
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
react-native-automerge-generated
Advanced tools
Native Automerge bindings for React Native via UniFFI
Native Automerge bindings for React Native via compiled Rust + UniFFI.
Replaces the WebAssembly-based Automerge backend with a native Rust implementation exposed through JSI, enabling:
createArrayBuffer patch for JSCRuntime.cppApp TypeScript
│
@automerge/automerge/slim ← UseApi(nativeApi)
│
useapi-adapter.ts (type conversion + API bridge)
│
src/generated/automerge.ts (auto-generated by ubrn)
│ JSI (C++)
cpp/generated/ (auto-generated by ubrn)
│ FFI (C ABI)
uniffi_automerge Rust crate (UniFFI 0.29)
│
automerge core (v0.7.3)
Hand-written components:
rust/ — UniFFI-annotated Rust wrapper (ported from automerge-swift)src/useapi-adapter.ts — bridges generated API to @automerge/automerge/slimEverything else (C++, ObjC++, Kotlin, generated TypeScript) is auto-generated by uniffi-bindgen-react-native.
npm install react-native-automerge-generated
# or
yarn add react-native-automerge-generated
cd ios && pod install
Gradle sync should pick up the native module automatically.
import { UseApi } from '@automerge/automerge/slim';
import { nativeApi } from 'react-native-automerge-generated';
// Initialize once at app startup
UseApi(nativeApi);
// Then use automerge normally
import * as Automerge from '@automerge/automerge/slim';
let doc = Automerge.init();
doc = Automerge.change(doc, d => {
d.key = 'value';
});
const saved = Automerge.save(doc);
const loaded = Automerge.load(saved);
rustup install stablerustup target add aarch64-apple-ios aarch64-apple-ios-simrustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-androidnpm install (dev dependency)# iOS (builds universal static lib + generates bindings)
npm run build:ios
# Android (builds for all ABIs + generates bindings)
npm run build:android
# Check Rust compiles
cd rust && cargo check
rust/
src/
automerge.udl UniFFI interface definition (50+ methods)
doc.rs Doc wrapper around automerge::AutoCommit
sync_state.rs SyncState wrapper
scalar_value.rs ScalarValue enum (String, Int, Uint, F64, etc.)
value.rs Value enum (Object | Scalar)
patches.rs Patch/PatchAction types
obj_id.rs ObjId custom type (ArrayBuffer)
actor_id.rs ActorId custom type (ArrayBuffer)
change_hash.rs ChangeHash custom type (ArrayBuffer)
cursor.rs Cursor custom type (ArrayBuffer)
...
Cargo.toml
src/
useapi-adapter.ts UseApi bridge (NativeAutomerge + nativeApi)
generated/
automerge.ts Auto-generated TypeScript bindings
automerge-ffi.ts Auto-generated FFI layer
index.ts Package entry point
The adapter converts between the generated API types and what @automerge/automerge/slim expects:
| automerge/slim | Generated API | Conversion |
|---|---|---|
ObjId (string "_root") | ArrayBuffer | base64 with o: prefix |
| ChangeHash (hex string) | ArrayBuffer | hex encode/decode |
| ActorId (hex string) | ArrayBuffer | hex encode/decode |
| Cursor (string) | ArrayBuffer | base64 with c: prefix |
Uint8Array | Array<number> | Array.from() / new Uint8Array() |
| JS primitives | ScalarValue tagged union | tag-based dispatch |
unmark(), spans(), getBlock(), updateBlock(), saveBundle(), encodeChange() throw or return empty values. These are not needed for core automerge operations.getChanges() returns concatenated bytes — the Rust encode_changes_since() returns all changes as a single byte array rather than individually split changes. This works for loadIncremental() / applyChanges() but callers expecting individual change objects should be aware.decodeChange() returns partial data — the native implementation returns change metadata (hash, actor, timestamp, message, deps) but not the full ops array or seq/startOp fields.The build process includes a post-build script (scripts/add-useapi-export.sh) that automatically injects the nativeApi export into index.ts after ubrn generates the bindings. This is necessary because ubrn regenerates index.ts from a template on each build.
The export line:
export { nativeApi, NativeAutomerge, NativeSyncState } from './useapi-adapter';
This runs automatically after npm run build:ios or npm run build:android.
The package includes a comprehensive test suite with 40+ test cases covering all major Automerge operations.
# Install dependencies
npm install
# Build the native module first (required)
npm run build:ios # or build:android
# Run tests
npm test
# Run tests in watch mode
npm run test:watch
# Run tests with coverage
npm test -- --coverage
Test coverage includes:
See tests/README.md for detailed test documentation.
Apache 2.0
FAQs
Native Automerge bindings for React Native via UniFFI
The npm package react-native-automerge-generated receives a total of 1 weekly downloads. As such, react-native-automerge-generated popularity was classified as not popular.
We found that react-native-automerge-generated demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.