react-native-update 10.59.2 → 10.61.0

package/android/src/main/java/cn/reactnative/modules/update/DownloadTask.java

@@ -6,15 +6,15 @@ import android.os.Looper;
 import android.util.Log;
 import com.facebook.react.bridge.Arguments;
 import com.facebook.react.bridge.WritableMap;
-import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.security.DigestOutputStream;
+import java.security.MessageDigest;
 import java.util.ArrayList;
 import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.Iterator;
 import java.util.zip.ZipEntry;
 import okhttp3.Call;
 import okhttp3.OkHttpClient;
@@ -24,16 +24,15 @@ import okhttp3.ResponseBody;
 import okio.BufferedSink;
 import okio.BufferedSource;
 import okio.Okio;
-import org.json.JSONException;
 import org.json.JSONObject;
-import org.json.JSONTokener;
 
 class DownloadTask implements Runnable {
     // Bundle delta entry inside a patch archive, stored encoded.
     private static final String BUNDLE_DELTA_ENTRY =
-        Texts.reveal("3319f0d4b6c56a502c3b10fcdca0de7d4b3307e9");
+        Texts.BUNDLE_DELTA_ENTRY;
 
-    private static final int DOWNLOAD_CHUNK_SIZE = 4096;
+    // Resume sidecars are a few hundred bytes of JSON.
+    private static final long MAX_SIDECAR_BYTES = 64 * 1024;
     // When the server does not report Content-Length we cannot key progress
     // events on percentage change, so throttle by bytes to avoid flooding the
     // bridge (e.g. a 20MB chunked download would otherwise emit ~5000 events).
@@ -42,17 +41,13 @@ class DownloadTask implements Runnable {
     // slow-dripping connection could occupy the single-threaded download
     // executor indefinitely and starve queued tasks. The call timeout is a
     // generous upper bound sized for large full-package downloads.
-    private static final OkHttpClient HTTP_CLIENT = new OkHttpClient.Builder()
+    private static final OkHttpClient HTTP_CLIENT = HttpClients.base().newBuilder()
             .connectTimeout(15, java.util.concurrent.TimeUnit.SECONDS)
             .readTimeout(30, java.util.concurrent.TimeUnit.SECONDS)
             .writeTimeout(30, java.util.concurrent.TimeUnit.SECONDS)
             .callTimeout(10, java.util.concurrent.TimeUnit.MINUTES)
             .build();
 
-    static {
-        NativeCore.ensureLoaded();
-    }
-
     // Two-phase install (cpp/patch_core/install_record.h): all unpack/patch
     // work happens in <hash>.staging; the final <hash> directory only ever
     // appears through an atomic rename after the completion record was
@@ -62,36 +57,32 @@ class DownloadTask implements Runnable {
         return InstallRecord.stagingDirectoryFor(params.unzipDirectory);
     }
 
-    // SHA-256 of the downloaded archive, computed right before extraction.
+    // SHA-256 of the downloaded archive, recorded in the install record.
     private String artifactSha256 = "";
-
+    // The archive digest computed while its bytes streamed to disk (a resumed
+    // transfer first hashes the prefix already on disk); null when this task
+    // did not stream the whole file itself and it must be hashed from disk.
+    private String streamedArchiveSha256;
+    // Digest of the bundle computed while a full package was extracted;
+    // null when the bundle was produced some other way (patch tasks).
+    private String stagedBundleSha256;
+
+    /** What a staged patch archive declared, as the native core consumes it. */
     private static final class PatchArchiveContents {
-        final ArrayList<String> entryNames = new ArrayList<String>();
-        final ArrayList<String> copyFroms = new ArrayList<String>();
-        final ArrayList<String> copyTos = new ArrayList<String>();
-        final ArrayList<String> deletes = new ArrayList<String>();
-        // __diff.json 的 hbcTransform 元数据(按 patch 条目名索引);
-        // 为空对象/缺失时返回 ""(native 走现状路径)
-        JSONObject hbcTransform;
-
-        String hbcTransformMetaFor(String patchEntryName) {
-            if (hbcTransform == null) {
-                return "";
-            }
-            JSONObject meta = hbcTransform.optJSONObject(patchEntryName);
-            return meta != null ? meta.toString() : "";
+        final String[] entryNames;
+        // The raw __diff.json bytes (UTF-8): parsed only by the native core
+        // (cpp/patch_core/patch_manifest.h), never here.
+        final byte[] manifestJson;
+
+        PatchArchiveContents(ArrayList<String> entryNames, byte[] manifestJson) {
+            this.entryNames = entryNames.toArray(new String[0]);
+            this.manifestJson = manifestJson;
         }
-        // Maps a copy source path ("from") to the CRC32 of the file content,
-        // when provided by the manifest ("copiesCrc"). Lets the resource
-        // copier locate the file by content if the path is not present on
-        // device (APK baseline -> AAB install path shortening).
-        final HashMap<String, Long> copyCrcs = new HashMap<String, Long>();
     }
 
     private final Context context;
     private final DownloadTaskParams params;
     private final Handler mainHandler = new Handler(Looper.getMainLooper());
-    private final byte[] buffer = new byte[DOWNLOAD_CHUNK_SIZE];
     private final BundledResourceCopier bundledResourceCopier;
     private String hash;
     // Set once downloadFile() returns: failures after this point in a patch
@@ -108,15 +99,12 @@ class DownloadTask implements Runnable {
         // Cross-platform progress contract: unknown length is reported as
         // total=0, never a raw -1 (OkHttp's contentLength for chunked/gzip).
         final long normalizedTotal = total > 0 ? total : 0;
-        mainHandler.post(new Runnable() {
-            @Override
-            public void run() {
-                WritableMap progress = Arguments.createMap();
-                progress.putDouble("received", received);
-                progress.putDouble("total", normalizedTotal);
-                progress.putString("hash", hash);
-                UpdateEventEmitter.sendEvent("RCTPushyDownloadProgress", progress);
-            }
+        mainHandler.post(() -> {
+            WritableMap progress = Arguments.createMap();
+            progress.putDouble("received", received);
+            progress.putDouble("total", normalizedTotal);
+            progress.putString("hash", hash);
+            UpdateEventEmitter.sendEvent("RCTPushyDownloadProgress", progress);
         });
     }
 
@@ -130,54 +118,30 @@ class DownloadTask implements Runnable {
 
     static void deleteResumeSidecar(File archive) {
         File sidecar = resumeSidecarFile(archive);
-        if (sidecar.exists() && !sidecar.delete() && UpdateContext.DEBUG) {
+        if (sidecar.exists() && !sidecar.delete() && BuildConfig.DEBUG) {
             Log.w(Texts.LOG_TAG, "Failed to delete resume sidecar " + sidecar);
         }
     }
 
-    private JSONObject readResumeMeta(File sidecar, String url) {
+    // The sidecar's text, "" when there is none or it cannot be one (larger
+    // than a sidecar ever is, unreadable): ResumePlan treats both as "no
+    // trusted partial".
+    private static String readSidecarText(File sidecar) {
         if (!sidecar.isFile()) {
-            return null;
+            return "";
         }
         try {
-            byte[] bytes = readBytes(new java.io.FileInputStream(sidecar));
-            JSONObject meta = (JSONObject) new JSONTokener(
-                new String(bytes, StandardCharsets.UTF_8)).nextValue();
-            if (url.equals(meta.optString("url"))) {
-                return meta;
-            }
+            return UpdateFileUtils.readSmallUtf8(sidecar, MAX_SIDECAR_BYTES);
         } catch (Throwable e) {
-            // A corrupt sidecar simply means "cannot resume".
+            return "";
         }
-        return null;
     }
 
-    private void writeResumeMeta(
-        File sidecar, String url, Response response, JSONObject previousMeta, long total
-    ) {
+    private static void writeSidecarText(File sidecar, String text) {
         try {
-            JSONObject meta = new JSONObject();
-            meta.put("url", url);
-            String etag = response.header("ETag");
-            String lastModified = response.header("Last-Modified");
-            if (etag == null && previousMeta != null) {
-                etag = previousMeta.optString("etag", null);
-            }
-            if (lastModified == null && previousMeta != null) {
-                lastModified = previousMeta.optString("lastModified", null);
-            }
-            if (etag != null) {
-                meta.put("etag", etag);
-            }
-            if (lastModified != null) {
-                meta.put("lastModified", lastModified);
-            }
-            if (total > 0) {
-                meta.put("total", total);
-            }
             UpdateFileUtils.ensureParentDirectory(sidecar);
             try (java.io.FileOutputStream out = new java.io.FileOutputStream(sidecar)) {
-                out.write(meta.toString().getBytes(StandardCharsets.UTF_8));
+                out.write(text.getBytes(StandardCharsets.UTF_8));
             }
         } catch (Throwable e) {
             // Non-fatal: without a sidecar the next attempt starts from zero.
@@ -185,8 +149,21 @@ class DownloadTask implements Runnable {
         }
     }
 
+    // A ResumePlan result; null from the native core means memory ran out.
+    private static JSONObject resumeDecision(String json) throws IOException {
+        if (json == null) {
+            throw new IOException("resume plan failed");
+        }
+        try {
+            return new JSONObject(json);
+        } catch (org.json.JSONException e) {
+            throw new IOException("resume plan failed", e);
+        }
+    }
+
     private void downloadFile() throws IOException {
         this.hash = params.hash;
+        streamedArchiveSha256 = null;
         String url = params.url;
         File writePath = params.targetFile;
         File sidecar = resumeSidecarFile(writePath);
@@ -195,142 +172,114 @@ class DownloadTask implements Runnable {
         // Cross-launch resume (NATIVE_CHECKUPDATE_DESIGN §11.4): a brick gets
         // a few hundred milliseconds per launch plus a bounded crash-rescue
         // window, so every partial byte must survive process death and count.
-        long resumeOffset = 0;
-        JSONObject resumeMeta = readResumeMeta(sidecar, url);
-        if (resumeMeta != null && writePath.isFile() && writePath.length() > 0) {
-            long knownTotal = resumeMeta.optLong("total", 0);
-            long size = writePath.length();
-            if (knownTotal > 0 && size == knownTotal) {
-                // Fully received in a previous attempt (the process died
-                // between download end and unzip): nothing left to transfer.
-                downloadPhaseCompleted = true;
-                postProgress(knownTotal, knownTotal);
-                return;
-            }
-            if (knownTotal <= 0 || size < knownTotal) {
-                resumeOffset = size;
-            }
-        }
-        if (resumeOffset == 0) {
-            if (writePath.exists() && !writePath.delete()) {
-                throw new IOException("Failed to replace existing file: " + writePath);
-            }
-            deleteResumeSidecar(writePath);
+        // What to request is the shared core's decision (ResumePlan).
+        String sidecarText = readSidecarText(sidecar);
+        JSONObject plan = resumeDecision(ResumePlan.planRequest(
+            sidecarText, url, writePath.isFile() ? writePath.length() : 0));
+        String action = plan.optString("action");
+        if ("complete".equals(action)) {
+            // Fully received in a previous attempt (the process died
+            // between download end and unzip): nothing left to transfer.
+            long total = plan.optLong("total");
+            downloadPhaseCompleted = true;
+            postProgress(total, total);
+            return;
         }
-
-        if (!transferArchive(url, writePath, sidecar, resumeMeta, resumeOffset)) {
-            // The server rejected the range for a partial that no longer
-            // matches (416): drop it and retry once from zero.
-            if (writePath.exists() && !writePath.delete()) {
-                throw new IOException("Failed to replace existing file: " + writePath);
-            }
-            deleteResumeSidecar(writePath);
-            if (!transferArchive(url, writePath, sidecar, null, 0)) {
+        long resumeOffset = 0;
+        JSONObject headers = null;
+        if ("resume".equals(action)) {
+            resumeOffset = plan.optLong("offset");
+            headers = plan.optJSONObject("headers");
+        } else {
+            discardPartial(writePath);
+            sidecarText = "";
+        }
+
+        if (!transferArchive(url, writePath, sidecar, sidecarText, resumeOffset, headers)) {
+            // The partial no longer matches what the server serves (a stale
+            // 416, an untrusted range response): drop it and retry once from
+            // zero.
+            discardPartial(writePath);
+            if (!transferArchive(url, writePath, sidecar, "", 0, null)) {
                 throw new IOException("Server rejected the download range for " + url);
             }
         }
         downloadPhaseCompleted = true;
     }
 
+    /** Drops a partial download and its sidecar; throws when the bytes stay. */
+    private static void discardPartial(File archive) throws IOException {
+        if (archive.exists() && !archive.delete()) {
+            throw new IOException("Failed to replace existing file: " + archive);
+        }
+        deleteResumeSidecar(archive);
+    }
+
     /**
      * One HTTP transfer, appending from resumeOffset when the server honours
-     * the range. Returns false only for the retryable stale-partial case
-     * (416 with a size mismatch); throws on every other failure.
+     * the range. Returns false only when the partial must be discarded and the
+     * download retried from zero (ResumePlan's "restart"); throws on every
+     * other failure.
      */
     private boolean transferArchive(
-        String url, File writePath, File sidecar, JSONObject resumeMeta, long resumeOffset
+        String url, File writePath, File sidecar, String sidecarText, long resumeOffset,
+        JSONObject resumeHeaders
     ) throws IOException {
         Request.Builder builder = new Request.Builder().url(url);
-        if (resumeOffset > 0) {
-            // Only resume requests pin the encoding: Range offsets must
-            // address the same bytes that are on disk. Fresh downloads keep
-            // OkHttp's transparent gzip (it decompresses and strips the
-            // headers itself), matching the pre-resume behaviour for servers
-            // that compress regardless.
-            builder.header("Accept-Encoding", "identity");
-            builder.header("Range", "bytes=" + resumeOffset + "-");
-            String validator = null;
-            if (resumeMeta != null) {
-                validator = resumeMeta.optString("etag", null);
-                if (validator == null) {
-                    validator = resumeMeta.optString("lastModified", null);
-                }
-            }
-            if (validator != null) {
-                // With a validator the server falls back to a full 200 when
-                // the file changed instead of appending mismatched bytes.
-                builder.header("If-Range", validator);
+        if (resumeHeaders != null) {
+            // Range, Accept-Encoding: identity and If-Range (ResumePlan).
+            // Fresh downloads send none of them and keep OkHttp's
+            // transparent gzip, which decompresses and strips the headers.
+            java.util.Iterator<String> names = resumeHeaders.keys();
+            while (names.hasNext()) {
+                String name = names.next();
+                builder.header(name, resumeHeaders.optString(name));
             }
         }
 
-        OkHttpClient requestClient = HTTP_CLIENT;
-        if (params.deadlineNanos > 0) {
-            long remainingNanos = params.deadlineNanos - System.nanoTime();
-            if (remainingNanos <= 0) {
-                throw new IOException("Download deadline expired before start");
-            }
-            long remainingMillis = Math.max(
-                1L,
-                java.util.concurrent.TimeUnit.NANOSECONDS.toMillis(remainingNanos)
-            );
-            requestClient = HTTP_CLIENT.newBuilder()
-                .callTimeout(remainingMillis, java.util.concurrent.TimeUnit.MILLISECONDS)
-                .build();
-        }
-
-        Call call = requestClient.newCall(builder.build());
+        Call call = HttpClients.withDeadline(HTTP_CLIENT, params.deadlineNanos)
+            .newCall(builder.build());
         // Registered so an orchestrated phase timeout can cancel it
         // (CODE_AUDIT 2.12); cleared once the transfer is over.
         params.attachCall(call);
         try (Response response = call.execute()) {
-            rejectProtocolDowngrade(url, response);
-            if (response.code() == 416) {
-                long total = resumeMeta == null ? 0 : resumeMeta.optLong("total", 0);
-                if (total > 0 && writePath.length() == total) {
-                    // The partial is actually the complete file.
-                    postProgress(total, total);
-                    return true;
-                }
+            HttpClients.rejectProtocolDowngrade(url, response);
+            ResponseBody body = response.body();
+            long contentLength = body == null ? -1 : body.contentLength();
+            // The Content-Encoding header is visible only when the server
+            // encoded the body itself (OkHttp strips it when it transparently
+            // decompresses its own gzip).
+            JSONObject decision = resumeDecision(ResumePlan.classifyResponse(
+                response.code(),
+                resumeOffset,
+                response.header("Content-Range"),
+                response.header("Content-Encoding"),
+                contentLength,
+                sidecarText,
+                url,
+                writePath.isFile() ? writePath.length() : 0));
+            String action = decision.optString("action");
+            if ("complete".equals(action)) {
+                // The partial is actually the complete file.
+                long total = decision.optLong("total");
+                postProgress(total, total);
+                return true;
+            }
+            if ("restart".equals(action)) {
                 return false;
             }
-            if (!response.isSuccessful()) {
+            if (!"write".equals(action)) {
+                // The partial and its sidecar stay: that is the resume state.
                 throw new IOException("Server error: " + response.code() + " " + response.message());
             }
-
-            ResponseBody body = response.body();
             if (body == null) {
                 throw new IOException("Empty response body for " + url);
             }
 
-            String contentEncoding = response.header("Content-Encoding");
-            // Visible only when the server encoded the body itself (OkHttp
-            // strips the header when it transparently decompresses its own
-            // gzip). Byte offsets in an encoded representation do not match
-            // the decoded bytes on disk, so resume is off the table.
-            boolean encodedBody = contentEncoding != null
-                && !contentEncoding.equalsIgnoreCase("identity");
-            boolean append = response.code() == 206 && resumeOffset > 0;
-            if (append && encodedBody) {
-                // The server ignored Accept-Encoding: identity on a range
-                // request; the appended bytes could not be trusted.
-                return false;
-            }
-            long baseOffset = append ? resumeOffset : 0;
-            long contentLength = body.contentLength();
-            long totalAll;
-            if (append) {
-                totalAll = HttpUtils.parseContentRange(
-                    response.header("Content-Range"), resumeOffset);
-                if (totalAll < 0) {
-                    // Malformed or mismatched Content-Range: treat like a
-                    // stale partial (one clean retry from zero) instead of
-                    // failing — a throw would keep the partial and hit the
-                    // same wall on every future attempt.
-                    return false;
-                }
-            } else {
-                totalAll = contentLength > 0 ? contentLength : 0;
-            }
+            boolean append = decision.optBoolean("append");
+            long baseOffset = decision.optLong("base");
+            long totalAll = decision.optLong("total");
+            boolean encodedBody = decision.optBoolean("encoded");
             if (totalAll > ArchiveLimits.MAX_ARCHIVE_BYTES) {
                 throw new IOException("archive too large: " + totalAll + " bytes");
             }
@@ -340,16 +289,17 @@ class DownloadTask implements Runnable {
                 // Destroy the old bytes before the sidecar can vouch for
                 // them with the new validators (a crash between the two
                 // writes must never leave a sidecar describing stale bytes).
-                if (writePath.exists() && !writePath.delete()) {
-                    throw new IOException("Failed to replace existing file: " + writePath);
-                }
+                discardPartial(writePath);
             }
-            if (encodedBody) {
+            String etag = response.header("ETag");
+            String lastModified = response.header("Last-Modified");
+            if (decision.optBoolean("persistSidecar")) {
+                // Persist before streaming so a mid-stream crash can resume.
+                writeSidecarText(sidecar,
+                    ResumePlan.sidecar(url, etag, lastModified, sidecarText, totalAll));
+            } else {
                 // No resume across an encoded transfer.
                 deleteResumeSidecar(writePath);
-            } else {
-                // Persist before streaming so a mid-stream crash can resume.
-                writeResumeMeta(sidecar, url, response, resumeMeta, totalAll);
             }
 
             long bytesRead;
@@ -358,25 +308,34 @@ class DownloadTask implements Runnable {
             long lastPostedBytes = baseOffset;
             // Unknown length: the response-time check could only reserve the
             // margin, so the disk is probed before any write that would run
-            // past the bytes reserved so far, each probe reserving at least
-            // the next PROBE bytes (more when one chunk is larger) — no write
-            // can ever eat into the margin (the archive cap alone is far more
-            // than the margin). A throw keeps the partial for a later attempt.
+            // past the bytes reserved so far (the shared probe plan,
+            // ArchiveLimits.planFreeSpaceProbe) — no write can ever eat into
+            // the margin. A throw keeps the partial for a later attempt.
             long freeSpaceReservedUntil = 0;
 
+            // The archive digest is computed as the bytes reach the file, so
+            // the install does not re-read the whole archive afterwards.
+            MessageDigest digest = UpdateFileUtils.newSha256();
+            if (append) {
+                UpdateFileUtils.updateDigest(digest, writePath);
+            }
             try (
                 BufferedSource source = body.source();
-                BufferedSink sink = Okio.buffer(
-                    append ? Okio.appendingSink(writePath) : Okio.sink(writePath))
+                BufferedSink sink = Okio.buffer(Okio.sink(new DigestOutputStream(
+                    new FileOutputStream(writePath, append), digest)))
             ) {
-                while ((bytesRead = source.read(sink.buffer(), DOWNLOAD_CHUNK_SIZE)) != -1) {
+                while ((bytesRead = source.read(sink.buffer(), UpdateFileUtils.BUFFER_SIZE)) != -1) {
+                    // A known length was reserved up front: no per-chunk plan
+                    // (and no JNI round trip on this hot loop).
+                    long[] probe = totalAll > 0 ? null : ArchiveLimits.planFreeSpaceProbe(
+                        totalAll, received, bytesRead, freeSpaceReservedUntil);
                     received += bytesRead;
-                    if (totalAll <= 0 && received > freeSpaceReservedUntil) {
-                        long reserve = Math.max(
-                            ArchiveLimits.UNKNOWN_LENGTH_FREE_SPACE_PROBE_BYTES, bytesRead);
-                        freeSpaceReservedUntil = received - bytesRead + reserve;
+                    if (probe != null) {
+                        freeSpaceReservedUntil = probe[1];
+                    }
+                    if (probe != null && probe[0] > 0) {
                         try {
-                            ArchiveLimits.ensureFreeSpace(writePath, reserve);
+                            ArchiveLimits.ensureFreeSpace(writePath, probe[0]);
                         } catch (IOException e) {
                             // The chunk is still only buffered; closing the
                             // sink would flush it onto the disk that just
@@ -385,7 +344,9 @@ class DownloadTask implements Runnable {
                             throw e;
                         }
                     }
-                    sink.emit();
+                    // Write whole segments only: a 64KB read no longer costs
+                    // a write() syscall per partially filled segment.
+                    sink.emitCompleteSegments();
 
                     long overall = baseOffset + received;
                     if (overall > ArchiveLimits.MAX_ARCHIVE_BYTES) {
@@ -415,6 +376,15 @@ class DownloadTask implements Runnable {
                 throw new IOException("Download incomplete: expected " + totalAll
                     + " bytes, got " + writePath.length());
             }
+            if (!encodedBody) {
+                // Refresh with the final size: a length unknown up front
+                // (chunked) left the sidecar without a total, so a process
+                // dying between download end and unzip would otherwise
+                // download the whole archive again.
+                writeSidecarText(sidecar, ResumePlan.sidecar(
+                    url, etag, lastModified, sidecarText, writePath.length()));
+            }
+            streamedArchiveSha256 = UpdateFileUtils.toHex(digest.digest());
             // Final progress event, skipped when the loop already posted this
             // exact value (known length reaching 100% posts it in-loop).
             if (baseOffset + received != lastPostedBytes) {
@@ -426,136 +396,51 @@ class DownloadTask implements Runnable {
         return true;
     }
 
-    private byte[] readBytes(InputStream input) throws IOException {
-        return readBytes(input, Long.MAX_VALUE);
-    }
-
-    private byte[] readBytes(InputStream input, long maxBytes) throws IOException {
-        try (
-            InputStream in = input;
-            ByteArrayOutputStream out = new ByteArrayOutputStream()
-        ) {
-            int count;
-            long total = 0;
-            while ((count = in.read(buffer)) != -1) {
-                total += count;
-                if (total > maxBytes) {
-                    throw new IOException("content exceeds " + maxBytes + " bytes");
-                }
-                out.write(buffer, 0, count);
-            }
-            return out.toByteArray();
-        }
-    }
-
-    private void appendManifestEntries(
-        JSONObject manifest,
-        ArrayList<String> copyFroms,
-        ArrayList<String> copyTos,
-        ArrayList<String> deletes,
-        HashMap<String, Long> copyCrcs
-    ) throws JSONException {
-        JSONObject copiesCrc = manifest.optJSONObject("copiesCrc");
-
-        JSONObject copies = manifest.optJSONObject("copies");
-        if (copies != null) {
-            Iterator<?> keys = copies.keys();
-            while (keys.hasNext()) {
-                String to = (String) keys.next();
-                String from = copies.getString(to);
-                if (from.isEmpty()) {
-                    from = to;
-                }
-                copyFroms.add(from);
-                copyTos.add(to);
-                if (copiesCrc != null && copyCrcs != null && copiesCrc.has(to)) {
-                    // Same content => same crc, so grouping multiple "to" under
-                    // one "from" stays consistent.
-                    copyCrcs.put(from, copiesCrc.getLong(to));
-                }
-            }
-        }
-
-        JSONObject deleteMap = manifest.optJSONObject("deletes");
-        if (deleteMap != null) {
-            Iterator<?> deleteKeys = deleteMap.keys();
-            while (deleteKeys.hasNext()) {
-                deletes.add((String) deleteKeys.next());
-            }
-        }
-    }
-
     private void copyBundledAssetToFile(String assetName, File destination) throws IOException {
         try (InputStream in = context.getAssets().open(assetName)) {
             UpdateFileUtils.copyInputStreamToFile(in, destination);
         }
     }
 
-    private HashMap<String, ArrayList<File>> buildCopyList(
-        File unzipDirectory,
-        CopyGroupResult[] groups
-    ) throws IOException {
-        HashMap<String, ArrayList<File>> copyList = new HashMap<String, ArrayList<File>>();
-        if (groups == null) {
-            return copyList;
-        }
-
-        String rootPath = unzipDirectory.getCanonicalPath() + File.separator;
-        for (CopyGroupResult group : groups) {
-            ArrayList<File> targets = new ArrayList<File>();
-            if (group.toPaths != null) {
-                for (String to : group.toPaths) {
-                    File toFile = new File(unzipDirectory, to);
-                    String canonicalPath = toFile.getCanonicalPath();
-                    if (!canonicalPath.startsWith(rootPath)) {
-                        throw new SecurityException("Illegal name: " + to);
-                    }
-                    targets.add(toFile);
-                }
-            }
-            copyList.put(group.from, targets);
-        }
-
-        return copyList;
-    }
-
     private PatchArchiveContents extractPatchArchive(File archiveFile, File unzipDirectory)
-        throws IOException, JSONException {
+        throws IOException {
         UpdateFileUtils.removeDirectory(unzipDirectory);
         UpdateFileUtils.ensureDirectory(unzipDirectory);
 
-        PatchArchiveContents contents = new PatchArchiveContents();
+        ArrayList<String> entryNames = new ArrayList<String>();
+        byte[] manifestJson = new byte[0];
         try (SafeZipFile zipFile = new SafeZipFile(archiveFile)) {
             ensureArchiveWithinLimits(archiveFile, zipFile, unzipDirectory);
             Enumeration<? extends ZipEntry> entries = zipFile.entries();
             while (entries.hasMoreElements()) {
                 ZipEntry entry = entries.nextElement();
                 String name = entry.getName();
-                contents.entryNames.add(name);
+                entryNames.add(name);
 
                 if (name.equals("__diff.json")) {
                     if (entry.getSize() > ArchiveLimits.MAX_MANIFEST_BYTES) {
                         throw new IOException("delta manifest too large: " + entry.getSize());
                     }
-                    byte[] bytes = readBytes(
+                    manifestJson = UpdateFileUtils.readBytes(
                         zipFile.getInputStream(entry), ArchiveLimits.MAX_MANIFEST_BYTES);
-                    String json = new String(bytes, StandardCharsets.UTF_8);
-                    JSONObject manifest = (JSONObject) new JSONTokener(json).nextValue();
-                    appendManifestEntries(
-                        manifest,
-                        contents.copyFroms,
-                        contents.copyTos,
-                        contents.deletes,
-                        contents.copyCrcs
-                    );
-                    contents.hbcTransform = manifest.optJSONObject("hbcTransform");
                     continue;
                 }
 
                 zipFile.unzipToPath(entry, unzipDirectory);
             }
         }
-        return contents;
+        return new PatchArchiveContents(entryNames, manifestJson);
+    }
+
+    /**
+     * Shared first half of the two patch tasks: download the archive and
+     * unpack it into the staging directory. The native applyArchiveDelta
+     * validates what it declared.
+     */
+    private PatchArchiveContents stagePatchArchive() throws IOException {
+        downloadFile();
+        artifactSha256 = archiveSha256();
+        return extractPatchArchive(params.targetFile, stagingDirectory());
     }
 
     private void doFullPatch() throws IOException {
@@ -564,25 +449,44 @@ class DownloadTask implements Runnable {
         File work = stagingDirectory();
         UpdateFileUtils.removeDirectory(work);
         UpdateFileUtils.ensureDirectory(work);
-        artifactSha256 = UpdateFileUtils.sha256Hex(params.targetFile);
-
+        artifactSha256 = archiveSha256();
+
+        // The bundle's digest (for the install record) is taken from the
+        // bytes as they are extracted, instead of re-reading the bundle right
+        // after. Any entry resolving to the bundle path counts; the last write
+        // wins on disk and in the digest alike.
+        File bundleTarget = InstallRecord.bundleFile(work).getCanonicalFile();
+        stagedBundleSha256 = null;
         try (SafeZipFile zipFile = new SafeZipFile(params.targetFile)) {
             ensureArchiveWithinLimits(params.targetFile, zipFile, work);
             Enumeration<? extends ZipEntry> entries = zipFile.entries();
             while (entries.hasMoreElements()) {
-                zipFile.unzipToPath(entries.nextElement(), work);
+                ZipEntry entry = entries.nextElement();
+                if (!entry.isDirectory()
+                    && new File(work, entry.getName()).getCanonicalFile().equals(bundleTarget)) {
+                    MessageDigest digest = UpdateFileUtils.newSha256();
+                    zipFile.unzipToPath(entry, work, digest);
+                    stagedBundleSha256 = UpdateFileUtils.toHex(digest.digest());
+                } else {
+                    zipFile.unzipToPath(entry, work);
+                }
             }
         }
 
         deleteConsumedArchive();
     }
 
+    private String archiveSha256() throws IOException {
+        return streamedArchiveSha256 != null
+            ? streamedArchiveSha256 : UpdateFileUtils.sha256Hex(params.targetFile);
+    }
+
     /**
      * Last step of a successful patch task: the completion record (with the
      * final bundle's digest) goes into the staging directory, which is then
      * renamed over the version directory in one atomic step.
      */
-    private void promoteStaging() throws IOException, JSONException {
+    private void promoteStaging() throws IOException {
         File work = stagingDirectory();
         if (targetsRunningVersion()) {
             // The process switched to this very version while the task ran
@@ -592,25 +496,11 @@ class DownloadTask implements Runnable {
             UpdateFileUtils.removeDirectory(work);
             return;
         }
-        File bundle = new File(work, "index.bundlejs");
-        if (!bundle.isFile()) {
-            throw new IOException("bundle missing after install: " + bundle);
-        }
-        String bundleSha256 = UpdateFileUtils.sha256Hex(bundle);
-        InstallRecord.write(
-            work, InstallRecord.build(params.hash, bundleSha256, artifactSha256));
+        InstallRecord.seal(work, params.hash, artifactSha256, stagedBundleSha256);
         if (params.unzipDirectory.exists()) {
             UpdateFileUtils.removeDirectory(params.unzipDirectory);
         }
-        if (!work.renameTo(params.unzipDirectory)) {
-            throw new IOException("failed to promote staging directory to " + params.unzipDirectory);
-        }
-        // The rename rewrote the versions root's entries; the record's own
-        // directory was synced by InstallRecord.write, the root was not.
-        File versionsRoot = params.unzipDirectory.getParentFile();
-        if (versionsRoot != null) {
-            InstallRecord.syncDirectory(versionsRoot);
-        }
+        InstallRecord.promote(work, params.unzipDirectory);
     }
 
     /**
@@ -626,8 +516,7 @@ class DownloadTask implements Runnable {
         if (archiveBytes > ArchiveLimits.MAX_ARCHIVE_BYTES) {
             throw new IOException("archive too large: " + archiveBytes + " bytes");
         }
-        SafeZipFile.Inspection inspection = zipFile.inspect();
-        ArchiveLimits.ensureFreeSpace(unzipDirectory, inspection.totalUncompressed);
+        ArchiveLimits.ensureFreeSpace(unzipDirectory, zipFile.inspect(archiveBytes));
     }
 
     // The archive and its resume sidecar live and die together: once the
@@ -640,96 +529,78 @@ class DownloadTask implements Runnable {
         deleteResumeSidecar(params.targetFile);
     }
 
-    private void doPatchFromApk() throws IOException, JSONException {
-        downloadFile();
+    private void doPatchFromApk() throws IOException {
+        PatchArchiveContents contents = stagePatchArchive();
         File work = stagingDirectory();
-        artifactSha256 = UpdateFileUtils.sha256Hex(params.targetFile);
-        PatchArchiveContents contents = extractPatchArchive(params.targetFile, work);
-
-        buildArchivePlan(
-            DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK,
-            contents.entryNames.toArray(new String[0]),
-            contents.copyFroms.toArray(new String[0]),
-            contents.copyTos.toArray(new String[0]),
-            contents.deletes.toArray(new String[0])
-        );
-
-        HashMap<String, ArrayList<File>> copyList = buildCopyList(
-            work,
-            buildCopyGroups(
-                contents.copyFroms.toArray(new String[0]),
-                contents.copyTos.toArray(new String[0])
-            )
-        );
 
         File originBundleFile = new File(work, ".origin.bundle");
         copyBundledAssetToFile("index.android.bundle", originBundleFile);
+        CopyGroupResult[] copies;
         try {
-            applyDeltaFromSource(
+            // The APK's resources are zip entries, not files: the core
+            // rebuilds the bundle and hands the manifest copies back.
+            copies = applyArchiveDelta(
+                DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK,
+                contents.entryNames,
+                contents.manifestJson,
                 work.getAbsolutePath(),
                 work.getAbsolutePath(),
                 originBundleFile.getAbsolutePath(),
                 new File(work, BUNDLE_DELTA_ENTRY).getAbsolutePath(),
-                new File(work, "index.bundlejs").getAbsolutePath(),
-                "",
-                false,
-                new String[0],
-                new String[0],
-                new String[0],
-                contents.hbcTransformMetaFor(BUNDLE_DELTA_ENTRY)
+                InstallRecord.bundleFile(work).getAbsolutePath(),
+                true
             );
         } finally {
             originBundleFile.delete();
         }
 
-        bundledResourceCopier.copyFromResource(copyList, contents.copyCrcs);
+        bundledResourceCopier.copyFromResource(work, copies);
         deleteConsumedArchive();
     }
 
-    private void doPatchFromPpk() throws IOException, JSONException {
-        downloadFile();
+    private void doPatchFromPpk() throws IOException {
+        PatchArchiveContents contents = stagePatchArchive();
         File work = stagingDirectory();
-        artifactSha256 = UpdateFileUtils.sha256Hex(params.targetFile);
-        PatchArchiveContents contents = extractPatchArchive(params.targetFile, work);
-
-        ArchivePatchPlanResult plan = buildArchivePlan(
+        applyArchiveDelta(
             DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK,
-            contents.entryNames.toArray(new String[0]),
-            contents.copyFroms.toArray(new String[0]),
-            contents.copyTos.toArray(new String[0]),
-            contents.deletes.toArray(new String[0])
-        );
-
-        applyDeltaFromSource(
+            contents.entryNames,
+            contents.manifestJson,
             params.originDirectory.getAbsolutePath(),
             work.getAbsolutePath(),
-            new File(params.originDirectory, "index.bundlejs").getAbsolutePath(),
+            InstallRecord.bundleFile(params.originDirectory).getAbsolutePath(),
             new File(work, BUNDLE_DELTA_ENTRY).getAbsolutePath(),
-            new File(work, "index.bundlejs").getAbsolutePath(),
-            plan.mergeSourceSubdir,
-            plan.enableMerge,
-            contents.copyFroms.toArray(new String[0]),
-            contents.copyTos.toArray(new String[0]),
-            contents.deletes.toArray(new String[0]),
-            contents.hbcTransformMetaFor(BUNDLE_DELTA_ENTRY)
+            InstallRecord.bundleFile(work).getAbsolutePath(),
+            false
         );
         deleteConsumedArchive();
     }
 
+    // Dot-named, so the selection under the versions root never picks it.
+    static final String TRASH_DIR_NAME = ".trash";
+
     private void doCleanUp() {
-        UpdateContext.getInstance(context).runCleanupWithLatestState(
-            new UpdateContext.CleanupAction() {
-                @Override
-                public void run(String keepCurrent, String keepPrevious) {
-                    cleanupOldEntries(
-                        params.unzipDirectory.getAbsolutePath(),
-                        keepCurrent,
-                        keepPrevious,
-                        params.maxAgeDays
-                    );
-                }
+        final File trash = new File(params.unzipDirectory, TRASH_DIR_NAME);
+        // Phase 1, under the version-files lock: only renames doomed entries
+        // into the trash, so activation is never blocked behind a recursive
+        // delete of several version directories.
+        UpdateContext.getInstance(context).runCleanupWithLatestState(keepNames ->
+            cleanupOldEntries(
+                params.unzipDirectory.getAbsolutePath(),
+                keepNames,
+                params.maxAgeDays,
+                trash.getAbsolutePath()
+            ));
+        // Phase 2, lock released: nothing in the trash is reachable as a
+        // version any more. Also purges leftovers of an interrupted run.
+        // Best effort: phase 1 already succeeded, and a leftover the native
+        // delete cannot remove must not fail every later cleanup task.
+        if (trash.isDirectory()) {
+            try {
+                cleanupOldEntries(trash.getAbsolutePath(), new String[0], 0, null);
+            } catch (RuntimeException e) {
+                Log.w(Texts.LOG_TAG, "Failed to purge cleanup trash", e);
             }
-        );
+        }
     }
 
     private void cleanUpAfterFailure(int taskType) {
@@ -753,37 +624,13 @@ class DownloadTask implements Runnable {
                 }
                 break;
             case DownloadTaskParams.TASK_TYPE_PLAIN_DOWNLOAD:
-                if (
-                    params.targetFile.exists()
-                        && !params.targetFile.delete()
-                        && UpdateContext.DEBUG
-                ) {
-                    Log.w(Texts.LOG_TAG, "Failed to clean partial download " + params.targetFile);
-                }
-                deleteResumeSidecar(params.targetFile);
+                deleteConsumedArchive();
                 break;
             default:
                 break;
         }
     }
 
-    /**
-     * An https artifact URL must stay on https through every redirect: the
-     * package is the supply-chain boundary and TLS is what authenticates
-     * it. OkHttp follows cross-scheme redirects by default, so the final
-     * request is checked here (the redirected bytes are discarded).
-     */
-    static void rejectProtocolDowngrade(String requestedUrl, Response response)
-        throws IOException {
-        if (requestedUrl != null
-            && requestedUrl.regionMatches(true, 0, "https:", 0, 6)
-            && !response.request().url().isHttps()) {
-            throw new IOException(
-                "https download redirected to plaintext http: "
-                    + response.request().url());
-        }
-    }
-
     private boolean isPatchTask(int taskType) {
         return taskType == DownloadTaskParams.TASK_TYPE_PATCH_FULL
             || taskType == DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK
@@ -793,8 +640,7 @@ class DownloadTask implements Runnable {
     private boolean hasCompletedDeltaDirectory() {
         return params.unzipDirectory != null
             && params.hash != null
-            && new File(params.unzipDirectory, "index.bundlejs").isFile()
-            && InstallRecord.isComplete(params.unzipDirectory, params.hash);
+            && InstallRecord.isInstalled(params.unzipDirectory, params.hash);
     }
 
     // True when this task targets the version the process is running from.
@@ -813,18 +659,12 @@ class DownloadTask implements Runnable {
      * failure rather than overwritten.
      */
     private void ensureNotReinstallingRunningVersion() throws IOException {
-        File bundle = new File(params.unzipDirectory, "index.bundlejs");
-        if (bundle.isFile() && InstallRecord.isComplete(params.unzipDirectory, params.hash)) {
-            try {
-                InstallRecord.verifyForActivation(params.unzipDirectory, params.hash, bundle);
-                return;
-            } catch (IOException e) {
-                throw new FileOperationException("Running version " + params.hash
-                    + " cannot be reinstalled in place: " + e.getMessage());
-            }
+        try {
+            InstallRecord.verifyInstalled(params.unzipDirectory, params.hash, false);
+        } catch (IOException e) {
+            throw new FileOperationException("Running version " + params.hash
+                + " cannot be reinstalled in place: " + e.getMessage());
         }
-        throw new FileOperationException("Running version " + params.hash
-            + " has no verifiable install record and cannot be reinstalled in place");
     }
 
     @Override
@@ -917,37 +757,29 @@ class DownloadTask implements Runnable {
         }
     }
 
-    private static native void applyDeltaFromSource(
+    // The native half of a patch install (cpp/patch_core/archive_patch_core.h
+    // ApplyArchivePatch): checks the archive's entries, parses and validates
+    // manifestJson (__diff.json), rebuilds the bundle and, unless
+    // hostCopiesResources, performs the copies, deletes and merge. Returns
+    // the copies the caller still owes (empty unless hostCopiesResources).
+    private static native CopyGroupResult[] applyArchiveDelta(
+        int patchType,
+        String[] entryNames,
+        byte[] manifestJson,
         String sourceRoot,
         String targetRoot,
         String originBundlePath,
         String bundlePatchPath,
         String bundleOutputPath,
-        String mergeSourceSubdir,
-        boolean enableMerge,
-        String[] copyFroms,
-        String[] copyTos,
-        String[] deletes,
-        String hbcTransformMeta
+        boolean hostCopiesResources
     );
 
+    // trashDir non-empty: move the selected entries there instead of
+    // deleting them (see doCleanUp).
     private static native void cleanupOldEntries(
         String rootDir,
-        String keepCurrent,
-        String keepPrevious,
-        int maxAgeDays
-    );
-
-    private static native ArchivePatchPlanResult buildArchivePlan(
-        int patchType,
-        String[] entryNames,
-        String[] copyFroms,
-        String[] copyTos,
-        String[] deletes
-    );
-
-    private static native CopyGroupResult[] buildCopyGroups(
-        String[] copyFroms,
-        String[] copyTos
+        String[] keepNames,
+        int maxAgeDays,
+        String trashDir
     );
 }