@_nazmiforreal/flutter-ota 0.1.5 → 0.1.7

package/dart-src/packages/cli-tools/lib/src/config.dart

@@ -1,19 +1,20 @@
 import 'dart:convert';
 import 'dart:io';
 
-import 'package:flutter_patcher_aws/flutter_patcher_aws.dart';
+import 'package:flutter_ota_kit_aws/flutter_ota_kit_aws.dart';
 import 'package:postgres/postgres.dart';
-import 'package:flutter_patcher_cloudflare/flutter_patcher_cloudflare.dart';
-import 'package:flutter_patcher_postgres/flutter_patcher_postgres.dart';
-import 'package:flutter_patcher_standalone/flutter_patcher_standalone.dart';
-import 'package:flutter_patcher_supabase/flutter_patcher_supabase.dart';
+import 'package:flutter_ota_kit_cloudflare/flutter_ota_kit_cloudflare.dart';
+import 'package:flutter_ota_kit_postgres/flutter_ota_kit_postgres.dart';
+
+import 'package:flutter_ota_kit_supabase/flutter_ota_kit_supabase.dart';
 import 'package:path/path.dart' as p;
 
-/// Resolved configuration for the flutter_patcher CLI.
+/// Resolved configuration for the flutter_ota_kit CLI.
 ///
 /// Mirrors hot-updater's config precedence: explicit flags > environment
-/// variables > the project `.flutter_patcher.json` (falling back to the global
-/// `~/.flutter_patcher/config.json`).
+/// variables > the project `.otat/config.json` (falling back to the global
+/// `~/.otat/config.json`). All CLI working state lives under `.otat/` so it can
+/// be git-ignored as a single unit.
 class FlutterPatcherConfig {
   FlutterPatcherConfig({
     required this.provider,
@@ -21,7 +22,6 @@ class FlutterPatcherConfig {
     this.postgres = const PostgresConfigJson(),
     this.cloudflare = const CloudflareConfigJson(),
     this.aws = const AwsConfigJson(),
-    this.standalone = const StandaloneConfigJson(),
     this.channel = 'production',
     this.platform = 'android',
     this.source = './dist',
@@ -43,9 +43,6 @@ class FlutterPatcherConfig {
         aws: AwsConfigJson.fromJson(
           (json['aws'] as Map?)?.cast<String, dynamic>() ?? {},
         ),
-        standalone: StandaloneConfigJson.fromJson(
-          (json['standalone'] as Map?)?.cast<String, dynamic>() ?? {},
-        ),
         channel: json['channel'] as String? ?? 'production',
         platform: json['platform'] as String? ?? 'android',
         source: json['source'] as String? ?? './dist',
@@ -57,7 +54,6 @@ class FlutterPatcherConfig {
   final PostgresConfigJson postgres;
   final CloudflareConfigJson cloudflare;
   final AwsConfigJson aws;
-  final StandaloneConfigJson standalone;
   final String channel;
   final String platform;
   final String source;
@@ -69,7 +65,6 @@ class FlutterPatcherConfig {
         'postgres': postgres.toJson(),
         'cloudflare': cloudflare.toJson(),
         'aws': aws.toJson(),
-        'standalone': standalone.toJson(),
         'channel': channel,
         'platform': platform,
         'source': source,
@@ -82,7 +77,6 @@ class FlutterPatcherConfig {
     PostgresConfigJson? postgres,
     CloudflareConfigJson? cloudflare,
     AwsConfigJson? aws,
-    StandaloneConfigJson? standalone,
     String? channel,
     String? platform,
     String? source,
@@ -94,7 +88,6 @@ class FlutterPatcherConfig {
         postgres: postgres ?? this.postgres,
         cloudflare: cloudflare ?? this.cloudflare,
         aws: aws ?? this.aws,
-        standalone: standalone ?? this.standalone,
         channel: channel ?? this.channel,
         platform: platform ?? this.platform,
         source: source ?? this.source,
@@ -110,6 +103,8 @@ class SupabaseConfigJson {
     this.anonKey,
     this.bucket,
     this.basePath,
+    this.managementKey,
+    this.databaseUrl,
   });
 
   factory SupabaseConfigJson.fromJson(Map<String, dynamic> json) =>
@@ -119,6 +114,8 @@ class SupabaseConfigJson {
         anonKey: json['anonKey'] as String?,
         bucket: json['bucket'] as String?,
         basePath: json['basePath'] as String?,
+        managementKey: json['managementKey'] as String?,
+        databaseUrl: json['databaseUrl'] as String?,
       );
 
   final String? url;
@@ -126,6 +123,8 @@ class SupabaseConfigJson {
   final String? anonKey;
   final String? bucket;
   final String? basePath;
+  final String? managementKey;
+  final String? databaseUrl;
 
   Map<String, dynamic> toJson() => {
         if (url != null) 'url': url,
@@ -133,16 +132,20 @@ class SupabaseConfigJson {
         if (anonKey != null) 'anonKey': anonKey,
         if (bucket != null) 'bucket': bucket,
         if (basePath != null) 'basePath': basePath,
+        if (managementKey != null) 'managementKey': managementKey,
+        if (databaseUrl != null) 'databaseUrl': databaseUrl,
       };
 }
 
-/// Search order for a config file on disk.
+/// Search order for a config file on disk. Both the project config and the
+/// global config live under a `.otat/` directory so all CLI state is grouped
+/// in one place (and can be git-ignored together).
 List<File> configCandidates() {
-  final cwd = File(p.join(Directory.current.path, '.flutter_patcher.json'));
+  final cwd = File(p.join(Directory.current.path, '.otat', 'config.json'));
   final home = Platform.environment['HOME'] ??
       Platform.environment['USERPROFILE'] ??
       '';
-  final global = File(p.join(home, '.flutter_patcher', 'config.json'));
+  final global = File(p.join(home, '.otat', 'config.json'));
   return [cwd, global];
 }
 
@@ -162,7 +165,7 @@ FlutterPatcherConfig? loadConfig() {
 }
 
 /// Persist a config. By default writes the project file (cwd); pass
-/// [global: true] to write the global `~/.flutter_patcher/config.json`.
+/// [global: true] to write the global `~/.flutter_ota_kit/config.json`.
 void saveConfig(FlutterPatcherConfig config, {bool global = false}) {
   final file = global ? configCandidates().last : configCandidates().first;
   file.parent.createSync(recursive: true);
@@ -228,7 +231,7 @@ SupabaseServiceRoleConfig resolveSupabaseConfig(
   if (resolvedUrl == null || resolvedUrl.isEmpty) {
     throw StateError(
       'Supabase URL is required. Set it via --url, SUPABASE_URL, or '
-      '`flutter_patcher config set supabase.url <url>`.',
+      '`flutter_ota_kit config set supabase.url <url>`.',
     );
   }
 
@@ -368,7 +371,7 @@ PostgresConfig resolvePostgresDatabaseConfig(
   if (resolvedHost == null || resolvedHost.isEmpty) {
     throw StateError(
       'Postgres host is required. Set --pg-host, POSTGRES_HOST, or '
-      '`flutter_patcher config set postgres.host <host>`.',
+      '`flutter_ota_kit config set postgres.host <host>`.',
     );
   }
 
@@ -485,7 +488,7 @@ D1DatabaseConfig resolveCloudflareDatabaseConfig(
       resolvedToken == null) {
     throw StateError(
       'Cloudflare requires accountId, d1DatabaseId and apiToken. Set them via '
-      'flags, CLOUDFLARE_* env vars, or `flutter_patcher config set cloudflare.*`.',
+      'flags, CLOUDFLARE_* env vars, or `flutter_ota_kit config set cloudflare.*`.',
     );
   }
 
@@ -526,7 +529,7 @@ R2S3StorageConfig resolveCloudflareStorageConfig(
       resolvedSecret == null) {
     throw StateError(
       'Cloudflare R2 requires accountId, accessKeyId and secretAccessKey. Set '
-      'them via flags, R2_* env vars, or `flutter_patcher config set cloudflare.*`.',
+      'them via flags, R2_* env vars, or `flutter_ota_kit config set cloudflare.*`.',
     );
   }
 
@@ -612,7 +615,7 @@ S3DatabaseConfig resolveAwsDatabaseConfig(
       resolvedSecret == null) {
     throw StateError(
       'AWS requires bucket, region, accessKeyId and secretAccessKey. Set them '
-      'via flags, AWS_* env vars, or `flutter_patcher config set aws.*`.',
+      'via flags, AWS_* env vars, or `flutter_ota_kit config set aws.*`.',
     );
   }
 
@@ -656,7 +659,7 @@ AwsS3StorageConfig resolveAwsStorageConfig(
       resolvedSecret == null) {
     throw StateError(
       'AWS requires bucket, region, accessKeyId and secretAccessKey. Set them '
-      'via flags, AWS_* env vars, or `flutter_patcher config set aws.*`.',
+      'via flags, AWS_* env vars, or `flutter_ota_kit config set aws.*`.',
     );
   }
 
@@ -671,55 +674,3 @@ AwsS3StorageConfig resolveAwsStorageConfig(
     clientFactory: clientFactory ?? defaultAwsS3ClientFactory,
   );
 }
-
-/// Standalone (self-hosted) section of [FlutterPatcherConfig].
-class StandaloneConfigJson {
-  const StandaloneConfigJson({this.baseUrl});
-
-  factory StandaloneConfigJson.fromJson(Map<String, dynamic> json) =>
-      StandaloneConfigJson(baseUrl: json['baseUrl'] as String?);
-
-  final String? baseUrl;
-
-  Map<String, dynamic> toJson() =>
-      {if (baseUrl != null) 'baseUrl': baseUrl};
-}
-
-/// Resolve the standalone repository (database) config.
-StandaloneRepositoryConfig resolveStandaloneDatabaseConfig(
-  FlutterPatcherConfig config, {
-  String? baseUrl,
-  StandaloneClientFactory? clientFactory,
-}) {
-  final env = Platform.environment;
-  final resolvedBaseUrl =
-      baseUrl ?? env['STANDALONE_BASE_URL'] ?? config.standalone.baseUrl;
-  if (resolvedBaseUrl == null || resolvedBaseUrl.isEmpty) {
-    throw StateError(
-      'Standalone baseUrl is required. Set --base-url, STANDALONE_BASE_URL, '
-      'or `flutter_patcher config set standalone.baseUrl <url>`.',
-    );
-  }
-  return StandaloneRepositoryConfig(
-    baseUrl: resolvedBaseUrl,
-    clientFactory: clientFactory,
-  );
-}
-
-/// Resolve the standalone storage config (shares the same self-hosted base).
-StandaloneStorageConfig resolveStandaloneStorageConfig(
-  FlutterPatcherConfig config, {
-  String? baseUrl,
-  StandaloneClientFactory? clientFactory,
-}) {
-  final db = resolveStandaloneDatabaseConfig(
-    config,
-    baseUrl: baseUrl,
-    clientFactory: clientFactory,
-  );
-  return StandaloneStorageConfig(
-    baseUrl: db.baseUrl,
-    commonHeaders: db.commonHeaders,
-    clientFactory: clientFactory,
-  );
-}

package/dart-src/packages/cli-tools/lib/src/operations.dart

@@ -2,8 +2,8 @@ import 'dart:convert';
 import 'dart:io';
 
 import 'package:crypto/crypto.dart';
-import 'package:flutter_patcher_core/flutter_patcher_core.dart';
-import 'package:flutter_patcher_plugin_core/flutter_patcher_plugin_core.dart';
+import 'package:flutter_ota_kit_core/flutter_ota_kit_core.dart';
+import 'package:flutter_ota_kit_plugin_core/flutter_ota_kit_plugin_core.dart';
 
 import 'backend.dart';
 import 'sign.dart';
@@ -61,7 +61,7 @@ Future<Bundle> deployBundle(Backend backend, DeployOptions opts) async {
     );
   }
   // Resolve the artifact to upload. If the source is already a zip (e.g. the
-  // `patch.zip` produced by `flutter_patcher build`/`pack`), upload it directly.
+  // `patch.zip` produced by `flutter_ota_kit build`/`pack`), upload it directly.
   // Otherwise, if the source directory contains a `patch.zip`, use that. As a
   // fallback, zip the source directory (for pre-built bundle layouts).
   final sourceFile = File(opts.source);
@@ -93,7 +93,7 @@ Future<Bundle> deployBundle(Backend backend, DeployOptions opts) async {
         : null;
 
     final bundleId = opts.bundleId ?? uuidV7();
-    final key = backend.storageKeyFor(bundleId, 'patch.zip');
+    final key = bundleId;
     final uploaded = await backend.storage.upload(key, zipPath);
     final storageUri = uploaded['storageUri'];
     if (storageUri == null || storageUri.isEmpty) {

package/dart-src/packages/cli-tools/lib/src/pack.dart

@@ -33,7 +33,7 @@ class PackResult {
 /// Pack a release APK into a device-compatible OTA patch (`patch.zip`).
 ///
 /// Mirrors the standalone `bin/pack.dart` CLI, but as a library usable by the
-/// `flutter_patcher build` command. Includes **every** ABI found in the APK so
+/// `flutter_ota_kit build` command. Includes **every** ABI found in the APK so
 /// a single bundle serves all device ABIs (the device SDK picks its ABI).
 Future<PackResult> packPatch({
   required String apkPath,
@@ -73,6 +73,7 @@ Future<PackResult> packPatch({
     version: version,
     targetVersionCode: targetVersionCode,
     requestedAssets: requestedAssets,
+    abi: abi,
     onProgress: onProgress,
   );
   return result;
@@ -85,8 +86,13 @@ PackResult _writePatchPackage({
   required String version,
   required int targetVersionCode,
   required List<String> requestedAssets,
+  String? abi,
   void Function(int done, int total, String label)? onProgress,
 }) {
+  // When an ABI is requested, restrict the patch to only that ABI instead of
+  // shipping every architecture found in the APK.
+  final effectiveLibs =
+      abi == null ? libs : libs.where((e) => e.$1 == abi).toList();
   final patchFiles = <String, _PatchAssetFile>{};
   final operations = <Map<String, dynamic>>[];
   var baseManifestSize = 0;
@@ -144,7 +150,7 @@ PackResult _writePatchPackage({
   }
 
   final libManifest = <String, dynamic>{
-    for (final (currentAbi, soBytes) in libs) currentAbi: {
+    for (final (currentAbi, soBytes) in effectiveLibs) currentAbi: {
       'path': 'lib/$currentAbi/libapp.so',
       'md5': md5.convert(soBytes).toString(),
     },
@@ -172,10 +178,10 @@ PackResult _writePatchPackage({
 
   final package = Archive()
     ..addFile(_jsonArchiveFile('manifest.json', zipManifest));
-  final progressTotal = libs.length + 1;
+  final progressTotal = effectiveLibs.length + 1;
   onProgress?.call(0, progressTotal, 'libapp.so');
   var progressDone = 0;
-  for (final (currentAbi, soBytes) in libs) {
+  for (final (currentAbi, soBytes) in effectiveLibs) {
     package.addFile(
         ArchiveFile('lib/$currentAbi/libapp.so', soBytes.length, soBytes));
     progressDone++;
@@ -210,7 +216,7 @@ PackResult _writePatchPackage({
     'version': version,
     'md5': payloadMd5,
     'targetVersionCode': targetVersionCode,
-    'abis': libs.map((e) => e.$1).toList(),
+    'abis': effectiveLibs.map((e) => e.$1).toList(),
     'payload': 'patch.zip',
   };
   _writeJson(File('${outDir.path}/manifest.json'), outerManifest);
@@ -218,7 +224,7 @@ PackResult _writePatchPackage({
   return PackResult(
     payloadPath: outZip.path,
     manifestPath: '${outDir.path}/manifest.json',
-    abis: libs.map((e) => e.$1).toList(),
+    abis: effectiveLibs.map((e) => e.$1).toList(),
     md5: payloadMd5,
     version: version,
     targetVersionCode: targetVersionCode,

package/dart-src/packages/cli-tools/lib/src/runner.dart

@@ -1,18 +1,34 @@
 import 'dart:io';
 
+import 'package:args/args.dart';
 import 'package:args/command_runner.dart';
 import 'ui/ui.dart';
+import 'verbose.dart';
 
 /// Custom [CommandRunner] that renders a clean, colorized top-level help.
 class FlutterPatcherRunner extends CommandRunner<int> {
-  FlutterPatcherRunner(String name, String description)
-      : super(name, description);
+  FlutterPatcherRunner(super.name, super.description) {
+    argParser.addFlag(
+      'verbose',
+      abbr: 'v',
+      help: 'Show full error stack traces.',
+      negatable: false,
+    );
+  }
+
+  @override
+  Future<int?> runCommand(ArgResults results) {
+    verboseMode = results['verbose'] as bool? ?? false;
+    return super.runCommand(results);
+  }
 
   @override
   String get usage {
     final names = commands.keys.toList()..sort();
     var maxName = 0;
-    for (final n in names) maxName = maxName < n.length ? n.length : maxName;
+    for (final n in names) {
+      maxName = maxName < n.length ? n.length : maxName;
+    }
     final buf = StringBuffer();
     buf.writeln('  ${cyan('▶')} ${cyan(bold(executableName))} '
         '${dim('·')} ${bold(description)}');
@@ -28,6 +44,9 @@ class FlutterPatcherRunner extends CommandRunner<int> {
     }
     buf.writeln('');
     buf.writeln('  ${dim('Run "$executableName help <command>" for more about a command.')}');
+    buf.writeln('');
+    buf.writeln('  ${bold('GLOBAL OPTIONS')}');
+    buf.writeln('    ${cyan('-v, --verbose')}  ${dim('Show full error stack traces.')}');
     return buf.toString();
   }
 
@@ -47,13 +66,13 @@ String _fullName(Command<int> command) {
   return parts.join(' ');
 }
 
-/// Base class for flutter_patcher commands; renders a clean, colorized
-/// per-command help (used by `flutter_patcher <cmd> --help`).
+/// Base class for flutter_ota_kit commands; renders a clean, colorized
+/// per-command help (used by `flutter_ota_kit <cmd> --help`).
 abstract class FlutterPatcherCommand extends Command<int> {
   @override
   String get usage {
     final buf = StringBuffer();
-    buf.writeln('  ${cyan(bold(name))} ${dim('·')} ${description}');
+    buf.writeln('  ${cyan(bold(name))} ${dim('·')} $description');
     buf.writeln('');
     buf.writeln('  ${bold('USAGE')}');
     buf.writeln('    ${_fullName(this)} [arguments]');

package/dart-src/packages/cli-tools/lib/src/ui/ui.dart

@@ -4,7 +4,7 @@ import 'dart:async';
 import 'dart:io';
 import 'dart:math' as math;
 
-/// Terminal UI toolkit for the flutter_patcher CLI: colored text, banners,
+/// Terminal UI toolkit for the flutter_ota_kit CLI: colored text, banners,
 /// bordered boxes, step logs, dynamic spinners and progress bars.
 ///
 /// Everything degrades gracefully to plain text when stdout is not a TTY or the
@@ -61,7 +61,7 @@ String kv(String k, String v) {
 
 void banner(String name) {
   _echo('');
-  _echo('  ${cyan('▶')} ${cyan(bold('flutter_patcher'))} ${dim('·')} ${bold(name)}');
+  _echo('  ${cyan('▶')} ${cyan(bold('flutter_ota_kit'))} ${dim('·')} ${bold(name)}');
   _echo('  ${dim('─' * math.min(_cols - 4, 60))}');
 }
 
@@ -173,7 +173,9 @@ void box(String title, List<String> lines) {
   final width = _boxWidth(lines, title);
   final inner = width - 4;
   final wrapped = <String>[];
-  for (final l in lines) wrapped.addAll(_wrap(l, inner));
+  for (final l in lines) {
+    wrapped.addAll(_wrap(l, inner));
+  }
 
   final titleText = ' $title ';
   final tVisible = _dispWidth(titleText);

package/dart-src/packages/cli-tools/lib/src/verbose.dart

@@ -0,0 +1,3 @@
+/// Global verbose flag, set from the top-level `--verbose`/`-v` option so
+/// [runGuarded] can emit stack traces on failure.
+bool verboseMode = false;

package/dart-src/packages/cli-tools/migrations/aws/README.md

@@ -0,0 +1,7 @@
+# AWS migrations
+
+The AWS backend stores bundle metadata as JSON in S3 (blob database), not in a
+relational database. There are **no SQL migrations** to apply — the bucket and
+object prefix are created on first `deploy`.
+
+If you front downloads with CloudFront, provision the distribution separately.

package/dart-src/packages/cli-tools/migrations/postgres/bundles.sql

@@ -0,0 +1,45 @@
+-- HotUpdater.bundles
+
+CREATE TYPE platforms AS ENUM ('ios', 'android');
+
+CREATE TABLE bundles (
+    id uuid PRIMARY KEY,
+    platform platforms NOT NULL,
+    should_force_update boolean NOT NULL,
+    enabled boolean NOT NULL,
+    file_hash text NOT NULL,
+    git_commit_hash text,
+    message text,
+    channel text NOT NULL DEFAULT 'production',
+    storage_uri text NOT NULL,
+    target_app_version text,
+    fingerprint_hash text,
+    CONSTRAINT check_version_or_fingerprint CHECK (
+        (target_app_version IS NOT NULL) OR (fingerprint_hash IS NOT NULL)
+    ),
+    metadata jsonb DEFAULT '{}'::jsonb,
+    manifest_storage_uri text,
+    manifest_file_hash text,
+    asset_base_storage_uri text,
+    rollout_cohort_count INTEGER DEFAULT 1000
+      CHECK (rollout_cohort_count >= 0 AND rollout_cohort_count <= 1000),
+    target_cohorts TEXT[]
+);
+
+CREATE TABLE bundle_patches (
+    id text PRIMARY KEY,
+    bundle_id uuid NOT NULL REFERENCES bundles(id) ON DELETE CASCADE,
+    base_bundle_id uuid NOT NULL REFERENCES bundles(id) ON DELETE CASCADE,
+    base_file_hash text NOT NULL,
+    patch_file_hash text NOT NULL,
+    patch_storage_uri text NOT NULL,
+    order_index integer NOT NULL DEFAULT 0
+);
+
+CREATE INDEX bundles_target_app_version_idx ON bundles(target_app_version);
+CREATE INDEX bundles_fingerprint_hash_idx ON bundles(fingerprint_hash);
+CREATE INDEX bundles_channel_idx ON bundles(channel);
+CREATE INDEX bundles_rollout_idx ON bundles(rollout_cohort_count);
+CREATE INDEX bundles_target_cohorts_idx ON bundles USING GIN (target_cohorts);
+CREATE INDEX bundle_patches_bundle_id_idx ON bundle_patches(bundle_id);
+CREATE INDEX bundle_patches_base_bundle_id_idx ON bundle_patches(base_bundle_id);

package/dart-src/packages/cli-tools/migrations/postgres/get_target_app_version_list.sql

@@ -0,0 +1,21 @@
+-- HotUpdater.get_target_app_version_list
+
+CREATE OR REPLACE FUNCTION get_target_app_version_list (
+    app_platform platforms,
+    min_bundle_id uuid
+)
+RETURNS TABLE (
+    target_app_version text
+)
+LANGUAGE plpgsql
+AS
+$$
+BEGIN
+    RETURN QUERY
+    SELECT b.target_app_version
+    FROM bundles b 
+    WHERE b.platform = app_platform
+    AND b.id >= min_bundle_id
+    GROUP BY b.target_app_version;
+END;
+$$;

package/dart-src/packages/cli-tools/migrations/postgres/get_update_info_by_app_version.sql

@@ -0,0 +1,126 @@
+-- HotUpdater.get_update_info_by_app_version
+
+DROP FUNCTION IF EXISTS get_update_info_by_app_version;
+
+CREATE OR REPLACE FUNCTION get_update_info_by_app_version (
+    app_platform   platforms,
+    app_version text,
+    bundle_id  uuid,
+    min_bundle_id uuid,
+    target_channel text,
+    target_app_version_list text[],
+    cohort TEXT DEFAULT NULL
+)
+RETURNS TABLE (
+    id            uuid,
+    should_force_update  boolean,
+    message       text,
+    status        text,
+    storage_uri   text,
+    file_hash     text
+)
+LANGUAGE plpgsql
+AS
+$$
+DECLARE
+    NIL_UUID CONSTANT uuid := '00000000-0000-0000-0000-000000000000';
+BEGIN
+    RETURN QUERY
+    WITH candidate_bundles AS (
+        SELECT
+            b.id,
+            b.should_force_update,
+            b.message,
+            b.storage_uri,
+            b.file_hash,
+            b.rollout_cohort_count,
+            b.target_cohorts
+        FROM bundles b
+        WHERE b.enabled = TRUE
+          AND b.platform = app_platform
+          AND b.id >= min_bundle_id
+          AND b.target_app_version IN (SELECT unnest(target_app_version_list))
+          AND b.channel = target_channel
+    ),
+    current_candidate AS (
+        SELECT
+            cb.id,
+            is_cohort_eligible(
+                cb.id,
+                cohort,
+                cb.rollout_cohort_count,
+                cb.target_cohorts
+            ) AS is_eligible
+        FROM candidate_bundles cb
+        WHERE cb.id = bundle_id
+        LIMIT 1
+    ),
+    eligible_update_candidate AS (
+        SELECT
+            cb.id,
+            cb.should_force_update,
+            cb.message,
+            'UPDATE' AS status,
+            cb.storage_uri,
+            cb.file_hash
+        FROM candidate_bundles cb
+        WHERE cb.id > bundle_id
+          AND is_cohort_eligible(
+              cb.id,
+              cohort,
+              cb.rollout_cohort_count,
+              cb.target_cohorts
+          )
+        ORDER BY cb.id DESC
+        LIMIT 1
+    ),
+    rollback_candidate AS (
+        SELECT
+            cb.id,
+            TRUE AS should_force_update,
+            cb.message,
+            'ROLLBACK' AS status,
+            cb.storage_uri,
+            cb.file_hash
+        FROM candidate_bundles cb
+        WHERE cb.id < bundle_id
+          AND NOT EXISTS (
+              SELECT 1
+              FROM current_candidate
+              WHERE current_candidate.is_eligible = TRUE
+          )
+          AND NOT EXISTS (SELECT 1 FROM eligible_update_candidate)
+        ORDER BY cb.id DESC
+        LIMIT 1
+    ),
+    final_result AS (
+        SELECT * FROM eligible_update_candidate
+        UNION ALL
+        SELECT * FROM rollback_candidate
+        WHERE NOT EXISTS (SELECT 1 FROM eligible_update_candidate)
+    )
+    SELECT *
+    FROM final_result
+    WHERE final_result.id != bundle_id
+
+    UNION ALL
+
+    SELECT
+        NIL_UUID      AS id,
+        TRUE          AS should_force_update,
+        NULL          AS message,
+        'ROLLBACK'    AS status,
+        NULL          AS storage_uri,
+        NULL          AS file_hash
+    WHERE (SELECT COUNT(*) FROM final_result) = 0
+      AND bundle_id != NIL_UUID
+      AND bundle_id > min_bundle_id
+      AND NOT EXISTS (
+          SELECT 1
+          FROM current_candidate
+          WHERE current_candidate.is_eligible = TRUE
+      )
+      AND NOT EXISTS (SELECT 1 FROM eligible_update_candidate)
+      AND NOT EXISTS (SELECT 1 FROM rollback_candidate);
+END;
+$$;