@hot-updater/react-native 1.0.7 → 1.1.0

package/src/nativeUpdateEvents.ts

@@ -0,0 +1,77 @@
+import type {
+  BundleDownloadedInfo,
+  UpdateCheckResult,
+  UpdateError,
+  UpdateHttpResponse,
+} from "@hot-updater/protocol";
+
+import type { LaunchReporter } from "./appReady";
+import { takeNativeUpdateEvents } from "./native";
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+/**
+ * Reports the update checks native code ran without JavaScript, such as a
+ * brownfield app's native `HotUpdaterInstance`, with the catalog and artifact
+ * responses they received, to the instance's plugins before this launch's
+ * report, which they precede. Native takes and clears them in one step, so
+ * each is reported at most once. A native error carries a message instead of
+ * the caught error, and each event keeps the time it happened as
+ * `occurredAt`.
+ */
+export const replayNativeUpdateEvents = (emit: LaunchReporter["emit"]) => {
+  let value: string | null;
+  try {
+    value = takeNativeUpdateEvents();
+  } catch {
+    return;
+  }
+  if (value === null) return;
+
+  let entries: unknown;
+  try {
+    entries = JSON.parse(value);
+  } catch {
+    return;
+  }
+  if (!Array.isArray(entries)) return;
+
+  for (const entry of entries) {
+    if (!isRecord(entry) || !isRecord(entry.payload)) continue;
+    const payload =
+      typeof entry.occurredAt === "number"
+        ? { ...entry.payload, occurredAt: entry.occurredAt }
+        : entry.payload;
+    switch (entry.name) {
+      case "onUpdateCheck":
+        emit("onUpdateCheck", () => payload as unknown as UpdateCheckResult);
+        break;
+      case "onBundleDownloaded":
+        emit(
+          "onBundleDownloaded",
+          () => payload as unknown as BundleDownloadedInfo,
+        );
+        break;
+      case "onHttpResponse":
+        emit("onHttpResponse", () => payload as unknown as UpdateHttpResponse);
+        break;
+      case "onUpdateError": {
+        const { message, ...error } = payload;
+        emit(
+          "onUpdateError",
+          () =>
+            ({
+              ...error,
+              cause: new Error(
+                typeof message === "string"
+                  ? message
+                  : "The native update check failed",
+              ),
+            }) as unknown as UpdateError,
+        );
+        break;
+      }
+    }
+  }
+};

package/src/sdkVersion.ts

@@ -1 +1 @@
-export const HOT_UPDATER_SDK_VERSION = "1.0.7";
+export const HOT_UPDATER_SDK_VERSION = "1.1.0";

package/src/specs/NativeHotUpdater.ts

@@ -54,11 +54,20 @@ export interface InstallArtifactParams {
 
 export interface Spec extends TurboModule {
   // Methods
+  /**
+   * Restarts the app process on Android and reloads React Native in place on
+   * iOS, so the app loads the current bundle.
+   */
   reload(): Promise<void>;
   /**
-   * Android process restart path used by `setReloadBehavior("processRestart")`.
-   *
-   * iOS exposes the same method name for API parity, but it behaves the same as `reload()`.
+   * @deprecated Kept for JavaScript↔native compatibility within this major
+   * version. Released JavaScript calls it on Android, and this SDK's
+   * JavaScript still calls it on Android because an older native build's
+   * `reload()` reloads React Native in place there. Native `reload()` now
+   * restarts the process on Android too: the Kotlin and Objective-C
+   * `reloadProcess` implementations run the same code as `reload()`, a
+   * process restart on Android and an in-place reload on iOS. The next major
+   * version removes it.
    */
   reloadProcess(): Promise<void>;
   /**
@@ -234,6 +243,14 @@ export interface Spec extends TurboModule {
    */
   setStorageItem: (key: string, value: string | null) => void;
 
+  /**
+   * Takes the events of the update checks native code ran without JavaScript
+   * (a native `HotUpdaterInstance`), as a JSON array, and clears them in one
+   * step.
+   * Returns null when there are none.
+   */
+  takeNativeUpdateEvents: () => string | null;
+
   // EventEmitter
   addListener(eventName: string): void;
   removeListeners(count: number): void;

package/android/libs/README.md

@@ -1,50 +0,0 @@
-# Bundled Libraries
-
-## hot-updater-brotli-dec-1.2.0.jar
-
-**Why bundled:** The official `org.brotli:dec` package on Maven Central is stuck at v0.1.2 (released May 2017) and contains critical security vulnerabilities. Google has not published newer versions to Maven Central despite releasing v1.2.0 with security fixes.
-
-**Source:** Built from [google/brotli v1.2.0](https://github.com/google/brotli/releases/tag/v1.2.0)
-
-**Security Fixes:**
-- CVE-2020-8927: Buffer overflow in Brotli versions < 1.0.8
-- CVE-2025-6176: DoS vulnerability in versions ≤ 1.1.0 (fixed in v1.2.0)
-
-**Build Command:**
-```bash
-git clone --depth 1 --branch v1.2.0 https://github.com/google/brotli.git
-cd brotli/java/org/brotli/dec
-mvn clean package -DskipTests
-cp target/org.brotli.dec-1.2.0-SNAPSHOT.jar <destination>/org.brotli.dec-1.2.0.jar
-```
-
-The generated jar is then relocated before being bundled:
-
-```gradle
-relocate "org.brotli.dec", "com.hotupdater.vendor.brotli.dec"
-```
-
-The relocation keeps Hot Updater's security-fixed Brotli decoder isolated from
-apps or frameworks that also depend on `org.brotli:dec`.
-
-**Verification:**
-- **Original SHA256:** `2d12a2d7fb52fd7f944564fb378aaccd41389cf02ea2e5eb6b3a6477188cced8`
-- **Relocated SHA256:** `4e9aee81466e21e365fd291bd29ca0540dc174ce64d29a7613ff336e4276bcdf`
-- **Size:** 99KB
-- **Built:** 2026-02-12
-- **Git Commit:** [028fb5a](https://github.com/google/brotli/commit/028fb5a23661f123017c060daa546b55cf4bde29) (v1.2.0 tag)
-- **Relocated Package:** `com.hotupdater.vendor.brotli.dec`
-
-**API Compatibility:**
-The v1.2.0 decoder is API compatible with v0.1.2. Hot Updater imports the
-relocated package internally, so apps can keep their own `org.brotli:dec`
-dependency without duplicate classes:
-- Relocated package: `com.hotupdater.vendor.brotli.dec`
-- Same class: `BrotliInputStream`
-- Same constructor: `BrotliInputStream(InputStream)`
-
-**Why Not Apache Commons Compress?**
-Apache Commons Compress depends on `org.brotli:dec:0.1.2` as an optional dependency, so switching to it would not fix the vulnerability—it would just make it transitive.
-
-**Future Updates:**
-When Google releases new versions of Brotli (e.g., v1.3.0), rebuild this JAR using the same process, relocate it into the Hot Updater vendor package, and update the SHA256 checksum and build date in this file.

package/android/src/bridge/BridgeReactInstance.kt

@@ -1,38 +0,0 @@
-package com.hotupdater
-
-import com.facebook.react.ReactApplication
-import com.facebook.react.bridge.JSBundleLoader
-
-/**
- * React Native 0.81 and older can run the New Architecture on the bridge, which
- * only ReactNativeHost reaches. Only builds for those versions compile this file.
- */
-internal object BridgeReactInstance {
-    fun setJSBundle(
-        application: ReactApplication,
-        bundleLoader: JSBundleLoader?,
-    ) {
-        @Suppress("DEPRECATION")
-        val instanceManager = application.reactNativeHost.reactInstanceManager
-        val bundleLoaderField = instanceManager::class.java.getDeclaredField("mBundleLoader")
-        bundleLoaderField.isAccessible = true
-        bundleLoaderField.set(instanceManager, bundleLoader)
-    }
-
-    fun reload(application: ReactApplication) {
-        @Suppress("DEPRECATION")
-        val reactNativeHost = application.reactNativeHost
-        try {
-            reactNativeHost.reactInstanceManager.recreateReactContextInBackground()
-        } catch (e: Exception) {
-            val currentActivity = reactNativeHost.reactInstanceManager.currentReactContext?.currentActivity
-            if (currentActivity == null) {
-                return
-            }
-
-            currentActivity.runOnUiThread {
-                currentActivity.recreate()
-            }
-        }
-    }
-}

package/android/src/bridgeless/BridgeReactInstance.kt

@@ -1,24 +0,0 @@
-package com.hotupdater
-
-import android.util.Log
-import com.facebook.react.ReactApplication
-import com.facebook.react.bridge.JSBundleLoader
-
-/**
- * React Native 0.82 and later have no bridge, so an app without a ReactHost has
- * no instance to update. Builds for those versions compile this file instead of
- * the bridge one, and never reference ReactNativeHost.
- */
-@Suppress("UNUSED_PARAMETER")
-internal object BridgeReactInstance {
-    fun setJSBundle(
-        application: ReactApplication,
-        bundleLoader: JSBundleLoader?,
-    ) {
-        Log.d("HotUpdater", "No ReactHost to set the JS bundle on")
-    }
-
-    fun reload(application: ReactApplication) {
-        Log.d("HotUpdater", "No ReactHost to reload")
-    }
-}

package/android/src/main/java/com/hotupdater/ReactIntegrationManagerBase.kt

@@ -1,34 +0,0 @@
-package com.hotupdater
-
-import android.app.Application
-import android.content.Context
-import com.facebook.react.ReactApplication
-import com.facebook.react.bridge.JSBundleLoader
-
-open class ReactIntegrationManagerBase(
-    private val context: Context,
-) {
-    fun getJSBundlerLoader(bundleFileUrl: String): JSBundleLoader? {
-        val bundleLoader: JSBundleLoader?
-
-        if (bundleFileUrl.lowercase().startsWith("assets://")) {
-            bundleLoader =
-                JSBundleLoader.createAssetLoader(
-                    context,
-                    bundleFileUrl,
-                    false,
-                )
-        } else {
-            bundleLoader = JSBundleLoader.createFileLoader(bundleFileUrl)
-        }
-        return bundleLoader
-    }
-
-    public fun getReactApplication(application: Application?): ReactApplication {
-        if (application is ReactApplication) {
-            return application
-        } else {
-            throw IllegalArgumentException("Application does not implement ReactApplication")
-        }
-    }
-}

package/android/src/newarch/ReactIntegrationManager.kt

@@ -1,185 +0,0 @@
-package com.hotupdater
-
-import android.content.Context
-import android.util.Log
-import com.facebook.react.ReactApplication
-import com.facebook.react.ReactHost
-import com.facebook.react.ReactInstanceEventListener
-import com.facebook.react.bridge.ReactApplicationContext
-import com.facebook.react.bridge.ReactContext
-import com.facebook.react.common.LifecycleState
-import kotlinx.coroutines.suspendCancellableCoroutine
-import kotlin.coroutines.resume
-
-class ReactIntegrationManager(
-    private val context: Context,
-) : ReactIntegrationManagerBase(context) {
-    /**
-     * Sets the JS bundle using ReactHost directly
-     * @param reactHost The ReactHost instance
-     * @param bundleURL The bundle URL to set
-     */
-    private fun setJSBundleInternal(
-        reactHost: ReactHost,
-        bundleURL: String,
-    ) {
-        try {
-            // Try both Java and Kotlin field names for compatibility
-            val reactHostDelegateField =
-                try {
-                    reactHost::class.java.getDeclaredField("mReactHostDelegate")
-                } catch (e: NoSuchFieldException) {
-                    try {
-                        reactHost::class.java.getDeclaredField("reactHostDelegate")
-                    } catch (e2: NoSuchFieldException) {
-                        throw RuntimeException("Neither mReactHostDelegate nor reactHostDelegate field found", e2)
-                    }
-                }
-
-            reactHostDelegateField.isAccessible = true
-            val reactHostDelegate = reactHostDelegateField.get(reactHost)
-            // Try _jsBundleLoader first (Expo SDK 55+ ExpoReactHostDelegate uses a computed
-            // property with a private backing field), then fall back to jsBundleLoader
-            // (DefaultReactHostDelegate and older Expo versions).
-            val jsBundleLoaderField =
-                try {
-                    reactHostDelegate::class.java.getDeclaredField("_jsBundleLoader")
-                } catch (e: NoSuchFieldException) {
-                    reactHostDelegate::class.java.getDeclaredField("jsBundleLoader")
-                }
-            jsBundleLoaderField.isAccessible = true
-            jsBundleLoaderField.set(reactHostDelegate, getJSBundlerLoader(bundleURL))
-        } catch (e: Exception) {
-            Log.d("HotUpdater", "Failed to setJSBundle with ReactHost: ${e.message}")
-        }
-    }
-
-    /**
-     * Reload the React Native application using ReactHost directly.
-     * @param reactHost The ReactHost instance
-     */
-    private suspend fun reloadInternal(reactHost: ReactHost) {
-        try {
-            // Ensure initialized; if not, start and wait
-            waitForReactContextInitialized(reactHost)
-
-            val activity = reactHost.currentReactContext?.currentActivity
-            if (reactHost.lifecycleState != LifecycleState.RESUMED && activity != null) {
-                reactHost.onHostResume(activity)
-            }
-            reactHost.reload("Requested by HotUpdater")
-        } catch (e: Exception) {
-            Log.d("HotUpdater", "Failed to reload with ReactHost: ${e.message}")
-        }
-    }
-
-    private fun getReactApplication(): ReactApplication? {
-        if (context is ReactApplicationContext) {
-            val activity = context.currentActivity
-            val application = activity?.application
-            if (application is ReactApplication) {
-                return application
-            }
-        }
-
-        return null
-    }
-
-    /**
-     * Sets the JS bundle.
-     * Priority: ReactHostHolder (if set) > application.reactHost > the bridge (React Native 0.81 and older)
-     * @param bundleURL The bundle URL to set
-     */
-    public fun setJSBundle(bundleURL: String) {
-        try {
-            // 1. First, check if ReactHost was set via HotUpdater.setReactHost()
-            val configuredHost = ReactHostHolder.getReactHost()
-            if (configuredHost != null) {
-                setJSBundleInternal(configuredHost, bundleURL)
-                return
-            }
-
-            // 2. Try to get ReactApplication from context
-            val application = getReactApplication()
-            if (application == null) {
-                Log.d("HotUpdater", "No ReactHost set and application is not ReactApplication")
-                return
-            }
-
-            // 3. Try application's ReactHost (new architecture)
-            val reactHost = application.reactHost
-            if (reactHost != null) {
-                setJSBundleInternal(reactHost, bundleURL)
-                return
-            }
-
-            // 4. Fall back to the bridge, which React Native 0.81 and older can run
-            BridgeReactInstance.setJSBundle(application, getJSBundlerLoader(bundleURL))
-        } catch (e: Exception) {
-            Log.d("HotUpdater", "Failed to setJSBundle: ${e.message}")
-        }
-    }
-
-    /**
-     * Reload the React Native application.
-     * Priority: ReactHostHolder (if set) > application.reactHost > the bridge (React Native 0.81 and older)
-     */
-    public suspend fun reload() {
-        try {
-            // 1. First, check if ReactHost was set via HotUpdater.setReactHost()
-            val configuredHost = ReactHostHolder.getReactHost()
-            if (configuredHost != null) {
-                reloadInternal(configuredHost)
-                return
-            }
-
-            // 2. Try to get ReactApplication from context
-            val application = getReactApplication()
-            if (application == null) {
-                Log.d("HotUpdater", "No ReactHost set and application is not ReactApplication")
-                return
-            }
-
-            // 3. Try application's ReactHost (new architecture)
-            val reactHost = application.reactHost
-            if (reactHost != null) {
-                reloadInternal(reactHost)
-                return
-            }
-
-            // 4. Fall back to the bridge, which React Native 0.81 and older can run
-            BridgeReactInstance.reload(application)
-        } catch (e: Exception) {
-            Log.d("HotUpdater", "Failed to reload: ${e.message}")
-        }
-    }
-
-    /**
-     * Waits until ReactContext is initialized.
-     * @return true if ReactContext was already initialized; false if we waited for it.
-     */
-    suspend fun waitForReactContextInitialized(reactHost: ReactHost): Boolean {
-        return try {
-            // If already initialized, return immediately
-            if (reactHost.currentReactContext != null) return true
-
-            // Wait for initialization; MainApplication handles starting the host
-            suspendCancellableCoroutine { continuation ->
-                val listener =
-                    object : ReactInstanceEventListener {
-                        override fun onReactContextInitialized(context: ReactContext) {
-                            reactHost.removeReactInstanceEventListener(this)
-                            if (continuation.isActive) continuation.resume(Unit)
-                        }
-                    }
-
-                reactHost.addReactInstanceEventListener(listener)
-                continuation.invokeOnCancellation { reactHost.removeReactInstanceEventListener(listener) }
-            }
-            false
-        } catch (e: Exception) {
-            Log.d("HotUpdater", "waitForReactContextInitialized failed: ${e.message}")
-            true
-        }
-    }
-}

package/android/src/oldarch/ReactIntegrationManager.kt

@@ -1,120 +0,0 @@
-package com.hotupdater
-
-import android.content.Context
-import android.util.Log
-import com.facebook.react.ReactApplication
-import com.facebook.react.ReactInstanceEventListener
-import com.facebook.react.ReactInstanceManager
-import com.facebook.react.bridge.JSBundleLoader
-import com.facebook.react.bridge.ReactApplicationContext
-import com.facebook.react.bridge.ReactContext
-import kotlinx.coroutines.suspendCancellableCoroutine
-import java.lang.reflect.Field
-import kotlin.coroutines.resume
-
-class ReactIntegrationManager(
-    private val context: Context,
-) : ReactIntegrationManagerBase(context) {
-    private fun getReactApplication(): ReactApplication? {
-        // 1. Try to get from ReactApplicationContext's current activity
-        if (context is ReactApplicationContext) {
-            val activity = context.currentActivity
-            val application = activity?.application
-            if (application is ReactApplication) {
-                return application
-            }
-        }
-
-        return null
-    }
-
-    /**
-     * Sets the JS bundle.
-     * Gets ReactApplication from context and uses reactNativeHost.
-     * @param bundleURL The bundle URL to set
-     */
-    public fun setJSBundle(bundleURL: String) {
-        try {
-            val application = getReactApplication()
-            if (application == null) {
-                Log.d("HotUpdater", "Application is not ReactApplication")
-                return
-            }
-
-            val instanceManager = application.reactNativeHost.reactInstanceManager
-            val bundleLoader: JSBundleLoader? = this.getJSBundlerLoader(bundleURL)
-            val bundleLoaderField: Field =
-                instanceManager::class.java.getDeclaredField("mBundleLoader")
-            bundleLoaderField.isAccessible = true
-
-            if (bundleLoader != null) {
-                bundleLoaderField.set(instanceManager, bundleLoader)
-            } else {
-                bundleLoaderField.set(instanceManager, null)
-            }
-        } catch (e: Exception) {
-            Log.d("HotUpdater", "Failed to setJSBundle: ${e.message}")
-        }
-    }
-
-    /**
-     * Reload the React Native application.
-     * Gets ReactApplication from context and uses reactNativeHost.
-     */
-    public suspend fun reload() {
-        try {
-            val application = getReactApplication()
-            if (application == null) {
-                Log.d("HotUpdater", "Application is not ReactApplication")
-                return
-            }
-
-            val instanceManager = application.reactNativeHost.reactInstanceManager
-
-            // Ensure initialized; if not, start and wait
-            waitForReactContextInitialized(instanceManager)
-
-            instanceManager.recreateReactContextInBackground()
-        } catch (e: Exception) {
-            try {
-                val application = getReactApplication() ?: return
-                val instanceManager = application.reactNativeHost.reactInstanceManager
-                val currentActivity = instanceManager.currentReactContext?.currentActivity
-                if (currentActivity == null) {
-                    return
-                }
-
-                currentActivity.runOnUiThread {
-                    currentActivity.recreate()
-                }
-            } catch (e2: Exception) {
-                Log.d("HotUpdater", "Failed to reload: ${e2.message}")
-            }
-        }
-    }
-
-    /**
-     * Waits until ReactContext is initialized using ReactInstanceManager.
-     * @param instanceManager The ReactInstanceManager instance
-     * @return true if ReactContext was already initialized; false if we waited for it.
-     */
-    suspend fun waitForReactContextInitialized(instanceManager: ReactInstanceManager): Boolean {
-        // If already initialized, return immediately and indicate so
-        if (instanceManager.currentReactContext != null) return true
-
-        // Otherwise, wait for initialization; MainApplication handles starting the instance
-        suspendCancellableCoroutine { continuation ->
-            val listener =
-                object : ReactInstanceEventListener {
-                    override fun onReactContextInitialized(context: ReactContext) {
-                        instanceManager.removeReactInstanceEventListener(this)
-                        if (continuation.isActive) continuation.resume(Unit)
-                    }
-                }
-
-            instanceManager.addReactInstanceEventListener(listener)
-            continuation.invokeOnCancellation { instanceManager.removeReactInstanceEventListener(listener) }
-        }
-        return false
-    }
-}