react-native-update 10.49.0 → 10.51.0

package/cpp/update_flow_core/tests/update_flow_core_test.cpp

@@ -0,0 +1,317 @@
+// Replays the golden vectors generated by scripts/generate-flow-vectors.ts
+// against the C++ port and compares canonical serializations. A mismatch
+// means the two implementations of the decision layer disagree — fix the C++
+// side (the TS side is the reference) or regenerate stale vectors.
+#include <cstdio>
+#include <fstream>
+#include <sstream>
+#include <string>
+
+#include "../flow_json.h"
+#include "../update_flow_core.h"
+
+using flowjson::Parse;
+using flowjson::Stringify;
+using flowjson::Value;
+
+namespace {
+
+Value Dispatch(const std::string& fn, const Value& args, bool* known) {
+  *known = true;
+  if (fn == "murmurhash3_32_gc") {
+    return Value::Number(updateflow::Murmur3_32(args.At(0).AsString()));
+  }
+  if (fn == "isInRollout") {
+    return Value::Bool(
+        updateflow::IsInRollout(args.At(0).AsNumber(), args.At(1).AsString()));
+  }
+  if (fn == "joinUrls") {
+    return updateflow::JoinUrls(args.At(0), args.At(1));
+  }
+  if (fn == "orderEndpointCandidates") {
+    return updateflow::OrderEndpointCandidates(args.At(0),
+                                               args.At(1).AsNumber());
+  }
+  if (fn == "buildCheckRequestBody") {
+    return updateflow::BuildCheckRequestBody(args.At(0));
+  }
+  if (fn == "resolveCheckResult") {
+    return updateflow::ResolveCheckResult(args.At(0), args.At(1));
+  }
+  if (fn == "decideDownload") {
+    return updateflow::DecideDownload(args.At(0), args.At(1),
+                                      args.At(2).Truthy());
+  }
+  if (fn == "shouldActivateAfterDownload") {
+    return Value::Bool(updateflow::ShouldActivateAfterDownload(
+        args.At(0), args.At(1).AsString()));
+  }
+  *known = false;
+  return Value::Undefined();
+}
+
+// The parser consumes network data (checkUpdate responses); malformed and
+// hostile inputs must set ok=false without crashing — this suite runs under
+// ASan+UBSan in CI. Valid-but-tricky inputs pin the JS JSON.parse semantics
+// the port relies on.
+int RunParserRobustness() {
+  int failures = 0;
+
+  const char* malformed[] = {
+      "",
+      "{",
+      "[1,2",
+      "\"abc",
+      "{\"a\":}",
+      "{\"a\" 1}",
+      "{\"a\":1,}",
+      "[1,]",
+      "tru",
+      "nul",
+      "falsy",
+      "1x",
+      "1 2",
+      "- 1",
+      "01",
+      "-01",
+      "1.",
+      "1e",
+      "1e+",
+      "\"\\q\"",
+      "\"\\u12\"",
+      "\"\\ud800\\u0041\"",  // high surrogate followed by a non-low escape
+      "{\"a\":1}garbage",
+      "[}",
+      "{]",
+  };
+  for (const char* input : malformed) {
+    bool ok = true;
+    Parse(input, &ok);
+    if (ok) {
+      std::fprintf(stderr, "robustness: accepted malformed input: %s\n", input);
+      failures++;
+    }
+  }
+
+  // Nesting: 64 levels parse, 65 are rejected (stack-depth cap).
+  for (int depth : {64, 65}) {
+    std::string nested;
+    for (int i = 0; i < depth; i++) {
+      nested.push_back('[');
+    }
+    for (int i = 0; i < depth; i++) {
+      nested.push_back(']');
+    }
+    bool ok = false;
+    Parse(nested, &ok);
+    bool expected = depth <= 64;
+    if (ok != expected) {
+      std::fprintf(stderr, "robustness: depth %d parsed=%d, expected %d\n",
+                   depth, ok, expected);
+      failures++;
+    }
+  }
+  // A deeply nested bomb must fail cleanly, not overflow the stack.
+  {
+    std::string bomb(100000, '[');
+    bool ok = true;
+    Parse(bomb, &ok);
+    if (ok) {
+      std::fprintf(stderr, "robustness: accepted nesting bomb\n");
+      failures++;
+    }
+  }
+
+  // Valid-but-tricky inputs: assert the parsed value via canonical stringify.
+  const struct {
+    const char* input;
+    const char* expected;
+  } tricky[] = {
+      // Duplicate keys: first position, last value (JSON.parse semantics).
+      {"{\"a\":1,\"b\":2,\"a\":3}", "{\"a\":3,\"b\":2}"},
+      {"\"\\u00e9\"", "\"\xc3\xa9\""},                    // BMP escape -> UTF-8
+      {"\"\\ud83d\\ude00\"", "\"\xf0\x9f\x98\x80\""},     // surrogate pair
+      {"  {  \"a\" : [ 1 , true , null ] }  ", "{\"a\":[1,true,null]}"},
+      {"-0.5", "-0.5"},
+      {"1e2", "100"},
+  };
+  for (const auto& t : tricky) {
+    bool ok = false;
+    Value v = Parse(t.input, &ok);
+    std::string actual = Stringify(v);
+    if (!ok || actual != t.expected) {
+      std::fprintf(stderr,
+                   "robustness: %s -> ok=%d %s (expected %s)\n", t.input, ok,
+                   actual.c_str(), t.expected);
+      failures++;
+    }
+  }
+
+  return failures;
+}
+
+// HandleCheckResponse is pure composition (no decision logic of its own), so
+// it is tested directly here instead of via TS-generated vectors: response
+// text in, canonical decision out.
+int RunHandleCheckResponse() {
+  int failures = 0;
+  Value identity = Value::Object();
+  identity.Set("packageVersion", Value::String("2.3.4"));
+  identity.Set("currentVersion", Value::String("cur"));
+  identity.Set("uuid", Value::String("test1"));  // bucket 62
+  identity.Set("rolledBackVersion", Value::String("bad"));
+
+  const struct {
+    const char* name;
+    const char* response;
+    const char* afterDownload;
+    const char* expected;
+  } cases[] = {
+      {"malformed", "not json{", "none",
+       "{\"action\":\"none\",\"reason\":\"invalidResponse\"}"},
+      {"non-object", "[1,2]", "none",
+       "{\"action\":\"none\",\"reason\":\"invalidResponse\"}"},
+      {"upToDate", "{\"upToDate\":true}", "none",
+       "{\"action\":\"none\",\"reason\":\"noUpdate\",\"info\":{\"upToDate\":"
+       "true}}"},
+      {"expired",
+       "{\"expired\":true,\"downloadUrl\":\"https://x/app.apk\"}", "none",
+       "{\"action\":\"none\",\"reason\":\"noUpdate\",\"info\":{\"expired\":"
+       "true,\"downloadUrl\":\"https://x/app.apk\"}}"},
+      {"alreadyCurrent",
+       "{\"update\":true,\"hash\":\"cur\",\"full\":\"cur.ppk\","
+       "\"paths\":[\"cdn.x.com\"]}",
+       "none",
+       "{\"action\":\"none\",\"reason\":\"noUpdate\",\"info\":{\"upToDate\":"
+       "true}}"},
+      {"download",
+       "{\"update\":true,\"hash\":\"h2\",\"full\":\"h2.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"name\":\"v2\"}",
+       "none",
+       "{\"action\":\"download\",\"hash\":\"h2\",\"attempts\":[{\"type\":"
+       "\"full\",\"urls\":[\"https://cdn.x.com/h2.ppk\"]}],\"devNoop\":false,"
+       "\"activate\":false,"
+       "\"info\":{\"update\":true,\"hash\":\"h2\",\"full\":\"h2.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"name\":\"v2\"}}"},
+      {"download-silent-strategy",
+       "{\"update\":true,\"hash\":\"h2\",\"full\":\"h2.ppk\","
+       "\"paths\":[\"cdn.x.com\"]}",
+       "setNeedUpdate",
+       "{\"action\":\"download\",\"hash\":\"h2\",\"attempts\":[{\"type\":"
+       "\"full\",\"urls\":[\"https://cdn.x.com/h2.ppk\"]}],\"devNoop\":false,"
+       "\"activate\":true,"
+       "\"info\":{\"update\":true,\"hash\":\"h2\",\"full\":\"h2.ppk\","
+       "\"paths\":[\"cdn.x.com\"]}}"},
+      {"download-forceBoot",
+       "{\"update\":true,\"hash\":\"h2\",\"full\":\"h2.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"config\":{\"forceBoot\":true}}",
+       "none",
+       "{\"action\":\"download\",\"hash\":\"h2\",\"attempts\":[{\"type\":"
+       "\"full\",\"urls\":[\"https://cdn.x.com/h2.ppk\"]}],\"devNoop\":false,"
+       "\"activate\":true,"
+       "\"info\":{\"update\":true,\"hash\":\"h2\",\"full\":\"h2.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"config\":{\"forceBoot\":true}}}"},
+      {"rollout-in-forceBoot",
+       "{\"update\":true,\"hash\":\"root\",\"full\":\"root.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"expVersion\":{\"name\":\"g\",\"hash\":"
+       "\"gray\",\"full\":\"gray.ppk\",\"config\":{\"rollout\":{\"2.3.4\":"
+       "63},\"forceBoot\":true}}}",
+       "none",
+       "{\"action\":\"download\",\"hash\":\"gray\",\"attempts\":[{\"type\":"
+       "\"full\",\"urls\":[\"https://cdn.x.com/gray.ppk\"]}],\"devNoop\":"
+       "false,\"activate\":true,"
+       "\"info\":{\"update\":true,\"name\":\"g\",\"hash\":\"gray\","
+       "\"full\":\"gray.ppk\",\"config\":{\"rollout\":{\"2.3.4\":63},"
+       "\"forceBoot\":true},\"paths\":[\"cdn.x.com\"]}}"},
+      {"rollout-out",
+       "{\"update\":true,\"hash\":\"root\",\"full\":\"root.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"expVersion\":{\"name\":\"g\",\"hash\":"
+       "\"gray\",\"full\":\"gray.ppk\",\"config\":{\"rollout\":{\"2.3.4\":"
+       "62}}}}",
+       "none",
+       "{\"action\":\"download\",\"hash\":\"root\",\"attempts\":[{\"type\":"
+       "\"full\",\"urls\":[\"https://cdn.x.com/root.ppk\"]}],\"devNoop\":"
+       "false,\"activate\":false,\"info\":{\"update\":true,\"hash\":\"root\","
+       "\"full\":\"root.ppk\",\"paths\":[\"cdn.x.com\"]}}"},
+      {"rolledBack-wins-over-forceBoot",
+       "{\"update\":true,\"hash\":\"bad\",\"full\":\"bad.ppk\","
+       "\"paths\":[\"cdn.x.com\"],\"config\":{\"forceBoot\":true}}",
+       "none",
+       "{\"action\":\"none\",\"reason\":\"rolledBack\",\"info\":{\"update\":"
+       "true,\"hash\":\"bad\",\"full\":\"bad.ppk\",\"paths\":[\"cdn.x.com\"],"
+       "\"config\":{\"forceBoot\":true}}}"},
+  };
+  for (const auto& c : cases) {
+    Value decision = updateflow::HandleCheckResponse(c.response, identity,
+                                                     false, c.afterDownload);
+    std::string actual = Stringify(decision);
+    if (actual != c.expected) {
+      std::fprintf(stderr,
+                   "handleCheckResponse %s MISMATCH\n  expected: %s\n"
+                   "  actual:   %s\n",
+                   c.name, c.expected, actual.c_str());
+      failures++;
+    }
+  }
+  return failures;
+}
+
+}  // namespace
+
+int main(int argc, char* argv[]) {
+  if (argc < 2) {
+    std::fprintf(stderr, "usage: %s <flow_vectors.json>\n", argv[0]);
+    return 2;
+  }
+  std::ifstream file(argv[1]);
+  if (!file) {
+    std::fprintf(stderr, "cannot open %s\n", argv[1]);
+    return 2;
+  }
+  std::stringstream buffer;
+  buffer << file.rdbuf();
+
+  bool ok = false;
+  Value doc = Parse(buffer.str(), &ok);
+  if (!ok) {
+    std::fprintf(stderr, "failed to parse %s\n", argv[1]);
+    return 2;
+  }
+
+  const Value& cases = doc.Get("cases");
+  if (!cases.IsArray() || cases.Size() == 0) {
+    std::fprintf(stderr, "%s must contain a non-empty cases array\n", argv[1]);
+    return 2;
+  }
+  int failures = RunParserRobustness() + RunHandleCheckResponse();
+  for (size_t i = 0; i < cases.Size(); i++) {
+    const Value& testCase = cases.At(i);
+    const std::string& fn = testCase.Get("fn").AsString();
+    bool known = false;
+    Value actual = Dispatch(fn, testCase.Get("args"), &known);
+    if (!known) {
+      std::fprintf(stderr, "case %zu: unknown fn %s\n", i, fn.c_str());
+      failures++;
+      continue;
+    }
+    std::string actualStr = Stringify(actual);
+    std::string expectedStr = Stringify(testCase.Get("expected"));
+    if (actualStr != expectedStr) {
+      std::fprintf(stderr,
+                   "case %zu (%s) MISMATCH\n  args:     %s\n  expected: %s\n"
+                   "  actual:   %s\n",
+                   i, fn.c_str(), Stringify(testCase.Get("args")).c_str(),
+                   expectedStr.c_str(), actualStr.c_str());
+      failures++;
+    }
+  }
+
+  if (failures) {
+    std::fprintf(stderr, "%d failures (%zu vectors + parser robustness)\n",
+                 failures, cases.Size());
+    return 1;
+  }
+  std::printf("all %zu flow vectors + parser robustness passed\n",
+              cases.Size());
+  return 0;
+}

package/cpp/update_flow_core/update_flow_core.cpp

@@ -0,0 +1,301 @@
+#include "update_flow_core.h"
+
+#include <cmath>
+
+namespace updateflow {
+
+using flowjson::Value;
+
+uint32_t Murmur3_32(const std::string& key, uint32_t seed) {
+  // The TS reference emulates 32-bit multiplication with 16-bit halves;
+  // native uint32_t arithmetic is exactly (x * y) mod 2^32, so the halved
+  // dance collapses to plain multiplies. Bytes are read as charCodeAt & 0xff,
+  // which is identical for the ASCII inputs this layer handles (uuids, keys).
+  const uint32_t c1 = 0xcc9e2d51;
+  const uint32_t c2 = 0x1b873593;
+  const size_t len = key.size();
+  const size_t nblocks = len / 4;
+  uint32_t h1 = seed;
+
+  const unsigned char* data =
+      reinterpret_cast<const unsigned char*>(key.data());
+  for (size_t i = 0; i < nblocks; i++) {
+    uint32_t k1 = static_cast<uint32_t>(data[i * 4]) |
+                  (static_cast<uint32_t>(data[i * 4 + 1]) << 8) |
+                  (static_cast<uint32_t>(data[i * 4 + 2]) << 16) |
+                  (static_cast<uint32_t>(data[i * 4 + 3]) << 24);
+    k1 *= c1;
+    k1 = (k1 << 15) | (k1 >> 17);
+    k1 *= c2;
+    h1 ^= k1;
+    h1 = (h1 << 13) | (h1 >> 19);
+    h1 = h1 * 5 + 0xe6546b64;
+  }
+
+  uint32_t k1 = 0;
+  const unsigned char* tail = data + nblocks * 4;
+  switch (len & 3) {
+    case 3:
+      k1 ^= static_cast<uint32_t>(tail[2]) << 16;
+      [[fallthrough]];
+    case 2:
+      k1 ^= static_cast<uint32_t>(tail[1]) << 8;
+      [[fallthrough]];
+    case 1:
+      k1 ^= tail[0];
+      k1 *= c1;
+      k1 = (k1 << 15) | (k1 >> 17);
+      k1 *= c2;
+      h1 ^= k1;
+  }
+
+  h1 ^= static_cast<uint32_t>(len);
+  h1 ^= h1 >> 16;
+  h1 *= 0x85ebca6b;
+  h1 ^= h1 >> 13;
+  h1 *= 0xc2b2ae35;
+  h1 ^= h1 >> 16;
+  return h1;
+}
+
+bool IsInRollout(double rollout, const std::string& uuid) {
+  return static_cast<double>(Murmur3_32(uuid) % 100) < rollout;
+}
+
+namespace {
+
+// ^[a-z][a-z0-9+.-]*:\/\/ (case-insensitive)
+bool HasExplicitScheme(const std::string& s) {
+  size_t i = 0;
+  auto isAlpha = [](char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
+  };
+  if (i >= s.size() || !isAlpha(s[i])) {
+    return false;
+  }
+  i++;
+  while (i < s.size()) {
+    char c = s[i];
+    if (isAlpha(c) || (c >= '0' && c <= '9') || c == '+' || c == '.' ||
+        c == '-') {
+      i++;
+    } else {
+      break;
+    }
+  }
+  return s.compare(i, 3, "://") == 0;
+}
+
+}  // namespace
+
+Value JoinUrls(const Value& paths, const Value& fileName) {
+  if (!fileName.Truthy()) {
+    return Value::Undefined();
+  }
+  Value urls = Value::Array();
+  for (const auto& path : paths.elements()) {
+    std::string normalized = path.AsString();
+    while (!normalized.empty() && normalized.back() == '/') {
+      normalized.pop_back();
+    }
+    std::string base = HasExplicitScheme(normalized)
+                           ? normalized
+                           : "https://" + normalized;
+    urls.Push(Value::String(base + "/" + fileName.AsString()));
+  }
+  return urls;
+}
+
+Value OrderEndpointCandidates(const Value& endpoints, double randomSample) {
+  Value deduped = Value::Array();
+  for (const auto& endpoint : endpoints.elements()) {
+    if (!endpoint.Truthy()) {
+      continue;
+    }
+    bool seen = false;
+    for (const auto& kept : deduped.elements()) {
+      if (kept.AsString() == endpoint.AsString()) {
+        seen = true;
+        break;
+      }
+    }
+    if (!seen) {
+      deduped.Push(endpoint);
+    }
+  }
+  const size_t n = deduped.Size();
+  if (n < 2) {
+    return deduped;
+  }
+  const double idx = std::isfinite(randomSample)
+                         ? std::floor(randomSample * static_cast<double>(n))
+                         : 0;
+  // Validate in floating-point space before converting to size_t: converting
+  // NaN, infinity, or an out-of-range value is undefined behavior in C++.
+  const size_t first = idx <= 0 ? 0
+                                : (idx >= static_cast<double>(n - 1)
+                                       ? n - 1
+                                       : static_cast<size_t>(idx));
+  Value ordered = Value::Array();
+  ordered.Push(deduped.At(first));
+  for (size_t i = 0; i < n; i++) {
+    if (i != first) {
+      ordered.Push(deduped.At(i));
+    }
+  }
+  return ordered;
+}
+
+Value BuildCheckRequestBody(const Value& input) {
+  Value body = Value::Object();
+  body.Set("packageVersion", input.Get("packageVersion"));
+  body.Set("hash", input.Get("currentVersion"));
+  body.Set("buildTime", input.Get("buildTime"));
+  body.Set("cInfo", input.Get("cInfo"));
+  const Value& diffV = input.Get("supportedDiffVersion");
+  if (diffV.Truthy()) {
+    body.Set("diffV", diffV);
+  }
+  const Value& bundleHash = input.Get("bundleHash");
+  if (bundleHash.Truthy()) {
+    body.Set("bundleHash", bundleHash);
+  }
+  const Value& extra = input.Get("extra");
+  if (extra.IsObject()) {
+    for (const auto& member : extra.members()) {
+      body.Set(member.first, member.second);
+    }
+  }
+  if (input.Get("isDev").Truthy()) {
+    body.Remove("buildTime");
+  }
+  return body;
+}
+
+Value ResolveCheckResult(const Value& rootInfo, const Value& identity) {
+  Value rootResult = Value::Object();
+  for (const auto& member : rootInfo.members()) {
+    if (member.first != "expVersion") {
+      rootResult.Set(member.first, member.second);
+    }
+  }
+  const Value& expVersion = rootInfo.Get("expVersion");
+  const Value& currentVersion = identity.Get("currentVersion");
+  // expVersion?.config?.rollout?.[identity.packageVersion] — Get on a
+  // non-object returns Undefined, mirroring optional chaining.
+  const Value& rollout = expVersion.Get("config").Get("rollout").Get(
+      identity.Get("packageVersion").AsString());
+  if (rootResult.Get("update").Truthy() && expVersion.Truthy() &&
+      rollout.IsNumber()) {
+    if (IsInRollout(rollout.AsNumber(), identity.Get("uuid").AsString())) {
+      const Value& expHash = expVersion.Get("hash");
+      if (expHash.IsString() && !expHash.AsString().empty() &&
+          Value::StrictEquals(expHash, currentVersion)) {
+        Value upToDate = Value::Object();
+        upToDate.Set("upToDate", Value::Bool(true));
+        return upToDate;
+      }
+      Value info = Value::Object();
+      info.Set("update", Value::Bool(true));
+      for (const auto& member : expVersion.members()) {
+        info.Set(member.first, member.second);
+      }
+      if (rootResult.Get("paths").Truthy()) {
+        info.Set("paths", rootResult.Get("paths"));
+      }
+      return info;
+    }
+  }
+  const Value& rootHash = rootResult.Get("hash");
+  if (rootResult.Get("update").Truthy() && rootHash.IsString() &&
+      !rootHash.AsString().empty() &&
+      Value::StrictEquals(rootHash, currentVersion)) {
+    Value upToDate = Value::Object();
+    upToDate.Set("upToDate", Value::Bool(true));
+    return upToDate;
+  }
+  return rootResult;
+}
+
+namespace {
+
+Value DeclineDownload(const char* reason) {
+  Value none = Value::Object();
+  none.Set("action", Value::String("none"));
+  none.Set("reason", Value::String(reason));
+  return none;
+}
+
+}  // namespace
+
+Value DecideDownload(const Value& info, const Value& identity, bool isDev) {
+  const Value& hash = info.Get("hash");
+  Value paths = info.Get("paths");
+  if (paths.IsUndefined()) {
+    paths = Value::Array();  // const { paths = [] } — undefined only
+  }
+  if (!info.Get("update").Truthy() || !hash.Truthy()) {
+    return DeclineDownload("noUpdate");
+  }
+  if (Value::StrictEquals(hash, identity.Get("currentVersion"))) {
+    return DeclineDownload("alreadyCurrent");
+  }
+  const Value& rolledBack = identity.Get("rolledBackVersion");
+  if (rolledBack.Truthy() && Value::StrictEquals(hash, rolledBack)) {
+    return DeclineDownload("rolledBack");
+  }
+  Value attempts = Value::Array();
+  auto pushAttempt = [&attempts](const char* type, const Value& urls) {
+    if (urls.IsArray() && urls.Size() > 0) {
+      Value attempt = Value::Object();
+      attempt.Set("type", Value::String(type));
+      attempt.Set("urls", urls);
+      attempts.Push(std::move(attempt));
+    }
+  };
+  if (!isDev) {
+    pushAttempt("diff", JoinUrls(paths, info.Get("diff")));
+    pushAttempt("pdiff", JoinUrls(paths, info.Get("pdiff")));
+  }
+  Value fullUrls = JoinUrls(paths, info.Get("full"));
+  pushAttempt("full", fullUrls);
+
+  const bool devNoop =
+      isDev && !(fullUrls.IsArray() && fullUrls.Size() > 0);
+  if (attempts.Size() == 0 && !devNoop) {
+    return DeclineDownload("noArtifact");
+  }
+
+  Value decision = Value::Object();
+  decision.Set("action", Value::String("download"));
+  decision.Set("hash", hash);
+  decision.Set("attempts", std::move(attempts));
+  decision.Set("devNoop", Value::Bool(devNoop));
+  return decision;
+}
+
+bool ShouldActivateAfterDownload(const Value& info,
+                                 const std::string& afterDownload) {
+  return afterDownload == "setNeedUpdate" ||
+         info.Get("config").Get("forceBoot").Truthy();
+}
+
+Value HandleCheckResponse(const std::string& responseText,
+                          const Value& identity, bool isDev,
+                          const std::string& afterDownload) {
+  bool ok = false;
+  Value root = flowjson::Parse(responseText, &ok);
+  if (!ok || !root.IsObject()) {
+    return DeclineDownload("invalidResponse");
+  }
+  Value resolved = ResolveCheckResult(root, identity);
+  Value decision = DecideDownload(resolved, identity, isDev);
+  if (decision.Get("action").AsString() == "download") {
+    decision.Set("activate", Value::Bool(ShouldActivateAfterDownload(
+                                 resolved, afterDownload)));
+  }
+  decision.Set("info", std::move(resolved));
+  return decision;
+}
+
+}  // namespace updateflow

package/cpp/update_flow_core/update_flow_core.h

@@ -0,0 +1,77 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+#include "flow_json.h"
+
+// C++ port of the update-flow decision layer.
+//
+// src/updateFlowCore.ts is the REFERENCE implementation: every function here
+// mirrors its TS counterpart 1:1, including object key order and JS
+// truthiness/strict-equality semantics, because parity is enforced by golden
+// vectors (tests/flow_vectors.json, generated from the TS side). Any semantic
+// change lands in the TS file first, regenerates the vectors, then gets
+// ported here — never the other direction.
+//
+// Like the TS side this layer is pure: no IO, no time, no randomness — the
+// random sample, identity and parsed JSON all arrive as parameters. The
+// orchestrators (per-platform HTTP/download/state glue) own all effects.
+namespace updateflow {
+
+uint32_t Murmur3_32(const std::string& key, uint32_t seed = 0);
+
+// murmur(uuid) % 100 < rollout — the gray-release bucketing predicate.
+bool IsInRollout(double rollout, const std::string& uuid);
+
+// paths × fileName -> candidate URL array; Undefined when fileName is falsy
+// (mirrors joinUrls returning undefined without a file name).
+flowjson::Value JoinUrls(const flowjson::Value& paths,
+                         const flowjson::Value& fileName);
+
+// Dedupe + move the sampled pick to the front, rest in configured order.
+// randomSample ∈ [0, 1) is injected by the caller.
+flowjson::Value OrderEndpointCandidates(const flowjson::Value& endpoints,
+                                        double randomSample);
+
+// input: { packageVersion, currentVersion, buildTime, cInfo,
+//          supportedDiffVersion?, bundleHash?, isDev?, extra? }
+flowjson::Value BuildCheckRequestBody(const flowjson::Value& input);
+
+// identity: { packageVersion, currentVersion?, uuid }
+flowjson::Value ResolveCheckResult(const flowjson::Value& rootInfo,
+                                   const flowjson::Value& identity);
+
+// identity: { currentVersion?, rolledBackVersion? }
+// -> { action: 'none', reason } | { action: 'download', hash, attempts,
+//      devNoop }
+flowjson::Value DecideDownload(const flowjson::Value& info,
+                               const flowjson::Value& identity, bool isDev);
+
+// Whether the orchestrator should activate a downloaded version for the
+// next launch: the client's silent strategies opt in locally
+// (afterDownload == "setNeedUpdate"), or the server marks the version
+// config.forceBoot — the per-version remote override that closes the
+// brick-rescue gap for alert-strategy apps (a bricked device never runs
+// JS, so activation cannot wait for it). Native-only; the device-local
+// rolledBackVersion guard in DecideDownload still wins, and the activated
+// version keeps the first_time crash-protection rollback.
+bool ShouldActivateAfterDownload(const flowjson::Value& info,
+                                 const std::string& afterDownload);
+
+// Composes Parse → ResolveCheckResult → DecideDownload: one call from the
+// raw checkUpdate response text to a download decision, so the platform
+// orchestrators contain no decision logic at all. identity is the union of
+// both composed functions' needs: { packageVersion, currentVersion?, uuid,
+// rolledBackVersion? }. afterDownload is the client's persisted activation
+// policy; a download decision carries `activate` (ShouldActivateAfterDownload
+// folded over it and the version's forceBoot) plus `info` — the resolved
+// check result — so orchestrators can persist name/description/metaInfo
+// alongside a downloaded version (the JS side's setLocalHashInfo).
+// Malformed JSON yields { action: 'none', reason: 'invalidResponse' }.
+flowjson::Value HandleCheckResponse(const std::string& responseText,
+                                    const flowjson::Value& identity,
+                                    bool isDev,
+                                    const std::string& afterDownload);
+
+}  // namespace updateflow