@shipvo/runtime 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,73 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -1,3 +1,21 @@
-# Temporary Holding Version
+# @shipvo/runtime
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The native half of Shipvo's over-the-air updates, as an Expo module.
+
+- Verifies every release pointer (Ed25519) and bundle (SHA-256 + size) against a public key built into the shell.
+- Downloads bsdiff patches when it has the previous release, full bundles otherwise; stages atomically.
+- Applies without restart, marks the release healthy when the app says so, and discards a release that fails to boot 3 times.
+- Android and iOS. iOS downloads full bundles (patches are Android-only for now) and is verified on the iOS Simulator in CI; in the web simulator the app runs the same release as the web build.
+
+```json
+{ "expo": { "plugins": [["@shipvo/runtime", { "baseUrl": "https://<your control plane>", "publicKey": "<base64 Ed25519 public key>", "appId": "myshop" }]] } }
+```
+
+```ts
+import { Runtime } from "@shipvo/runtime";
+const s = Runtime.getState();            // running / pending / previous release, band, baseUrl, appId
+await Runtime.checkForUpdate(true);      // verify, download (patch if possible), stage, apply
+Runtime.markHealthy();                   // call once the first screen rendered
+```
+
+`shipvo init` wires all of this for you.

package/android/build.gradle

@@ -0,0 +1,24 @@
+plugins {
+  id 'com.android.library'
+  id 'expo-module-gradle-plugin'
+}
+
+group = "dev.shipvo"
+version = '0.0.1'
+
+android {
+  namespace "dev.shipvo.runtime"
+  defaultConfig {
+    versionCode 1
+    versionName "0.0.1"
+    consumerProguardFiles "proguard-rules.pro"
+  }
+}
+
+dependencies {
+  implementation 'com.facebook.react:react-android'
+  // Ed25519 verification on Android 7+ (no platform Ed25519 before API 33). Pure Java, ~60 KB.
+  implementation 'net.i2p.crypto:eddsa:0.3.0'
+  // bzip2 for standard BSDIFF40 patches. 1.21 has no transitive dependencies; R8 keeps only the bzip2 reader.
+  implementation 'org.apache.commons:commons-compress:1.21'
+}

package/android/proguard-rules.pro

@@ -0,0 +1,8 @@
+# net.i2p eddsa references a JDK-only class in a code path Android never takes (X509 key encoding).
+-dontwarn sun.security.x509.**
+-keep class net.i2p.crypto.eddsa.** { *; }
+-dontwarn org.apache.commons.compress.**
+-dontwarn org.tukaani.xz.**
+-dontwarn com.github.luben.zstd.**
+-dontwarn org.brotli.dec.**
+-dontwarn org.objectweb.asm.**

package/android/src/main/java/dev/shipvo/runtime/Patch.kt

@@ -0,0 +1,48 @@
+package dev.shipvo.runtime
+
+import org.apache.commons.compress.compressors.bzip2.BZip2CompressorInputStream
+import java.io.ByteArrayInputStream
+import java.io.InputStream
+
+/** bspatch for the standard BSDIFF40 format (Colin Percival's bsdiff 4.x): header, then bzip2 ctrl/diff/extra blocks. */
+internal object Patch {
+  private fun offtin(b: ByteArray, o: Int): Long {
+    var y = (b[o + 7].toLong() and 0x7F)
+    for (i in 6 downTo 0) y = (y shl 8) or (b[o + i].toLong() and 0xFF)
+    return if ((b[o + 7].toInt() and 0x80) != 0) -y else y
+  }
+
+  private fun readFully(ins: InputStream, buf: ByteArray, off: Int, len: Int) {
+    var n = 0
+    while (n < len) { val r = ins.read(buf, off + n, len - n); require(r > 0) { "patch truncated" }; n += r }
+  }
+
+  fun apply(old: ByteArray, patch: ByteArray): ByteArray {
+    require(patch.size >= 32 && String(patch, 0, 8, Charsets.US_ASCII) == "BSDIFF40") { "not a BSDIFF40 patch" }
+    val ctrlLen = offtin(patch, 8); val diffLen = offtin(patch, 16); val newSize = offtin(patch, 24)
+    require(ctrlLen >= 0 && diffLen >= 0 && newSize in 0..(64L shl 20)) { "bad patch header" }
+    val ctrl = BZip2CompressorInputStream(ByteArrayInputStream(patch, 32, ctrlLen.toInt()))
+    val diff = BZip2CompressorInputStream(ByteArrayInputStream(patch, (32 + ctrlLen).toInt(), diffLen.toInt()))
+    val extraStart = (32 + ctrlLen + diffLen).toInt()
+    val extra = BZip2CompressorInputStream(ByteArrayInputStream(patch, extraStart, patch.size - extraStart))
+
+    val out = ByteArray(newSize.toInt())
+    var oldPos = 0L; var newPos = 0L
+    val c = ByteArray(24)
+    while (newPos < newSize) {
+      readFully(ctrl, c, 0, 24)
+      val x = offtin(c, 0); val y = offtin(c, 8); val z = offtin(c, 16)
+      require(x >= 0 && y >= 0 && newPos + x + y <= newSize) { "corrupt patch control" }
+      readFully(diff, out, newPos.toInt(), x.toInt())
+      for (i in 0 until x.toInt()) {
+        val op = oldPos + i
+        if (op in 0 until old.size) out[(newPos + i).toInt()] = (out[(newPos + i).toInt()] + old[op.toInt()]).toByte()
+      }
+      newPos += x; oldPos += x
+      readFully(extra, out, newPos.toInt(), y.toInt())
+      newPos += y; oldPos += z
+    }
+    ctrl.close(); diff.close(); extra.close()
+    return out
+  }
+}

package/android/src/main/java/dev/shipvo/runtime/ShipvoHostHandler.kt

@@ -0,0 +1,77 @@
+package dev.shipvo.runtime
+
+import android.content.Context
+import expo.modules.core.interfaces.ReactNativeHostHandler
+import java.io.File
+
+/**
+ * Chooses the JS bundle at boot. Order: a staged (pending) release on trial, else the last good release,
+ * else the bundle embedded in the APK. A pending release that fails to reach markHealthy within 3 boots is
+ * discarded; a current release that boots unhealthy 3 times inside 60 s falls back to the previous one.
+ */
+class ShipvoHostHandler(private val ctx: Context) : ReactNativeHostHandler {
+  override fun getJSBundleFile(useDeveloperSupport: Boolean): String? {
+    if (useDeveloperSupport) return null
+    synchronized(LOCK) {
+      val s = Store(ctx)
+      Store.bundleSelectedAt = s.now()
+      Store.loadsInProcess = Store.loadsInProcess + 1
+
+      val installed = s.installedBinaryVersion
+      if (s.binaryVersion != installed) {
+        val hadBundles = s.currentPath != null || s.pendingPath != null
+        s.resetForNewShell()
+        if (hadBundles) s.addEvent("shell_changed:0")
+      }
+
+      val pending = s.pendingPath
+      if (pending != null) {
+        if (s.trialBoots >= MAX_BOOTS || !File(pending).exists()) {
+          s.addEvent("crash_loop_revert:${s.pendingRelease}")
+          s.block(s.pendingRelease)
+          File(pending).delete()
+          s.pendingPath = null; s.pendingRelease = 0; s.trialBoots = 0
+        } else {
+          s.trialBoots = s.trialBoots + 1
+          Store.runningRelease = s.pendingRelease
+          return pending
+        }
+      }
+
+      val current = s.currentPath
+      if (current != null && File(current).exists()) {
+        val now = s.now()
+        if (now - s.firstUnhealthyAt > WINDOW_MS) { s.firstUnhealthyAt = now; s.unhealthyBoots = 0 }
+        s.unhealthyBoots = s.unhealthyBoots + 1
+        if (s.unhealthyBoots > MAX_BOOTS) {
+          s.addEvent("crash_loop_revert:${s.currentRelease}")
+          s.block(s.currentRelease)
+          revertToPrevious(s)
+          return selectCurrentOrEmbedded(s)
+        }
+        Store.runningRelease = s.currentRelease
+        return current
+      }
+      Store.runningRelease = 0
+      return null // embedded bundle in the APK
+    }
+  }
+
+  private fun selectCurrentOrEmbedded(s: Store): String? {
+    val c = s.currentPath
+    return if (c != null && File(c).exists()) { Store.runningRelease = s.currentRelease; c } else { Store.runningRelease = 0; null }
+  }
+
+  companion object {
+    const val MAX_BOOTS = 3
+    const val WINDOW_MS = 60_000L
+    val LOCK = Any()
+
+    internal fun revertToPrevious(s: Store) {
+      s.currentPath?.let { if (it != s.previousPath) File(it).delete() }
+      s.currentPath = s.previousPath; s.currentRelease = s.previousRelease; s.currentSha = null
+      s.previousPath = null; s.previousRelease = 0
+      s.unhealthyBoots = 0; s.firstUnhealthyAt = 0
+    }
+  }
+}

package/android/src/main/java/dev/shipvo/runtime/ShipvoRuntimeModule.kt

@@ -0,0 +1,170 @@
+package dev.shipvo.runtime
+
+import android.content.Context
+import android.os.Handler
+import android.os.Looper
+import android.os.Process
+import android.os.SystemClock
+import com.facebook.react.ReactApplication
+import expo.modules.kotlin.exception.Exceptions
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+import org.json.JSONObject
+import java.io.File
+import java.net.HttpURLConnection
+import java.net.URL
+
+class ShipvoRuntimeModule : Module() {
+  private val ctx: Context get() = appContext.reactContext?.applicationContext ?: throw Exceptions.ReactContextLost()
+
+  override fun definition() = ModuleDefinition {
+    Name("ShipvoRuntime")
+
+    Function("getState") {
+      val s = Store(ctx)
+      mapOf(
+        "cohort" to s.cohort, "band" to s.band,
+        "runningRelease" to Store.runningRelease, "currentRelease" to s.currentRelease,
+        "pendingRelease" to s.pendingRelease, "previousRelease" to s.previousRelease,
+        "blockedRelease" to s.blockedRelease, "shellVersion" to s.installedBinaryVersion,
+        "baseUrl" to s.baseUrl, "appId" to s.appId, "shellMajor" to s.shellMajor
+      )
+    }
+
+    AsyncFunction("checkForUpdate") { apply: Boolean ->
+      val r = try { check() } catch (e: Exception) { mapOf("status" to "error", "error" to (e.message ?: e.javaClass.simpleName)) }
+      if (apply && r["status"] == "staged") reloadHost()
+      r
+    }
+
+    Function("markHealthy") {
+      val s = Store(ctx)
+      val now = SystemClock.elapsedRealtime()
+      val coldStart = now - Process.getStartElapsedRealtime()
+      val sinceLoad = if (Store.bundleSelectedAt > 0) now - Store.bundleSelectedAt else -1
+      var promoted = false
+      synchronized(ShipvoHostHandler.LOCK) {
+        if (s.pendingRelease != 0 && Store.runningRelease == s.pendingRelease) {
+          s.previousPath?.let { old -> if (old != s.currentPath) File(old).delete() }
+          s.previousRelease = s.currentRelease; s.previousPath = s.currentPath
+          s.currentRelease = s.pendingRelease; s.currentPath = s.pendingPath; s.currentSha = s.pendingSha
+          s.pendingRelease = 0; s.pendingPath = null; s.trialBoots = 0
+          s.addEvent("applied:${s.currentRelease}")
+          promoted = true
+        }
+        s.unhealthyBoots = 0; s.firstUnhealthyAt = 0
+      }
+      val kind = if (Store.loadsInProcess <= 1) "cold" else "reload"
+      mapOf("release" to Store.runningRelease, "coldStartMs" to coldStart, "sinceLoadMs" to sinceLoad, "promoted" to promoted, "kind" to kind)
+    }
+
+    Function("consumeEvents") { Store(ctx).consumeEvents() }
+
+    Function("rollback") {
+      val s = Store(ctx)
+      synchronized(ShipvoHostHandler.LOCK) {
+        s.pendingPath?.let { File(it).delete() }
+        s.pendingPath = null; s.pendingRelease = 0; s.trialBoots = 0
+        s.addEvent("rolled_back:${s.currentRelease}")
+        s.block(s.currentRelease)
+        ShipvoHostHandler.revertToPrevious(s)
+      }
+      reloadHost()
+    }
+
+    Function("reload") { reloadHost() }
+  }
+
+  private fun reloadHost() {
+    Handler(Looper.getMainLooper()).post {
+      (ctx as? ReactApplication)?.reactHost?.reload("shipvo-update")
+    }
+  }
+
+  private fun http(url: String, etag: String?): HttpURLConnection =
+    (URL(url).openConnection() as HttpURLConnection).apply {
+      connectTimeout = 10_000; readTimeout = 30_000; useCaches = false
+      etag?.let { setRequestProperty("If-None-Match", it) }
+    }
+
+  private fun resolve(s: Store, url: String) = if (url.startsWith("http")) url else "${s.baseUrl}/${url.trimStart('/')}"
+
+  private fun check(): Map<String, Any?> {
+    val s = Store(ctx)
+    require(s.baseUrl.isNotEmpty() && s.publicKey.isNotEmpty() && s.appId.isNotEmpty()) { "runtime not configured" }
+    val known = maxOf(s.currentRelease, s.pendingRelease, s.blockedRelease)
+    val conn = http("${s.baseUrl}/p/${s.appId}/${s.shellMajor}/${s.band}.json", if (known > 0) "\"$known\"" else null)
+    val code = conn.responseCode
+    if (code == 304 || code == 404) { conn.disconnect(); return mapOf("status" to "none") }
+    require(code == 200) { "pointer HTTP $code" }
+    val envelope = JSONObject(conn.inputStream.bufferedReader().use { it.readText() })
+    conn.disconnect()
+
+    val t0 = SystemClock.elapsedRealtime()
+    val bodyStr = envelope.getString("body")
+    require(Verify.ed25519(bodyStr.toByteArray(Charsets.UTF_8), envelope.getString("signature"), s.publicKey)) { "pointer signature invalid" }
+    val body = JSONObject(bodyStr)
+    require(body.getString("app_id") == s.appId && body.getInt("shell_major") == s.shellMajor) { "pointer for another app/shell" }
+    val release = body.getInt("release")
+    if (release <= known) return mapOf("status" to "none")
+    val shellVersion = ctx.packageManager.getPackageInfo(ctx.packageName, 0).versionName ?: "0.0.0"
+    require(!Verify.semverLess(shellVersion, body.getString("min_shell_version"))) { "shell too old for release $release" }
+    val verifyPointerMs = SystemClock.elapsedRealtime() - t0
+
+    val core = body.getJSONObject("core")
+    val wantSha = core.getString("sha256"); val wantSize = core.getLong("size")
+    val tmp = File(s.dir, "dl-$release.tmp")
+    val d0 = SystemClock.elapsedRealtime()
+    var via = "full"; var bytesDownloaded = 0L; var patchError: String? = null
+
+    // 1. Try a patch against the bundle this device already has (last good release, else the APK's own bundle).
+    val patches = core.optJSONArray("patches")
+    if (patches != null && patches.length() > 0) {
+      try {
+        val baseFile = s.currentPath?.let { File(it) }?.takeIf { it.exists() }
+        val baseSha = if (baseFile != null) (s.currentSha ?: Verify.sha256Hex(baseFile).also { s.currentSha = it }) else s.embeddedSha()
+        var match: JSONObject? = null
+        for (i in 0 until patches.length()) { val p = patches.getJSONObject(i); if (p.getString("from_sha256") == baseSha) { match = p; break } }
+        if (match != null) {
+          val patchBytes = http(resolve(s, match.getString("url")), null).let { c ->
+            require(c.responseCode == 200) { "patch HTTP ${c.responseCode}" }
+            c.inputStream.use { it.readBytes() }.also { c.disconnect() }
+          }
+          require(patchBytes.size.toLong() == match.getLong("size") && Verify.sha256Hex(patchBytes) == match.getString("sha256")) { "patch hash mismatch" }
+          val base = baseFile?.readBytes() ?: s.embeddedBundle() ?: error("no base bundle")
+          val out = Patch.apply(base, patchBytes)
+          require(out.size.toLong() == wantSize && Verify.sha256Hex(out) == wantSha) { "patched bundle hash mismatch" }
+          tmp.writeBytes(out)
+          via = "patch"; bytesDownloaded = patchBytes.size.toLong()
+        }
+      } catch (e: Exception) { patchError = e.message; tmp.delete() }
+    }
+
+    // 2. Fall back to the full bundle.
+    if (via == "full") {
+      val dl = http(resolve(s, core.getString("url")), null)
+      require(dl.responseCode == 200) { "bundle HTTP ${dl.responseCode}" }
+      dl.inputStream.use { ins -> tmp.outputStream().use { ins.copyTo(it, 64 * 1024) } }
+      dl.disconnect()
+      bytesDownloaded = tmp.length()
+    }
+    val downloadMs = SystemClock.elapsedRealtime() - d0
+
+    val v0 = SystemClock.elapsedRealtime()
+    val ok = tmp.length() == wantSize && Verify.sha256Hex(tmp) == wantSha
+    if (!ok) { tmp.delete(); s.addEvent("verify_failed:$release"); throw IllegalStateException("bundle hash/size mismatch") }
+    val verifyMs = SystemClock.elapsedRealtime() - v0 + verifyPointerMs
+
+    val dest = File(s.dir, "r$release.hbc")
+    require(tmp.renameTo(dest)) { "could not stage bundle" }
+    synchronized(ShipvoHostHandler.LOCK) {
+      s.pendingPath?.let { if (it != dest.path) File(it).delete() }
+      s.pendingPath = dest.path; s.pendingRelease = release; s.trialBoots = 0; s.pendingSha = wantSha
+      if (s.binaryVersion == null) s.binaryVersion = s.installedBinaryVersion
+      s.pendingIssuedAt = body.optString("issued_at")
+    }
+    return mapOf("status" to "staged", "release" to release, "bytes" to bytesDownloaded, "via" to via, "bundleBytes" to dest.length(),
+      "patchError" to patchError,
+      "downloadMs" to downloadMs, "verifyMs" to verifyMs, "issuedAt" to body.optString("issued_at"))
+  }
+}

package/android/src/main/java/dev/shipvo/runtime/ShipvoRuntimePackage.kt

@@ -0,0 +1,10 @@
+package dev.shipvo.runtime
+
+import android.content.Context
+import expo.modules.core.interfaces.Package
+import expo.modules.core.interfaces.ReactNativeHostHandler
+
+class ShipvoRuntimePackage : Package {
+  override fun createReactNativeHostHandlers(context: Context): List<ReactNativeHostHandler> =
+    listOf(ShipvoHostHandler(context))
+}

package/android/src/main/java/dev/shipvo/runtime/Store.kt

@@ -0,0 +1,96 @@
+package dev.shipvo.runtime
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.content.pm.PackageManager
+import android.os.SystemClock
+import java.io.File
+import kotlin.random.Random
+
+/** Persistent runtime state. All bundle decisions go through here so the host handler and module agree. */
+internal class Store(private val ctx: Context) {
+  private val p: SharedPreferences = ctx.getSharedPreferences("shipvo.runtime", Context.MODE_PRIVATE)
+  val dir: File get() = File(ctx.filesDir, "shipvo").apply { mkdirs() }
+
+  val cohort: Int
+    get() {
+      if (!p.contains("cohort")) p.edit().putInt("cohort", Random.nextInt(0, 1000)).commit()
+      return p.getInt("cohort", 0)
+    }
+  val band: String get() = cohort.let { if (it < 10) "b0" else if (it < 100) "b1" else "b2" }
+
+  var currentRelease: Int get() = p.getInt("current_release", 0); set(v) { p.edit().putInt("current_release", v).commit() }
+  var currentPath: String? get() = p.getString("current_path", null); set(v) { p.edit().putString("current_path", v).commit() }
+  var previousRelease: Int get() = p.getInt("previous_release", 0); set(v) { p.edit().putInt("previous_release", v).commit() }
+  var previousPath: String? get() = p.getString("previous_path", null); set(v) { p.edit().putString("previous_path", v).commit() }
+  var pendingRelease: Int get() = p.getInt("pending_release", 0); set(v) { p.edit().putInt("pending_release", v).commit() }
+  var pendingPath: String? get() = p.getString("pending_path", null); set(v) { p.edit().putString("pending_path", v).commit() }
+  var pendingIssuedAt: String? get() = p.getString("pending_issued_at", null); set(v) { p.edit().putString("pending_issued_at", v).commit() }
+  /** Highest release this device refused (crash-looped or rolled back). Only newer releases are fetched. */
+  var blockedRelease: Int get() = p.getInt("blocked_release", 0); set(v) { p.edit().putInt("blocked_release", v).commit() }
+  /** Shell binary the stored OTA bundles were downloaded under. */
+  var binaryVersion: String? get() = p.getString("binary_version", null); set(v) { p.edit().putString("binary_version", v).commit() }
+  fun block(release: Int) { if (release > blockedRelease) blockedRelease = release }
+
+  val installedBinaryVersion: String
+    get() = try {
+      val pi = ctx.packageManager.getPackageInfo(ctx.packageName, 0)
+      @Suppress("DEPRECATION") val code = if (android.os.Build.VERSION.SDK_INT >= 28) pi.longVersionCode else pi.versionCode.toLong()
+      "${pi.versionName}/$code"
+    } catch (_: Exception) { "unknown" }
+
+  /** After a shell (APK) update, bundles built for the old native code must not run. */
+  fun resetForNewShell() {
+    dir.listFiles()?.forEach { it.delete() }
+    p.edit().remove("current_release").remove("current_path").remove("previous_release").remove("previous_path")
+      .remove("pending_release").remove("pending_path").remove("pending_issued_at").remove("trial_boots")
+      .remove("unhealthy_boots").remove("first_unhealthy_at").remove("blocked_release")
+      .remove("current_sha").remove("pending_sha")
+      .putString("binary_version", installedBinaryVersion).commit()
+  }
+
+  /** sha256 of the current (last good) bundle file, cached so we don't hash 1.5 MB on every check. */
+  var currentSha: String? get() = p.getString("current_sha", null); set(v) { p.edit().putString("current_sha", v).commit() }
+  var pendingSha: String? get() = p.getString("pending_sha", null); set(v) { p.edit().putString("pending_sha", v).commit() }
+
+  /** The bundle embedded in the APK, used as the first patch baseline. */
+  fun embeddedBundle(): ByteArray? = try { ctx.assets.open("index.android.bundle").use { it.readBytes() } } catch (_: Exception) { null }
+  fun embeddedSha(): String? {
+    val key = "embedded_sha:" + installedBinaryVersion
+    p.getString(key, null)?.let { return it }
+    val sha = embeddedBundle()?.let { Verify.sha256Hex(it) } ?: return null
+    p.edit().putString(key, sha).commit(); return sha
+  }
+
+  var trialBoots: Int get() = p.getInt("trial_boots", 0); set(v) { p.edit().putInt("trial_boots", v).commit() }
+  var unhealthyBoots: Int get() = p.getInt("unhealthy_boots", 0); set(v) { p.edit().putInt("unhealthy_boots", v).commit() }
+  var firstUnhealthyAt: Long get() = p.getLong("first_unhealthy_at", 0); set(v) { p.edit().putLong("first_unhealthy_at", v).commit() }
+
+  fun addEvent(e: String) {
+    val list = p.getString("events", "")!!.split('\n').filter { it.isNotBlank() }.takeLast(49) + e
+    p.edit().putString("events", list.joinToString("\n")).commit()
+  }
+  fun consumeEvents(): List<String> {
+    val list = p.getString("events", "")!!.split('\n').filter { it.isNotBlank() }
+    p.edit().remove("events").commit(); return list
+  }
+
+  private fun meta(key: String): String? = try {
+    val ai = ctx.packageManager.getApplicationInfo(ctx.packageName, PackageManager.GET_META_DATA)
+    ai.metaData?.getString(key)
+  } catch (_: Exception) { null }
+  val baseUrl: String get() = (meta("dev.shipvo.BASE_URL") ?: "").trimEnd('/')
+  val publicKey: String get() = meta("dev.shipvo.PUBLIC_KEY") ?: ""
+  val appId: String get() = meta("dev.shipvo.APP_ID") ?: ""
+  val shellMajor: Int get() = (meta("dev.shipvo.SHELL_MAJOR") ?: "1").toIntOrNull() ?: 1
+
+  companion object {
+    /** Which release the JS that is running right now came from (set at bundle-selection time). */
+    @Volatile var runningRelease: Int = 0
+    @Volatile var bundleSelectedAt: Long = 0
+    /** How many times a bundle was selected in this process: 1 = cold start, more = in-process reload. */
+    @Volatile var loadsInProcess: Int = 0
+  }
+
+  fun now() = SystemClock.elapsedRealtime()
+}

package/android/src/main/java/dev/shipvo/runtime/Verify.kt

@@ -0,0 +1,38 @@
+package dev.shipvo.runtime
+
+import android.util.Base64
+import net.i2p.crypto.eddsa.EdDSAEngine
+import net.i2p.crypto.eddsa.EdDSAPublicKey
+import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable
+import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec
+import java.io.File
+import java.io.FileInputStream
+import java.security.MessageDigest
+
+internal object Verify {
+  fun ed25519(message: ByteArray, signatureB64: String, publicKeyB64: String): Boolean = try {
+    val spec = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.ED_25519)
+    val key = EdDSAPublicKey(EdDSAPublicKeySpec(Base64.decode(publicKeyB64, Base64.DEFAULT), spec))
+    val engine = EdDSAEngine(MessageDigest.getInstance(spec.hashAlgorithm))
+    engine.initVerify(key)
+    engine.update(message)
+    engine.verify(Base64.decode(signatureB64, Base64.DEFAULT))
+  } catch (_: Exception) { false }
+
+  fun sha256Hex(f: File): String {
+    val md = MessageDigest.getInstance("SHA-256")
+    FileInputStream(f).use { ins -> val buf = ByteArray(64 * 1024); while (true) { val n = ins.read(buf); if (n < 0) break; md.update(buf, 0, n) } }
+    return md.digest().joinToString("") { "%02x".format(it) }
+  }
+
+  fun sha256Hex(b: ByteArray): String =
+    MessageDigest.getInstance("SHA-256").digest(b).joinToString("") { "%02x".format(it) }
+
+  /** a < b for x.y.z */
+  fun semverLess(a: String, b: String): Boolean {
+    val pa = a.split('-')[0].split('.').map { it.toIntOrNull() ?: 0 }
+    val pb = b.split('-')[0].split('.').map { it.toIntOrNull() ?: 0 }
+    for (i in 0 until 3) { val x = pa.getOrElse(i) { 0 }; val y = pb.getOrElse(i) { 0 }; if (x != y) return x < y }
+    return false
+  }
+}

package/app.plugin.js

@@ -0,0 +1,26 @@
+// Shipvo config plugin: puts the trust root and control-plane address in the native shell (AndroidManifest
+// meta-data, and expo.extra.shipvo for platforms without the OTA runtime), so an over-the-air bundle can never
+// change which key it is verified against.
+const { withAndroidManifest, withInfoPlist, AndroidConfig } = require("expo/config-plugins");
+
+module.exports = function withShipvo(config, props) {
+  const { baseUrl, publicKey, appId, shellMajor = 1 } = props || {};
+  if (!baseUrl || !publicKey || !appId) throw new Error("@shipvo/runtime: baseUrl, publicKey and appId are required");
+  config.extra = { ...(config.extra ?? {}), shipvo: { baseUrl, appId, shellMajor } };
+  config = withInfoPlist(config, (cfg) => {
+    cfg.modResults.ShipvoBaseURL = baseUrl;
+    cfg.modResults.ShipvoPublicKey = publicKey;
+    cfg.modResults.ShipvoAppId = appId;
+    cfg.modResults.ShipvoShellMajor = String(shellMajor);
+    return cfg;
+  });
+  return withAndroidManifest(config, (cfg) => {
+    const app = AndroidConfig.Manifest.getMainApplicationOrThrow(cfg.modResults);
+    const set = (name, value) => AndroidConfig.Manifest.addMetaDataItemToMainApplication(app, name, String(value));
+    set("dev.shipvo.BASE_URL", baseUrl);
+    set("dev.shipvo.PUBLIC_KEY", publicKey);
+    set("dev.shipvo.APP_ID", appId);
+    set("dev.shipvo.SHELL_MAJOR", shellMajor);
+    return cfg;
+  });
+};

package/expo-module.config.json

@@ -0,0 +1,19 @@
+{
+  "platforms": [
+    "android",
+    "apple"
+  ],
+  "android": {
+    "modules": [
+      "dev.shipvo.runtime.ShipvoRuntimeModule"
+    ]
+  },
+  "apple": {
+    "modules": [
+      "ShipvoRuntimeModule"
+    ],
+    "reactDelegateHandlers": [
+      "ShipvoReactDelegateHandler"
+    ]
+  }
+}

package/ios/BundleSelector.swift

@@ -0,0 +1,92 @@
+import Foundation
+
+/// The bundle-choice rules. Kept free of Expo and React imports so they run under `swift test` on a plain Mac.
+enum ShipvoBundleSelector {
+  static let maxBoots = 3
+  static let windowSeconds: TimeInterval = 60
+
+  /// Idempotent per load: React Native asks for the URL more than once, and only the first ask counts as a boot.
+  static func select(_ s: Store) -> URL? {
+    Store.lock.lock(); defer { Store.lock.unlock() }
+    if Store.selection.set { return Store.selection.url }
+    let url = choose(s)
+    Store.selection = (url, true)
+    return url
+  }
+
+  /// The app reports a healthy start: a pending release that is the one running becomes current. Returns whether it was promoted.
+  @discardableResult
+  static func promoteIfRunning(_ s: Store) -> Bool {
+    Store.lock.lock(); defer { Store.lock.unlock() }
+    var promoted = false
+    if s.pendingRelease != 0 && Store.runningRelease == s.pendingRelease {
+      if let old = s.previousPath, old != s.currentPath { remove(old) }
+      s.previousRelease = s.currentRelease; s.previousPath = s.currentPath
+      s.currentRelease = s.pendingRelease; s.currentPath = s.pendingPath; s.currentSha = s.pendingSha
+      s.pendingRelease = 0; s.pendingPath = nil; s.trialBoots = 0
+      s.addEvent("applied:\(s.currentRelease)")
+      promoted = true
+    }
+    s.unhealthyBoots = 0; s.firstUnhealthyAt = 0
+    return promoted
+  }
+
+  /// Called before a reload so the next ask is a fresh load.
+  static func invalidate() { Store.lock.lock(); Store.selection = (nil, false); Store.lock.unlock() }
+
+  private static func exists(_ path: String?) -> Bool { path != nil && FileManager.default.fileExists(atPath: path!) }
+  private static func remove(_ path: String?) { if let p = path { try? FileManager.default.removeItem(atPath: p) } }
+
+  private static func choose(_ s: Store) -> URL? {
+    Store.bundleSelectedAt = Store.now()
+    Store.loadsInProcess += 1
+
+    let installed = s.installedBinaryVersion
+    if s.binaryVersion != installed {
+      let hadBundles = s.currentPath != nil || s.pendingPath != nil
+      s.resetForNewShell()
+      if hadBundles { s.addEvent("shell_changed:0") }
+    }
+
+    if let pending = s.pendingPath {
+      if s.trialBoots >= maxBoots || !exists(pending) {
+        s.addEvent("crash_loop_revert:\(s.pendingRelease)")
+        s.block(s.pendingRelease)
+        remove(pending)
+        s.pendingPath = nil; s.pendingRelease = 0; s.trialBoots = 0
+      } else {
+        s.trialBoots += 1
+        Store.runningRelease = s.pendingRelease
+        return URL(fileURLWithPath: pending)
+      }
+    }
+
+    if exists(s.currentPath) {
+      let now = Store.now()
+      if now - s.firstUnhealthyAt > windowSeconds { s.firstUnhealthyAt = now; s.unhealthyBoots = 0 }
+      s.unhealthyBoots += 1
+      if s.unhealthyBoots > maxBoots {
+        s.addEvent("crash_loop_revert:\(s.currentRelease)")
+        s.block(s.currentRelease)
+        revertToPrevious(s)
+        return currentOrEmbedded(s)
+      }
+      Store.runningRelease = s.currentRelease
+      return URL(fileURLWithPath: s.currentPath!)
+    }
+    Store.runningRelease = 0
+    return nil // the embedded bundle
+  }
+
+  private static func currentOrEmbedded(_ s: Store) -> URL? {
+    if exists(s.currentPath) { Store.runningRelease = s.currentRelease; return URL(fileURLWithPath: s.currentPath!) }
+    Store.runningRelease = 0; return nil
+  }
+
+  static func revertToPrevious(_ s: Store) {
+    if let c = s.currentPath, c != s.previousPath { remove(c) }
+    s.currentPath = s.previousPath; s.currentRelease = s.previousRelease; s.currentSha = nil
+    s.previousPath = nil; s.previousRelease = 0
+    s.unhealthyBoots = 0; s.firstUnhealthyAt = 0
+  }
+}

package/ios/ShipvoReactDelegateHandler.swift

@@ -0,0 +1,16 @@
+import ExpoModulesCore
+import Foundation
+
+/// Chooses the JS bundle at load. Order: a staged (pending) release on trial, else the last good release, else the
+/// bundle embedded in the app (returning nil lets React Native use main.jsbundle). A pending release that does not
+/// reach markHealthy within 3 loads is discarded; a current release that loads unhealthy 3 times inside 60 s falls
+/// back to the previous one. Same rules as the Android host handler.
+public final class ShipvoReactDelegateHandler: ExpoReactDelegateHandler {
+  public override func bundleURL(reactDelegate: ExpoReactDelegate) -> URL? {
+#if DEBUG
+    return nil // development builds load from Metro
+#else
+    return ShipvoBundleSelector.select(Store())
+#endif
+  }
+}

package/ios/ShipvoRuntime.podspec

@@ -0,0 +1,25 @@
+require 'json'
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name           = 'ShipvoRuntime'
+  s.version        = package['version']
+  s.summary        = package['description']
+  s.description    = package['description']
+  s.license        = package['license']
+  s.author         = 'Shipvo'
+  s.homepage       = 'https://shipvo.dev'
+  s.platforms      = { :ios => '16.4' }
+  s.swift_version  = '5.9'
+  s.source         = { git: 'https://github.com/shipvo/shipvo.git' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+  s.dependency 'React-Core'
+
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+  s.source_files = '**/*.{h,m,swift}'
+end

package/ios/ShipvoRuntimeModule.swift

@@ -0,0 +1,72 @@
+import ExpoModulesCore
+import Foundation
+import React
+
+/// JS-facing runtime: getState / checkForUpdate / markHealthy / consumeEvents / rollback / reload.
+/// Same contract as the Android module so `Runtime` in src/index.ts is platform-neutral.
+public final class ShipvoRuntimeModule: Module {
+  public func definition() -> ModuleDefinition {
+    Name("ShipvoRuntime")
+
+    Function("getState") { () -> [String: Any] in
+      let s = Store()
+      var out: [String: Any] = [
+        "cohort": s.cohort, "band": s.band,
+        "runningRelease": Store.runningRelease, "currentRelease": s.currentRelease,
+        "pendingRelease": s.pendingRelease, "previousRelease": s.previousRelease,
+        "shellVersion": s.installedBinaryVersion,
+        "baseUrl": s.baseUrl, "appId": s.appId, "shellMajor": s.shellMajor,
+      ]
+      if s.blockedRelease != 0 { out["blockedRelease"] = s.blockedRelease }
+      return out
+    }
+
+    AsyncFunction("checkForUpdate") { (apply: Bool) async -> [String: Any] in
+      let r: [String: Any]
+      do { r = try await Updater.check(Store()) }
+      catch { r = ["status": "error", "error": (error as? UpdateError)?.message ?? error.localizedDescription] }
+      if apply, r["status"] as? String == "staged" { Self.reloadHost() }
+      return r
+    }
+
+    Function("markHealthy") { () -> [String: Any] in
+      let s = Store()
+      let now = Store.now()
+      let coldStart = max(0, (Date().timeIntervalSince1970 - Self.processStart()) * 1000)
+      let sinceLoad = Store.bundleSelectedAt > 0 ? (now - Store.bundleSelectedAt) * 1000 : -1
+      let promoted = ShipvoBundleSelector.promoteIfRunning(s)
+      return ["release": Store.runningRelease, "coldStartMs": Int(coldStart), "sinceLoadMs": Int(sinceLoad), "promoted": promoted,
+              "kind": Store.loadsInProcess <= 1 ? "cold" : "reload"]
+    }
+
+    Function("consumeEvents") { () -> [String] in Store().consumeEvents() }
+
+    Function("rollback") { () in
+      let s = Store()
+      Store.lock.lock()
+      if let p = s.pendingPath { try? FileManager.default.removeItem(atPath: p) }
+      s.pendingPath = nil; s.pendingRelease = 0; s.trialBoots = 0
+      s.addEvent("rolled_back:\(s.currentRelease)")
+      s.block(s.currentRelease)
+      ShipvoBundleSelector.revertToPrevious(s)
+      Store.lock.unlock()
+      Self.reloadHost()
+    }
+
+    Function("reload") { () in Self.reloadHost() }
+  }
+
+  static func reloadHost() {
+    ShipvoBundleSelector.invalidate()
+    DispatchQueue.main.async { RCTTriggerReloadCommandListeners("shipvo-update") }
+  }
+
+  /// Seconds since 1970 at which this process started.
+  static func processStart() -> TimeInterval {
+    var info = kinfo_proc(); var size = MemoryLayout<kinfo_proc>.stride
+    var mib: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()]
+    guard sysctl(&mib, 4, &info, &size, nil, 0) == 0 else { return Date().timeIntervalSince1970 }
+    let t = info.kp_proc.p_un.__p_starttime
+    return TimeInterval(t.tv_sec) + TimeInterval(t.tv_usec) / 1_000_000
+  }
+}

package/ios/Store.swift

@@ -0,0 +1,102 @@
+import Foundation
+
+/// Persistent runtime state. Every bundle decision goes through here so the host handler and the module agree.
+/// Mirrors the Android `Store`: same fields, same meaning.
+final class Store {
+  /// Replaces what the app's Info.plist and file system would say. Tests use it; the app never does.
+  struct Overrides {
+    var suite: String, dir: URL, baseUrl: String, publicKey: String, appId: String, shellMajor: Int, shellVersion: String, binaryVersion: String
+  }
+
+  private let d: UserDefaults
+  private let bundle: Bundle
+  private let o: Overrides?
+
+  init(bundle: Bundle = .main, overrides: Overrides? = nil) {
+    self.bundle = bundle; self.o = overrides
+    self.d = UserDefaults(suiteName: overrides?.suite ?? "shipvo.runtime") ?? .standard
+  }
+
+  var dir: URL {
+    let base = o?.dir ?? FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0].appendingPathComponent("shipvo", isDirectory: true)
+    try? FileManager.default.createDirectory(at: base, withIntermediateDirectories: true)
+    return base
+  }
+
+  // MARK: cohort and band
+  var cohort: Int {
+    if d.object(forKey: "cohort") == nil { d.set(Int.random(in: 0..<1000), forKey: "cohort") }
+    return d.integer(forKey: "cohort")
+  }
+  var band: String { let c = cohort; return c < 10 ? "b0" : (c < 100 ? "b1" : "b2") }
+
+  // MARK: releases
+  var currentRelease: Int { get { d.integer(forKey: "current_release") } set { d.set(newValue, forKey: "current_release") } }
+  var currentPath: String? { get { d.string(forKey: "current_path") } set { d.set(newValue, forKey: "current_path") } }
+  var currentSha: String? { get { d.string(forKey: "current_sha") } set { d.set(newValue, forKey: "current_sha") } }
+  var previousRelease: Int { get { d.integer(forKey: "previous_release") } set { d.set(newValue, forKey: "previous_release") } }
+  var previousPath: String? { get { d.string(forKey: "previous_path") } set { d.set(newValue, forKey: "previous_path") } }
+  var pendingRelease: Int { get { d.integer(forKey: "pending_release") } set { d.set(newValue, forKey: "pending_release") } }
+  var pendingPath: String? { get { d.string(forKey: "pending_path") } set { d.set(newValue, forKey: "pending_path") } }
+  var pendingSha: String? { get { d.string(forKey: "pending_sha") } set { d.set(newValue, forKey: "pending_sha") } }
+  var pendingIssuedAt: String? { get { d.string(forKey: "pending_issued_at") } set { d.set(newValue, forKey: "pending_issued_at") } }
+  /// Highest release this device refused (crash-looped or rolled back). Only newer releases are fetched.
+  var blockedRelease: Int { get { d.integer(forKey: "blocked_release") } set { d.set(newValue, forKey: "blocked_release") } }
+  /// Shell binary the stored OTA bundles were downloaded under.
+  var binaryVersion: String? { get { d.string(forKey: "binary_version") } set { d.set(newValue, forKey: "binary_version") } }
+  func block(_ release: Int) { if release > blockedRelease { blockedRelease = release } }
+
+  var trialBoots: Int { get { d.integer(forKey: "trial_boots") } set { d.set(newValue, forKey: "trial_boots") } }
+  var unhealthyBoots: Int { get { d.integer(forKey: "unhealthy_boots") } set { d.set(newValue, forKey: "unhealthy_boots") } }
+  var firstUnhealthyAt: Double { get { d.double(forKey: "first_unhealthy_at") } set { d.set(newValue, forKey: "first_unhealthy_at") } }
+
+  var installedBinaryVersion: String {
+    if let o { return o.binaryVersion }
+    let v = bundle.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.0.0"
+    let b = bundle.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "0"
+    return "\(v)/\(b)"
+  }
+  /// The marketing version alone, compared against `min_shell_version`.
+  var shellVersion: String { if let o { return o.shellVersion }; return bundle.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.0.0" }
+
+  /// After a shell (app binary) update, bundles built for the old native code must not run.
+  func resetForNewShell() {
+    if let files = try? FileManager.default.contentsOfDirectory(at: dir, includingPropertiesForKeys: nil) {
+      for f in files { try? FileManager.default.removeItem(at: f) }
+    }
+    for k in ["current_release", "current_path", "current_sha", "previous_release", "previous_path", "pending_release", "pending_path",
+              "pending_sha", "pending_issued_at", "trial_boots", "unhealthy_boots", "first_unhealthy_at", "blocked_release"] { d.removeObject(forKey: k) }
+    binaryVersion = installedBinaryVersion
+  }
+
+  // MARK: events
+  func addEvent(_ e: String) {
+    var list = (d.string(forKey: "events") ?? "").split(separator: "\n").map(String.init).filter { !$0.isEmpty }
+    list = Array(list.suffix(49)) + [e]
+    d.set(list.joined(separator: "\n"), forKey: "events")
+  }
+  func consumeEvents() -> [String] {
+    let list = (d.string(forKey: "events") ?? "").split(separator: "\n").map(String.init).filter { !$0.isEmpty }
+    d.removeObject(forKey: "events"); return list
+  }
+
+  // MARK: trust root (Info.plist, written by the config plugin; an OTA bundle cannot change these)
+  private func plist(_ key: String) -> String? { bundle.object(forInfoDictionaryKey: key) as? String }
+  var baseUrl: String { var s = o?.baseUrl ?? plist("ShipvoBaseURL") ?? ""; while s.hasSuffix("/") { s.removeLast() }; return s }
+  var publicKey: String { o?.publicKey ?? plist("ShipvoPublicKey") ?? "" }
+  var appId: String { o?.appId ?? plist("ShipvoAppId") ?? "" }
+  var shellMajor: Int { if let o { return o.shellMajor }; return Int(plist("ShipvoShellMajor") ?? "1") ?? 1 }
+
+  // MARK: per-process state
+  /// Which release the JS running right now came from (set when the bundle is selected).
+  static var runningRelease = 0
+  static var bundleSelectedAt: TimeInterval = 0
+  /// How many times a bundle was selected in this process: 1 = cold start, more = in-process reload.
+  static var loadsInProcess = 0
+  /// The URL chosen for the current load. React Native asks for the bundle URL more than once per load,
+  /// so the choice (and its trial-boot accounting) is made once and cached until a reload clears it.
+  static var selection: (url: URL?, set: Bool) = (nil, false)
+  static let lock = NSRecursiveLock()
+
+  static func now() -> TimeInterval { ProcessInfo.processInfo.systemUptime }
+}

package/ios/Updater.swift

@@ -0,0 +1,73 @@
+import Foundation
+
+struct UpdateError: Error { let message: String; init(_ m: String) { message = m } }
+
+/// Fetch, verify and stage the newest signed release for this device's band. Mirrors Android `check()`.
+/// iOS downloads full bundles only for now; a pointer's `patches` are ignored (an Android-only optimisation).
+enum Updater {
+  private static func require(_ cond: Bool, _ msg: @autoclosure () -> String) throws { if !cond { throw UpdateError(msg()) } }
+
+  private static func request(_ url: String, etag: String?) throws -> URLRequest {
+    guard let u = URL(string: url) else { throw UpdateError("bad url \(url)") }
+    var r = URLRequest(url: u, cachePolicy: .reloadIgnoringLocalCacheData, timeoutInterval: 30)
+    if let etag { r.setValue(etag, forHTTPHeaderField: "If-None-Match") }
+    return r
+  }
+
+  private static func resolve(_ s: Store, _ url: String) -> String { url.hasPrefix("http") ? url : "\(s.baseUrl)/\(url.drop(while: { $0 == "/" }))" }
+
+  static func check(_ s: Store) async throws -> [String: Any] {
+    try require(!s.baseUrl.isEmpty && !s.publicKey.isEmpty && !s.appId.isEmpty, "runtime not configured")
+    let known = max(s.currentRelease, s.pendingRelease, s.blockedRelease)
+    let (data, resp) = try await URLSession.shared.data(for: request("\(s.baseUrl)/p/\(s.appId)/\(s.shellMajor)/ios/\(s.band).json", etag: known > 0 ? "\"\(known)\"" : nil))
+    let code = (resp as? HTTPURLResponse)?.statusCode ?? 0
+    if code == 304 || code == 404 { return ["status": "none"] }
+    try require(code == 200, "pointer HTTP \(code)")
+    guard let envelope = try JSONSerialization.jsonObject(with: data) as? [String: Any],
+          let bodyStr = envelope["body"] as? String, let sig = envelope["signature"] as? String else { throw UpdateError("pointer is not an envelope") }
+
+    let t0 = Store.now()
+    try require(Verify.ed25519(Data(bodyStr.utf8), signatureB64: sig, publicKeyB64: s.publicKey), "pointer signature invalid")
+    guard let body = try JSONSerialization.jsonObject(with: Data(bodyStr.utf8)) as? [String: Any] else { throw UpdateError("pointer body unreadable") }
+    try require(body["platform"] as? String == "ios", "pointer is not for iOS")
+    try require(body["app_id"] as? String == s.appId && body["shell_major"] as? Int == s.shellMajor, "pointer for another app/shell")
+    guard let release = body["release"] as? Int else { throw UpdateError("pointer has no release") }
+    if release <= known { return ["status": "none"] }
+    try require(!Verify.semverLess(s.shellVersion, body["min_shell_version"] as? String ?? "0.0.0"), "shell too old for release \(release)")
+    let verifyPointerMs = (Store.now() - t0) * 1000
+
+    guard let core = body["core"] as? [String: Any], let wantSha = core["sha256"] as? String,
+          let wantSize = (core["size"] as? NSNumber)?.intValue, let url = core["url"] as? String else { throw UpdateError("pointer core incomplete") }
+    let tmp = s.dir.appendingPathComponent("dl-\(release).tmp")
+    try? FileManager.default.removeItem(at: tmp)
+
+    let d0 = Store.now()
+    let (fileURL, dresp) = try await URLSession.shared.download(for: request(resolve(s, url), etag: nil))
+    let dcode = (dresp as? HTTPURLResponse)?.statusCode ?? 0
+    try require(dcode == 200, "bundle HTTP \(dcode)")
+    try FileManager.default.moveItem(at: fileURL, to: tmp)
+    let downloadMs = (Store.now() - d0) * 1000
+
+    let v0 = Store.now()
+    let size = (try? FileManager.default.attributesOfItem(atPath: tmp.path)[.size] as? Int) ?? -1
+    let ok = try (size == wantSize && Verify.sha256Hex(file: tmp) == wantSha)
+    if !ok { try? FileManager.default.removeItem(at: tmp); s.addEvent("verify_failed:\(release)"); throw UpdateError("bundle hash/size mismatch") }
+    let verifyMs = (Store.now() - v0) * 1000 + verifyPointerMs
+
+    let dest = s.dir.appendingPathComponent("r\(release).hbc")
+    try? FileManager.default.removeItem(at: dest)
+    try FileManager.default.moveItem(at: tmp, to: dest)
+    stage(s, dest: dest, release: release, sha: wantSha, issuedAt: body["issued_at"] as? String)
+    return ["status": "staged", "release": release, "bytes": size, "via": "full", "bundleBytes": size,
+            "downloadMs": Int(downloadMs), "verifyMs": Int(verifyMs), "issuedAt": body["issued_at"] as? String ?? ""]
+  }
+
+  /// Synchronous so the lock is never held across a suspension point.
+  private static func stage(_ s: Store, dest: URL, release: Int, sha: String, issuedAt: String?) {
+    Store.lock.lock(); defer { Store.lock.unlock() }
+    if let p = s.pendingPath, p != dest.path { try? FileManager.default.removeItem(atPath: p) }
+    s.pendingPath = dest.path; s.pendingRelease = release; s.trialBoots = 0; s.pendingSha = sha
+    if s.binaryVersion == nil { s.binaryVersion = s.installedBinaryVersion }
+    s.pendingIssuedAt = issuedAt
+  }
+}

package/ios/Verify.swift

@@ -0,0 +1,30 @@
+import CryptoKit
+import Foundation
+
+enum Verify {
+  static func ed25519(_ message: Data, signatureB64: String, publicKeyB64: String) -> Bool {
+    guard let sig = Data(base64Encoded: signatureB64), let raw = Data(base64Encoded: publicKeyB64),
+          let key = try? Curve25519.Signing.PublicKey(rawRepresentation: raw) else { return false }
+    return key.isValidSignature(sig, for: message)
+  }
+
+  static func sha256Hex(_ data: Data) -> String { SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined() }
+
+  static func sha256Hex(file url: URL) throws -> String {
+    let h = try FileHandle(forReadingFrom: url); defer { try? h.close() }
+    var hasher = SHA256()
+    while let chunk = try h.read(upToCount: 64 * 1024), !chunk.isEmpty { hasher.update(data: chunk) }
+    return hasher.finalize().map { String(format: "%02x", $0) }.joined()
+  }
+
+  /// a < b for x.y.z
+  static func semverLess(_ a: String, _ b: String) -> Bool {
+    func parts(_ s: String) -> [Int] { s.split(separator: "-")[0].split(separator: ".").map { Int($0) ?? 0 } }
+    let pa = parts(a), pb = parts(b)
+    for i in 0..<3 {
+      let x = i < pa.count ? pa[i] : 0, y = i < pb.count ? pb[i] : 0
+      if x != y { return x < y }
+    }
+    return false
+  }
+}

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "@shipvo/runtime",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "license": "Apache-2.0",
+  "description": "The Shipvo native runtime: a tiny Expo module that verifies (Ed25519 + SHA-256), downloads (bsdiff patches), stages and applies signed over-the-air releases, with crash-loop rollback. Plus the config plugin that pins the trust root in the native shell.",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "react-native": "./src/index.ts",
+      "browser": "./src/index.web.ts",
+      "default": "./src/index.ts"
+    },
+    "./app.plugin.js": "./app.plugin.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src",
+    "android",
+    "ios",
+    "app.plugin.js",
+    "expo-module.config.json",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "expo": "*",
+    "expo-modules-core": "*",
+    "expo-constants": "*",
+    "react-native": "*"
+  },
+  "peerDependenciesMeta": {
+    "expo-constants": {
+      "optional": true
+    }
+  },
+  "keywords": [
+    "shipvo",
+    "expo",
+    "react-native",
+    "ota",
+    "over-the-air",
+    "updates",
+    "ed25519"
+  ],
+  "homepage": "https://github.com/shipvo/shipvo#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shipvo/shipvo.git",
+    "directory": "packages/runtime"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }

package/src/index.ts

@@ -0,0 +1,42 @@
+import { requireOptionalNativeModule } from "expo-modules-core";
+
+export type RuntimeState = {
+  cohort: number; band: "b0" | "b1" | "b2";
+  runningRelease: number; currentRelease: number; pendingRelease: number; previousRelease: number;
+  blockedRelease?: number; shellVersion?: string;
+  baseUrl: string; appId: string; shellMajor: number;
+};
+export type CheckResult = {
+  status: "none" | "staged" | "error"; release?: number; bytes?: number; downloadMs?: number; verifyMs?: number;
+  /** Shell 1.0.2+ (Android): "patch" when a bsdiff patch was applied, "full" otherwise. iOS always downloads "full". */
+  via?: "patch" | "full"; bundleBytes?: number; patchError?: string | null;
+  issuedAt?: string; error?: string;
+};
+export type HealthyResult = {
+  release: number; coldStartMs: number; sinceLoadMs: number; promoted: boolean;
+  /** Set by shell 1.0.1+: "cold" = first bundle load in this process, "reload" = applied without restart. */
+  kind?: "cold" | "reload";
+};
+
+type Native = {
+  getState(): RuntimeState;
+  checkForUpdate(apply: boolean): Promise<CheckResult>;
+  markHealthy(): HealthyResult;
+  consumeEvents(): string[];
+  rollback(): void;
+  reload(): void;
+};
+
+// The native runtime exists on Android and iOS. Where the module is missing (web, Expo Go, a shell built without it) the
+// app runs its embedded bundle and live content, and still knows its control plane and app id from expo.extra.shipvo.
+const t0 = Date.now();
+let extra: any = {};
+try { extra = require("expo-constants").default?.expoConfig?.extra?.shipvo ?? {}; } catch {}
+const fallback: Native = {
+  getState: () => ({ cohort: 0, band: "b0", runningRelease: 0, currentRelease: 0, pendingRelease: 0, previousRelease: 0,
+    shellVersion: "no-runtime", baseUrl: extra.baseUrl ?? "", appId: extra.appId ?? "", shellMajor: extra.shellMajor ?? 1 }),
+  checkForUpdate: async () => ({ status: "none" }),
+  markHealthy: () => ({ release: 0, coldStartMs: Date.now() - t0, sinceLoadMs: 0, promoted: false, kind: "cold" }),
+  consumeEvents: () => [], rollback: () => {}, reload: () => {},
+};
+export const Runtime: Native = requireOptionalNativeModule<Native>("ShipvoRuntime") ?? fallback;

package/src/index.web.ts

@@ -0,0 +1,18 @@
+// Simulator (web) stand-in for the native runtime: no OTA, no device. The simulator can point content at a
+// control plane by setting globalThis.__PN_SIM__ = { baseUrl, appId } before the app loads.
+import type { CheckResult, HealthyResult, RuntimeState } from "./index";
+export type { CheckResult, HealthyResult, RuntimeState } from "./index";
+
+const sim = (globalThis as any).__PN_SIM__ ?? {};
+const t0 = Date.now();
+export const Runtime = {
+  getState(): RuntimeState {
+    return { cohort: 0, band: "b0", runningRelease: 0, currentRelease: 0, pendingRelease: 0, previousRelease: 0,
+      shellVersion: "simulator", baseUrl: sim.baseUrl ?? "", appId: sim.appId ?? "", shellMajor: 1 };
+  },
+  async checkForUpdate(_apply: boolean): Promise<CheckResult> { return { status: "none" }; },
+  markHealthy(): HealthyResult { return { release: 0, coldStartMs: Date.now() - t0, sinceLoadMs: 0, promoted: false, kind: "cold" }; },
+  consumeEvents(): string[] { return []; },
+  rollback(): void {},
+  reload(): void { (globalThis as any).location?.reload(); },
+};