pulse-updates 1.0.18 → 1.0.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "description": "OTA updates for React Native - lightweight alternative to expo-updates",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/scripts/publish.mjs

@@ -646,6 +646,43 @@ function detectRuntimeVersion(platform) {
   return null;
 }
 
+/**
+ * Detect whether the app is configured to run on Hermes, from its native build
+ * config. Used to auto-resolve requireHermes when it isn't explicitly set: a Hermes
+ * app should never receive a plain-JS OTA, so detection turns enforcement on for it
+ * without the developer having to declare the flag. Returns true / false / null
+ * (null = couldn't determine → caller stays best-effort).
+ */
+function detectHermesEnabled(platform) {
+  try {
+    if (platform === 'android') {
+      const gp = path.resolve('android/gradle.properties');
+      if (fs.existsSync(gp)) {
+        const m = fs.readFileSync(gp, 'utf8').match(/^\s*hermesEnabled\s*=\s*(\S+)/m);
+        if (m) return /^true$/i.test(m[1].trim());
+      }
+    } else if (platform === 'ios') {
+      const podfile = path.resolve('ios/Podfile');
+      if (fs.existsSync(podfile)) {
+        const txt = fs.readFileSync(podfile, 'utf8');
+        // ENV['USE_HERMES'] = '1' / USE_HERMES => true, or :hermes_enabled => true
+        const useHermes = txt.match(/USE_HERMES['"\]\s]*[=>]+\s*['"]?(\w+)/);
+        if (useHermes) return /^(1|true|yes)$/i.test(useHermes[1]);
+        const flag = txt.match(/:hermes_enabled\s*=>\s*(\w+)/);
+        if (flag) return /^true$/i.test(flag[1]);
+      }
+      // Fallback: the Pods lockfile lists hermes-engine when Hermes is on.
+      const lock = path.resolve('ios/Podfile.lock');
+      if (fs.existsSync(lock)) {
+        return /hermes-engine/.test(fs.readFileSync(lock, 'utf8'));
+      }
+    }
+  } catch {
+    /* detection is best-effort */
+  }
+  return null; // unknown
+}
+
 /**
  * Extract base API URL from full manifest URL
  * e.g., "https://pulse.example.com/pulse/manifest/my-app" -> "https://pulse.example.com"
@@ -728,6 +765,27 @@ function loadConfig(options) {
     }
   }
 
+  // Resolve Hermes enforcement (tri-state): explicit true/false wins; when left
+  // unset, auto-detect from the app's native config — a Hermes app is enforced,
+  // anything else stays best-effort.
+  let requireHermes =
+    options['require-hermes'] ? true
+      : options['no-require-hermes'] ? false
+        : process.env.PULSE_REQUIRE_HERMES != null ? (process.env.PULSE_REQUIRE_HERMES === '1')
+          : fileConfig.requireHermes; // true | false | undefined
+  if (requireHermes === undefined) {
+    const detected = platform ? detectHermesEnabled(platform) : null;
+    requireHermes = detected === true;
+    log(
+      `  Auto-detected Hermes enforcement: ${
+        detected === true ? 'ON (app uses Hermes)'
+          : detected === false ? 'OFF (app not on Hermes)'
+            : 'OFF (could not determine — best-effort)'
+      }`,
+      colors.dim
+    );
+  }
+
   return {
     apiUrl,
     apiKey: options['api-key'] || process.env.PULSE_API_KEY || fileConfig.apiKey,
@@ -739,12 +797,12 @@ function loadConfig(options) {
     skipBundle: options['skip-bundle'] || false,
     build: options.build || process.env.PULSE_BUILD || fileConfig.build || null,
     message: options.message || fileConfig.message || null,
-    // Opt-in: the app runs on Hermes, so a plain-JS OTA must never be shipped.
-    // Makes a missing/failing hermesc fatal (with a one-shot pod-install attempt on
-    // macOS), enables -fstrip-function-names, and asserts bytecode output.
-    // Leave unset for apps that intentionally run plain JS (best-effort default).
-    requireHermes: options['require-hermes'] || process.env.PULSE_REQUIRE_HERMES === '1' ||
-      fileConfig.requireHermes || false,
+    // Whether to enforce Hermes (resolved above): explicit config/flag/env, or
+    // auto-detected from the app's native build config when left unset. When on, a
+    // missing/failing hermesc is fatal (one-shot pod-install attempt on macOS),
+    // -fstrip-function-names is passed, and bytecode output is asserted — so a
+    // Hermes app can never ship a readable plain-JS OTA.
+    requireHermes,
   };
 }