react-native-update 10.59.2 → 10.61.0

package/android/src/main/java/cn/reactnative/modules/update/DownloadTaskParams.java

@@ -8,18 +8,22 @@ import java.io.File;
 class DownloadTaskParams {
     static final int TASK_TYPE_CLEANUP          = 0; //Keep hash & originHash
 
-    static final int TASK_TYPE_PATCH_FULL       = 1;
-    static final int TASK_TYPE_PATCH_FROM_APK   = 2;
-    static final int TASK_TYPE_PATCH_FROM_PPK   = 3;
+    // <generated:archive-patch-types> (scripts/contract.ts; bun scripts/generate-contract.ts)
+    static final int TASK_TYPE_PATCH_FULL = 1;
+    static final int TASK_TYPE_PATCH_FROM_APK = 2;
+    static final int TASK_TYPE_PATCH_FROM_PPK = 3;
+    // </generated:archive-patch-types>
     static final int TASK_TYPE_PLAIN_DOWNLOAD   = 4;
 
+    static final int DEFAULT_MAX_AGE_DAYS = 3;
+
 
     int         type;
     String      url;
     String      hash;
     String      originHash;
     // TASK_TYPE_CLEANUP only: entries younger than this survive; 0 = delete all
-    int         maxAgeDays = 3;
+    int         maxAgeDays = DEFAULT_MAX_AGE_DAYS;
     // Absolute System.nanoTime deadline for orchestrated cold-start downloads;
     // 0 keeps the normal public API's 10-minute per-call timeout.
     long        deadlineNanos;

package/android/src/main/java/cn/reactnative/modules/update/ErrorCodes.java

@@ -4,11 +4,12 @@ package cn.reactnative.modules.update;
  * Stable, machine-readable error codes used as the promise rejection code so
  * the JS layer and user loggers can aggregate errors across platforms.
  *
- * MUST stay in sync with cpp/patch_core/error_codes.h (the single source of
- * truth) and src/error.ts (UpdateErrorCode). Messages are free-form; only the
- * codes are part of the contract.
+ * The codes of cpp/patch_core/error_codes.h and src/error.ts
+ * (UpdateErrorCode), all generated from scripts/contract.ts. Messages are
+ * free-form; only the codes are part of the contract.
  */
 final class ErrorCodes {
+    // <generated:error-codes> (scripts/contract.ts; bun scripts/generate-contract.ts)
     static final String INVALID_OPTIONS = "INVALID_OPTIONS";
     static final String DOWNLOAD_FAILED = "DOWNLOAD_FAILED";
     // Encoded (see Texts.reveal): the value is "PATCH_FAILED".
@@ -22,7 +23,35 @@ final class ErrorCodes {
     static final String UNSUPPORTED_PLATFORM = "UNSUPPORTED_PLATFORM";
     static final String APK_INSTALL_PERMISSION_REQUIRED = "APK_INSTALL_PERMISSION_REQUIRED";
     static final String APK_INSTALL_FAILED = "APK_INSTALL_FAILED";
+    // </generated:error-codes>
 
     private ErrorCodes() {
     }
+
+    /**
+     * Rejection code of a failed download task, from DownloadTask's
+     * classification: post-download failures (unzip / hdiff / resource copy,
+     * incl. copiesCrc verification) are PATCH_FAILED so telemetry can
+     * separate patch health from network health; a local refusal
+     * (reinstalling the running version in place) is FILE_OPERATION_FAILED.
+     */
+    static String forDownloadFailure(Throwable error) {
+        if (error instanceof PatchFailedException) {
+            return DELTA_FAILED;
+        }
+        if (error instanceof FileOperationException) {
+            return FILE_OPERATION_FAILED;
+        }
+        return DOWNLOAD_FAILED;
+    }
+
+    /**
+     * Whether another mirror of the same artifact can change the outcome
+     * (mirrors update_flow_core::IsMirrorRetryableCode and the JS
+     * isMirrorRetryableCode). A patch failure cannot: the bytes arrived and
+     * every mirror serves the same artifact.
+     */
+    static boolean isMirrorRetryable(String code) {
+        return !DELTA_FAILED.equals(code);
+    }
 }

package/android/src/main/java/cn/reactnative/modules/update/FileOperationException.java

@@ -6,7 +6,7 @@ import java.io.IOException;
  * A download task refused by a local file-system rule rather than by the
  * network or the patch itself — today: reinstalling the version this process
  * is running from in place (DownloadTask.ensureNotReinstallingRunningVersion).
- * UpdateModuleImpl rejects these with FILE_OPERATION_FAILED.
+ * UpdateModule rejects these with FILE_OPERATION_FAILED.
  */
 class FileOperationException extends IOException {
     FileOperationException(String message) {

package/android/src/main/java/cn/reactnative/modules/update/FlowBridge.java

@@ -7,19 +7,50 @@ package cn.reactnative.modules.update;
  * A null return means the input did not parse; callers skip the check round.
  */
 final class FlowBridge {
-    static {
-        NativeCore.ensureLoaded();
-    }
-
     private FlowBridge() {
     }
 
-    static native String buildRequestBody(String inputJson);
+    // The cold-start round (cpp/update_flow_core/native_round.h), shared with
+    // iOS and Harmony. envJson describes this launch (see native_round.h).
 
-    static native String orderEndpointCandidates(String endpointsJson, double randomSample);
+    /** {"body": request text, "query": first query state}; null when not runnable. */
+    static native String prepareRound(String configJson, String envJson, double randomSample);
 
-    static native boolean isValidResponse(String responseText);
+    /**
+     * The next endpoint-query state: "url" (+ "post") to request next,
+     * "found" when the text passed in is the response, neither when the
+     * query is over. responseText is null for a failed (or no) request.
+     */
+    static native String nextQueryStep(String stateJson, String responseText);
 
+    /**
+     * One step of the round driver (cpp/update_flow_core/round_engine.h):
+     * {"state", "commands"} for the previous state (null to start) and the
+     * event. Null only when the core threw.
+     */
+    static native String stepRound(String stateJson, String eventJson);
+
+    /** The decision with planned attempts, hashInfo and the response-cache text. */
     static native String handleResponse(
-        String responseText, String identityJson, String afterDownload);
+        String responseText, String configJson, String envJson, String requestBody,
+        long responseAtSeconds);
+
+    // Persisted-config layer (cpp/update_flow_core/native_config.h), shared
+    // with iOS and Harmony.
+
+    /** Contract C1: same config in another serialization. Null is never equivalent. */
+    static native boolean configsEquivalent(String a, String b);
+
+    /**
+     * The run gate: {"appKey": trimmed} when the config may run a round,
+     * otherwise {"status", "reason"}. Null config text = not configured.
+     */
+    static native String runnableConfig(String configJson);
+
+    /**
+     * Validates host configure() options (a JSON object) into the config to
+     * persist. Throws IllegalArgumentException("Invalid native configuration:
+     * ...") for options the host must fix.
+     */
+    static native String normalizeConfiguration(String optionsJson);
 }

package/android/src/main/java/cn/reactnative/modules/update/HttpClients.java

@@ -0,0 +1,63 @@
+package cn.reactnative.modules.update;
+
+import java.io.IOException;
+import java.util.concurrent.TimeUnit;
+import okhttp3.OkHttpClient;
+import okhttp3.Response;
+
+/**
+ * The one OkHttpClient the SDK owns. Callers derive their timeout variants
+ * with newBuilder(), which shares the connection pool and dispatcher threads
+ * instead of each client growing its own.
+ */
+final class HttpClients {
+    private HttpClients() {
+    }
+
+    private static final class Holder {
+        static final OkHttpClient BASE = new OkHttpClient();
+    }
+
+    static OkHttpClient base() {
+        return Holder.BASE;
+    }
+
+    /**
+     * {@code client} with its call timeout capped to the time left until the
+     * absolute System.nanoTime {@code deadlineNanos} (0: no deadline, the
+     * client as is), so an orchestrated request never outlives its budget.
+     * Throws when the deadline already passed.
+     */
+    static OkHttpClient withDeadline(OkHttpClient client, long deadlineNanos)
+        throws IOException {
+        if (deadlineNanos <= 0) {
+            return client;
+        }
+        long remainingNanos = deadlineNanos - System.nanoTime();
+        if (remainingNanos <= 0) {
+            throw new IOException("Request deadline expired before start");
+        }
+        long remainingMillis = Math.max(1L, TimeUnit.NANOSECONDS.toMillis(remainingNanos));
+        int callTimeoutMillis = client.callTimeoutMillis();
+        if (callTimeoutMillis > 0 && callTimeoutMillis <= remainingMillis) {
+            return client;
+        }
+        return client.newBuilder()
+            .callTimeout(remainingMillis, TimeUnit.MILLISECONDS)
+            .build();
+    }
+
+    /**
+     * An https URL must stay on https through every redirect: TLS is what
+     * authenticates the package and the check response. OkHttp follows
+     * cross-scheme redirects by default, so the final request is checked
+     * here (the redirected bytes are discarded).
+     */
+    static void rejectProtocolDowngrade(String requestedUrl, Response response)
+        throws IOException {
+        if (HttpUtils.isHttpsUrl(requestedUrl) && !response.request().url().isHttps()) {
+            throw new IOException(
+                "https request redirected to plaintext http: " + response.request().url());
+        }
+    }
+}

package/android/src/main/java/cn/reactnative/modules/update/HttpUtils.java

@@ -14,49 +14,4 @@ final class HttpUtils {
     static boolean isHttpsUrl(String url) {
         return url != null && url.regionMatches(true, 0, "https://", 0, 8);
     }
-
-    /** Request path appended to an endpoint base, kept out of the plain string table. */
-    static final String QUERY_PATH = Texts.reveal("7514fcd4ad805d55263e08fc99");
-
-    /** Strips every trailing slash so "<base><QUERY_PATH><appKey>" never doubles one. */
-    static String normalizeEndpointBase(String base) {
-        while (base.endsWith("/")) {
-            base = base.substring(0, base.length() - 1);
-        }
-        return base;
-    }
-
-    // "bytes <start>-<end>/<total>". Returns the total (0 when "*"), or -1
-    // when the header is missing/malformed, the start does not match the
-    // local partial, or the range and total contradict each other (end
-    // before start, or a numeric total not beyond the end) — either way the
-    // appended bytes could not be trusted. A total of 0 would otherwise pass
-    // as "unknown" and skip the final size check (RFC 9110 §14.4: the
-    // complete length must exceed the last position).
-    static long parseContentRange(String header, long expectedStart) {
-        if (header == null || !header.startsWith("bytes ")) {
-            return -1;
-        }
-        try {
-            String range = header.substring("bytes ".length()).trim();
-            int slash = range.indexOf('/');
-            int dash = range.indexOf('-');
-            if (slash < 0 || dash < 0 || dash > slash) {
-                return -1;
-            }
-            long start = Long.parseLong(range.substring(0, dash).trim());
-            long end = Long.parseLong(range.substring(dash + 1, slash).trim());
-            if (start != expectedStart || end < start) {
-                return -1;
-            }
-            String totalPart = range.substring(slash + 1).trim();
-            if (totalPart.equals("*")) {
-                return 0;
-            }
-            long total = Long.parseLong(totalPart);
-            return total > end ? total : -1;
-        } catch (NumberFormatException e) {
-            return -1;
-        }
-    }
 }

package/android/src/main/java/cn/reactnative/modules/update/InstallRecord.java

@@ -1,151 +1,103 @@
 package cn.reactnative.modules.update;
 
-import android.os.Build;
-import android.util.Log;
 import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
 import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import org.json.JSONException;
-import org.json.JSONObject;
 
 /**
- * Java mirror of cpp/patch_core/install_record.h — keep in sync by hand.
  * The completion record written as the last step of a two-phase install and
- * read back before a version directory is trusted.
+ * read back before a version directory is trusted. The logic is the shared
+ * core's (cpp/patch_core/install_record.h, over JNI); only the paths are
+ * built here. Every call does file IO and checkActivation hashes the whole
+ * bundle: callers run on worker threads (download tasks, the state serial
+ * thread, the sync coordinator), except the launch-time reads of
+ * isInstalled / recordedBundleSha256, which only stat and read the record.
  */
 final class InstallRecord {
-    static final int SCHEMA = 1;
-    static final String FILE_NAME = ".pushy-complete";
+    // install_record.h kStagingSuffix, generated from scripts/contract.ts.
+    // <generated:staging-suffix> (scripts/contract.ts; bun scripts/generate-contract.ts)
     static final String STAGING_SUFFIX = ".staging";
+    // </generated:staging-suffix>
+    /** The JS bundle inside a version directory. */
+    static final String BUNDLE_FILE_NAME = "index.bundlejs";
 
     private InstallRecord() {
     }
 
-    static File stagingDirectoryFor(File versionDir) {
-        return new File(versionDir.getPath() + STAGING_SUFFIX);
+    static File bundleFile(File versionDir) {
+        return new File(versionDir, BUNDLE_FILE_NAME);
     }
 
-    static String build(String versionHash, String bundleSha256, String artifactSha256)
-        throws JSONException {
-        JSONObject record = new JSONObject();
-        record.put("schema", SCHEMA);
-        record.put("versionHash", versionHash);
-        if (bundleSha256 != null && !bundleSha256.isEmpty()) {
-            record.put("bundleSha256", bundleSha256);
-        }
-        if (artifactSha256 != null && !artifactSha256.isEmpty()) {
-            record.put("artifactSha256", artifactSha256);
-        }
-        return record.toString();
+    static File stagingDirectoryFor(File versionDir) {
+        return new File(versionDir.getPath() + STAGING_SUFFIX);
     }
 
     /**
-     * Writes the record and fsyncs it, then the directory holding it: the
-     * rename that follows must find the record on disk, and the new
-     * directory entry is only durable once the directory itself is synced.
+     * Launch / dedup presence check: the bundle exists and the record names
+     * this version (or is the legacy empty marker). No digest work.
      */
-    static void write(File versionDir, String recordJson) throws IOException {
-        File file = new File(versionDir, FILE_NAME);
-        try (FileOutputStream out = new FileOutputStream(file)) {
-            out.write(recordJson.getBytes(StandardCharsets.UTF_8));
-            out.flush();
-            out.getFD().sync();
-        }
-        syncDirectory(versionDir);
-    }
-
-    // java.nio.file (the only way to open a directory for fsync from Java)
-    // is API 26+ on Android; below that the file fsync above is all there
-    // is. Best-effort by design: a file system that refuses to open a
-    // directory for reading must not fail the install. Also called by the
-    // installer on the versions root after the staging -> version rename:
-    // that rename changes the parent's entries, which only the parent's own
-    // sync makes durable.
-    static void syncDirectory(File dir) {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
-            return;
-        }
-        try (java.nio.channels.FileChannel channel = java.nio.channels.FileChannel.open(
-                dir.toPath(), java.nio.file.StandardOpenOption.READ)) {
-            channel.force(true);
-        } catch (Throwable e) {
-            Log.w("pushy", "Directory fsync skipped for " + dir + ": " + e);
-        }
+    static boolean isInstalled(File versionDir, String versionHash) {
+        return isComplete(versionDir.getPath(), versionHash, BUNDLE_FILE_NAME);
     }
 
     /**
-     * Parsed record, or null when the file is absent or malformed. An empty
-     * file (legacy marker) yields an empty JSONObject.
+     * Activation check: the bundle exists and its bytes match the record's
+     * mandatory digest (the legacy empty marker has none). A directory
+     * without a record passes only when {@code grandfathered} (it is the
+     * persisted current or last version). Throws with the reason otherwise.
      */
-    static JSONObject read(File versionDir) {
-        File file = new File(versionDir, FILE_NAME);
-        if (!file.isFile()) {
-            return null;
-        }
-        if (file.length() == 0) {
-            return new JSONObject();
-        }
-        if (file.length() > 64 * 1024) {
-            return null;
-        }
-        try (FileInputStream in = new FileInputStream(file)) {
-            byte[] bytes = new byte[(int) file.length()];
-            int offset = 0;
-            while (offset < bytes.length) {
-                int read = in.read(bytes, offset, bytes.length - offset);
-                if (read < 0) {
-                    break;
-                }
-                offset += read;
-            }
-            return new JSONObject(new String(bytes, 0, offset, StandardCharsets.UTF_8));
-        } catch (IOException | JSONException e) {
-            return null;
+    static void verifyInstalled(File versionDir, String versionHash, boolean grandfathered)
+        throws IOException {
+        String reason = checkActivation(
+            versionDir.getPath(), versionHash, BUNDLE_FILE_NAME, grandfathered);
+        if (reason != null) {
+            throw new IOException(reason);
         }
     }
 
     /**
-     * Presence check: the record exists and, unless legacy-empty, names this
-     * version. No digest work — this runs on launch / dedup paths.
+     * Writes the record (with the staged bundle's digest: knownBundleSha256
+     * when the bundle was hashed while extracted, else hashed now) into the
+     * staging directory, atomically and durably.
      */
-    static boolean isComplete(File versionDir, String versionHash) {
-        JSONObject record = read(versionDir);
-        if (record == null) {
-            return false;
+    static void seal(
+        File stagingDir, String versionHash, String artifactSha256, String knownBundleSha256
+    ) throws IOException {
+        String reason = sealStaging(stagingDir.getPath(), versionHash, BUNDLE_FILE_NAME,
+            artifactSha256, knownBundleSha256);
+        if (reason != null) {
+            throw new IOException(reason);
         }
-        if (record.length() == 0) {
-            return true;
-        }
-        return record.optInt("schema", 0) == SCHEMA
-            && versionHash.equals(record.optString("versionHash", ""));
     }
 
-    /**
-     * Activation check: re-hashes the bundle when the record carries a digest.
-     * Throws with the reason when the directory must not be activated.
-     */
-    static void verifyForActivation(File versionDir, String versionHash, File bundleFile)
-        throws IOException {
-        JSONObject record = read(versionDir);
-        if (record == null) {
-            throw new IOException("Bundle version " + versionHash + " has no valid completion record.");
-        }
-        if (record.length() == 0) {
-            return;
-        }
-        if (record.optInt("schema", 0) != SCHEMA
-            || !versionHash.equals(record.optString("versionHash", ""))) {
-            throw new IOException("Bundle version " + versionHash + " completion record mismatch.");
-        }
-        String expected = record.optString("bundleSha256", "");
-        if (expected.isEmpty()) {
-            return;
-        }
-        String actual = UpdateFileUtils.sha256Hex(bundleFile);
-        if (!expected.equalsIgnoreCase(actual)) {
-            throw new IOException("Bundle version " + versionHash + " bundle digest mismatch.");
+    /** Renames the sealed staging directory to the (absent) version directory. */
+    static void promote(File stagingDir, File versionDir) throws IOException {
+        String reason = promoteStaging(stagingDir.getPath(), versionDir.getPath());
+        if (reason != null) {
+            throw new IOException(reason);
         }
     }
+
+    /** The record's bundleSha256 (crash attribution); "" when there is none. */
+    static String recordedBundleSha256(File versionDir) {
+        String digest = bundleSha256Of(versionDir.getPath());
+        return digest == null ? "" : digest;
+    }
+
+    private static native boolean isComplete(
+        String versionDir, String versionHash, String bundleFileName);
+
+    // These return null on success, the reason otherwise.
+    private static native String checkActivation(
+        String versionDir, String versionHash, String bundleFileName, boolean grandfathered);
+
+    private static native String sealStaging(
+        String stagingDir,
+        String versionHash,
+        String bundleFileName,
+        String artifactSha256,
+        String knownBundleSha256);
+
+    private static native String promoteStaging(String stagingDir, String versionDir);
+
+    private static native String bundleSha256Of(String versionDir);
 }

package/android/src/main/java/cn/reactnative/modules/update/NativeCore.java

@@ -1,5 +1,14 @@
 package cn.reactnative.modules.update;
 
+/**
+ * Loads librnpushy.so. Its JNI_OnLoad registers the natives of every class
+ * (cpp/android_jni/jni_registration.cpp), so the library only has to be
+ * loaded before the first native call: UpdateContext's static initializer
+ * does that, and DownloadTask, FlowBridge, InstallRecord and
+ * supportedDiffVersion are only ever reached through an UpdateContext
+ * instance — except PushyRuntime.configure, which validates options before
+ * touching UpdateContext and so loads the library itself.
+ */
 final class NativeCore {
     private static boolean loaded = false;
 
@@ -12,7 +21,7 @@ final class NativeCore {
         }
 
         try {
-            System.loadLibrary(Texts.reveal("2819e4c4bd8371"));
+            System.loadLibrary(Texts.LIBRARY_NAME);
         } catch (UnsatisfiedLinkError error) {
             UnsatisfiedLinkError wrapped = new UnsatisfiedLinkError(
                 "Failed to load the native library. Original error: "
@@ -30,7 +39,6 @@ final class NativeCore {
      * 服务端按能力门控下发。
      */
     static int supportedDiffVersion() {
-        ensureLoaded();
         return getSupportedDiffVersion();
     }
 

package/android/src/main/java/cn/reactnative/modules/update/PatchFailedException.java

@@ -5,7 +5,7 @@ import java.io.IOException;
 /**
  * A download task failure that happened after the artifact was fully
  * downloaded — unzip, hdiff apply, or bundled-resource copy (including the
- * copiesCrc content verification). UpdateModuleImpl rejects these with
+ * copiesCrc content verification). UpdateModule rejects these with
  * PATCH_FAILED instead of DOWNLOAD_FAILED so the JS layer and server-side
  * telemetry can separate patch health from network health.
  */