react-native-update 10.59.1 → 10.60.0

package/cpp/android_jni/archive_limits_jni.cpp

@@ -0,0 +1,83 @@
+// JNI glue of ArchiveLimits.java over the shared extraction accounting
+// (cpp/patch_core/archive_limits.h).
+#include <jni.h>
+
+#include <string>
+#include <vector>
+
+#include "jni_natives.h"
+#include "jni_util.h"
+#include "../patch_core/archive_limits.h"
+
+namespace {
+
+using pushy::jni_util::GuardJni;
+using pushy::jni_util::JArrayToVector;
+using pushy::jni_util::ThrowRuntimeException;
+
+void ThrowIOException(JNIEnv* env, const std::string& message) {
+  jclass exception = env->FindClass("java/io/IOException");
+  if (exception != nullptr) {
+    env->ThrowNew(exception, message.c_str());
+  }
+}
+
+}  // namespace
+
+// One call per archive: the central directory's names and declared sizes
+// through an EntryAccumulator. Returns the total uncompressed size, or throws
+// an IOException with the first violation.
+jlong pushy::jni_natives::ArchiveCheckEntries(
+    JNIEnv* env, jclass, jlong archive_bytes, jobjectArray names,
+    jlongArray sizes, jlongArray compressed_sizes) {
+  return GuardJni(
+      env, "Unexpected native exception while checking an archive", [&]() -> jlong {
+    const jsize count = names == nullptr ? 0 : env->GetArrayLength(names);
+    if (sizes == nullptr || compressed_sizes == nullptr ||
+        env->GetArrayLength(sizes) != count ||
+        env->GetArrayLength(compressed_sizes) != count) {
+      ThrowRuntimeException(env, "archive entry arrays differ in length");
+      return 0;
+    }
+    // Before any name is copied: a hostile central directory may list far
+    // more entries than the cap.
+    pushy::delta::Status status = pushy::archive_limits::CheckEntryCount(count);
+    if (!status.ok) {
+      ThrowIOException(env, status.message);
+      return 0;
+    }
+    const std::vector<std::string> entry_names = JArrayToVector(env, names);
+    std::vector<jlong> size_values(static_cast<size_t>(count));
+    std::vector<jlong> compressed_values(static_cast<size_t>(count));
+    if (count > 0) {
+      env->GetLongArrayRegion(sizes, 0, count, size_values.data());
+      env->GetLongArrayRegion(compressed_sizes, 0, count, compressed_values.data());
+    }
+    pushy::archive_limits::EntryAccumulator accumulator(archive_bytes);
+    for (jsize i = 0; i < count; i++) {
+      status = accumulator.Accept(size_values[i], compressed_values[i], false,
+                                  entry_names[i]);
+      if (!status.ok) {
+        ThrowIOException(env, status.message);
+        return 0;
+      }
+    }
+    return accumulator.total_uncompressed();
+  });
+}
+
+// {bytes to probe for (0: no probe), reservation end} before one chunk of a
+// download is written.
+jlongArray pushy::jni_natives::ArchivePlanFreeSpaceProbe(
+    JNIEnv* env, jclass, jlong known_total, jlong written_before,
+    jlong chunk_bytes, jlong reserved_until) {
+  const pushy::archive_limits::FreeSpaceProbe plan =
+      pushy::archive_limits::PlanUnknownLengthFreeSpaceProbe(
+          known_total, written_before, chunk_bytes, reserved_until);
+  jlongArray result = env->NewLongArray(2);
+  if (result != nullptr) {
+    const jlong values[2] = {plan.probe ? plan.reserve : 0, plan.reserved_until};
+    env->SetLongArrayRegion(result, 0, 2, values);
+  }
+  return result;
+}

package/cpp/android_jni/install_record_jni.cpp

@@ -0,0 +1,89 @@
+// JNI glue of InstallRecord.java over the shared completion record core
+// (cpp/patch_core/install_record.h). The jstring-returning natives return
+// null on success and the reason otherwise; Java turns a reason into an
+// IOException.
+#include <jni.h>
+
+#include <string>
+
+#include "jni_natives.h"
+#include "jni_util.h"
+#include "../patch_core/install_record.h"
+
+namespace {
+
+using pushy::jni_util::GuardJni;
+using pushy::jni_util::JStringToString;
+using pushy::jni_util::ToJString;
+
+jstring ReasonOrNull(JNIEnv* env, const pushy::delta::Status& status) {
+  return status.ok ? nullptr : ToJString(env, status.message);
+}
+
+}  // namespace
+
+jboolean pushy::jni_natives::InstallRecordIsComplete(
+    JNIEnv* env, jclass, jstring version_dir, jstring version_hash,
+    jstring bundle_file_name) {
+  return GuardJni(
+      env, "Unexpected native exception while reading a completion record", [&] {
+    return pushy::install_record::IsComplete(
+               JStringToString(env, version_dir),
+               JStringToString(env, version_hash),
+               JStringToString(env, bundle_file_name))
+               ? JNI_TRUE
+               : JNI_FALSE;
+  });
+}
+
+// Hashes the whole bundle: called from worker threads only.
+jstring pushy::jni_natives::InstallRecordCheckActivation(
+    JNIEnv* env, jclass, jstring version_dir, jstring version_hash,
+    jstring bundle_file_name, jboolean grandfathered) {
+  return GuardJni(
+      env, "Unexpected native exception while verifying a version", [&] {
+    pushy::install_record::Activation activation;
+    return ReasonOrNull(
+        env, pushy::install_record::CheckActivation(
+                 JStringToString(env, version_dir),
+                 JStringToString(env, version_hash),
+                 JStringToString(env, bundle_file_name),
+                 grandfathered == JNI_TRUE, &activation));
+  });
+}
+
+jstring pushy::jni_natives::InstallRecordSeal(
+    JNIEnv* env, jclass, jstring staging_dir, jstring version_hash,
+    jstring bundle_file_name, jstring artifact_sha256,
+    jstring known_bundle_sha256) {
+  return GuardJni(
+      env, "Unexpected native exception while writing a completion record", [&] {
+    return ReasonOrNull(
+        env, pushy::install_record::Seal(
+                 JStringToString(env, staging_dir),
+                 JStringToString(env, version_hash),
+                 JStringToString(env, bundle_file_name),
+                 JStringToString(env, artifact_sha256),
+                 JStringToString(env, known_bundle_sha256))
+                 .status);
+  });
+}
+
+jstring pushy::jni_natives::InstallRecordPromote(
+    JNIEnv* env, jclass, jstring staging_dir, jstring version_dir) {
+  return GuardJni(
+      env, "Unexpected native exception while moving a staged version", [&] {
+    return ReasonOrNull(
+        env, pushy::install_record::Promote(JStringToString(env, staging_dir),
+                                            JStringToString(env, version_dir)));
+  });
+}
+
+jstring pushy::jni_natives::InstallRecordBundleSha256(
+    JNIEnv* env, jclass, jstring version_dir) {
+  return GuardJni(
+      env, "Unexpected native exception while reading a completion record", [&] {
+    return ToJString(env, pushy::install_record::RecordedBundleSha256(
+                              JStringToString(env, version_dir)));
+  });
+}

package/cpp/android_jni/jni_log.h

@@ -0,0 +1,31 @@
+#ifndef PUSHY_ANDROID_JNI_LOG_H_
+#define PUSHY_ANDROID_JNI_LOG_H_
+
+#include <android/log.h>
+
+#include "../patch_core/obscured_text.h"
+
+// Keep the core internal to whichever binary links it (see podspec Core).
+#pragma GCC visibility push(hidden)
+
+namespace pushy {
+namespace jni_log {
+
+// Same logcat tag as the Java layer (Texts.LOG_TAG), stored encoded.
+inline const char* Tag() {
+  static const char* const tag =
+      text::RevealStatic("2812f5d2bac6664436360afc9ba680694b3301");
+  return tag;
+}
+
+}  // namespace jni_log
+}  // namespace pushy
+
+#pragma GCC visibility pop
+
+// Error-level logcat line under the SDK's tag. For JNI binding failures that
+// would otherwise be swallowed: they must be visible in release builds.
+#define PUSHY_JNI_LOGE(...) \
+  __android_log_print(ANDROID_LOG_ERROR, ::pushy::jni_log::Tag(), __VA_ARGS__)
+
+#endif  // PUSHY_ANDROID_JNI_LOG_H_

package/cpp/android_jni/jni_natives.h

@@ -0,0 +1,40 @@
+#ifndef PUSHY_ANDROID_JNI_NATIVES_H_
+#define PUSHY_ANDROID_JNI_NATIVES_H_
+
+#include <jni.h>
+
+// Android native methods. They are registered by name from JNI_OnLoad
+// (jni_registration.cpp) instead of being exported as Java_* symbols, so the
+// shared library's dynamic symbol table carries no class or method names.
+namespace pushy {
+namespace jni_natives {
+
+// Called once from JNI_OnLoad: caches the JNI result classes (global refs),
+// their constructors and field IDs. Returns false (after logging what is
+// missing) when any lookup failed; the natives that need the missing class
+// then throw a RuntimeException instead of defaulting fields.
+bool InitResultClassCache(JNIEnv* env);
+
+jint SupportedDiffVersion(JNIEnv*, jclass);
+jobject SyncStateWithBinaryVersion(JNIEnv* env, jclass, jstring package_version, jstring build_time, jobject state_result);
+jobject RunStateCore(JNIEnv* env, jclass, jint operation, jobject state_result, jstring string_arg, jboolean flag_a, jboolean flag_b);
+jobjectArray ApplyArchiveDelta(JNIEnv* env, jclass, jint patch_type, jobjectArray entry_names, jbyteArray manifest_json, jstring source_root, jstring target_root, jstring origin_bundle_path, jstring bundle_patch_path, jstring bundle_output_path, jboolean host_copies_resources);
+void CleanupOldEntries(JNIEnv* env, jclass, jstring root_dir, jobjectArray keep_names, jint max_age_days, jstring trash_dir);
+jstring FlowPrepareRound(JNIEnv* env, jclass, jstring configJson, jstring envJson, jdouble randomSample);
+jstring FlowNextQueryStep(JNIEnv* env, jclass, jstring stateJson, jstring responseText);
+jstring FlowHandleResponse(JNIEnv* env, jclass, jstring responseText, jstring configJson, jstring envJson, jstring requestBody, jlong responseAtSeconds);
+jboolean FlowConfigsEquivalent(JNIEnv* env, jclass, jstring a, jstring b);
+jstring FlowRunnableConfig(JNIEnv* env, jclass, jstring configJson);
+jstring FlowNormalizeConfiguration(JNIEnv* env, jclass, jstring optionsJson);
+jboolean InstallRecordIsComplete(JNIEnv* env, jclass, jstring version_dir, jstring version_hash, jstring bundle_file_name);
+jstring InstallRecordCheckActivation(JNIEnv* env, jclass, jstring version_dir, jstring version_hash, jstring bundle_file_name, jboolean grandfathered);
+jstring InstallRecordSeal(JNIEnv* env, jclass, jstring staging_dir, jstring version_hash, jstring bundle_file_name, jstring artifact_sha256, jstring known_bundle_sha256);
+jstring InstallRecordPromote(JNIEnv* env, jclass, jstring staging_dir, jstring version_dir);
+jstring InstallRecordBundleSha256(JNIEnv* env, jclass, jstring version_dir);
+jlong ArchiveCheckEntries(JNIEnv* env, jclass, jlong archive_bytes, jobjectArray names, jlongArray sizes, jlongArray compressed_sizes);
+jlongArray ArchivePlanFreeSpaceProbe(JNIEnv* env, jclass, jlong known_total, jlong written_before, jlong chunk_bytes, jlong reserved_until);
+
+}  // namespace jni_natives
+}  // namespace pushy
+
+#endif  // PUSHY_ANDROID_JNI_NATIVES_H_

package/cpp/android_jni/jni_registration.cpp

@@ -0,0 +1,133 @@
+// Registers the Android native methods from JNI_OnLoad instead of exporting
+// Java_<package>_<class>_<method> symbols: the shared library then exports only
+// JNI_OnLoad, and the class names, method names and signatures used for
+// registration are stored encoded (obscured_text.h,
+// scripts/encode-native-text.ts). Regenerate the table when a native method
+// is added or its Java signature changes.
+#include <jni.h>
+
+#include <string>
+#include <vector>
+
+#include "jni_log.h"
+#include "jni_natives.h"
+#include "../patch_core/obscured_text.h"
+
+namespace {
+
+struct NativeMethod {
+  const char* name;
+  const char* signature;
+  void* function;
+};
+
+struct NativeClass {
+  const char* name;
+  std::vector<NativeMethod> methods;
+};
+
+const std::vector<NativeClass>& NativeClasses() {
+  static const std::vector<NativeClass> classes = {
+  {"3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c8ebc8e7e42342de4daa0",  // NativeCore
+   {
+       {"3d12e0e2bb9b784a302b19fdf2ba966b7c2216f2f7d4b6", "725edd",
+        reinterpret_cast<void*>(&pushy::jni_natives::SupportedDiffVersion)},
+   }},
+  {"3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c95ad9e7640342de4c6b1878768",  // UpdateContext
+   {
+       {"290efad29d9f6951270815edde9199634b351dd7fbc9ab9c7d41", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655c7cbabcd8d79583507feccbe8e7244113617f1c7a3897a09361019fbc3b1de5d5f2911e7dcd3ab9341553e1febd0faf7b77b5b7d1de9c8a5976e7c4e3e02f481a687615753390ab9c6a0896b53214e2defd9a1974c433b03d1c5ceaf9b600a",
+        reinterpret_cast<void*>(&pushy::jni_natives::SyncStateWithBinaryVersion)},
+       {"2802fae2ba8a7c4001300efc", "723ed8d2a0c47a40233c08f7d7a7997b4f6809eefaceb49061003919e2c2b4b8d54440301aeeebaa909a4e5c2506fcd9f1ab6e40483a57f9d3a18b2675371214f4d0efab54020406ecb0cebc977044230bf3cdb7bbd4755a361ae0ccb5cc756d5e3600f481989c64565a1f16e4d682887952281545",
+        reinterpret_cast<void*>(&pushy::jni_natives::RunStateCore)},
+   }},
+  {"3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c84b28d79583e0feffca49194",  // DownloadTask
+   {
+       {"3b07e4ddb7aa7a462a360afcf2b69c794b", "723ecffda48a7e446d331df7d1fca379582e0ae6a5e09ab9784e3a08a9cfa1b39d3867251ce2c6a2d9b376582012bfc1ab89630e6d2f0afcdca8d7454c22161cb5dbb59f69041b11f0f6d2becd5f5a2c1ce68badbf957f1a011bfec0a8843b51503602f081a7896b45100f0de4dabe8a317d6d3a32f8d6fa806a4d2a12edc1c9b381711e2304ecd0aeba8f36432314ecdea2cb42714b2132e0c0b9995446332816e38f",
+        reinterpret_cast<void*>(&pushy::jni_natives::ApplyArchiveDelta)},
+       {"391bf1d0a09e786a2e3b39f7c2a1996859", "723bfed0b88a274923311bb6e5a7826444205fdad2d1b98373002008e8c4ef8e8e655d3f09b0e189889e6a58791ff1c3adc857554c3216f289e6ba",
+        reinterpret_cast<void*>(&pushy::jni_natives::CleanupOldEntries)},
+   }},
+  {"3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c86b19560762307efcfa0",  // FlowBridge
+   {
+       {"2a05f1c1af996d772d2a12fd", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655cf8189889e6a58791ff1c3adc857554c3216f289",
+        reinterpret_cast<void*>(&pushy::jni_natives::FlowPrepareRound)},
+       {"3412ecc59f9e6d573b0c08fcc6", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655a2e4af83897d163a12fecae5b4705357351fae",
+        reinterpret_cast<void*>(&pushy::jni_natives::FlowNextQueryStep)},
+       {"3216fad5a28e5a40312f13f7c5b6", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655c7c2a4949e3355371df78299937648503c43d9d8ae9a68092f0113fd9887857c422602b9d595959c72462c45ebc5afb9d44b412006e2cefd",
+        reinterpret_cast<void*>(&pushy::jni_natives::FlowHandleResponse)},
+       {"3918fad7a78c7b60332a15efd7bf95635e", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655a2f2",
+        reinterpret_cast<void*>(&pushy::jni_natives::FlowConfigsEquivalent)},
+       {"2802fadfaf896440013012ffdfb4", "723bfed0b88a274923311bb6e5a7826444205fa8d2d1b98373002008e8c4ef8e8e655d3f09b0",
+        reinterpret_cast<void*>(&pushy::jni_natives::FlowRunnableConfig)},
+       {"3418e6dcaf87615f271c13f7d0ba9778582610e8f1d5", "723bfed0b88a274923311bb6e5a7826444205fa8d2d1b98373002008e8c4ef8e8e655d3f09b0",
+        reinterpret_cast<void*>(&pushy::jni_natives::FlowNormalizeConfiguration)},
+   }},
+  {"3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c89b38963553d02d9cda68d8d78",  // InstallRecord
+   {
+       {"3304d7dea39b6440363a", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655c7c2a4949e3355371df78299937648503c43bce8",
+        reinterpret_cast<void*>(&pushy::jni_natives::InstallRecordIsComplete)},
+       {"391ff1d2a5aa6b512b291deddfbc9e", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655c7c2a4949e3355371df78299937648503c43cf9b83866850224f11fbd9b3de5d5f3a0cecf887",
+        reinterpret_cast<void*>(&pushy::jni_natives::InstallRecordCheckActivation)},
+       {"2912f5dd9d9f69422b311b", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655c7c2a4949e3355371df78299937648503c43d9d8ae9a68092f0113fd9887857c422602b9d3d6b880721f210be9c3ee8d8f6a5c3c08b7808a89616b5b7818f0c0acc756564d3517f188",
+        reinterpret_cast<void*>(&pushy::jni_natives::InstallRecordSeal)},
+       {"2a05fbdca19f6d76363e1bf0d8b4", "723bfed0b88a274923311bb6e5a7826444205fcdf4daae943d432d07e18c93a9887e5a3655a2e4af83897d163a12fecae5b4705357351fae",
+        reinterpret_cast<void*>(&pushy::jni_natives::InstallRecordPromote)},
+       {"3802fad5a28e5b4d236d49aff9b5", "723bfed0b88a274923311bb6e5a7826444205fa8d2d1b98373002008e8c4ef8e8e655d3f09b0",
+        reinterpret_cast<void*>(&pushy::jni_natives::InstallRecordBundleSha256)},
+   }},
+  {"3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c81af997f5d270bc7c1a88b8b6f",  // ArchiveLimits
+   {
+       {"391ff1d2a5ae6651303619ea", "723dcffda48a7e446d331df7d1fca379582e0ae6a5e092ae580606",
+        reinterpret_cast<void*>(&pushy::jni_natives::ArchiveCheckEntries)},
+       {"2a1bf5df88996d40112f1dfad38382624822", "723ddefb84c2536f",
+        reinterpret_cast<void*>(&pushy::jni_natives::ArchivePlanFreeSpaceProbe)},
+   }},
+  };
+  return classes;
+}
+
+// Registers each method on its own: a host's R8 build may drop an unused
+// class or native method, which must not prevent the rest from binding. A
+// failure is still logged (release builds too): otherwise the first call of
+// the unbound method surfaces as an UnsatisfiedLinkError with no hint why.
+void RegisterAll(JNIEnv* env) {
+  for (const NativeClass& native_class : NativeClasses()) {
+    const std::string class_name = pushy::text::Reveal(native_class.name);
+    jclass clazz = env->FindClass(class_name.c_str());
+    if (clazz == nullptr) {
+      env->ExceptionClear();
+      PUSHY_JNI_LOGE("JNI binding: class %s not found, %zu native methods unbound",
+                     class_name.c_str(), native_class.methods.size());
+      continue;
+    }
+    for (const NativeMethod& method : native_class.methods) {
+      const std::string name = pushy::text::Reveal(method.name);
+      const std::string signature = pushy::text::Reveal(method.signature);
+      const JNINativeMethod entry = {
+          const_cast<char*>(name.c_str()),
+          const_cast<char*>(signature.c_str()),
+          method.function,
+      };
+      if (env->RegisterNatives(clazz, &entry, 1) != JNI_OK) {
+        env->ExceptionClear();
+        PUSHY_JNI_LOGE("JNI binding: %s.%s%s could not be registered",
+                       class_name.c_str(), name.c_str(), signature.c_str());
+      }
+    }
+    env->DeleteLocalRef(clazz);
+  }
+}
+
+}  // namespace
+
+extern "C" JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void*) {
+  JNIEnv* env = nullptr;
+  if (vm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK) {
+    return JNI_ERR;
+  }
+  RegisterAll(env);
+  // Result classes and their field IDs are resolved once here; a failure is
+  // logged inside and makes the affected natives throw instead of guessing.
+  pushy::jni_natives::InitResultClassCache(env);
+  return JNI_VERSION_1_6;
+}

package/cpp/android_jni/jni_util.h

@@ -0,0 +1,160 @@
+#pragma once
+
+#include <jni.h>
+
+#include <cstdint>
+#include <exception>
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+// Small JNI helpers shared by every Android glue translation unit
+// (update_core_android.cpp and update_flow_jni.cpp). Header-only with inline
+// linkage so each can include it without a separate compilation unit.
+
+namespace pushy {
+namespace jni_util {
+
+inline std::string JStringToString(JNIEnv* env, jstring value) {
+  if (value == nullptr) {
+    return std::string();
+  }
+
+  const char* chars = env->GetStringUTFChars(value, nullptr);
+  if (chars == nullptr) {
+    return std::string();
+  }
+
+  std::string result(chars);
+  env->ReleaseStringUTFChars(value, chars);
+  return result;
+}
+
+// Standard UTF-8 -> Java string. NewStringUTF expects JNI's *modified* UTF-8
+// and corrupts supplementary code points (4-byte sequences, e.g. emoji), so
+// decode explicitly and pass UTF-16 code units to NewString. Encoded
+// surrogate code points are accepted too: strings that originated in Java may
+// have entered through modified UTF-8 (JStringToString). Invalid bytes become
+// U+FFFD. Returns nullptr when the result would not fit a jsize.
+inline jstring ToJString(JNIEnv* env, const std::string& value) {
+  std::vector<jchar> utf16;
+  utf16.reserve(value.size());
+  size_t i = 0;
+  while (i < value.size()) {
+    const unsigned char first = static_cast<unsigned char>(value[i]);
+    uint32_t codePoint = 0xfffd;
+    size_t width = 1;
+    if (first < 0x80) {
+      codePoint = first;
+    } else if (first >= 0xc2 && first <= 0xdf && i + 1 < value.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(value[i + 1]);
+      if ((b1 & 0xc0) == 0x80) {
+        codePoint = ((first & 0x1f) << 6) | (b1 & 0x3f);
+        width = 2;
+      }
+    } else if (first == 0xc0 && i + 1 < value.size() &&
+               static_cast<unsigned char>(value[i + 1]) == 0x80) {
+      codePoint = 0;  // modified UTF-8 encoding of U+0000
+      width = 2;
+    } else if (first >= 0xe0 && first <= 0xef && i + 2 < value.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(value[i + 1]);
+      const unsigned char b2 = static_cast<unsigned char>(value[i + 2]);
+      if ((b1 & 0xc0) == 0x80 && (b2 & 0xc0) == 0x80 &&
+          !(first == 0xe0 && b1 < 0xa0)) {
+        codePoint = ((first & 0x0f) << 12) | ((b1 & 0x3f) << 6) |
+                    (b2 & 0x3f);
+        width = 3;
+      }
+    } else if (first >= 0xf0 && first <= 0xf4 && i + 3 < value.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(value[i + 1]);
+      const unsigned char b2 = static_cast<unsigned char>(value[i + 2]);
+      const unsigned char b3 = static_cast<unsigned char>(value[i + 3]);
+      if ((b1 & 0xc0) == 0x80 && (b2 & 0xc0) == 0x80 &&
+          (b3 & 0xc0) == 0x80 && !(first == 0xf0 && b1 < 0x90) &&
+          !(first == 0xf4 && b1 > 0x8f)) {
+        codePoint = ((first & 0x07) << 18) | ((b1 & 0x3f) << 12) |
+                    ((b2 & 0x3f) << 6) | (b3 & 0x3f);
+        width = 4;
+      }
+    }
+    i += width;
+    if (codePoint <= 0xffff) {
+      utf16.push_back(static_cast<jchar>(codePoint));
+    } else {
+      codePoint -= 0x10000;
+      utf16.push_back(static_cast<jchar>(0xd800 + (codePoint >> 10)));
+      utf16.push_back(static_cast<jchar>(0xdc00 + (codePoint & 0x3ff)));
+    }
+  }
+  if (utf16.size() > static_cast<size_t>(std::numeric_limits<jsize>::max())) {
+    return nullptr;
+  }
+  return env->NewString(utf16.empty() ? nullptr : utf16.data(),
+                        static_cast<jsize>(utf16.size()));
+}
+
+inline std::vector<std::string> JArrayToVector(
+    JNIEnv* env,
+    jobjectArray values) {
+  std::vector<std::string> result;
+  if (values == nullptr) {
+    return result;
+  }
+
+  const jsize size = env->GetArrayLength(values);
+  result.reserve(static_cast<size_t>(size));
+  for (jsize index = 0; index < size; ++index) {
+    auto* item = static_cast<jstring>(env->GetObjectArrayElement(values, index));
+    result.push_back(JStringToString(env, item));
+    env->DeleteLocalRef(item);
+  }
+  return result;
+}
+
+inline void ThrowRuntimeException(JNIEnv* env, const char* message) {
+  jclass exception = env->FindClass("java/lang/RuntimeException");
+  if (exception != nullptr) {
+    env->ThrowNew(exception, message);
+  }
+}
+
+inline void ThrowRuntimeException(JNIEnv* env, const std::string& message) {
+  ThrowRuntimeException(env, message.c_str());
+}
+
+// The bytes of a Java byte[] as-is (an empty string for null).
+inline std::string JByteArrayToString(JNIEnv* env, jbyteArray values) {
+  if (values == nullptr) {
+    return std::string();
+  }
+  const jsize size = env->GetArrayLength(values);
+  std::string result(static_cast<size_t>(size), '\0');
+  if (size > 0) {
+    env->GetByteArrayRegion(values, 0, size,
+                            reinterpret_cast<jbyte*>(&result[0]));
+  }
+  return result;
+}
+
+// Runs a native method body so no C++ exception (bad_alloc/length_error from
+// input-proportional STL allocations) ever unwinds through the JNI boundary:
+// it becomes a Java RuntimeException like every other failure of the entry
+// point, carrying `fallback_message` when the exception has no message of its
+// own. Returns a value-initialized Result (nullptr / void) in that case.
+template <typename Body>
+auto GuardJni(JNIEnv* env, const char* fallback_message, Body&& body)
+    -> decltype(body()) {
+  using Result = decltype(body());
+  try {
+    return std::forward<Body>(body)();
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, fallback_message);
+  }
+  return Result();
+}
+
+}  // namespace jni_util
+}  // namespace pushy