react-native-nitro-logger 0.1.0

package/ios/Gzip.swift

@@ -0,0 +1,203 @@
+#if canImport(Compression)
+import Foundation
+import Compression
+
+/// Produces gzip (RFC 1952) containers for rotated log archives.
+///
+/// Apple's Compression framework emits a *raw* DEFLATE stream for
+/// `COMPRESSION_ZLIB` (RFC 1951) with no container around it, so writing a file
+/// that `gunzip` and every other standard tool can open means supplying the
+/// gzip header and the trailing CRC-32 and length ourselves.
+///
+/// Vendored unchanged from SwiftLogger (`Sources/Logger/Gzip.swift`). Kept
+/// byte-identical on purpose: it is the piece with the least reason to diverge
+/// and the most reason to stay diffable against the original.
+internal enum Gzip {
+
+    /// Header: magic, DEFLATE method, no flags, no mtime, no extra flags, and
+    /// an unknown OS (255) so the output is reproducible.
+    private static let header: [UInt8] = [0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff]
+
+    /// Returns `data` as a gzip stream, or `nil` if compression fails.
+    static func compress(_ data: Data) -> Data? {
+        guard let deflated = deflate(data) else { return nil }
+
+        var output = Data(capacity: deflated.count + 18)
+        output.append(contentsOf: header)
+        output.append(deflated)
+
+        // Trailer: CRC-32 of the *uncompressed* data, then its length mod 2^32,
+        // both little-endian.
+        appendLittleEndian(&output, crc32(data))
+        appendLittleEndian(&output, UInt32(truncatingIfNeeded: data.count))
+
+        return output
+    }
+
+    /// Size of each read from the source file. Two of these are live at a time,
+    /// so peak memory is bounded regardless of how large the archive is.
+    private static let chunkSize = 64 * 1024
+
+    /// Compresses the file at `source` into a gzip file at `destination`,
+    /// streaming in fixed-size chunks.
+    ///
+    /// ``compress(_:)`` holds the whole input, the whole DEFLATE output, and
+    /// the assembled container in memory at once — roughly 2.5× a 10 MB archive
+    /// on the write queue. This reads and deflates incrementally instead, so a
+    /// rotation costs two 64 KB buffers no matter how big the log grew.
+    ///
+    /// Returns `false` and removes any partial output if anything fails, so the
+    /// caller can keep the uncompressed original.
+    static func compressFile(at source: URL, to destination: URL) -> Bool {
+        guard let input = try? FileHandle(forReadingFrom: source) else { return false }
+        defer { try? input.close() }
+
+        guard FileManager.default.createFile(atPath: destination.path, contents: nil),
+              let output = try? FileHandle(forWritingTo: destination) else {
+            try? FileManager.default.removeItem(at: destination)
+            return false
+        }
+
+        var succeeded = false
+        defer {
+            try? output.close()
+            if !succeeded {
+                try? FileManager.default.removeItem(at: destination)
+            }
+        }
+
+        guard (try? output.write(contentsOf: Data(header))) != nil else { return false }
+
+        var stream = compression_stream(
+            dst_ptr: UnsafeMutablePointer<UInt8>(bitPattern: -1)!, dst_size: 0,
+            src_ptr: UnsafePointer<UInt8>(bitPattern: -1)!, src_size: 0,
+            state: nil
+        )
+        guard compression_stream_init(&stream, COMPRESSION_STREAM_ENCODE, COMPRESSION_ZLIB)
+                == COMPRESSION_STATUS_OK else { return false }
+        defer { compression_stream_destroy(&stream) }
+
+        let outputBuffer = UnsafeMutablePointer<UInt8>.allocate(capacity: chunkSize)
+        defer { outputBuffer.deallocate() }
+
+        var crc: UInt32 = 0xFFFF_FFFF
+        var totalRead = 0
+
+        while true {
+            // A read error must NOT be treated as end-of-input. Doing so would
+            // finalize the stream over a partial file, write a CRC and length
+            // matching what was read, and return success — producing a .gz that
+            // gunzip happily verifies while the caller deletes the complete
+            // original. Silent truncation is far worse than a failed rotation.
+            //
+            // `read(upToCount:)` returns nil at EOF and throws on error, so the
+            // two must be distinguished rather than collapsed with `try?`.
+            let chunk: Data
+            do {
+                chunk = try input.read(upToCount: chunkSize) ?? Data()
+            } catch {
+                return false
+            }
+            let isLast = chunk.isEmpty
+            totalRead += chunk.count
+            crc = crc32Update(crc, chunk)
+
+            let ok = chunk.withUnsafeBytes { raw -> Bool in
+                // An empty Data has no base address; the encoder accepts a
+                // zero-length source as long as the pointer is non-null.
+                let base = raw.bindMemory(to: UInt8.self).baseAddress
+                    ?? UnsafePointer<UInt8>(bitPattern: -1)!
+                stream.src_ptr = base
+                stream.src_size = chunk.count
+                let flags = isLast ? Int32(COMPRESSION_STREAM_FINALIZE.rawValue) : 0
+
+                // One source chunk can expand into several output chunks, so
+                // keep draining until the encoder stops filling the buffer.
+                repeat {
+                    stream.dst_ptr = outputBuffer
+                    stream.dst_size = chunkSize
+                    let status = compression_stream_process(&stream, flags)
+                    guard status != COMPRESSION_STATUS_ERROR else { return false }
+
+                    let produced = chunkSize - stream.dst_size
+                    if produced > 0 {
+                        let out = Data(bytes: outputBuffer, count: produced)
+                        guard (try? output.write(contentsOf: out)) != nil else { return false }
+                    }
+                    if status == COMPRESSION_STATUS_END { break }
+                } while stream.src_size > 0 || (isLast && stream.dst_size == 0)
+
+                return true
+            }
+            guard ok else { return false }
+            if isLast { break }
+        }
+
+        // Trailer: CRC-32 of the uncompressed bytes, then their length mod 2^32.
+        var trailer = Data(capacity: 8)
+        appendLittleEndian(&trailer, crc ^ 0xFFFF_FFFF)
+        appendLittleEndian(&trailer, UInt32(truncatingIfNeeded: totalRead))
+        guard (try? output.write(contentsOf: trailer)) != nil else { return false }
+
+        succeeded = true
+        return true
+    }
+
+    private static func appendLittleEndian(_ data: inout Data, _ value: UInt32) {
+        withUnsafeBytes(of: value.littleEndian) { data.append(contentsOf: $0) }
+    }
+
+    private static func deflate(_ data: Data) -> Data? {
+        guard !data.isEmpty else { return Data() }
+
+        // Incompressible input can grow slightly, so leave headroom rather than
+        // letting the encode fail on a tight buffer.
+        let capacity = data.count + (data.count / 2) + 64
+        let destination = UnsafeMutablePointer<UInt8>.allocate(capacity: capacity)
+        defer { destination.deallocate() }
+
+        let written = data.withUnsafeBytes { raw -> Int in
+            guard let base = raw.bindMemory(to: UInt8.self).baseAddress else { return 0 }
+            return compression_encode_buffer(
+                destination, capacity,
+                base, data.count,
+                nil,
+                COMPRESSION_ZLIB
+            )
+        }
+
+        guard written > 0 else { return nil }
+        return Data(bytes: destination, count: written)
+    }
+
+    // MARK: - CRC-32
+
+    private static let crcTable: [UInt32] = {
+        (0..<256).map { index -> UInt32 in
+            var value = UInt32(index)
+            for _ in 0..<8 {
+                value = (value & 1 == 1) ? (0xEDB8_8320 ^ (value >> 1)) : (value >> 1)
+            }
+            return value
+        }
+    }()
+
+    static func crc32(_ data: Data) -> UInt32 {
+        crc32Update(0xFFFF_FFFF, data) ^ 0xFFFF_FFFF
+    }
+
+    /// Folds `data` into a running CRC-32. The caller supplies the initial
+    /// `0xFFFF_FFFF` and applies the final inversion, so a checksum can be
+    /// accumulated across streamed chunks.
+    private static func crc32Update(_ crc: UInt32, _ data: Data) -> UInt32 {
+        guard !data.isEmpty else { return crc }
+        var value = crc
+        data.withUnsafeBytes { raw in
+            for byte in raw.bindMemory(to: UInt8.self) {
+                value = crcTable[Int((value ^ UInt32(byte)) & 0xFF)] ^ (value >> 8)
+            }
+        }
+        return value
+    }
+}
+#endif

package/ios/HybridFileSink.swift

@@ -0,0 +1,291 @@
+import Foundation
+import NitroModules
+
+/// The Nitro end of the file sink: marshalling, and nothing else.
+///
+/// Every decision — batching, backpressure, drop accounting, loss notices —
+/// lives in TypeScript, and every byte that touches the disk lives in
+/// `LogWriter`. What is left here is converting `Double` to `Int`, one enum to
+/// another, and holding exactly one `LogFileHandle`.
+///
+/// That split is the point, not an accident of it: `LogWriter` imports nothing
+/// from Nitro, so rotation, recovery, the registry, and every injected fault run
+/// under XCTest in about a second instead of by hand on a simulator. Anything
+/// that grows logic in this file has been put in the wrong place.
+final class HybridFileSink: HybridFileSinkSpec {
+  private let lock = NSLock()
+  private var handle: LogFileHandle?
+
+  /// Whether this sink may have put anything on disk.
+  ///
+  /// `handle == nil` conflates two states that owe the caller opposite answers.
+  /// A sink that created nothing can say "everything is deleted" vacuously. A
+  /// sink whose files are on disk but out of reach cannot — and reporting a
+  /// durable purge over those is the worst lie in the API, because the only
+  /// caller who asks is the one deleting patient data on request.
+  ///
+  /// Set *before* the acquisition attempt rather than after it succeeds.
+  /// Acquiring creates the log directory and can then fail on the file itself,
+  /// so a throw out of `acquire` is not evidence that nothing was written.
+  ///
+  /// Never cleared once set: `close` releases the handle, it does not unmake
+  /// the files.
+  private var mayHaveArtifacts = false
+
+  /// An `open` past its check and inside `acquire`.
+  ///
+  /// Published so a second `open` is refused instead of racing to install a
+  /// handle over the first one's, and so `close` can tell "nothing here" from
+  /// "something is on its way".
+  private var opening = false
+
+  /// A `close` that arrived while `opening` was true.
+  ///
+  /// The close had no handle to flush and has already returned; this tells the
+  /// in-flight `open` to throw away what it acquired rather than install it.
+  private var closePending = false
+
+  /// The native finalizer, which is the whole reason the refcount is native.
+  ///
+  /// An abrupt runtime teardown never runs JavaScript, so a JS `dispose()` is
+  /// not a guarantee — but this deinit is. Releasing here hands the descriptor
+  /// and the registry slot back even when nothing on the JS side got to run.
+  deinit {
+    lock.lock()
+    let live = handle
+    handle = nil
+    lock.unlock()
+    // Zero deadline: a teardown deinit must not wait on a wedged disk.
+    _ = live?.close(deadlineMs: 0)
+  }
+
+  var defaultLogDirectory: String {
+    let base = FileManager.default.urls(for: .libraryDirectory, in: .userDomainMask).first
+      ?? FileManager.default.temporaryDirectory
+    return base.appendingPathComponent("Logs").path
+  }
+
+  func open(path: String, rotation: RotationConfig?, lineFramed: Bool?) throws {
+    lock.lock()
+    // `opening` counts as open. Acquisition does real I/O — it creates the
+    // directory, opens the file, and may scan a torn tail — so the lock cannot
+    // be held across it without putting every `getStatus` behind disk latency,
+    // which is the one thing that call is documented not to do. Instead the
+    // in-flight attempt is published, and a second one is refused rather than
+    // being allowed to acquire a writer that would overwrite the first: the
+    // loser's handle would be unreachable, and unreachable means a later purge
+    // never deletes its files.
+    let busy = handle != nil || opening
+    if !busy {
+      opening = true
+      closePending = false
+      // Recorded before the attempt: see `mayHaveArtifacts`.
+      mayHaveArtifacts = true
+    }
+    lock.unlock()
+    guard !busy else {
+      throw RuntimeError.error(withMessage: "FileSink: already open")
+    }
+
+    // However this attempt ends, it is no longer in flight afterwards.
+    defer {
+      lock.lock()
+      opening = false
+      lock.unlock()
+    }
+
+    let acquired: LogFileHandle
+    do {
+      acquired = try LogWriterRegistry.shared.acquire(
+        path: path,
+        policy: Self.policy(from: rotation),
+        // Absent means absent. Without a declared one-record-per-line contract
+        // the startup scan must not trim a trailing record, because it cannot
+        // tell a torn one from an intentional newline.
+        lineFramed: lineFramed ?? false
+      )
+    } catch LogWriterError.configConflict {
+      throw RuntimeError.error(
+        withMessage: "FileSink: another destination already opened this file with a different configuration")
+    } catch LogWriterError.symlinkEscape {
+      throw RuntimeError.error(withMessage: "FileSink: the log path is a symbolic link")
+    } catch LogWriterError.stillClosing {
+      // Distinct from the others because it is the one worth retrying: a
+      // previous destination on this file has not finished shutting down, and
+      // opening a second writer alongside it is exactly what must not happen.
+      throw RuntimeError.error(
+        withMessage: "FileSink: the previous destination for this file is still closing")
+    } catch {
+      // Deliberately payload-free. An `errno` description or a path is exactly
+      // the kind of string that carries a username, and this message crosses
+      // into JavaScript where something will eventually log it.
+      throw RuntimeError.error(withMessage: "FileSink: could not open the log file")
+    }
+
+    lock.lock()
+    // A close that arrived mid-acquisition found nothing to hand back and has
+    // already returned. Installing now would leave a live writer holding a
+    // descriptor that nothing can reach or release.
+    let abandon = closePending
+    closePending = false
+    if !abandon { handle = acquired }
+    lock.unlock()
+
+    if abandon {
+      // Zero deadline: the caller has already been told this sink is closed.
+      _ = acquired.close(deadlineMs: 0)
+    }
+  }
+
+  func appendBatch(batch: String, entryCount: Double) throws -> AppendResult {
+    guard let handle = current() else {
+      return AppendResult(accepted: false, rejectReason: .closed,
+                          queuedBytes: 0, lostBytes: 0, lostEntries: 0, degraded: 0)
+    }
+    // Refused rather than rounded: an unchecked cast of NaN or 1e30 traps, and
+    // a count that does not survive the round trip cannot be trusted to
+    // describe the batch it arrived with.
+    guard entryCount.isFinite, let count = Int(exactly: entryCount) else {
+      return Self.appendResult(
+        LogAppendResult(accepted: false, rejectReason: .failed, status: handle.status()))
+    }
+    return Self.appendResult(handle.appendBatch(batch, entryCount: count))
+  }
+
+  func getStatus() throws -> SinkStatus {
+    guard let handle = current() else {
+      return SinkStatus(queuedBytes: 0, lostBytes: 0, lostEntries: 0, degraded: 0)
+    }
+    return Self.status(handle.status())
+  }
+
+  func flush(deadlineMs: Double) throws -> FlushOutcome {
+    guard let handle = current() else {
+      // Nothing was ever accepted through this sink, so "every accepted byte
+      // reached storage" holds vacuously. Reporting otherwise would have the
+      // JavaScript side retry a flush that can never have anything to do.
+      return Self.emptyOutcome()
+    }
+    return Self.flushOutcome(handle.flush(deadlineMs: deadlineMs))
+  }
+
+  func close(deadlineMs: Double) throws -> FlushOutcome {
+    lock.lock()
+    let live = handle
+    handle = nil
+    // Nothing to close, but an acquisition is in flight and will finish after
+    // this returns. Recording the intent is what keeps that writer from being
+    // installed into a sink the caller has already closed.
+    if live == nil && opening { closePending = true }
+    lock.unlock()
+
+    guard let live else { return Self.emptyOutcome() }
+    return Self.flushOutcome(live.close(deadlineMs: deadlineMs))
+  }
+
+  func getLogFilePaths() throws -> [String] {
+    current()?.logFilePaths() ?? []
+  }
+
+  func clearLogs(deadlineMs: Double) throws -> ClearOutcome {
+    // Both fields read in ONE critical section. Reading them separately lets a
+    // close land in between and produce "no handle, nothing created" — the one
+    // combination that is never true, and the one that lies in the direction
+    // that matters.
+    lock.lock()
+    let live = handle
+    let created = mayHaveArtifacts
+    lock.unlock()
+
+    guard let handle = live else {
+      // Nothing created: "every artifact is gone" holds vacuously. `rebound`
+      // stays false regardless — there is nothing to rebind onto, and saying
+      // otherwise would have the JS destination resume against a sink it never
+      // opened.
+      //
+      // Otherwise the files are still there and this object cannot reach them.
+      // The registry has the right answer for a released handle
+      // (`durable: false`, pinned by `testAReleasedHandleCannotPurge`) but
+      // `close` nils the handle above before that branch is reachable, so the
+      // honest answer has to be produced here.
+      return ClearOutcome(
+        deletedCount: 0, failedPaths: [], durable: !created, rebound: false)
+    }
+    let outcome = handle.clearLogs(deadlineMs: deadlineMs)
+    return ClearOutcome(
+      deletedCount: Double(outcome.deletedCount),
+      failedPaths: outcome.failedPaths,
+      durable: outcome.durable,
+      rebound: outcome.rebound
+    )
+  }
+
+  private func current() -> LogFileHandle? {
+    lock.lock()
+    defer { lock.unlock() }
+    return handle
+  }
+
+  // MARK: - Marshalling
+
+  /// Numbers arrive as `Double` because that is what JavaScript has. The
+  /// clamping lives in `LogRotationPolicy.init`, which is also where the Kotlin
+  /// side's equivalent has to agree with it.
+  private static func policy(from config: RotationConfig?) -> LogRotationPolicy {
+    guard let config else { return LogRotationPolicy() }
+    return LogRotationPolicy(
+      maxFileSizeBytes: config.maxFileSizeBytes,
+      maxArchivedFilesCount: config.maxArchivedFilesCount,
+      maxFileAgeSeconds: config.maxFileAgeSeconds,
+      compressArchives: config.compressArchives,
+      maxArchiveAgeSeconds: config.maxArchiveAgeSeconds,
+      maxTotalLogBytes: config.maxTotalLogBytes
+    )
+  }
+
+  private static func status(_ status: LogSinkStatus) -> SinkStatus {
+    SinkStatus(
+      queuedBytes: Double(status.queuedBytes),
+      lostBytes: Double(status.lostBytes),
+      lostEntries: Double(status.lostEntries),
+      degraded: Double(status.degraded)
+    )
+  }
+
+  private static func appendResult(_ result: LogAppendResult) -> AppendResult {
+    AppendResult(
+      accepted: result.accepted,
+      rejectReason: result.rejectReason.map(reason),
+      queuedBytes: Double(result.status.queuedBytes),
+      lostBytes: Double(result.status.lostBytes),
+      lostEntries: Double(result.status.lostEntries),
+      degraded: Double(result.status.degraded)
+    )
+  }
+
+  private static func flushOutcome(_ outcome: LogFlushOutcome) -> FlushOutcome {
+    FlushOutcome(
+      durable: outcome.durable,
+      timedOut: outcome.timedOut,
+      pendingBytes: Double(outcome.pendingBytes),
+      queuedBytes: Double(outcome.status.queuedBytes),
+      lostBytes: Double(outcome.status.lostBytes),
+      lostEntries: Double(outcome.status.lostEntries),
+      degraded: Double(outcome.status.degraded)
+    )
+  }
+
+  private static func emptyOutcome() -> FlushOutcome {
+    FlushOutcome(durable: true, timedOut: false, pendingBytes: 0,
+                 queuedBytes: 0, lostBytes: 0, lostEntries: 0, degraded: 0)
+  }
+
+  private static func reason(_ reason: LogRejectReason) -> RejectReason {
+    switch reason {
+    case .full: return .full
+    case .staleGeneration: return .stalegeneration
+    case .closed: return .closed
+    case .failed: return .failed
+    }
+  }
+}

package/ios/HybridNativeConsoleSink.swift

@@ -0,0 +1,20 @@
+import Foundation
+import NitroModules
+
+/// The Nitro end of the os_log sink: marshalling, and nothing else.
+///
+/// The level map and the chunking live in `NativeConsoleWriter`, which imports
+/// nothing from Nitro and therefore runs under XCTest. Anything that grows a
+/// decision in this file has been put in the wrong place — the same split the
+/// file sink uses, for the same reason.
+final class HybridNativeConsoleSink: HybridNativeConsoleSinkSpec {
+  private let writer = NativeConsoleWriter()
+
+  func install(subsystem: String, category: String) throws {
+    writer.install(subsystem: subsystem, category: category)
+  }
+
+  func logBatch(levels: [Double], messages: [String]) throws {
+    writer.logBatch(levels: levels, messages: messages)
+  }
+}