@depup/react-native 0.87.0-depup.0 → 0.87.1-depup.0

package/scripts/spm/download-spm-artifacts.js

@@ -393,15 +393,63 @@ async function resolveRNDepsArtifact(
   return {url: snapshotUrl, version};
 }
 
+/**
+ * Resolves the `hermes-compiler` npm package's version from THIS project's own
+ * node_modules — the exact same lookup generate-spm-xcodeproj.js's
+ * resolveHermesCliPathSetting() uses to find the hermesc binary that will
+ * compile the JS bundle, and the same one react-native-xcode.sh falls back to
+ * for SwiftPM builds. Returns null when the package isn't resolvable (e.g.
+ * USE_HERMES=false apps that never installed it) so the caller can fall back
+ * to the npm dist-tag lookup.
+ */
+function resolveLocalHermesCompilerVersion(
+  rnRoot /*: string */,
+) /*: string | null */ {
+  try {
+    const pkgPath = require.resolve('hermes-compiler/package.json', {
+      paths: [rnRoot],
+    });
+    // $FlowFixMe[incompatible-type] JSON.parse returns any
+    const pkg /*: {version: string} */ = JSON.parse(
+      fs.readFileSync(pkgPath, 'utf8'),
+    );
+    assertSafeVersion(pkg.version, 'local hermes-compiler/package.json');
+    return pkg.version;
+  } catch (error) {
+    // A MODULE_NOT_FOUND resolution failure is the expected case (e.g.
+    // USE_HERMES=false apps that never installed hermes-compiler) — fall back
+    // silently. Any other failure means hermes-compiler IS installed but its
+    // package.json is unreadable/malformed or carries an unsafe version; warn
+    // loudly rather than silently regressing to the live latest-v1 dist-tag,
+    // which would re-introduce the version-skew crash this resolves (#57917).
+    if (error.code !== 'MODULE_NOT_FOUND') {
+      log(
+        `  WARNING: hermes-compiler is installed but its version could not be resolved (${error.message}); falling back to the latest-v1 dist-tag, which may not match the pinned hermesc and can crash at launch with "Wrong bytecode version".`,
+      );
+    }
+    return null;
+  }
+}
+
 /**
  * Returns {url, version} for Hermes. Hermes uses its own version space
  * decoupled from React Native's nightly cadence — RN's `hermes-compiler`
  * npm package publishes a `latest-v1` dist-tag that always resolves to a
- * binary that's been built and uploaded to Maven. Our default mirrors RN's
- * CocoaPods prebuild path (see scripts/ios-prebuild/hermes.js):
+ * binary that's been built and uploaded to Maven.
  *
- *   HERMES_VERSION unset       → 'latest-v1' dist-tag
- *   HERMES_VERSION=latest-v1   → same (explicit)
+ *   HERMES_VERSION unset       → version pinned by the locally installed
+ *                                hermes-compiler package (node_modules).
+ *                                This is the SAME source
+ *                                resolveHermesCliPathSetting() reads for
+ *                                HERMES_CLI_PATH, so the downloaded VM and
+ *                                the hermesc that compiles the JS bundle
+ *                                always agree — a mismatched pair crashes at
+ *                                launch with "Wrong bytecode version" (#57917).
+ *                                Falls back to the 'latest-v1' npm dist-tag
+ *                                (RN's CocoaPods prebuild default; see
+ *                                scripts/ios-prebuild/hermes.js) only when
+ *                                hermes-compiler isn't locally resolvable.
+ *   HERMES_VERSION=latest-v1   → 'latest-v1' dist-tag (explicit)
  *   HERMES_VERSION=nightly     → hermes-compiler@nightly dist-tag
  *   HERMES_VERSION=<literal>   → use that version verbatim
  *
@@ -413,8 +461,17 @@ async function resolveHermesArtifact(
   rnVersion /*: string */,
   flavor /*: string */,
   rawVersion /*: string | null */,
+  rnRoot /*: string */,
 ) /*: Promise<ResolvedArtifact> */ {
-  let version = process.env.HERMES_VERSION ?? 'latest-v1';
+  let version = process.env.HERMES_VERSION;
+
+  if (version == null) {
+    const localVersion = resolveLocalHermesCompilerVersion(rnRoot);
+    if (localVersion != null) {
+      log(`  Using locally pinned hermes-compiler: ${localVersion}`);
+    }
+    version = localVersion ?? 'latest-v1';
+  }
 
   if (version === 'nightly') {
     version = await resolveNightlyVersion('hermes-compiler');
@@ -1119,7 +1176,7 @@ async function main(argv /*:: ?: Array<string> */) /*: Promise<void> */ {
       label: 'hermes',
       name: 'hermes-engine',
       resolve: () =>
-        resolveHermesArtifact(resolvedRnVersion, flavor, rawVersion),
+        resolveHermesArtifact(resolvedRnVersion, flavor, rawVersion, rnRoot),
       sharedName: (v /*: string */) => `hermes-ios-${v}-${flavor}.tar.gz`,
     },
   ];
@@ -1390,6 +1447,7 @@ module.exports = {
   main,
   resolveCacheSlotVersion,
   resolveHermesArtifact,
+  resolveLocalHermesCompilerVersion,
   REQUIRED_ARTIFACTS,
   validateArtifactsCache,
   // Exposed for unit tests (pure / fetch-stubbable helpers).

package/scripts/spm/expand-spm-dependencies.js

@@ -10,10 +10,12 @@
 
 'use strict';
 
-const {toSwiftName} = require('./spm-utils');
+const {RESERVED_SWIFT_NAMES, makeLogger, toSwiftName} = require('./spm-utils');
 const fs = require('fs');
 const path = require('path');
 
+const {warn} = makeLogger('expand-spm-dependencies');
+
 /**
  * expand-spm-dependencies.js — Resolves transitive native deps declared via
  * `spm.dependencies` in a library's react-native.config.js.
@@ -32,7 +34,7 @@ const path = require('path');
  * list with autolinking-shaped entries so the downstream pipeline can convert
  * each to an SPM target without further branching.
  *
- * I/O is injected (readConfig, resolveDep) so the logic stays pure and
+ * I/O is injected (readConfig, resolveDep, log) so the logic stays pure and
  * testable.
  */
 
@@ -44,52 +46,232 @@ import type {AutolinkedDep} from './spm-types';
 type RnConfig = {...};
 type ReadConfig = (root: string) => ?RnConfig;
 type ResolveDep = (name: string, fromRoot: string) => ?string;
+type Log = (message: string) => void;
+// Keyed by lower case, valued with the canonical spelling: two names differing
+// only in case are not distinct enough for the build to keep the two apart.
+type ReservedNames = ReadonlyMap<string, string>;
 type Options = {
   readConfig: ReadConfig,
   resolveDep: ResolveDep,
+  // Names to reserve alongside RESERVED_SWIFT_NAMES, supplied by the caller
+  // (remote mode relabels the RN package) since this module reads no config.
+  extraReservedNames?: ?ReadonlyArray<string>,
+  log?: ?Log,
 };
 */
 
-// Validates and returns the Swift target name for a dep. Falls back to
-// toSwiftName(npmName) when no override is set. The override is the dep's
-// `react-native.config.js` `spm.name`, intended for libraries whose import
-// prefix differs from the auto-derived name (e.g. `react-native-worklets`
-// publishes headers under `<worklets/...>` via the podspec `s.header_dir`,
-// so the SPM target name should be `worklets`, not `ReactNativeWorklets`).
+/**
+ * A misconfiguration rather than a resolution failure: scaffoldAll degrades past
+ * a transitive dep it cannot find, but must still surface this.
+ */
+class SpmNameCollisionError extends Error {
+  constructor(message /*: string */) {
+    super(message);
+    this.name = 'SpmNameCollisionError';
+  }
+}
+
+// The charset `spm.name` must satisfy — permissive on purpose, since it has to
+// admit header-dir style (lowercase with hyphens) as well as Swift identifiers.
+// Shared with the app's own `spm.modules` names.
+function isValidSwiftName(name /*: unknown */) /*: boolean */ {
+  return typeof name === 'string' && /^[A-Za-z_][A-Za-z0-9_-]*$/.test(name);
+}
+
+function reservedSwiftNames(
+  extraReservedNames /*: ?ReadonlyArray<string> */,
+) /*: ReservedNames */ {
+  return new Map(
+    [...RESERVED_SWIFT_NAMES, ...(extraReservedNames ?? [])].map(name => [
+      name.toLowerCase(),
+      name,
+    ]),
+  );
+}
+
+// The scope-borrowed form of a name: `@powersync/react-native`'s `ReactNative`
+// becomes `PowersyncReactNative`.
+function scopeBorrowedName(
+  npmName /*: string */,
+  swiftName /*: string */,
+) /*: ?string */ {
+  const scope = /^@([^/]+)\//.exec(npmName)?.[1];
+  return scope == null ? null : `${toSwiftName(scope)}${swiftName}`;
+}
+
+// The Swift target name for one dep, judged in isolation. `spm.name` is for
+// libraries whose import prefix differs from the derived name:
+// `react-native-worklets` ships headers as `<worklets/...>` (podspec
+// `s.header_dir`), so its target is `worklets`, not `ReactNativeWorklets`. A
+// derived name that lands on a reserved one borrows the npm scope instead.
 function resolveSwiftName(
   npmName /*: string */,
   config /*: ?RnConfig */,
+  reserved /*: ReservedNames */,
+  log /*:: ?: ?Log */,
 ) /*: string */ {
   // $FlowFixMe[prop-missing] config has dynamic shape
   const override = config?.spm?.name;
-  if (override == null) {
-    return toSwiftName(npmName);
+  if (override != null) {
+    if (typeof override !== 'string' || override.length === 0) {
+      throw new Error(
+        `react-native autolinking: '${npmName}' has an invalid 'spm.name' override: expected a non-empty string, got ${JSON.stringify(override)}.`,
+      );
+    }
+    if (!isValidSwiftName(override)) {
+      throw new Error(
+        `react-native autolinking: '${npmName}' has an invalid 'spm.name' override '${override}': must start with a letter or underscore and contain only letters, digits, underscores, or hyphens.`,
+      );
+    }
+    return override;
   }
-  if (typeof override !== 'string' || override.length === 0) {
-    throw new Error(
-      `react-native autolinking: '${npmName}' has an invalid 'spm.name' override: expected a non-empty string, got ${JSON.stringify(override)}.`,
-    );
+
+  const derived = toSwiftName(npmName);
+  if (!reserved.has(derived.toLowerCase())) {
+    return derived;
   }
-  // Accept Swift-identifier style (TitleCase / snake_case) and header-dir
-  // style (lowercase, optional hyphens). Reject whitespace, slashes, and
-  // other characters that would break SPM target / module identifiers.
-  if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(override)) {
-    throw new Error(
-      `react-native autolinking: '${npmName}' has an invalid 'spm.name' override '${override}': must start with a letter or underscore and contain only letters, digits, underscores, or hyphens.`,
-    );
+  const disambiguated = scopeBorrowedName(npmName, derived);
+  if (disambiguated == null || reserved.has(disambiguated.toLowerCase())) {
+    return derived;
+  }
+  log?.(
+    `'${npmName}' would take React Native's reserved name '${derived}', so its npm scope is prepended: '${disambiguated}'. ` +
+      `Set 'spm.name' in ${npmName}'s react-native.config.js to choose the name yourself.`,
+  );
+  return disambiguated;
+}
+
+function assertNameNotReserved(
+  swiftName /*: string */,
+  reserved /*: ReservedNames */,
+  labels /*: {label: string, remedy: string} */,
+) /*: void */ {
+  const reservedName = reserved.get(swiftName.toLowerCase());
+  if (reservedName == null) {
+    return;
+  }
+  // Vaguer about the case clash than the dep-vs-dep message on purpose: this
+  // set spans package identities and product names, which collide differently.
+  throw new SpmNameCollisionError(
+    `react-native autolinking: SPM Swift name collision: ${labels.label} resolves to '${swiftName}', ` +
+      (reservedName === swiftName
+        ? `which React Native reserves for its own SPM package and products.`
+        : `which differs from React Native's reserved '${reservedName}' only in case — not distinct enough for the build to keep the two apart.`) +
+      ` ${labels.remedy}`,
+  );
+}
+
+/**
+ * Throws when `swiftName` is one React Native's own manifests use. `remedy` is
+ * the fix: a library sets `spm.name`, an app renames its `spm.modules` entry.
+ */
+function assertSwiftNameNotReserved(
+  swiftName /*: string */,
+  options /*: {
+    label: string,
+    remedy: string,
+    extraReservedNames?: ?ReadonlyArray<string>,
+  } */,
+) /*: void */ {
+  const {label, remedy, extraReservedNames} = options;
+  assertNameNotReserved(swiftName, reservedSwiftNames(extraReservedNames), {
+    label,
+    remedy,
+  });
+}
+
+// Reserved-name backstop over the resolved set. Unconditional: a plugin-shipping
+// library is checked like any other, so `spm scaffold` — which knows nothing
+// about plugins — cannot disagree with the autolinker about the same dep.
+function assertNoReservedSwiftNames(
+  deps /*: ReadonlyArray<AutolinkedDep> */,
+  reserved /*: ReservedNames */,
+) /*: void */ {
+  for (const dep of deps) {
+    const swiftName = dep.swiftName;
+    if (swiftName == null) {
+      continue;
+    }
+    assertNameNotReserved(swiftName, reserved, {
+      label: `'${dep.name}'`,
+      remedy: `Set a different 'spm.name' in ${dep.name}'s react-native.config.js.`,
+    });
+  }
+}
+
+// Pulls apart deps that resolved to the same name by borrowing their npm scopes.
+// Every scoped member of a colliding group moves: there is no non-arbitrary
+// winner to keep. Exactly one pass — retrying would trade a diagnosable error
+// for a name nobody can predict.
+function disambiguateSharedSwiftNames(
+  deps /*: ReadonlyArray<AutolinkedDep> */,
+  autoNamed /*: ReadonlySet<string> */,
+  log /*: ?Log */,
+) /*: void */ {
+  const groups /*: Map<string, Array<{dep: AutolinkedDep, swiftName: string}>> */ =
+    new Map();
+  for (const dep of deps) {
+    const swiftName = dep.swiftName;
+    if (swiftName == null) {
+      continue;
+    }
+    const key = swiftName.toLowerCase();
+    const group = groups.get(key);
+    if (group == null) {
+      groups.set(key, [{dep, swiftName}]);
+    } else {
+      group.push({dep, swiftName});
+    }
+  }
+
+  for (const group of groups.values()) {
+    if (group.length < 2) {
+      continue;
+    }
+    for (const {dep, swiftName} of group) {
+      // A name we derived can borrow a second time (`AAReactNative`); the
+      // member whose name we did not derive is the incumbent and keeps it.
+      if (!autoNamed.has(dep.name)) {
+        continue;
+      }
+      const borrowed = scopeBorrowedName(dep.name, swiftName);
+      if (borrowed == null) {
+        continue;
+      }
+      const others = group
+        .filter(other => other.dep !== dep)
+        .map(other => `'${other.dep.name}'`)
+        .join(', ');
+      log?.(
+        `'${dep.name}' would share the name '${swiftName}' with ${others}, so its npm scope is prepended: '${borrowed}'. ` +
+          `Set 'spm.name' in ${dep.name}'s react-native.config.js to choose the name yourself.`,
+      );
+      dep.swiftName = borrowed;
+    }
   }
-  return override;
 }
 
 function expandSpmDependencies(
   directDeps /*: Array<AutolinkedDep> */,
   options /*: Options */,
 ) /*: Array<AutolinkedDep> */ {
-  const {readConfig, resolveDep} = options;
+  const {readConfig, resolveDep, extraReservedNames, log} = options;
+  const reserved = reservedSwiftNames(extraReservedNames);
   const byName /*: Map<string, AutolinkedDep> */ = new Map();
   for (const dep of directDeps) {
     byName.set(dep.name, {...dep, spmDependencies: []});
   }
+  const autoNamed /*: Set<string> */ = new Set();
+  const resolveName = (
+    npmName /*: string */,
+    config /*: ?RnConfig */,
+  ) /*: string */ => {
+    // $FlowFixMe[prop-missing] config has dynamic shape
+    if (config?.spm?.name == null) {
+      autoNamed.add(npmName);
+    }
+    return resolveSwiftName(npmName, config, reserved, log);
+  };
 
   const queue /*: Array<string> */ = directDeps.map(d => d.name);
   while (queue.length > 0) {
@@ -105,7 +287,7 @@ function expandSpmDependencies(
     // Resolve swiftName lazily from the same config read we already need for
     // spm.dependencies — saves a duplicate readConfig call per direct dep.
     if (current.swiftName == null) {
-      current.swiftName = resolveSwiftName(currentName, config);
+      current.swiftName = resolveName(currentName, config);
     }
     // $FlowFixMe[prop-missing] config has dynamic shape
     const transitives /*: Array<string> */ = config?.spm?.dependencies ?? [];
@@ -134,7 +316,7 @@ function expandSpmDependencies(
           name: transitiveName,
           root: transitiveRoot,
           platforms: {ios: iosPlatform},
-          swiftName: resolveSwiftName(transitiveName, transitiveConfig),
+          swiftName: resolveName(transitiveName, transitiveConfig),
           spmDependencies: [],
         });
         queue.push(transitiveName);
@@ -144,6 +326,14 @@ function expandSpmDependencies(
     current.spmDependencies = currentSpmDeps;
   }
 
+  const allDeps /*: Array<AutolinkedDep> */ = Array.from(byName.values());
+
+  disambiguateSharedSwiftNames(allDeps, autoNamed, log);
+
+  // Both checks below validate the FINAL set, after that pass: a borrowed scope
+  // can land on a reserved name, or on one another dep already holds.
+  assertNoReservedSwiftNames(allDeps, reserved);
+
   // Collision check: two deps mapping to the same Swift name (whether via
   // override or auto-derivation) would clobber each other in the synth
   // package layout and the centralized headers tree. Surface it now with a
@@ -154,7 +344,7 @@ function expandSpmDependencies(
   // passes but the two still collide as directories on the default
   // case-insensitive macOS filesystem (synth package layout + headers tree).
   const seen /*: Map<string, {name: string, swiftName: string}> */ = new Map();
-  for (const dep of byName.values()) {
+  for (const dep of allDeps) {
     const swiftName = dep.swiftName;
     if (swiftName == null) {
       continue;
@@ -163,7 +353,7 @@ function expandSpmDependencies(
     const existing = seen.get(key);
     if (existing != null) {
       const same = existing.swiftName === swiftName;
-      throw new Error(
+      throw new SpmNameCollisionError(
         `react-native autolinking: SPM Swift name collision: '${existing.name}' ('${existing.swiftName}') and '${dep.name}' ('${swiftName}') ` +
           (same
             ? `both resolve to '${swiftName}'.`
@@ -174,7 +364,7 @@ function expandSpmDependencies(
     seen.set(key, {name: dep.name, swiftName});
   }
 
-  return Array.from(byName.values());
+  return allDeps;
 }
 
 // ---------------------------------------------------------------------------
@@ -188,8 +378,34 @@ function defaultReadConfig(root /*: string */) /*: ?RnConfig */ {
   }
   try {
     // $FlowFixMe[unsupported-syntax]
-    return require(configPath);
-  } catch {
+    const mod = require(configPath);
+    // Read both export styles, because the community CLI's two loaders
+    // disagree with each other: its sync path (`loadConfig`) requires the
+    // module and sees named exports at top level, its async path
+    // (`loadConfigAsync`) takes the default export only. Merging covers both,
+    // with named exports winning — the shape the sync path already resolves.
+    // Every sibling key of the default export is preserved
+    // (`dependency.platforms.ios` is read from this result too).
+    // A function-style config (`module.exports = () => ({...})`) and other
+    // non-objects pass through untouched — there is no default export to
+    // unwrap, and nulling them would hide a config that used to be read.
+    if (mod == null || typeof mod !== 'object') {
+      return mod;
+    }
+    const dflt = mod.default;
+    if (dflt == null || typeof dflt !== 'object') {
+      return mod;
+    }
+    const {default: _unused, ...named} = mod;
+    return {...dflt, ...named};
+  } catch (e) {
+    // A config can fail to load for reasons unrelated to SPM (it may import a
+    // devDependency absent in a consumer install), so this stays a warning —
+    // but a silent null turns a dropped `spm` block into a link error much
+    // later.
+    warn(
+      `Failed to load ${configPath}: ${e.message}. Any 'spm' settings in it are ignored.`,
+    );
     return null;
   }
 }
@@ -209,7 +425,10 @@ function defaultResolveDep(
 }
 
 module.exports = {
+  SpmNameCollisionError,
+  assertSwiftNameNotReserved,
   expandSpmDependencies,
+  isValidSwiftName,
   resolveSwiftName,
   defaultReadConfig,
   defaultResolveDep,