@shipvo/capacitor 0.0.2 → 0.0.4

package/Package.swift

@@ -0,0 +1,19 @@
+// swift-tools-version:5.9
+// Entry point for Capacitor's Swift Package Manager integration (`cap sync ios` links this package).
+// The sources live in ios/Sources; ios/Package.swift runs the same ShipvoBundle target's tests.
+import PackageDescription
+
+let package = Package(
+  name: "ShipvoCapacitor",
+  platforms: [.iOS(.v15)],
+  products: [.library(name: "ShipvoCapacitor", targets: ["ShipvoCapacitor"])],
+  dependencies: [.package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0")],
+  targets: [
+    .target(name: "ShipvoBundle", path: "ios/Sources/ShipvoBundle"),
+    .target(
+      name: "ShipvoCapacitor",
+      dependencies: [.product(name: "Capacitor", package: "capacitor-swift-pm"), "ShipvoBundle"],
+      path: "ios/Sources/ShipvoCapacitor"
+    ),
+  ]
+)

package/android/build.gradle

@@ -14,5 +14,7 @@ android {
 
 dependencies {
     implementation project(':capacitor-android')
+    // bzip2 for the BSDIFF40 patch step; the same version packages/runtime uses.
+    implementation 'org.apache.commons:commons-compress:1.21'
     testImplementation "junit:junit:4.13.2"
 }

package/android/src/main/java/dev/shipvo/capacitor/BundleStore.java

@@ -57,6 +57,18 @@ public final class BundleStore {
         for (int n; (n = in.read(buf)) > 0; ) out.write(buf, 0, n);
     }
 
+    /**
+     * Builds `name` from the stored `baseName` and a patch. Writes the file only when the patch, the
+     * rebuilt size and the rebuilt hash all check out; otherwise the caller downloads the full bundle.
+     */
+    public PatchStep.Outcome patch(String baseName, byte[] patch, String patchSha256, String name, long newSize, String newSha256, long maxMemory) {
+        byte[] base = null;
+        try { if (file(baseName).length() <= maxMemory) base = read(baseName); } catch (IOException | OutOfMemoryError e) { base = null; }
+        PatchStep.Outcome o = PatchStep.run(base, patch, patchSha256, newSize, newSha256, maxMemory);
+        if (o.bytes == null) return o;
+        try { write(name, o.bytes); return o; } catch (IOException e) { return new PatchStep.Outcome("full", null, e.getMessage()); }
+    }
+
     public void remove(String name) throws IOException { file(name).delete(); }
 
     public List<String> list() {

package/android/src/main/java/dev/shipvo/capacitor/Patch.java

@@ -0,0 +1,55 @@
+package dev.shipvo.capacitor;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import org.apache.commons.compress.compressors.bzip2.BZip2CompressorInputStream;
+
+/** bspatch for the BSDIFF40 format (bsdiff 4.x): header, then bzip2 control, diff and extra blocks. Copied in small form from packages/runtime. */
+final class Patch {
+    private Patch() {}
+
+    private static long offtin(byte[] b, int o) {
+        long y = b[o + 7] & 0x7F;
+        for (int i = 6; i >= 0; i--) y = (y << 8) | (b[o + i] & 0xFF);
+        return (b[o + 7] & 0x80) != 0 ? -y : y;
+    }
+
+    private static void readFully(InputStream in, byte[] buf, int off, int len) throws IOException {
+        int n = 0;
+        while (n < len) {
+            int r = in.read(buf, off + n, len - n);
+            if (r <= 0) throw new IOException("patch truncated");
+            n += r;
+        }
+    }
+
+    static byte[] apply(byte[] old, byte[] patch) throws IOException {
+        if (patch.length < 32 || !"BSDIFF40".equals(new String(patch, 0, 8, StandardCharsets.US_ASCII))) throw new IOException("not a BSDIFF40 patch");
+        long ctrlLen = offtin(patch, 8), diffLen = offtin(patch, 16), newSize = offtin(patch, 24);
+        if (ctrlLen < 0 || diffLen < 0 || newSize < 0 || newSize > (64L << 20) || 32 + ctrlLen + diffLen > patch.length) throw new IOException("bad patch header");
+        int extraStart = (int) (32 + ctrlLen + diffLen);
+        byte[] out = new byte[(int) newSize];
+        try (InputStream ctrl = new BZip2CompressorInputStream(new ByteArrayInputStream(patch, 32, (int) ctrlLen));
+             InputStream diff = new BZip2CompressorInputStream(new ByteArrayInputStream(patch, 32 + (int) ctrlLen, (int) diffLen));
+             InputStream extra = new BZip2CompressorInputStream(new ByteArrayInputStream(patch, extraStart, patch.length - extraStart))) {
+            long oldPos = 0, newPos = 0;
+            byte[] c = new byte[24];
+            while (newPos < newSize) {
+                readFully(ctrl, c, 0, 24);
+                long x = offtin(c, 0), y = offtin(c, 8), z = offtin(c, 16);
+                if (x < 0 || y < 0 || newPos + x + y > newSize) throw new IOException("corrupt patch control");
+                readFully(diff, out, (int) newPos, (int) x);
+                for (int i = 0; i < x; i++) {
+                    long op = oldPos + i;
+                    if (op >= 0 && op < old.length) out[(int) newPos + i] += old[(int) op];
+                }
+                newPos += x; oldPos += x;
+                readFully(extra, out, (int) newPos, (int) y);
+                newPos += y; oldPos += z;
+            }
+        }
+        return out;
+    }
+}

package/android/src/main/java/dev/shipvo/capacitor/PatchStep.java

@@ -0,0 +1,35 @@
+package dev.shipvo.capacitor;
+
+/**
+ * Rule 9 on Android: apply a patch to the stored base bundle, check it, and say whether the
+ * caller may use the result. Anything else means "download the full bundle".
+ */
+public final class PatchStep {
+    private PatchStep() {}
+
+    /** Share of the app's heap limit that base + patch + output may use together. */
+    public static final double BUDGET_FRACTION = 0.4;
+    public static final String OUT_OF_MEMORY = "out_of_memory";
+    public static final String OVER_BUDGET = "over_memory_budget";
+
+    /** `bytes` is the rebuilt bundle when `via` is "patch"; otherwise `patchError` says why the full bundle is needed. */
+    public static final class Outcome {
+        public final String via; public final byte[] bytes; public final String patchError;
+        Outcome(String via, byte[] bytes, String patchError) { this.via = via; this.bytes = bytes; this.patchError = patchError; }
+    }
+
+    public static boolean fits(long base, long patch, long out, long maxMemory) {
+        return base + patch + out <= (long) (maxMemory * BUDGET_FRACTION);
+    }
+
+    public static Outcome run(byte[] base, byte[] patch, String patchSha256, long newSize, String newSha256, long maxMemory) {
+        if (base == null || !fits(base.length, patch.length, newSize, maxMemory)) return new Outcome("full", null, OVER_BUDGET);
+        try {
+            if (!BundleStore.sha256Hex(patch).equalsIgnoreCase(patchSha256)) throw new IllegalStateException("patch hash mismatch");
+            byte[] out = Patch.apply(base, patch);
+            if (out.length != newSize || !BundleStore.sha256Hex(out).equalsIgnoreCase(newSha256)) throw new IllegalStateException("patched bundle hash mismatch");
+            return new Outcome("patch", out, null);
+        } catch (OutOfMemoryError e) { return new Outcome("full", null, OUT_OF_MEMORY); }
+        catch (Exception e) { return new Outcome("full", null, String.valueOf(e.getMessage())); }
+    }
+}

package/android/src/main/java/dev/shipvo/capacitor/ShipvoPlugin.java

@@ -57,6 +57,20 @@ public class ShipvoPlugin extends Plugin {
         } catch (Exception e) { call.reject(e.getMessage()); }
     }
 
+    /** Rule 9: build `name` from the stored `base` and a patch. Resolves `via` "patch", or "full" with `patchError`. */
+    @PluginMethod
+    public void filePatch(PluginCall call) {
+        try {
+            byte[] patch = Base64.decode(call.getString("patch", ""), Base64.NO_WRAP);
+            PatchStep.Outcome o = store().patch(call.getString("base"), patch, call.getString("patchSha256"), call.getString("name"),
+                call.getLong("size", -1L), call.getString("sha256"), Runtime.getRuntime().maxMemory());
+            JSObject r = new JSObject();
+            r.put("via", o.via);
+            if (o.patchError != null) r.put("patchError", o.patchError);
+            call.resolve(r);
+        } catch (Exception e) { call.reject(e.getMessage()); }
+    }
+
     @PluginMethod
     public void fileRead(PluginCall call) {
         try {

package/dist/engine.js

@@ -170,28 +170,57 @@ export class ShipvoCapacitor {
             return { status: "none", release: p.release };
         const t1 = this.now();
         let bytes;
-        try {
-            const url = new URL(p.core.url, this.c.baseUrl.replace(/\/?$/, "/")).toString();
-            const r = await f(url);
-            if (!r.ok)
-                throw new Error(`HTTP ${r.status}`);
-            bytes = new Uint8Array(await r.arrayBuffer());
+        // Rule 9: a patch only when its from_sha256 is the hash of the bundle this device runs (the current release).
+        let via = "full";
+        let patchError;
+        let patchedBytes = 0;
+        const baseSha = s.current ? s.hashes[String(s.current)] : undefined;
+        const chosen = baseSha && this.c.files.patch ? p.core.patches?.find((x) => x.from_sha256 === baseSha) : undefined;
+        if (chosen && this.c.files.patch) {
+            try {
+                const r = await f(new URL(chosen.url, this.c.baseUrl.replace(/\/?$/, "/")).toString());
+                if (!r.ok)
+                    throw new Error(`patch HTTP ${r.status}`);
+                const patch = new Uint8Array(await r.arrayBuffer());
+                if (patch.byteLength !== chosen.size)
+                    throw new Error("patch size mismatch");
+                const o = await this.c.files.patch({ base: bundleName(s.current), patch, patchSha256: chosen.sha256, name: bundleName(p.release), size: p.core.size, sha256: p.core.sha256 });
+                via = o.via;
+                patchError = o.patchError;
+                if (o.via === "patch")
+                    patchedBytes = patch.byteLength;
+            }
+            catch (e) {
+                patchError = String(e?.message ?? e);
+            }
         }
-        catch (e) {
-            this.push(s, "download_failed");
-            await this.save();
-            return { status: "error", release: p.release, error: String(e?.message ?? e) };
+        if (via === "patch") {
+            bytes = new Uint8Array(0);
         }
+        else
+            try {
+                const url = new URL(p.core.url, this.c.baseUrl.replace(/\/?$/, "/")).toString();
+                const r = await f(url);
+                if (!r.ok)
+                    throw new Error(`HTTP ${r.status}`);
+                bytes = new Uint8Array(await r.arrayBuffer());
+            }
+            catch (e) {
+                this.push(s, "download_failed");
+                await this.save();
+                return { status: "error", release: p.release, error: String(e?.message ?? e) };
+            }
         const t2 = this.now();
-        // Size and sha-256 against the signed pointer.
-        if (bytes.byteLength !== p.core.size || (await sha256Hex(bytes)) !== p.core.sha256) {
+        // Size and sha-256 against the signed pointer. A patched bundle was already checked natively.
+        if (via === "full" && (bytes.byteLength !== p.core.size || (await sha256Hex(bytes)) !== p.core.sha256)) {
             this.block(s, p.release);
             return this.reject(s, "verify_failed", "bundle size or sha-256 does not match", p.release);
         }
         const t3 = this.now();
         // Stage: write the file, then point `pending` at it. A replaced pending release is dropped.
         const old = s.pending;
-        await this.c.files.write(bundleName(p.release), bytes);
+        if (via === "full")
+            await this.c.files.write(bundleName(p.release), bytes);
         s.hashes[String(p.release)] = p.core.sha256;
         s.pending = p.release;
         s.pendingBoots = 0;
@@ -200,7 +229,7 @@ export class ShipvoCapacitor {
         await this.save();
         if (apply)
             await this.reload();
-        return { status: "staged", release: p.release, bytes: bytes.byteLength, downloadMs: t2 - t1, verifyMs: t3 - t2, issuedAt: p.issued_at };
+        return { status: "staged", release: p.release, bytes: via === "patch" ? patchedBytes : bytes.byteLength, via, ...(patchError ? { patchError } : {}), downloadMs: t2 - t1, verifyMs: t3 - t2, issuedAt: p.issued_at };
     }
     push(s, e) { if (!s.events.includes(e) || !e.startsWith("pointer_rejected"))
         s.events.push(e); }

package/dist/index.d.ts

@@ -4,4 +4,4 @@ export type { ShipvoConfig } from "./engine.js";
 export { MemoryStore, MemoryFiles } from "./memory.js";
 export { verifyEd25519, sha256Hex, semverLess } from "./verify.js";
 export { NativeStore, NativeFiles, bootAndServe, bootAndSwitch } from "./native.js";
-export type { ShipvoNativePlugin } from "./native.js";
+export type { ShipvoNativePlugin, ShipvoPatchPlugin } from "./native.js";

package/dist/native.d.ts

@@ -37,6 +37,20 @@ export interface ShipvoNativePlugin {
         serving?: string;
     }>;
 }
+/** Build a stored bundle from another stored bundle and a BSDIFF40 patch. Native checks the patch hash, the rebuilt size and hash, and the memory budget. */
+export interface ShipvoPatchPlugin {
+    filePatch(o: {
+        base: string;
+        name: string;
+        patch: string;
+        patchSha256: string;
+        size: number;
+        sha256: string;
+    }): Promise<{
+        via: "patch" | "full";
+        patchError?: string;
+    }>;
+}
 /** `KeyValueStore` backed by the native plugin (SharedPreferences on Android). */
 export declare class NativeStore implements KeyValueStore {
     private n;
@@ -47,7 +61,9 @@ export declare class NativeStore implements KeyValueStore {
 /** `BundleFiles` backed by the native plugin (the app-private files directory on Android). */
 export declare class NativeFiles implements BundleFiles {
     private n;
-    constructor(n: ShipvoNativePlugin);
+    /** Set only when the plugin has `filePatch`, so the core tries a patch only where one can be applied. */
+    patch?: BundleFiles["patch"];
+    constructor(n: ShipvoNativePlugin & Partial<ShipvoPatchPlugin>);
     write(name: string, bytes: Uint8Array): Promise<void>;
     read(name: string): Promise<Uint8Array<ArrayBuffer>>;
     remove(name: string): Promise<void>;

package/dist/native.js

@@ -13,8 +13,12 @@ export class NativeStore {
 /** `BundleFiles` backed by the native plugin (the app-private files directory on Android). */
 export class NativeFiles {
     n;
+    /** Set only when the plugin has `filePatch`, so the core tries a patch only where one can be applied. */
+    patch;
     constructor(n) {
         this.n = n;
+        if (n.filePatch)
+            this.patch = (o) => n.filePatch({ base: o.base, name: o.name, patch: toB64(o.patch), patchSha256: o.patchSha256, size: o.size, sha256: o.sha256 });
     }
     async write(name, bytes) { await this.n.fileWrite({ name, data: toB64(bytes) }); }
     async read(name) { return fromB64((await this.n.fileRead({ name })).data); }

package/dist/types.d.ts

@@ -21,6 +21,9 @@ export type CheckResult = {
     verifyMs?: number;
     issuedAt?: string;
     error?: string;
+    /** How the bundle arrived: a patch against the current bundle, or the full file. `patchError` says why a patch was not used. */
+    via?: "patch" | "full";
+    patchError?: string;
     reason?: "hermes_bytecode_mismatch" | "native_module_missing" | "native_module_version";
 };
 export type HealthyResult = {
@@ -52,6 +55,21 @@ export interface KeyValueStore {
 export interface BundleFiles {
     write(name: string, bytes: Uint8Array): Promise<void>;
     remove(name: string): Promise<void>;
+    /**
+     * Optional. Build `name` from the stored `base` file and a patch (rule 9). Native checks the patch hash,
+     * then the rebuilt size and hash, and writes `name` only on success; otherwise it reports `via: "full"`.
+     */
+    patch?(o: {
+        base: string;
+        patch: Uint8Array;
+        patchSha256: string;
+        name: string;
+        size: number;
+        sha256: string;
+    }): Promise<{
+        via: "patch" | "full";
+        patchError?: string;
+    }>;
     /** Remove every file. Used when a new shell is installed. */
     clear(): Promise<void>;
 }

package/ios/Sources/ShipvoBundle/Bundle.swift

@@ -0,0 +1,71 @@
+#if canImport(CryptoKit)
+import CryptoKit
+#else
+import Crypto
+#endif
+import Foundation
+
+public enum BundleError: Error, Equatable {
+  case badSignature, badPointer, badHash, badStorage, shellTooOld
+  /// Same codes as `expect` in test-vectors/bundle.json.
+  public var code: String {
+    switch self {
+    case .badSignature: return "bad_signature"
+    case .badPointer: return "bad_pointer"
+    case .badHash: return "bad_hash"
+    case .badStorage: return "bad_storage"
+    case .shellTooOld: return "shell_too_old"
+    }
+  }
+}
+
+/// Fields of a signed web release pointer that the bundle check reads.
+struct Pointer: Decodable {
+  struct Core: Decodable { let sha256: String; let size: Int }
+  let kind: String, platform: String?, app_id: String, shell_major: Int, band: String, release: Int, min_shell_version: String, core: Core
+}
+
+public struct Identity {
+  public var appId: String, shellMajor: Int, band: String
+  /// Installed app version, x.y.z.
+  public var shellVersion: String
+  /// Ed25519 public key (base64) built into the app. Never read from the network.
+  public var publicKey: String
+  public init(appId: String, shellMajor: Int, band: String, shellVersion: String, publicKey: String) {
+    self.appId = appId; self.shellMajor = shellMajor; self.band = band; self.shellVersion = shellVersion; self.publicKey = publicKey
+  }
+}
+
+/// a < b for x.y.z. Pre-release tags are ignored. Same as `semverLess` in the TypeScript core.
+func semverLess(_ a: String, _ b: String) -> Bool {
+  func parts(_ v: String) -> [Int] { String(v.split(separator: "-", omittingEmptySubsequences: false).first ?? "").split(separator: ".", omittingEmptySubsequences: false).map { Int($0) ?? 0 } }
+  let pa = parts(a), pb = parts(b)
+  for i in 0..<3 {
+    let x = i < pa.count ? pa[i] : 0, y = i < pb.count ? pb[i] : 0
+    if x != y { return x < y }
+  }
+  return false
+}
+
+public enum BundleVerify {
+  public static func sha256Hex(_ data: Data) -> String { SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined() }
+
+  static func signatureOK(body: String, signature: String, publicKey: String) -> Bool {
+    guard let sig = Data(base64Encoded: signature), let raw = Data(base64Encoded: publicKey),
+          let key = try? Curve25519.Signing.PublicKey(rawRepresentation: raw) else { return false }
+    return key.isValidSignature(sig, for: Data(body.utf8))
+  }
+
+  /// Same order as the TypeScript core: signature over the exact body bytes first, then the body, then the minimum shell version, then size and sha-256.
+  /// Returns the release number. Any failure throws and nothing is stored.
+  public static func check(body: String, signature: String, archive: Data, identity: Identity) throws -> Int {
+    guard signatureOK(body: body, signature: signature, publicKey: identity.publicKey) else { throw BundleError.badSignature }
+    guard let p = try? JSONDecoder().decode(Pointer.self, from: Data(body.utf8)),
+          p.kind == "web", (p.platform ?? "android") == "ios", p.app_id == identity.appId,
+          p.shell_major == identity.shellMajor, p.band == identity.band, p.release > 0 else { throw BundleError.badPointer }
+    // Rule 5: minimum shell version.
+    if semverLess(identity.shellVersion, p.min_shell_version) { throw BundleError.shellTooOld }
+    guard archive.count == p.core.size, sha256Hex(archive) == p.core.sha256 else { throw BundleError.badHash }
+    return p.release
+  }
+}

package/ios/Sources/ShipvoBundle/BundleStore.swift

@@ -0,0 +1,120 @@
+import Foundation
+
+/// Bundles under `<root>/bundles/release-<n>/bundle.zip` and release state in `<root>/state.json`.
+/// Same release rules as the TypeScript core (10, 11, 12, 14): three trial boots for a pending release,
+/// more than three boots in a minute reverts the current one, rollback blocks it.
+public final class BundleStore {
+  public static let maxBoots = 3
+  public static let windowMs = 60_000
+
+  struct State: Codable {
+    var current = 0, pending = 0, previous = 0, blocked = 0, pendingBoots = 0
+    var bootTimes: [Int] = []
+    var hashes: [String: String] = [:]
+  }
+
+  private let root: URL
+  private let identity: Identity
+  private let now: () -> Int
+  private var s: State
+
+  public init(root: URL, identity: Identity, now: @escaping () -> Int = { Int(Date().timeIntervalSince1970 * 1000) }) throws {
+    self.root = root; self.identity = identity; self.now = now
+    do { try FileManager.default.createDirectory(at: root.appendingPathComponent("bundles"), withIntermediateDirectories: true) }
+    catch { throw BundleError.badStorage }
+    // A state file that cannot be read starts clean: no release is trusted without a verified record.
+    if let d = try? Data(contentsOf: root.appendingPathComponent("state.json")), let st = try? JSONDecoder().decode(State.self, from: d) { s = st }
+    else { s = State() }
+  }
+
+  public var current: Int { s.current }
+  public var pending: Int { s.pending }
+  public var previous: Int { s.previous }
+  public var blocked: Int { s.blocked }
+
+  public func directory(for release: Int) -> URL { root.appendingPathComponent("bundles/release-\(release)") }
+  public func archiveURL(for release: Int) -> URL { directory(for: release).appendingPathComponent("bundle.zip") }
+
+  /// Verifies, then stores the archive and makes it the pending release. A refused bundle changes nothing.
+  @discardableResult
+  public func stage(body: String, signature: String, archive: Data) throws -> Int {
+    let release: Int
+    do { release = try BundleVerify.check(body: body, signature: signature, archive: archive, identity: identity) }
+    catch BundleError.badHash {
+      // Like the TypeScript core: a release whose size or sha-256 does not match is blocked, so it is not tried again.
+      // The signature was valid, so the release number is trusted.
+      if let r = signedRelease(body: body, signature: signature) { s.blocked = max(s.blocked, r); try save() }
+      throw BundleError.badHash
+    }
+    if release <= max(s.current, s.pending, s.blocked) { throw BundleError.badPointer }
+    let dir = directory(for: release)
+    do {
+      try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+      try archive.write(to: archiveURL(for: release), options: .atomic)
+    } catch { throw BundleError.badStorage }
+    let old = s.pending
+    s.hashes[String(release)] = BundleVerify.sha256Hex(archive)
+    s.pending = release; s.pendingBoots = 0
+    if old != 0 && old != release { drop(old) }
+    try save()
+    return release
+  }
+
+  /// The release number of a pointer whose signature is valid, else nil.
+  private func signedRelease(body: String, signature: String) -> Int? {
+    struct R: Decodable { let release: Int }
+    guard BundleVerify.signatureOK(body: body, signature: signature, publicKey: identity.publicKey),
+          let r = try? JSONDecoder().decode(R.self, from: Data(body.utf8)) else { return nil }
+    return r.release
+  }
+
+  /// The release to serve now, or 0 for the embedded bundle. The stored hash is re-checked before a file is chosen.
+  public func boot() throws -> Int {
+    let t = now()
+    if s.pending != 0 {
+      if s.pendingBoots >= Self.maxBoots {
+        blockAndDrop(s.pending); s.pending = 0; s.pendingBoots = 0
+      } else if intact(s.pending) {
+        s.pendingBoots += 1; try save(); return s.pending
+      } else { blockAndDrop(s.pending); s.pending = 0; s.pendingBoots = 0 }
+    }
+    if s.current != 0 {
+      s.bootTimes = s.bootTimes.filter { t - $0 < Self.windowMs } + [t]
+      if s.bootTimes.count > Self.maxBoots || !intact(s.current) {
+        blockAndDrop(s.current); s.current = s.previous; s.previous = 0; s.bootTimes = []
+      }
+    }
+    try save()
+    return s.current
+  }
+
+  /// Rule 12: the pending release that is running becomes current.
+  public func markHealthy(running: Int) throws {
+    guard s.pending != 0, s.pending == running else { return }
+    if s.previous != 0 { drop(s.previous) }
+    s.previous = s.current; s.current = s.pending; s.pending = 0; s.pendingBoots = 0; s.bootTimes = []
+    try save()
+  }
+
+  /// Rule 14: drop pending, block the current release, go back to the previous one.
+  public func rollback() throws {
+    if s.pending != 0 { drop(s.pending); s.pending = 0; s.pendingBoots = 0 }
+    if s.current != 0 { blockAndDrop(s.current) }
+    s.current = s.previous; s.previous = 0; s.bootTimes = []
+    try save()
+  }
+
+  private func intact(_ release: Int) -> Bool {
+    guard let d = try? Data(contentsOf: archiveURL(for: release)) else { return false }
+    return BundleVerify.sha256Hex(d) == s.hashes[String(release)]
+  }
+  private func blockAndDrop(_ release: Int) { s.blocked = max(s.blocked, release); drop(release) }
+  private func drop(_ release: Int) {
+    s.hashes[String(release)] = nil
+    try? FileManager.default.removeItem(at: directory(for: release))
+  }
+  private func save() throws {
+    do { try JSONEncoder().encode(s).write(to: root.appendingPathComponent("state.json"), options: .atomic) }
+    catch { throw BundleError.badStorage }
+  }
+}

package/ios/Sources/ShipvoCapacitor/ShipvoPlugin.swift

@@ -0,0 +1,116 @@
+import Capacitor
+import Foundation
+import ShipvoBundle
+
+/// The native half of @shipvo/capacitor on iOS. Same plugin name (`Shipvo`), methods and results as the Android plugin
+/// (`ShipvoNativePlugin` in src/native.ts). It backs the core's key-value store and bundle files, and points the web view
+/// at an unpacked bundle. It makes no release decisions: the TypeScript core verifies the signature and hash, and this
+/// class checks the hash it is given again before it unpacks.
+@objc(ShipvoPlugin)
+public class ShipvoPlugin: CAPPlugin, CAPBridgedPlugin {
+  public let identifier = "ShipvoPlugin"
+  public let jsName = "Shipvo"
+  public let pluginMethods: [CAPPluginMethod] = [
+    CAPPluginMethod(name: "kvGet", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "kvSet", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "fileWrite", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "fileRead", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "fileRemove", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "fileList", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "fileClear", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "serve", returnType: CAPPluginReturnPromise),
+    CAPPluginMethod(name: "status", returnType: CAPPluginReturnPromise),
+  ]
+
+  private let defaults = UserDefaults(suiteName: "shipvo") ?? .standard
+  // Instance state, like the Android plugin: it lasts as long as the bridge, and a new bridge starts on the embedded assets.
+  private var serving: String?
+  private var servingPath: String?
+
+  private lazy var root: URL = {
+    let base = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0].appendingPathComponent("shipvo")
+    try? FileManager.default.createDirectory(at: base.appendingPathComponent("bundles"), withIntermediateDirectories: true)
+    return base
+  }()
+  private var bundles: URL { root.appendingPathComponent("bundles") }
+  private var served: URL { root.appendingPathComponent("served") }
+
+  private func file(_ name: String?) throws -> URL {
+    guard let n = name, n.range(of: "^[A-Za-z0-9._-]{1,128}$", options: .regularExpression) != nil, !n.contains("..") else {
+      throw Unzip.Failure(message: "bad file name")
+    }
+    return bundles.appendingPathComponent(n)
+  }
+
+  @objc func kvGet(_ call: CAPPluginCall) {
+    guard let key = call.getString("key"), let v = defaults.string(forKey: key) else { call.resolve([:]); return }
+    call.resolve(["value": v])
+  }
+
+  @objc func kvSet(_ call: CAPPluginCall) {
+    guard let key = call.getString("key"), let value = call.getString("value") else { call.reject("key and value are required"); return }
+    defaults.set(value, forKey: key)
+    // The boot counter must be on disk before the page runs.
+    defaults.synchronize()
+    call.resolve()
+  }
+
+  @objc func fileWrite(_ call: CAPPluginCall) {
+    do {
+      guard let data = Data(base64Encoded: call.getString("data") ?? "") else { throw Unzip.Failure(message: "bad data") }
+      try data.write(to: try file(call.getString("name")), options: .atomic)
+      call.resolve()
+    } catch { call.reject("could not write: \(error.localizedDescription)") }
+  }
+
+  @objc func fileRead(_ call: CAPPluginCall) {
+    do { call.resolve(["data": try Data(contentsOf: try file(call.getString("name"))).base64EncodedString()]) }
+    catch { call.reject(error.localizedDescription) }
+  }
+
+  @objc func fileRemove(_ call: CAPPluginCall) {
+    do { try? FileManager.default.removeItem(at: try file(call.getString("name"))); call.resolve() }
+    catch { call.reject(error.localizedDescription) }
+  }
+
+  @objc func fileList(_ call: CAPPluginCall) {
+    let names = ((try? FileManager.default.contentsOfDirectory(atPath: bundles.path)) ?? []).filter { !$0.hasSuffix(".tmp") }.sorted()
+    call.resolve(["names": names])
+  }
+
+  @objc func fileClear(_ call: CAPPluginCall) {
+    for n in (try? FileManager.default.contentsOfDirectory(atPath: bundles.path)) ?? [] { try? FileManager.default.removeItem(at: bundles.appendingPathComponent(n)) }
+    try? FileManager.default.removeItem(at: served)
+    serving = nil; servingPath = nil
+    call.resolve()
+  }
+
+  /// Serve a stored bundle. `sha256` is the hash the core verified; it is checked again before unpacking.
+  @objc func serve(_ call: CAPPluginCall) {
+    do {
+      let name = call.getString("name")
+      let zip = try Data(contentsOf: try file(name))
+      guard let want = call.getString("sha256"), BundleVerify.sha256Hex(zip).lowercased() == want.lowercased() else {
+        throw Unzip.Failure(message: "bundle hash does not match")
+      }
+      try? FileManager.default.removeItem(at: served)
+      let target = served.appendingPathComponent(name!)
+      try FileManager.default.createDirectory(at: target, withIntermediateDirectories: true)
+      do {
+        try Unzip.extract(zip, to: target)
+        guard FileManager.default.fileExists(atPath: target.appendingPathComponent("index.html").path) else { throw Unzip.Failure(message: "bundle has no index.html") }
+      } catch { try? FileManager.default.removeItem(at: served); throw error }
+      DispatchQueue.main.async {
+        guard let vc = self.bridge?.viewController as? CAPBridgeViewController else { call.reject("no web view to point at the bundle"); return }
+        vc.setServerBasePath(path: target.path)
+        self.serving = name; self.servingPath = target.path
+        call.resolve()
+      }
+    } catch { call.reject(error.localizedDescription) }
+  }
+
+  /// Which bundle this process is already serving, so the page it loads does not boot again.
+  @objc func status(_ call: CAPPluginCall) {
+    if let s = serving, servingPath != nil { call.resolve(["serving": s]) } else { call.resolve([:]) }
+  }
+}

package/ios/Sources/ShipvoCapacitor/Unzip.swift

@@ -0,0 +1,50 @@
+import Compression
+import Foundation
+
+/// Reads a zip archive held in memory (stored and deflate entries). Entries that would leave the target directory are refused.
+enum Unzip {
+  struct Failure: Error, LocalizedError { let message: String; var errorDescription: String? { message } }
+  static let maxEntryBytes = 256 * 1024 * 1024
+
+  static func extract(_ zip: Data, to target: URL) throws {
+    let b = [UInt8](zip)
+    func u16(_ o: Int) -> Int { Int(b[o]) | Int(b[o + 1]) << 8 }
+    func u32(_ o: Int) -> Int { u16(o) | u16(o + 2) << 16 }
+    guard b.count >= 22 else { throw Failure(message: "bad entry in bundle") }
+    // End of central directory record: the last 22+ bytes, signature 0x06054b50.
+    var eocd = -1
+    var i = b.count - 22
+    while i >= max(0, b.count - 22 - 65_535) { if u32(i) == 0x0605_4b50 { eocd = i; break }; i -= 1 }
+    guard eocd >= 0 else { throw Failure(message: "bad entry in bundle") }
+    let count = u16(eocd + 10)
+    var p = u32(eocd + 16)
+    let root = target.standardizedFileURL.path + "/"
+    let fm = FileManager.default
+    for _ in 0..<count {
+      guard p + 46 <= b.count, u32(p) == 0x0201_4b50 else { throw Failure(message: "bad entry in bundle") }
+      let method = u16(p + 10), csize = u32(p + 20), usize = u32(p + 24)
+      let nlen = u16(p + 28), elen = u16(p + 30), clen = u16(p + 32), local = u32(p + 42)
+      guard p + 46 + nlen <= b.count, local + 30 <= b.count, u32(local) == 0x0403_4b50, usize <= maxEntryBytes else { throw Failure(message: "bad entry in bundle") }
+      let name = String(decoding: b[(p + 46)..<(p + 46 + nlen)], as: UTF8.self)
+      p += 46 + nlen + elen + clen
+      let out = target.appendingPathComponent(name).standardizedFileURL
+      guard out.path.hasPrefix(root) else { throw Failure(message: "bad entry in bundle") }
+      if name.hasSuffix("/") { try fm.createDirectory(at: out, withIntermediateDirectories: true); continue }
+      let start = local + 30 + u16(local + 26) + u16(local + 28)
+      guard start + csize <= b.count else { throw Failure(message: "bad entry in bundle") }
+      let raw = Data(b[start..<(start + csize)])
+      var data: Data
+      if method == 0 { data = raw }
+      else if method == 8 {
+        var dst = [UInt8](repeating: 0, count: max(usize, 1))
+        let n = raw.withUnsafeBytes { src in
+          compression_decode_buffer(&dst, dst.count, src.bindMemory(to: UInt8.self).baseAddress!, raw.count, nil, COMPRESSION_ZLIB)
+        }
+        guard n == usize else { throw Failure(message: "bad entry in bundle") }
+        data = Data(dst.prefix(n))
+      } else { throw Failure(message: "bad entry in bundle") }
+      try fm.createDirectory(at: out.deletingLastPathComponent(), withIntermediateDirectories: true)
+      try data.write(to: out)
+    }
+  }
+}

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@shipvo/capacitor",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Signed over-the-air updates for Capacitor web bundles: the same release decisions and trust model as the Shipvo React Native runtime.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@shipvo/schema": "^0.0.6"
+    "@shipvo/schema": "^0.0.8"
   },
   "devDependencies": {
     "@types/node": "^22.8.0",
@@ -33,6 +33,8 @@
     "dist",
     "android/build.gradle",
     "android/src/main",
+    "Package.swift",
+    "ios/Sources",
     "README.md"
   ],
   "publishConfig": {
@@ -42,6 +44,11 @@
   "engines": {
     "node": ">=20"
   },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run"