react-native-update 10.59.2 → 10.61.0

package/src/clientReporter.ts

@@ -0,0 +1,398 @@
+import {
+  buildTime,
+  cInfo,
+  currentVersion,
+  currentVersionInfo,
+  packageVersion,
+} from './core';
+import { toUpdateError, type UpdateError, type UpdateErrorCode } from './error';
+import {
+  type ErrorReportContext,
+  type ErrorReportingOptions,
+  installGlobalErrorHandler,
+  type SerializedException,
+  serializeException,
+} from './errorReporting';
+import {
+  resolveServerEventHash,
+  resolveServerEventType,
+  truncateDetail,
+} from './telemetry';
+import type { ClientOptions, EventType, UpdateCheckState } from './type';
+import { fetchWithTimeout, log, noop } from './utils';
+
+/** One report() event: the logger payload and the source of server telemetry. */
+export interface ReportEvent {
+  type: EventType;
+  message?: string;
+  code?: UpdateErrorCode;
+  data?: Record<string, string | number>;
+}
+
+/**
+ * Receives every error the client reports, alongside the report event type.
+ * The UpdateProvider subscribes to surface errors as lastError/Alert; user
+ * code can subscribe too. Listeners run before any throwError rethrow.
+ */
+export type UpdateErrorListener = (
+  error: UpdateError,
+  eventType: EventType
+) => void;
+
+/** What reporting needs from the client. */
+export interface ReporterHost {
+  readonly options: ClientOptions;
+  getEffectivePackageVersion(): string;
+  /**
+   * The client's report: events raised here go through it, so a caller that
+   * replaces client.report sees them too.
+   */
+  report(event: ReportEvent): Promise<void>;
+  /** The endpoint telemetry posts to: the last one that served a check. */
+  telemetryEndpoint(): string | undefined;
+}
+
+/**
+ * Everything that leaves the client as a signal: the user logger, server
+ * telemetry, JS exception reports and the onError listeners. Never throws
+ * into the update flow.
+ */
+export class Reporter {
+  constructor(private readonly host: ReporterHost) {}
+
+  private reportedInvalidUpdates = new Set<string>();
+  private reportedExceptions = new WeakSet<object>();
+  private globalErrorCleanup?: () => void;
+  private errorListeners = new Set<UpdateErrorListener>();
+  private emittedErrors = new WeakSet<Error>();
+
+  /** Resolved once a logger is configured (see report). */
+  loggerPromise = (() => {
+    let resolve: (value?: unknown) => void = () => {};
+    const promise = new Promise((res) => {
+      resolve = res;
+    });
+    return {
+      promise,
+      resolve,
+    };
+  })();
+
+  syncAutomaticErrorReporting = (): void => {
+    const { options } = this.host;
+    if (options.disableTelemetry || options.disableErrorReporting) {
+      this.globalErrorCleanup?.();
+      return;
+    }
+    this.enableErrorReporting();
+  };
+
+  reportInvalidUpdateOnce = (
+    reason: 'missingHash' | 'noArtifact',
+    hash = ''
+  ) => {
+    const key = `${this.host.options.appKey}:${reason}:${hash}`;
+    if (this.reportedInvalidUpdates.has(key)) {
+      return;
+    }
+    this.reportedInvalidUpdates.add(key);
+    this.host.report({
+      type: 'errorUpdate',
+      message:
+        reason === 'missingHash'
+          ? 'update response is missing a version hash'
+          : 'update response contains no downloadable artifact',
+      ...(hash ? { data: { newVersion: hash } } : {}),
+    });
+  };
+
+  /**
+   * Best-effort JS exception reporting for the currently running OTA release.
+   * It is intentionally synchronous to call and never throws; the transport
+   * runs in the background and preserves the app's existing error flow.
+   */
+  captureException = (
+    error: unknown,
+    context: ErrorReportContext = {}
+  ): void => {
+    try {
+      const { options } = this.host;
+      if (
+        __DEV__ ||
+        options.disableTelemetry ||
+        options.disableErrorReporting ||
+        !currentVersion
+      ) {
+        return;
+      }
+      if (
+        error !== null &&
+        (typeof error === 'object' || typeof error === 'function')
+      ) {
+        const object = error as object;
+        if (this.reportedExceptions.has(object)) {
+          return;
+        }
+        this.reportedExceptions.add(object);
+      }
+      this.postReport({
+        type: 'js_exception',
+        hash: currentVersion,
+        error: serializeException(error, context),
+      });
+    } catch (e: any) {
+      log('exception telemetry error:', e?.message || e);
+    }
+  };
+
+  /**
+   * Ensure uncaught JS exception capture is installed and return a runtime
+   * cleanup function. Capture is installed automatically by default; this
+   * method remains an idempotent compatibility hook. The wrapper always
+   * chains the handler that was installed before it and only restores that
+   * handler when no later integration has replaced ours.
+   */
+  enableErrorReporting = (
+    options: ErrorReportingOptions = {}
+  ): (() => void) => {
+    if (
+      options.captureGlobal === false ||
+      this.host.options.disableTelemetry ||
+      this.host.options.disableErrorReporting
+    ) {
+      return () => {};
+    }
+    if (this.globalErrorCleanup) {
+      return this.globalErrorCleanup;
+    }
+    const uninstall = installGlobalErrorHandler((error, isFatal) => {
+      this.captureException(error, { fatal: isFatal === true });
+    });
+    let active = true;
+    const cleanup = () => {
+      if (!active) {
+        return;
+      }
+      active = false;
+      uninstall();
+      if (this.globalErrorCleanup === cleanup) {
+        this.globalErrorCleanup = undefined;
+      }
+    };
+    this.globalErrorCleanup = cleanup;
+    return cleanup;
+  };
+
+  report = async ({ type, message = '', code, data = {} }: ReportEvent) => {
+    log(`${type} ${code ? `[${code}] ` : ''}${message}`);
+    // Fire-and-forget server telemetry; must not wait for the logger below.
+    this.reportToServer({ type, message, code, data });
+    if (this.host.options.logger === noop) {
+      // Wait briefly for a logger to arrive via setOptions (e.g. the rollback
+      // report fires in the constructor before the user configures one), but
+      // give up after a bound instead of retaining the closure forever when
+      // no logger is ever provided.
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      await Promise.race([
+        this.loggerPromise.promise,
+        new Promise<void>((resolve) => {
+          timer = setTimeout(() => resolve(), 10 * 1000);
+        }),
+      ]);
+      clearTimeout(timer);
+    }
+    const { logger = noop, appKey } = this.host.options;
+    const overridePackageVersion = this.host.options.overridePackageVersion;
+    try {
+      logger({
+        type,
+        data: {
+          appKey,
+          currentVersion,
+          cInfo,
+          packageVersion,
+          overridePackageVersion,
+          buildTime,
+          message,
+          code,
+          ...currentVersionInfo,
+          ...data,
+        },
+      });
+    } catch (e: any) {
+      // A user-provided logger must never break the update flow, and report()
+      // calls are fire-and-forget so a throw here would be an unhandled
+      // rejection.
+      log('logger error:', e?.message || e);
+    }
+  };
+
+  /**
+   * Best-effort lifecycle event reporting to the update server (aggregate
+   * counts + sampled failure details power the version health view and the
+   * rollback safety net server-side). Single POST to the last known working
+   * endpoint, no retry, no fallback race; any failure is swallowed — telemetry
+   * must never affect the update flow. Opt out with disableTelemetry.
+   */
+  private reportToServer = ({
+    type,
+    message,
+    code,
+    data = {},
+  }: ReportEvent) => {
+    try {
+      if (__DEV__ || this.host.options.disableTelemetry) {
+        return;
+      }
+      const serverType = resolveServerEventType(type, code);
+      if (!serverType) {
+        return;
+      }
+      const hash = resolveServerEventHash({ serverType, data, currentVersion });
+      if (!hash) {
+        return;
+      }
+      // A download rescued by a later strategy reports its patch-health
+      // signal through downloadFallback, which only counts patch-apply
+      // failures; downloadSuccess's data.error (any earlier failure, network
+      // errors included) stays local.
+      this.postReport({
+        type: serverType,
+        hash,
+        detail: truncateDetail(message),
+      });
+    } catch (e: any) {
+      log('telemetry error:', e?.message || e);
+    }
+  };
+
+  /**
+   * The single telemetry POST ({endpoint}/report/{appKey}) to the last known
+   * working endpoint; no retry, failures only logged.
+   */
+  private postReport = ({
+    type,
+    hash,
+    ...payload
+  }: {
+    type: string;
+    hash: string;
+    detail?: string;
+    error?: SerializedException;
+  }) => {
+    const { appKey } = this.host.options;
+    const endpoint = this.host.telemetryEndpoint();
+    if (!appKey || !endpoint) {
+      return;
+    }
+    fetchWithTimeout(`${endpoint}/report/${appKey}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        type,
+        hash,
+        packageVersion: this.host.getEffectivePackageVersion(),
+        cInfo,
+        ...payload,
+      }),
+    }).catch((e: any) => {
+      log('telemetry report failed:', e?.message || e);
+    });
+  };
+
+  throwIfEnabled = (e: Error) => {
+    if (this.host.options.throwError) {
+      throw e;
+    }
+  };
+
+  /**
+   * Subscribe to every error the client reports (regardless of throwError).
+   * Returns an unsubscribe function.
+   */
+  onError = (listener: UpdateErrorListener) => {
+    this.errorListeners.add(listener);
+    return () => {
+      this.errorListeners.delete(listener);
+    };
+  };
+
+  /**
+   * Whether this exact error object already went through emitError (and was
+   * therefore delivered to onError subscribers). Lets UI layers decide if a
+   * caught error still needs surfacing — checking `e.code` is not enough,
+   * since axios/system errors carry their own code without ever entering the
+   * pipeline.
+   */
+  wasEmitted = (e: unknown): boolean =>
+    e instanceof Error && this.emittedErrors.has(e);
+
+  /**
+   * Single exit point for errors: reports to the logger (with the stable
+   * code) and notifies onError listeners. Whether to also throw stays with
+   * the caller (throwIfEnabled or an unconditional rethrow).
+   */
+  emitError = (
+    error: UpdateError,
+    type: EventType,
+    {
+      message = error.message,
+      data,
+    }: { message?: string; data?: Record<string, string | number> } = {}
+  ) => {
+    this.emittedErrors.add(error);
+    this.host.report({
+      type,
+      message,
+      code: error.code,
+      // Structured context from the error (e.g. HTTP status) reaches the
+      // logger; explicit data wins on key conflicts.
+      data: error.extra ? { ...error.extra, ...data } : data,
+    });
+    for (const listener of this.errorListeners) {
+      try {
+        listener(error, type);
+      } catch (e: any) {
+        log('onError listener error:', e?.message || e);
+      }
+    }
+  };
+
+  /**
+   * toUpdateError + emitError: how a caught failure leaves the client.
+   * Returns the error for the caller to throw or pass to throwIfEnabled.
+   * `fallbackMessage` is reported when the error has no message of its own.
+   */
+  fail = (
+    e: unknown,
+    code: UpdateErrorCode,
+    type: EventType,
+    {
+      message,
+      fallbackMessage,
+      data,
+    }: {
+      message?: string;
+      fallbackMessage?: string;
+      data?: Record<string, string | number>;
+    } = {}
+  ): UpdateError => {
+    const err = toUpdateError(e, code);
+    this.emitError(err, type, {
+      message: message ?? (err.message || fallbackMessage),
+      data,
+    });
+    return err;
+  };
+
+  notifyAfterCheckUpdate = (state: UpdateCheckState) => {
+    const { afterCheckUpdate } = this.host.options;
+    if (!afterCheckUpdate) {
+      return;
+    }
+    // 这里仅做状态通知，不阻塞原有检查流程
+    Promise.resolve(afterCheckUpdate(state)).catch((error: any) => {
+      log('afterCheckUpdate failed:', error?.message || error);
+    });
+  };
+}

package/src/clientState.ts

@@ -0,0 +1,51 @@
+import type { ProgressData } from './type';
+
+export interface SharedState {
+  downloadingTasks: Record<string, Promise<string | undefined>>;
+  // Progress callbacks per hash: concurrent downloadUpdate callers of the
+  // same hash each register theirs here instead of the second one being
+  // silently dropped by the in-flight dedup.
+  progressCallbacks: Record<string, Set<(data: ProgressData) => void>>;
+  downloadedHash?: string;
+  toHash?: string;
+  apkStatus: 'downloading' | 'downloaded' | null;
+  marked: boolean;
+  applyingUpdate: boolean;
+}
+
+/**
+ * Process-wide state of the update flow. The SDK is a process-level
+ * singleton (one client, see Pushy's constructor); client.ts creates this
+ * once, when it is evaluated, and hands it to each part of the client.
+ */
+export interface ProcessState {
+  shared: SharedState;
+  // The native cold-start check writes its response cache at most once per
+  // launch (and skips it once JS has checked), so once this process has seen
+  // it absent or expired, later reads are near-certain misses: skip the
+  // bridge call from then on. The rare miss costs one network check. A fresh
+  // entry that only mismatches the request or config does not set this: a
+  // later check with the original options (e.g. after `extra` reverts) can
+  // still reuse it.
+  nativeCheckCacheExhausted: boolean;
+  // In-flight native markSuccess shared by concurrent callers, so the native
+  // call and its telemetry happen once. Cleared once settled.
+  markingPromise?: Promise<void>;
+  // A reset/new switch invalidates ownership of older async completions and
+  // watchdogs before the process-wide applyingUpdate flag can be reused.
+  applyingUpdateGeneration: number;
+  reloadWatchdogTimer?: ReturnType<typeof setTimeout>;
+}
+
+export const createProcessState = (): ProcessState => ({
+  shared: {
+    downloadingTasks: {},
+    progressCallbacks: {},
+    downloadedHash: undefined,
+    apkStatus: null,
+    marked: false,
+    applyingUpdate: false,
+  },
+  nativeCheckCacheExhausted: false,
+  applyingUpdateGeneration: 0,
+});

package/src/context.ts

@@ -46,7 +46,7 @@ export interface UpdateContextValue {
   lastError?: Error;
 }
 
-export const defaultContext: UpdateContextValue = {
+const defaultContext: UpdateContextValue = {
   checkUpdate: asyncNoop,
   switchVersion: asyncNoop,
   switchVersionLater: asyncNoop,

package/src/core.ts

@@ -1,7 +1,7 @@
 import { NativeEventEmitter, NativeModules, Platform } from 'react-native';
 import { UpdateError } from './error';
 import i18n from './i18n';
-import { emptyModule, error, log } from './utils';
+import { createNonSecureId, emptyModule, error, log } from './utils';
 
 // RN's JS global object. Declared locally because RN 0.87's own typings no
 // longer define `global` (only @types/node did), and this source is
@@ -35,6 +35,34 @@ if (!PushyModule) {
   );
 }
 
+/**
+ * `module[name]` as an always-async function (a synchronous bridge throw
+ * becomes a rejection), or undefined when the module lacks it: the JS layer
+ * can arrive via hot update onto an older binary whose native module predates
+ * the method. Always undefined on web, where the module is a noop Proxy that
+ * would pass any typeof check.
+ */
+export const bindNativeMethod = (
+  module: Record<string, any>,
+  name: string
+): ((...args: any[]) => Promise<any>) | undefined => {
+  const method = module === emptyModule ? undefined : module[name];
+  if (typeof method !== 'function') {
+    return undefined;
+  }
+  return (...args) => {
+    try {
+      return Promise.resolve(method.apply(module, args));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  };
+};
+
+/** An optional PushyModule method, see bindNativeMethod. */
+export const nativeMethod = (name: string) =>
+  bindNativeMethod(PushyModule, name);
+
 // On web PushyModule is a Proxy whose every property is a noop function, so
 // reading the constants off it would make each of them a function:
 // `isRolledBack` true (a fake rollback report on every page load), a uuid of
@@ -98,9 +126,10 @@ export const currentBundleSha256: string =
     ? PushyConstants.currentBundleSha256
     : '';
 
-export const isFirstTime: boolean = PushyConstants.isFirstTime;
-export const isFirstTimeDebug: boolean = isFirstTime && isDebugChannel;
-export const rolledBackVersion: string = PushyConstants.rolledBackVersion;
+// The platforms report an absent value differently (iOS nil, Android
+// false/null, Harmony false/''): normalize at the boundary.
+export const isFirstTime: boolean = !!PushyConstants.isFirstTime;
+export const rolledBackVersion: string = PushyConstants.rolledBackVersion || '';
 export const isRolledBack: boolean = !!rolledBackVersion;
 
 export const buildTime: string = PushyConstants.buildTime;
@@ -121,9 +150,10 @@ let uuid = PushyConstants.uuid;
 // between its dedup window and the fetch, and a hash is never worth delaying
 // a check for.
 let bundleHash = '';
-// The JS layer can arrive via hot update onto an older binary whose native
-// module predates the method, hence the feature detect (on web the noop Proxy
-// would pass it, so web is excluded explicitly).
+// Feature-detected like nativeMethod (older natives lack it, web has no native
+// module), but called directly rather than through it: a synchronous throw
+// means a broken native integration and must propagate at module load, not be
+// turned into a logged rejection. Only an async failure is tolerated.
 if (!isWebPlatform && typeof PushyModule.getBundleHash === 'function') {
   Promise.resolve(PushyModule.getBundleHash())
     .then((hash: unknown) => {
@@ -156,7 +186,7 @@ export async function getCurrentVersionInfo(): Promise<{
 export const pushyNativeEventEmitter = new NativeEventEmitter(PushyModule);
 
 if (!uuid) {
-  uuid = require('nanoid/non-secure').nanoid();
+  uuid = createNonSecureId();
   // If persisting fails the uuid drifts on every launch, which skews gray
   // release bucketing and inflates stats — log it instead of failing silently.
   // Web has nowhere to persist it (nothing runs there anyway).
@@ -171,7 +201,7 @@ export const cInfo = {
   rnu: require('../package.json').version,
   rn: RNVersion,
   // tvOS reports Platform.OS 'ios'; label it apart so the server can bucket
-  // tvOS devices separately. Must match PushyOsName in RCTPushy.mm.
+  // tvOS devices separately. Must match PushyOsName in RCTPushyOrchestrator.mm.
   os: `${Platform.OS === 'ios' && Platform.isTV ? 'tvos' : Platform.OS} ${Platform.Version}`,
   uuid,
 };
@@ -181,7 +211,6 @@ log('bootup status', {
   currentVersion,
   currentVersionInfo,
   isFirstTime,
-  isFirstTimeDebug,
   isDebugChannel,
   cInfo,
 });

package/src/endpoint.ts

@@ -2,8 +2,6 @@ import { UpdateError } from './error';
 import i18n from './i18n';
 import { dedupeEndpoints, orderEndpointCandidates } from './updateFlowCore';
 
-export { dedupeEndpoints };
-
 export interface EndpointAttemptSuccess<T> {
   endpoint: string;
   value: T;
@@ -22,6 +20,7 @@ export interface ExecuteEndpointFallbackOptions<T> {
   random?: () => number;
   now?: () => number;
   hedgeDelayMs?: number;
+  maxRequests?: number;
   onFirstFailure?: (failure: EndpointAttemptFailure) => void | Promise<void>;
 }
 
@@ -34,6 +33,17 @@ const normalizeError = (error: unknown) => {
 
 export const DEFAULT_HEDGE_DELAY_MS = 250;
 
+/**
+ * Endpoint requests one check may issue in total, as the native round's
+ * flowcore::kMaxQueryRequests (cpp/update_flow_core/native_round.h). The
+ * remote list comes from a public mirror: without a bound, a long (or
+ * hostile) list would make every device fan out to all of its entries on
+ * each failed check.
+ */
+// <generated:query-budget> (scripts/contract.ts; bun scripts/generate-contract.ts)
+export const MAX_ENDPOINT_REQUESTS = 8;
+// </generated:query-budget>
+
 /**
  * Hedged race over the candidate endpoints: the first candidate starts
  * immediately, each following one is only started after `hedgeDelayMs` of
@@ -139,6 +149,7 @@ export async function executeEndpointFallback<T>({
   random = Math.random,
   now = Date.now,
   hedgeDelayMs = DEFAULT_HEDGE_DELAY_MS,
+  maxRequests = MAX_ENDPOINT_REQUESTS,
   onFirstFailure,
 }: ExecuteEndpointFallbackOptions<T>): Promise<EndpointAttemptSuccess<T>> {
   const excludedEndpoints = new Set<string>();
@@ -146,7 +157,8 @@ export async function executeEndpointFallback<T>({
   // is pure policy; this side only executes it.
   let candidates = orderEndpointCandidates(configuredEndpoints, random());
 
-  if (!candidates.length) {
+  // No budget means no request at all, like no endpoint.
+  if (!candidates.length || maxRequests < 1) {
     throw new UpdateError(i18n.t('error_no_endpoints'), 'NO_ENDPOINTS');
   }
 
@@ -166,14 +178,15 @@ export async function executeEndpointFallback<T>({
     excludedEndpoints.add(firstEndpoint);
     await onFirstFailure?.(firstFailure);
     let lastError = firstFailure.error;
-
-    while (true) {
+    // Every endpoint is asked at most once, so the excluded set counts the
+    // requests issued so far.
+    while (excludedEndpoints.size < maxRequests) {
       const remoteEndpoints = getRemoteEndpoints
         ? await getRemoteEndpoints().catch(() => [])
         : [];
-      candidates = dedupeEndpoints([...candidates, ...remoteEndpoints]).filter(
-        (endpoint) => !excludedEndpoints.has(endpoint)
-      );
+      candidates = dedupeEndpoints([...candidates, ...remoteEndpoints])
+        .filter((endpoint) => !excludedEndpoints.has(endpoint))
+        .slice(0, maxRequests - excludedEndpoints.size);
 
       if (!candidates.length) {
         throw lastError;
@@ -195,5 +208,6 @@ export async function executeEndpointFallback<T>({
         lastError = failure.error;
       }
     }
+    throw lastError;
   }
 }