react-native-update 10.59.1 → 10.60.0

package/src/updateFlowCore.ts

@@ -118,6 +118,117 @@ export const dedupeEndpoints = (
   return result;
 };
 
+// Values the natives assume for keys a persisted native check config omits.
+const NATIVE_CONFIG_DEFAULTS: Record<string, unknown> = {
+  disabled: false,
+  queryUrls: [],
+  rnu: '',
+  rn: '',
+  afterDownload: 'none',
+};
+
+/**
+ * Deep equality of JSON values, key order ignored. Object members whose value
+ * is undefined count as absent, matching JSON.stringify (they do not exist on
+ * the wire).
+ */
+export const jsonDeepEqual = (a: unknown, b: unknown): boolean => {
+  if (a === b) {
+    return true;
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return (
+      Array.isArray(a) &&
+      Array.isArray(b) &&
+      a.length === b.length &&
+      a.every((value, index) => jsonDeepEqual(value, b[index]))
+    );
+  }
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object') {
+    return false;
+  }
+  const left = a as Record<string, unknown>;
+  const right = b as Record<string, unknown>;
+  const definedKeys = (object: Record<string, unknown>) =>
+    Object.keys(object).filter((key) => object[key] !== undefined);
+  const leftKeys = definedKeys(left);
+  return (
+    leftKeys.length === definedKeys(right).length &&
+    leftKeys.every(
+      (key) =>
+        // biome-ignore lint/suspicious/noPrototypeBuiltins: Object.hasOwn is missing from JSC before iOS 15.4
+        Object.prototype.hasOwnProperty.call(right, key) &&
+        jsonDeepEqual(left[key], right[key])
+    )
+  );
+};
+
+// Each string loses every trailing '/', then entries (strings or not) are
+// deduplicated by JSON value, keeping the first occurrence.
+const canonicalUrlList = (value: unknown): unknown => {
+  if (!Array.isArray(value)) {
+    return value;
+  }
+  const result: unknown[] = [];
+  const visited = new Set<string>();
+  for (const item of value) {
+    if (typeof item === 'string') {
+      const url = item.replace(/\/+$/, '');
+      if (!visited.has(url)) {
+        visited.add(url);
+        result.push(url);
+      }
+    } else if (!result.some((existing) => jsonDeepEqual(existing, item))) {
+      result.push(item);
+    }
+  }
+  return result;
+};
+
+/**
+ * Canonical form of a persisted native check config (shared contract C1 with
+ * the Android/iOS/Harmony natives): absent keys take their native defaults,
+ * `endpoints`/`queryUrls` lose trailing '/' and duplicates (first occurrence
+ * kept). Undefined when the JSON is unparseable or not an object.
+ */
+export function canonicalizeNativeConfig(
+  configJson: string
+): Record<string, unknown> | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(configJson);
+  } catch {
+    return undefined;
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return undefined;
+  }
+  const canonical: Record<string, unknown> = {
+    ...NATIVE_CONFIG_DEFAULTS,
+    ...(parsed as Record<string, unknown>),
+  };
+  for (const key of ['endpoints', 'queryUrls']) {
+    if (key in canonical) {
+      canonical[key] = canonicalUrlList(canonical[key]);
+    }
+  }
+  return canonical;
+}
+
+/**
+ * Whether two native check config JSON strings describe the same config
+ * (contract C1): their canonical forms are deep-equal, key order ignored.
+ * Anything unparseable is never equivalent.
+ */
+export function nativeConfigsEquivalent(
+  leftJson: string,
+  rightJson: string
+): boolean {
+  const left = canonicalizeNativeConfig(leftJson);
+  const right = canonicalizeNativeConfig(rightJson);
+  return !!left && !!right && jsonDeepEqual(left, right);
+}
+
 /**
  * The endpoint plan: dedupe, then move the sampled pick to the front (load
  * spreading), keeping the rest in configured order as the fallback sequence.
@@ -223,8 +334,10 @@ export interface CheckFingerprintInput {
   appKey?: string;
   endpoints?: string[];
   queryUrls?: string[];
-  uuid?: string;
-  /** The exact serialized request body (identity fields + extra). */
+  /**
+   * The exact serialized request body (identity fields + extra; the client
+   * uuid travels inside its cInfo).
+   */
   body: string;
 }
 
@@ -236,16 +349,9 @@ export function buildCheckFingerprint({
   appKey,
   endpoints,
   queryUrls,
-  uuid,
   body,
 }: CheckFingerprintInput): string {
-  return JSON.stringify([
-    appKey ?? '',
-    endpoints ?? [],
-    queryUrls ?? [],
-    uuid ?? '',
-    body,
-  ]);
+  return JSON.stringify([appKey ?? '', endpoints ?? [], queryUrls ?? [], body]);
 }
 
 /**

package/src/utils.ts

@@ -57,6 +57,23 @@ export function promiseAny<T>(promises: Promise<T>[]) {
   });
 }
 
+// Same alphabet and length as nanoid's default (URL-safe, 21 chars), so ids
+// stay format-compatible with the ones nanoid/non-secure used to generate.
+const ID_ALPHABET =
+  'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict';
+
+/**
+ * Non-cryptographic random id (installation uuid). Math.random is enough: it
+ * only buckets gray releases, it is not a secret.
+ */
+export const createNonSecureId = (size = 21): string => {
+  let id = '';
+  for (let i = 0; i < size; i++) {
+    id += ID_ALPHABET[Math.floor(Math.random() * 64)];
+  }
+  return id;
+};
+
 export const noop = () => {};
 const emptyModuleTarget: Record<string, typeof noop> = {};
 export const emptyModule = new Proxy(emptyModuleTarget, {
@@ -65,40 +82,32 @@ export const emptyModule = new Proxy(emptyModuleTarget, {
   },
 });
 
-const ping = isWeb
-  ? Promise.resolve
-  : async (url: string) => {
-      try {
-        const {
-          status,
-          statusText,
-          url: finalUrl,
-        } = await fetchWithTimeout(
-          url,
-          {
-            method: 'HEAD',
-          },
-          DEFAULT_FETCH_TIMEOUT_MS
-        );
-        if (status === 200) {
-          if (isProtocolDowngrade(url, finalUrl)) {
-            // The probe was redirected from https to plaintext http. Never
-            // let a downgraded final URL win the race: the winner is what
-            // the real artifact download uses.
-            log('ping rejected: https redirected to http', url, finalUrl);
-            throw Error(i18n.t('error_ping_failed'));
-          }
-          return finalUrl;
-        }
-        log('ping failed', url, status, statusText);
+const ping = async (url: string) => {
+  try {
+    const {
+      status,
+      statusText,
+      url: finalUrl,
+    } = await fetchWithTimeout(url, {
+      method: 'HEAD',
+    });
+    if (status === 200) {
+      if (isProtocolDowngrade(url, finalUrl)) {
+        // The probe was redirected from https to plaintext http. Never let a
+        // downgraded final URL win the race: the winner is what the real
+        // artifact download uses.
+        log('ping rejected: https redirected to http', url, finalUrl);
         throw Error(i18n.t('error_ping_failed'));
-      } catch (e) {
-        log('ping error', url, e);
-        throw e;
       }
-    };
-
-export { joinUrls } from './updateFlowCore';
+      return finalUrl;
+    }
+    log('ping failed', url, status, statusText);
+    throw Error(i18n.t('error_ping_failed'));
+  } catch (e) {
+    log('ping error', url, e);
+    throw e;
+  }
+};
 
 export const testUrls = async (urls?: string[]): Promise<string | null> => {
   if (!urls?.length) {
@@ -162,16 +171,14 @@ export const fetchWithTimeout = (
   // Promise.race the losing fetch kept running (and kept the connection busy)
   // long after the caller had already moved on.
   const controller = new AbortController();
-  // The timeout controller replaces params.signal on the fetch call, so a
-  // caller-provided signal (e.g. the hedged endpoint race cancelling losers)
-  // must be chained onto it manually.
-  const externalSignal =
-    signal ?? ((params as any)?.signal as AbortSignal | undefined);
+  // The timeout controller is the fetch call's signal, so a caller-provided
+  // signal (e.g. the hedged endpoint race cancelling losers) must be chained
+  // onto it manually.
   const onExternalAbort = () => controller.abort();
-  if (externalSignal?.aborted) {
+  if (signal?.aborted) {
     controller.abort();
-  } else if (externalSignal) {
-    externalSignal.addEventListener('abort', onExternalAbort);
+  } else if (signal) {
+    signal.addEventListener('abort', onExternalAbort);
   }
   const timeoutId = setTimeout(() => {
     log('fetch timeout', url);
@@ -180,7 +187,7 @@ export const fetchWithTimeout = (
 
   return enhancedFetch(url, { ...params, signal: controller.signal as any })
     .catch((e: any) => {
-      if (externalSignal?.aborted) {
+      if (signal?.aborted) {
         // Cancelled by the caller, not timed out; keep the abort semantics.
         throw e;
       }
@@ -193,7 +200,7 @@ export const fetchWithTimeout = (
       clearTimeout(timeoutId);
       // A long-lived caller signal (one per endpoint race) would otherwise
       // keep every finished request's listener — and its controller — alive.
-      externalSignal?.removeEventListener('abort', onExternalAbort);
+      signal?.removeEventListener('abort', onExternalAbort);
     });
 };
 

package/android/src/main/java/cn/reactnative/modules/update/ArchivePatchPlanResult.java

@@ -1,6 +0,0 @@
-package cn.reactnative.modules.update;
-
-class ArchivePatchPlanResult {
-    String mergeSourceSubdir;
-    boolean enableMerge;
-}

package/android/src/main/java/cn/reactnative/modules/update/PushyConfiguration.java

@@ -1,104 +0,0 @@
-package cn.reactnative.modules.update;
-
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.Set;
-import java.util.regex.Pattern;
-import org.json.JSONArray;
-import org.json.JSONException;
-import org.json.JSONObject;
-
-/** Internal normalizer for the JSONObject accepted by PushyRuntime.configure. */
-final class PushyConfiguration {
-    private static final Set<String> KEYS = new HashSet<>(Arrays.asList(
-        "appKey", "endpoints", "queryUrls", "afterDownload", "disabled",
-        "packageVersion", "rnu", "rn"));
-    private static final Pattern URL = Pattern.compile(
-        "^https?://(\\[[0-9a-fA-F:]+\\]|[a-zA-Z0-9.-]+)(:[0-9]+)?([/?#]|$)");
-    // Default service addresses, encoded by scripts/encode-native-text.ts.
-    private static final String[] ENDPOINTS = {
-        Texts.reveal("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5b3d5b9817b592947e5cdefbc8a7e"),
-        Texts.reveal("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5f0daac9c644a620ae88ca1ad93")
-    };
-    private static final String[] QUERY_URLS = {
-        Texts.reveal("3203e0c1bdd1270a253608fcd3fd9362476817f4f0d5a1996342631be3c2a3a9d779552507fdcde8928a6f512f5ce2ccbdc869404d2f1de79daa826d562c0913eec4fa9b7d4426"),
-        Texts.reveal("3203e0c1bdd1270a213b12b7dca09468462e12f3b0d5bd813d482446f4c6a1be8e79552507fdcda68cd06e5c3710e480a4867048483e55e0c2ab8d7d43030d1ce9c3b183214e2601f2f0d5b782601e2719e8ca")
-    };
-
-    // afterDownload value that selects the bundle for the next launch, encoded.
-    static final String POLICY_NEXT_LAUNCH = Texts.reveal("2912e0ffab8e6c70323b1dedd3");
-
-    private PushyConfiguration() {}
-
-    static String normalize(String json) throws JSONException {
-        JSONObject options = new JSONObject(json);
-        for (Iterator<String> keys = options.keys(); keys.hasNext();) {
-            String key = keys.next();
-            if (!KEYS.contains(key)) {
-                throw invalid("unknown option " + key);
-            }
-        }
-        String appKey = string(options.opt("appKey"), "appKey", false);
-        boolean customEndpoints = options.has("endpoints");
-        JSONArray endpoints = urls(customEndpoints ? options.get("endpoints")
-            : new JSONArray(Arrays.asList(ENDPOINTS)), "endpoints", true);
-        JSONArray queryUrls = urls(options.has("queryUrls") ? options.get("queryUrls")
-            : new JSONArray(Arrays.asList(customEndpoints ? new String[0] : QUERY_URLS)),
-            "queryUrls", false);
-        String afterDownload = options.has("afterDownload")
-            ? string(options.get("afterDownload"), "afterDownload", false) : "none";
-        if (!"none".equals(afterDownload) && !POLICY_NEXT_LAUNCH.equals(afterDownload)) {
-            throw invalid("afterDownload must be none or " + POLICY_NEXT_LAUNCH);
-        }
-        Object disabled = options.has("disabled") ? options.get("disabled") : Boolean.FALSE;
-        if (!(disabled instanceof Boolean)) {
-            throw invalid("disabled must be a boolean");
-        }
-        JSONObject result = new JSONObject();
-        result.put("appKey", appKey);
-        result.put("endpoints", endpoints);
-        result.put("queryUrls", queryUrls);
-        result.put("afterDownload", afterDownload);
-        result.put("disabled", disabled);
-        result.put("rnu", options.has("rnu") ? string(options.get("rnu"), "rnu", true) : "");
-        result.put("rn", options.has("rn") ? string(options.get("rn"), "rn", true) : "");
-        if (options.has("packageVersion")) {
-            result.put("packageVersion", string(options.get("packageVersion"), "packageVersion", false));
-        }
-        return result.toString();
-    }
-
-    private static String string(Object value, String name, boolean allowEmpty) {
-        if (!(value instanceof String) || (!allowEmpty && ((String) value).trim().isEmpty())) {
-            throw invalid(name + " must be a string" + (allowEmpty ? "" : " and must not be blank"));
-        }
-        return (String) value;
-    }
-
-    private static JSONArray urls(Object value, String name, boolean base) throws JSONException {
-        if (!(value instanceof JSONArray) || (base && ((JSONArray) value).length() == 0)) {
-            throw invalid(name + " must be " + (base ? "a non-empty" : "an") + " array");
-        }
-        JSONArray values = (JSONArray) value;
-        JSONArray result = new JSONArray();
-        Set<String> seen = new HashSet<>();
-        for (int i = 0; i < values.length(); i++) {
-            String url = string(values.get(i), name, false).trim();
-            if (!URL.matcher(url).find() || url.matches("(?s).*\\s.*") || url.contains("\\")
-                || (base && (url.contains("?") || url.contains("#")))) {
-                throw invalid(name + " requires absolute HTTP(S) URLs without credentials"
-                    + (base ? ", queries or fragments" : ""));
-            }
-            String normalized = base ? url.replaceAll("/+$", "") : url;
-            if (seen.add(normalized)) {
-                result.put(normalized);
-            }
-        }
-        return result;
-    }
-
-    private static IllegalArgumentException invalid(String message) {
-        return new IllegalArgumentException("Invalid native configuration: " + message);
-    }
-}

package/android/src/main/java/cn/reactnative/modules/update/UiThreadRunner.java

@@ -1,37 +0,0 @@
-package cn.reactnative.modules.update;
-
-import android.util.Log;
-import androidx.annotation.Nullable;
-import com.facebook.react.bridge.Promise;
-import com.facebook.react.bridge.UiThreadUtil;
-
-final class UiThreadRunner {
-    interface Operation {
-        void run() throws Throwable;
-    }
-
-    private UiThreadRunner() {
-    }
-
-    static void run(
-        @Nullable final Promise promise,
-        final String errorCode,
-        final String operationName,
-        final Operation operation
-    ) {
-        UiThreadUtil.runOnUiThread(new Runnable() {
-            @Override
-            public void run() {
-                try {
-                    operation.run();
-                } catch (Throwable error) {
-                    if (promise != null) {
-                        promise.reject(errorCode, operationName + " failed", error);
-                    } else {
-                        Log.e(Texts.LOG_TAG, operationName + " failed", error);
-                    }
-                }
-            }
-        });
-    }
-}

package/android/src/newarch/cn/reactnative/modules/update/UpdateModule.java

@@ -1,121 +0,0 @@
-package cn.reactnative.modules.update;
-
-import com.facebook.react.bridge.Promise;
-import com.facebook.react.bridge.ReactApplicationContext;
-import com.facebook.react.bridge.ReadableMap;
-import java.util.Map;
-
-/**
- * New-architecture bridge: the codegen spec overrides only, every method
- * forwards to UpdateModuleImpl.
- */
-public class UpdateModule extends NativePushySpec {
-    private final UpdateModuleImpl impl;
-
-    public UpdateModule(ReactApplicationContext reactContext, UpdateContext updateContext) {
-        super(reactContext);
-        this.impl = new UpdateModuleImpl(reactContext, updateContext);
-    }
-
-    public UpdateModule(ReactApplicationContext reactContext) {
-        this(reactContext, UpdateContext.getInstance(reactContext));
-    }
-
-    @Override
-    protected Map<String, Object> getTypedExportedConstants() {
-        return impl.getConstants();
-    }
-
-    @Override
-    public String getName() {
-        return UpdateModuleImpl.NAME;
-    }
-
-    @Override
-    public void downloadFullUpdate(ReadableMap options, Promise promise) {
-        impl.downloadFullUpdate(options, promise);
-    }
-
-    @Override
-    public void downloadAndInstallApk(ReadableMap options, Promise promise) {
-        impl.downloadAndInstallApk(options, promise);
-    }
-
-    @Override
-    public void downloadPatchFromPackage(ReadableMap options, Promise promise) {
-        impl.downloadPatchFromPackage(options, promise);
-    }
-
-    @Override
-    public void downloadPatchFromPpk(ReadableMap options, Promise promise) {
-        impl.downloadPatchFromPpk(options, promise);
-    }
-
-    @Override
-    public void reloadUpdate(ReadableMap options, Promise promise) {
-        impl.reloadUpdate(options, promise);
-    }
-
-    @Override
-    public void restartApp(Promise promise) {
-        impl.restartApp(null, promise);
-    }
-
-    @Override
-    public void setNeedUpdate(ReadableMap options, Promise promise) {
-        impl.setNeedUpdate(options, promise);
-    }
-
-    @Override
-    public void markSuccess(Promise promise) {
-        impl.markSuccess(promise);
-    }
-
-    @Override
-    public void getBundleHash(Promise promise) {
-        impl.getBundleHash(promise);
-    }
-
-    @Override
-    public void resetToPackagedBundle(Promise promise) {
-        impl.resetToPackagedBundle(promise);
-    }
-
-    @Override
-    public void setUuid(String uuid, Promise promise) {
-        impl.setUuid(uuid, promise);
-    }
-
-    @Override
-    public void syncNativeConfig(String config, Promise promise) {
-        impl.syncNativeConfig(config, promise);
-    }
-
-    @Override
-    public void getNativeCheckCache(Promise promise) {
-        impl.getNativeCheckCache(promise);
-    }
-
-    @Override
-    public void markJsCheckCompleted(String config, Promise promise) {
-        impl.markJsCheckCompleted(config, promise);
-    }
-
-    @Override
-    public void setLocalHashInfo(String hash, String info, Promise promise) {
-        impl.setLocalHashInfo(hash, info, promise);
-    }
-
-    @Override
-    public void getLocalHashInfo(String hash, Promise promise) {
-        impl.getLocalHashInfo(hash, promise);
-    }
-
-    @Override
-    public void addListener(String eventName) {
-    }
-
-    @Override
-    public void removeListeners(double count) {
-    }
-}

package/android/src/oldarch/cn/reactnative/modules/update/UpdateModule.java

@@ -1,125 +0,0 @@
-package cn.reactnative.modules.update;
-
-import com.facebook.react.bridge.Promise;
-import com.facebook.react.bridge.ReactApplicationContext;
-import com.facebook.react.bridge.ReactContextBaseJavaModule;
-import com.facebook.react.bridge.ReactMethod;
-import com.facebook.react.bridge.ReadableMap;
-import java.util.Map;
-
-/**
- * Old-architecture bridge: @ReactMethod declarations only, every method
- * forwards to UpdateModuleImpl. Each state-changing method takes a trailing
- * Promise, like the TurboModule spec, so a failed persistence rejects instead
- * of resolving early (CODE_AUDIT 2.3).
- */
-public class UpdateModule extends ReactContextBaseJavaModule {
-    private final UpdateModuleImpl impl;
-
-    public UpdateModule(ReactApplicationContext reactContext, UpdateContext updateContext) {
-        super(reactContext);
-        this.impl = new UpdateModuleImpl(reactContext, updateContext);
-    }
-
-    public UpdateModule(ReactApplicationContext reactContext) {
-        this(reactContext, UpdateContext.getInstance(reactContext));
-    }
-
-    @Override
-    public Map<String, Object> getConstants() {
-        return impl.getConstants();
-    }
-
-    @Override
-    public String getName() {
-        return UpdateModuleImpl.NAME;
-    }
-
-    @ReactMethod
-    public void downloadFullUpdate(ReadableMap options, Promise promise) {
-        impl.downloadFullUpdate(options, promise);
-    }
-
-    @ReactMethod
-    public void downloadAndInstallApk(ReadableMap options, Promise promise) {
-        impl.downloadAndInstallApk(options, promise);
-    }
-
-    @ReactMethod
-    public void downloadPatchFromPackage(ReadableMap options, Promise promise) {
-        impl.downloadPatchFromPackage(options, promise);
-    }
-
-    @ReactMethod
-    public void downloadPatchFromPpk(ReadableMap options, Promise promise) {
-        impl.downloadPatchFromPpk(options, promise);
-    }
-
-    @ReactMethod
-    public void reloadUpdate(ReadableMap options, Promise promise) {
-        impl.reloadUpdate(options, promise);
-    }
-
-    @ReactMethod
-    public void restartApp(Promise promise) {
-        impl.restartApp(null, promise);
-    }
-
-    @ReactMethod
-    public void setNeedUpdate(ReadableMap options, Promise promise) {
-        impl.setNeedUpdate(options, promise);
-    }
-
-    @ReactMethod
-    public void markSuccess(Promise promise) {
-        impl.markSuccess(promise);
-    }
-
-    @ReactMethod
-    public void getBundleHash(Promise promise) {
-        impl.getBundleHash(promise);
-    }
-
-    @ReactMethod
-    public void resetToPackagedBundle(Promise promise) {
-        impl.resetToPackagedBundle(promise);
-    }
-
-    @ReactMethod
-    public void setUuid(String uuid, Promise promise) {
-        impl.setUuid(uuid, promise);
-    }
-
-    @ReactMethod
-    public void syncNativeConfig(String config, Promise promise) {
-        impl.syncNativeConfig(config, promise);
-    }
-
-    @ReactMethod
-    public void getNativeCheckCache(Promise promise) {
-        impl.getNativeCheckCache(promise);
-    }
-
-    @ReactMethod
-    public void markJsCheckCompleted(String config, Promise promise) {
-        impl.markJsCheckCompleted(config, promise);
-    }
-
-    @ReactMethod
-    public void setLocalHashInfo(String hash, String info, Promise promise) {
-        impl.setLocalHashInfo(hash, info, promise);
-    }
-
-    @ReactMethod
-    public void getLocalHashInfo(String hash, Promise promise) {
-        impl.getLocalHashInfo(hash, promise);
-    }
-
-    @ReactMethod
-    public void addListener(String eventName) {
-    }
-
-    @ReactMethod
-    public void removeListeners(Integer count) {
-    }
-}