@assetlib/sdk-core 0.7.4-preview.1 → 0.7.6-preview.1

package/dist/index.d.ts

@@ -43,6 +43,8 @@ export declare class AssetClient {
     private options;
     readonly config: AssetlibConfig;
     private state;
+    private adoptedRaw;
+    private payloads;
     private initialized;
     private storageFailure;
     private lastError;

package/dist/index.js

@@ -224,18 +224,35 @@ async function fetchBounded(fetcher, url, maxBytes, timeoutMs, accept = 'image/w
         controller.abort();
     }
 }
+/** Iterative, so any depth JSON.parse accepted freezes without exhausting the stack. */
+function deepFreeze(value) {
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        if (item === null || typeof item !== 'object')
+            continue;
+        Object.freeze(item);
+        for (const child of Object.values(item))
+            pending.push(child);
+    }
+    return value;
+}
 /** Durable replay identity survives authorized route and signing-key changes. */
 export function storageNamespace(config) {
     return hashBytes(utf8ToBytes(JSON.stringify([new URL(config.manifestUrl).origin, config.orgId, config.appId, config.environment]))).slice(0, 32);
 }
 /** Use the same verification for normal state loads and legacy namespace migration. */
 export function verifyStoredState(serialized, config) {
+    return verifyStoredHistory(serialized, config).state;
+}
+function verifyStoredHistory(serialized, config) {
     if (utf8ToBytes(serialized).length > SDK_LIMITS.stateBytes)
         throw new Error('Stored SDK state exceeds its bound.');
     const state = JSON.parse(serialized);
     if (!record(state) || state.version !== 1 || !integer(state.highestSequence, 1, 2_147_483_647) || !Array.isArray(state.history) || state.history.length < 1 || state.history.length > SDK_LIMITS.retainedReleases)
         throw new Error('Stored SDK state is invalid.');
     let previous = state.highestSequence + 1;
+    const payloads = [];
     for (const [index, entry] of state.history.entries()) {
         const { payload } = verifySignedManifest(entry, config);
         if (payload.sequence >= previous)
@@ -243,13 +260,16 @@ export function verifyStoredState(serialized, config) {
         if (index === 0 && payload.sequence !== state.highestSequence)
             throw new Error('Stored sequence does not match its signed manifest.');
         previous = payload.sequence;
+        payloads.push(payload);
     }
-    return state;
+    return { state: state, payloads };
 }
 export class AssetClient {
     options;
     config;
     state = { version: 1, highestSequence: 0, history: [] };
+    adoptedRaw = null;
+    payloads = [];
     initialized = false;
     storageFailure = null;
     lastError = null;
@@ -322,16 +342,22 @@ export class AssetClient {
                     throw new Error('Stored release state disappeared.');
                 return;
             }
-            const next = verifyStoredState(raw, this.config);
+            // These exact bytes were already verified with this client's fixed config.
+            if (raw === this.adoptedRaw)
+                return;
+            const { state: next, payloads } = verifyStoredHistory(raw, this.config);
             if (next.highestSequence < this.state.highestSequence)
                 throw new Error('Stored release state moved backwards.');
-            const accepted = new Map(this.state.history.map(entry => [verifySignedManifest(entry, this.config).payload.sequence, entry.payload]));
-            for (const entry of next.history) {
-                const previous = accepted.get(verifySignedManifest(entry, this.config).payload.sequence);
+            const accepted = new Map(this.state.history.map((entry, index) => [this.payloads[index].sequence, entry.payload]));
+            for (const [index, entry] of next.history.entries()) {
+                const previous = accepted.get(payloads[index].sequence);
                 if (previous !== undefined && previous !== entry.payload)
                     throw new Error('Stored release state conflicts with an accepted release.');
             }
+            const frozen = payloads.map(deepFreeze);
             this.state = next;
+            this.payloads = frozen;
+            this.adoptedRaw = raw;
         }
         catch {
             this.storageFailure = 'Stored release state could not be verified. Using bundled assets; repair or explicitly reset app data before reconnecting.';
@@ -367,8 +393,12 @@ export class AssetClient {
                 const serialized = JSON.stringify(next);
                 if (utf8ToBytes(serialized).length > SDK_LIMITS.stateBytes)
                     throw new Error('Release history exceeds the storage bound.');
+                const payloads = [deepFreeze(payload), ...this.payloads].slice(0, SDK_LIMITS.retainedReleases);
                 await this.options.storage.saveState(serialized);
+                // Nothing may throw between these: state, payloads and adoptedRaw describe one history.
                 this.state = next;
+                this.payloads = payloads;
+                this.adoptedRaw = serialized;
                 this.lastError = null;
                 return { updated: true, sequence: payload.sequence };
             }
@@ -382,7 +412,7 @@ export class AssetClient {
     }
     /** Only metadata transitions use the serial queue. Image transfers are bounded and concurrent. */
     snapshot() {
-        return this.serial(async () => { await this.load(); return this.storageFailure ? [] : this.state.history.map(entry => ({ payload: verifySignedManifest(entry, this.config).payload })); });
+        return this.serial(async () => { await this.load(); return this.storageFailure ? [] : this.payloads.map(payload => ({ payload })); });
     }
     withTransfer(work, signal) {
         throwIfAborted(signal);

package/dist/telemetry.js

@@ -28,7 +28,7 @@ export class ObservationReporter {
         this.fetcher = fetcher;
         this.interval = boundedInteger(options.flushIntervalMs, 60_000, 2_147_483_647);
         this.maxBatch = boundedInteger(options.maxBatch, 200, 200);
-        const sdk = options.sdk ?? { name: 'sdk-core', version: '0.7.4-preview.1' };
+        const sdk = options.sdk ?? { name: 'sdk-core', version: '0.7.6-preview.1' };
         const build = options.build ?? { platform: 'web', appVersion: 'unknown', buildNumber: 'unknown' };
         if (!version(sdk.name) || !version(sdk.version) || !['ios', 'android', 'web', 'expo'].includes(build.platform) || !version(build.appVersion) || !version(build.buildNumber) || (options.installId !== undefined && !validId(options.installId)))
             throw new Error('Invalid observation configuration.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assetlib/sdk-core",
-  "version": "0.7.4-preview.1",
+  "version": "0.7.6-preview.1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",