fix(android): stop split-bundle extraction racing itself

.github/workflows/package-publish.yml

@@ -11,6 +11,14 @@ on:
         options:
           - next
           - latest
+      only_workspace:
+        # A failed package cannot be retried by re-running the whole release:
+        # the 39 that already published reject with E403 and the run goes red
+        # before proving anything about the one that matters.
+        description: "Publish only this workspace, e.g. @onekeyfe/react-native-bundle-crypto. Leave empty to publish every package."
+        required: false
+        default: ""
+        type: string
 
 jobs:
   package-publish:
@@ -28,10 +36,31 @@ jobs:
       - name: Install Package
         run: corepack enable && yarn install
       - name: Publish packages (4 concurrent)
+        if: inputs.only_workspace == ''
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: yarn version:publish --tag "${{ inputs.npm_dist_tag }}"
+          NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
+        run: yarn version:publish --tag "$NPM_DIST_TAG"
       - name: Publish NativeList after shared build dependencies
+        if: inputs.only_workspace == ''
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
+        run: yarn workspace @onekeyfe/react-native-native-list release --tag "$NPM_DIST_TAG"
+      - name: Publish a single workspace
+        if: inputs.only_workspace != ''
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: yarn workspace @onekeyfe/react-native-native-list release --tag "${{ inputs.npm_dist_tag }}"
+          NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
+          ONLY_WORKSPACE: ${{ inputs.only_workspace }}
+        run: yarn workspace "$ONLY_WORKSPACE" release --tag "$NPM_DIST_TAG"
+      # npm reports success the moment it accepts a tarball, which is not the
+      # same as the version becoming available. 3.0.137 went out green with
+      # @onekeyfe/react-native-bundle-crypto staged but never committed: the
+      # version was undownloadable AND unrepublishable, and nothing in this
+      # workflow noticed. Fail the run that produced it instead.
+      - name: Verify the published versions are on the registry
+        env:
+          NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
+          ONLY_WORKSPACE: ${{ inputs.only_workspace }}
+        run: node scripts/verify-published.mjs "$NPM_DIST_TAG" "$ONLY_WORKSPACE"

CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [3.0.139] - 2026-09-16
+
+### Chores
+- **release tooling**: The publish workflow trusted npm's exit code, so a package that npm accepted but never made available still turned the run green — exactly how `@onekeyfe/react-native-bundle-crypto@3.0.137` shipped as a silent partial release. Added `scripts/verify-published.mjs`, which reads each published version back from the registry origin (`?write=true`, since the read-through CDN can serve hours-stale documents and would otherwise fail healthy releases) and requires both that the version is listed and that the dist-tag points at it, polling for up to 10 minutes before failing the run.
+- **release tooling**: Added an `only_workspace` input to the publish workflow. Retrying one failed package previously meant re-running the whole release, where the packages that already published reject with E403 and turn the run red before proving anything about the one that mattered.
+- Bump all 40 publishable packages to 3.0.139. Package contents are unchanged from 3.0.138 — this release exercises the new post-publish verification on a real run.
+
+## [3.0.138] - 2026-09-16
+
+### Bug Fixes
+- **bundle-crypto (iOS)**: Drop the x86_64 simulator architecture from the vendored `Gopenpgp.xcframework`. The package was 14.9 MB packed / 42.5 MB unpacked — 9x the next largest package here and ~100x the median — because the framework carries three ~10 MB gomobile static archives, one of them a fat simulator slice holding both arm64 and x86_64. Now 10.7 MB packed / 30.7 MB unpacked. The slice directory is renamed to match its contents and the xcframework manifest updated; the podspec vendors the whole xcframework, so nothing else referenced the old name. **Intel Mac simulator builds are no longer supported by this module**; Apple Silicon simulator, device, and Mac Catalyst are unchanged. Symbol stripping is not an alternative — `strip -S` rejects the gomobile archives with "string table not at the end of the file".
+
+### Chores
+- Bump all 40 publishable packages to 3.0.138. 3.0.137 shipped for 39 of them, but npm left `@onekeyfe/react-native-bundle-crypto@3.0.137` in a staged-but-never-committed state — undownloadable, and permanently rejecting republishing with `409 Cannot publish over previously staged version`. The version number is unrecoverable, so the whole set moves to 3.0.138 to stay in lockstep.
+
+## [3.0.137] - 2026-09-16
+
+### Bug Fixes
+- **split-bundle-loader (Android)**: Stop the builtin segment extractor from racing itself. The main and background runtimes resolve the same segment independently, and `extractSemaphore` throttles I/O rather than excluding concurrent work on one path, so both could extract the same segment at once into a shared `<name>.tmp` — two `O_TRUNC` writers on one inode, with `renameTo` failing for whichever thread lost. That loser reported `SPLIT_BUNDLE_NOT_FOUND` for a file that was already on disk and complete, and the JS loader caches that code as a permanent failure, so a millisecond-wide race blanked a route for the rest of the process. Seen on the first launch after an APK replace, where the install-stamp wipe forces every segment to re-extract at once. Extraction is now serialized per path, each attempt writes a uniquely named temp file (so no two writers can publish a partially zeroed HBC, across processes too), and a failed rename re-checks the destination before reporting the segment missing.
+
+### Chores
+- Bump all 40 publishable packages to 3.0.137. Published for 39 of them; `@onekeyfe/react-native-bundle-crypto@3.0.137` never became available (see 3.0.138).
+
 ## [3.0.136] - 2026-09-15
 
 ### Bug Fixes

native-modules/native-logger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-native-logger",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-native-logger",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-aes-crypto/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-aes-crypto",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-aes-crypto",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-app-update/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-app-update",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-app-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-async-storage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-async-storage",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-async-storage",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-background-thread/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-background-thread",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-background-thread",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-bundle-crypto/ios/Frameworks/Gopenpgp.xcframework/Info.plist

@@ -8,20 +8,19 @@
 			<key>BinaryPath</key>
 			<string>Gopenpgp.framework/Gopenpgp</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64_x86_64-simulator</string>
+			<string>ios-arm64-simulator</string>
 			<key>LibraryPath</key>
 			<string>Gopenpgp.framework</string>
+			<key>MinimumOSVersion</key>
+			<string>15.5</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
-				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
 			<key>SupportedPlatformVariant</key>
 			<string>simulator</string>
-			<key>MinimumOSVersion</key>
-			<string>15.5</string>
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
@@ -30,6 +29,8 @@
 			<string>ios-arm64-maccatalyst</string>
 			<key>LibraryPath</key>
 			<string>Gopenpgp.framework</string>
+			<key>MinimumOSVersion</key>
+			<string>15.5</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
@@ -38,8 +39,6 @@
 			<string>ios</string>
 			<key>SupportedPlatformVariant</key>
 			<string>maccatalyst</string>
-			<key>MinimumOSVersion</key>
-			<string>15.5</string>
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
@@ -48,23 +47,23 @@
 			<string>ios-arm64</string>
 			<key>LibraryPath</key>
 			<string>Gopenpgp.framework</string>
+			<key>MinimumOSVersion</key>
+			<string>15.5</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
-			<key>MinimumOSVersion</key>
-			<string>15.5</string>
 		</dict>
 	</array>
 	<key>CFBundlePackageType</key>
 	<string>XFWK</string>
+	<key>MinimumOSVersion</key>
+	<string>15.5</string>
 	<key>RCTNewArchEnabled</key>
 	<true/>
 	<key>XCFrameworkFormatVersion</key>
 	<string>1.0</string>
-	<key>MinimumOSVersion</key>
-	<string>15.5</string>
 </dict>
 </plist>

native-modules/react-native-bundle-crypto/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-bundle-crypto",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-bundle-crypto",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-bundle-update/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-bundle-update",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-bundle-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-check-biometric-auth-changed/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-check-biometric-auth-changed",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-check-biometric-auth-changed",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-cloud-fs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-cloud-fs",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-cloud-fs TurboModule for OneKey",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-cloud-kit-module/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-cloud-kit-module",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-cloud-kit-module",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-device-utils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-device-utils",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-device-utils",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-dns-lookup/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-dns-lookup",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-dns-lookup",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-get-random-values/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-get-random-values",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-get-random-values",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-keychain-module/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-keychain-module",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-keychain-module",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-lite-card/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-lite-card",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "lite card",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-network-info/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-network-info",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-network-info",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-network-throttle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-network-throttle",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-network-throttle",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-pbkdf2/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-pbkdf2",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-pbkdf2",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-perf-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-perf-memory",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-perf-memory",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-perf-stats/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-perf-stats",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-perf-stats",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-ping/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-ping",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-ping TurboModule for OneKey",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-range-downloader/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-range-downloader",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-range-downloader",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-sni-connect/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-sni-connect",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "A React Native library for SNI-based HTTP requests with DNS caching and request management",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

native-modules/react-native-splash-screen/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-splash-screen",
-  "version": "3.0.136",
+  "version": "3.0.139",
   "description": "react-native-splash-screen",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",