react-native-update 10.60.0 → 10.61.0

package/cpp/patch_core/native_texts.h

@@ -0,0 +1,102 @@
+#ifndef PUSHY_PATCH_CORE_NATIVE_TEXTS_H_
+#define PUSHY_PATCH_CORE_NATIVE_TEXTS_H_
+
+#include <string>
+#include <vector>
+
+#include "obscured_text.h"
+
+// The plain text shipped native code needs but must not carry in its string
+// tables (update wording, service addresses), stored encoded and decoded on
+// first use. Shared by the C++ cores and iOS; Android and Harmony get their
+// copies in Texts.java / Texts.ts. All generated from scripts/contract.ts.
+// Keep the core internal to whichever binary links it (see podspec Core).
+#pragma GCC visibility push(hidden)
+
+namespace pushy {
+namespace texts {
+
+// <generated:texts> (scripts/contract.ts; bun scripts/generate-contract.ts)
+// The round status / decision reason when nothing is to be installed.
+inline const std::string& StatusNone() {
+  static const std::string value = text::Reveal("3418c1c1aa8a7c40");
+  return value;
+}
+// Version-info flag of a version a crash hold installed (read by JS).
+inline const std::string& InfoCrashHold() {
+  static const std::string value = text::Reveal("3905f5c2a6b96d56212a19");
+  return value;
+}
+// Version-info flag of a version the server forceBoot-activated.
+inline const std::string& InfoForceBoot() {
+  static const std::string value = text::Reveal("3c18e6d2aba9674a360d19ead5a695");
+  return value;
+}
+inline const std::string& QueryPath() {
+  static const std::string value = text::Reveal("7514fcd4ad805d55263e08fc99");
+  return value;
+}
+// The afterDownload policy that activates for the next launch.
+inline const std::string& PolicyNextLaunch() {
+  static const std::string value = text::Reveal("2912e0ffab8e6c70323b1dedd3");
+  return value;
+}
+inline const std::string& FieldAvailable() {
+  static const std::string value = text::Reveal("2f07f0d0ba8e");
+  return value;
+}
+// The bundle patch entry inside a patch archive.
+inline const std::string& BundleDeltaEntry() {
+  static const std::string value = text::Reveal("3319f0d4b6c56a502c3b10fcdca0de7d4b3307e9");
+  return value;
+}
+inline const std::string& OptionUrlKey() {
+  static const std::string value = text::Reveal("2f07f0d0ba8e5d572e");
+  return value;
+}
+inline const std::string& PpkDeltaSuffix() {
+  static const std::string value = text::Reveal("7407e4dae09b69512137");
+  return value;
+}
+// Archive suffix of a patch against the installed package.
+inline const std::string& PackageDeltaSuffix() {
+  static const std::string value = text::Reveal("741ee4d0e09b69512137");
+  return value;
+}
+inline const std::string& PackageUpdatedMarkedKey() {
+  static const std::string value = text::Reveal("0832d5f29aa549710b0939daf88ca058790f3dded7e888b451640d2ec3f69099bb43711523cafa8ea7bb4372132a");
+  return value;
+}
+inline const std::string& LogTag() {
+  static const std::string value = text::Reveal("2812f5d2bac6664436360afc9ba680694b3301");
+  return value;
+}
+inline const std::string& StateResultClass() {
+  static const std::string value = text::Reveal("3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c93a99b63511201f9cd97878c695522");
+  return value;
+}
+inline const std::string& CopyGroupResultClass() {
+  static const std::string value = text::Reveal("3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c83b28a6e732301fed897878c695522");
+  return value;
+}
+// Pushy's own service addresses, configure()'s defaults.
+inline std::vector<std::string> DefaultEndpoints() {
+  return {
+      text::Reveal("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5b3d5b9817b592947e5cdefbc8a7e"),
+      text::Reveal("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5f0daac9c644a620ae88ca1ad93"),
+  };
+}
+inline std::vector<std::string> DefaultQueryUrls() {
+  return {
+      text::Reveal("3203e0c1bdd1270a253608fcd3fd9362476817f4f0d5a1996342631be3c2a3a9d779552507fdcde8928a6f512f5ce2ccbdc869404d2f1de79daa826d562c0913eec4fa9b7d4426"),
+      text::Reveal("3203e0c1bdd1270a213b12b7dca09468462e12f3b0d5bd813d482446f4c6a1be8e79552507fdcda68cd06e5c3710e480a4867048483e55e0c2ab8d7d43030d1ce9c3b183214e2601f2f0d5b782601e2719e8ca"),
+  };
+}
+// </generated:texts>
+
+}  // namespace texts
+}  // namespace pushy
+
+#pragma GCC visibility pop
+
+#endif  // PUSHY_PATCH_CORE_NATIVE_TEXTS_H_

package/cpp/patch_core/resume_plan.cpp

@@ -0,0 +1,226 @@
+#include "resume_plan.h"
+
+#include <cmath>
+
+// Relative like every other cross-core include: use_frameworks! flattens the
+// pod's headers.
+#include "../update_flow_core/flow_json.h"
+
+namespace pushy {
+namespace resume {
+namespace {
+
+using flowjson::Value;
+
+bool IsSpace(char c) { return c == ' ' || c == '\t'; }
+
+std::string Trim(const std::string& text) {
+  size_t begin = 0;
+  size_t end = text.size();
+  while (begin < end && IsSpace(text[begin])) {
+    ++begin;
+  }
+  while (end > begin && IsSpace(text[end - 1])) {
+    --end;
+  }
+  return text.substr(begin, end - begin);
+}
+
+// Digits only (no sign, no trailing text), within long long. -1 otherwise.
+long long ParseDigits(const std::string& text) {
+  if (text.empty() || text.size() > 18) {
+    return -1;
+  }
+  long long value = 0;
+  for (char c : text) {
+    if (c < '0' || c > '9') {
+      return -1;
+    }
+    value = value * 10 + (c - '0');
+  }
+  return value;
+}
+
+struct Sidecar {
+  bool valid = false;
+  std::string etag;
+  std::string last_modified;
+  long long total = 0;
+};
+
+// The sidecar for url, or invalid (absent, oversized, not a JSON object,
+// another url): a partial without one is untrusted.
+Sidecar ReadSidecar(const std::string& text, const std::string& url) {
+  Sidecar sidecar;
+  if (text.empty() || static_cast<long long>(text.size()) > kMaxSidecarBytes) {
+    return sidecar;
+  }
+  bool ok = false;
+  Value root = flowjson::Parse(text, &ok);
+  if (!ok || !root.IsObject()) {
+    return sidecar;
+  }
+  const Value& url_value = root.Get("url");
+  if (!url_value.IsString() || url_value.AsString() != url) {
+    return sidecar;
+  }
+  sidecar.valid = true;
+  const Value& etag = root.Get("etag");
+  if (etag.IsString()) {
+    sidecar.etag = etag.AsString();
+  }
+  const Value& last_modified = root.Get("lastModified");
+  if (last_modified.IsString()) {
+    sidecar.last_modified = last_modified.AsString();
+  }
+  const Value& total = root.Get("total");
+  if (total.IsNumber() && total.AsNumber() > 0 &&
+      total.AsNumber() < 9007199254740992.0 &&
+      std::floor(total.AsNumber()) == total.AsNumber()) {
+    sidecar.total = static_cast<long long>(total.AsNumber());
+  }
+  return sidecar;
+}
+
+Value Number(long long n) { return Value::Number(static_cast<double>(n)); }
+
+Value Action(const char* action) {
+  Value result = Value::Object();
+  result.Set("action", Value::String(action));
+  return result;
+}
+
+std::string Complete(long long total) {
+  Value result = Action("complete");
+  result.Set("total", Number(total));
+  return flowjson::Stringify(result);
+}
+
+bool IsEncoded(const std::string& content_encoding) {
+  std::string encoding = Trim(content_encoding);
+  if (encoding.empty()) {
+    return false;
+  }
+  for (char& c : encoding) {
+    if (c >= 'A' && c <= 'Z') {
+      c = static_cast<char>(c - 'A' + 'a');
+    }
+  }
+  return encoding != "identity";
+}
+
+}  // namespace
+
+long long ParseContentRangeTotal(const std::string& header,
+                                 long long expected_start) {
+  const std::string unit = "bytes ";
+  if (header.compare(0, unit.size(), unit) != 0) {
+    return -1;
+  }
+  const std::string range = header.substr(unit.size());
+  const size_t slash = range.find('/');
+  const size_t dash = range.find('-');
+  if (slash == std::string::npos || dash == std::string::npos || dash > slash) {
+    return -1;
+  }
+  const long long start = ParseDigits(Trim(range.substr(0, dash)));
+  const long long end = ParseDigits(Trim(range.substr(dash + 1, slash - dash - 1)));
+  if (start < 0 || end < 0 || start != expected_start || end < start) {
+    return -1;
+  }
+  const std::string total_part = Trim(range.substr(slash + 1));
+  if (total_part == "*") {
+    return 0;
+  }
+  const long long total = ParseDigits(total_part);
+  return total > end ? total : -1;
+}
+
+std::string PlanRequestJson(const std::string& sidecar_text,
+                            const std::string& url, long long partial_size) {
+  const Sidecar sidecar = ReadSidecar(sidecar_text, url);
+  if (sidecar.valid && partial_size > 0) {
+    if (sidecar.total > 0 && partial_size == sidecar.total) {
+      return Complete(sidecar.total);
+    }
+    if (sidecar.total <= 0 || partial_size < sidecar.total) {
+      Value headers = Value::Object();
+      headers.Set("Range", Value::String("bytes=" + std::to_string(partial_size) + "-"));
+      headers.Set("Accept-Encoding", Value::String("identity"));
+      const std::string& validator =
+          sidecar.etag.empty() ? sidecar.last_modified : sidecar.etag;
+      if (!validator.empty()) {
+        headers.Set("If-Range", Value::String(validator));
+      }
+      Value result = Action("resume");
+      result.Set("offset", Number(partial_size));
+      result.Set("headers", headers);
+      return flowjson::Stringify(result);
+    }
+  }
+  return flowjson::Stringify(Action("fresh"));
+}
+
+std::string ClassifyResponseJson(int status, long long resume_offset,
+                                 const std::string& content_range,
+                                 const std::string& content_encoding,
+                                 long long content_length,
+                                 const std::string& sidecar_text,
+                                 const std::string& url,
+                                 long long partial_size) {
+  if (status == 416) {
+    const Sidecar sidecar = ReadSidecar(sidecar_text, url);
+    if (sidecar.valid && sidecar.total > 0 && partial_size == sidecar.total) {
+      return Complete(sidecar.total);
+    }
+    return flowjson::Stringify(Action("restart"));
+  }
+  if (status < 200 || status > 299) {
+    return flowjson::Stringify(Action("httpError"));
+  }
+  const bool encoded = IsEncoded(content_encoding);
+  const bool append = status == 206 && resume_offset > 0;
+  long long total = 0;
+  if (append) {
+    // Encoded range bytes or a missing/mismatched Content-Range: the appended
+    // bytes could not be trusted. Restarting (once) beats failing, which
+    // would keep the partial and hit the same wall on every attempt.
+    total = encoded ? -1 : ParseContentRangeTotal(content_range, resume_offset);
+    if (total < 0) {
+      return flowjson::Stringify(Action("restart"));
+    }
+  } else if (!encoded && content_length > 0) {
+    total = content_length;
+  }
+  Value result = Action("write");
+  result.Set("append", Value::Bool(append));
+  result.Set("base", Number(append ? resume_offset : 0));
+  result.Set("total", Number(total));
+  result.Set("encoded", Value::Bool(encoded));
+  result.Set("persistSidecar", Value::Bool(!encoded));
+  return flowjson::Stringify(result);
+}
+
+std::string SidecarJson(const std::string& url, const std::string& etag,
+                        const std::string& last_modified,
+                        const std::string& previous_sidecar, long long total) {
+  const Sidecar previous = ReadSidecar(previous_sidecar, url);
+  const std::string& kept_etag = etag.empty() ? previous.etag : etag;
+  const std::string& kept_last_modified =
+      last_modified.empty() ? previous.last_modified : last_modified;
+  Value meta = Value::Object();
+  meta.Set("url", Value::String(url));
+  if (!kept_etag.empty()) {
+    meta.Set("etag", Value::String(kept_etag));
+  }
+  if (!kept_last_modified.empty()) {
+    meta.Set("lastModified", Value::String(kept_last_modified));
+  }
+  if (total > 0) {
+    meta.Set("total", Number(total));
+  }
+  return flowjson::Stringify(meta);
+}
+
+}  // namespace resume
+}  // namespace pushy

package/cpp/patch_core/resume_plan.h

@@ -0,0 +1,88 @@
+#pragma once
+
+#include <string>
+
+// Cross-launch resumable download (NATIVE_CHECKUPDATE_DESIGN §11.4): the pure
+// decisions every platform's downloader makes around a partial archive and
+// its `<archive>.resume` sidecar, one implementation for Android
+// (DownloadTask.java, through JNI), iOS (RCTPushyDownloader.mm) and Harmony
+// (DownloadTask.ts, through NAPI). The downloaders keep the IO: reading and
+// writing the archive and the sidecar, the HTTP request, the single retry
+// from zero, progress and limits. tests/resume-plan-vectors.json pins this
+// layer.
+//
+// The sidecar records what a partial belongs to:
+//   {"url": "...", "etag": "...", "lastModified": "...", "total": N}
+// (url always; the validators when the server sent them; total only when
+// known). A partial without a sidecar for the same URL is untrusted.
+//
+// JSON strings in and out, so the bindings stay thin. Keep the core internal
+// to whichever binary links it (see podspec Core).
+#pragma GCC visibility push(hidden)
+
+namespace pushy {
+namespace resume {
+
+// A sidecar is a few hundred bytes; anything larger is not one.
+constexpr long long kMaxSidecarBytes = 64 * 1024;
+
+// "bytes <start>-<end>/<total>" (RFC 9110 §14.4), whitespace around the
+// numbers allowed, digits only. Returns the total (0 when "*"), or -1 when the
+// header is missing or malformed, the start is not expected_start, or the
+// range and total contradict each other (end before start, a numeric total
+// not beyond end): the appended bytes could not be trusted. A total of 0
+// would otherwise pass as "unknown" and skip the final size check.
+long long ParseContentRangeTotal(const std::string& header,
+                                 long long expected_start);
+
+// What to do before the request, from the sidecar text ("" when there is
+// none) and the size of the partial on disk (0 when there is none):
+//   {"action":"complete","total":N}  the partial is the whole archive (the
+//       process died between download end and unzip): nothing to transfer.
+//   {"action":"resume","offset":N,"headers":{...}}  send these headers:
+//       Range, Accept-Encoding: identity (offsets must address the bytes on
+//       disk) and, when the sidecar has a validator, If-Range (a changed file
+//       then comes back as a full 200 instead of mismatched bytes).
+//   {"action":"fresh"}  discard the partial and its sidecar; send a plain
+//       request (fresh downloads keep the platform's transparent encoding).
+std::string PlanRequestJson(const std::string& sidecar, const std::string& url,
+                            long long partial_size);
+
+// What to do with the response to a request PlanRequestJson planned
+// (resume_offset is its offset, 0 for a fresh request; partial_size the
+// partial's size now; content_length the body's, -1 when unknown):
+//   {"action":"complete","total":N}  416 and the partial is the whole archive.
+//   {"action":"restart"}  the partial is stale (416, an encoded range body, a
+//       missing or mismatched Content-Range): discard it and its sidecar and
+//       retry once from zero.
+//   {"action":"httpError"}  any other non-2xx status: keep the partial and
+//       its sidecar (the resume state) and fail.
+//   {"action":"write","append":B,"base":N,"total":N,"encoded":B,
+//    "persistSidecar":B}  stream the body: appended at base (append) or
+//       replacing the partial (base 0); total is the whole archive (0 when
+//       unknown or the body is encoded). Persist the sidecar before the first
+//       byte lands unless the body is encoded (no resume across an encoded
+//       transfer: offsets would address the encoded representation), in
+//       which case delete it.
+std::string ClassifyResponseJson(int status, long long resume_offset,
+                                 const std::string& content_range,
+                                 const std::string& content_encoding,
+                                 long long content_length,
+                                 const std::string& sidecar,
+                                 const std::string& url,
+                                 long long partial_size);
+
+// The sidecar text for url: this response's validators, falling back to the
+// previous sidecar's (same url only) when the response omits them, and total
+// when it is known (> 0). Downloaders write it before streaming and once more
+// with the final size after a complete, unencoded transfer, so a process
+// that dies between download end and unzip finds the archive complete even
+// when the length was unknown up front.
+std::string SidecarJson(const std::string& url, const std::string& etag,
+                        const std::string& last_modified,
+                        const std::string& previous_sidecar, long long total);
+
+}  // namespace resume
+}  // namespace pushy
+
+#pragma GCC visibility pop

package/cpp/patch_core/state_ops.h

@@ -15,12 +15,14 @@ namespace pushy {
 namespace state_ops {
 
 enum class StateOperation {
+  // <generated:state-operations> (scripts/contract.ts; bun scripts/generate-contract.ts)
   kSwitchVersion = 1,
   kMarkSuccess = 2,
   kRollback = 3,
   kClearFirstTime = 4,
   kClearRollbackMark = 5,
   kResolveLaunch = 6,
+  // </generated:state-operations>
 };
 
 }  // namespace state_ops

package/cpp/update_flow_core/native_config.cpp

@@ -4,7 +4,7 @@
 #include <utility>
 #include <vector>
 
-#include "../patch_core/obscured_text.h"
+#include "../patch_core/native_texts.h"
 
 namespace flowcore {
 
@@ -104,30 +104,10 @@ Value ParseObject(const std::string& json) {
   return ok && value.IsObject() ? value : Value::Undefined();
 }
 
-const std::string& PolicyNextLaunch() {
-  static const std::string value =
-      pushy::text::Reveal("2912e0ffab8e6c70323b1dedd3");
-  return value;
-}
-
-// Pushy's own service addresses, encoded by scripts/encode-native-text.ts.
-std::vector<std::string> DefaultEndpoints() {
-  return {
-      pushy::text::Reveal(
-          "3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5b3d5b9817b592947e5cdefbc8a7e"),
-      pushy::text::Reveal(
-          "3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5f0daac9c644a620ae88ca1ad93"),
-  };
-}
-
-// One literal per address: src/__tests__/nativeTextEncoding.test.ts finds
-// them by pattern.
-std::vector<std::string> DefaultQueryUrls() {
-  return {
-      pushy::text::Reveal("3203e0c1bdd1270a253608fcd3fd9362476817f4f0d5a1996342631be3c2a3a9d779552507fdcde8928a6f512f5ce2ccbdc869404d2f1de79daa826d562c0913eec4fa9b7d4426"),
-      pushy::text::Reveal("3203e0c1bdd1270a213b12b7dca09468462e12f3b0d5bd813d482446f4c6a1be8e79552507fdcda68cd06e5c3710e480a4867048483e55e0c2ab8d7d43030d1ce9c3b183214e2601f2f0d5b782601e2719e8ca"),
-  };
-}
+// Stored encoded (native_texts.h), Pushy's service addresses among them.
+using pushy::texts::DefaultEndpoints;
+using pushy::texts::DefaultQueryUrls;
+using pushy::texts::PolicyNextLaunch;
 
 Value StringArray(const std::vector<std::string>& values) {
   Value array = Value::Array();

package/cpp/update_flow_core/native_round.cpp

@@ -4,7 +4,7 @@
 #include <utility>
 
 #include "../patch_core/hbc_transform_wire.h"
-#include "../patch_core/obscured_text.h"
+#include "../patch_core/native_texts.h"
 #include "native_config.h"
 #include "update_flow_core.h"
 
@@ -14,16 +14,9 @@ using flowjson::Value;
 
 namespace {
 
-// Stored encoded (see obscured_text.h).
-const std::string& QueryPath() {
-  static const std::string value = pushy::text::Reveal("7514fcd4ad805d55263e08fc99");
-  return value;
-}
-const std::string& InfoForceBoot() {
-  static const std::string value =
-      pushy::text::Reveal("3c18e6d2aba9674a360d19ead5a695");
-  return value;
-}
+// Stored encoded (native_texts.h).
+using pushy::texts::InfoForceBoot;
+using pushy::texts::QueryPath;
 
 // The lists NextQueryStep walks, in order; the state's "list" names the
 // current one ("" once the query is over).
@@ -67,14 +60,16 @@ Value StringOr(const Value& value, const char* fallback) {
   return value.IsString() ? value : Value::String(fallback);
 }
 
-// A non-negative integral state counter; anything else reads as 0.
+// A non-negative integral state counter; anything else reads as 0. Capped
+// well inside a 32-bit size_t (armeabi-v7a, x86): converting a double beyond
+// the target's range is undefined.
 size_t Counter(const Value& value) {
   const double number = value.AsNumber();
   if (!value.IsNumber() || !std::isfinite(number) || number < 0) {
     return 0;
   }
-  return number >= 1e15 ? static_cast<size_t>(1e15)
-                        : static_cast<size_t>(number);
+  return number >= 1e9 ? static_cast<size_t>(1e9)
+                       : static_cast<size_t>(number);
 }
 
 // { packageVersion, currentVersion, uuid, rolledBackVersion } — what

package/cpp/update_flow_core/native_round.h

@@ -7,8 +7,8 @@
 // The pure steps of the native cold-start round (NATIVE_CHECKUPDATE_DESIGN
 // §10), one implementation for the Android, iOS and Harmony orchestrators:
 // what to send, which endpoint to ask next, and everything a commit needs
-// from the answer. HTTP, timeouts, locks, downloads and persistence stay
-// native. JS has no counterpart (its client builds its own request through
+// from the answer. round_engine.h drives these steps; HTTP, locks,
+// downloads and persistence stay native. JS has no counterpart (its client builds its own request through
 // src/updateFlowCore.ts buildCheckRequestBody, which BuildRequestBody
 // mirrors); tests/native-round-vectors.json pins this layer.
 //
@@ -31,8 +31,12 @@
 namespace flowcore {
 
 // Total HTTP requests one query may issue: endpoint queries and remote list
-// fetches alike.
+// fetches alike. The JS check's endpoint fallback keeps the same budget for
+// its endpoint queries (src/endpoint.ts MAX_ENDPOINT_REQUESTS; both generated
+// from scripts/contract.ts).
+// <generated:query-budget> (scripts/contract.ts; bun scripts/generate-contract.ts)
 constexpr int kMaxQueryRequests = 8;
+// </generated:query-budget>
 
 // {"body": "<checkUpdate request text>", "query": <first NextQueryStep
 // state>}. The body is BuildRequestBody over the config and env: a non-empty