pulse-updates 1.0.17 → 1.0.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "OTA updates for React Native - lightweight alternative to expo-updates",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/scripts/publish.mjs

@@ -187,12 +187,14 @@ function findHermesc(platform) {
 
 /**
  * Locate hermesc, and if it isn't there yet, try to materialize it.
+ * Only used when the caller has REQUIRED Hermes (config.requireHermes / --require-hermes).
  * A React Native app may only carry hermesc inside the installed CocoaPods (it
  * does not always ship in node_modules for every RN version), so on macOS a
  * missing compiler often means "Pods aren't installed" — which we fix by running
- * pod-install once, then re-checking. Anything else is a hard stop: we NEVER
- * silently fall back to a plain-JS OTA bundle (that would ship readable source
- * over the air). Hermes is mandatory on every publish.
+ * pod-install once, then re-checking. If it still can't be found we throw, rather
+ * than silently shipping a plain-JS OTA bundle (readable source over the air).
+ * Apps that intentionally run without Hermes must NOT set requireHermes — they get
+ * the default best-effort path (compile if hermesc is present, plain JS otherwise).
  */
 function ensureHermesc(platform) {
   let hermesc = findHermesc(platform);
@@ -260,23 +262,42 @@ function createBundle(platform, bundleDir, entryFile = 'index.ts') {
 }
 
 /**
- * Compile bundle with Hermes
+ * Compile bundle with Hermes.
+ *
+ * Default (best-effort): if hermesc is found, compile to bytecode; if not, warn and
+ * ship the plain JS bundle — this is correct for apps that don't run Hermes (JSC,
+ * or an intentionally plain-JS runtime), which is why it stays the default.
+ *
+ * With options.requireHermes (config.requireHermes / --require-hermes): the app has
+ * declared it runs on Hermes, so a plain-JS OTA would be both readable source and a
+ * runtime mismatch. In that mode we locate-or-materialize hermesc (throwing if we
+ * can't), pass -fstrip-function-names to shrink the string table, and assert the
+ * output is bytecode before returning. eSound and Lyra run in this mode.
  */
-function compileWithHermes(bundlePath, platform) {
-  // Mandatory: locate (and if needed materialize) hermesc. Throws rather than
-  // degrading to a plain-JS bundle — see ensureHermesc.
-  const hermesc = ensureHermesc(platform);
+function compileWithHermes(bundlePath, platform, options = {}) {
+  const requireHermes = !!options.requireHermes;
+
+  // In required mode, ensureHermesc throws if it can't obtain a compiler.
+  // Otherwise fall back to best-effort discovery.
+  const hermesc = requireHermes ? ensureHermesc(platform) : findHermesc(platform);
+  if (!hermesc) {
+    // Only reachable when Hermes is NOT required.
+    logWarning('Hermes compiler not found, using plain JS bundle');
+    return bundlePath;
+  }
 
   const hbcPath = bundlePath.replace('.bundle', '.hbc');
 
   log(`  Compiling with Hermes...`, colors.dim);
 
   // -emit-binary: Hermes bytecode.
-  // -fstrip-function-names: drop JS function names from the string table (smaller
-  //   bundle, and function names are the biggest readability gift to anyone
-  //   inspecting the bytecode). Trade-off: JS function names disappear from crash
-  //   stack traces. Does NOT touch string literals.
-  const hermesArgs = ['-emit-binary', '-fstrip-function-names', '-out', hbcPath, bundlePath];
+  // -fstrip-function-names (required mode only): drop JS function names from the
+  //   bytecode string table (smaller bundle, less readable). Trade-off: JS function
+  //   names disappear from crash stack traces, so it stays opt-in via requireHermes.
+  //   Does NOT touch string literals.
+  const hermesArgs = ['-emit-binary'];
+  if (requireHermes) hermesArgs.push('-fstrip-function-names');
+  hermesArgs.push('-out', hbcPath, bundlePath);
 
   // Use spawnSync with larger buffer to avoid ENOBUFS error
   const result = spawnSync(hermesc, hermesArgs, {
@@ -286,12 +307,17 @@ function compileWithHermes(bundlePath, platform) {
   });
 
   if (result.error) {
-    throw result.error;
+    if (requireHermes) throw result.error;
+    logWarning(`Hermes compilation failed: ${result.error.message}`);
+    return bundlePath;
   }
 
   if (result.status !== 0) {
     const stderr = result.stderr || '';
-    throw new Error(`Hermes exited with code ${result.status}: ${stderr.slice(0, 500)}`);
+    const message = `Hermes exited with code ${result.status}: ${stderr.slice(0, 500)}`;
+    if (requireHermes) throw new Error(message);
+    logWarning(`Hermes compilation failed: ${message}`);
+    return bundlePath;
   }
 
   // Remove the plain JS bundle, keep only HBC
@@ -300,9 +326,8 @@ function compileWithHermes(bundlePath, platform) {
   const finalPath = bundlePath;
   fs.renameSync(hbcPath, finalPath);
 
-  // Belt-and-suspenders: the launch asset MUST be Hermes bytecode. If for any
-  // reason it isn't, fail the publish instead of shipping readable JS OTA.
-  if (!isHermesBytecode(finalPath)) {
+  // In required mode, belt-and-suspenders: the launch asset MUST be Hermes bytecode.
+  if (requireHermes && !isHermesBytecode(finalPath)) {
     throw new Error(
       'Post-compile check failed: launch bundle is not Hermes bytecode. Refusing to publish a plain-JS OTA bundle.'
     );
@@ -621,6 +646,43 @@ function detectRuntimeVersion(platform) {
   return null;
 }
 
+/**
+ * Detect whether the app is configured to run on Hermes, from its native build
+ * config. Used to auto-resolve requireHermes when it isn't explicitly set: a Hermes
+ * app should never receive a plain-JS OTA, so detection turns enforcement on for it
+ * without the developer having to declare the flag. Returns true / false / null
+ * (null = couldn't determine → caller stays best-effort).
+ */
+function detectHermesEnabled(platform) {
+  try {
+    if (platform === 'android') {
+      const gp = path.resolve('android/gradle.properties');
+      if (fs.existsSync(gp)) {
+        const m = fs.readFileSync(gp, 'utf8').match(/^\s*hermesEnabled\s*=\s*(\S+)/m);
+        if (m) return /^true$/i.test(m[1].trim());
+      }
+    } else if (platform === 'ios') {
+      const podfile = path.resolve('ios/Podfile');
+      if (fs.existsSync(podfile)) {
+        const txt = fs.readFileSync(podfile, 'utf8');
+        // ENV['USE_HERMES'] = '1' / USE_HERMES => true, or :hermes_enabled => true
+        const useHermes = txt.match(/USE_HERMES['"\]\s]*[=>]+\s*['"]?(\w+)/);
+        if (useHermes) return /^(1|true|yes)$/i.test(useHermes[1]);
+        const flag = txt.match(/:hermes_enabled\s*=>\s*(\w+)/);
+        if (flag) return /^true$/i.test(flag[1]);
+      }
+      // Fallback: the Pods lockfile lists hermes-engine when Hermes is on.
+      const lock = path.resolve('ios/Podfile.lock');
+      if (fs.existsSync(lock)) {
+        return /hermes-engine/.test(fs.readFileSync(lock, 'utf8'));
+      }
+    }
+  } catch {
+    /* detection is best-effort */
+  }
+  return null; // unknown
+}
+
 /**
  * Extract base API URL from full manifest URL
  * e.g., "https://pulse.example.com/pulse/manifest/my-app" -> "https://pulse.example.com"
@@ -703,6 +765,27 @@ function loadConfig(options) {
     }
   }
 
+  // Resolve Hermes enforcement (tri-state): explicit true/false wins; when left
+  // unset, auto-detect from the app's native config — a Hermes app is enforced,
+  // anything else stays best-effort.
+  let requireHermes =
+    options['require-hermes'] ? true
+      : options['no-require-hermes'] ? false
+        : process.env.PULSE_REQUIRE_HERMES != null ? (process.env.PULSE_REQUIRE_HERMES === '1')
+          : fileConfig.requireHermes; // true | false | undefined
+  if (requireHermes === undefined) {
+    const detected = platform ? detectHermesEnabled(platform) : null;
+    requireHermes = detected === true;
+    log(
+      `  Auto-detected Hermes enforcement: ${
+        detected === true ? 'ON (app uses Hermes)'
+          : detected === false ? 'OFF (app not on Hermes)'
+            : 'OFF (could not determine — best-effort)'
+      }`,
+      colors.dim
+    );
+  }
+
   return {
     apiUrl,
     apiKey: options['api-key'] || process.env.PULSE_API_KEY || fileConfig.apiKey,
@@ -714,6 +797,12 @@ function loadConfig(options) {
     skipBundle: options['skip-bundle'] || false,
     build: options.build || process.env.PULSE_BUILD || fileConfig.build || null,
     message: options.message || fileConfig.message || null,
+    // Whether to enforce Hermes (resolved above): explicit config/flag/env, or
+    // auto-detected from the app's native build config when left unset. When on, a
+    // missing/failing hermesc is fatal (one-shot pod-install attempt on macOS),
+    // -fstrip-function-names is passed, and bytecode output is asserted — so a
+    // Hermes app can never ship a readable plain-JS OTA.
+    requireHermes,
   };
 }
 
@@ -763,7 +852,7 @@ async function publish(options) {
 
     // Step 2: Compile with Hermes
     logStep('2/6', 'Compiling with Hermes...');
-    compileWithHermes(bundlePath, config.platform);
+    compileWithHermes(bundlePath, config.platform, { requireHermes: config.requireHermes });
     logSuccess('Hermes compilation complete');
   } else {
     logStep('1/6', 'Skipping bundle creation (--skip-bundle)');