expo-modules-jsi 57.0.0 → 57.0.2

package/CHANGELOG.md

@@ -10,6 +10,26 @@
 
 ### 💡 Others
 
+## 57.0.2 — 2026-07-15
+
+### 🎉 New features
+
+- [iOS] Add `JavaScriptRef.withValue`, a non-consuming borrow accessor that reads the referenced value without taking it, so a long-lived reference can be read repeatedly. ([#47238](https://github.com/expo/expo/pull/47238) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Add `JavaScriptRuntime.longLivedObjects`, a `LongLivedObjectCollection` that keeps `LongLivedObject`s (such as in-flight promises) alive across asynchronous boundaries and releases any that remain when the runtime is torn down. ([#47511](https://github.com/expo/expo/pull/47511) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Add a `JavaScriptCodable` conformance for `Date`: it encodes to a JS `Date` and decodes from a JS `Date`, a number of milliseconds since the epoch, or a string parsed by the JS engine's `Date` constructor. ([#47602](https://github.com/expo/expo/pull/47602) by [@tsapeta](https://github.com/tsapeta))
+
+### 🐛 Bug fixes
+
+- [iOS] Fixed a use-after-free when a `JavaScriptPromise` outlives its runtime (e.g. an async function's promise held by a completion handler that fires after `reloadAsync()`) by having the runtime's `LongLivedObjectCollection` own its JSI values and release them on the JavaScript thread when the wrapper is dropped or at teardown, instead of against a freed runtime. ([#47521](https://github.com/expo/expo/pull/47521) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Preserve the `code` on the JavaScript error when an async function rejects with a `JavaScriptThrowable` (e.g. an `Exception`), instead of stringifying it and dropping the `code`, mirroring the synchronous throw path. ([#47259](https://github.com/expo/expo/pull/47259) by [@wwdrew](https://github.com/wwdrew))
+- [iOS] Fixed a standalone `JavaScriptRuntime` leaking its underlying Hermes runtime: a runtime it creates itself is now destroyed on `deinit`, while runtimes adopted from elsewhere (e.g. React Native) are left untouched. ([#47515](https://github.com/expo/expo/pull/47515) by [@tsapeta](https://github.com/tsapeta))
+
+## 57.0.1 — 2026-07-07
+
+### 🐛 Bug fixes
+
+- [iOS] Return `NSNull` instead of trapping in the deprecated `JavaScriptValue.getAny()` when it encounters a unrepresentable value. ([#47381](https://github.com/expo/expo/pull/47381) by [@alanjhughes](https://github.com/alanjhughes))
+
 ## 57.0.0 — 2026-06-25
 
 ### 🛠 Breaking changes
@@ -52,6 +72,7 @@
 
 ### 🐛 Bug fixes
 
+- [iOS] Fixed `Build ExpoModulesJSI xcframework` build phase failing on Xcode 26 because the nested SwiftPM build ignored `-derivedDataPath` and wrote products outside the expected location. ([#46326](https://github.com/expo/expo/issues/46326) by [@Kurogoma4D](https://github.com/Kurogoma4D))
 - [iOS] Fixed the xcframework build failing with a `sed` error when building in an environment that uses GNU `sed` instead of BSD `sed` (e.g. a Nix shell). ([#46389](https://github.com/expo/expo/pull/46389) by [@niteshbalusu11](https://github.com/niteshbalusu11))
 - [iOS] Propagate `JavaScriptPromise` setup failures instead of trapping the app. ([#46106](https://github.com/expo/expo/issues/46106) by [@qutrek](https://github.com/qutrek)) ([#46145](https://github.com/expo/expo/pull/46145) by [@mvincentong](https://github.com/mvincentong))
 - Fix build framework for macOS ([#46413](https://github.com/expo/expo/pull/46413) by [@gabrieldonadel](https://github.com/gabrieldonadel))

package/apple/Sources/ExpoModulesJSI/Coding/JavaScriptCodable+Date.swift

@@ -0,0 +1,70 @@
+// Copyright 2025-present 650 Industries. All rights reserved.
+
+import Foundation
+
+// `Date` encodes to a JS `Date` and decodes from a JS `Date`, a number of milliseconds since the epoch,
+// or a string. Strings are parsed by the runtime's own `new Date(str)` (so parsing is identical on every
+// platform, with no native date parser to maintain), which inherits JS's quirks: a zone-less string is
+// read as local time, and an unparseable one becomes an `Invalid Date` (`NaN`), decoded as a thrown error.
+// A `Date` is an absolute instant with no timezone/calendar; resolution is milliseconds.
+
+extension Date: JavaScriptCodable {
+  @JavaScriptActor
+  @inlinable
+  public static func decode(_ value: borrowing JavaScriptValue, in runtime: borrowing JavaScriptRuntime) throws -> Date
+  {
+    // The cheap tag checks come before `is("Date")`, which does a global lookup plus an `instanceof`
+    // walk; a number or string can't be a `Date`, so the order is behavior-neutral.
+    if value.isNumber() {
+      return try dateFromMilliseconds(value.getDouble())
+    }
+    if value.isString() {
+      let dateConstructor = try runtime.global().getPropertyAsFunction("Date")
+      let constructed = try dateConstructor.callAsConstructor(value.copy()).asObject()
+      return try dateFromMilliseconds(constructed.callFunction("getTime").asDouble())
+    }
+    if value.is("Date") {
+      return try dateFromMilliseconds(value.asObject().callFunction("getTime").asDouble())
+    }
+    throw InvalidDateException()
+  }
+
+  @JavaScriptActor
+  @inlinable
+  public static func encode(_ value: Date, in runtime: borrowing JavaScriptRuntime) throws -> JavaScriptValue {
+    let milliseconds = value.timeIntervalSince1970 * 1000.0
+    let dateConstructor = try runtime.global().getPropertyAsFunction("Date")
+    // Typed explicitly so the variadic `callAsConstructor` overload is chosen over the `JavaScriptValuesBuffer?` one.
+    let millisecondsValue: JavaScriptValue = .number(milliseconds)
+    return try dateConstructor.callAsConstructor(millisecondsValue)
+  }
+}
+
+/// The largest magnitude, in milliseconds, a JS `Date` can represent (100,000,000 days from the epoch,
+/// ECMAScript TimeClip); a value beyond it is an `Invalid Date`.
+@usableFromInline
+let maxJavaScriptDateMilliseconds: Double = 8_640_000_000_000_000
+
+/// Builds a `Date` from a milliseconds value, applying the JS `Date` constructor's TimeClip: a non-finite
+/// or out-of-range value throws, an in-range one is truncated toward zero. This keeps the number branch
+/// faithful to `new Date(number)`; the `Date`/string branches pass an already-clipped `getTime()` through.
+@usableFromInline
+func dateFromMilliseconds(_ milliseconds: Double) throws -> Date {
+  guard milliseconds.isFinite, abs(milliseconds) <= maxJavaScriptDateMilliseconds else {
+    throw InvalidDateException()
+  }
+  return Date(timeIntervalSince1970: milliseconds.rounded(.towardZero) / 1000.0)
+}
+
+/// Thrown when a JavaScript value can't be converted to a `Date`. Named after JS's own "Invalid Date".
+public struct InvalidDateException: JavaScriptThrowable {
+  @usableFromInline
+  init() {}
+
+  public var code: String {
+    "ERR_INVALID_DATE"
+  }
+  public var message: String {
+    "Cannot convert the JavaScript value to a Date because it is not a Date, a number of milliseconds since the epoch, or a parseable date string"
+  }
+}

package/apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRef.swift

@@ -52,6 +52,18 @@ public final class JavaScriptRef<T: JavaScriptType & ~Copyable>: JavaScriptType,
     return value.take()
   }
 
+  /// Borrows the referenced value for the duration of `body` without consuming it, so the reference
+  /// keeps holding the value and can be read again. `body` receives the value as a borrow, or `nil` when
+  /// the reference is empty (already taken, released, or never set), and its result is returned as-is.
+  /// Use this instead of `take()` when the value must stay in the reference (e.g. a long-lived ref read
+  /// repeatedly).
+  ///
+  /// `body` returns `R` directly (rather than this method wrapping it in `R?`) so the result can itself
+  /// be a non-`Copyable` optional like `JavaScriptObject?`, which can't be nested inside another optional.
+  public func withValue<R: ~Copyable>(_ body: (borrowing T?) throws -> R?) rethrows -> R? {
+    return try body(value)
+  }
+
   /// Takes the value as a `JavaScriptValue`. Returns `undefined` value if the reference does not hold any value.
   public func asValue() -> JavaScriptValue {
     return take()?.asValue() ?? .undefined

package/apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRuntime.swift

@@ -38,6 +38,12 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
   internal let runtimePointee: facebook.jsi.Runtime
   internal let scheduler: expo.RuntimeScheduler
 
+  /// Whether this wrapper owns the underlying `jsi::Runtime` and must destroy it on `deinit`. True
+  /// only for the standalone `init()`, which creates the runtime via `createHermesRuntime()`. The
+  /// other initializers adopt a runtime owned elsewhere (e.g. React Native), which must never be
+  /// freed here, matching the immortal (no-op) release semantics of the imported reference type.
+  private let ownsRuntime: Bool
+
   /// Thread ID of the JavaScript thread, captured at construction time. Used by `isOnJavaScriptThread()`
   /// for a fast integer comparison instead of `Thread.current.name == "..."`.
   /// Assumes runtime initializers always run on the JS thread.
@@ -57,6 +63,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler()
+    self.ownsRuntime = false
+    installLongLivedObjectsTeardown()
   }
 
   /// Creates a standalone Hermes runtime. Scheduled tasks run synchronously —
@@ -66,6 +74,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler()
+    self.ownsRuntime = true
+    installLongLivedObjectsTeardown()
   }
 
   /// Creates a runtime from a raw pointer to the underlying `facebook.jsi.Runtime`.
@@ -76,6 +86,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler()
+    self.ownsRuntime = false
+    installLongLivedObjectsTeardown()
   }
 
   /// Creates a runtime bound to a host-provided React `RuntimeScheduler`. Calls to
@@ -84,7 +96,11 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
   /// React Native factory uses.
   ///
   /// - `unsafePointer`: raw pointer to the underlying `facebook::jsi::Runtime`.
-  /// - `scheduler`: raw pointer to the `react::RuntimeScheduler` instance.
+  /// - `scheduler`: opaque host-owned handle that `dispatch` resolves to the real
+  ///   scheduler. The React Native factory passes a handle that references the
+  ///   `react::RuntimeScheduler` weakly (see `EXReactSchedulerDispatch.h` in
+  ///   `ExpoModulesCore`), so dispatching after the React instance tore the
+  ///   scheduler down safely drops the task.
   /// - `dispatch`: raw pointer to a C function with signature
   ///   `void (*)(void *scheduler, int priority, void (^callback)())`.
   public init(
@@ -97,6 +113,27 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler(scheduler, fn)
+    self.ownsRuntime = false
+    installLongLivedObjectsTeardown()
+  }
+
+  deinit {
+    // Destroy the runtime only if this wrapper created it (standalone `init()`); adopted runtimes
+    // are owned elsewhere (e.g. React Native) and must not be freed here.
+    guard ownsRuntime else {
+      return
+    }
+    // Release cached JSI objects (e.g. `PropNameID`s) before the runtime goes away. Swift tears
+    // down stored properties only after `deinit` returns, so leaving them for that phase would
+    // destroy them against an already-freed runtime, which JSI forbids: all objects associated with
+    // a runtime must be destroyed before the runtime itself.
+    //
+    // No thread hop is needed. JSI documents that destructors are safe to call from any thread; the
+    // requirement is only that there is no concurrent access, which holds here since `deinit` runs
+    // when the last reference is gone. `deinit` is `nonisolated`, so it can touch the actor-isolated
+    // registry directly given that exclusive access.
+    propNameIdsRegistry.removeAll()
+    expo.destroyRuntime(runtimePointee)
   }
 
   /// Provides scoped access to a raw pointer to the underlying `facebook.jsi.Runtime`.
@@ -637,6 +674,51 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
 
   @JavaScriptActor
   internal var propNameIdsRegistry: [String: JavaScriptPropNameID] = [:]
+
+  // MARK: - Long-lived objects
+
+  /// Registry of JSI objects (such as in-flight promises) that must outlive the native call that
+  /// created them. Cleared when the runtime is torn down so their JSI state is released on the
+  /// JavaScript thread while the runtime is still valid.
+  @JavaScriptActor
+  public let longLivedObjects = LongLivedObjectCollection()
+
+  /// Attaches a native state to a dedicated JS object whose deallocator clears ``longLivedObjects``
+  /// when the runtime is torn down. The object is pinned by storing it as a property on `global`, so
+  /// it stays reachable within the JavaScript heap for the runtime's whole life (no Swift-side strong
+  /// reference) and its native state drops only when the runtime's object graph is destroyed. That
+  /// fires the deallocator on the JavaScript thread while the runtime is still valid, the point at
+  /// which any surviving long-lived objects can safely release their JSI state.
+  private func installLongLivedObjectsTeardown() {
+    // Runtime initializers run on the JavaScript thread but aren't actor-isolated, so reach the
+    // isolated object/native-state/`clear()` APIs through the actor.
+    JavaScriptActor.assumeIsolated {
+      // Capture the collection strongly, not `self`: teardown may run as the runtime itself
+      // deallocates, and the sweep must still call `allowRelease()` on survivors. Holding the
+      // collection keeps it alive for the sweep; it does not retain the runtime.
+      let longLivedObjects = self.longLivedObjects
+      let nativeState = JavaScriptNativeState()
+      nativeState.setDeallocator { nativeState in
+        // Fires as the teardown object is released on the JavaScript thread with the runtime still
+        // valid, so releasing JSI state here is safe. Mirrors the caveat on `AppContext.NativeState`:
+        // a future cross-runtime path that could drop this state from another thread would have to
+        // hop back to the JavaScript thread first.
+        JavaScriptActor.assumeIsolated {
+          longLivedObjects.clear()
+        }
+      }
+      let object = createObject()
+      object.setNativeState(nativeState)
+      // Pin via a JS-heap reference on `global` rather than a Swift property, so the object's
+      // lifetime is governed by the runtime's object graph. The property name is unique per wrapper
+      // (keyed by this wrapper's address), so several wrappers of the same underlying runtime (e.g.
+      // via `init(unsafePointer:)`) each pin their own teardown object instead of overwriting a
+      // shared slot, which would let one wrapper's collection be swept early while the runtime is
+      // still alive.
+      let wrapperAddress = UInt(bitPattern: Unmanaged.passUnretained(self).toOpaque())
+      global().setProperty("__expo_long_lived_objects_teardown_\(wrapperAddress)__", value: object.asValue())
+    }
+  }
 }
 
 private func createFunctionClosure(

package/apple/Sources/ExpoModulesJSI/Runtime/LongLivedObjectCollection.swift

@@ -0,0 +1,46 @@
+/// An object whose lifetime must extend past the native call that created it, such as an in-flight
+/// promise holding its resolve/reject state. Register it with a ``LongLivedObjectCollection``.
+@JavaScriptActor
+public protocol LongLivedObject: AnyObject {
+  /// Called on the JavaScript thread when the runtime tears down while this object is still
+  /// registered, to release any held JSI state. Not called on the normal completion path, where the
+  /// object removes itself after releasing its own state.
+  func allowRelease()
+}
+
+/// Keeps ``LongLivedObject``s alive across asynchronous boundaries and releases any that remain when
+/// the runtime is torn down. Isolated to ``JavaScriptActor``, so it needs no lock.
+@JavaScriptActor
+public final class LongLivedObjectCollection {
+  // Keyed by identity, effectively a set. A dictionary rather than a `Set` because
+  // `any LongLivedObject` is an existential and cannot conform to `Hashable`.
+  private var registeredObjects: [ObjectIdentifier: any LongLivedObject] = [:]
+
+  // `nonisolated` so ``JavaScriptRuntime`` can create one as a stored-property default.
+  internal nonisolated init() {}
+
+  /// Registers an object, keeping it alive until it is removed or the collection is cleared.
+  public func add(_ object: any LongLivedObject) {
+    registeredObjects[ObjectIdentifier(object)] = object
+  }
+
+  /// Removes an object that finished on its own, without calling ``LongLivedObject/allowRelease()``.
+  public func remove(_ object: any LongLivedObject) {
+    registeredObjects[ObjectIdentifier(object)] = nil
+  }
+
+  /// Teardown sweep: calls ``LongLivedObject/allowRelease()`` on every remaining object and empties
+  /// the collection. Must run on the JavaScript thread while the runtime is still valid.
+  public func clear() {
+    let survivors = registeredObjects.values
+    registeredObjects.removeAll()
+    for object in survivors {
+      object.allowRelease()
+    }
+  }
+
+  /// Number of currently registered objects.
+  public var count: Int {
+    return registeredObjects.count
+  }
+}

package/apple/Sources/ExpoModulesJSI/Runtime/Values/JavaScriptError.swift

@@ -50,6 +50,21 @@ public final class JavaScriptError: Error, Sendable {
     }
   }
 
+  /// Returns the `JavaScriptError` representing an arbitrary native error. An existing
+  /// `JavaScriptError` is returned unchanged so its wrapped value reaches JS as-is; a
+  /// `JavaScriptThrowable` is routed through the code-preserving initializer above; any
+  /// other error is stringified into a generic `Error`.
+  @inlinable
+  public static func from(_ error: any Error, in runtime: JavaScriptRuntime) -> JavaScriptError {
+    if let jsError = error as? JavaScriptError {
+      return jsError
+    }
+    if let throwable = error as? JavaScriptThrowable {
+      return JavaScriptError(runtime, from: throwable)
+    }
+    return JavaScriptError(runtime, message: String(describing: error))
+  }
+
   /// Returns the error as a `JavaScriptValue`, which may be an arbitrary value rather than an
   /// `Error` instance when the error was created from one.
   public func toValue() -> JavaScriptValue {

package/apple/Sources/ExpoModulesJSI/Runtime/Values/JavaScriptPromise.swift

@@ -11,46 +11,93 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   private typealias PromiseContinuation = CheckedContinuation<JavaScriptValue.Ref, any Error>
 
   private weak let runtime: JavaScriptRuntime?
-  private var object: JavaScriptObject
   private let deferredPromise = DeferredPromise()
 
-  // Create refs for resolve and reject functions.
-  // They will be set in the Promise setup function.
-  private let resolveFunction = JavaScriptValue.Ref()
-  private let rejectFunction = JavaScriptValue.Ref()
+  /// Owns the promise's JSI values (the object and, for a deferred promise, its resolve/reject
+  /// functions). Registered with the runtime's ``LongLivedObjectCollection`` so they're released on
+  /// the JS thread rather than against a freed runtime when a wrapper outlives its runtime (e.g. an
+  /// async function's promise held by a URLSession delegate).
+  ///
+  /// There are two release paths, both on the JS thread while the runtime is alive:
+  /// - When the ``JavaScriptPromise`` wrapper is dropped, its `deinit` schedules a job that
+  ///   deregisters this state and releases the values, so a stream of promises doesn't pin their
+  ///   objects (and resolution values) until teardown.
+  /// - If the wrapper outlives the runtime, the teardown sweep (``allowRelease()``) releases whatever
+  ///   is still registered before the runtime is destroyed.
+  ///
+  /// The state stays registered for as long as the wrapper is alive, even after the promise settles,
+  /// so ``asValue()`` keeps returning a valid object. Settling only releases the resolve/reject
+  /// functions, which can no longer be called and are the bulk of a deferred promise's held state.
+  @JavaScriptActor
+  private final class LongLivedState: LongLivedObject {
+    // Stored as `JavaScriptValue` (a reference type), not `JavaScriptObject`: a `Copyable` value read
+    // back through `JavaScriptRef.withValue` avoids the copy a borrowed `~Copyable` object would trap on.
+    let object = JavaScriptValue.Ref()
+    let resolveFunction = JavaScriptValue.Ref()
+    let rejectFunction = JavaScriptValue.Ref()
+
+    func allowRelease() {
+      object.release()
+      resolveFunction.release()
+      rejectFunction.release()
+    }
+  }
+
+  private let longLivedState = LongLivedState()
+
+  /// Dropping the wrapper means no native code can settle or read this promise anymore, so release
+  /// its long-lived state. The values can only be touched on the JS thread while the runtime is
+  /// alive, so schedule the work there; if the runtime is already gone, the teardown sweep has
+  /// released everything and there is nothing to do (this is the `#47454` off-thread-drop case).
+  deinit {
+    guard let runtime else {
+      return
+    }
+    // Capture the collection, not the runtime, so a wrapper's deinit can't prolong the runtime's
+    // lifetime by keeping it alive until the scheduled job drains.
+    let longLivedObjects = runtime.longLivedObjects
+    runtime.schedule { [longLivedState] in
+      longLivedObjects.remove(longLivedState)
+      longLivedState.allowRelease()
+    }
+  }
 
   /// Initializes a promise from the existing object. The promise may already be settled.
   /// It cannot be resolved/rejected from the outside, i.e. `resolve` and `reject` functions are no-op.
   @JavaScriptActor
   public init(_ runtime: JavaScriptRuntime, _ object: consuming JavaScriptObject) throws {
     self.runtime = runtime
-    self.object = object
+    longLivedState.object.reset(object.asValue())
     try setUpCallbacks()
+    // Register only after setup succeeds, so a failed initializer (e.g. `then` unavailable) doesn't
+    // leave the state pinned in the collection until teardown. Owns the promise's JSI values from
+    // here until teardown (see `LongLivedState`).
+    runtime.longLivedObjects.add(longLivedState)
   }
 
   /// Creates a new promise whose resolver or rejecter must be called from the outside (also known as a deferred promise).
   @JavaScriptActor
   public init(_ runtime: JavaScriptRuntime) throws {
     self.runtime = runtime
-    // Initialize the non-copyable field before any throwing work. Swift requires a
-    // consistently initialized value on every throwing initializer path.
-    self.object = runtime.createObject()
 
     // Create function that is the promise setup. It is called immediately on `callAsConstructor`.
-    let setup = runtime.createFunction { [weak resolveFunction, weak rejectFunction] this, arguments in
-      resolveFunction?.reset(arguments[0])
-      rejectFunction?.reset(arguments[1])
+    let setup = runtime.createFunction { [weak longLivedState] this, arguments in
+      longLivedState?.resolveFunction.reset(arguments[0])
+      longLivedState?.rejectFunction.reset(arguments[1])
       return .undefined
     }
 
-    self.object =
+    let object =
       try runtime
       .global()
       .getPropertyAsFunction(.cached(runtime, "Promise"))
       .callAsConstructor(setup.asValue())
-      .getObject()
-
+    longLivedState.object.reset(object)
     try setUpCallbacks()
+    // Register only after setup succeeds, so a failed initializer (e.g. `then` unavailable) doesn't
+    // leave the state pinned in the collection until teardown. Owns the promise's JSI values from
+    // here until teardown (see `LongLivedState`).
+    runtime.longLivedObjects.add(longLivedState)
   }
 
   @JavaScriptActor
@@ -59,7 +106,7 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   }
 
   public var isDeferred: Bool {
-    return !resolveFunction.isEmpty && !rejectFunction.isEmpty
+    return !longLivedState.resolveFunction.isEmpty && !longLivedState.rejectFunction.isEmpty
   }
 
   @JavaScriptActor
@@ -68,7 +115,10 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   }
 
   public func asValue() -> JavaScriptValue {
-    return object.asValue()
+    // Read without consuming, so the state keeps owning the object (unlike `Ref.asValue()`).
+    return longLivedState.object.withValue { object in
+      return object
+    } ?? .undefined
   }
 
   public func resolve<V: JavaScriptRepresentable>(_ value: V) {
@@ -77,17 +127,18 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
     }
 
     // `resolve` is not isolated, so make sure to jump to JS thread.
-    runtime.schedule(priority: .immediate) { [resolveFunction, rejectFunction] in
+    runtime.schedule(priority: .immediate) { [longLivedState] in
       // If the promise is already settled, do nothing.
-      guard let resolver = resolveFunction.take() else {
+      guard let resolver = longLivedState.resolveFunction.take() else {
         return
       }
       // Call the actual resolver given in the Promise setup.
       // This will also call `deferredPromise.resolve` in the `then` handler.
       _ = try! resolver.getFunction().call(arguments: value)
 
-      // Release the rejecter, we cannot call it anymore.
-      rejectFunction.release()
+      // The rejecter can't be called anymore. The state stays registered so it keeps owning the
+      // object until the wrapper is dropped (or the teardown sweep runs).
+      longLivedState.rejectFunction.release()
     }
   }
 
@@ -97,23 +148,24 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
     }
 
     // `reject` is not isolated, so make sure to jump to JS thread.
-    runtime.schedule(priority: .immediate) { [resolveFunction, rejectFunction] in
+    runtime.schedule(priority: .immediate) { [longLivedState] in
       // If the promise is already settled, do nothing.
-      guard let rejecter = rejectFunction.take() else {
+      guard let rejecter = longLivedState.rejectFunction.take() else {
         return
       }
-      // A `JavaScriptError` already carries the value to reject with (which may be an arbitrary JS
-      // value rather than an `Error`), so reuse it. Any other native error is stringified into a
-      // generic `Error`.
-      let jsError = error as? JavaScriptError ?? JavaScriptError(runtime, message: String(describing: error))
-      let errorValue = jsError.toValue()
+      // Convert the error to its JavaScript representation. This preserves an existing
+      // `JavaScriptError`'s wrapped value and a `JavaScriptThrowable`'s structured `code`
+      // (mirroring the synchronous throw path in `forwardingSwiftErrorsToJS`), so the `code`
+      // is not lost on async rejection. See `JavaScriptError.from(_:in:)`.
+      let errorValue = JavaScriptError.from(error, in: runtime).toValue()
 
       // Call the actual rejecter given in the Promise setup.
       // This will also call `deferredPromise.reject` in the `then` handler.
       _ = try! rejecter.getFunction().call(arguments: errorValue)
 
-      // Release the resolver, we cannot call it anymore.
-      resolveFunction.release()
+      // The resolver can't be called anymore. The state stays registered so it keeps owning the
+      // object until the wrapper is dropped (or the teardown sweep runs).
+      longLivedState.resolveFunction.release()
     }
   }
 
@@ -140,6 +192,12 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
       }
       return .undefined
     }
-    try object.callFunction(.cached(runtime, "then"), arguments: onFulfilled.asValue(), onRejected.asValue())
+    _ = try longLivedState.object.withValue { object in
+      try object?.getObject().callFunction(
+        .cached(runtime, "then"),
+        arguments: onFulfilled.asValue(),
+        onRejected.asValue()
+      )
+    }
   }
 }

package/apple/Sources/ExpoModulesJSI/Runtime/Values/JavaScriptValue.swift

@@ -208,7 +208,8 @@ public final class JavaScriptValue: JavaScriptType, Equatable, Escapable {
         return result
       }
       if object.isFunction() {
-        FatalError.unimplemented()
+        // Don't trap, callers convert speculatively under `try?`, which can't catch a `fatalError`.
+        return NSNull()
       }
       var result = [String: Any]()
 
@@ -222,7 +223,8 @@ public final class JavaScriptValue: JavaScriptType, Equatable, Escapable {
       }
       return result
     }
-    fatalError("Unsupported value kind: \(kind)")
+    // Unrepresentable kind (e.g. symbol). Don't trap, for the same reason as above.
+    return NSNull()
   }
 
   /// Returns the value as a boolean, or asserts if not a boolean.

package/apple/Sources/ExpoModulesJSI-Cxx/include/JSIUtils.h

@@ -125,6 +125,16 @@ inline bool isHostObject(jsi::IRuntime &runtime, const jsi::Object &object) {
 
 jsi::Runtime* createHermesRuntime();
 
+/**
+ Destroys a `jsi::Runtime` created by `createHermesRuntime()`. Since the runtime is imported into
+ Swift as an immortal reference type (no ARC-managed lifetime), Swift can't `delete` it directly, so
+ the standalone `JavaScriptRuntime` calls this from its `deinit` to free the runtime it owns. Must
+ not be called on a runtime owned elsewhere (e.g. the React Native-provided one).
+ */
+inline void destroyRuntime(jsi::Runtime &runtime) {
+  delete &runtime;
+}
+
 inline jsi::Value evaluateJavaScript(jsi::IRuntime &runtime, const std::shared_ptr<const jsi::Buffer>& buffer, const std::string& sourceURL) {
   return expo::CppError::tryCatch(runtime, ^{
     return runtime.evaluateJavaScript(buffer, sourceURL);

package/apple/Sources/ExpoModulesJSI-Cxx/include/RuntimeScheduler.h

@@ -31,8 +31,9 @@ public:
   using ScheduleTaskCallback = void(^)();
 
   /**
-   Trampoline implemented by the host — casts `nativeScheduler` back to
-   react::RuntimeScheduler* and calls scheduleTask on it. Keeping it as a
+   Trampoline implemented by the host. It resolves `nativeScheduler` (an opaque
+   host-owned handle) to the real react::RuntimeScheduler and calls scheduleTask
+   on it, or drops the task when the scheduler no longer exists. Keeping it as a
    function pointer keeps React types out of this header.
    */
   using ScheduleFn = void (*)(void *nativeScheduler, int priority, ScheduleTaskCallback callback);