@shipvo/runtime 0.1.0 → 0.1.1

package/README.md

@@ -5,7 +5,7 @@ The native half of Shipvo's over-the-air updates, as an Expo module.
 - Verifies every release pointer (Ed25519) and bundle (SHA-256 + size) against a public key built into the shell.
 - Downloads bsdiff patches when it has the previous release, full bundles otherwise; stages atomically.
 - Applies without restart, marks the release healthy when the app says so, and discards a release that fails to boot 3 times.
-- Android today; on iOS and in the simulator the app runs its embedded bundle and the same live content.
+- Android and iOS. iOS downloads full bundles (patches are Android-only for now) and is verified on the iOS Simulator in CI; in the web simulator the app runs the same release as the web build.
 
 ```json
 { "expo": { "plugins": [["@shipvo/runtime", { "baseUrl": "https://<your control plane>", "publicKey": "<base64 Ed25519 public key>", "appId": "myshop" }]] } }

package/app.plugin.js

@@ -1,12 +1,19 @@
 // Shipvo config plugin: puts the trust root and control-plane address in the native shell (AndroidManifest
 // meta-data, and expo.extra.shipvo for platforms without the OTA runtime), so an over-the-air bundle can never
 // change which key it is verified against.
-const { withAndroidManifest, AndroidConfig } = require("expo/config-plugins");
+const { withAndroidManifest, withInfoPlist, AndroidConfig } = require("expo/config-plugins");
 
 module.exports = function withShipvo(config, props) {
   const { baseUrl, publicKey, appId, shellMajor = 1 } = props || {};
   if (!baseUrl || !publicKey || !appId) throw new Error("@shipvo/runtime: baseUrl, publicKey and appId are required");
   config.extra = { ...(config.extra ?? {}), shipvo: { baseUrl, appId, shellMajor } };
+  config = withInfoPlist(config, (cfg) => {
+    cfg.modResults.ShipvoBaseURL = baseUrl;
+    cfg.modResults.ShipvoPublicKey = publicKey;
+    cfg.modResults.ShipvoAppId = appId;
+    cfg.modResults.ShipvoShellMajor = String(shellMajor);
+    return cfg;
+  });
   return withAndroidManifest(config, (cfg) => {
     const app = AndroidConfig.Manifest.getMainApplicationOrThrow(cfg.modResults);
     const set = (name, value) => AndroidConfig.Manifest.addMetaDataItemToMainApplication(app, name, String(value));

package/expo-module.config.json

@@ -1,4 +1,19 @@
 {
-  "platforms": ["android"],
-  "android": { "modules": ["dev.shipvo.runtime.ShipvoRuntimeModule"] }
+  "platforms": [
+    "android",
+    "apple"
+  ],
+  "android": {
+    "modules": [
+      "dev.shipvo.runtime.ShipvoRuntimeModule"
+    ]
+  },
+  "apple": {
+    "modules": [
+      "ShipvoRuntimeModule"
+    ],
+    "reactDelegateHandlers": [
+      "ShipvoReactDelegateHandler"
+    ]
+  }
 }

package/ios/BundleSelector.swift

@@ -0,0 +1,92 @@
+import Foundation
+
+/// The bundle-choice rules. Kept free of Expo and React imports so they run under `swift test` on a plain Mac.
+enum ShipvoBundleSelector {
+  static let maxBoots = 3
+  static let windowSeconds: TimeInterval = 60
+
+  /// Idempotent per load: React Native asks for the URL more than once, and only the first ask counts as a boot.
+  static func select(_ s: Store) -> URL? {
+    Store.lock.lock(); defer { Store.lock.unlock() }
+    if Store.selection.set { return Store.selection.url }
+    let url = choose(s)
+    Store.selection = (url, true)
+    return url
+  }
+
+  /// The app reports a healthy start: a pending release that is the one running becomes current. Returns whether it was promoted.
+  @discardableResult
+  static func promoteIfRunning(_ s: Store) -> Bool {
+    Store.lock.lock(); defer { Store.lock.unlock() }
+    var promoted = false
+    if s.pendingRelease != 0 && Store.runningRelease == s.pendingRelease {
+      if let old = s.previousPath, old != s.currentPath { remove(old) }
+      s.previousRelease = s.currentRelease; s.previousPath = s.currentPath
+      s.currentRelease = s.pendingRelease; s.currentPath = s.pendingPath; s.currentSha = s.pendingSha
+      s.pendingRelease = 0; s.pendingPath = nil; s.trialBoots = 0
+      s.addEvent("applied:\(s.currentRelease)")
+      promoted = true
+    }
+    s.unhealthyBoots = 0; s.firstUnhealthyAt = 0
+    return promoted
+  }
+
+  /// Called before a reload so the next ask is a fresh load.
+  static func invalidate() { Store.lock.lock(); Store.selection = (nil, false); Store.lock.unlock() }
+
+  private static func exists(_ path: String?) -> Bool { path != nil && FileManager.default.fileExists(atPath: path!) }
+  private static func remove(_ path: String?) { if let p = path { try? FileManager.default.removeItem(atPath: p) } }
+
+  private static func choose(_ s: Store) -> URL? {
+    Store.bundleSelectedAt = Store.now()
+    Store.loadsInProcess += 1
+
+    let installed = s.installedBinaryVersion
+    if s.binaryVersion != installed {
+      let hadBundles = s.currentPath != nil || s.pendingPath != nil
+      s.resetForNewShell()
+      if hadBundles { s.addEvent("shell_changed:0") }
+    }
+
+    if let pending = s.pendingPath {
+      if s.trialBoots >= maxBoots || !exists(pending) {
+        s.addEvent("crash_loop_revert:\(s.pendingRelease)")
+        s.block(s.pendingRelease)
+        remove(pending)
+        s.pendingPath = nil; s.pendingRelease = 0; s.trialBoots = 0
+      } else {
+        s.trialBoots += 1
+        Store.runningRelease = s.pendingRelease
+        return URL(fileURLWithPath: pending)
+      }
+    }
+
+    if exists(s.currentPath) {
+      let now = Store.now()
+      if now - s.firstUnhealthyAt > windowSeconds { s.firstUnhealthyAt = now; s.unhealthyBoots = 0 }
+      s.unhealthyBoots += 1
+      if s.unhealthyBoots > maxBoots {
+        s.addEvent("crash_loop_revert:\(s.currentRelease)")
+        s.block(s.currentRelease)
+        revertToPrevious(s)
+        return currentOrEmbedded(s)
+      }
+      Store.runningRelease = s.currentRelease
+      return URL(fileURLWithPath: s.currentPath!)
+    }
+    Store.runningRelease = 0
+    return nil // the embedded bundle
+  }
+
+  private static func currentOrEmbedded(_ s: Store) -> URL? {
+    if exists(s.currentPath) { Store.runningRelease = s.currentRelease; return URL(fileURLWithPath: s.currentPath!) }
+    Store.runningRelease = 0; return nil
+  }
+
+  static func revertToPrevious(_ s: Store) {
+    if let c = s.currentPath, c != s.previousPath { remove(c) }
+    s.currentPath = s.previousPath; s.currentRelease = s.previousRelease; s.currentSha = nil
+    s.previousPath = nil; s.previousRelease = 0
+    s.unhealthyBoots = 0; s.firstUnhealthyAt = 0
+  }
+}

package/ios/ShipvoReactDelegateHandler.swift

@@ -0,0 +1,16 @@
+import ExpoModulesCore
+import Foundation
+
+/// Chooses the JS bundle at load. Order: a staged (pending) release on trial, else the last good release, else the
+/// bundle embedded in the app (returning nil lets React Native use main.jsbundle). A pending release that does not
+/// reach markHealthy within 3 loads is discarded; a current release that loads unhealthy 3 times inside 60 s falls
+/// back to the previous one. Same rules as the Android host handler.
+public final class ShipvoReactDelegateHandler: ExpoReactDelegateHandler {
+  public override func bundleURL(reactDelegate: ExpoReactDelegate) -> URL? {
+#if DEBUG
+    return nil // development builds load from Metro
+#else
+    return ShipvoBundleSelector.select(Store())
+#endif
+  }
+}

package/ios/ShipvoRuntime.podspec

@@ -0,0 +1,25 @@
+require 'json'
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name           = 'ShipvoRuntime'
+  s.version        = package['version']
+  s.summary        = package['description']
+  s.description    = package['description']
+  s.license        = package['license']
+  s.author         = 'Shipvo'
+  s.homepage       = 'https://shipvo.dev'
+  s.platforms      = { :ios => '16.4' }
+  s.swift_version  = '5.9'
+  s.source         = { git: 'https://github.com/shipvo/shipvo.git' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+  s.dependency 'React-Core'
+
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+  s.source_files = '**/*.{h,m,swift}'
+end

package/ios/ShipvoRuntimeModule.swift

@@ -0,0 +1,72 @@
+import ExpoModulesCore
+import Foundation
+import React
+
+/// JS-facing runtime: getState / checkForUpdate / markHealthy / consumeEvents / rollback / reload.
+/// Same contract as the Android module so `Runtime` in src/index.ts is platform-neutral.
+public final class ShipvoRuntimeModule: Module {
+  public func definition() -> ModuleDefinition {
+    Name("ShipvoRuntime")
+
+    Function("getState") { () -> [String: Any] in
+      let s = Store()
+      var out: [String: Any] = [
+        "cohort": s.cohort, "band": s.band,
+        "runningRelease": Store.runningRelease, "currentRelease": s.currentRelease,
+        "pendingRelease": s.pendingRelease, "previousRelease": s.previousRelease,
+        "shellVersion": s.installedBinaryVersion,
+        "baseUrl": s.baseUrl, "appId": s.appId, "shellMajor": s.shellMajor,
+      ]
+      if s.blockedRelease != 0 { out["blockedRelease"] = s.blockedRelease }
+      return out
+    }
+
+    AsyncFunction("checkForUpdate") { (apply: Bool) async -> [String: Any] in
+      let r: [String: Any]
+      do { r = try await Updater.check(Store()) }
+      catch { r = ["status": "error", "error": (error as? UpdateError)?.message ?? error.localizedDescription] }
+      if apply, r["status"] as? String == "staged" { Self.reloadHost() }
+      return r
+    }
+
+    Function("markHealthy") { () -> [String: Any] in
+      let s = Store()
+      let now = Store.now()
+      let coldStart = max(0, (Date().timeIntervalSince1970 - Self.processStart()) * 1000)
+      let sinceLoad = Store.bundleSelectedAt > 0 ? (now - Store.bundleSelectedAt) * 1000 : -1
+      let promoted = ShipvoBundleSelector.promoteIfRunning(s)
+      return ["release": Store.runningRelease, "coldStartMs": Int(coldStart), "sinceLoadMs": Int(sinceLoad), "promoted": promoted,
+              "kind": Store.loadsInProcess <= 1 ? "cold" : "reload"]
+    }
+
+    Function("consumeEvents") { () -> [String] in Store().consumeEvents() }
+
+    Function("rollback") { () in
+      let s = Store()
+      Store.lock.lock()
+      if let p = s.pendingPath { try? FileManager.default.removeItem(atPath: p) }
+      s.pendingPath = nil; s.pendingRelease = 0; s.trialBoots = 0
+      s.addEvent("rolled_back:\(s.currentRelease)")
+      s.block(s.currentRelease)
+      ShipvoBundleSelector.revertToPrevious(s)
+      Store.lock.unlock()
+      Self.reloadHost()
+    }
+
+    Function("reload") { () in Self.reloadHost() }
+  }
+
+  static func reloadHost() {
+    ShipvoBundleSelector.invalidate()
+    DispatchQueue.main.async { RCTTriggerReloadCommandListeners("shipvo-update") }
+  }
+
+  /// Seconds since 1970 at which this process started.
+  static func processStart() -> TimeInterval {
+    var info = kinfo_proc(); var size = MemoryLayout<kinfo_proc>.stride
+    var mib: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()]
+    guard sysctl(&mib, 4, &info, &size, nil, 0) == 0 else { return Date().timeIntervalSince1970 }
+    let t = info.kp_proc.p_un.__p_starttime
+    return TimeInterval(t.tv_sec) + TimeInterval(t.tv_usec) / 1_000_000
+  }
+}

package/ios/Store.swift

@@ -0,0 +1,102 @@
+import Foundation
+
+/// Persistent runtime state. Every bundle decision goes through here so the host handler and the module agree.
+/// Mirrors the Android `Store`: same fields, same meaning.
+final class Store {
+  /// Replaces what the app's Info.plist and file system would say. Tests use it; the app never does.
+  struct Overrides {
+    var suite: String, dir: URL, baseUrl: String, publicKey: String, appId: String, shellMajor: Int, shellVersion: String, binaryVersion: String
+  }
+
+  private let d: UserDefaults
+  private let bundle: Bundle
+  private let o: Overrides?
+
+  init(bundle: Bundle = .main, overrides: Overrides? = nil) {
+    self.bundle = bundle; self.o = overrides
+    self.d = UserDefaults(suiteName: overrides?.suite ?? "shipvo.runtime") ?? .standard
+  }
+
+  var dir: URL {
+    let base = o?.dir ?? FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0].appendingPathComponent("shipvo", isDirectory: true)
+    try? FileManager.default.createDirectory(at: base, withIntermediateDirectories: true)
+    return base
+  }
+
+  // MARK: cohort and band
+  var cohort: Int {
+    if d.object(forKey: "cohort") == nil { d.set(Int.random(in: 0..<1000), forKey: "cohort") }
+    return d.integer(forKey: "cohort")
+  }
+  var band: String { let c = cohort; return c < 10 ? "b0" : (c < 100 ? "b1" : "b2") }
+
+  // MARK: releases
+  var currentRelease: Int { get { d.integer(forKey: "current_release") } set { d.set(newValue, forKey: "current_release") } }
+  var currentPath: String? { get { d.string(forKey: "current_path") } set { d.set(newValue, forKey: "current_path") } }
+  var currentSha: String? { get { d.string(forKey: "current_sha") } set { d.set(newValue, forKey: "current_sha") } }
+  var previousRelease: Int { get { d.integer(forKey: "previous_release") } set { d.set(newValue, forKey: "previous_release") } }
+  var previousPath: String? { get { d.string(forKey: "previous_path") } set { d.set(newValue, forKey: "previous_path") } }
+  var pendingRelease: Int { get { d.integer(forKey: "pending_release") } set { d.set(newValue, forKey: "pending_release") } }
+  var pendingPath: String? { get { d.string(forKey: "pending_path") } set { d.set(newValue, forKey: "pending_path") } }
+  var pendingSha: String? { get { d.string(forKey: "pending_sha") } set { d.set(newValue, forKey: "pending_sha") } }
+  var pendingIssuedAt: String? { get { d.string(forKey: "pending_issued_at") } set { d.set(newValue, forKey: "pending_issued_at") } }
+  /// Highest release this device refused (crash-looped or rolled back). Only newer releases are fetched.
+  var blockedRelease: Int { get { d.integer(forKey: "blocked_release") } set { d.set(newValue, forKey: "blocked_release") } }
+  /// Shell binary the stored OTA bundles were downloaded under.
+  var binaryVersion: String? { get { d.string(forKey: "binary_version") } set { d.set(newValue, forKey: "binary_version") } }
+  func block(_ release: Int) { if release > blockedRelease { blockedRelease = release } }
+
+  var trialBoots: Int { get { d.integer(forKey: "trial_boots") } set { d.set(newValue, forKey: "trial_boots") } }
+  var unhealthyBoots: Int { get { d.integer(forKey: "unhealthy_boots") } set { d.set(newValue, forKey: "unhealthy_boots") } }
+  var firstUnhealthyAt: Double { get { d.double(forKey: "first_unhealthy_at") } set { d.set(newValue, forKey: "first_unhealthy_at") } }
+
+  var installedBinaryVersion: String {
+    if let o { return o.binaryVersion }
+    let v = bundle.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.0.0"
+    let b = bundle.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "0"
+    return "\(v)/\(b)"
+  }
+  /// The marketing version alone, compared against `min_shell_version`.
+  var shellVersion: String { if let o { return o.shellVersion }; return bundle.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.0.0" }
+
+  /// After a shell (app binary) update, bundles built for the old native code must not run.
+  func resetForNewShell() {
+    if let files = try? FileManager.default.contentsOfDirectory(at: dir, includingPropertiesForKeys: nil) {
+      for f in files { try? FileManager.default.removeItem(at: f) }
+    }
+    for k in ["current_release", "current_path", "current_sha", "previous_release", "previous_path", "pending_release", "pending_path",
+              "pending_sha", "pending_issued_at", "trial_boots", "unhealthy_boots", "first_unhealthy_at", "blocked_release"] { d.removeObject(forKey: k) }
+    binaryVersion = installedBinaryVersion
+  }
+
+  // MARK: events
+  func addEvent(_ e: String) {
+    var list = (d.string(forKey: "events") ?? "").split(separator: "\n").map(String.init).filter { !$0.isEmpty }
+    list = Array(list.suffix(49)) + [e]
+    d.set(list.joined(separator: "\n"), forKey: "events")
+  }
+  func consumeEvents() -> [String] {
+    let list = (d.string(forKey: "events") ?? "").split(separator: "\n").map(String.init).filter { !$0.isEmpty }
+    d.removeObject(forKey: "events"); return list
+  }
+
+  // MARK: trust root (Info.plist, written by the config plugin; an OTA bundle cannot change these)
+  private func plist(_ key: String) -> String? { bundle.object(forInfoDictionaryKey: key) as? String }
+  var baseUrl: String { var s = o?.baseUrl ?? plist("ShipvoBaseURL") ?? ""; while s.hasSuffix("/") { s.removeLast() }; return s }
+  var publicKey: String { o?.publicKey ?? plist("ShipvoPublicKey") ?? "" }
+  var appId: String { o?.appId ?? plist("ShipvoAppId") ?? "" }
+  var shellMajor: Int { if let o { return o.shellMajor }; return Int(plist("ShipvoShellMajor") ?? "1") ?? 1 }
+
+  // MARK: per-process state
+  /// Which release the JS running right now came from (set when the bundle is selected).
+  static var runningRelease = 0
+  static var bundleSelectedAt: TimeInterval = 0
+  /// How many times a bundle was selected in this process: 1 = cold start, more = in-process reload.
+  static var loadsInProcess = 0
+  /// The URL chosen for the current load. React Native asks for the bundle URL more than once per load,
+  /// so the choice (and its trial-boot accounting) is made once and cached until a reload clears it.
+  static var selection: (url: URL?, set: Bool) = (nil, false)
+  static let lock = NSRecursiveLock()
+
+  static func now() -> TimeInterval { ProcessInfo.processInfo.systemUptime }
+}

package/ios/Updater.swift

@@ -0,0 +1,73 @@
+import Foundation
+
+struct UpdateError: Error { let message: String; init(_ m: String) { message = m } }
+
+/// Fetch, verify and stage the newest signed release for this device's band. Mirrors Android `check()`.
+/// iOS downloads full bundles only for now; a pointer's `patches` are ignored (an Android-only optimisation).
+enum Updater {
+  private static func require(_ cond: Bool, _ msg: @autoclosure () -> String) throws { if !cond { throw UpdateError(msg()) } }
+
+  private static func request(_ url: String, etag: String?) throws -> URLRequest {
+    guard let u = URL(string: url) else { throw UpdateError("bad url \(url)") }
+    var r = URLRequest(url: u, cachePolicy: .reloadIgnoringLocalCacheData, timeoutInterval: 30)
+    if let etag { r.setValue(etag, forHTTPHeaderField: "If-None-Match") }
+    return r
+  }
+
+  private static func resolve(_ s: Store, _ url: String) -> String { url.hasPrefix("http") ? url : "\(s.baseUrl)/\(url.drop(while: { $0 == "/" }))" }
+
+  static func check(_ s: Store) async throws -> [String: Any] {
+    try require(!s.baseUrl.isEmpty && !s.publicKey.isEmpty && !s.appId.isEmpty, "runtime not configured")
+    let known = max(s.currentRelease, s.pendingRelease, s.blockedRelease)
+    let (data, resp) = try await URLSession.shared.data(for: request("\(s.baseUrl)/p/\(s.appId)/\(s.shellMajor)/ios/\(s.band).json", etag: known > 0 ? "\"\(known)\"" : nil))
+    let code = (resp as? HTTPURLResponse)?.statusCode ?? 0
+    if code == 304 || code == 404 { return ["status": "none"] }
+    try require(code == 200, "pointer HTTP \(code)")
+    guard let envelope = try JSONSerialization.jsonObject(with: data) as? [String: Any],
+          let bodyStr = envelope["body"] as? String, let sig = envelope["signature"] as? String else { throw UpdateError("pointer is not an envelope") }
+
+    let t0 = Store.now()
+    try require(Verify.ed25519(Data(bodyStr.utf8), signatureB64: sig, publicKeyB64: s.publicKey), "pointer signature invalid")
+    guard let body = try JSONSerialization.jsonObject(with: Data(bodyStr.utf8)) as? [String: Any] else { throw UpdateError("pointer body unreadable") }
+    try require(body["platform"] as? String == "ios", "pointer is not for iOS")
+    try require(body["app_id"] as? String == s.appId && body["shell_major"] as? Int == s.shellMajor, "pointer for another app/shell")
+    guard let release = body["release"] as? Int else { throw UpdateError("pointer has no release") }
+    if release <= known { return ["status": "none"] }
+    try require(!Verify.semverLess(s.shellVersion, body["min_shell_version"] as? String ?? "0.0.0"), "shell too old for release \(release)")
+    let verifyPointerMs = (Store.now() - t0) * 1000
+
+    guard let core = body["core"] as? [String: Any], let wantSha = core["sha256"] as? String,
+          let wantSize = (core["size"] as? NSNumber)?.intValue, let url = core["url"] as? String else { throw UpdateError("pointer core incomplete") }
+    let tmp = s.dir.appendingPathComponent("dl-\(release).tmp")
+    try? FileManager.default.removeItem(at: tmp)
+
+    let d0 = Store.now()
+    let (fileURL, dresp) = try await URLSession.shared.download(for: request(resolve(s, url), etag: nil))
+    let dcode = (dresp as? HTTPURLResponse)?.statusCode ?? 0
+    try require(dcode == 200, "bundle HTTP \(dcode)")
+    try FileManager.default.moveItem(at: fileURL, to: tmp)
+    let downloadMs = (Store.now() - d0) * 1000
+
+    let v0 = Store.now()
+    let size = (try? FileManager.default.attributesOfItem(atPath: tmp.path)[.size] as? Int) ?? -1
+    let ok = try (size == wantSize && Verify.sha256Hex(file: tmp) == wantSha)
+    if !ok { try? FileManager.default.removeItem(at: tmp); s.addEvent("verify_failed:\(release)"); throw UpdateError("bundle hash/size mismatch") }
+    let verifyMs = (Store.now() - v0) * 1000 + verifyPointerMs
+
+    let dest = s.dir.appendingPathComponent("r\(release).hbc")
+    try? FileManager.default.removeItem(at: dest)
+    try FileManager.default.moveItem(at: tmp, to: dest)
+    stage(s, dest: dest, release: release, sha: wantSha, issuedAt: body["issued_at"] as? String)
+    return ["status": "staged", "release": release, "bytes": size, "via": "full", "bundleBytes": size,
+            "downloadMs": Int(downloadMs), "verifyMs": Int(verifyMs), "issuedAt": body["issued_at"] as? String ?? ""]
+  }
+
+  /// Synchronous so the lock is never held across a suspension point.
+  private static func stage(_ s: Store, dest: URL, release: Int, sha: String, issuedAt: String?) {
+    Store.lock.lock(); defer { Store.lock.unlock() }
+    if let p = s.pendingPath, p != dest.path { try? FileManager.default.removeItem(atPath: p) }
+    s.pendingPath = dest.path; s.pendingRelease = release; s.trialBoots = 0; s.pendingSha = sha
+    if s.binaryVersion == nil { s.binaryVersion = s.installedBinaryVersion }
+    s.pendingIssuedAt = issuedAt
+  }
+}

package/ios/Verify.swift

@@ -0,0 +1,30 @@
+import CryptoKit
+import Foundation
+
+enum Verify {
+  static func ed25519(_ message: Data, signatureB64: String, publicKeyB64: String) -> Bool {
+    guard let sig = Data(base64Encoded: signatureB64), let raw = Data(base64Encoded: publicKeyB64),
+          let key = try? Curve25519.Signing.PublicKey(rawRepresentation: raw) else { return false }
+    return key.isValidSignature(sig, for: message)
+  }
+
+  static func sha256Hex(_ data: Data) -> String { SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined() }
+
+  static func sha256Hex(file url: URL) throws -> String {
+    let h = try FileHandle(forReadingFrom: url); defer { try? h.close() }
+    var hasher = SHA256()
+    while let chunk = try h.read(upToCount: 64 * 1024), !chunk.isEmpty { hasher.update(data: chunk) }
+    return hasher.finalize().map { String(format: "%02x", $0) }.joined()
+  }
+
+  /// a < b for x.y.z
+  static func semverLess(_ a: String, _ b: String) -> Bool {
+    func parts(_ s: String) -> [Int] { s.split(separator: "-")[0].split(separator: ".").map { Int($0) ?? 0 } }
+    let pa = parts(a), pb = parts(b)
+    for i in 0..<3 {
+      let x = i < pa.count ? pa[i] : 0, y = i < pb.count ? pb[i] : 0
+      if x != y { return x < y }
+    }
+    return false
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipvo/runtime",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "license": "Apache-2.0",
   "description": "The Shipvo native runtime: a tiny Expo module that verifies (Ed25519 + SHA-256), downloads (bsdiff patches), stages and applies signed over-the-air releases, with crash-loop rollback. Plus the config plugin that pins the trust root in the native shell.",
   "main": "src/index.ts",
@@ -18,6 +18,7 @@
   "files": [
     "src",
     "android",
+    "ios",
     "app.plugin.js",
     "expo-module.config.json",
     "README.md"

package/src/index.ts

@@ -8,7 +8,7 @@ export type RuntimeState = {
 };
 export type CheckResult = {
   status: "none" | "staged" | "error"; release?: number; bytes?: number; downloadMs?: number; verifyMs?: number;
-  /** Shell 1.0.2+: "patch" when a bsdiff patch was applied, "full" otherwise. */
+  /** Shell 1.0.2+ (Android): "patch" when a bsdiff patch was applied, "full" otherwise. iOS always downloads "full". */
   via?: "patch" | "full"; bundleBytes?: number; patchError?: string | null;
   issuedAt?: string; error?: string;
 };
@@ -27,8 +27,8 @@ type Native = {
   reload(): void;
 };
 
-// The OTA runtime is Android-only for now. On iOS the app runs on its embedded bundle and live content; it still
-// knows its control plane and app id from the config the plugin writes into expo.extra.shipvo.
+// The native runtime exists on Android and iOS. Where the module is missing (web, Expo Go, a shell built without it) the
+// app runs its embedded bundle and live content, and still knows its control plane and app id from expo.extra.shipvo.
 const t0 = Date.now();
 let extra: any = {};
 try { extra = require("expo-constants").default?.expoConfig?.extra?.shipvo ?? {}; } catch {}