react-native-update 10.59.2 → 10.61.0

package/android/src/main/java/cn/reactnative/modules/update/UpdateEventEmitter.java

@@ -39,7 +39,7 @@ final class UpdateEventEmitter {
             // emit (this SDK itself triggers reloads); sendEvent runs on the
             // main thread, so a throw here would crash the app for a lost
             // progress tick.
-            Log.w("pushy", "sendEvent " + eventName + " failed: " + e.getMessage());
+            Log.w(Texts.LOG_TAG, "sendEvent " + eventName + " failed: " + e.getMessage());
         }
     }
 

package/android/src/main/java/cn/reactnative/modules/update/UpdateFileUtils.java

@@ -1,13 +1,18 @@
 package cn.reactnative.modules.update;
 
+import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 
 final class UpdateFileUtils {
-    private static final int BUFFER_SIZE = 8192;
+    /** The one IO block size: stream copies, digests, downloads, unzip. */
+    static final int BUFFER_SIZE = 64 * 1024;
 
     private UpdateFileUtils() {
     }
@@ -57,27 +62,53 @@ final class UpdateFileUtils {
         }
     }
 
+    static MessageDigest newSha256() throws IOException {
+        try {
+            return MessageDigest.getInstance("SHA-256");
+        } catch (java.security.NoSuchAlgorithmException e) {
+            throw new IOException("SHA-256 unavailable", e);
+        }
+    }
+
+    /** Feeds the whole file into digest (streaming, bounded memory). */
+    static void updateDigest(MessageDigest digest, File file) throws IOException {
+        try (InputStream in = new FileInputStream(file)) {
+            updateDigest(digest, in);
+        }
+    }
+
+    /** Feeds the rest of the stream into digest; the caller closes it. */
+    static void updateDigest(MessageDigest digest, InputStream in) throws IOException {
+        byte[] buffer = new byte[BUFFER_SIZE];
+        int read;
+        while ((read = in.read(buffer)) != -1) {
+            digest.update(buffer, 0, read);
+        }
+    }
+
+    static String toHex(byte[] digest) {
+        StringBuilder hex = new StringBuilder(digest.length * 2);
+        for (byte b : digest) {
+            hex.append(Character.forDigit((b >> 4) & 0xf, 16));
+            hex.append(Character.forDigit(b & 0xf, 16));
+        }
+        return hex.toString();
+    }
+
     /** Streaming SHA-256 of a file, lowercase hex. */
     static String sha256Hex(File file) throws IOException {
         try (InputStream in = new FileInputStream(file)) {
-            java.security.MessageDigest md = java.security.MessageDigest.getInstance("SHA-256");
-            byte[] buffer = new byte[64 * 1024];
-            int read;
-            while ((read = in.read(buffer)) != -1) {
-                md.update(buffer, 0, read);
-            }
-            byte[] digest = md.digest();
-            StringBuilder hex = new StringBuilder(digest.length * 2);
-            for (byte b : digest) {
-                hex.append(Character.forDigit((b >> 4) & 0xf, 16));
-                hex.append(Character.forDigit(b & 0xf, 16));
-            }
-            return hex.toString();
-        } catch (java.security.NoSuchAlgorithmException e) {
-            throw new IOException("SHA-256 unavailable", e);
+            return sha256Hex(in);
         }
     }
 
+    /** Streaming SHA-256 of the rest of the stream, lowercase hex; the caller closes it. */
+    static String sha256Hex(InputStream in) throws IOException {
+        MessageDigest md = newSha256();
+        updateDigest(md, in);
+        return toHex(md.digest());
+    }
+
     static void copyFile(File from, File to) throws IOException {
         ensureParentDirectory(to);
         try (
@@ -95,11 +126,38 @@ final class UpdateFileUtils {
         }
     }
 
-    private static void copy(InputStream in, FileOutputStream out) throws IOException {
+    /** Copies the rest of the stream; the caller closes both ends. */
+    static void copy(InputStream in, OutputStream out) throws IOException {
         byte[] buffer = new byte[BUFFER_SIZE];
         int count;
         while ((count = in.read(buffer)) != -1) {
             out.write(buffer, 0, count);
         }
     }
+
+    /**
+     * Reads the whole stream (and closes it), failing once it exceeds
+     * maxBytes: small server- or archive-provided documents must not be
+     * able to exhaust memory.
+     */
+    static byte[] readBytes(InputStream input, long maxBytes) throws IOException {
+        try (InputStream in = input; ByteArrayOutputStream out = new ByteArrayOutputStream()) {
+            byte[] buffer = new byte[BUFFER_SIZE];
+            int count;
+            long total = 0;
+            while ((count = in.read(buffer)) != -1) {
+                total += count;
+                if (total > maxBytes) {
+                    throw new IOException("content exceeds " + maxBytes + " bytes");
+                }
+                out.write(buffer, 0, count);
+            }
+            return out.toByteArray();
+        }
+    }
+
+    /** A small UTF-8 text file (a record, a sidecar), at most maxBytes long. */
+    static String readSmallUtf8(File file, long maxBytes) throws IOException {
+        return new String(readBytes(new FileInputStream(file), maxBytes), StandardCharsets.UTF_8);
+    }
 }

package/android/src/main/java/cn/reactnative/modules/update/{UpdateModuleImpl.java → UpdateModule.java}

@@ -1,9 +1,13 @@
 package cn.reactnative.modules.update;
 
+import static cn.reactnative.modules.update.StateSerialRunner.STATE_SERIAL;
+import static cn.reactnative.modules.update.StateSerialRunner.UI_THREAD;
+
 import android.util.Log;
 import androidx.annotation.Nullable;
 import com.facebook.react.bridge.Promise;
 import com.facebook.react.bridge.ReactApplicationContext;
+import com.facebook.react.bridge.ReactMethod;
 import com.facebook.react.bridge.ReadableMap;
 import java.util.HashMap;
 import java.util.Map;
@@ -12,32 +16,33 @@ import org.json.JSONObject;
 import org.json.JSONTokener;
 
 /**
- * Everything the "Pushy" native module does, independent of the bridge it is
- * registered with. The old-architecture and new-architecture UpdateModule
- * classes are thin wrappers that only carry their annotations / spec
- * overrides and forward here, so the two cannot drift apart.
+ * The "Pushy" native module for both architectures. NativePushySpec is the
+ * codegen spec under the new architecture and the hand-written stand-in in
+ * src/oldarch otherwise; the old bridge discovers methods through the
+ * @ReactMethod annotations here, so every spec method carries one. Each
+ * state-changing method takes a trailing Promise, so a failed persistence
+ * rejects instead of resolving early (CODE_AUDIT 2.3).
  */
-public class UpdateModuleImpl {
+public class UpdateModule extends NativePushySpec {
     // Download URL option key, stored encoded.
-    private static final String OPTION_URL = Texts.reveal("2f07f0d0ba8e5d572e");
-
-
-    public static final String NAME = "Pushy";
+    private static final String OPTION_URL = Texts.OPTION_URL_KEY;
 
     private final ReactApplicationContext reactContext;
     private final UpdateContext updateContext;
 
-    public UpdateModuleImpl(ReactApplicationContext reactContext) {
+    public UpdateModule(ReactApplicationContext reactContext) {
         this(reactContext, UpdateContext.getInstance(reactContext));
     }
 
-    public UpdateModuleImpl(ReactApplicationContext reactContext, UpdateContext updateContext) {
+    public UpdateModule(ReactApplicationContext reactContext, UpdateContext updateContext) {
+        super(reactContext);
         this.reactContext = reactContext;
         this.updateContext = updateContext;
         UpdateEventEmitter.register(reactContext);
     }
 
-    public Map<String, Object> getConstants() {
+    @Override
+    protected Map<String, Object> getTypedExportedConstants() {
         final Map<String, Object> constants = new HashMap<String, Object>();
         constants.put("downloadRootDir", updateContext.getRootDir());
         constants.put("packageVersion", updateContext.getPackageVersion());
@@ -45,6 +50,8 @@ public class UpdateModuleImpl {
         String currentVersion = updateContext.getCurrentVersion();
         constants.put("currentVersion", currentVersion);
         constants.put("currentVersionInfo", updateContext.getKv("hash_" + currentVersion));
+        // Served from the value cached at launch resolution (no file read on
+        // the JS thread) when currentVersion is the launched version.
         constants.put("currentBundleSha256", updateContext.currentBundleSha256(currentVersion));
         constants.put("buildTime", updateContext.getBuildTime());
         constants.put("isUsingBundleUrl", updateContext.getIsUsingBundleUrl());
@@ -63,7 +70,7 @@ public class UpdateModuleImpl {
             // A mismatched librnpushy.so (stale manual copy / build cache)
             // must not crash startup via getConstants; 0 simply means "no v2
             // diff track" and the server degrades gracefully.
-            Log.e("pushy", "supportedDiffVersion missing from the native library", e);
+            Log.e(Texts.LOG_TAG, "supportedDiffVersion missing from the native library", e);
         }
         constants.put("supportedDiffVersion", supportedDiffVersion);
         return constants;
@@ -127,26 +134,13 @@ public class UpdateModuleImpl {
 
             @Override
             public void onDownloadFailed(Throwable error) {
-                promise.reject(downloadErrorCode(error), error);
+                promise.reject(ErrorCodes.forDownloadFailure(error), error);
             }
         };
     }
 
-    // Post-download failures (unzip / hdiff / resource copy, incl. copiesCrc
-    // verification) reject as PATCH_FAILED so JS-side telemetry can separate
-    // patch health from network health; a local refusal (reinstalling the
-    // running version in place) as FILE_OPERATION_FAILED. DownloadTask
-    // classifies them.
-    private static String downloadErrorCode(Throwable error) {
-        if (error instanceof PatchFailedException) {
-            return ErrorCodes.DELTA_FAILED;
-        }
-        if (error instanceof FileOperationException) {
-            return ErrorCodes.FILE_OPERATION_FAILED;
-        }
-        return ErrorCodes.DOWNLOAD_FAILED;
-    }
-
+    @ReactMethod
+    @Override
     public void downloadFullUpdate(final ReadableMap options, final Promise promise) {
         String url = readRequiredString(options, OPTION_URL, promise);
         if (url == null) {
@@ -156,9 +150,11 @@ public class UpdateModuleImpl {
         if (hash == null) {
             return;
         }
-        updateContext.downloadFullUpdate(url, hash, downloadListener(promise));
+        updateContext.downloadFullUpdate(url, hash, downloadListener(promise), 0);
     }
 
+    @ReactMethod
+    @Override
     public void downloadAndInstallApk(final ReadableMap options, final Promise promise) {
         // Every failure of this path — a missing REQUEST_INSTALL_PACKAGES
         // declaration above all — has to come back as a promise rejection,
@@ -203,6 +199,8 @@ public class UpdateModuleImpl {
         }
     }
 
+    @ReactMethod
+    @Override
     public void downloadPatchFromPackage(final ReadableMap options, final Promise promise) {
         String url = readRequiredString(options, OPTION_URL, promise);
         if (url == null) {
@@ -212,9 +210,11 @@ public class UpdateModuleImpl {
         if (hash == null) {
             return;
         }
-        updateContext.downloadPatchFromApk(url, hash, downloadListener(promise));
+        updateContext.downloadPatchFromApk(url, hash, downloadListener(promise), 0);
     }
 
+    @ReactMethod
+    @Override
     public void downloadPatchFromPpk(final ReadableMap options, final Promise promise) {
         String url = readRequiredString(options, OPTION_URL, promise);
         if (url == null) {
@@ -228,79 +228,80 @@ public class UpdateModuleImpl {
         if (originHash == null) {
             return;
         }
-        updateContext.downloadPatchFromPpk(url, hash, originHash, downloadListener(promise));
+        updateContext.downloadPatchFromPpk(url, hash, originHash, downloadListener(promise), 0);
     }
 
+    @ReactMethod
+    @Override
     public void reloadUpdate(final ReadableMap options, final Promise promise) {
         String hash = readRequiredString(options, "hash", promise);
         if (hash == null) {
             return;
         }
-        restartApp(hash, promise);
+        restart(hash, promise);
     }
 
-    public void restartApp(@Nullable final String hash, final Promise promise) {
+    @ReactMethod
+    @Override
+    public void restartApp(Promise promise) {
+        restart(null, promise);
+    }
+
+    private void restart(@Nullable final String hash, final Promise promise) {
         // Two hops (CODE_AUDIT 2.2): the switch (bundle digest + commit) and
         // the launch resolution run on the state serial thread like every
-        // other state write; only the React reload itself is posted to the
-        // UI thread. A failure at either hop rejects with RESTART_FAILED.
-        StateSerialRunner.run(promise, ErrorCodes.RESTART_FAILED, "restartApp", new StateSerialRunner.Operation() {
-            @Override
-            public void run() throws Throwable {
-                final String bundlePath = ReactReloadManager.prepareRestart(updateContext, hash);
-                UiThreadRunner.run(promise, ErrorCodes.RESTART_FAILED, "restartApp", new UiThreadRunner.Operation() {
-                    @Override
-                    public void run() throws Throwable {
-                        ReactReloadManager.reload(updateContext, reactContext, bundlePath);
-                        promise.resolve(true);
-                    }
-                });
+        // other state write — nothing there touches React; only the React
+        // reload itself is posted to the UI thread. A failure at either hop
+        // rejects with RESTART_FAILED.
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.RESTART_FAILED, "restartApp", () -> {
+            if (hash != null) {
+                updateContext.switchVersion(hash);
             }
+            // The bundle to load; null for the packaged one.
+            final String bundlePath = updateContext.getBundleUrl();
+            StateSerialRunner.run(UI_THREAD, promise, ErrorCodes.RESTART_FAILED, "restartApp", () -> {
+                ReactReloadManager.reload(updateContext, reactContext, bundlePath);
+                promise.resolve(true);
+            });
         });
     }
 
+    @ReactMethod
+    @Override
     public void setNeedUpdate(final ReadableMap options, final Promise promise) {
         final String hash = readRequiredString(options, "hash", promise);
         if (hash == null) {
             return;
         }
-        StateSerialRunner.run(promise, ErrorCodes.SWITCH_VERSION_FAILED, "switchVersionLater", new StateSerialRunner.Operation() {
-            @Override
-            public void run() {
-                updateContext.switchVersion(hash);
-                promise.resolve(true);
-            }
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.SWITCH_VERSION_FAILED, "switchVersionLater", () -> {
+            updateContext.switchVersion(hash);
+            promise.resolve(true);
         });
     }
 
+    @ReactMethod
+    @Override
     public void markSuccess(final Promise promise) {
-        StateSerialRunner.run(promise, ErrorCodes.MARK_SUCCESS_FAILED, "markSuccess", new StateSerialRunner.Operation() {
-            @Override
-            public void run() {
-                updateContext.markSuccess();
-                promise.resolve(true);
-            }
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.MARK_SUCCESS_FAILED, "markSuccess", () -> {
+            updateContext.markSuccess();
+            promise.resolve(true);
         });
     }
 
+    @ReactMethod
+    @Override
     public void getBundleHash(final Promise promise) {
-        // Threading lives in UpdateContext (download executor); resolve is
+        // Threading lives in UpdateContext (its bundle-hash thread); resolve is
         // thread-safe. Never rejects — empty string means "unknown".
-        updateContext.getBundleHash(new UpdateContext.BundleHashListener() {
-            @Override
-            public void onBundleHash(String hash) {
-                promise.resolve(hash);
-            }
-        });
+        updateContext.getBundleHash(promise::resolve);
     }
 
+    @ReactMethod
+    @Override
     public void resetToPackagedBundle(final Promise promise) {
-        StateSerialRunner.run(promise, ErrorCodes.RESET_FAILED, "resetToPackagedBundle", new StateSerialRunner.Operation() {
-            @Override
-            public void run() {
-                updateContext.resetToPackagedBundle();
-                promise.resolve(true);
-            }
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.RESET_FAILED, "resetToPackagedBundle", () -> {
+            updateContext.resetToPackagedBundle();
+            promise.resolve(true);
         });
     }
 
@@ -309,18 +310,19 @@ public class UpdateModuleImpl {
      * reuse instead of re-checking (§10.3). Empty string when absent; never
      * rejects.
      */
+    @ReactMethod
+    @Override
     public void getNativeCheckCache(final Promise promise) {
-        String cached = updateContext.getKv(SyncCoordinator.KEY_RESP_CACHE);
+        String cached = updateContext.getNativeCheckCache();
         promise.resolve(cached == null ? "" : cached);
     }
 
     /**
-     * Provisioning for the native cold-start update check
-     * (NATIVE_CHECKUPDATE_DESIGN §10.1): the raw JSON persists as-is and is
-     * parsed on read by the orchestrator; absent config = check disabled.
-     * Validated at write time — a corrupt config would otherwise silently
-     * disable the native check forever with no signal.
+     * JS obtained a valid check response for this config in this process; the
+     * delayed native round then skips its duplicate request (§10.3).
      */
+    @ReactMethod
+    @Override
     public void markJsCheckCompleted(final String config, final Promise promise) {
         if (requireNonEmpty(config, "config", promise) == null) {
             return;
@@ -329,6 +331,15 @@ public class UpdateModuleImpl {
         promise.resolve(true);
     }
 
+    /**
+     * Provisioning for the native cold-start update check
+     * (NATIVE_CHECKUPDATE_DESIGN §10.1): the raw JSON persists as-is and is
+     * parsed on read by the orchestrator; absent config = check disabled.
+     * Validated at write time — a corrupt config would otherwise silently
+     * disable the native check forever with no signal.
+     */
+    @ReactMethod
+    @Override
     public void syncNativeConfig(final String config, final Promise promise) {
         if (requireNonEmpty(config, "config", promise) == null) {
             return;
@@ -339,28 +350,26 @@ public class UpdateModuleImpl {
             promise.reject(ErrorCodes.INVALID_OPTIONS, "config must be a JSON object string", e);
             return;
         }
-        StateSerialRunner.run(promise, ErrorCodes.FILE_OPERATION_FAILED, "syncNativeConfig", new StateSerialRunner.Operation() {
-            @Override
-            public void run() {
-                updateContext.setNativeConfig(config);
-                promise.resolve(true);
-            }
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.FILE_OPERATION_FAILED, "syncNativeConfig", () -> {
+            updateContext.setNativeConfig(config);
+            promise.resolve(true);
         });
     }
 
+    @ReactMethod
+    @Override
     public void setUuid(final String uuid, final Promise promise) {
         if (requireNonEmpty(uuid, "uuid", promise) == null) {
             return;
         }
-        StateSerialRunner.run(promise, ErrorCodes.FILE_OPERATION_FAILED, "setUuid", new StateSerialRunner.Operation() {
-            @Override
-            public void run() {
-                updateContext.setKv("uuid", uuid);
-                promise.resolve(true);
-            }
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.FILE_OPERATION_FAILED, "setUuid", () -> {
+            updateContext.setKv("uuid", uuid);
+            promise.resolve(true);
         });
     }
 
+    @ReactMethod
+    @Override
     public void setLocalHashInfo(final String hash, final String info, final Promise promise) {
         if (requireNonEmpty(hash, "hash", promise) == null) {
             return;
@@ -371,15 +380,14 @@ public class UpdateModuleImpl {
         }
         // A state write that did not reach disk (SharedPreferences commit
         // false) is FILE_OPERATION_FAILED, distinct from malformed input.
-        StateSerialRunner.run(promise, ErrorCodes.FILE_OPERATION_FAILED, "setLocalHashInfo", new StateSerialRunner.Operation() {
-            @Override
-            public void run() {
-                updateContext.setKv("hash_" + hash, info);
-                promise.resolve(true);
-            }
+        StateSerialRunner.run(STATE_SERIAL, promise, ErrorCodes.FILE_OPERATION_FAILED, "setLocalHashInfo", () -> {
+            updateContext.setKv("hash_" + hash, info);
+            promise.resolve(true);
         });
     }
 
+    @ReactMethod
+    @Override
     public void getLocalHashInfo(final String hash, final Promise promise) {
         if (requireNonEmpty(hash, "hash", promise) == null) {
             return;
@@ -398,4 +406,14 @@ public class UpdateModuleImpl {
 
         promise.resolve(value);
     }
+
+    @ReactMethod
+    @Override
+    public void addListener(String eventName) {
+    }
+
+    @ReactMethod
+    @Override
+    public void removeListeners(double count) {
+    }
 }

package/android/src/main/java/cn/reactnative/modules/update/UpdatePackage.java

@@ -18,29 +18,26 @@ public class UpdatePackage extends TurboReactPackage {
     @Nullable
     @Override
     public NativeModule getModule(String name, ReactApplicationContext reactContext) {
-        return name.equals(UpdateModuleImpl.NAME) ? new UpdateModule(reactContext) : null;
+        return name.equals(UpdateModule.NAME) ? new UpdateModule(reactContext) : null;
     }
 
     @Override
     public ReactModuleInfoProvider getReactModuleInfoProvider() {
-        return new ReactModuleInfoProvider() {
-            @Override
-            public Map<String, ReactModuleInfo> getReactModuleInfos() {
-                final Map<String, ReactModuleInfo> moduleInfos = new HashMap<>();
-                boolean isTurboModule = BuildConfig.IS_NEW_ARCHITECTURE_ENABLED;
-                moduleInfos.put(
-                        UpdateModuleImpl.NAME,
-                        new ReactModuleInfo(
-                                UpdateModuleImpl.NAME,
-                                UpdateModuleImpl.NAME,
-                                false, // canOverrideExistingModule
-                                false, // needsEagerInit
-                                true, // hasConstants
-                                false, // isCxxModule
-                                isTurboModule // isTurboModule
-                        ));
-                return moduleInfos;
-            }
+        return () -> {
+            final Map<String, ReactModuleInfo> moduleInfos = new HashMap<>();
+            boolean isTurboModule = BuildConfig.IS_NEW_ARCHITECTURE_ENABLED;
+            moduleInfos.put(
+                    UpdateModule.NAME,
+                    new ReactModuleInfo(
+                            UpdateModule.NAME,
+                            UpdateModule.NAME,
+                            false, // canOverrideExistingModule
+                            false, // needsEagerInit
+                            true, // hasConstants
+                            false, // isCxxModule
+                            isTurboModule // isTurboModule
+                    ));
+            return moduleInfos;
         };
     }
 }

package/android/src/main/java/cn/reactnative/modules/update/VersionScopedKeys.java

@@ -0,0 +1,64 @@
+package cn.reactnative.modules.update;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * The keys of the main state file that describe installed versions rather
+ * than the install itself. What a binary upgrade or a reset to the packaged
+ * bundle drops (besides the state fields applyState rewrites) is the same on
+ * every platform and generated from scripts/contract.ts (storedItems); the
+ * install's own keys — the client uuid that buckets gray releases, the
+ * persisted native config the cold-start round and crash hold run from, the
+ * round breadcrumb, the bundle hash cache keyed by package version — survive.
+ */
+final class VersionScopedKeys {
+    static final String HASH_INFO_PREFIX = "hash_";
+
+    // <generated:lifecycle> (scripts/contract.ts; bun scripts/generate-contract.ts)
+    // What a reset to the packaged bundle and a binary upgrade delete besides
+    // the state fields (scripts/contract.ts storedItems; every other item survives
+    // both: the uuid, the native config, the round breadcrumb, the bundle hash
+    // cache).
+    static final String[] RESET_KEYS = {UpdateContext.KEY_FIRST_LOAD_MARKED, SyncCoordinator.KEY_RESP_CACHE};
+    static final String[] RESET_PREFIXES = {HASH_INFO_PREFIX};
+    static final String[] UPGRADE_KEYS = {UpdateContext.KEY_FIRST_LOAD_MARKED, SyncCoordinator.KEY_RESP_CACHE};
+    static final String[] UPGRADE_PREFIXES = {HASH_INFO_PREFIX};
+    // </generated:lifecycle>
+
+    private VersionScopedKeys() {
+    }
+
+    /** The keys a reset to the packaged bundle deletes. */
+    static List<String> clearedOnReset(Collection<String> keys) {
+        return select(keys, RESET_KEYS, RESET_PREFIXES);
+    }
+
+    /** The keys a binary upgrade deletes. */
+    static List<String> clearedOnUpgrade(Collection<String> keys) {
+        return select(keys, UPGRADE_KEYS, UPGRADE_PREFIXES);
+    }
+
+    private static List<String> select(
+        Collection<String> keys, String[] exact, String[] prefixes
+    ) {
+        List<String> doomed = new ArrayList<>();
+        for (String key : keys) {
+            if (key == null) {
+                continue;
+            }
+            boolean match = false;
+            for (String name : exact) {
+                match |= key.equals(name);
+            }
+            for (String prefix : prefixes) {
+                match |= key.startsWith(prefix);
+            }
+            if (match) {
+                doomed.add(key);
+            }
+        }
+        return doomed;
+    }
+}