react-native-update 10.59.2 → 10.61.0

package/cpp/patch_core/resume_plan.cpp

@@ -0,0 +1,226 @@
+#include "resume_plan.h"
+
+#include <cmath>
+
+// Relative like every other cross-core include: use_frameworks! flattens the
+// pod's headers.
+#include "../update_flow_core/flow_json.h"
+
+namespace pushy {
+namespace resume {
+namespace {
+
+using flowjson::Value;
+
+bool IsSpace(char c) { return c == ' ' || c == '\t'; }
+
+std::string Trim(const std::string& text) {
+  size_t begin = 0;
+  size_t end = text.size();
+  while (begin < end && IsSpace(text[begin])) {
+    ++begin;
+  }
+  while (end > begin && IsSpace(text[end - 1])) {
+    --end;
+  }
+  return text.substr(begin, end - begin);
+}
+
+// Digits only (no sign, no trailing text), within long long. -1 otherwise.
+long long ParseDigits(const std::string& text) {
+  if (text.empty() || text.size() > 18) {
+    return -1;
+  }
+  long long value = 0;
+  for (char c : text) {
+    if (c < '0' || c > '9') {
+      return -1;
+    }
+    value = value * 10 + (c - '0');
+  }
+  return value;
+}
+
+struct Sidecar {
+  bool valid = false;
+  std::string etag;
+  std::string last_modified;
+  long long total = 0;
+};
+
+// The sidecar for url, or invalid (absent, oversized, not a JSON object,
+// another url): a partial without one is untrusted.
+Sidecar ReadSidecar(const std::string& text, const std::string& url) {
+  Sidecar sidecar;
+  if (text.empty() || static_cast<long long>(text.size()) > kMaxSidecarBytes) {
+    return sidecar;
+  }
+  bool ok = false;
+  Value root = flowjson::Parse(text, &ok);
+  if (!ok || !root.IsObject()) {
+    return sidecar;
+  }
+  const Value& url_value = root.Get("url");
+  if (!url_value.IsString() || url_value.AsString() != url) {
+    return sidecar;
+  }
+  sidecar.valid = true;
+  const Value& etag = root.Get("etag");
+  if (etag.IsString()) {
+    sidecar.etag = etag.AsString();
+  }
+  const Value& last_modified = root.Get("lastModified");
+  if (last_modified.IsString()) {
+    sidecar.last_modified = last_modified.AsString();
+  }
+  const Value& total = root.Get("total");
+  if (total.IsNumber() && total.AsNumber() > 0 &&
+      total.AsNumber() < 9007199254740992.0 &&
+      std::floor(total.AsNumber()) == total.AsNumber()) {
+    sidecar.total = static_cast<long long>(total.AsNumber());
+  }
+  return sidecar;
+}
+
+Value Number(long long n) { return Value::Number(static_cast<double>(n)); }
+
+Value Action(const char* action) {
+  Value result = Value::Object();
+  result.Set("action", Value::String(action));
+  return result;
+}
+
+std::string Complete(long long total) {
+  Value result = Action("complete");
+  result.Set("total", Number(total));
+  return flowjson::Stringify(result);
+}
+
+bool IsEncoded(const std::string& content_encoding) {
+  std::string encoding = Trim(content_encoding);
+  if (encoding.empty()) {
+    return false;
+  }
+  for (char& c : encoding) {
+    if (c >= 'A' && c <= 'Z') {
+      c = static_cast<char>(c - 'A' + 'a');
+    }
+  }
+  return encoding != "identity";
+}
+
+}  // namespace
+
+long long ParseContentRangeTotal(const std::string& header,
+                                 long long expected_start) {
+  const std::string unit = "bytes ";
+  if (header.compare(0, unit.size(), unit) != 0) {
+    return -1;
+  }
+  const std::string range = header.substr(unit.size());
+  const size_t slash = range.find('/');
+  const size_t dash = range.find('-');
+  if (slash == std::string::npos || dash == std::string::npos || dash > slash) {
+    return -1;
+  }
+  const long long start = ParseDigits(Trim(range.substr(0, dash)));
+  const long long end = ParseDigits(Trim(range.substr(dash + 1, slash - dash - 1)));
+  if (start < 0 || end < 0 || start != expected_start || end < start) {
+    return -1;
+  }
+  const std::string total_part = Trim(range.substr(slash + 1));
+  if (total_part == "*") {
+    return 0;
+  }
+  const long long total = ParseDigits(total_part);
+  return total > end ? total : -1;
+}
+
+std::string PlanRequestJson(const std::string& sidecar_text,
+                            const std::string& url, long long partial_size) {
+  const Sidecar sidecar = ReadSidecar(sidecar_text, url);
+  if (sidecar.valid && partial_size > 0) {
+    if (sidecar.total > 0 && partial_size == sidecar.total) {
+      return Complete(sidecar.total);
+    }
+    if (sidecar.total <= 0 || partial_size < sidecar.total) {
+      Value headers = Value::Object();
+      headers.Set("Range", Value::String("bytes=" + std::to_string(partial_size) + "-"));
+      headers.Set("Accept-Encoding", Value::String("identity"));
+      const std::string& validator =
+          sidecar.etag.empty() ? sidecar.last_modified : sidecar.etag;
+      if (!validator.empty()) {
+        headers.Set("If-Range", Value::String(validator));
+      }
+      Value result = Action("resume");
+      result.Set("offset", Number(partial_size));
+      result.Set("headers", headers);
+      return flowjson::Stringify(result);
+    }
+  }
+  return flowjson::Stringify(Action("fresh"));
+}
+
+std::string ClassifyResponseJson(int status, long long resume_offset,
+                                 const std::string& content_range,
+                                 const std::string& content_encoding,
+                                 long long content_length,
+                                 const std::string& sidecar_text,
+                                 const std::string& url,
+                                 long long partial_size) {
+  if (status == 416) {
+    const Sidecar sidecar = ReadSidecar(sidecar_text, url);
+    if (sidecar.valid && sidecar.total > 0 && partial_size == sidecar.total) {
+      return Complete(sidecar.total);
+    }
+    return flowjson::Stringify(Action("restart"));
+  }
+  if (status < 200 || status > 299) {
+    return flowjson::Stringify(Action("httpError"));
+  }
+  const bool encoded = IsEncoded(content_encoding);
+  const bool append = status == 206 && resume_offset > 0;
+  long long total = 0;
+  if (append) {
+    // Encoded range bytes or a missing/mismatched Content-Range: the appended
+    // bytes could not be trusted. Restarting (once) beats failing, which
+    // would keep the partial and hit the same wall on every attempt.
+    total = encoded ? -1 : ParseContentRangeTotal(content_range, resume_offset);
+    if (total < 0) {
+      return flowjson::Stringify(Action("restart"));
+    }
+  } else if (!encoded && content_length > 0) {
+    total = content_length;
+  }
+  Value result = Action("write");
+  result.Set("append", Value::Bool(append));
+  result.Set("base", Number(append ? resume_offset : 0));
+  result.Set("total", Number(total));
+  result.Set("encoded", Value::Bool(encoded));
+  result.Set("persistSidecar", Value::Bool(!encoded));
+  return flowjson::Stringify(result);
+}
+
+std::string SidecarJson(const std::string& url, const std::string& etag,
+                        const std::string& last_modified,
+                        const std::string& previous_sidecar, long long total) {
+  const Sidecar previous = ReadSidecar(previous_sidecar, url);
+  const std::string& kept_etag = etag.empty() ? previous.etag : etag;
+  const std::string& kept_last_modified =
+      last_modified.empty() ? previous.last_modified : last_modified;
+  Value meta = Value::Object();
+  meta.Set("url", Value::String(url));
+  if (!kept_etag.empty()) {
+    meta.Set("etag", Value::String(kept_etag));
+  }
+  if (!kept_last_modified.empty()) {
+    meta.Set("lastModified", Value::String(kept_last_modified));
+  }
+  if (total > 0) {
+    meta.Set("total", Number(total));
+  }
+  return flowjson::Stringify(meta);
+}
+
+}  // namespace resume
+}  // namespace pushy

package/cpp/patch_core/resume_plan.h

@@ -0,0 +1,88 @@
+#pragma once
+
+#include <string>
+
+// Cross-launch resumable download (NATIVE_CHECKUPDATE_DESIGN §11.4): the pure
+// decisions every platform's downloader makes around a partial archive and
+// its `<archive>.resume` sidecar, one implementation for Android
+// (DownloadTask.java, through JNI), iOS (RCTPushyDownloader.mm) and Harmony
+// (DownloadTask.ts, through NAPI). The downloaders keep the IO: reading and
+// writing the archive and the sidecar, the HTTP request, the single retry
+// from zero, progress and limits. tests/resume-plan-vectors.json pins this
+// layer.
+//
+// The sidecar records what a partial belongs to:
+//   {"url": "...", "etag": "...", "lastModified": "...", "total": N}
+// (url always; the validators when the server sent them; total only when
+// known). A partial without a sidecar for the same URL is untrusted.
+//
+// JSON strings in and out, so the bindings stay thin. Keep the core internal
+// to whichever binary links it (see podspec Core).
+#pragma GCC visibility push(hidden)
+
+namespace pushy {
+namespace resume {
+
+// A sidecar is a few hundred bytes; anything larger is not one.
+constexpr long long kMaxSidecarBytes = 64 * 1024;
+
+// "bytes <start>-<end>/<total>" (RFC 9110 §14.4), whitespace around the
+// numbers allowed, digits only. Returns the total (0 when "*"), or -1 when the
+// header is missing or malformed, the start is not expected_start, or the
+// range and total contradict each other (end before start, a numeric total
+// not beyond end): the appended bytes could not be trusted. A total of 0
+// would otherwise pass as "unknown" and skip the final size check.
+long long ParseContentRangeTotal(const std::string& header,
+                                 long long expected_start);
+
+// What to do before the request, from the sidecar text ("" when there is
+// none) and the size of the partial on disk (0 when there is none):
+//   {"action":"complete","total":N}  the partial is the whole archive (the
+//       process died between download end and unzip): nothing to transfer.
+//   {"action":"resume","offset":N,"headers":{...}}  send these headers:
+//       Range, Accept-Encoding: identity (offsets must address the bytes on
+//       disk) and, when the sidecar has a validator, If-Range (a changed file
+//       then comes back as a full 200 instead of mismatched bytes).
+//   {"action":"fresh"}  discard the partial and its sidecar; send a plain
+//       request (fresh downloads keep the platform's transparent encoding).
+std::string PlanRequestJson(const std::string& sidecar, const std::string& url,
+                            long long partial_size);
+
+// What to do with the response to a request PlanRequestJson planned
+// (resume_offset is its offset, 0 for a fresh request; partial_size the
+// partial's size now; content_length the body's, -1 when unknown):
+//   {"action":"complete","total":N}  416 and the partial is the whole archive.
+//   {"action":"restart"}  the partial is stale (416, an encoded range body, a
+//       missing or mismatched Content-Range): discard it and its sidecar and
+//       retry once from zero.
+//   {"action":"httpError"}  any other non-2xx status: keep the partial and
+//       its sidecar (the resume state) and fail.
+//   {"action":"write","append":B,"base":N,"total":N,"encoded":B,
+//    "persistSidecar":B}  stream the body: appended at base (append) or
+//       replacing the partial (base 0); total is the whole archive (0 when
+//       unknown or the body is encoded). Persist the sidecar before the first
+//       byte lands unless the body is encoded (no resume across an encoded
+//       transfer: offsets would address the encoded representation), in
+//       which case delete it.
+std::string ClassifyResponseJson(int status, long long resume_offset,
+                                 const std::string& content_range,
+                                 const std::string& content_encoding,
+                                 long long content_length,
+                                 const std::string& sidecar,
+                                 const std::string& url,
+                                 long long partial_size);
+
+// The sidecar text for url: this response's validators, falling back to the
+// previous sidecar's (same url only) when the response omits them, and total
+// when it is known (> 0). Downloaders write it before streaming and once more
+// with the final size after a complete, unencoded transfer, so a process
+// that dies between download end and unzip finds the archive complete even
+// when the length was unknown up front.
+std::string SidecarJson(const std::string& url, const std::string& etag,
+                        const std::string& last_modified,
+                        const std::string& previous_sidecar, long long total);
+
+}  // namespace resume
+}  // namespace pushy
+
+#pragma GCC visibility pop

package/cpp/patch_core/state_ops.h

@@ -1,9 +1,9 @@
 #pragma once
 
 // Single source of truth for the state-machine operation codes shared across
-// the platform glue layers (Android JNI in update_core_android.cpp and
-// HarmonyOS NAPI in pushy.cpp). The integer values MUST stay in sync with the
-// callers on each platform:
+// the platform glue layers (Android JNI in
+// cpp/android_jni/update_core_android.cpp and HarmonyOS NAPI in pushy.cpp).
+// The integer values MUST stay in sync with the callers on each platform:
 //   - Android:  UpdateContext.java (STATE_OP_* constants)
 //   - HarmonyOS: UpdateContext.ts  (StateOperation usage)
 // Do not renumber existing entries; only append new ones.
@@ -15,12 +15,14 @@ namespace pushy {
 namespace state_ops {
 
 enum class StateOperation {
+  // <generated:state-operations> (scripts/contract.ts; bun scripts/generate-contract.ts)
   kSwitchVersion = 1,
   kMarkSuccess = 2,
   kRollback = 3,
   kClearFirstTime = 4,
   kClearRollbackMark = 5,
   kResolveLaunch = 6,
+  // </generated:state-operations>
 };
 
 }  // namespace state_ops

package/cpp/update_flow_core/flow_json.cpp

@@ -3,6 +3,7 @@
 #include <cmath>
 #include <cstdint>
 #include <cstdio>
+#include <unordered_map>
 
 namespace flowjson {
 
@@ -86,6 +87,40 @@ bool Value::StrictEquals(const Value& a, const Value& b) {
   return false;
 }
 
+bool Value::DeepEquals(const Value& a, const Value& b) {
+  if (a.kind_ == Kind::Array && b.kind_ == Kind::Array) {
+    if (a.elements_.size() != b.elements_.size()) {
+      return false;
+    }
+    for (size_t i = 0; i < a.elements_.size(); i++) {
+      if (!DeepEquals(a.elements_[i], b.elements_[i])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  if (a.kind_ == Kind::Object && b.kind_ == Kind::Object) {
+    size_t defined = 0;
+    for (const auto& member : a.members_) {
+      if (member.second.IsUndefined()) {
+        continue;
+      }
+      defined++;
+      const Value& other = b.Get(member.first);
+      if (other.IsUndefined() || !DeepEquals(member.second, other)) {
+        return false;
+      }
+    }
+    for (const auto& member : b.members_) {
+      if (!member.second.IsUndefined()) {
+        defined--;
+      }
+    }
+    return defined == 0;
+  }
+  return StrictEquals(a, b);
+}
+
 namespace {
 
 void AppendEscaped(const std::string& s, std::string* out) {
@@ -232,6 +267,8 @@ namespace {
 // stack limit (size and node count are capped in flow_json.h). Real
 // responses nest ~4 levels.
 constexpr int kMaxDepth = 64;
+// Objects with more members than this get a hash index while parsing.
+constexpr size_t kIndexedObjectMembers = 16;
 
 // Locale-independent decimal -> double. strtod() honours LC_NUMERIC, so a
 // host process that called setlocale() into a comma-decimal locale would stop
@@ -327,7 +364,8 @@ double DecimalToDouble(const std::string& token) {
 
 class Parser {
  public:
-  Parser(const std::string& text) : text_(text) {}
+  Parser(const std::string& text, size_t max_nodes)
+      : text_(text), max_nodes_(max_nodes) {}
 
   Value Run(bool* ok) {
     Value v = ParseValue();
@@ -376,7 +414,7 @@ class Parser {
       ok_ = false;
       return Value::Undefined();
     }
-    if (++nodes_ > kMaxNodes) {
+    if (++nodes_ > max_nodes_) {
       ok_ = false;
       return Value::Undefined();
     }
@@ -409,20 +447,51 @@ class Parser {
     }
   }
 
+  // Duplicate keys keep the first position and the last value (Value::Set
+  // semantics). Large objects (a patch manifest's copies map has thousands
+  // of members) look keys up through a hash index instead of Set's linear
+  // scan, which would make parsing quadratic in the member count.
   Value ParseObject() {
-    Value obj = Value::Object();
     Consume('{');
     SkipWs();
     if (pos_ < text_.size() && text_[pos_] == '}') {
       pos_++;
-      return obj;
+      return Value::Object();
     }
+    Members members;
+    std::unordered_map<std::string, size_t> index;
     while (ok_) {
       SkipWs();
       std::string key = ParseString();
       SkipWs();
       Consume(':');
-      obj.Set(key, ParseValue());
+      Value value = ParseValue();
+      if (members.size() == kIndexedObjectMembers && index.empty()) {
+        for (size_t i = 0; i < members.size(); i++) {
+          index.emplace(members[i].first, i);
+        }
+      }
+      size_t existing = members.size();
+      if (index.empty()) {
+        for (size_t i = 0; i < members.size(); i++) {
+          if (members[i].first == key) {
+            existing = i;
+            break;
+          }
+        }
+      } else {
+        auto found = index.find(key);
+        if (found != index.end()) {
+          existing = found->second;
+        } else {
+          index.emplace(key, members.size());
+        }
+      }
+      if (existing < members.size()) {
+        members[existing].second = std::move(value);
+      } else {
+        members.emplace_back(std::move(key), std::move(value));
+      }
       SkipWs();
       if (pos_ < text_.size() && text_[pos_] == ',') {
         pos_++;
@@ -431,7 +500,7 @@ class Parser {
       Consume('}');
       break;
     }
-    return obj;
+    return Value::Object(std::move(members));
   }
 
   Value ParseArray() {
@@ -635,6 +704,7 @@ class Parser {
   }
 
   const std::string& text_;
+  const size_t max_nodes_;
   size_t pos_ = 0;
   int depth_ = 0;
   size_t nodes_ = 0;
@@ -644,11 +714,15 @@ class Parser {
 }  // namespace
 
 Value Parse(const std::string& text, bool* ok) {
-  if (text.size() > kMaxInputBytes) {
+  return Parse(text, ParseLimits(), ok);
+}
+
+Value Parse(const std::string& text, const ParseLimits& limits, bool* ok) {
+  if (text.size() > limits.max_input_bytes) {
     *ok = false;
     return Value::Undefined();
   }
-  Parser parser(text);
+  Parser parser(text, limits.max_nodes);
   return parser.Run(ok);
 }
 

package/cpp/update_flow_core/flow_json.h

@@ -51,6 +51,12 @@ class Value {
   }
   static Value Array() { return Value(Kind::Array); }
   static Value Object() { return Value(Kind::Object); }
+  // The members must have distinct keys (Set's invariant).
+  static Value Object(Members members) {
+    Value v(Kind::Object);
+    v.members_ = std::move(members);
+    return v;
+  }
 
   Kind kind() const { return kind_; }
   bool IsUndefined() const { return kind_ == Kind::Undefined; }
@@ -81,6 +87,12 @@ class Value {
 
   static bool StrictEquals(const Value& a, const Value& b);
 
+  // Structural equality of JSON values (src/updateFlowCore.ts
+  // jsonDeepEqual): object key order is ignored and undefined members count
+  // as absent; arrays compare element-wise in order; primitives use ===
+  // (so 1 equals 1.0, false is not 0, null equals only null).
+  static bool DeepEquals(const Value& a, const Value& b);
+
  private:
   explicit Value(Kind kind) : kind_(kind) {}
 
@@ -116,6 +128,15 @@ constexpr size_t kMaxNodes = 65536;
 // Lone surrogate escapes decode to U+FFFD so the output is always valid UTF-8.
 Value Parse(const std::string& text, bool* ok);
 
+// Same parser under caller-chosen caps, for documents whose size is bounded
+// by something other than a checkUpdate response (the patch core's
+// __diff.json manifest, cpp/patch_core/patch_manifest.h).
+struct ParseLimits {
+  size_t max_input_bytes = kMaxInputBytes;
+  size_t max_nodes = kMaxNodes;
+};
+Value Parse(const std::string& text, const ParseLimits& limits, bool* ok);
+
 }  // namespace flowjson
 
 #pragma GCC visibility pop