expo 58.0.0-preview.4 → 58.0.0-preview.6

package/android/build.gradle

@@ -10,7 +10,7 @@ buildscript {
 }
 
 group = 'host.exp.exponent'
-version = '58.0.0-preview.4'
+version = '58.0.0-preview.6'
 
 expoModule {
   // We can't prebuild the module because it depends on the generated files.
@@ -21,7 +21,7 @@ android {
   namespace "expo.core"
   defaultConfig {
     versionCode 1
-    versionName "58.0.0-preview.4"
+    versionName "58.0.0-preview.6"
     consumerProguardFiles("proguard-rules.pro")
   }
   testOptions {

package/build/winter/runtime.js

@@ -7,5 +7,11 @@ Object.defineProperty(globalThis, '__ExpoImportMetaRegistry', {
     enumerable: false,
     writable: true
 });
+// Server rendering has no animation frames, but we need to stub these *temporarily* to work around
+// react-native-worklets, see: https://github.com/software-mansion/react-native-reanimated/pull/10667
+if (process.env.EXPO_SERVER && typeof globalThis.requestAnimationFrame !== 'function') {
+    globalThis.requestAnimationFrame = ()=>0;
+    globalThis.cancelAnimationFrame = ()=>{};
+}
 
 //# sourceMappingURL=runtime.js.map

package/build/winter/runtime.js.map

@@ -1 +1 @@
-{"version":3,"sources":["winter/runtime.ts"],"sourcesContent":[null],"names":["Object","defineProperty","globalThis","value","require","ImportMetaRegistry","enumerable","writable"],"mappings":"AAAA,OAAO,yBAAyB;AAChC,iGAAiG;AACjG,sFAAsF;AACtF,OAAO,wBAAwB;AAE/BA,OAAOC,cAAc,CAACC,YAAY,4BAA4B;IAC5DC,OAAOC,QAAQ,wBAAwBC,kBAAkB;IACzDC,YAAY;IACZC,UAAU;AACZ"}
+{"version":3,"sources":["winter/runtime.ts"],"sourcesContent":[null],"names":["Object","defineProperty","globalThis","value","require","ImportMetaRegistry","enumerable","writable","process","env","EXPO_SERVER","requestAnimationFrame","cancelAnimationFrame"],"mappings":"AAAA,OAAO,yBAAyB;AAChC,iGAAiG;AACjG,sFAAsF;AACtF,OAAO,wBAAwB;AAE/BA,OAAOC,cAAc,CAACC,YAAY,4BAA4B;IAC5DC,OAAOC,QAAQ,wBAAwBC,kBAAkB;IACzDC,YAAY;IACZC,UAAU;AACZ;AAEA,mGAAmG;AACnG,qGAAqG;AACrG,IAAIC,QAAQC,GAAG,CAACC,WAAW,IAAI,OAAOR,WAAWS,qBAAqB,KAAK,YAAY;IACrFT,WAAWS,qBAAqB,GAAG,IAAM;IACzCT,WAAWU,oBAAoB,GAAG,KAAO;AAC3C"}

package/build/winter/runtime.native.d.ts

@@ -1,2 +1,2 @@
-import 'react-native/setup-env';
+import './setupReactNativeEnvironment';
 import '../../types';

package/build/winter/runtime.native.js

@@ -2,7 +2,7 @@
 // https://wintercg.org/
 // WARN(@kitten): We must ensure that the core react-native globals are initialized before ours
 // Otherwise we're relying on `getModulesRunBeforeMainModule` which is unstable or can be missing
-import 'react-native/setup-env';
+import './setupReactNativeEnvironment';
 import '../../types';
 import { installAbortSignalPatch } from './AbortSignal';
 import { installFormDataPatch } from './FormData';

package/build/winter/runtime.native.js.map

@@ -1 +1 @@
-{"version":3,"sources":["winter/runtime.native.ts"],"sourcesContent":[null],"names":["installAbortSignalPatch","installFormDataPatch","installGlobal","install","require","TextDecoder","TextDecoderStream","TextEncoderStream","URL","URLSearchParams","DOMException","ImportMetaRegistry","default","FormData","AbortSignal","Symbol","asyncIterator","for","useRnFetch","process","env","EXPO_PUBLIC_USE_RN_FETCH","globalThis","Headers","Error","fetch"],"mappings":"AAAA,wFAAwF;AACxF,wBAAwB;AAExB,+FAA+F;AAC/F,iGAAiG;AACjG,OAAO,yBAAyB;AAChC,OAAO,cAAc;AACrB,SAASA,uBAAuB,QAAQ,gBAAgB;AACxD,SAASC,oBAAoB,QAAQ,aAAa;AAClD,SAASC,iBAAiBC,OAAO,QAAQ,kBAAkB;AAE3D,gDAAgD;AAChDA,QAAQ,eAAe,IAAMC,QAAQ,iBAAiBC,WAAW;AACjE,gEAAgE;AAChEF,QAAQ,qBAAqB,IAAMC,QAAQ,uBAAuBE,iBAAiB;AACnF,gEAAgE;AAChEH,QAAQ,qBAAqB,IAAMC,QAAQ,uBAAuBG,iBAAiB;AACnF,mCAAmC;AACnCJ,QAAQ,OAAO,IAAMC,QAAQ,SAASI,GAAG;AACzC,+CAA+C;AAC/CL,QAAQ,mBAAmB,IAAMC,QAAQ,SAASK,eAAe;AACjE,mDAAmD;AACnDN,QAAQ,gBAAgB,IAAMC,QAAQ,kBAAkBM,YAAY;AACpE,sCAAsC;AACtC,kDAAkD;AAElDP,QAAQ,4BAA4B,IAAMC,QAAQ,wBAAwBO,kBAAkB;AAE5F,8EAA8E;AAC9ER,QAAQ,mBAAmB,IAAMC,QAAQ,2BAA2BQ,OAAO;AAE3EX,qBAAqBY;AACrBb,wBAAwBc;AAExB,6CAA6C;AAC7C,+EAA+E;AAC/EC,OAAOC,aAAa,KAAKD,OAAOE,GAAG,CAAC;AAEpC,MAAMC,aACJC,QAAQC,GAAG,CAACC,wBAAwB,KAAK,OAAOF,QAAQC,GAAG,CAACC,wBAAwB,KAAK;AAE3F,IAAI,CAACH,YAAY;IACf,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,CAACI,WAAWC,OAAO,EAAE;QACvB,MAAM,IAAIC,MACR;IAEJ;IACArB,QAAQ,SAAS,IAAMC,QAAQ,WAAWqB,KAAK;AACjD"}
+{"version":3,"sources":["winter/runtime.native.ts"],"sourcesContent":[null],"names":["installAbortSignalPatch","installFormDataPatch","installGlobal","install","require","TextDecoder","TextDecoderStream","TextEncoderStream","URL","URLSearchParams","DOMException","ImportMetaRegistry","default","FormData","AbortSignal","Symbol","asyncIterator","for","useRnFetch","process","env","EXPO_PUBLIC_USE_RN_FETCH","globalThis","Headers","Error","fetch"],"mappings":"AAAA,wFAAwF;AACxF,wBAAwB;AAExB,+FAA+F;AAC/F,iGAAiG;AACjG,OAAO,gCAAgC;AACvC,OAAO,cAAc;AACrB,SAASA,uBAAuB,QAAQ,gBAAgB;AACxD,SAASC,oBAAoB,QAAQ,aAAa;AAClD,SAASC,iBAAiBC,OAAO,QAAQ,kBAAkB;AAE3D,gDAAgD;AAChDA,QAAQ,eAAe,IAAMC,QAAQ,iBAAiBC,WAAW;AACjE,gEAAgE;AAChEF,QAAQ,qBAAqB,IAAMC,QAAQ,uBAAuBE,iBAAiB;AACnF,gEAAgE;AAChEH,QAAQ,qBAAqB,IAAMC,QAAQ,uBAAuBG,iBAAiB;AACnF,mCAAmC;AACnCJ,QAAQ,OAAO,IAAMC,QAAQ,SAASI,GAAG;AACzC,+CAA+C;AAC/CL,QAAQ,mBAAmB,IAAMC,QAAQ,SAASK,eAAe;AACjE,mDAAmD;AACnDN,QAAQ,gBAAgB,IAAMC,QAAQ,kBAAkBM,YAAY;AACpE,sCAAsC;AACtC,kDAAkD;AAElDP,QAAQ,4BAA4B,IAAMC,QAAQ,wBAAwBO,kBAAkB;AAE5F,8EAA8E;AAC9ER,QAAQ,mBAAmB,IAAMC,QAAQ,2BAA2BQ,OAAO;AAE3EX,qBAAqBY;AACrBb,wBAAwBc;AAExB,6CAA6C;AAC7C,+EAA+E;AAC/EC,OAAOC,aAAa,KAAKD,OAAOE,GAAG,CAAC;AAEpC,MAAMC,aACJC,QAAQC,GAAG,CAACC,wBAAwB,KAAK,OAAOF,QAAQC,GAAG,CAACC,wBAAwB,KAAK;AAE3F,IAAI,CAACH,YAAY;IACf,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,CAACI,WAAWC,OAAO,EAAE;QACvB,MAAM,IAAIC,MACR;IAEJ;IACArB,QAAQ,SAAS,IAAMC,QAAQ,WAAWqB,KAAK;AACjD"}

package/build/winter/setupReactNativeEnvironment.d.ts

@@ -0,0 +1 @@
+import 'react-native/setup-env';

package/build/winter/setupReactNativeEnvironment.js

@@ -0,0 +1,5 @@
+// Platform variants of this file pick the entry
+// that the host React Native package for that platform ships.
+import 'react-native/setup-env';
+
+//# sourceMappingURL=setupReactNativeEnvironment.js.map

package/build/winter/setupReactNativeEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["winter/setupReactNativeEnvironment.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA,gDAAgD;AAChD,8DAA8D;AAC9D,OAAO,yBAAyB"}

package/build/winter/setupReactNativeEnvironment.macos.d.ts

@@ -0,0 +1 @@
+export {};

package/build/winter/setupReactNativeEnvironment.macos.js

@@ -0,0 +1,4 @@
+// `react-native/setup-env` was added in React Native 0.87. Remove when bumping `react-native-macos`
+require('react-native/Libraries/Core/InitializeCore');
+
+//# sourceMappingURL=setupReactNativeEnvironment.macos.js.map

package/build/winter/setupReactNativeEnvironment.macos.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["winter/setupReactNativeEnvironment.macos.ts"],"sourcesContent":[null],"names":["require"],"mappings":"AAAA,oGAAoG;AACpGA,QAAQ"}

package/bundledNativeModules.json

@@ -1,9 +1,9 @@
 {
   "@expo/dom-webview": "~58.0.1",
   "@expo/fingerprint": "~0.21.1",
-  "@expo/metro-runtime": "~58.0.4",
+  "@expo/metro-runtime": "~58.0.6",
   "@expo/vector-icons": "^15.0.2",
-  "@expo/ui": "~58.0.4",
+  "@expo/ui": "~58.0.6",
   "@react-native-async-storage/async-storage": "2.2.0",
   "@react-native-community/datetimepicker": "9.2.1",
   "@react-native-masked-view/masked-view": "0.3.2",
@@ -16,87 +16,87 @@
   "eslint-config-expo": "~58.0.2",
   "expo-analytics-amplitude": "~11.3.0",
   "expo-app-auth": "~11.1.0",
-  "expo-app-intents": "~0.4.2",
+  "expo-app-intents": "~0.4.4",
   "expo-app-loader-provider": "~8.0.0",
-  "expo-app-metrics": "~58.0.4",
+  "expo-app-metrics": "~58.0.6",
   "expo-apple-authentication": "~58.0.1",
   "expo-application": "~58.0.1",
-  "expo-asset": "~58.0.4",
-  "expo-audio": "~58.0.1",
-  "expo-auth-session": "~58.0.3",
-  "expo-background-fetch": "~58.0.4",
-  "expo-background-task": "~58.0.4",
+  "expo-asset": "~58.0.6",
+  "expo-audio": "~58.0.2",
+  "expo-auth-session": "~58.0.4",
+  "expo-background-fetch": "~58.0.6",
+  "expo-background-task": "~58.0.6",
   "expo-battery": "~58.0.1",
   "expo-blur": "~58.0.1",
   "expo-brightness": "~58.0.0",
-  "expo-brownfield": "~58.0.4",
-  "expo-build-properties": "~58.0.4",
+  "expo-brownfield": "~58.0.6",
+  "expo-build-properties": "~58.0.6",
   "expo-calendar": "~58.0.2",
-  "expo-camera": "~58.0.2",
+  "expo-camera": "~58.0.3",
   "expo-cellular": "~58.0.0",
   "expo-checkbox": "~58.0.1",
   "expo-clipboard": "~58.0.1",
-  "expo-constants": "~58.0.4",
+  "expo-constants": "~58.0.6",
   "expo-contacts": "~58.0.2",
   "expo-crypto": "~58.0.2",
-  "expo-dev-client": "~58.0.4",
-  "expo-device": "~58.0.1",
-  "expo-document-picker": "~58.0.0",
+  "expo-dev-client": "~58.0.6",
+  "expo-device": "~58.0.2",
+  "expo-document-picker": "~58.0.1",
   "expo-eas-client": "~58.0.0",
-  "expo-file-system": "~58.0.0",
+  "expo-file-system": "~58.0.1",
   "expo-font": "~58.0.2",
   "expo-gl": "~58.0.1",
-  "expo-glass-effect": "~58.0.1",
+  "expo-glass-effect": "~58.0.2",
   "expo-google-app-auth": "~8.3.0",
   "expo-haptics": "~58.0.1",
-  "expo-image": "~58.0.3",
+  "expo-image": "~58.0.5",
   "expo-image-loader": "~58.0.1",
-  "expo-image-manipulator": "~58.0.5",
-  "expo-image-picker": "~58.0.4",
+  "expo-image-manipulator": "~58.0.7",
+  "expo-image-picker": "~58.0.6",
   "expo-intent-launcher": "~58.0.0",
-  "expo-insights": "~58.0.4",
+  "expo-insights": "~58.0.6",
   "expo-keep-awake": "~58.0.1",
   "expo-linear-gradient": "~58.0.1",
-  "expo-linking": "~58.0.4",
+  "expo-linking": "~58.0.6",
   "expo-local-authentication": "~58.0.0",
   "expo-localization": "~58.0.1",
-  "expo-location": "~58.0.4",
+  "expo-location": "~58.0.6",
   "expo-mail-composer": "~58.0.0",
   "expo-manifests": "~58.0.0",
   "expo-maps": "~58.0.2",
   "expo-mcp": "~0.2.1",
-  "expo-media-library": "~58.0.0",
+  "expo-media-library": "~58.0.1",
   "expo-mesh-gradient": "~58.0.1",
-  "expo-module-template": "~58.0.2",
-  "expo-modules-core": "~58.0.4",
+  "expo-module-template": "~58.0.3",
+  "expo-modules-core": "~58.0.6",
   "expo-navigation-bar": "~58.0.1",
   "expo-network": "~58.0.1",
-  "expo-notifications": "~58.0.4",
-  "expo-observe": "~58.0.6",
-  "expo-print": "~58.0.1",
+  "expo-notifications": "~58.0.6",
+  "expo-observe": "~58.0.8",
+  "expo-print": "~58.0.2",
   "expo-live-photo": "~58.0.1",
-  "expo-router": "~58.0.5",
-  "expo-screen-capture": "~58.0.1",
+  "expo-router": "~58.0.7",
+  "expo-screen-capture": "~58.0.2",
   "expo-screen-orientation": "~58.0.0",
   "expo-secure-store": "~58.0.0",
   "expo-sensors": "~58.0.0",
   "expo-server": "~58.0.1",
-  "expo-sharing": "~58.0.7",
+  "expo-sharing": "~58.0.9",
   "expo-sms": "~58.0.0",
   "expo-speech": "~58.0.0",
   "expo-splash-screen": "~58.0.1",
-  "expo-sqlite": "~58.0.4",
+  "expo-sqlite": "~58.0.5",
   "expo-status-bar": "~58.0.1",
   "expo-store-review": "~58.0.0",
   "expo-symbols": "~58.0.2",
   "expo-system-ui": "~58.0.2",
-  "expo-task-manager": "~58.0.5",
+  "expo-task-manager": "~58.0.7",
   "expo-tracking-transparency": "~58.0.0",
-  "expo-updates": "~58.0.6",
+  "expo-updates": "~58.0.8",
   "expo-video-thumbnails": "~58.0.0",
-  "expo-video": "~58.0.2",
-  "expo-web-browser": "~58.0.1",
-  "expo-widgets": "~58.0.4",
+  "expo-video": "~58.0.3",
+  "expo-web-browser": "~58.0.2",
+  "expo-widgets": "~58.0.6",
   "jest-expo": "~58.0.3",
   "lottie-react-native": "~7.5.0",
   "react": "19.3.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo",
-  "version": "58.0.0-preview.4",
+  "version": "58.0.0-preview.6",
   "description": "The Expo SDK",
   "keywords": [
     "expo"
@@ -200,7 +200,7 @@
   },
   "dependencies": {
     "@babel/runtime": "^7.20.0",
-    "@expo/cli": "^58.0.4",
+    "@expo/cli": "^58.0.6",
     "@expo/config": "~58.0.0",
     "@expo/config-plugins": "~58.0.2",
     "@expo/devtools": "~58.0.1",
@@ -213,23 +213,23 @@
     "@expo/metro-config": "~58.0.4",
     "@ungap/structured-clone": "^1.3.0",
     "babel-preset-expo": "~58.0.4",
-    "expo-asset": "~58.0.4",
-    "expo-constants": "~58.0.4",
-    "expo-file-system": "~58.0.0",
+    "expo-asset": "~58.0.6",
+    "expo-constants": "~58.0.6",
+    "expo-file-system": "~58.0.1",
     "expo-font": "~58.0.2",
     "expo-keep-awake": "~58.0.1",
     "expo-modules-autolinking": "~58.0.3",
-    "expo-modules-core": "~58.0.4",
+    "expo-modules-core": "~58.0.6",
     "pretty-format": "^29.7.0",
     "react-refresh": "^0.14.2",
     "whatwg-url-minimum": "^0.2.0"
   },
   "devDependencies": {
     "@expo/dom-webview": "58.0.1",
-    "@expo/metro-runtime": "58.0.4",
+    "@expo/metro-runtime": "58.0.6",
     "@types/node": "^22.14.0",
     "@types/react": "~19.3.0",
-    "expo-updates": "58.0.6",
+    "expo-updates": "58.0.8",
     "npm-run-all2": "^8.0.4",
     "react": "19.3.0",
     "react-dom": "19.3.0",
@@ -269,7 +269,7 @@
   "engines": {
     "node": "^22.13.0 || ^24.3.0 || ^26.0.0 || >=27.0.0"
   },
-  "gitHead": "ebb1fd7569c9c9e172cb9abd73dfede027c1d674",
+  "gitHead": "8aeb4368d396d2d71a2fc8c652c4d1d4d53ed858",
   "scripts": {
     "build": "../expo-module-scripts/bin/expo-build src",
     "clean": "rimraf build",

package/scripts/spm/__tests__/flavored-frameworks.test.js

@@ -6,12 +6,16 @@ const os = require('os');
 const path = require('path');
 
 const {
+  FLAVORS,
   prepareCompileInterfaces,
   resolveFlavoredFramework,
   stableFrameworkId,
   validateFlavoredFramework,
 } = require('../flavored-frameworks');
 
+// GNU tar reads the `C:` in a Windows path as a remote hostname and fails to connect.
+const itNotWindows = process.platform === 'win32' ? it.skip : it;
+
 function makeXcframework(root, frameworkName, flavor, contents = flavor) {
   const xcframework = path.join(root, flavor, `${frameworkName}.xcframework`);
   const framework = path.join(xcframework, 'ios-arm64', `${frameworkName}.framework`);
@@ -33,6 +37,13 @@ function makeXcframework(root, frameworkName, flavor, contents = flavor) {
   return xcframework;
 }
 
+function packTarball(sourceDir, tarballPath, entries, { preservePaths = false } = {}) {
+  fs.mkdirSync(path.dirname(tarballPath), { recursive: true });
+  const flags = preservePaths ? ['-czPf'] : ['-czf'];
+  execFileSync('tar', [...flags, tarballPath, '-C', sourceDir, ...entries]);
+  return tarballPath;
+}
+
 function declaration(frameworkName, debug, release, overrides = {}) {
   return {
     id: stableFrameworkId(frameworkName),
@@ -131,21 +142,16 @@ describe('artifact preparation', () => {
     ).toThrow('missing release');
   });
 
-  it('expands both bundled tarballs before returning absolute flavor paths', () => {
+  itNotWindows('expands both bundled tarballs before returning absolute flavor paths', () => {
     const output = path.join(root, 'test-package', 'output');
     for (const flavor of ['debug', 'release']) {
       const source = path.join(root, `source-${flavor}`);
       makeXcframework(source, 'ExpoPair', flavor);
-      const sourceDir = path.join(source, flavor);
-      const tarballDir = path.join(output, flavor, 'xcframeworks');
-      fs.mkdirSync(tarballDir, { recursive: true });
-      execFileSync('tar', [
-        '-czf',
-        path.join(tarballDir, 'ExpoPair.tar.gz'),
-        '-C',
-        sourceDir,
-        'ExpoPair.xcframework',
-      ]);
+      packTarball(
+        path.join(source, flavor),
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        ['ExpoPair.xcframework']
+      );
     }
 
     const result = resolveFlavoredFramework({
@@ -167,6 +173,150 @@ describe('artifact preparation', () => {
     expect(fs.existsSync(path.join(result.flavors.release, 'Info.plist'))).toBe(true);
   });
 
+  it('accepts a tarball that also bundles a SwiftPM dependency xcframework', () => {
+    const output = path.join(root, 'test-package', 'output');
+    for (const flavor of FLAVORS) {
+      const source = path.join(root, `source-${flavor}`);
+      makeXcframework(source, 'ExpoPair', flavor);
+      makeXcframework(source, 'Lottie', flavor);
+      packTarball(
+        path.join(source, flavor),
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        ['ExpoPair.xcframework', 'Lottie.xcframework']
+      );
+    }
+
+    const result = resolveFlavoredFramework({
+      packageName: 'test-package',
+      moduleRoot: path.join(root, 'module'),
+      frameworkName: 'ExpoPair',
+      cacheDir: path.join(root, 'cache'),
+    });
+    expect(result.flavors).toEqual({
+      debug: path.join(root, 'cache', 'expo-pair', 'debug', 'ExpoPair.xcframework'),
+      release: path.join(root, 'cache', 'expo-pair', 'release', 'ExpoPair.xcframework'),
+    });
+    expect(fs.existsSync(path.join(result.flavors.debug, 'Info.plist'))).toBe(true);
+    expect(
+      fs.existsSync(path.join(root, 'cache', 'expo-pair', 'debug', 'Lottie.xcframework'))
+    ).toBe(true);
+  });
+
+  it('rejects a tarball holding an entry outside an xcframework root', () => {
+    const output = path.join(root, 'test-package', 'output');
+    for (const flavor of FLAVORS) {
+      const source = path.join(root, `source-${flavor}`);
+      makeXcframework(source, 'ExpoPair', flavor);
+      fs.writeFileSync(path.join(source, flavor, 'README.md'), 'stray');
+      packTarball(
+        path.join(source, flavor),
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        ['ExpoPair.xcframework', 'README.md']
+      );
+    }
+
+    expect(() =>
+      resolveFlavoredFramework({
+        packageName: 'test-package',
+        moduleRoot: path.join(root, 'module'),
+        frameworkName: 'ExpoPair',
+        cacheDir: path.join(root, 'cache'),
+      })
+    ).toThrow("'README.md' is not part of an .xcframework");
+  });
+
+  it('rejects a tarball that never contains the requested framework', () => {
+    const output = path.join(root, 'test-package', 'output');
+    for (const flavor of FLAVORS) {
+      const source = path.join(root, `source-${flavor}`);
+      makeXcframework(source, 'Lottie', flavor);
+      packTarball(
+        path.join(source, flavor),
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        ['Lottie.xcframework']
+      );
+    }
+
+    expect(() =>
+      resolveFlavoredFramework({
+        packageName: 'test-package',
+        moduleRoot: path.join(root, 'module'),
+        frameworkName: 'ExpoPair',
+        cacheDir: path.join(root, 'cache'),
+      })
+    ).toThrow('does not contain ExpoPair.xcframework');
+  });
+
+  it('rejects a tarball whose member escapes through an absolute path', () => {
+    const output = path.join(root, 'test-package', 'output');
+    for (const flavor of FLAVORS) {
+      const source = path.join(root, `source-${flavor}`);
+      const xcframework = makeXcframework(source, 'ExpoPair', flavor);
+      packTarball(
+        path.join(source, flavor),
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        [xcframework],
+        { preservePaths: true }
+      );
+    }
+
+    expect(() =>
+      resolveFlavoredFramework({
+        packageName: 'test-package',
+        moduleRoot: path.join(root, 'module'),
+        frameworkName: 'ExpoPair',
+        cacheDir: path.join(root, 'cache'),
+      })
+    ).toThrow(/holds the unsafe path '\/.*ExpoPair\.xcframework/);
+  });
+
+  it("rejects a tarball whose member escapes through '..'", () => {
+    const output = path.join(root, 'test-package', 'output');
+    for (const flavor of FLAVORS) {
+      const source = path.join(root, `source-${flavor}`);
+      const xcframework = makeXcframework(source, 'ExpoPair', flavor);
+      packTarball(
+        xcframework,
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        ['../ExpoPair.xcframework'],
+        { preservePaths: true }
+      );
+    }
+
+    expect(() =>
+      resolveFlavoredFramework({
+        packageName: 'test-package',
+        moduleRoot: path.join(root, 'module'),
+        frameworkName: 'ExpoPair',
+        cacheDir: path.join(root, 'cache'),
+      })
+    ).toThrow("holds the unsafe path '../ExpoPair.xcframework");
+  });
+
+  it('rejects a root named only .xcframework', () => {
+    const output = path.join(root, 'test-package', 'output');
+    for (const flavor of FLAVORS) {
+      const source = path.join(root, `source-${flavor}`);
+      makeXcframework(source, 'ExpoPair', flavor);
+      fs.mkdirSync(path.join(source, flavor, '.xcframework'), { recursive: true });
+      fs.writeFileSync(path.join(source, flavor, '.xcframework', 'Info.plist'), '<plist/>');
+      packTarball(
+        path.join(source, flavor),
+        path.join(output, flavor, 'xcframeworks', 'ExpoPair.tar.gz'),
+        ['ExpoPair.xcframework', '.xcframework']
+      );
+    }
+
+    expect(() =>
+      resolveFlavoredFramework({
+        packageName: 'test-package',
+        moduleRoot: path.join(root, 'module'),
+        frameworkName: 'ExpoPair',
+        cacheDir: path.join(root, 'cache'),
+      })
+    ).toThrow('is not part of an .xcframework');
+  });
+
   it('produces byte-identical compile interfaces regardless of declaration order', () => {
     const aDebug = makeXcframework(root, 'ExpoA', 'a-debug', 'a');
     const aRelease = makeXcframework(root, 'ExpoA', 'a-release', 'a');

package/scripts/spm/flavored-frameworks.js

@@ -57,6 +57,12 @@ function artifactBaseDirs(packageName, moduleRoot) {
   return Array.from(new Set(bases));
 }
 
+/**
+ * A flavor tarball holds one xcframework root per product the prebuild packed:
+ * the module itself plus any SwiftPM dependency bundled with it (for example
+ * Lottie.xcframework inside lottie-react-native). Anything else is either an
+ * unrelated archive or an extraction escape.
+ */
 function validateTarEntries(tarballPath, frameworkName) {
   const expectedRoot = `${frameworkName}.xcframework`;
   const listing = execFileSync('tar', ['-tzf', tarballPath], {
@@ -70,13 +76,33 @@ function validateTarEntries(tarballPath, frameworkName) {
   if (entries.length === 0) {
     throw new Error(`[expo-spm-plugin] ${tarballPath} is empty`);
   }
+  const roots = new Set();
   for (const entry of entries) {
     const parts = entry.split('/');
-    if (path.isAbsolute(entry) || parts.includes('..') || parts[0] !== expectedRoot) {
+    if (path.isAbsolute(entry) || parts.includes('..')) {
+      throw new Error(
+        `[expo-spm-plugin] ${tarballPath} holds the unsafe path '${entry}'. Extracting it would ` +
+          'write outside the plugin cache, so the archive is not a precompiled Expo artifact. ' +
+          'Delete it and rebuild or re-download the precompiled module.'
+      );
+    }
+    if (!/.+\.xcframework$/.test(parts[0])) {
       throw new Error(
-        `[expo-spm-plugin] ${tarballPath} must contain only ${expectedRoot}, found '${entry}'`
+        `[expo-spm-plugin] in ${tarballPath}, '${entry}' is not part of an .xcframework. ` +
+          'A flavor tarball holds only XCFramework directories, so this archive was packed by ' +
+          'something other than the Expo prebuild pipeline. Delete it and rebuild or ' +
+          're-download the precompiled module.'
       );
     }
+    roots.add(parts[0]);
+  }
+  if (!roots.has(expectedRoot)) {
+    throw new Error(
+      `[expo-spm-plugin] ${tarballPath} does not contain ${expectedRoot}; it holds ` +
+        `${Array.from(roots).sort().join(', ')}. The tarball belongs to a different product or ` +
+        'the prebuild for this one did not finish. Rebuild the module with the Expo prebuild ' +
+        'pipeline, or re-download its precompiled artifacts.'
+    );
   }
 }
 

package/scripts/spm/manifests.js

@@ -496,7 +496,7 @@ function resolveTargetPaths(targets, moduleRoot) {
       continue;
     }
     const inferred =
-      PREDEFINED_SOURCE_DIRS.map((dir) => path.join(dir, target.name)).find((rel) =>
+      PREDEFINED_SOURCE_DIRS.map((dir) => path.posix.join(dir, target.name)).find((rel) =>
         fs.existsSync(path.join(moduleRoot, rel))
       ) ??
       (singleTarget

package/src/winter/__tests__/runtime.test.web.ts

@@ -18,7 +18,41 @@ function setCurrentScript(src: string | null) {
 // The web test project runs this file in jsdom, the node project on the server.
 // `getBundleUrl` reads `document.currentScript`, so only assert in the browser.
 if (typeof window === 'undefined') {
-  it('noop', () => {});
+  // The jsdom environment provides animation frames, which a server environment such as Node.js
+  // does not, so remove them for each test.
+  const jsdomRequestAnimationFrame = globalThis.requestAnimationFrame;
+  const jsdomCancelAnimationFrame = globalThis.cancelAnimationFrame;
+
+  beforeEach(() => {
+    // @ts-expect-error Simulates a server environment without animation frames.
+    delete globalThis.requestAnimationFrame;
+    // @ts-expect-error Simulates a server environment without animation frames.
+    delete globalThis.cancelAnimationFrame;
+  });
+
+  afterEach(() => {
+    globalThis.requestAnimationFrame = jsdomRequestAnimationFrame;
+    globalThis.cancelAnimationFrame = jsdomCancelAnimationFrame;
+    jest.resetModules();
+  });
+
+  it('stubs requestAnimationFrame on the server, never running callbacks', async () => {
+    require('../runtime');
+
+    const callback = jest.fn();
+    globalThis.requestAnimationFrame(callback);
+    globalThis.cancelAnimationFrame(0);
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(callback).not.toHaveBeenCalled();
+  });
+
+  it('keeps an existing requestAnimationFrame on the server', () => {
+    const existingRequestAnimationFrame = jest.fn();
+    globalThis.requestAnimationFrame = existingRequestAnimationFrame;
+    require('../runtime');
+
+    expect(globalThis.requestAnimationFrame).toBe(existingRequestAnimationFrame);
+  });
 } else {
   afterEach(() => {
     setCurrentScript(null);

package/src/winter/runtime.native.ts

@@ -3,7 +3,7 @@
 
 // WARN(@kitten): We must ensure that the core react-native globals are initialized before ours
 // Otherwise we're relying on `getModulesRunBeforeMainModule` which is unstable or can be missing
-import 'react-native/setup-env';
+import './setupReactNativeEnvironment';
 import '../../types';
 import { installAbortSignalPatch } from './AbortSignal';
 import { installFormDataPatch } from './FormData';

package/src/winter/runtime.ts

@@ -8,3 +8,10 @@ Object.defineProperty(globalThis, '__ExpoImportMetaRegistry', {
   enumerable: false,
   writable: true,
 });
+
+// Server rendering has no animation frames, but we need to stub these *temporarily* to work around
+// react-native-worklets, see: https://github.com/software-mansion/react-native-reanimated/pull/10667
+if (process.env.EXPO_SERVER && typeof globalThis.requestAnimationFrame !== 'function') {
+  globalThis.requestAnimationFrame = () => 0;
+  globalThis.cancelAnimationFrame = () => {};
+}

package/src/winter/setupReactNativeEnvironment.macos.ts

@@ -0,0 +1,2 @@
+// `react-native/setup-env` was added in React Native 0.87. Remove when bumping `react-native-macos`
+require('react-native/Libraries/Core/InitializeCore');

package/src/winter/setupReactNativeEnvironment.ts

@@ -0,0 +1,3 @@
+// Platform variants of this file pick the entry
+// that the host React Native package for that platform ships.
+import 'react-native/setup-env';