Remove the kill feature; the product is remote config with update walls and maintenance

Author: meliharik

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+- Removed the kill switch, following its removal from the protocol. Evaluation
+  order is now maintenance → force → soft → none. Old payloads that still carry
+  a `kill` block parse fine; the block is ignored.
+
 ## 0.1.0
 
 First release.

README.md

@@ -1,6 +1,6 @@
 # @ripstop/react-native
 
-**Force update, kill switch, maintenance mode and remote config for React Native.**
+**Remote config, update walls and maintenance mode for React Native.**
 Decided at the edge, verified on device.
 
 [![npm](https://img.shields.io/npm/v/@ripstop/react-native.svg)](https://www.npmjs.com/package/@ripstop/react-native)
@@ -62,9 +62,9 @@ restarts.
 | No network | Uses the last **signed** payload |
 | No network, no cache | `none` — your app runs, unrestricted |
 | Server returns 500, or times out | Cache, then normal |
-| Signature doesn't verify | Discarded. A forged payload can never kill your app |
+| Signature doesn't verify | Discarded. A forged payload can never wall your app |
 | Cache tampered with | Re-verified on read, so it grants nothing |
-| Kill switch on, then network lost | The kill **stays**, until a fresh signed payload clears it |
+| Maintenance on, then network lost | The wall **stays**, until a fresh signed payload clears it |
 
 ## About `crypto.subtle`
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ripstop/react-native",
   "version": "0.1.0",
-  "description": "Force update, kill switch, maintenance mode and remote config for React Native — signed at the edge, verified on device.",
+  "description": "Remote config, update walls and maintenance mode for React Native — signed at the edge, verified on device.",
   "license": "MIT",
   "repository": { "type": "git", "url": "git+https://github.com/ripstop-dev/ripstop-react-native.git" },
   "homepage": "https://ripstop.dev/docs/react-native",
@@ -37,5 +37,5 @@
     "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"
   },
-  "keywords": ["react-native", "force-update", "kill-switch", "remote-config", "maintenance-mode"]
+  "keywords": ["react-native", "force-update", "remote-config", "maintenance-mode"]
 }

src/client.ts

@@ -176,7 +176,7 @@ export class Ripstop {
   /**
    * Adopts a payload only if it still verifies. Cached payloads get the same
    * scrutiny as fresh ones — localStorage is editable from the console, so
-   * trusting it would make the kill switch a suggestion.
+   * trusting it would make every wall a suggestion.
    */
   private async adopt(
     body: string,

src/evaluate.ts

@@ -28,7 +28,6 @@ export interface EvaluateContext {
 }
 
 export type Decision =
-  | { type: 'kill'; message: string }
   | {
       type: 'maintenance';
       title: string;
@@ -52,26 +51,7 @@ export function evaluate(config: RipstopConfig, ctx: EvaluateContext): Decision
   const locale = ctx.locale ?? FALLBACK_LOCALE;
   const version = parseVersion(ctx.appVersion);
 
-  // 1. Kill
-  const kill = config.kill;
-  if (kill.active) {
-    const platformMatch = kill.platforms.length === 0 || kill.platforms.includes(ctx.platform);
-    let rangeMatch = kill.version_ranges.length === 0;
-    if (!rangeMatch && version !== null) {
-      rangeMatch = kill.version_ranges.some((r) => {
-        const from = r.from === undefined ? null : parseVersion(r.from);
-        const to = r.to === undefined ? null : parseVersion(r.to);
-        if (from !== null && compareParsed(version, from) < 0) return false;
-        if (to !== null && compareParsed(version, to) > 0) return false;
-        return true;
-      });
-    }
-    if (platformMatch && rangeMatch) {
-      return { type: 'kill', message: resolveMessage(config, locale, kill.message_key) };
-    }
-  }
-
-  // 2. Maintenance — `active` is server-evaluated at fetch time; starts_at/ends_at are display-only.
+  // 1. Maintenance — `active` is server-evaluated at fetch time; starts_at/ends_at are display-only.
   const maintenance = config.maintenance;
   if (maintenance.active) {
     return {
@@ -85,7 +65,7 @@ export function evaluate(config: RipstopConfig, ctx: EvaluateContext): Decision
     };
   }
 
-  // 3–4. Force / soft — need a platform entry and a parseable version; otherwise fail open.
+  // 2–3. Force / soft — need a platform entry and a parseable version; otherwise fail open.
   const entry = config.update[ctx.platform];
   if (entry === undefined || version === null) return { type: 'none' };
 
@@ -124,8 +104,8 @@ export function evaluate(config: RipstopConfig, ctx: EvaluateContext): Decision
 /**
  * Fail-open state machine (README §9): which config may drive a decision after
  * a fetch attempt. Any failure falls back to the last cached *signed* config;
- * with no cache, behave as `none`. Kill stickiness follows: a cached kill stays
- * in force until a fresh, signed config clears it.
+ * with no cache, behave as `none`. Stickiness follows: a cached restriction
+ * stays in force until a fresh, signed config clears it.
  */
 export type FetchOutcome = 'ok' | 'http_error' | 'timeout' | 'invalid_signature';
 export type ConfigSource = 'fresh' | 'cached' | 'none';

src/index.tsx

@@ -84,7 +84,7 @@ export function RipstopProvider({
 
   // Options are read once, on mount: an SDK that re-initialises because a
   // parent re-rendered would refetch on every keystroke somewhere up the tree.
-  const initial = useMemo(() => options, []); // eslint-disable-line react-hooks/exhaustive-deps
+  const initial = useMemo(() => options, []);
 
   useEffect(() => {
     let cancelled = false;
@@ -161,14 +161,6 @@ function Walls({
   if (loading) return <>{children}</>;
 
   switch (decision.type) {
-    case 'kill':
-      return (
-        <Wall
-          theme={theme}
-          title={decision.message || 'This version is no longer available'}
-          body=""
-        />
-      );
     case 'maintenance':
       return (
         <Wall

src/storage.ts

@@ -4,8 +4,8 @@
  * The payload is stored *with* its signature and re-verified on read, so a
  * cached config carries exactly as much authority as a fresh one — and no more.
  * On the web this matters more than on mobile: localStorage is two keystrokes
- * away in devtools, so a cache that were trusted would make the kill switch a
- * polite request.
+ * away in devtools, so a cache that were trusted would make a maintenance wall
+ * a polite request.
  */
 
 export interface CachedConfig {

src/types.ts

@@ -19,21 +19,6 @@ export type JsonValue =
   | JsonValue[]
   | { [key: string]: JsonValue };
 
-export interface VersionRange {
-  /** Inclusive; absent means unbounded. */
-  from?: string;
-  to?: string;
-}
-
-export interface KillSwitch {
-  active: boolean;
-  /** Empty means every platform. */
-  platforms: Platform[];
-  /** Empty means every version. */
-  version_ranges: VersionRange[];
-  message_key: string;
-}
-
 export interface Maintenance {
   /** Server-evaluated at fetch time. The browser never checks the schedule. */
   active: boolean;
@@ -63,7 +48,6 @@ export interface RipstopConfig {
   env: string;
   published_at: string;
   key_id: string;
-  kill: KillSwitch;
   maintenance: Maintenance;
   update: Partial<Record<Platform, UpdateEntry>>;
   values: Record<string, JsonValue>;
@@ -85,7 +69,8 @@ const int = (v: unknown, fallback: number): number =>
  * Forgiving in exactly one direction: unknown fields are ignored, so a newer
  * control plane can add one without breaking apps already in the field. A
  * field we do recognise but cannot read makes the whole payload null, and a
- * null payload never drives a decision.
+ * null payload never drives a decision. The retired `kill` block rides the
+ * same rule: old cached payloads still carry it, and it is simply not read.
  */
 export function parseConfig(input: unknown): RipstopConfig | null {
   if (!isRecord(input)) return null;
@@ -122,7 +107,6 @@ export function parseConfig(input: unknown): RipstopConfig | null {
     messages[locale] = out;
   }
 
-  const kill = isRecord(input.kill) ? input.kill : {};
   const maintenance = isRecord(input.maintenance) ? input.maintenance : {};
 
   return {
@@ -131,19 +115,6 @@ export function parseConfig(input: unknown): RipstopConfig | null {
     env: str(input.env, 'production'),
     published_at: str(input.published_at),
     key_id: str(input.key_id),
-    kill: {
-      active: bool(kill.active),
-      platforms: Array.isArray(kill.platforms)
-        ? (kill.platforms.filter((p) => typeof p === 'string') as Platform[])
-        : [],
-      version_ranges: Array.isArray(kill.version_ranges)
-        ? kill.version_ranges.filter(isRecord).map((r) => ({
-            ...(typeof r.from === 'string' ? { from: r.from } : {}),
-            ...(typeof r.to === 'string' ? { to: r.to } : {}),
-          }))
-        : [],
-      message_key: str(kill.message_key, 'kill_default'),
-    },
     maintenance: {
       active: bool(maintenance.active),
       starts_at: typeof maintenance.starts_at === 'string' ? maintenance.starts_at : null,

src/verify.ts

@@ -10,7 +10,7 @@
  * anything is parsed. `JSON.parse` then `JSON.stringify` would produce
  * different bytes for the same document and reject payloads that were genuine.
  */
-import { etc, hashes, verifyAsync } from '@noble/ed25519';
+import { hashes, verifyAsync } from '@noble/ed25519';
 import { sha512 } from '@noble/hashes/sha2';
 
 // Wired once, at module load, before any verification can run.

test/client.test.ts

@@ -26,21 +26,15 @@ beforeAll(async () => {
   publicKeyB64 = bytesToBase64(await getPublicKeyAsync(privateKey));
 });
 
-function config(options: { kill?: boolean; min?: string; target?: string } = {}) {
+function config(options: { maintenance?: boolean; min?: string; target?: string } = {}) {
   return {
     v: 1,
     app: 'app_test',
     env: 'production',
     published_at: '2026-01-01T00:00:00Z',
     key_id: KEY_ID,
-    kill: {
-      active: options.kill ?? false,
-      platforms: [],
-      version_ranges: [],
-      message_key: 'kill_default',
-    },
     maintenance: {
-      active: false,
+      active: options.maintenance ?? false,
       starts_at: null,
       ends_at: null,
       message_key: 'maint_default',
@@ -61,7 +55,8 @@ function config(options: { kill?: boolean; min?: string; target?: string } = {})
         force_body: 'Reload to continue.',
         soft_title: 'Update available',
         soft_body: 'A new version is ready.',
-        kill_default: 'App unavailable',
+        maint_title: 'Back shortly',
+        maint_default: 'Down for maintenance.',
       },
     },
   };
@@ -118,7 +113,7 @@ describe('the client', () => {
   });
 
   it('refuses a forged signature and lets the app run', async () => {
-    const { impl } = server(config({ kill: true }), { corrupt: true });
+    const { impl } = server(config({ maintenance: true }), { corrupt: true });
     const gate = await boot(impl);
 
     expect((await gate.check()).type).toBe('none');
@@ -133,23 +128,23 @@ describe('the client', () => {
 
   it('falls back to cache when the network fails', async () => {
     const storage = new MemoryStorage();
-    const good = server(config({ kill: true }));
+    const good = server(config({ maintenance: true }));
     const first = await boot(good.impl, { storage });
-    expect((await first.check()).type).toBe('kill');
+    expect((await first.check()).type).toBe('maintenance');
 
     const broken = server(config(), { status: 500 });
     const second = await boot(broken.impl, { storage });
 
-    expect((await second.check()).type).toBe('kill');
+    expect((await second.check()).type).toBe('maintenance');
     expect(second.source).toBe('cached');
   });
 
   it('refuses a tampered cache', async () => {
     const storage = new MemoryStorage();
-    const good = server(config({ kill: true }));
+    const good = server(config({ maintenance: true }));
     await boot(good.impl, { storage });
 
-    // Someone opens devtools and edits localStorage to lift the kill.
+    // Someone opens devtools and edits localStorage to lift the wall.
     const raw = JSON.parse(storage.read(`ripstop.config.${KEY}`)!) as { body: string };
     raw.body = JSON.stringify(config());
     storage.write(`ripstop.config.${KEY}`, JSON.stringify(raw));