feat: add managed runtime delivery and safer project setup - #28
Conversation
Add signed local runtime manifests, publisher authority leases, bounded artifact authorization and download verification, revocation-aware fallback, package-managed Metro integration, bundle-drop sync, hardened Expo and bare setup, expanded doctor diagnostics, native ES256/SHA-256 support, and comprehensive JS/Android/iOS coverage.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5019589d6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| function normalizeManifestOrigin(value: string): string | undefined { | ||
| const match = /^https:\/\/([^/?#@]+)\/?$/i.exec(value); | ||
| if (!match) return undefined; |
There was a problem hiding this comment.
When manifestBaseUrl contains a path, such as https://cdn.example.com/bundle-drop, the bootstrap validator accepts it and manifest URL construction supports it, but this regex rejects the entire configured value instead of extracting its origin. Consequently, even a lease declaring the matching https://cdn.example.com origin is reported as authority_origin_mismatch, and every managed manifest check falls back to /resolve; normalize the configured URL to its HTTPS origin before comparing.
Useful? React with 👍 / 👎.
| function laneStateKey(identity: RuntimeDeliveryLaneIdentity): string { | ||
| return [identity.projectSlug, identity.channelName, identity.platform, identity.runtimeVersion] | ||
| .map(value => encodeURIComponent(value)) | ||
| .join('/'); |
There was a problem hiding this comment.
After an app is repointed to a different server or organization that reuses the same project slug, channel, platform, and runtime version, this key loads the previous authority's generation state. Because runtime-delivery-state.json is not cleared during native binary-version cleanup, a legitimate new project's lower generation is then rejected indefinitely as a regression until it surpasses the unrelated old value; include the bootstrap's server/organization or another stable authority identifier in the state key.
Useful? React with 👍 / 👎.
🤖 I have created a release *beep* *boop* --- ## [0.6.0](v0.5.1...v0.6.0) (2026-08-22) ### Features * add managed runtime delivery and safer project setup ([#28](#28)) ([cba0725](cba0725)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
2 participants
Summary
Make managed runtime delivery the standard Bundle Drop path and harden automated and manual project setup.
Managed runtime delivery
Project setup
bundle-drop syncfor generating or repairing the public runtime trust bootstrap.bundle-drop doctorand document a complete non-AI manual setup flow.Native runtime
nativeVersionfrom0.4.5to0.5.0.Expected release
This
featPR should cause Release Please to propose npm version0.6.0.package.json.versionremains0.5.1in this PR; Release Please owns that bump. The generated release PR will receive the complete curated release notes before it is merged.Upgrade instructions
@gfean/react-native-bundle-drop.npx bundle-drop initif the package-managed Metro wrapper is not already installed.npx bundle-drop syncand commit.bundle-drop/runtime-delivery.generated.jsonwith the application. The file contains public verification material, not secrets.nativeVersionis now0.5.0, refresh Pods/prebuild as appropriate and ship a new native binary before enabling managed runtime delivery.npx bundle-drop doctorand resolve every reported integration issue.Validation
yarn verify:releaseyarn buildnpm packand exact tarball inspection: 265 files, 1,283,977 unpacked bytesactionlintgit diff --checkSafety notes