expo-modules-jsi 57.0.1 → 57.0.3

package/CHANGELOG.md

@@ -10,6 +10,24 @@
 
 ### 💡 Others
 
+## 57.0.3 — 2026-07-15
+
+_This version does not introduce any user-facing changes._
+
+## 57.0.2 — 2026-07-15
+
+### 🎉 New features
+
+- [iOS] Add `JavaScriptRef.withValue`, a non-consuming borrow accessor that reads the referenced value without taking it, so a long-lived reference can be read repeatedly. ([#47238](https://github.com/expo/expo/pull/47238) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Add `JavaScriptRuntime.longLivedObjects`, a `LongLivedObjectCollection` that keeps `LongLivedObject`s (such as in-flight promises) alive across asynchronous boundaries and releases any that remain when the runtime is torn down. ([#47511](https://github.com/expo/expo/pull/47511) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Add a `JavaScriptCodable` conformance for `Date`: it encodes to a JS `Date` and decodes from a JS `Date`, a number of milliseconds since the epoch, or a string parsed by the JS engine's `Date` constructor. ([#47602](https://github.com/expo/expo/pull/47602) by [@tsapeta](https://github.com/tsapeta))
+
+### 🐛 Bug fixes
+
+- [iOS] Fixed a use-after-free when a `JavaScriptPromise` outlives its runtime (e.g. an async function's promise held by a completion handler that fires after `reloadAsync()`) by having the runtime's `LongLivedObjectCollection` own its JSI values and release them on the JavaScript thread when the wrapper is dropped or at teardown, instead of against a freed runtime. ([#47521](https://github.com/expo/expo/pull/47521) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Preserve the `code` on the JavaScript error when an async function rejects with a `JavaScriptThrowable` (e.g. an `Exception`), instead of stringifying it and dropping the `code`, mirroring the synchronous throw path. ([#47259](https://github.com/expo/expo/pull/47259) by [@wwdrew](https://github.com/wwdrew))
+- [iOS] Fixed a standalone `JavaScriptRuntime` leaking its underlying Hermes runtime: a runtime it creates itself is now destroyed on `deinit`, while runtimes adopted from elsewhere (e.g. React Native) are left untouched. ([#47515](https://github.com/expo/expo/pull/47515) by [@tsapeta](https://github.com/tsapeta))
+
 ## 57.0.1 — 2026-07-07
 
 ### 🐛 Bug fixes
@@ -58,6 +76,7 @@
 
 ### 🐛 Bug fixes
 
+- [iOS] Fixed `Build ExpoModulesJSI xcframework` build phase failing on Xcode 26 because the nested SwiftPM build ignored `-derivedDataPath` and wrote products outside the expected location. ([#46326](https://github.com/expo/expo/issues/46326) by [@Kurogoma4D](https://github.com/Kurogoma4D))
 - [iOS] Fixed the xcframework build failing with a `sed` error when building in an environment that uses GNU `sed` instead of BSD `sed` (e.g. a Nix shell). ([#46389](https://github.com/expo/expo/pull/46389) by [@niteshbalusu11](https://github.com/niteshbalusu11))
 - [iOS] Propagate `JavaScriptPromise` setup failures instead of trapping the app. ([#46106](https://github.com/expo/expo/issues/46106) by [@qutrek](https://github.com/qutrek)) ([#46145](https://github.com/expo/expo/pull/46145) by [@mvincentong](https://github.com/mvincentong))
 - Fix build framework for macOS ([#46413](https://github.com/expo/expo/pull/46413) by [@gabrieldonadel](https://github.com/gabrieldonadel))

package/apple/Sources/ExpoModulesJSI/Coding/JavaScriptCodable+Date.swift

@@ -0,0 +1,70 @@
+// Copyright 2025-present 650 Industries. All rights reserved.
+
+import Foundation
+
+// `Date` encodes to a JS `Date` and decodes from a JS `Date`, a number of milliseconds since the epoch,
+// or a string. Strings are parsed by the runtime's own `new Date(str)` (so parsing is identical on every
+// platform, with no native date parser to maintain), which inherits JS's quirks: a zone-less string is
+// read as local time, and an unparseable one becomes an `Invalid Date` (`NaN`), decoded as a thrown error.
+// A `Date` is an absolute instant with no timezone/calendar; resolution is milliseconds.
+
+extension Date: JavaScriptCodable {
+  @JavaScriptActor
+  @inlinable
+  public static func decode(_ value: borrowing JavaScriptValue, in runtime: borrowing JavaScriptRuntime) throws -> Date
+  {
+    // The cheap tag checks come before `is("Date")`, which does a global lookup plus an `instanceof`
+    // walk; a number or string can't be a `Date`, so the order is behavior-neutral.
+    if value.isNumber() {
+      return try dateFromMilliseconds(value.getDouble())
+    }
+    if value.isString() {
+      let dateConstructor = try runtime.global().getPropertyAsFunction("Date")
+      let constructed = try dateConstructor.callAsConstructor(value.copy()).asObject()
+      return try dateFromMilliseconds(constructed.callFunction("getTime").asDouble())
+    }
+    if value.is("Date") {
+      return try dateFromMilliseconds(value.asObject().callFunction("getTime").asDouble())
+    }
+    throw InvalidDateException()
+  }
+
+  @JavaScriptActor
+  @inlinable
+  public static func encode(_ value: Date, in runtime: borrowing JavaScriptRuntime) throws -> JavaScriptValue {
+    let milliseconds = value.timeIntervalSince1970 * 1000.0
+    let dateConstructor = try runtime.global().getPropertyAsFunction("Date")
+    // Typed explicitly so the variadic `callAsConstructor` overload is chosen over the `JavaScriptValuesBuffer?` one.
+    let millisecondsValue: JavaScriptValue = .number(milliseconds)
+    return try dateConstructor.callAsConstructor(millisecondsValue)
+  }
+}
+
+/// The largest magnitude, in milliseconds, a JS `Date` can represent (100,000,000 days from the epoch,
+/// ECMAScript TimeClip); a value beyond it is an `Invalid Date`.
+@usableFromInline
+let maxJavaScriptDateMilliseconds: Double = 8_640_000_000_000_000
+
+/// Builds a `Date` from a milliseconds value, applying the JS `Date` constructor's TimeClip: a non-finite
+/// or out-of-range value throws, an in-range one is truncated toward zero. This keeps the number branch
+/// faithful to `new Date(number)`; the `Date`/string branches pass an already-clipped `getTime()` through.
+@usableFromInline
+func dateFromMilliseconds(_ milliseconds: Double) throws -> Date {
+  guard milliseconds.isFinite, abs(milliseconds) <= maxJavaScriptDateMilliseconds else {
+    throw InvalidDateException()
+  }
+  return Date(timeIntervalSince1970: milliseconds.rounded(.towardZero) / 1000.0)
+}
+
+/// Thrown when a JavaScript value can't be converted to a `Date`. Named after JS's own "Invalid Date".
+public struct InvalidDateException: JavaScriptThrowable {
+  @usableFromInline
+  init() {}
+
+  public var code: String {
+    "ERR_INVALID_DATE"
+  }
+  public var message: String {
+    "Cannot convert the JavaScript value to a Date because it is not a Date, a number of milliseconds since the epoch, or a parseable date string"
+  }
+}

package/apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRef.swift

@@ -52,6 +52,18 @@ public final class JavaScriptRef<T: JavaScriptType & ~Copyable>: JavaScriptType,
     return value.take()
   }
 
+  /// Borrows the referenced value for the duration of `body` without consuming it, so the reference
+  /// keeps holding the value and can be read again. `body` receives the value as a borrow, or `nil` when
+  /// the reference is empty (already taken, released, or never set), and its result is returned as-is.
+  /// Use this instead of `take()` when the value must stay in the reference (e.g. a long-lived ref read
+  /// repeatedly).
+  ///
+  /// `body` returns `R` directly (rather than this method wrapping it in `R?`) so the result can itself
+  /// be a non-`Copyable` optional like `JavaScriptObject?`, which can't be nested inside another optional.
+  public func withValue<R: ~Copyable>(_ body: (borrowing T?) throws -> R?) rethrows -> R? {
+    return try body(value)
+  }
+
   /// Takes the value as a `JavaScriptValue`. Returns `undefined` value if the reference does not hold any value.
   public func asValue() -> JavaScriptValue {
     return take()?.asValue() ?? .undefined

package/apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRuntime.swift

@@ -38,6 +38,12 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
   internal let runtimePointee: facebook.jsi.Runtime
   internal let scheduler: expo.RuntimeScheduler
 
+  /// Whether this wrapper owns the underlying `jsi::Runtime` and must destroy it on `deinit`. True
+  /// only for the standalone `init()`, which creates the runtime via `createHermesRuntime()`. The
+  /// other initializers adopt a runtime owned elsewhere (e.g. React Native), which must never be
+  /// freed here, matching the immortal (no-op) release semantics of the imported reference type.
+  private let ownsRuntime: Bool
+
   /// Thread ID of the JavaScript thread, captured at construction time. Used by `isOnJavaScriptThread()`
   /// for a fast integer comparison instead of `Thread.current.name == "..."`.
   /// Assumes runtime initializers always run on the JS thread.
@@ -57,6 +63,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler()
+    self.ownsRuntime = false
+    installLongLivedObjectsTeardown()
   }
 
   /// Creates a standalone Hermes runtime. Scheduled tasks run synchronously —
@@ -66,6 +74,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler()
+    self.ownsRuntime = true
+    installLongLivedObjectsTeardown()
   }
 
   /// Creates a runtime from a raw pointer to the underlying `facebook.jsi.Runtime`.
@@ -76,6 +86,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler()
+    self.ownsRuntime = false
+    installLongLivedObjectsTeardown()
   }
 
   /// Creates a runtime bound to a host-provided React `RuntimeScheduler`. Calls to
@@ -84,7 +96,11 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
   /// React Native factory uses.
   ///
   /// - `unsafePointer`: raw pointer to the underlying `facebook::jsi::Runtime`.
-  /// - `scheduler`: raw pointer to the `react::RuntimeScheduler` instance.
+  /// - `scheduler`: opaque host-owned handle that `dispatch` resolves to the real
+  ///   scheduler. The React Native factory passes a handle that references the
+  ///   `react::RuntimeScheduler` weakly (see `EXReactSchedulerDispatch.h` in
+  ///   `ExpoModulesCore`), so dispatching after the React instance tore the
+  ///   scheduler down safely drops the task.
   /// - `dispatch`: raw pointer to a C function with signature
   ///   `void (*)(void *scheduler, int priority, void (^callback)())`.
   public init(
@@ -97,6 +113,27 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     self.runtimePointee = runtime
     self.pointee = expo.iruntime(runtime)
     self.scheduler = expo.RuntimeScheduler(scheduler, fn)
+    self.ownsRuntime = false
+    installLongLivedObjectsTeardown()
+  }
+
+  deinit {
+    // Destroy the runtime only if this wrapper created it (standalone `init()`); adopted runtimes
+    // are owned elsewhere (e.g. React Native) and must not be freed here.
+    guard ownsRuntime else {
+      return
+    }
+    // Release cached JSI objects (e.g. `PropNameID`s) before the runtime goes away. Swift tears
+    // down stored properties only after `deinit` returns, so leaving them for that phase would
+    // destroy them against an already-freed runtime, which JSI forbids: all objects associated with
+    // a runtime must be destroyed before the runtime itself.
+    //
+    // No thread hop is needed. JSI documents that destructors are safe to call from any thread; the
+    // requirement is only that there is no concurrent access, which holds here since `deinit` runs
+    // when the last reference is gone. `deinit` is `nonisolated`, so it can touch the actor-isolated
+    // registry directly given that exclusive access.
+    propNameIdsRegistry.removeAll()
+    expo.destroyRuntime(runtimePointee)
   }
 
   /// Provides scoped access to a raw pointer to the underlying `facebook.jsi.Runtime`.
@@ -637,6 +674,51 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
 
   @JavaScriptActor
   internal var propNameIdsRegistry: [String: JavaScriptPropNameID] = [:]
+
+  // MARK: - Long-lived objects
+
+  /// Registry of JSI objects (such as in-flight promises) that must outlive the native call that
+  /// created them. Cleared when the runtime is torn down so their JSI state is released on the
+  /// JavaScript thread while the runtime is still valid.
+  @JavaScriptActor
+  public let longLivedObjects = LongLivedObjectCollection()
+
+  /// Attaches a native state to a dedicated JS object whose deallocator clears ``longLivedObjects``
+  /// when the runtime is torn down. The object is pinned by storing it as a property on `global`, so
+  /// it stays reachable within the JavaScript heap for the runtime's whole life (no Swift-side strong
+  /// reference) and its native state drops only when the runtime's object graph is destroyed. That
+  /// fires the deallocator on the JavaScript thread while the runtime is still valid, the point at
+  /// which any surviving long-lived objects can safely release their JSI state.
+  private func installLongLivedObjectsTeardown() {
+    // Runtime initializers run on the JavaScript thread but aren't actor-isolated, so reach the
+    // isolated object/native-state/`clear()` APIs through the actor.
+    JavaScriptActor.assumeIsolated {
+      // Capture the collection strongly, not `self`: teardown may run as the runtime itself
+      // deallocates, and the sweep must still call `allowRelease()` on survivors. Holding the
+      // collection keeps it alive for the sweep; it does not retain the runtime.
+      let longLivedObjects = self.longLivedObjects
+      let nativeState = JavaScriptNativeState()
+      nativeState.setDeallocator { nativeState in
+        // Fires as the teardown object is released on the JavaScript thread with the runtime still
+        // valid, so releasing JSI state here is safe. Mirrors the caveat on `AppContext.NativeState`:
+        // a future cross-runtime path that could drop this state from another thread would have to
+        // hop back to the JavaScript thread first.
+        JavaScriptActor.assumeIsolated {
+          longLivedObjects.clear()
+        }
+      }
+      let object = createObject()
+      object.setNativeState(nativeState)
+      // Pin via a JS-heap reference on `global` rather than a Swift property, so the object's
+      // lifetime is governed by the runtime's object graph. The property name is unique per wrapper
+      // (keyed by this wrapper's address), so several wrappers of the same underlying runtime (e.g.
+      // via `init(unsafePointer:)`) each pin their own teardown object instead of overwriting a
+      // shared slot, which would let one wrapper's collection be swept early while the runtime is
+      // still alive.
+      let wrapperAddress = UInt(bitPattern: Unmanaged.passUnretained(self).toOpaque())
+      global().setProperty("__expo_long_lived_objects_teardown_\(wrapperAddress)__", value: object.asValue())
+    }
+  }
 }
 
 private func createFunctionClosure(

package/apple/Sources/ExpoModulesJSI/Runtime/LongLivedObjectCollection.swift

@@ -0,0 +1,46 @@
+/// An object whose lifetime must extend past the native call that created it, such as an in-flight
+/// promise holding its resolve/reject state. Register it with a ``LongLivedObjectCollection``.
+@JavaScriptActor
+public protocol LongLivedObject: AnyObject {
+  /// Called on the JavaScript thread when the runtime tears down while this object is still
+  /// registered, to release any held JSI state. Not called on the normal completion path, where the
+  /// object removes itself after releasing its own state.
+  func allowRelease()
+}
+
+/// Keeps ``LongLivedObject``s alive across asynchronous boundaries and releases any that remain when
+/// the runtime is torn down. Isolated to ``JavaScriptActor``, so it needs no lock.
+@JavaScriptActor
+public final class LongLivedObjectCollection {
+  // Keyed by identity, effectively a set. A dictionary rather than a `Set` because
+  // `any LongLivedObject` is an existential and cannot conform to `Hashable`.
+  private var registeredObjects: [ObjectIdentifier: any LongLivedObject] = [:]
+
+  // `nonisolated` so ``JavaScriptRuntime`` can create one as a stored-property default.
+  internal nonisolated init() {}
+
+  /// Registers an object, keeping it alive until it is removed or the collection is cleared.
+  public func add(_ object: any LongLivedObject) {
+    registeredObjects[ObjectIdentifier(object)] = object
+  }
+
+  /// Removes an object that finished on its own, without calling ``LongLivedObject/allowRelease()``.
+  public func remove(_ object: any LongLivedObject) {
+    registeredObjects[ObjectIdentifier(object)] = nil
+  }
+
+  /// Teardown sweep: calls ``LongLivedObject/allowRelease()`` on every remaining object and empties
+  /// the collection. Must run on the JavaScript thread while the runtime is still valid.
+  public func clear() {
+    let survivors = registeredObjects.values
+    registeredObjects.removeAll()
+    for object in survivors {
+      object.allowRelease()
+    }
+  }
+
+  /// Number of currently registered objects.
+  public var count: Int {
+    return registeredObjects.count
+  }
+}

package/apple/Sources/ExpoModulesJSI/Runtime/Values/JavaScriptError.swift

@@ -50,6 +50,21 @@ public final class JavaScriptError: Error, Sendable {
     }
   }
 
+  /// Returns the `JavaScriptError` representing an arbitrary native error. An existing
+  /// `JavaScriptError` is returned unchanged so its wrapped value reaches JS as-is; a
+  /// `JavaScriptThrowable` is routed through the code-preserving initializer above; any
+  /// other error is stringified into a generic `Error`.
+  @inlinable
+  public static func from(_ error: any Error, in runtime: JavaScriptRuntime) -> JavaScriptError {
+    if let jsError = error as? JavaScriptError {
+      return jsError
+    }
+    if let throwable = error as? JavaScriptThrowable {
+      return JavaScriptError(runtime, from: throwable)
+    }
+    return JavaScriptError(runtime, message: String(describing: error))
+  }
+
   /// Returns the error as a `JavaScriptValue`, which may be an arbitrary value rather than an
   /// `Error` instance when the error was created from one.
   public func toValue() -> JavaScriptValue {

package/apple/Sources/ExpoModulesJSI/Runtime/Values/JavaScriptPromise.swift

@@ -11,46 +11,93 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   private typealias PromiseContinuation = CheckedContinuation<JavaScriptValue.Ref, any Error>
 
   private weak let runtime: JavaScriptRuntime?
-  private var object: JavaScriptObject
   private let deferredPromise = DeferredPromise()
 
-  // Create refs for resolve and reject functions.
-  // They will be set in the Promise setup function.
-  private let resolveFunction = JavaScriptValue.Ref()
-  private let rejectFunction = JavaScriptValue.Ref()
+  /// Owns the promise's JSI values (the object and, for a deferred promise, its resolve/reject
+  /// functions). Registered with the runtime's ``LongLivedObjectCollection`` so they're released on
+  /// the JS thread rather than against a freed runtime when a wrapper outlives its runtime (e.g. an
+  /// async function's promise held by a URLSession delegate).
+  ///
+  /// There are two release paths, both on the JS thread while the runtime is alive:
+  /// - When the ``JavaScriptPromise`` wrapper is dropped, its `deinit` schedules a job that
+  ///   deregisters this state and releases the values, so a stream of promises doesn't pin their
+  ///   objects (and resolution values) until teardown.
+  /// - If the wrapper outlives the runtime, the teardown sweep (``allowRelease()``) releases whatever
+  ///   is still registered before the runtime is destroyed.
+  ///
+  /// The state stays registered for as long as the wrapper is alive, even after the promise settles,
+  /// so ``asValue()`` keeps returning a valid object. Settling only releases the resolve/reject
+  /// functions, which can no longer be called and are the bulk of a deferred promise's held state.
+  @JavaScriptActor
+  private final class LongLivedState: LongLivedObject {
+    // Stored as `JavaScriptValue` (a reference type), not `JavaScriptObject`: a `Copyable` value read
+    // back through `JavaScriptRef.withValue` avoids the copy a borrowed `~Copyable` object would trap on.
+    let object = JavaScriptValue.Ref()
+    let resolveFunction = JavaScriptValue.Ref()
+    let rejectFunction = JavaScriptValue.Ref()
+
+    func allowRelease() {
+      object.release()
+      resolveFunction.release()
+      rejectFunction.release()
+    }
+  }
+
+  private let longLivedState = LongLivedState()
+
+  /// Dropping the wrapper means no native code can settle or read this promise anymore, so release
+  /// its long-lived state. The values can only be touched on the JS thread while the runtime is
+  /// alive, so schedule the work there; if the runtime is already gone, the teardown sweep has
+  /// released everything and there is nothing to do (this is the `#47454` off-thread-drop case).
+  deinit {
+    guard let runtime else {
+      return
+    }
+    // Capture the collection, not the runtime, so a wrapper's deinit can't prolong the runtime's
+    // lifetime by keeping it alive until the scheduled job drains.
+    let longLivedObjects = runtime.longLivedObjects
+    runtime.schedule { [longLivedState] in
+      longLivedObjects.remove(longLivedState)
+      longLivedState.allowRelease()
+    }
+  }
 
   /// Initializes a promise from the existing object. The promise may already be settled.
   /// It cannot be resolved/rejected from the outside, i.e. `resolve` and `reject` functions are no-op.
   @JavaScriptActor
   public init(_ runtime: JavaScriptRuntime, _ object: consuming JavaScriptObject) throws {
     self.runtime = runtime
-    self.object = object
+    longLivedState.object.reset(object.asValue())
     try setUpCallbacks()
+    // Register only after setup succeeds, so a failed initializer (e.g. `then` unavailable) doesn't
+    // leave the state pinned in the collection until teardown. Owns the promise's JSI values from
+    // here until teardown (see `LongLivedState`).
+    runtime.longLivedObjects.add(longLivedState)
   }
 
   /// Creates a new promise whose resolver or rejecter must be called from the outside (also known as a deferred promise).
   @JavaScriptActor
   public init(_ runtime: JavaScriptRuntime) throws {
     self.runtime = runtime
-    // Initialize the non-copyable field before any throwing work. Swift requires a
-    // consistently initialized value on every throwing initializer path.
-    self.object = runtime.createObject()
 
     // Create function that is the promise setup. It is called immediately on `callAsConstructor`.
-    let setup = runtime.createFunction { [weak resolveFunction, weak rejectFunction] this, arguments in
-      resolveFunction?.reset(arguments[0])
-      rejectFunction?.reset(arguments[1])
+    let setup = runtime.createFunction { [weak longLivedState] this, arguments in
+      longLivedState?.resolveFunction.reset(arguments[0])
+      longLivedState?.rejectFunction.reset(arguments[1])
       return .undefined
     }
 
-    self.object =
+    let object =
       try runtime
       .global()
       .getPropertyAsFunction(.cached(runtime, "Promise"))
       .callAsConstructor(setup.asValue())
-      .getObject()
-
+    longLivedState.object.reset(object)
     try setUpCallbacks()
+    // Register only after setup succeeds, so a failed initializer (e.g. `then` unavailable) doesn't
+    // leave the state pinned in the collection until teardown. Owns the promise's JSI values from
+    // here until teardown (see `LongLivedState`).
+    runtime.longLivedObjects.add(longLivedState)
   }
 
   @JavaScriptActor
@@ -59,7 +106,7 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   }
 
   public var isDeferred: Bool {
-    return !resolveFunction.isEmpty && !rejectFunction.isEmpty
+    return !longLivedState.resolveFunction.isEmpty && !longLivedState.rejectFunction.isEmpty
   }
 
   @JavaScriptActor
@@ -68,7 +115,10 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   }
 
   public func asValue() -> JavaScriptValue {
-    return object.asValue()
+    // Read without consuming, so the state keeps owning the object (unlike `Ref.asValue()`).
+    return longLivedState.object.withValue { object in
+      return object
+    } ?? .undefined
   }
 
   public func resolve<V: JavaScriptRepresentable>(_ value: V) {
@@ -77,17 +127,18 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
     }
 
     // `resolve` is not isolated, so make sure to jump to JS thread.
-    runtime.schedule(priority: .immediate) { [resolveFunction, rejectFunction] in
+    runtime.schedule(priority: .immediate) { [longLivedState] in
       // If the promise is already settled, do nothing.
-      guard let resolver = resolveFunction.take() else {
+      guard let resolver = longLivedState.resolveFunction.take() else {
         return
       }
       // Call the actual resolver given in the Promise setup.
       // This will also call `deferredPromise.resolve` in the `then` handler.
       _ = try! resolver.getFunction().call(arguments: value)
 
-      // Release the rejecter, we cannot call it anymore.
-      rejectFunction.release()
+      // The rejecter can't be called anymore. The state stays registered so it keeps owning the
+      // object until the wrapper is dropped (or the teardown sweep runs).
+      longLivedState.rejectFunction.release()
     }
   }
 
@@ -97,23 +148,24 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
     }
 
     // `reject` is not isolated, so make sure to jump to JS thread.
-    runtime.schedule(priority: .immediate) { [resolveFunction, rejectFunction] in
+    runtime.schedule(priority: .immediate) { [longLivedState] in
       // If the promise is already settled, do nothing.
-      guard let rejecter = rejectFunction.take() else {
+      guard let rejecter = longLivedState.rejectFunction.take() else {
         return
       }
-      // A `JavaScriptError` already carries the value to reject with (which may be an arbitrary JS
-      // value rather than an `Error`), so reuse it. Any other native error is stringified into a
-      // generic `Error`.
-      let jsError = error as? JavaScriptError ?? JavaScriptError(runtime, message: String(describing: error))
-      let errorValue = jsError.toValue()
+      // Convert the error to its JavaScript representation. This preserves an existing
+      // `JavaScriptError`'s wrapped value and a `JavaScriptThrowable`'s structured `code`
+      // (mirroring the synchronous throw path in `forwardingSwiftErrorsToJS`), so the `code`
+      // is not lost on async rejection. See `JavaScriptError.from(_:in:)`.
+      let errorValue = JavaScriptError.from(error, in: runtime).toValue()
 
       // Call the actual rejecter given in the Promise setup.
       // This will also call `deferredPromise.reject` in the `then` handler.
       _ = try! rejecter.getFunction().call(arguments: errorValue)
 
-      // Release the resolver, we cannot call it anymore.
-      resolveFunction.release()
+      // The resolver can't be called anymore. The state stays registered so it keeps owning the
+      // object until the wrapper is dropped (or the teardown sweep runs).
+      longLivedState.resolveFunction.release()
     }
   }
 
@@ -140,6 +192,12 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
       }
       return .undefined
     }
-    try object.callFunction(.cached(runtime, "then"), arguments: onFulfilled.asValue(), onRejected.asValue())
+    _ = try longLivedState.object.withValue { object in
+      try object?.getObject().callFunction(
+        .cached(runtime, "then"),
+        arguments: onFulfilled.asValue(),
+        onRejected.asValue()
+      )
+    }
   }
 }

package/apple/Sources/ExpoModulesJSI-Cxx/include/JSIUtils.h

@@ -125,6 +125,16 @@ inline bool isHostObject(jsi::IRuntime &runtime, const jsi::Object &object) {
 
 jsi::Runtime* createHermesRuntime();
 
+/**
+ Destroys a `jsi::Runtime` created by `createHermesRuntime()`. Since the runtime is imported into
+ Swift as an immortal reference type (no ARC-managed lifetime), Swift can't `delete` it directly, so
+ the standalone `JavaScriptRuntime` calls this from its `deinit` to free the runtime it owns. Must
+ not be called on a runtime owned elsewhere (e.g. the React Native-provided one).
+ */
+inline void destroyRuntime(jsi::Runtime &runtime) {
+  delete &runtime;
+}
+
 inline jsi::Value evaluateJavaScript(jsi::IRuntime &runtime, const std::shared_ptr<const jsi::Buffer>& buffer, const std::string& sourceURL) {
   return expo::CppError::tryCatch(runtime, ^{
     return runtime.evaluateJavaScript(buffer, sourceURL);

package/apple/Sources/ExpoModulesJSI-Cxx/include/RuntimeScheduler.h

@@ -31,8 +31,9 @@ public:
   using ScheduleTaskCallback = void(^)();
 
   /**
-   Trampoline implemented by the host — casts `nativeScheduler` back to
-   react::RuntimeScheduler* and calls scheduleTask on it. Keeping it as a
+   Trampoline implemented by the host. It resolves `nativeScheduler` (an opaque
+   host-owned handle) to the real react::RuntimeScheduler and calls scheduleTask
+   on it, or drops the task when the scheduler no longer exists. Keeping it as a
    function pointer keeps React types out of this header.
    */
   using ScheduleFn = void (*)(void *nativeScheduler, int priority, ScheduleTaskCallback callback);

package/apple/Tests/JavaScriptCodableDateTests.swift

@@ -0,0 +1,270 @@
+// Copyright 2025-present 650 Industries. All rights reserved.
+
+import ExpoModulesJSI
+import Foundation
+import Testing
+
+@Suite("JavaScriptCodable+Date")
+@JavaScriptActor
+struct JavaScriptCodableDateTests {
+  let runtime = JavaScriptRuntime()
+
+  // MARK: - Decode
+
+  @Test
+  func `decodes a JS Date to the same instant`() throws {
+    // 2021-01-01T00:00:00.000Z expressed as an absolute UTC millisecond instant. `Date.UTC` returns
+    // that instant directly, so no local timezone enters the JS side.
+    let value = try runtime.eval("new Date(Date.UTC(2021, 0, 1, 0, 0, 0, 0))")
+    let decoded = try Date.decode(value, in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 1_609_459_200.0)
+  }
+
+  @Test
+  func `decodes the Unix epoch`() throws {
+    let decoded = try Date.decode(runtime.eval("new Date(0)"), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 0.0)
+  }
+
+  @Test
+  func `decodes a pre-epoch Date`() throws {
+    // A negative millisecond instant (1960-01-01T00:00:00Z) must decode to a negative interval.
+    let value = try runtime.eval("new Date(Date.UTC(1960, 0, 1))")
+    let decoded = try Date.decode(value, in: runtime)
+    #expect(decoded.timeIntervalSince1970 == -315_619_200.0)
+  }
+
+  @Test
+  func `decode preserves sub-second milliseconds`() throws {
+    // Assert on the whole-millisecond instant (an integer-valued Double, always exact) rather than the
+    // reconstructed fractional seconds, whose last bit can differ by an ULP across the JS boundary.
+    let decoded = try Date.decode(runtime.eval("new Date(1234)"), in: runtime)
+    #expect((decoded.timeIntervalSince1970 * 1000.0).rounded() == 1234.0)
+  }
+
+  @Test
+  func `decodes a JS Date through the borrowed-value overload`() throws {
+    // `Date` does not override the zero-copy overload (it needs a `getTime()` call), so this goes
+    // through the default that copies the borrowed value into an owning one and forwards.
+    let value = try runtime.eval("new Date(5000)")
+    let buffer = JavaScriptValuesBuffer.copying(in: runtime, values: [value])
+    let decoded = try Date.decode(buffer.unownedValue(at: 0), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 5.0)
+  }
+
+  // MARK: - Encode
+
+  @Test
+  func `encodes a Date to a JS Date`() throws {
+    let encoded = try Date.encode(Date(timeIntervalSince1970: 1_609_459_200.0), in: runtime)
+    #expect(encoded.is("Date") == true)
+  }
+
+  @Test
+  func `encoded Date carries the same instant into JS`() throws {
+    // Cross-check the encoded value against JS's own `getTime()`, so the assertion is that JS and
+    // Swift agree on the absolute millisecond instant — not merely that a Date was produced.
+    let date = Date(timeIntervalSince1970: 1_609_459_200.0)
+    let encoded = try Date.encode(date, in: runtime)
+    let millisecondsInJS = try encoded.asObject().callFunction("getTime").asDouble()
+    #expect(millisecondsInJS == 1_609_459_200_000.0)
+  }
+
+  // MARK: - Timezone / calendar independence
+
+  @Test
+  func `instant is independent of the JS Date's local-time getters`() throws {
+    // Build the same absolute instant two ways: from a UTC millisecond value, and from local-time
+    // components. `Date.UTC` and the `new Date(y, m, d, …)` local constructor produce different
+    // instants unless the runtime is at UTC, so we decode the explicitly-UTC one and assert the
+    // instant matches its `getTime()` exactly. The point: decode reads `getTime()` (absolute UTC ms),
+    // never a local-time getter, so no timezone offset is folded in.
+    let value = try runtime.eval("new Date(Date.UTC(2021, 5, 15, 12, 30, 45, 123))")
+    let expectedMilliseconds = try value.asObject().callFunction("getTime").asDouble()
+    let decoded = try Date.decode(value, in: runtime)
+    #expect((decoded.timeIntervalSince1970 * 1000.0).rounded() == expectedMilliseconds)
+  }
+
+  @Test
+  func `round-trip is calendar and timezone agnostic`() throws {
+    // A `Date` is an absolute instant with no stored calendar or timezone; both JS `Date` and Swift
+    // `Date` are epoch-relative. This encodes to JS and decodes back, asserting the instant is
+    // unchanged at millisecond granularity regardless of the ambient calendar/timezone.
+    let original = Date(timeIntervalSince1970: 1_655_296_245.123)
+    let encoded = try Date.encode(original, in: runtime)
+    let roundTripped = try Date.decode(encoded, in: runtime)
+    // Compare at whole-millisecond granularity (JS `Date`'s resolution); the original is already an
+    // exact number of milliseconds, so nothing is lost, but the comparison avoids float-equality ULP noise.
+    #expect(
+      (roundTripped.timeIntervalSince1970 * 1000.0).rounded() == (original.timeIntervalSince1970 * 1000.0).rounded())
+  }
+
+  @Test
+  func `round-trip drops sub-millisecond precision`() throws {
+    // JS `Date` is integer-millisecond resolution, so the microsecond tail of a Swift `Date` is lost
+    // on the way through JS. The round-trip lands on the truncated whole millisecond (JS's `Date`
+    // constructor truncates the fractional millisecond toward zero), and no longer equals the original.
+    let original = Date(timeIntervalSince1970: 1.2345678)
+    let roundTripped = try Date.decode(Date.encode(original, in: runtime), in: runtime)
+    #expect((roundTripped.timeIntervalSince1970 * 1000.0).rounded() == 1234.0)
+    #expect(roundTripped.timeIntervalSince1970 != original.timeIntervalSince1970)
+  }
+
+  @Test
+  func `Date current time round-trips to the millisecond`() throws {
+    let now = Date()
+    let roundTripped = try Date.decode(Date.encode(now, in: runtime), in: runtime)
+    // Truncate the original to whole milliseconds (JS's resolution) and compare on the millisecond
+    // instant, which is an exact integer-valued Double on both sides.
+    let nowMilliseconds = (now.timeIntervalSince1970 * 1000.0).rounded(.towardZero)
+    #expect((roundTripped.timeIntervalSince1970 * 1000.0).rounded() == nowMilliseconds)
+  }
+
+  // MARK: - Decode from a JS number (milliseconds since the epoch)
+
+  @Test
+  func `decodes a number as milliseconds since the epoch`() throws {
+    // A JS number is interpreted the same way `new Date(ms)` interprets it, so `getTime()` round-trips.
+    let decoded = try Date.decode(runtime.eval("1609459200000"), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 1_609_459_200.0)
+  }
+
+  @Test
+  func `decodes zero as the Unix epoch`() throws {
+    let decoded = try Date.decode(runtime.eval("0"), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 0.0)
+  }
+
+  @Test
+  func `decodes a negative number as a pre-epoch instant`() throws {
+    let decoded = try Date.decode(runtime.eval("-315619200000"), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == -315_619_200.0)
+  }
+
+  @Test
+  func `a JS Date's getTime decodes to the same instant as the Date`() throws {
+    // Passing `someDate` and passing `someDate.getTime()` must decode to the same Swift `Date`.
+    let fromDate = try Date.decode(runtime.eval("new Date(Date.UTC(2021, 0, 1))"), in: runtime)
+    let fromMilliseconds = try Date.decode(runtime.eval("new Date(Date.UTC(2021, 0, 1)).getTime()"), in: runtime)
+    #expect(fromDate.timeIntervalSince1970 == fromMilliseconds.timeIntervalSince1970)
+  }
+
+  @Test
+  func `decode truncates a fractional number toward zero like the Date constructor`() throws {
+    // `new Date(1.9).getTime()` is `1` and `new Date(-1.9).getTime()` is `-1`: the constructor applies
+    // TimeClip (truncate toward zero), so the number branch must too rather than keeping 1.9 ms.
+    let positive = try Date.decode(runtime.eval("1.9"), in: runtime)
+    #expect((positive.timeIntervalSince1970 * 1000.0).rounded() == 1.0)
+    let negative = try Date.decode(runtime.eval("-1.9"), in: runtime)
+    #expect((negative.timeIntervalSince1970 * 1000.0).rounded() == -1.0)
+  }
+
+  @Test
+  func `decode accepts the maximum representable JS date`() throws {
+    // ±8.64e15 ms (100,000,000 days from the epoch) is the inclusive bound of a valid JS `Date`.
+    let maximum = try Date.decode(runtime.eval("8640000000000000"), in: runtime)
+    #expect((maximum.timeIntervalSince1970 * 1000.0) == 8_640_000_000_000_000.0)
+    let minimum = try Date.decode(runtime.eval("-8640000000000000"), in: runtime)
+    #expect((minimum.timeIntervalSince1970 * 1000.0) == -8_640_000_000_000_000.0)
+  }
+
+  @Test
+  func `decode rejects a number beyond the JS date range`() throws {
+    // One millisecond past the bound is an `Invalid Date` in JS (`new Date(8640000000000001).getTime()`
+    // is `NaN`), so decode must reject it rather than accept an instant JS `Date` can't hold.
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("8640000000000001"), in: runtime)
+    }
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("-8640000000000001"), in: runtime)
+    }
+  }
+
+  @Test
+  func `decode matches new Date for the same number`() throws {
+    // Cross-check the number branch against the constructor for values that exercise TimeClip.
+    for source in ["1.9", "-1.9", "0.4", "1234.5678", "8640000000000000"] {
+      let expected = try runtime.eval("new Date(\(source)).getTime()").asDouble()
+      let decoded = try Date.decode(runtime.eval(source), in: runtime)
+      #expect((decoded.timeIntervalSince1970 * 1000.0).rounded() == expected)
+    }
+  }
+
+  // MARK: - Decode from a string (parsed by the JS `Date` constructor)
+
+  @Test
+  func `decodes an ISO 8601 string with fractional seconds`() throws {
+    let decoded = try Date.decode(runtime.eval("\"2021-01-01T00:00:00.123Z\""), in: runtime)
+    #expect((decoded.timeIntervalSince1970 * 1000.0).rounded() == 1_609_459_200_123.0)
+  }
+
+  @Test
+  func `decodes an ISO 8601 string without fractional seconds`() throws {
+    let decoded = try Date.decode(runtime.eval("\"2021-01-01T00:00:00Z\""), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 1_609_459_200.0)
+  }
+
+  @Test
+  func `decodes an ISO 8601 string with a timezone offset to the correct UTC instant`() throws {
+    // 01:00 at +01:00 is the same absolute instant as 00:00 UTC; the offset must be applied, not ignored.
+    let decoded = try Date.decode(runtime.eval("\"2021-01-01T01:00:00+01:00\""), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 1_609_459_200.0)
+  }
+
+  @Test
+  func `decodes a date-only string as UTC midnight`() throws {
+    // The JS `Date` constructor reads a date-only ISO string as UTC midnight (unlike a zone-less
+    // date-time, which it reads as local). This form is accepted here because `new Date(str)` accepts it.
+    let decoded = try Date.decode(runtime.eval("\"2021-01-01\""), in: runtime)
+    #expect(decoded.timeIntervalSince1970 == 1_609_459_200.0)
+  }
+
+  @Test
+  func `decodes a string the same way new Date parses it`() throws {
+    // The decode contract for a string is "exactly what `new Date(str)` produces". Cross-check the
+    // decoded instant against the engine's own parse of the same string, so this holds for whatever
+    // date grammar the runtime supports (ISO, RFC-2822-ish, etc.), identically on every platform.
+    let source = "\"2021-06-15T12:30:45.500Z\""
+    let expectedMilliseconds = try runtime.eval("new Date(\(source)).getTime()").asDouble()
+    let decoded = try Date.decode(runtime.eval(source), in: runtime)
+    #expect((decoded.timeIntervalSince1970 * 1000.0).rounded() == expectedMilliseconds)
+  }
+
+  // MARK: - Error paths
+
+  @Test
+  func `Date decode throws on an unparseable string`() throws {
+    // `new Date(...)` yields an `Invalid Date` (NaN time) rather than throwing; decode turns that NaN
+    // into a thrown error.
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("\"not a date\""), in: runtime)
+    }
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("\"\""), in: runtime)
+    }
+  }
+
+  @Test
+  func `Date decode throws on NaN`() throws {
+    // A NaN number produces an `Invalid Date` in JS; decode must reject it rather than yield a bogus instant.
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("NaN"), in: runtime)
+    }
+  }
+
+  @Test
+  func `Date decode throws on an unsupported type`() throws {
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("({})"), in: runtime)
+    }
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("null"), in: runtime)
+    }
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("true"), in: runtime)
+    }
+    #expect(throws: InvalidDateException.self) {
+      _ = try Date.decode(runtime.eval("[1, 2, 3]"), in: runtime)
+    }
+  }
+}

package/apple/Tests/JavaScriptErrorTests.swift

@@ -179,6 +179,39 @@ struct JavaScriptErrorTests {
     #expect(caught.getObject().getProperty("message").getString() == "native failure")
   }
 
+  // MARK: - JavaScriptError.from(_:in:) helper
+
+  @Test
+  func `from returns an existing JavaScriptError unchanged`() {
+    // An existing `JavaScriptError` must be returned as the very same instance so its wrapped
+    // value (which may be an arbitrary JS value) reaches JS unchanged.
+    let original = JavaScriptError(runtime, value: JavaScriptValue(runtime, "just a string"))
+    let result = JavaScriptError.from(original, in: runtime)
+
+    #expect(result === original)
+    #expect(result.toValue().getString() == "just a string")
+  }
+
+  @Test
+  func `from routes a JavaScriptThrowable through the code-preserving initializer`() {
+    let throwable = CodedError(message: "Not found", code: "ERR_NOT_FOUND")
+    let object = JavaScriptError.from(throwable, in: runtime).toValue().getObject()
+
+    #expect(object.getProperty("message").getString() == "Not found")
+    #expect(object.getProperty("code").getString() == "ERR_NOT_FOUND")
+  }
+
+  @Test
+  func `from stringifies any other native error into a generic Error`() {
+    struct TestError: Error, CustomStringConvertible {
+      var description: String { "native failure" }
+    }
+    let object = JavaScriptError.from(TestError(), in: runtime).toValue().getObject()
+
+    #expect(object.getProperty("message").getString() == "native failure")
+    #expect(object.getProperty("code").isUndefined() == true)
+  }
+
   @Test
   func `nested host function errors are independent`() throws {
     let outer = runtime.createFunction("outer") { [self] _, _ in

package/apple/Tests/JavaScriptPromiseTests.swift

@@ -106,6 +106,9 @@ struct JavaScriptPromiseTests {
     #expect(throws: Error.self) {
       _ = try promiseValue.getPromise()
     }
+    // A failed initializer must not leave its state registered, or it would pin the promise object
+    // in the collection until teardown even though no `JavaScriptPromise` escaped.
+    #expect(runtime.longLivedObjects.count == 0)
   }
 
   @Test
@@ -370,4 +373,126 @@ struct JavaScriptPromiseTests {
 
     #expect(promise.isDeferred == false)
   }
+
+  // MARK: - Long-lived object registration
+
+  @Test
+  func `deferred promise registers as a long-lived object`() throws {
+    let runtime = JavaScriptRuntime()
+    #expect(runtime.longLivedObjects.count == 0)
+
+    let promise = try JavaScriptPromise(runtime)
+    _ = promise.isDeferred
+
+    #expect(runtime.longLivedObjects.count == 1)
+  }
+
+  @Test
+  func `wrapping an existing promise registers to own its object`() throws {
+    let runtime = JavaScriptRuntime()
+    let promise = try runtime.eval("Promise.resolve(42)").getPromise()
+    #expect(promise.isDeferred == false)
+
+    // Even a wrapped promise owns a JSI object that must not be released against a freed runtime,
+    // so it registers to have that object swept at teardown.
+    #expect(runtime.longLivedObjects.count == 1)
+  }
+
+  @Test
+  func `settling keeps the promise registered while the wrapper is alive`() async throws {
+    let runtime = JavaScriptRuntime()
+    let promise = try JavaScriptPromise(runtime)
+    #expect(runtime.longLivedObjects.count == 1)
+
+    promise.resolve(JavaScriptValue(runtime, 42))
+    _ = try await promise.await()
+
+    // Settling releases the resolve/reject functions, but the state stays registered so it continues
+    // to own the promise object for as long as the wrapper is alive (it is only deregistered when the
+    // wrapper is dropped, see the tests below, or by the teardown sweep).
+    #expect(promise.isDeferred == false)
+    #expect(runtime.longLivedObjects.count == 1)
+  }
+
+  @Test
+  func `dropping a settled promise deregisters its state`() async throws {
+    let runtime = JavaScriptRuntime()
+
+    do {
+      let promise = try JavaScriptPromise(runtime)
+      promise.resolve(JavaScriptValue(runtime, 42))
+      _ = try await promise.await()
+      #expect(runtime.longLivedObjects.count == 1)
+      // Leaving the scope drops the last owner of the wrapper.
+    }
+
+    // Dropping the wrapper deregisters its state and releases the promise object, so a stream of
+    // short-lived promises doesn't pin their objects (and resolution values) until teardown.
+    #expect(runtime.longLivedObjects.count == 0)
+  }
+
+  @Test
+  func `dropping an unsettled promise deregisters its state`() throws {
+    let runtime = JavaScriptRuntime()
+
+    do {
+      let promise = try JavaScriptPromise(runtime)
+      #expect(promise.isDeferred == true)
+      #expect(runtime.longLivedObjects.count == 1)
+      // The promise is never settled; dropping the wrapper here is the only owner going away.
+    }
+
+    // Even an unsettled promise releases its state when its wrapper is dropped: nothing outside can
+    // settle it anymore, so keeping it registered would only pin the object until teardown.
+    #expect(runtime.longLivedObjects.count == 0)
+  }
+
+  @Test
+  func `dropping a wrapped promise deregisters its state`() throws {
+    let runtime = JavaScriptRuntime()
+
+    do {
+      let promise = try runtime.eval("Promise.resolve(42)").getPromise()
+      #expect(promise.isDeferred == false)
+      #expect(runtime.longLivedObjects.count == 1)
+    }
+
+    #expect(runtime.longLivedObjects.count == 0)
+  }
+
+  @Test
+  func `an unsettled deferred promise is released by the teardown sweep`() throws {
+    let runtime = JavaScriptRuntime()
+    let promise = try JavaScriptPromise(runtime)
+    #expect(runtime.longLivedObjects.count == 1)
+
+    // The promise is never settled; the runtime's teardown sweep must release its long-lived state.
+    runtime.longLivedObjects.clear()
+
+    #expect(runtime.longLivedObjects.count == 0)
+    // After the sweep the settle functions are released, so it can no longer be settled.
+    #expect(promise.isDeferred == false)
+  }
+
+  @Test
+  func `an unsettled deferred promise outliving its runtime does not crash on teardown`() throws {
+    // Reproduces the shape of the promise-teardown crash (#47454): a deferred promise is still in
+    // flight when its runtime is torn down. Before the state was owned by the runtime's
+    // `LongLivedObjectCollection`, its JSI values were released after the Hermes runtime was already
+    // destroyed, a use-after-free. Now the runtime's teardown sweep releases the state on the JS
+    // thread while the runtime is still valid.
+    var promise: JavaScriptPromise? = nil
+
+    do {
+      let runtime = JavaScriptRuntime()
+      promise = try JavaScriptPromise(runtime)
+      #expect(promise?.isDeferred == true)
+      // Leaving the scope releases the runtime while the promise is still unsettled. Its teardown
+      // sweep must release the promise's state before Hermes is destroyed.
+    }
+
+    // Dropping the promise wrapper here must not touch a freed runtime. This is the crash point in
+    // #47454; reaching the end of the test without a crash is the assertion.
+    promise = nil
+  }
 }

package/apple/Tests/JavaScriptRuntimeTests.swift

@@ -790,6 +790,73 @@ struct JavaScriptRuntimeTests {
     let otherRuntime = JavaScriptRuntime()
     #expect(otherRuntime.id != runtime.id)
   }
+
+  @Test
+  func `creating and releasing standalone runtimes repeatedly does not crash`() throws {
+    // Each standalone runtime owns its Hermes runtime and destroys it on `deinit`. Cycling through
+    // many create/use/release rounds exercises that teardown and would surface a use-after-free or
+    // double-free (destroying a runtime must not corrupt a subsequently created one). Calling `is`
+    // caches a `PropNameID` on the runtime, so this also covers releasing cached JSI objects before
+    // the runtime is freed.
+    for index in 0..<20 {
+      let localRuntime = JavaScriptRuntime()
+      let value = try localRuntime.eval("({ index: \(index) })")
+      #expect(value.is("Object") == true)
+      #expect(value.getObject().getProperty("index").getInt() == index)
+    }
+  }
+
+  // MARK: - Long-lived objects teardown
+
+  /// Records whether `allowRelease()` was called.
+  final class TrackedObject: LongLivedObject {
+    private(set) var released = false
+
+    func allowRelease() {
+      released = true
+    }
+  }
+
+  @Test
+  func `tearing down the runtime clears its long-lived objects`() {
+    let tracked = TrackedObject()
+
+    do {
+      let localRuntime = JavaScriptRuntime()
+      localRuntime.longLivedObjects.add(tracked)
+      #expect(localRuntime.longLivedObjects.count == 1)
+      // Leaving the scope releases the runtime. Its `deinit` destroys the owned Hermes runtime,
+      // tearing down the JS heap, which drops the teardown object's native state and fires its
+      // deallocator, sweeping the collection.
+    }
+
+    #expect(tracked.released == true)
+  }
+
+  @Test
+  func `an object removed before teardown is not released by the sweep`() {
+    let tracked = TrackedObject()
+
+    do {
+      let localRuntime = JavaScriptRuntime()
+      localRuntime.longLivedObjects.add(tracked)
+      localRuntime.longLivedObjects.remove(tracked)
+    }
+
+    #expect(tracked.released == false)
+  }
+
+  @Test
+  func `wrapping the same runtime again does not sweep the first wrapper's objects`() {
+    // Each wrapper pins its own teardown object under a per-wrapper property name. A second wrapper
+    // of the same underlying runtime must not overwrite the first's pinned object (which would let
+    // it be collected early and sweep the first wrapper's collection while the runtime is alive).
+    let tracked = TrackedObject()
+    runtime.longLivedObjects.add(tracked)
+    _ = runtime.withUnsafePointee { JavaScriptRuntime(unsafePointer: $0) }
+    #expect(tracked.released == false)
+    #expect(runtime.longLivedObjects.count == 1)
+  }
 }
 
 /// Runs `body` on a freshly spawned synchronous thread and bridges the result back into the

package/apple/Tests/LongLivedObjectCollectionTests.swift

@@ -0,0 +1,228 @@
+import ExpoModulesJSI
+import Testing
+
+@Suite
+@JavaScriptActor
+struct LongLivedObjectCollectionTests {
+  /// Minimal conformer that counts how many times `allowRelease()` was called, so tests can assert
+  /// it fires exactly once (and not at all on the remove path).
+  final class TrackedObject: LongLivedObject {
+    private(set) var releaseCount = 0
+
+    func allowRelease() {
+      releaseCount += 1
+    }
+  }
+
+  // MARK: - add / remove
+
+  @Test
+  func `a new collection is empty`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+
+    #expect(collection.count == 0)
+  }
+
+  @Test
+  func `add registers the object`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+
+    collection.add(TrackedObject())
+
+    #expect(collection.count == 1)
+  }
+
+  @Test
+  func `remove deregisters the object`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let object = TrackedObject()
+
+    collection.add(object)
+    collection.remove(object)
+
+    #expect(collection.count == 0)
+  }
+
+  @Test
+  func `remove does not call allowRelease`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let object = TrackedObject()
+
+    collection.add(object)
+    collection.remove(object)
+
+    #expect(object.releaseCount == 0)
+  }
+
+  @Test
+  func `removing an object that was never added is a no-op`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let added = TrackedObject()
+    let neverAdded = TrackedObject()
+
+    collection.add(added)
+    collection.remove(neverAdded)
+
+    #expect(collection.count == 1)
+    #expect(neverAdded.releaseCount == 0)
+  }
+
+  @Test
+  func `removing one object leaves the others registered`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let first = TrackedObject()
+    let second = TrackedObject()
+
+    collection.add(first)
+    collection.add(second)
+    collection.remove(first)
+
+    #expect(collection.count == 1)
+  }
+
+  // MARK: - identity semantics
+
+  @Test
+  func `distinct objects are distinct entries`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+
+    collection.add(TrackedObject())
+    collection.add(TrackedObject())
+
+    #expect(collection.count == 2)
+  }
+
+  @Test
+  func `adding the same object twice keeps a single entry`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let object = TrackedObject()
+
+    collection.add(object)
+    collection.add(object)
+
+    #expect(collection.count == 1)
+  }
+
+  @Test
+  func `re-adding after remove registers again`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let object = TrackedObject()
+
+    collection.add(object)
+    collection.remove(object)
+    collection.add(object)
+
+    #expect(collection.count == 1)
+  }
+
+  // MARK: - clear
+
+  @Test
+  func `clear empties the collection`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+
+    collection.add(TrackedObject())
+    collection.add(TrackedObject())
+    collection.clear()
+
+    #expect(collection.count == 0)
+  }
+
+  @Test
+  func `clear calls allowRelease exactly once on every survivor`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let first = TrackedObject()
+    let second = TrackedObject()
+
+    collection.add(first)
+    collection.add(second)
+    collection.clear()
+
+    #expect(first.releaseCount == 1)
+    #expect(second.releaseCount == 1)
+  }
+
+  @Test
+  func `clear does not call allowRelease on a removed object`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    let removed = TrackedObject()
+    let survivor = TrackedObject()
+
+    collection.add(removed)
+    collection.add(survivor)
+    collection.remove(removed)
+    collection.clear()
+
+    #expect(removed.releaseCount == 0)
+    #expect(survivor.releaseCount == 1)
+  }
+
+  @Test
+  func `clear on an empty collection is a no-op`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+
+    collection.clear()
+
+    #expect(collection.count == 0)
+  }
+
+  @Test
+  func `the collection is reusable after clear`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+
+    collection.add(TrackedObject())
+    collection.clear()
+    collection.add(TrackedObject())
+
+    #expect(collection.count == 1)
+  }
+
+  // MARK: - ownership
+
+  @Test
+  func `the collection stops retaining an object after clear`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    weak var weakObject: TrackedObject?
+
+    do {
+      let object = TrackedObject()
+      weakObject = object
+      collection.add(object)
+      collection.clear()
+    }
+
+    // With no external strong reference and the collection's own reference dropped by `clear()`,
+    // the object must have been deallocated.
+    #expect(weakObject == nil)
+  }
+
+  @Test
+  func `the collection stops retaining an object after remove`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    weak var weakObject: TrackedObject?
+
+    do {
+      let object = TrackedObject()
+      weakObject = object
+      collection.add(object)
+      collection.remove(object)
+    }
+
+    #expect(weakObject == nil)
+  }
+
+  @Test
+  func `the collection retains a registered object`() {
+    let collection = JavaScriptRuntime().longLivedObjects
+    weak var weakObject: TrackedObject?
+
+    do {
+      let object = TrackedObject()
+      weakObject = object
+      collection.add(object)
+    }
+
+    // The external strong reference is gone, but the collection still holds one.
+    #expect(weakObject != nil)
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-modules-jsi",
-  "version": "57.0.1",
+  "version": "57.0.3",
   "description": "The JavaScript Interface for Expo Modules",
   "main": "index.js",
   "sideEffects": [],
@@ -41,7 +41,7 @@
       "./apple/scripts/test.sh"
     ]
   },
-  "gitHead": "b31bd70c8873eee2894bc5cc3b3460abca0cdea0",
+  "gitHead": "b9503d06b8e130abfca1bc16f671dbefb41ad709",
   "scripts": {
     "build": "apple/scripts/build-xcframework.sh",
     "swift:format": "../../scripts/swift-format.sh",