@scalebun-release/react-native 2.5.0

package/lib/commonjs/features/ota/OtaTypes.js

@@ -0,0 +1,6 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+//# sourceMappingURL=OtaTypes.js.map

package/lib/commonjs/features/ota/deviceAttributes.js

@@ -0,0 +1,48 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.deviceTargetingAttributes = deviceTargetingAttributes;
+var _reactNative = require("react-native");
+/**
+ * Hardware/OS context auto-attached to OTA check payloads so ATTRIBUTE targeting
+ * rules can address device classes without any host-app wiring:
+ *
+ *   deviceModel  — 'SM-A155F', '23129RAA4G'… (Android; iOS does not expose it in JS)
+ *   manufacturer — 'samsung', 'xiaomi'… (lowercased: rules shouldn't fail on casing)
+ *   brand        — 'redmi' vs manufacturer 'xiaomi' — sub-brands are real segments
+ *   osVersion    — Android Release ('14') / iOS version ('17.5')
+ *   formFactor   — 'phone' | 'tablet' | 'tv' (Android tablets via the 600dp
+ *                  smallest-width convention — the same line AndroidX draws)
+ *
+ * Host-supplied attributes always win on key collision: an app that knows better
+ * (e.g. its own device tiering) must not be overridden by generic detection.
+ * Everything here is best-effort — a missing constant yields a missing key,
+ * never a guessed value.
+ */
+function deviceTargetingAttributes() {
+  const out = {};
+  try {
+    const c = _reactNative.Platform.constants ?? {};
+    if (_reactNative.Platform.OS === 'android') {
+      if (typeof c.Model === 'string' && c.Model) out.deviceModel = c.Model;
+      if (typeof c.Manufacturer === 'string' && c.Manufacturer) {
+        out.manufacturer = c.Manufacturer.toLowerCase();
+      }
+      if (typeof c.Brand === 'string' && c.Brand) out.brand = c.Brand.toLowerCase();
+      if (typeof c.Release === 'string' && c.Release) out.osVersion = c.Release;
+      const screen = _reactNative.Dimensions.get('screen');
+      const smallestDp = Math.min(screen.width, screen.height);
+      out.formFactor = _reactNative.Platform.isTV ? 'tv' : smallestDp >= 600 ? 'tablet' : 'phone';
+    } else {
+      const osVersion = typeof c.osVersion === 'string' ? c.osVersion : String(_reactNative.Platform.Version ?? '');
+      if (osVersion) out.osVersion = osVersion;
+      out.formFactor = _reactNative.Platform.isTV ? 'tv' : c.interfaceIdiom === 'pad' ? 'tablet' : 'phone';
+    }
+  } catch {
+    // Targeting enrichment must never break a check. Missing keys are honest.
+  }
+  return out;
+}
+//# sourceMappingURL=deviceAttributes.js.map

package/lib/commonjs/features/ota/environment.js

@@ -0,0 +1,172 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.REACT_HOST_ONLY_RN = exports.MIN_BRIDGELESS_RN = void 0;
+exports._resetOtaEnvironmentCache = _resetOtaEnvironmentCache;
+exports.detectOtaEnvironment = detectOtaEnvironment;
+var _reactNative = require("react-native");
+/**
+ * OTA runtime environment detection.
+ *
+ * ── Why this file exists ────────────────────────────────────────────────────
+ *
+ * Our Android OTA resolves the active bundle through
+ * `MainApplication.getJSBundleFile()`. That is a *bridge-mode* API.
+ *
+ * Under the New Architecture (bridgeless), the app is built by
+ * `DefaultReactHost` instead — and until React Native 0.76.1,
+ * `DefaultReactNativeHost.toReactHost()` never forwarded `jsBundleFile`:
+ *
+ *     // RN 0.74.1 — DefaultReactNativeHost.kt
+ *     public fun toReactHost(context: Context): ReactHost =
+ *         DefaultReactHost.getDefaultReactHost(
+ *             context, packages, jsMainModuleName,
+ *             bundleAssetName ?: "index",   // <- jsBundleFile is NEVER passed
+ *             isHermesEnabled ?: true)
+ *
+ *     // RN 0.74.1 — DefaultReactHost.kt
+ *     val jsBundleLoader =
+ *         JSBundleLoader.createAssetLoader(context, "assets://$jsBundleAssetPath", true)
+ *
+ * The loader is hardcoded to the APK asset. `getJSBundleFile()` is never
+ * consulted, so an update stages, applies, reports INSTALLED, restarts — and
+ * the app loads the bundle baked into the APK. Every signal says success and
+ * nothing happened. This is the same failure that killed CodePush on modern RN.
+ *
+ * Fixed upstream in 0.76.1 (`jsBundleFile` is threaded through). Verified
+ * present in 0.81.5.
+ *
+ * We refuse to run rather than pretend to work. A loud failure at startup is
+ * recoverable; a silent no-op that reports success is not — it corrupts the
+ * adoption metrics, the guard thresholds, and every rollout decision made
+ * from them.
+ */
+
+/** First React Native version where bridgeless honours `getJSBundleFile()`. */
+const MIN_BRIDGELESS_RN = exports.MIN_BRIDGELESS_RN = {
+  major: 0,
+  minor: 76,
+  patch: 1
+};
+
+/**
+ * React Native 0.82 REMOVED `ReactNativeHost`. The New Architecture became
+ * mandatory and `newArchEnabled=false` was withdrawn, so the legacy
+ * `override fun getJSBundleFile()` integration does not merely stop working —
+ * it does not compile. From 0.82 the only correct integration is passing
+ * `jsBundleFilePath` straight to `getDefaultReactHost(...)`.
+ *
+ * We cannot see which integration a host app used, so this is not a block. It
+ * drives a startup hint, and the post-restart identity check is what actually
+ * catches a host that got it wrong.
+ */
+const REACT_HOST_ONLY_RN = exports.REACT_HOST_ONLY_RN = {
+  major: 0,
+  minor: 82,
+  patch: 0
+};
+function compare(a, b) {
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  return a.patch - b.patch;
+}
+function readRnVersion() {
+  // `Platform.constants.reactNativeVersion` is public API and present on both
+  // platforms since 0.62. Preferred over the deep `Libraries/Core/...` import,
+  // which is private and has moved between releases.
+  try {
+    const v = _reactNative.Platform.constants?.reactNativeVersion;
+    if (v && typeof v.major === 'number' && typeof v.minor === 'number') {
+      return {
+        major: v.major,
+        minor: v.minor,
+        patch: v.patch ?? 0
+      };
+    }
+  } catch {
+    // fall through
+  }
+  return null;
+}
+function readBridgeless() {
+  // Set by the runtime itself when the bridgeless host is in use. Absent on
+  // the old architecture, so `=== true` is the correct test.
+  try {
+    return globalThis.RN$Bridgeless === true;
+  } catch {
+    return false;
+  }
+}
+function readHermes() {
+  try {
+    const h = globalThis.HermesInternal;
+    if (!h) return {
+      hermes: false,
+      bytecodeVersion: null
+    };
+    let bytecodeVersion = null;
+    const props = h.getRuntimeProperties?.();
+    if (props) {
+      // Hermes reports this as "Bytecode Version"; the value has been both a
+      // number and a numeric string across releases, so coerce and validate.
+      const raw = props['Bytecode Version'];
+      const n = typeof raw === 'string' ? Number(raw) : raw;
+      if (typeof n === 'number' && Number.isFinite(n)) bytecodeVersion = n;
+    }
+    return {
+      hermes: true,
+      bytecodeVersion
+    };
+  } catch {
+    return {
+      hermes: false,
+      bytecodeVersion: null
+    };
+  }
+}
+let cached = null;
+
+/**
+ * Detect the runtime environment and decide whether OTA can function at all.
+ * Result is cached — none of these values change during a process lifetime.
+ */
+function detectOtaEnvironment() {
+  if (cached) return cached;
+  const rnVersion = readRnVersion();
+  const bridgeless = readBridgeless();
+  const {
+    hermes,
+    bytecodeVersion
+  } = readHermes();
+  let supported = true;
+  let blockReason = null;
+  if (bridgeless && rnVersion) {
+    if (compare(rnVersion, MIN_BRIDGELESS_RN) < 0) {
+      supported = false;
+      blockReason = `React Native ${rnVersion.major}.${rnVersion.minor}.${rnVersion.patch} is running ` + `bridgeless (New Architecture), but jsBundleFile was not threaded through ` + `DefaultReactHost until RN 0.76.1. getJSBundleFile() is ignored on this runtime, ` + `so an OTA bundle would install successfully and never actually load. ` + `Upgrade to React Native >= 0.76.1, or disable the New Architecture.`;
+    }
+  } else if (bridgeless && !rnVersion) {
+    // Can't prove it's broken, and blocking every app whose version we failed
+    // to read would be worse than the bug. Warn instead of blocking.
+    blockReason = null;
+  }
+  cached = {
+    rnVersion,
+    rnVersionString: rnVersion ? `${rnVersion.major}.${rnVersion.minor}.${rnVersion.patch}` : null,
+    bridgeless,
+    hermes,
+    hermesBytecodeVersion: bytecodeVersion,
+    supported,
+    blockReason,
+    requiresReactHostIntegration: rnVersion ? compare(rnVersion, REACT_HOST_ONLY_RN) >= 0 : false
+  };
+  return cached;
+}
+
+/** Test seam — the detection result is process-lifetime cached. */
+function _resetOtaEnvironmentCache() {
+  cached = null;
+}
+//# sourceMappingURL=environment.js.map

package/lib/commonjs/features/ota/geoCountry.js

@@ -0,0 +1,93 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getDeviceCountry = getDeviceCountry;
+exports.prefetchDeviceCountry = prefetchDeviceCountry;
+exports.setGeoEndpoint = setGeoEndpoint;
+var _StorageBackend = require("../../storage/StorageBackend");
+var _internalLogger = require("../../core/logger/internalLogger");
+/**
+ * Device country via an edge Worker — the workaround for an API that is not
+ * behind a geo-stamping CDN.
+ *
+ * The clean architecture is the API itself resolving `cf-ipcountry` at its own
+ * edge (see backend `resolveCountry`) — the device can't forge it and every
+ * request carries it. When the API record isn't proxied, that header never
+ * exists, so this module asks a Cloudflare Worker (which DOES see the device's
+ * edge geo) and attaches the answer to the OTA check payload. Host-supplied
+ * country always wins; the server treats a client country as locale-grade, not
+ * proof of location.
+ *
+ * Failure-soft by design: a dead Worker, a timeout, or a bad payload leaves the
+ * country unset — an unknown country must render as unknown, never be guessed.
+ */
+
+/** Default lookup endpoint. Overridable via {@link setGeoEndpoint}. */
+const DEFAULT_GEO_ENDPOINT = 'https://get-location.imohamadfahmy.workers.dev/';
+const K_COUNTRY = 'scalebun.ota.geoCountry';
+const K_FETCHED_AT = 'scalebun.ota.geoCountryAt';
+const TTL_MS = 24 * 60 * 60 * 1000; // countries change when people travel — daily is plenty
+const TIMEOUT_MS = 2500;
+
+/** Cloudflare's non-countries: Tor exits and internal probes. Unknown, not a place. */
+const NON_COUNTRIES = new Set(['XX', 'T1', 'ZZ']);
+let endpoint = DEFAULT_GEO_ENDPOINT;
+let memory = null;
+let inFlight = null;
+const storage = (0, _StorageBackend.createStorageBackend)();
+
+/** Override the lookup endpoint (e.g. a self-hosted Worker). */
+function setGeoEndpoint(url) {
+  endpoint = url;
+}
+
+/**
+ * Synchronous read of the cached country (uppercase ISO 3166-1 alpha-2), or
+ * null when no fresh lookup has ever succeeded. Never triggers network.
+ */
+function getDeviceCountry() {
+  if (memory) return memory;
+  const stored = storage.get(K_COUNTRY);
+  const at = parseInt(storage.get(K_FETCHED_AT) ?? '0', 10) || 0;
+  if (stored && Date.now() - at < TTL_MS) {
+    memory = stored;
+    return stored;
+  }
+  return null;
+}
+
+/**
+ * Refresh the cache from the Worker if stale. Fire-and-forget: call it at
+ * orchestrator init; the first check of a cold install may go out without a
+ * country (the server stores the country per device on later checks anyway).
+ */
+function prefetchDeviceCountry() {
+  if (getDeviceCountry()) return Promise.resolve(); // fresh — nothing to do
+  if (inFlight) return inFlight;
+  inFlight = (async () => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+      const res = await fetch(endpoint, {
+        signal: controller.signal
+      });
+      if (!res.ok) return;
+      const body = await res.json();
+      const raw = typeof body?.country === 'string' ? body.country.trim().toUpperCase() : '';
+      if (!/^[A-Z]{2}$/.test(raw) || NON_COUNTRIES.has(raw)) return;
+      memory = raw;
+      storage.set(K_COUNTRY, raw);
+      storage.set(K_FETCHED_AT, String(Date.now()));
+      __DEV__ && _internalLogger.logger.debug(`[OTA] Device country resolved: ${raw}`);
+    } catch (err) {
+      __DEV__ && _internalLogger.logger.debug(`[OTA] Geo lookup skipped: ${err?.message ?? err}`);
+    } finally {
+      clearTimeout(timer);
+      inFlight = null;
+    }
+  })();
+  return inFlight;
+}
+//# sourceMappingURL=geoCountry.js.map

package/lib/commonjs/features/ota/retry.js

@@ -0,0 +1,96 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.HttpStatusError = void 0;
+exports.backoffDelay = backoffDelay;
+exports.isRetryableNetworkError = isRetryableNetworkError;
+exports.retryWithBackoff = retryWithBackoff;
+var _internalLogger = require("../../core/logger/internalLogger");
+/**
+ * Retry with exponential backoff and full jitter.
+ *
+ * ── Why ─────────────────────────────────────────────────────────────────────
+ *
+ * The OTA path had no retry at all. A download that failed on a flaky mobile
+ * connection returned an error and the device then waited for the next cold
+ * start to try again — which on a phone is often hours, and on a device that
+ * is never fully restarted, effectively never. On mobile networks a single
+ * transient failure is the common case, not the exception.
+ *
+ * Full jitter (`random(0, backoff)` rather than `backoff`) matters more here
+ * than in most clients: every device on a release checks in against the same
+ * schedule, so a fixed backoff would retry the whole fleet in lockstep and
+ * turn one origin blip into a synchronised thundering herd.
+ */
+
+const DEFAULT_ATTEMPTS = 3;
+const DEFAULT_BASE_DELAY_MS = 1_000;
+const DEFAULT_MAX_DELAY_MS = 30_000;
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+/** Exposed for tests; `Math.random` is the only nondeterminism in the schedule. */
+function backoffDelay(attemptIndex, baseDelayMs, maxDelayMs, random = Math.random) {
+  const exponential = Math.min(maxDelayMs, baseDelayMs * Math.pow(2, attemptIndex));
+  return Math.floor(random() * exponential);
+}
+
+/**
+ * Run `fn`, retrying on failure with exponential backoff.
+ * Rethrows the last error once attempts are exhausted.
+ */
+async function retryWithBackoff(fn, options = {}) {
+  const attempts = options.attempts ?? DEFAULT_ATTEMPTS;
+  const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+  const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+  const label = options.label ?? 'operation';
+  const isRetryable = options.isRetryable ?? (() => true);
+  let lastError;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      return await fn(attempt);
+    } catch (err) {
+      lastError = err;
+      if (!isRetryable(err)) {
+        __DEV__ && _internalLogger.logger.debug(`[OTA] ${label} failed with a non-retryable error — not retrying`);
+        throw err;
+      }
+      const isLast = attempt === attempts - 1;
+      if (isLast) break;
+      const delay = backoffDelay(attempt, baseDelayMs, maxDelayMs);
+      __DEV__ && _internalLogger.logger.debug(`[OTA] ${label} failed (attempt ${attempt + 1}/${attempts}) — retrying in ${delay}ms`);
+      await sleep(delay);
+    }
+  }
+  throw lastError;
+}
+
+/**
+ * True for failures that a later attempt could plausibly survive.
+ *
+ * Network errors and 5xx/429 are retryable. A 4xx other than 429 is the server
+ * telling us the request itself is wrong — retrying it just wastes battery.
+ */
+function isRetryableNetworkError(err) {
+  const status = err?.status;
+  if (typeof status === 'number') {
+    if (status === 429) return true;
+    if (status >= 500) return true;
+    if (status >= 400) return false;
+  }
+  // fetch() rejects with a TypeError on DNS failure, connection refused, and
+  // airplane mode — all of which are exactly what we want to retry.
+  return true;
+}
+
+/** Error carrying an HTTP status so `isRetryableNetworkError` can classify it. */
+class HttpStatusError extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = 'HttpStatusError';
+  }
+}
+exports.HttpStatusError = HttpStatusError;
+//# sourceMappingURL=retry.js.map

package/lib/commonjs/features/ota/signedDownload.js

@@ -0,0 +1,187 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.SIGNED_DOWNLOAD_DEFAULTS = exports.DOWNLOAD_REASON = void 0;
+exports.downloadReason = downloadReason;
+exports.retryDecision = retryDecision;
+exports.signedPatchSupported = signedPatchSupported;
+exports.stageSignedWithRetry = stageSignedWithRetry;
+exports.trySignedPatch = trySignedPatch;
+exports.verdictErrorCode = verdictErrorCode;
+var _retry = require("./retry");
+/**
+ * Download + stage a SIGNED release, retrying what a retry can fix.
+ *
+ * WHY. The unsigned path has always retried (retryWithBackoff); the signed path — every release of
+ * an app that embeds trusted keys, i.e. every le-garage release — made ONE native call and gave up.
+ * A 19 MB bundle on a mobile connection that drops once was lost until the next cold start, often
+ * hours away. Production showed it: DOWNLOAD_FAILED 13-104 s into downloads.
+ *
+ * WHAT IS RETRIED. Only a DOWNLOAD failure with a transient cause. A signature, identity, size or
+ * hash failure is a verdict about the bytes or the release, and repeating it changes nothing.
+ *
+ * THE URL EXPIRES. The download URL is presigned for 300 s, and one iOS attempt can take 240 s, so
+ * a naive third attempt usually hits an expired URL (403). Before a retry after a 403, or once 240 s
+ * have passed since the offer, the server is asked again and the fresh URL used. If it now offers a
+ * DIFFERENT release, or none (paused, rolled back, superseded), the download stops quietly: a
+ * withdrawn release is never installed, and not being offered it is not a failure.
+ *
+ * Pure: native call, re-check, clock and sleep are injected, so every branch is testable in JS.
+ */
+
+/** The only reasons that may leave the device. Anything else is dropped. */
+const DOWNLOAD_REASON = exports.DOWNLOAD_REASON = /^(http_[1-5]\d\d|timeout|dns|tls|pin_mismatch|size_exceeded|redirect_limit|io)$/;
+
+/** A validated download reason, or null. */
+function downloadReason(v) {
+  return v.code === 'DOWNLOAD_FAILED' && typeof v.reason === 'string' && DOWNLOAD_REASON.test(v.reason) ? v.reason : null;
+}
+
+/** The wire errorCode for a failed verdict: `DOWNLOAD_FAILED:http_403`, or just the code. */
+function verdictErrorCode(v) {
+  const code = v.code || 'verify_and_stage_release_failed';
+  const reason = downloadReason(v);
+  return reason ? `${code}:${reason}` : code;
+}
+function retryDecision(v) {
+  if (v.ok) return 'stop';
+  if (v.code !== 'DOWNLOAD_FAILED') return 'stop'; // signature / identity / size / hash / threw
+  const reason = downloadReason(v);
+  // No (or an unrecognised) reason: an older native binary, which cannot tell a dropped connection
+  // from anything else. Retrying is what the unsigned path always did in that position.
+  if (reason === null) return 'retry';
+  if (reason === 'http_403') return 'refresh'; // an expired presigned URL answers 403
+  if (/^(timeout|dns|io|tls)$/.test(reason)) return 'retry';
+  if (/^http_(5\d\d|408|429)$/.test(reason)) return 'retry';
+  return 'stop'; // 404 and other 4xx, pin_mismatch, size_exceeded, redirect_limit
+}
+
+/** The offered bundle as far as this needs it. */
+
+const SIGNED_DOWNLOAD_DEFAULTS = exports.SIGNED_DOWNLOAD_DEFAULTS = {
+  attempts: 3,
+  baseDelayMs: 2_000,
+  maxDelayMs: 30_000,
+  refreshAfterMs: 240_000,
+  budgetMs: 8 * 60_000
+};
+async function stageSignedWithRetry(deps, offered, offeredAt, options = {}) {
+  const o = {
+    ...SIGNED_DOWNLOAD_DEFAULTS,
+    ...options
+  };
+  const started = deps.now();
+  let bundle = offered;
+  let offerTime = offeredAt;
+  let verdict = {
+    ok: false,
+    code: 'not_attempted'
+  };
+  for (let i = 0; i < o.attempts; i++) {
+    verdict = await deps.attempt(bundle);
+    if (verdict.ok) return {
+      verdict,
+      bundle,
+      attempts: i + 1,
+      withdrawn: false
+    };
+    const decision = retryDecision(verdict);
+    const last = i === o.attempts - 1;
+    if (decision === 'stop' || last) return {
+      verdict,
+      bundle,
+      attempts: i + 1,
+      withdrawn: false
+    };
+    await deps.sleep((0, _retry.backoffDelay)(i, o.baseDelayMs, o.maxDelayMs, deps.random));
+    if (deps.now() - started > o.budgetMs) return {
+      verdict,
+      bundle,
+      attempts: i + 1,
+      withdrawn: false
+    };
+    if (decision === 'refresh' || deps.now() - offerTime > o.refreshAfterMs) {
+      let fresh;
+      try {
+        fresh = await deps.recheck();
+      } catch {
+        // Cannot reach the server: the stale URL is all there is, and it would fail again.
+        return {
+          verdict,
+          bundle,
+          attempts: i + 1,
+          withdrawn: false
+        };
+      }
+      if (!fresh || fresh.id !== bundle.id || (fresh.releaseId ?? null) !== (bundle.releaseId ?? null)) {
+        return {
+          verdict,
+          bundle,
+          attempts: i + 1,
+          withdrawn: true
+        };
+      }
+      bundle = fresh;
+      offerTime = deps.now();
+    }
+  }
+  return {
+    verdict,
+    bundle,
+    attempts: o.attempts,
+    withdrawn: false
+  };
+}
+
+// ── Signed patches ────────────────────────────────────────────────────────────
+
+/**
+ * Does this native build have `verifyAndStagePatch`?
+ *
+ * OTA ships JS, not native: the JS in an update runs on binaries built before the method existed.
+ * On both architectures a method missing from the native build reads as `undefined`, so this is
+ * the whole guard — never call it without asking.
+ */
+function signedPatchSupported(native) {
+  return typeof native?.verifyAndStagePatch === 'function';
+}
+/**
+ * ONE attempt to stage a signed release from its patch. Never throws, never retries: any failure
+ * means "download the full bundle" (with signedDownload's retry), which is always correct — the
+ * patch only ever saves bytes. The result is a verdict like verifyAndStageRelease's, plus
+ * `patchUsed: true` when the patch was applied.
+ */
+async function trySignedPatch(native, envelope, url, patch) {
+  if (!native || !signedPatchSupported(native)) return {
+    ok: false,
+    code: 'patch_unsupported'
+  };
+  try {
+    const json = await native.verifyAndStagePatch(JSON.stringify({
+      ...envelope,
+      downloadUrl: url
+    }), JSON.stringify({
+      url: patch.url,
+      size: patch.size,
+      sha256: patch.sha256,
+      baseBundleId: patch.baseBundleId,
+      ...(patch.baseSha256 ? {
+        baseSha256: patch.baseSha256
+      } : {})
+    }));
+    const v = JSON.parse(json);
+    return v.ok ? {
+      ...v,
+      patchUsed: true
+    } : v;
+  } catch (err) {
+    return {
+      ok: false,
+      code: 'patch_threw',
+      message: err?.message ?? String(err)
+    };
+  }
+}
+//# sourceMappingURL=signedDownload.js.map