pulse-updates 1.0.16 → 1.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "description": "OTA updates for React Native - lightweight alternative to expo-updates",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/scripts/publish.mjs

@@ -157,12 +157,15 @@ function getMimeType(ext) {
  */
 function findHermesc(platform) {
   const possiblePaths = [
-    // iOS paths
+    // iOS paths (present once Pods are installed)
     'ios/Pods/hermes-engine/destroot/bin/hermesc',
+    // hermesc as shipped inside react-native itself (host-arch dirs vary by RN version)
     'node_modules/react-native/sdks/hermesc/osx-bin/hermesc',
     'node_modules/react-native/sdks/hermesc/linux64-bin/hermesc',
-    // Android paths
+    'node_modules/react-native/sdks/hermesc/win64-bin/hermesc.exe',
+    // Android paths (present once an Android build has run)
     'node_modules/react-native/ReactAndroid/hermes-engine/build/hermes/bin/hermesc',
+    'node_modules/react-native/ReactAndroid/hermes-engine/build/hermes/tools/hermesc/hermesc',
   ];
 
   for (const p of possiblePaths) {
@@ -172,12 +175,59 @@ function findHermesc(platform) {
     }
   }
 
-  // Try to find via which
+  // Try to find via PATH
   try {
-    return execSync('which hermesc', { encoding: 'utf8' }).trim();
+    const viaPath = execSync('command -v hermesc', { encoding: 'utf8' }).trim();
+    if (viaPath) return viaPath;
   } catch {
-    return null;
+    /* not on PATH */
   }
+  return null;
+}
+
+/**
+ * Locate hermesc, and if it isn't there yet, try to materialize it.
+ * A React Native app may only carry hermesc inside the installed CocoaPods (it
+ * does not always ship in node_modules for every RN version), so on macOS a
+ * missing compiler often means "Pods aren't installed" — which we fix by running
+ * pod-install once, then re-checking. Anything else is a hard stop: we NEVER
+ * silently fall back to a plain-JS OTA bundle (that would ship readable source
+ * over the air). Hermes is mandatory on every publish.
+ */
+function ensureHermesc(platform) {
+  let hermesc = findHermesc(platform);
+  if (hermesc) return hermesc;
+
+  const onMac = process.platform === 'darwin';
+  const hasPodfile = fs.existsSync(path.resolve('ios/Podfile'));
+  if (onMac && hasPodfile) {
+    logWarning('Hermes compiler not found — installing iOS Pods to obtain it (one-shot)...');
+    try {
+      // Prefer a repo pod-install helper if the app provides one, else npx pod-install.
+      const repoHelper = path.resolve('scripts/pod-install-if-mac.js');
+      const cmd = fs.existsSync(repoHelper)
+        ? `node ${repoHelper}`
+        : 'npx pod-install ios';
+      execSync(cmd, { stdio: 'inherit' });
+    } catch (error) {
+      throw new Error(
+        `Hermes compiler not found and automatic pod install failed (${error.message}). ` +
+        'Run `npx pod-install ios` (or `cd ios && pod install`) and publish again.'
+      );
+    }
+    hermesc = findHermesc(platform);
+  }
+
+  if (!hermesc) {
+    throw new Error(
+      'Hermes compiler (hermesc) could not be located. Pulse publishes Hermes bytecode only — ' +
+      'a plain-JS OTA bundle must never be shipped. Install it before publishing:\n' +
+      '  • macOS: `npx pod-install ios` (materializes ios/Pods/hermes-engine/.../hermesc)\n' +
+      '  • or ensure react-native ships hermesc under node_modules/react-native/sdks/hermesc/\n' +
+      '  • or put hermesc on PATH.'
+    );
+  }
+  return hermesc;
 }
 
 /**
@@ -213,43 +263,51 @@ function createBundle(platform, bundleDir, entryFile = 'index.ts') {
  * Compile bundle with Hermes
  */
 function compileWithHermes(bundlePath, platform) {
-  const hermesc = findHermesc(platform);
-  if (!hermesc) {
-    logWarning('Hermes compiler not found, using plain JS bundle');
-    return bundlePath;
-  }
+  // Mandatory: locate (and if needed materialize) hermesc. Throws rather than
+  // degrading to a plain-JS bundle — see ensureHermesc.
+  const hermesc = ensureHermesc(platform);
 
   const hbcPath = bundlePath.replace('.bundle', '.hbc');
 
   log(`  Compiling with Hermes...`, colors.dim);
 
-  try {
-    // Use spawnSync with larger buffer to avoid ENOBUFS error
-    const result = spawnSync(hermesc, ['-emit-binary', '-out', hbcPath, bundlePath], {
-      stdio: ['pipe', 'pipe', 'pipe'],
-      maxBuffer: 100 * 1024 * 1024, // 100MB buffer
-      encoding: 'utf8',
-    });
+  // -emit-binary: Hermes bytecode.
+  // -fstrip-function-names: drop JS function names from the string table (smaller
+  //   bundle, and function names are the biggest readability gift to anyone
+  //   inspecting the bytecode). Trade-off: JS function names disappear from crash
+  //   stack traces. Does NOT touch string literals.
+  const hermesArgs = ['-emit-binary', '-fstrip-function-names', '-out', hbcPath, bundlePath];
+
+  // Use spawnSync with larger buffer to avoid ENOBUFS error
+  const result = spawnSync(hermesc, hermesArgs, {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    maxBuffer: 100 * 1024 * 1024, // 100MB buffer
+    encoding: 'utf8',
+  });
 
-    if (result.error) {
-      throw result.error;
-    }
+  if (result.error) {
+    throw result.error;
+  }
 
-    if (result.status !== 0) {
-      const stderr = result.stderr || '';
-      throw new Error(`Hermes exited with code ${result.status}: ${stderr.slice(0, 500)}`);
-    }
+  if (result.status !== 0) {
+    const stderr = result.stderr || '';
+    throw new Error(`Hermes exited with code ${result.status}: ${stderr.slice(0, 500)}`);
+  }
 
-    // Remove the plain JS bundle, keep only HBC
-    fs.unlinkSync(bundlePath);
-    // Rename .hbc to .bundle for compatibility
-    const finalPath = bundlePath;
-    fs.renameSync(hbcPath, finalPath);
-    return finalPath;
-  } catch (error) {
-    logWarning(`Hermes compilation failed: ${error.message}`);
-    return bundlePath;
+  // Remove the plain JS bundle, keep only HBC
+  fs.unlinkSync(bundlePath);
+  // Rename .hbc to .bundle for compatibility
+  const finalPath = bundlePath;
+  fs.renameSync(hbcPath, finalPath);
+
+  // Belt-and-suspenders: the launch asset MUST be Hermes bytecode. If for any
+  // reason it isn't, fail the publish instead of shipping readable JS OTA.
+  if (!isHermesBytecode(finalPath)) {
+    throw new Error(
+      'Post-compile check failed: launch bundle is not Hermes bytecode. Refusing to publish a plain-JS OTA bundle.'
+    );
   }
+  return finalPath;
 }
 
 /**