@bravemobile/react-native-code-push 13.0.0 → 13.1.0-beta.1

package/CodePush.podspec

@@ -12,11 +12,40 @@ Pod::Spec.new do |s|
   s.source         = { :git => 'https://github.com/Soomgo-Mobile/react-native-code-push.git', :tag => "v#{s.version}"}
   s.ios.deployment_target = '15.5'
   s.tvos.deployment_target = '15.5'
-  s.preserve_paths = '*.js'
+  s.preserve_paths = ['*.js', 'cpp/binarypatch/**/*.h']
   s.library        = 'z'
-  s.source_files = 'ios/CodePush/*.{h,m,mm}'
+  # The applier that installs a binary patch update is compiled from the C sources the
+  # other platform and the host build compile as well, referenced where they live rather
+  # than copied here, which is what keeps the appliers of the platforms from drifting
+  # apart. Only the decompressing half of zstd is needed, and its assembly fast path is
+  # deliberately not vendored, so this list is the same one the other platform builds.
+  s.source_files = [
+    'ios/CodePush/*.{h,m,mm}',
+    'cpp/binarypatch/binarypatch_zstd_decompressor.c',
+    'cpp/binarypatch/vendor/HDiffPatch/libHDiffPatch/HPatch/patch.c',
+    'cpp/binarypatch/vendor/zstd/common/debug.c',
+    'cpp/binarypatch/vendor/zstd/common/entropy_common.c',
+    'cpp/binarypatch/vendor/zstd/common/error_private.c',
+    'cpp/binarypatch/vendor/zstd/common/fse_decompress.c',
+    'cpp/binarypatch/vendor/zstd/common/xxhash.c',
+    'cpp/binarypatch/vendor/zstd/common/zstd_common.c',
+    'cpp/binarypatch/vendor/zstd/decompress/huf_decompress.c',
+    'cpp/binarypatch/vendor/zstd/decompress/zstd_ddict.c',
+    'cpp/binarypatch/vendor/zstd/decompress/zstd_decompress.c',
+    'cpp/binarypatch/vendor/zstd/decompress/zstd_decompress_block.c'
+  ]
   s.public_header_files = ['ios/CodePush/CodePush.h']
 
+  binary_patch_header_search_paths = '"$(PODS_TARGET_SRCROOT)/cpp/binarypatch" "$(PODS_TARGET_SRCROOT)/cpp/binarypatch/vendor/HDiffPatch" "$(PODS_TARGET_SRCROOT)/cpp/binarypatch/vendor/zstd"'
+  # ZSTD_DISABLE_ASM: the assembly fast path is intentionally not vendored.
+  # _IS_USED_MULTITHREAD=0: patches are applied on the thread that downloads them.
+  binary_patch_preprocessor_definitions = '$(inherited) ZSTD_DISABLE_ASM=1 _IS_USED_MULTITHREAD=0'
+
+  s.pod_target_xcconfig = {
+    'HEADER_SEARCH_PATHS' => binary_patch_header_search_paths,
+    'GCC_PREPROCESSOR_DEFINITIONS' => binary_patch_preprocessor_definitions
+  }
+
   # Note: Even though there are copy/pasted versions of some of these dependencies in the repo,
   # we explicitly let CocoaPods pull in the versions below so all dependencies are resolved and
   # linked properly at a parent workspace level.
@@ -25,9 +54,12 @@ Pod::Spec.new do |s|
 
   if ENV['RCT_NEW_ARCH_ENABLED'] == '1'
     s.compiler_flags = '-DRCT_NEW_ARCH_ENABLED=1'
+    # This replaces pod_target_xcconfig rather than adding to it, so what the applier
+    # needs to build has to be carried into it as well.
     s.pod_target_xcconfig = {
       'CLANG_CXX_LANGUAGE_STANDARD' => 'c++17',
-      'HEADER_SEARCH_PATHS' => "\"$(PODS_ROOT)/Headers/Public/ReactCodegen\" \"${PODS_CONFIGURATION_BUILD_DIR}/ReactCodegen/ReactCodegen.framework/Headers\""
+      'HEADER_SEARCH_PATHS' => "\"$(PODS_ROOT)/Headers/Public/ReactCodegen\" \"${PODS_CONFIGURATION_BUILD_DIR}/ReactCodegen/ReactCodegen.framework/Headers\" #{binary_patch_header_search_paths}",
+      'GCC_PREPROCESSOR_DEFINITIONS' => binary_patch_preprocessor_definitions
     }
 
     s.dependency 'ReactCodegen'

package/README.md

@@ -1,9 +1,9 @@
 # @bravemobile/react-native-code-push
 
-### Seamless Transition from AppCenter to a Fully Self-Hosted CodePush
+### CodePush without an update server
 
 - **No API Server Needed** – Use static hosting solutions (e.g., AWS S3) without maintaining additional API servers.
-- **Familiar API** – Built on `microsoft/react-native-code-push`, ensuring compatibility and stability.
+- **Familiar API** – Built on `microsoft/react-native-code-push`, with the native module migrated to TurboModule.
 - **Flexible Deployment** – Implement your own release workflow, giving you complete control over the deployment process.
 
 ### 🚀 New Architecture support
@@ -36,7 +36,7 @@ npm install @bravemobile/react-native-code-push
 1. Edit `android/app/build.gradle` file to remove the `apply from: "../../node_modules/..../codepush.gradle"` line.
 
 2. The following changes are optional but recommended for cleaning up the old configuration:
-   - Since the deployment key is no longer needed due to the retirement of AppCenter, it is recommended to remove it from your `Info.plist`, `strings.xml`, or JavaScript code.
+   - Since the deployment key is no longer used, it is recommended to remove it from your `Info.plist`, `strings.xml`, or JavaScript code.
    - Thanks to Auto Linking, you can remove the `react-native-code-push` module settings from `settings.gradle`.
 
 3. Follow the installation guide starting from **'4. "CodePush-ify" your app'**.
@@ -81,6 +81,10 @@ Run `cd ios && pod install && cd ..`
 
 (`npx pod-install`, `bundle exec pod install --project-directory=./ios`, ..)
 
+The pod compiles the applier that installs binary patch updates from the C sources it
+carries, so there is nothing else to install: CocoaPods builds them along with the rest
+of the pod.
+
 
 #### (2) Edit `AppDelegate` Code
 
@@ -294,6 +298,38 @@ Please refer to the [CodePushOptions](https://github.com/Soomgo-Mobile/react-nat
 - **onDownloadStart:** Triggered when the bundle download begins.
 - **onDownloadSuccess:** Triggered when the bundle download completes successfully.
 - **onSyncError:** Triggered when an unknown error occurs during the update process. (`CodePush.SyncStatus.UNKNOWN_ERROR` status)
+- **onBinaryPatchResult:** Triggered when an update that was published with a binary patch has been downloaded, with the release label and how the patch went. Unlike the callbacks above, this one can also be passed to a single `sync()` call - see below.
+
+`onBinaryPatchResult` is called with `{ status: "applied" | "fallback", fallbackReason?: string, applyDurationMs: number }`.
+A `"fallback"` is not a failed update: the update is downloaded in full instead and installed as usual, so the result
+is there to be observed and nothing more. The library neither stores it nor sends it anywhere - an app that wants it in
+its telemetry sends it itself. A callback that throws never fails the update - the error is only logged to the console.
+A fallback also shows in `downloadProgressCallback`: the full download reports a second progress stream that counts
+`receivedBytes` from zero again, against its own, larger `totalBytes`.
+
+Register `onBinaryPatchResult` on `CodePush({ ... })` like the callbacks above and it covers every sync, whatever the `checkFrequency` is
+and including the `CodePush.sync()` calls you make yourself.
+
+```typescript
+export default CodePush({
+  checkFrequency: CodePush.CheckFrequency.MANUAL, // or something else
+  releaseHistoryFetcher: releaseHistoryFetcher,
+  onBinaryPatchResult: (label, result) => {
+    // Send it to your own telemetry, if you want it there.
+  },
+})(MyApp);
+```
+
+Pass it to a `sync()` call to override the registered one for that call - to tag the result of one particular sync,
+for instance.
+
+```typescript
+CodePush.sync({
+  onBinaryPatchResult: (label, result) => {
+    // Send it to your own telemetry, if you want it there.
+  },
+});
+```
 
 
 ### 5. Configure the CLI Tool
@@ -396,6 +432,84 @@ module.exports = Config;
 ```
 
 
+### 6. Export the Embedded Bundle (Optional)
+
+Only needed if you want to release **binary patch updates** (`release --binary-bundle-path`).
+A binary patch is the difference between the update and the JS bundle that is already
+inside the installed app, so releasing one means holding on to that bundle: the exact
+bytes the build you shipped to the store embedded.
+
+The library ships a hook for each platform that copies the freshly compiled bundle out of
+the build, together with a `binary-patch-base.json` record describing it.
+
+**Android** - apply the Gradle script in your app module's `android/app/build.gradle`:
+
+```groovy
+apply plugin: "com.android.application"
+apply plugin: "com.facebook.react"
+
+react {
+    // ...
+}
+
+apply from: "../../node_modules/@bravemobile/react-native-code-push/android/codepush-export.gradle"
+```
+
+The line can go anywhere in the file (if you use `ext.codePushExportDir`, set it before the
+`apply from:` line). Every variant that bundles JS then exports to
+`android/app/build/codepush/embedded-bundle/<variant>/` after it is bundled. Pass
+`-PcodePushExportDir=<path>` (or set `ext.codePushExportDir`) to export somewhere else; the
+`<variant>` directory is appended either way.
+
+**iOS** - call the export script at the end of the **"Bundle React Native code and images"**
+build phase. In Xcode, open that phase
+in your app target's **Build Phases** tab and append the last line below to its script:
+
+```bash
+/bin/sh -c "\"$WITH_ENVIRONMENT\" \"$REACT_NATIVE_XCODE\""
+
+"$SRCROOT/../node_modules/@bravemobile/react-native-code-push/scripts/export-embedded-bundle.sh"
+```
+
+The export lands in `$BUILD_DIR/codepush/embedded-bundle/$CONFIGURATION-$PLATFORM_NAME/`.
+Set the `CODEPUSH_EXPORT_DIR` environment variable to export somewhere else; the
+`$CONFIGURATION-$PLATFORM_NAME` directory is appended either way.
+
+**Archive the export per binary release.** Whatever pipeline builds your store binary
+should keep that build's export somewhere durable, organized by binary version, so a later
+release can fetch the bundle that matches the binary it targets:
+
+```bash
+# Android, after ./gradlew :app:assembleRelease
+aws s3 cp --recursive \
+  android/app/build/codepush/embedded-bundle/release \
+  "s3://your-bucket/binaries/android/$BINARY_VERSION/"
+
+# iOS - point the export at a path the pipeline knows, since $BUILD_DIR only exists inside the build
+export CODEPUSH_EXPORT_DIR="$PWD/codepush-export"
+xcodebuild -workspace ios/YourApp.xcworkspace -scheme YourApp -configuration Release archive # ...
+aws s3 cp --recursive \
+  "$CODEPUSH_EXPORT_DIR/Release-iphoneos" \
+  "s3://your-bucket/binaries/ios/$BINARY_VERSION/"
+```
+
+To release a patch later, download the export and pass the bundle's path to
+`--binary-bundle-path`:
+
+```bash
+aws s3 cp --recursive "s3://your-bucket/binaries/android/1.0.0/" ./binary/
+npx code-push release -b 1.0.0 -v 1.0.1 -p android \
+                      --binary-bundle-path ./binary/index.android.bundle
+```
+
+`release` also uses the record to verify the base bundle it was handed - see
+[Verifying the base bundle](cli/README.md#verifying-the-base-bundle) for details.
+
+> [!NOTE]
+> Applying these hooks automatically through the Expo config plugin (`app.plugin.js`) is
+> not implemented yet.
+
+
 ## 🚀 CLI Tool Usage
 
 > [!TIP]

package/THIRD-PARTY-NOTICES

@@ -0,0 +1,96 @@
+THIRD PARTY NOTICES
+===================
+
+This package includes third party source code. The notices below apply to that
+code only; the rest of this project is covered by LICENSE.md.
+
+
+-------------------------------------------------------------------------------
+HDiffPatch
+-------------------------------------------------------------------------------
+
+Version:    v5.1.3
+Source:     https://github.com/sisong/HDiffPatch/tree/v5.1.3
+License:    MIT
+Vendored:   cpp/binarypatch/vendor/HDiffPatch/
+
+Only the files required to apply a patch on device are vendored, from
+libHDiffPatch/HPatch: patch.c, patch.h, patch_private.h, patch_types.h,
+checksum_plugin.h and hpatch_mt/hpatch_mt.h. The diff side of HDiffPatch is not
+vendored; the `hdiffz` command line tool is built from upstream sources by
+scripts/binary-patch/build-hdiffpatch.sh and is not distributed with this package.
+
+MIT License
+
+HDiffPatch
+Copyright (c) 2012-2025 housisong
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+-------------------------------------------------------------------------------
+Zstandard (zstd)
+-------------------------------------------------------------------------------
+
+Version:    1.5.7
+Commit:     68c88c7c7ad22b5e6882a5296ef96d27dc8750c4
+Source:     https://github.com/sisong/zstd
+            (the fork HDiffPatch builds against, derived from
+            https://github.com/facebook/zstd)
+            The files here are a snapshot of that fork; the copies in this
+            repository are the version the appliers are built from, and
+            scripts/binary-patch/build-hdiffpatch.sh pins the same commit so the
+            `hdiffz` it builds compresses with the code that is vendored here.
+License:    BSD-3-Clause
+Vendored:   cpp/binarypatch/vendor/zstd/
+
+Only the decompression path is vendored (lib/common and lib/decompress). The
+amd64 assembly implementation of the Huffman decoder is not vendored because the
+appliers are compiled with ZSTD_DISABLE_ASM=1.
+
+BSD License
+
+For Zstandard software
+
+Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/android/app/build.gradle

@@ -32,8 +32,27 @@ android {
     defaultConfig {
         consumerProguardFiles 'proguard-rules.pro'
     }
+
+    // Builds the binary patch applier. Its sources are the shared ones at the root of the
+    // repository, which the CMake file points at; nothing is compiled twice.
+    externalNativeBuild {
+        cmake {
+            path "src/main/cpp/CMakeLists.txt"
+        }
+    }
+
+    testOptions {
+        // The unit tests exercise plain logic, so the android framework classes they touch
+        // in passing (logging above all) are allowed to do nothing instead of throwing.
+        unitTests.returnDefaultValues = true
+    }
 }
 
 dependencies {
     implementation "com.facebook.react:react-native:+"
+
+    testImplementation "junit:junit:4.13.2"
+    // org.json ships as stubs in the android framework jar, and the unit tests parse real
+    // manifests, so they need an implementation that actually parses.
+    testImplementation "org.json:json:20231013"
 }

package/android/app/proguard-rules.pro

@@ -37,3 +37,8 @@
 
 # Can't find referenced class org.bouncycastle.**
 -dontwarn com.nimbusds.jose.**
+
+# The binary patch applier is found by name from the native library.
+-keepclasseswithmembernames class com.microsoft.codepush.react.HDiffPatchNative {
+    native <methods>;
+}

package/android/app/src/main/cpp/CMakeLists.txt

@@ -0,0 +1,38 @@
+cmake_minimum_required(VERSION 3.13)
+
+project(codepush-binarypatch C)
+
+# The applier sources live outside the platform directories because the host build and
+# the other platform compile the very same files. Referencing them where they are is
+# what keeps the appliers of the platforms from drifting apart, so they are deliberately
+# not copied into this directory.
+set(BINARY_PATCH_DIR ${CMAKE_CURRENT_SOURCE_DIR}/../../../../../cpp/binarypatch)
+
+add_library(codepush-binarypatch SHARED
+        ${CMAKE_CURRENT_SOURCE_DIR}/binarypatch_jni.c
+        ${BINARY_PATCH_DIR}/binarypatch_zstd_decompressor.c
+        ${BINARY_PATCH_DIR}/vendor/HDiffPatch/libHDiffPatch/HPatch/patch.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/common/debug.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/common/entropy_common.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/common/error_private.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/common/fse_decompress.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/common/xxhash.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/common/zstd_common.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/decompress/huf_decompress.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/decompress/zstd_ddict.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/decompress/zstd_decompress.c
+        ${BINARY_PATCH_DIR}/vendor/zstd/decompress/zstd_decompress_block.c)
+
+target_include_directories(codepush-binarypatch PRIVATE
+        ${BINARY_PATCH_DIR}
+        ${BINARY_PATCH_DIR}/vendor/HDiffPatch
+        ${BINARY_PATCH_DIR}/vendor/zstd)
+
+# ZSTD_DISABLE_ASM: the assembly fast path is intentionally not vendored.
+# _IS_USED_MULTITHREAD=0: patches are applied on the thread that downloads them.
+target_compile_definitions(codepush-binarypatch PRIVATE
+        ZSTD_DISABLE_ASM=1
+        _IS_USED_MULTITHREAD=0)
+
+find_library(log-lib log)
+target_link_libraries(codepush-binarypatch ${log-lib})

package/android/app/src/main/cpp/binarypatch_jni.c

@@ -0,0 +1,181 @@
+/*
+ * JNI entry point of the CodePush binary patch applier.
+ *
+ * The applier itself is the shared C code one directory tree up, which the host build and
+ * the other platform compile as well; this file only moves data across the JNI boundary
+ * and turns a failure into the result code `HDiffPatchNative` hands back to Java.
+ *
+ * Memory contract, the same one the host build documents:
+ *   - the base bundle is held whole, because the patches are produced with `hdiffz -m`,
+ *     which patches with random access to the base data
+ *   - the patch is held whole, being far smaller than either bundle
+ *   - the restored bundle is written sequentially to a file, so a patch session never
+ *     holds two bundles at once
+ *
+ * A patch carries no checksum of the base data and its zstd streams carry no content
+ * checksum, so a successful apply here is not proof of a correct result. The caller
+ * verifies the base and target hashes; this file cannot.
+ */
+
+#include <jni.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <android/log.h>
+
+#include "binarypatch_zstd_decompressor.h"
+#include "libHDiffPatch/HPatch/patch.h"
+
+#define LOG_TAG "ReactNative"
+#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)
+
+/* Mirrored by CodePushBinaryPatch.PatchApplier; the two lists have to stay in step. */
+#define RESULT_OK 0
+#define RESULT_INVALID_ARGUMENT 1
+#define RESULT_IO_ERROR 2
+#define RESULT_INVALID_HEADER 3
+#define RESULT_UNSUPPORTED_COMPRESSION 4
+#define RESULT_SIZE_MISMATCH 5
+#define RESULT_APPLY_FAILED 6
+
+/* Scratch buffer handed to patch_decompress_with_cache() to reduce stream reads. */
+#define APPLY_CACHE_SIZE (1024 * 1024)
+
+typedef struct {
+    FILE*              file;
+    hpatch_StreamPos_t writtenSize;
+} TSequentialFileWriter;
+
+static hpatch_BOOL _write_sequential(const hpatch_TStreamOutput* stream,
+                                     hpatch_StreamPos_t writeToPos,
+                                     const unsigned char* data,
+                                     const unsigned char* data_end) {
+    TSequentialFileWriter* self = (TSequentialFileWriter*)stream->streamImport;
+    const size_t length = (size_t)(data_end - data);
+    /* patch_decompress_with_cache() only ever appends; anything else is a bug. */
+    if (writeToPos != self->writtenSize) {
+        return hpatch_FALSE;
+    }
+    if (fwrite(data, 1, length, self->file) != length) {
+        return hpatch_FALSE;
+    }
+    self->writtenSize += length;
+    return hpatch_TRUE;
+}
+
+JNIEXPORT jint JNICALL
+Java_com_microsoft_codepush_react_HDiffPatchNative_applyPatch(JNIEnv* env,
+                                                             jclass clazz,
+                                                             jbyteArray base,
+                                                             jbyteArray patch,
+                                                             jstring outputPath,
+                                                             jlong expectedTargetSize) {
+    jbyte* baseData = NULL;
+    jbyte* patchData = NULL;
+    const char* outputPathChars = NULL;
+    unsigned char* cache = NULL;
+    jsize baseSize = 0;
+    jsize patchSize = 0;
+    hpatch_compressedDiffInfo diffInfo;
+    hpatch_TDecompress decompressor;
+    hpatch_TStreamInput baseStream;
+    hpatch_TStreamInput patchStream;
+    hpatch_TStreamOutput targetStream;
+    TSequentialFileWriter writer;
+    hpatch_BOOL applied;
+    int result = RESULT_OK;
+
+    (void)clazz;
+
+    if ((base == NULL) || (patch == NULL) || (outputPath == NULL) || (expectedTargetSize <= 0)) {
+        return RESULT_INVALID_ARGUMENT;
+    }
+
+    baseSize = (*env)->GetArrayLength(env, base);
+    patchSize = (*env)->GetArrayLength(env, patch);
+    baseData = (*env)->GetByteArrayElements(env, base, NULL);
+    patchData = (*env)->GetByteArrayElements(env, patch, NULL);
+    outputPathChars = (*env)->GetStringUTFChars(env, outputPath, NULL);
+    if ((baseData == NULL) || (patchData == NULL) || (outputPathChars == NULL)) {
+        LOGE("[CodePush] out of memory while reading the binary patch inputs");
+        result = RESULT_IO_ERROR;
+        goto cleanup;
+    }
+
+    binarypatch_zstd_decompressor_init(&decompressor);
+
+    if (!getCompressedDiffInfo_mem(&diffInfo, (const unsigned char*)patchData,
+                                   (const unsigned char*)patchData + patchSize)) {
+        LOGE("[CodePush] the binary patch header could not be read");
+        result = RESULT_INVALID_HEADER;
+        goto cleanup;
+    }
+    if ((strlen(diffInfo.compressType) > 0) && !decompressor.is_can_open(diffInfo.compressType)) {
+        LOGE("[CodePush] the binary patch uses an unsupported codec: %s", diffInfo.compressType);
+        result = RESULT_UNSUPPORTED_COMPRESSION;
+        goto cleanup;
+    }
+    if (diffInfo.oldDataSize != (hpatch_StreamPos_t)baseSize) {
+        LOGE("[CodePush] the binary patch expects a %llu byte base bundle, this one is %llu bytes",
+             (unsigned long long)diffInfo.oldDataSize, (unsigned long long)baseSize);
+        result = RESULT_SIZE_MISMATCH;
+        goto cleanup;
+    }
+    if (diffInfo.newDataSize != (hpatch_StreamPos_t)expectedTargetSize) {
+        LOGE("[CodePush] the binary patch produces %llu bytes, the manifest promises %llu",
+             (unsigned long long)diffInfo.newDataSize, (unsigned long long)expectedTargetSize);
+        result = RESULT_SIZE_MISMATCH;
+        goto cleanup;
+    }
+
+    cache = (unsigned char*)malloc(APPLY_CACHE_SIZE);
+    if (cache == NULL) {
+        LOGE("[CodePush] out of memory while allocating the binary patch cache");
+        result = RESULT_IO_ERROR;
+        goto cleanup;
+    }
+
+    writer.file = fopen(outputPathChars, "wb");
+    writer.writtenSize = 0;
+    if (writer.file == NULL) {
+        LOGE("[CodePush] the restored bundle could not be opened for writing");
+        result = RESULT_IO_ERROR;
+        goto cleanup;
+    }
+
+    mem_as_hStreamInput(&baseStream, (const unsigned char*)baseData, (const unsigned char*)baseData + baseSize);
+    mem_as_hStreamInput(&patchStream, (const unsigned char*)patchData, (const unsigned char*)patchData + patchSize);
+    memset(&targetStream, 0, sizeof(targetStream));
+    targetStream.streamImport = &writer;
+    targetStream.streamSize = diffInfo.newDataSize;
+    targetStream.write = _write_sequential;
+
+    applied = patch_decompress_with_cache(&targetStream, &baseStream, &patchStream, &decompressor,
+                                          cache, cache + APPLY_CACHE_SIZE);
+    if (fclose(writer.file) != 0) {
+        LOGE("[CodePush] the restored bundle could not be flushed to disk");
+        result = RESULT_IO_ERROR;
+        goto cleanup;
+    }
+    if (!applied) {
+        LOGE("[CodePush] applying the binary patch failed (decError=%d)", (int)decompressor.decError);
+        result = RESULT_APPLY_FAILED;
+        goto cleanup;
+    }
+
+cleanup:
+    free(cache);
+    if (outputPathChars != NULL) {
+        (*env)->ReleaseStringUTFChars(env, outputPath, outputPathChars);
+    }
+    /* JNI_ABORT: neither array is written to, so nothing has to be copied back. */
+    if (patchData != NULL) {
+        (*env)->ReleaseByteArrayElements(env, patch, patchData, JNI_ABORT);
+    }
+    if (baseData != NULL) {
+        (*env)->ReleaseByteArrayElements(env, base, baseData, JNI_ABORT);
+    }
+
+    return (jint)result;
+}

package/android/app/src/main/java/com/microsoft/codepush/react/BinaryPatchAttempt.java

@@ -0,0 +1,92 @@
+package com.microsoft.codepush.react;
+
+import org.json.JSONObject;
+
+/**
+ * The record of one attempt at installing an update from its binary patch archive: whether
+ * the update was installed from the patch, why the full archive had to be downloaded when it
+ * was not, and how long the work took.
+ *
+ * The record exists for an app that wants to judge a patch rollout with its own telemetry, so
+ * it travels to whoever asked for the download and nowhere else. It is not part of the
+ * update's metadata, it is never written to disk, and nothing here sends it anywhere.
+ */
+class BinaryPatchAttempt {
+
+    private static final String APPLY_DURATION_MS_KEY = "applyDurationMs";
+    private static final String FALLBACK_REASON_KEY = "fallbackReason";
+    private static final String STATUS_KEY = "status";
+
+    private static final String STATUS_APPLIED = "applied";
+    private static final String STATUS_FALLBACK = "fallback";
+
+    private final long mStartTimeMs = System.currentTimeMillis();
+
+    /** How long the applier took, once it has restored the bundle. */
+    private long mApplyDurationMs = -1;
+
+    private boolean mFellBack;
+    private String mFallbackReason;
+    private long mAttemptDurationMs;
+
+    /**
+     * The applier restored the bundle. Whether the update installs is decided by the checks
+     * that follow, so this is not yet the attempt succeeding.
+     */
+    void recordBundleRestored(long applyDurationMs) {
+        mApplyDurationMs = applyDurationMs;
+    }
+
+    /**
+     * The attempt ended in one of the reasons the appliers report.
+     *
+     * The attempt is timed here rather than when it is read, because what happens next is the
+     * full archive being downloaded and that is not time the patch spent.
+     */
+    void recordFallback(String failureReason) {
+        mFellBack = true;
+        mFallbackReason = failureReason;
+        mAttemptDurationMs = System.currentTimeMillis() - mStartTimeMs;
+    }
+
+    /**
+     * The attempt ended in an error rather than in a verdict of its own.
+     *
+     * An error raised after the bundle was restored is the restored update failing the checks
+     * that every update passes before it is installed. Before that point the appliers have no
+     * word for what happened - the patch archive not being downloadable, say - and inventing
+     * one here would put a value on the wire that no platform reports, so the fallback is
+     * reported without a reason.
+     */
+    void recordFallbackAfterError() {
+        recordFallback(bundleWasRestored() ? BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED : null);
+    }
+
+    private boolean bundleWasRestored() {
+        return mApplyDurationMs >= 0;
+    }
+
+    /**
+     * What the attempt ended in, as the app reads it.
+     *
+     * An attempt that never fell back is one the update was installed from, and it reports the
+     * time the applier took. A fallback reports how long the attempt ran before it was given
+     * up on, because there is no completed apply to time.
+     */
+    JSONObject result() {
+        JSONObject result = new JSONObject();
+        if (!mFellBack) {
+            CodePushUtils.setJSONValueForKey(result, STATUS_KEY, STATUS_APPLIED);
+            CodePushUtils.setJSONValueForKey(result, APPLY_DURATION_MS_KEY, Math.max(mApplyDurationMs, 0));
+            return result;
+        }
+
+        CodePushUtils.setJSONValueForKey(result, STATUS_KEY, STATUS_FALLBACK);
+        if (mFallbackReason != null) {
+            CodePushUtils.setJSONValueForKey(result, FALLBACK_REASON_KEY, mFallbackReason);
+        }
+
+        CodePushUtils.setJSONValueForKey(result, APPLY_DURATION_MS_KEY, mAttemptDurationMs);
+        return result;
+    }
+}