@assetlib/sdk-core 0.7.10-preview.1 → 0.7.11-preview.1

package/README.md

@@ -20,7 +20,7 @@ const asset = await client.resolve(AppAssets.Travel.coast, { pixelWidth: 600, pi
 // source is 'remote', 'cache', or 'bundle'. Render a bundled image for 'bundle'.
 ```
 
-`refresh()` returns `{ updated, sequence, error? }`. Errors preserve the previous accepted release. `resolve()` returns `{ source, sequence, message, arm, armSource, bytes?, sha256?, assetId?, mime?, pixelWidth?, pixelHeight?, rendering? }`. `getStatus()` returns `{ initialized, sequence, lastError }`. Use one long-lived client per configured app.
+`refresh()` returns `{ updated, sequence, error? }`. Errors preserve the previous accepted release. After a release is accepted, later refreshes send the service's `ETag` as `If-None-Match`, and a `304 Not Modified` returns `{ updated: false, sequence }` without downloading or re-verifying the manifest; the validator lives in client memory and is only sent while durable state still holds that exact release. `resolve()` returns `{ source, sequence, message, arm, armSource, bytes?, sha256?, assetId?, mime?, pixelWidth?, pixelHeight?, rendering? }`. `getStatus()` returns `{ initialized, sequence, lastError }`. Use one long-lived client per configured app.
 
 Public config: `{ schemaVersion: 1, orgId, appId, environment: 'staging' | 'production', manifestUrl, pinnedPublicKey?, keyId?, pinnedPublicKeys?, keyIds? }`. Supply `pinnedPublicKey` or a `pinnedPublicKeys` array of 1–16 distinct exact-PEM Ed25519 SPKI public keys. Each PEM is limited to 256 UTF-8 bytes. When both are present, the single key must exactly match a member of the set. Configurations with only `pinnedPublicKey` retain their existing behavior and parsed shape.
 

package/dist/index.d.ts

@@ -48,6 +48,9 @@ export declare class AssetClient {
     private initialized;
     private storageFailure;
     private lastError;
+    /** The ETag the delivery service gave the envelope this client last accepted, so a later refresh can ask for it
+        conditionally. Held in memory only and sent only while the durable state still holds that exact release. */
+    private manifestEtag;
     private lastRefreshReason;
     private reporter?;
     private queue;

package/dist/index.js

@@ -161,7 +161,14 @@ class DeliveryError extends Error {
     }
 }
 const failureReason = (error) => error instanceof DeliveryError ? error.reason : 'other';
+/** An ETag worth sending back: a quoted (optionally weak) validator of bounded length. Anything else is ignored. */
+const usableEtag = (value) => value && /^(?:W\/)?"[^"]{1,200}"$/.test(value) ? value : null;
 async function fetchBounded(fetcher, url, maxBytes, timeoutMs, accept = 'image/webp', signal, noStore = false) {
+    return (await fetchBoundedResponse(fetcher, url, maxBytes, timeoutMs, accept, signal, noStore)).bytes;
+}
+/** Like fetchBounded, but with `ifNoneMatch` set the request is conditional and a 304 returns `notModified` without a body.
+    A 304 to an unconditional request is a server error and fails like any other non-2xx status. */
+async function fetchBoundedResponse(fetcher, url, maxBytes, timeoutMs, accept = 'image/webp', signal, noStore = false, ifNoneMatch) {
     throwIfAborted(signal);
     const controller = new AbortController();
     let timeout;
@@ -171,11 +178,15 @@ async function fetchBounded(fetcher, url, maxBytes, timeoutMs, accept = 'image/w
     const request = async () => {
         let response;
         try {
-            response = await fetcher(url, { method: 'GET', credentials: 'omit', redirect: 'error', ...(noStore ? { cache: 'no-store' } : {}), signal: controller.signal, headers: { Accept: url.endsWith('/manifest') ? 'application/json' : accept } });
+            response = await fetcher(url, { method: 'GET', credentials: 'omit', redirect: 'error', ...(noStore ? { cache: 'no-store' } : {}), signal: controller.signal, headers: { Accept: url.endsWith('/manifest') ? 'application/json' : accept, ...(ifNoneMatch ? { 'If-None-Match': ifNoneMatch } : {}) } });
         }
         catch (error) {
             throw new DeliveryError(error instanceof Error ? error.message : 'Assetlib delivery is unavailable.', 'offline');
         }
+        if (ifNoneMatch && response.status === 304 && !response.redirected) {
+            await response.body?.cancel().catch(() => { });
+            return { bytes: new Uint8Array(0), etag: usableEtag(response.headers.get('etag')), notModified: true };
+        }
         if (!response.ok || response.redirected)
             throw new DeliveryError(`Assetlib delivery returned ${response.status}.`, response.redirected ? 'verification' : response.status === 404 ? 'missing' : 'other');
         const declared = response.headers.get('content-length');
@@ -211,7 +222,7 @@ async function fetchBounded(fetcher, url, maxBytes, timeoutMs, accept = 'image/w
             bytes.set(chunk, offset);
             offset += chunk.byteLength;
         }
-        return bytes;
+        return { bytes, etag: usableEtag(response.headers.get('etag')), notModified: false };
     };
     try {
         return await Promise.race([request(), deadline, cancelled]);
@@ -273,6 +284,9 @@ export class AssetClient {
     initialized = false;
     storageFailure = null;
     lastError = null;
+    /** The ETag the delivery service gave the envelope this client last accepted, so a later refresh can ask for it
+        conditionally. Held in memory only and sent only while the durable state still holds that exact release. */
+    manifestEtag = null;
     lastRefreshReason = 'missing';
     reporter;
     queue = Promise.resolve();
@@ -372,20 +386,29 @@ export class AssetClient {
             try {
                 if (this.storageFailure)
                     throw new DeliveryError(this.storageFailure, 'verification');
-                const bytes = await fetchBounded(this.fetcher, this.config.manifestUrl, SDK_LIMITS.manifestBytes, this.timeoutMs);
+                const current = this.state.history[0];
+                const known = this.manifestEtag && current && this.manifestEtag.sequence === this.state.highestSequence && this.manifestEtag.payload === current.payload ? this.manifestEtag : null;
+                const fetched = await fetchBoundedResponse(this.fetcher, this.config.manifestUrl, SDK_LIMITS.manifestBytes, this.timeoutMs, undefined, undefined, false, known?.etag);
+                if (fetched.notModified) {
+                    // The service confirmed the accepted release is still current. Nothing was downloaded or re-verified.
+                    this.lastError = null;
+                    return { updated: false, sequence: this.state.highestSequence };
+                }
                 let verified;
                 try {
-                    verified = verifySignedManifest(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)), this.config);
+                    verified = verifySignedManifest(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(fetched.bytes)), this.config);
                 }
                 catch (error) {
                     throw new DeliveryError(error instanceof Error ? error.message : 'Manifest verification failed.', 'verification');
                 }
                 const { envelope, payload } = verified;
+                const remember = () => { this.manifestEtag = fetched.etag ? { etag: fetched.etag, sequence: payload.sequence, payload: envelope.payload } : null; };
                 if (payload.sequence < this.state.highestSequence)
                     throw new DeliveryError('An older release was rejected.', 'verification');
                 if (payload.sequence === this.state.highestSequence) {
-                    if (envelope.payload !== this.state.history[0]?.payload)
+                    if (envelope.payload !== current?.payload)
                         throw new DeliveryError('Conflicting content reused an existing release sequence.', 'verification');
+                    remember();
                     this.lastError = null;
                     return { updated: false, sequence: payload.sequence };
                 }
@@ -399,6 +422,7 @@ export class AssetClient {
                 this.state = next;
                 this.payloads = payloads;
                 this.adoptedRaw = serialized;
+                remember();
                 this.lastError = null;
                 return { updated: true, sequence: payload.sequence };
             }

package/dist/telemetry.js

@@ -28,7 +28,7 @@ export class ObservationReporter {
         this.fetcher = fetcher;
         this.interval = boundedInteger(options.flushIntervalMs, 60_000, 2_147_483_647);
         this.maxBatch = boundedInteger(options.maxBatch, 200, 200);
-        const sdk = options.sdk ?? { name: 'sdk-core', version: '0.7.10-preview.1' };
+        const sdk = options.sdk ?? { name: 'sdk-core', version: '0.7.11-preview.1' };
         const build = options.build ?? { platform: 'web', appVersion: 'unknown', buildNumber: 'unknown' };
         if (!version(sdk.name) || !version(sdk.version) || !['ios', 'android', 'web', 'expo'].includes(build.platform) || !version(build.appVersion) || !version(build.buildNumber) || (options.installId !== undefined && !validId(options.installId)))
             throw new Error('Invalid observation configuration.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assetlib/sdk-core",
-  "version": "0.7.10-preview.1",
+  "version": "0.7.11-preview.1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",