL else {
+            throw RovqError(.downloadFailed, "The server sent no download URL")
+        }
+        let extracted = try startWork()
+        defer { try? FileManager.default.removeItem(at: workFolder) }
+
+        let packageFile = partialFolder.appendingPathComponent("\(manifest.packageHash).zip")
+        removePartialFiles(except: [packageFile.lastPathComponent])
         do {
+            // Extracting needs room too, and its size is unknown until then, so this asks for
+            // the package twice. A package can still expand further, and extraction reports that.
             try downloader.download(
-                url: offer.downloadURL,
-                manifest: manifest,
+                url: downloadURL,
+                hash: manifest.packageHash,
+                size: manifest.packageSize,
                 target: packageFile,
+                extraSpace: manifest.packageSize,
                 onProgress: onProgress
             )
             try extractor.extract(packageFile: packageFile, destination: extracted)
-            do {
-                try files.moveItem(at: extracted, to: folder)
-            } catch {
-                throw RovqError(.storageFailed, "Could not move the release into place")
-            }
-            try? files.removeItem(at: packageFile)
+            try moveIntoPlace(extracted, folder)
+            try? FileManager.default.removeItem(at: packageFile)
         } catch {
             // A file that failed anything but the network is not worth continuing from.
             if (error as? RovqError)?.code != .downloadFailed {
-                try? files.removeItem(at: packageFile)
+                try? FileManager.default.removeItem(at: packageFile)
             }
             throw error
         }
     }
+
+    /// Builds a release from its files: each comes from a kept release, from the app itself,
+    /// or from the network, in that order, and only after its content matches the signed hash.
+    /// See docs/file-packages.md.
+    private func installFileList(
+        _ list: [ManifestFile],
+        releaseId: String,
+        folder: URL,
+        fileLinks: FileLinks,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        let files = FileManager.default
+        let assembled = try startWork()
+        defer { try? files.removeItem(at: workFolder) }
+        removePartialFiles(except: Set(list.map(\.hash)))
+        let root = assembled.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+
+        // A hash already placed, so the same content at another path is linked, not fetched.
+        var placed: [String: URL] = [:]
+        // Files with no local copy at their own path. Another path may still provide them.
+        var unresolved: [(file: ManifestFile, target: URL)] = []
+
+        for file in list {
+            let target = assembled.appendingPathComponent(file.path)
+            let parent = target.deletingLastPathComponent()
+            do {
+                try files.createDirectory(at: parent, withIntermediateDirectories: true)
+            } catch {
+                throw RovqError(.storageFailed, "Could not create a folder")
+            }
+            // A second, independent check: whatever the rules allow, the real path must stay
+            // inside the folder.
+            let resolved = parent.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+            if !resolved.hasPrefix(root) {
+                throw RovqError(.invalidPackage, "The file \(file.path) leaves the folder")
+            }
+
+            if let source = placed[file.hash] {
+                try link(source, to: target)
+            } else if file.size == 0 {
+                guard file.hash == emptyFileHash else {
+                    throw RovqError(.hashMismatch, "An empty file does not match its signed hash")
+                }
+                guard files.createFile(atPath: target.path, contents: nil) else {
+                    throw RovqError(.storageFailed, "Could not create the file")
+                }
+                placed[file.hash] = target
+            } else if let local = findLocalCopy(of: file, excluding: folder) {
+                if local.isOwn {
+                    try link(local.url, to: target)
+                } else {
+                    // On APFS a copy shares the blocks until either side changes, so it is free.
+                    try copy(local.url, to: target)
+                }
+                placed[file.hash] = target
+            } else {
+                unresolved.append((file, target))
+            }
+        }
+
+        // Files to download, by hash, with every path that needs each one, in manifest order.
+        var targets: [String: [URL]] = [:]
+        var missing: [ManifestFile] = []
+        for (file, target) in unresolved {
+            if let source = placed[file.hash] {
+                try link(source, to: target)
+            } else if targets[file.hash] != nil {
+                targets[file.hash]!.append(target)
+            } else {
+                targets[file.hash] = [target]
+                missing.append(file)
+            }
+        }
+
+        try download(missing, targets: targets, releaseId: releaseId, fileLinks: fileLinks, onProgress: onProgress)
+
+        try moveIntoPlace(assembled, folder)
+        // Linked into the release, so the content stays where it is needed.
+        for file in missing {
+            try? files.removeItem(at: partialFolder.appendingPathComponent(file.hash))
+        }
+    }
+
+    private func download(
+        _ missing: [ManifestFile],
+        targets: [String: [URL]],
+        releaseId: String,
+        fileLinks: FileLinks,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        if missing.isEmpty { return }
+        let total = missing.reduce(Int64(0)) { $0 + $1.size }
+        // Checked for the whole release first, so a full disk fails before any download.
+        var remaining: Int64 = 0
+        for file in missing {
+            let partial = partialFolder.appendingPathComponent(file.hash)
+            remaining += file.size - min(fileSize(partial) ?? 0, file.size)
+        }
+        if downloader.freeSpace(partialFolder) < remaining {
+            throw RovqError(.storageFailed, "Not enough free space for this update")
+        }
+
+        var finished: Int64 = 0
+        onProgress(0, total)
+        for start in stride(from: 0, to: missing.count, by: linkBatchSize) {
+            let batch = Array(missing[start..<min(start + linkBatchSize, missing.count)])
+            let links = try fileLinks(releaseId, batch.map(\.hash))
+            for file in batch {
+                guard let url = links[file.hash] else {
+                    throw RovqError(.downloadFailed, "The server sent no link for a file")
+                }
+                let partial = partialFolder.appendingPathComponent(file.hash)
+                let before = finished
+                try downloader.download(url: url, hash: file.hash, size: file.size, target: partial) {
+                    received, _ in onProgress(before + received, total)
+                }
+                finished += file.size
+                for target in targets[file.hash] ?? [] { try link(partial, to: target) }
+            }
+        }
+    }
+
+    /// The same path in a kept release, or in the app itself, if its content is the signed one.
+    /// Hashed every time, because reusing a damaged file would break the new release.
+    private func findLocalCopy(of file: ManifestFile, excluding folder: URL) -> (url: URL, isOwn: Bool)? {
+        let releases =
+            (try? FileManager.default.contentsOfDirectory(at: updatesFolder, includingPropertiesForKeys: nil)) ?? []
+        var candidates = releases
+            .filter { $0.lastPathComponent != folder.lastPathComponent }
+            .map { ($0.appendingPathComponent(file.path), true) }
+        if let builtIn = builtInFolder {
+            candidates.append((builtIn.appendingPathComponent(file.path), false))
+        }
+        for (url, isOwn) in candidates where fileSize(url) == file.size && hashOf(url) == file.hash {
+            return (url, isOwn)
+        }
+        return nil
+    }
+
+    private func fileSize(_ url: URL) -> Int64? {
+        guard let attributes = try? FileManager.default.attributesOfItem(atPath: url.path),
+            attributes[.type] as? FileAttributeType == .typeRegular
+        else { return nil }
+        return (attributes[.size] as? NSNumber)?.int64Value
+    }
+
+    private func hashOf(_ url: URL) -> String? {
+        guard let input = try? FileHandle(forReadingFrom: url) else { return nil }
+        defer { try? input.close() }
+        var digest = SHA256()
+        while let chunk = try? input.read(upToCount: 1024 * 1024), !chunk.isEmpty {
+            digest.update(data: chunk)
+        }
+        return digest.finalize().map { String(format: "%02x", $0) }.joined()
+    }
+
+    /// A hard link costs no space. Files in a release never change, so sharing them is safe.
+    private func link(_ source: URL, to target: URL) throws {
+        do {
+            try FileManager.default.linkItem(at: source, to: target)
+        } catch {
+            try copy(source, to: target)
+        }
+    }
+
+    private func copy(_ source: URL, to target: URL) throws {
+        do {
+            try FileManager.default.copyItem(at: source, to: target)
+        } catch {
+            throw RovqError(.storageFailed, "Could not place a file")
+        }
+    }
 }

package/ios/Engine/UpdateService.swift

@@ -43,6 +43,13 @@ public protocol UpdateService {
 
     /// - Throws: if the events could not be delivered.
     func report(deploymentKey: String, deviceId: String, events: [QueuedEvent]) throws
+
+    /// Download links for files of a release made of files, by hash. Each file is checked
+    /// against the signed manifest, so the links are trusted for nothing.
+    ///
+    /// - Throws: if the server cannot be reached or answers with an error.
+    func fileLinks(deploymentKey: String, deviceId: String, releaseId: String, hashes: [String]) throws
+        -> [String: String]
 }
 
 public final class HTTPUpdateService: UpdateService {
@@ -62,6 +69,8 @@ public final class HTTPUpdateService: UpdateService {
             "runtimeVersion": request.runtimeVersion,
             "binaryVersion": request.binaryVersion,
             "highestSequence": request.highestSequence,
+            // Both a ZIP package and a list of files. See docs/file-packages.md.
+            "packageFormats": [1, 2],
         ]
         if let current = request.currentReleaseId { body["currentReleaseId"] = current }
 
@@ -73,12 +82,13 @@ public final class HTTPUpdateService: UpdateService {
         case "ROLLBACK":
             return CheckAnswer(response: .rollback, revocations: revocations)
         case "UPDATE":
+            // A release made of files has no single download URL.
             guard let update = response["update"] as? [String: Any],
                 let manifest = update["manifest"] as? String,
                 let signature = update["signature"] as? String,
-                let keyId = update["keyId"] as? String,
-                let downloadURL = update["downloadUrl"] as? String
+                let keyId = update["keyId"] as? String
             else { throw RovqError(.downloadFailed, "The server sent an unreadable response") }
+            let downloadURL = update["downloadUrl"] as? String
             return CheckAnswer(
                 response: .update(
                     OfferedUpdate(manifest: manifest, signature: signature, keyId: keyId, downloadURL: downloadURL)),
@@ -117,6 +127,23 @@ public final class HTTPUpdateService: UpdateService {
         )
     }
 
+    public func fileLinks(deploymentKey: String, deviceId: String, releaseId: String, hashes: [String]) throws
+        -> [String: String]
+    {
+        let response = try post(
+            "/device/updates/files",
+            body: ["deploymentKey": deploymentKey, "deviceId": deviceId, "releaseId": releaseId, "hashes": hashes]
+        )
+        guard let files = response["files"] as? [[String: Any]] else {
+            throw RovqError(.downloadFailed, "The server sent an unreadable response")
+        }
+        var links: [String: String] = [:]
+        for file in files {
+            if let hash = file["hash"] as? String, let url = file["url"] as? String { links[hash] = url }
+        }
+        return links
+    }
+
     /// Blocks until finished, so call it away from the main thread.
     private func post(_ path: String, body: [String: Any]) throws -> [String: Any] {
         let base = apiURL.hasSuffix("/") ? String(apiURL.dropLast()) : apiURL

package/ios/React/RovqHost.swift

@@ -54,7 +54,9 @@ public final class RovqHost: NSObject {
                     binaryVersion: info["CFBundleShortVersionString"] as? String ?? "0",
                     binaryId: binaryId(info),
                     trustedKeys: config.trustedKeys,
-                    allowInsecureURLs: config.allowInsecureURLs
+                    allowInsecureURLs: config.allowInsecureURLs,
+                    // react-native bundle puts assets at the same paths a package uses.
+                    builtInFolder: Bundle.main.bundleURL
                 )
             )
             watchForBackground()

package/ios/React/RovqModule.mm

@@ -69,7 +69,9 @@ RCT_EXPORT_MODULE(Rovq)
 
 - (void)restartApp
 {
-  RCTExecuteOnMainQueue(^{
+  // Always later, never at once: RCTExecuteOnMainQueue runs immediately when already on the main
+  // thread, which reloads JavaScript while it is still inside this call.
+  dispatch_async(dispatch_get_main_queue(), ^{
     RCTTriggerReloadCommandListeners(@"ROVQ restart");
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rovq/react-native",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Over-the-air updates for React Native, with signed releases and automatic rollback",
   "keywords": [
     "react-native",
@@ -34,11 +34,15 @@
     "LICENSE"
   ],
   "peerDependencies": {
+    "react": "*",
     "react-native": ">=0.82"
   },
   "peerDependenciesMeta": {
     "react-native": {
       "optional": true
+    },
+    "react": {
+      "optional": true
     }
   },
   "codegenConfig": {