@assetlib/sdk-core 0.7.5-preview.1 → 0.7.7-preview.1

package/README.md

@@ -86,7 +86,7 @@ App-owned catalog placements may include `bundledAccessibility` with the same sh
 
 ## Image formats and sizes
 
-Preview 0.2 accepts the optional signed `renditionSchemaVersion: 1` extension. Existing schema-1 manifests still work; older clients can use the mandatory WebP fallback in new manifests. By default, the client selects PNG or WebP. Ask for physical pixels with both `pixelWidth` and `pixelHeight`; without a target, selection uses the generated placement dimensions. Layout and display density remain the application's responsibility.
+Preview 0.2 accepts the optional signed `renditionSchemaVersion: 1` extension. Existing schema-1 manifests still work; older clients can use the mandatory WebP fallback in new manifests. By default, the client selects PNG or WebP. Ask for physical pixels with both `pixelWidth` and `pixelHeight`; without a target, selection uses the generated reference dimensions. Core cannot see layout: the Expo components pass the measured view × display scale (see the [Expo README](../sdk-expo/README.md#sizing)); other callers pass their own target.
 
 Selection uses the smallest rendition covering both dimensions, then byte size and hash. If every rendition is smaller, the largest is preferred. Failed candidates advance to the next candidate, then the legacy fallback. Historical releases remain cache-only. The result describes the actual selected MIME, hash and pixel dimensions. It does not convert one format into another on the device.
 
@@ -102,7 +102,7 @@ A catalog placement can declare `"rendering": "template"`. Assetlib then deliver
 
 Signed image descriptors (placements, state members, variant cells and catalog page images) may carry `rendering`. A present value that is not a string matching `^[a-z][a-z0-9-]{0,31}$` rejects the release; absent means `original`. Resolution compares the reference's rendering with the descriptor actually selected after arm, appearance and state selection. If they differ, or the descriptor names a value this client does not know, that release's descriptor is skipped as for an incompatible size: its cache entry is not read and nothing is downloaded. When the current release publishes the key, resolution continues with the usual order, a compatible verified cached image from an older retained release and then the bundled fallback (`fallbackReason: 'missing'`). Other placements are unaffected. Catalog page images resolve as `original`. `ResolvedAsset.rendering` reports the delivered descriptor's rendering, `'original'` or `'template'`.
 
-The bundled fallback must also be a single-color shape, such as a PNG with alpha, because the app applies the same tint to remote and bundled artwork. Remote masks are rasters, so request physical pixels with `pixelWidth` and `pixelHeight` (logical size × display scale); the Expo adapter does this for template references. Template rendering needs this SDK and CLI or newer: older code generation drops the field, and older runtimes do not check it. Publishing template descriptors from the hosted console is planned; until then releases carry no `rendering` field.
+The bundled fallback must also be a single-color shape, such as a PNG with alpha, because the app applies the same tint to remote and bundled artwork. Remote masks are rasters, so request physical pixels with `pixelWidth` and `pixelHeight` (view size × display scale); the Expo components do this for every placement. Template rendering needs this SDK and CLI or newer: older code generation drops the field, and older runtimes do not check it. Publishing template descriptors from the hosted console is planned; until then releases carry no `rendering` field.
 
 ## Offline typed references
 
@@ -121,7 +121,7 @@ Check a catalog into your application:
 node node_modules/@assetlib/sdk-core/bin/codegen.mjs assetlib.catalog.json > src/assets.generated.ts
 ```
 
-Use `AppAssets.Travel.coast` in application code. Existing compatible artwork updates do not require regenerating this catalog. Adding a new application placement does. Schema v1 identifies placements by key and by width and height. The size is a reference, not a crop: it fixes the aspect ratio every published image must match (the console checks it when an image is assigned and again at publish), and it is the size `resolve` requests when the caller passes no `pixelWidth` and `pixelHeight`; published images may have any pixel size at that aspect ratio. Stable placement IDs and separately versioned contracts are not implemented yet. Renaming a key requires a coordinated migration, not simply renaming it in the console.
+Use `AppAssets.Travel.coast` in application code. Existing compatible artwork updates do not require regenerating this catalog. Adding a new application placement does. Schema v1 identifies placements by key and by width and height. Width and height are a reference size: they fix the aspect ratio and identify the placement; the SDK sizes requests from the view. Every published image must match that aspect ratio (the console checks it when an image is assigned and again at publish) and may have any pixel size. `resolve` without `pixelWidth` and `pixelHeight` uses the reference size as its target; the Expo components measure the view instead. Changing the numbers changes the placement's identity, so never renumber a catalog to change sharpness. Stable placement IDs and separately versioned contracts are not implemented yet. Renaming a key requires a coordinated migration, not simply renaming it in the console.
 
 ## Appearance and arm variants
 

package/dist/index.d.ts

@@ -43,6 +43,8 @@ export declare class AssetClient {
     private options;
     readonly config: AssetlibConfig;
     private state;
+    private adoptedRaw;
+    private payloads;
     private initialized;
     private storageFailure;
     private lastError;

package/dist/index.js

@@ -224,18 +224,35 @@ async function fetchBounded(fetcher, url, maxBytes, timeoutMs, accept = 'image/w
         controller.abort();
     }
 }
+/** Iterative, so any depth JSON.parse accepted freezes without exhausting the stack. */
+function deepFreeze(value) {
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        if (item === null || typeof item !== 'object')
+            continue;
+        Object.freeze(item);
+        for (const child of Object.values(item))
+            pending.push(child);
+    }
+    return value;
+}
 /** Durable replay identity survives authorized route and signing-key changes. */
 export function storageNamespace(config) {
     return hashBytes(utf8ToBytes(JSON.stringify([new URL(config.manifestUrl).origin, config.orgId, config.appId, config.environment]))).slice(0, 32);
 }
 /** Use the same verification for normal state loads and legacy namespace migration. */
 export function verifyStoredState(serialized, config) {
+    return verifyStoredHistory(serialized, config).state;
+}
+function verifyStoredHistory(serialized, config) {
     if (utf8ToBytes(serialized).length > SDK_LIMITS.stateBytes)
         throw new Error('Stored SDK state exceeds its bound.');
     const state = JSON.parse(serialized);
     if (!record(state) || state.version !== 1 || !integer(state.highestSequence, 1, 2_147_483_647) || !Array.isArray(state.history) || state.history.length < 1 || state.history.length > SDK_LIMITS.retainedReleases)
         throw new Error('Stored SDK state is invalid.');
     let previous = state.highestSequence + 1;
+    const payloads = [];
     for (const [index, entry] of state.history.entries()) {
         const { payload } = verifySignedManifest(entry, config);
         if (payload.sequence >= previous)
@@ -243,13 +260,16 @@ export function verifyStoredState(serialized, config) {
         if (index === 0 && payload.sequence !== state.highestSequence)
             throw new Error('Stored sequence does not match its signed manifest.');
         previous = payload.sequence;
+        payloads.push(payload);
     }
-    return state;
+    return { state: state, payloads };
 }
 export class AssetClient {
     options;
     config;
     state = { version: 1, highestSequence: 0, history: [] };
+    adoptedRaw = null;
+    payloads = [];
     initialized = false;
     storageFailure = null;
     lastError = null;
@@ -322,16 +342,22 @@ export class AssetClient {
                     throw new Error('Stored release state disappeared.');
                 return;
             }
-            const next = verifyStoredState(raw, this.config);
+            // These exact bytes were already verified with this client's fixed config.
+            if (raw === this.adoptedRaw)
+                return;
+            const { state: next, payloads } = verifyStoredHistory(raw, this.config);
             if (next.highestSequence < this.state.highestSequence)
                 throw new Error('Stored release state moved backwards.');
-            const accepted = new Map(this.state.history.map(entry => [verifySignedManifest(entry, this.config).payload.sequence, entry.payload]));
-            for (const entry of next.history) {
-                const previous = accepted.get(verifySignedManifest(entry, this.config).payload.sequence);
+            const accepted = new Map(this.state.history.map((entry, index) => [this.payloads[index].sequence, entry.payload]));
+            for (const [index, entry] of next.history.entries()) {
+                const previous = accepted.get(payloads[index].sequence);
                 if (previous !== undefined && previous !== entry.payload)
                     throw new Error('Stored release state conflicts with an accepted release.');
             }
+            const frozen = payloads.map(deepFreeze);
             this.state = next;
+            this.payloads = frozen;
+            this.adoptedRaw = raw;
         }
         catch {
             this.storageFailure = 'Stored release state could not be verified. Using bundled assets; repair or explicitly reset app data before reconnecting.';
@@ -367,8 +393,12 @@ export class AssetClient {
                 const serialized = JSON.stringify(next);
                 if (utf8ToBytes(serialized).length > SDK_LIMITS.stateBytes)
                     throw new Error('Release history exceeds the storage bound.');
+                const payloads = [deepFreeze(payload), ...this.payloads].slice(0, SDK_LIMITS.retainedReleases);
                 await this.options.storage.saveState(serialized);
+                // Nothing may throw between these: state, payloads and adoptedRaw describe one history.
                 this.state = next;
+                this.payloads = payloads;
+                this.adoptedRaw = serialized;
                 this.lastError = null;
                 return { updated: true, sequence: payload.sequence };
             }
@@ -382,7 +412,7 @@ export class AssetClient {
     }
     /** Only metadata transitions use the serial queue. Image transfers are bounded and concurrent. */
     snapshot() {
-        return this.serial(async () => { await this.load(); return this.storageFailure ? [] : this.state.history.map(entry => ({ payload: verifySignedManifest(entry, this.config).payload })); });
+        return this.serial(async () => { await this.load(); return this.storageFailure ? [] : this.payloads.map(payload => ({ payload })); });
     }
     withTransfer(work, signal) {
         throwIfAborted(signal);

package/dist/telemetry.js

@@ -28,7 +28,7 @@ export class ObservationReporter {
         this.fetcher = fetcher;
         this.interval = boundedInteger(options.flushIntervalMs, 60_000, 2_147_483_647);
         this.maxBatch = boundedInteger(options.maxBatch, 200, 200);
-        const sdk = options.sdk ?? { name: 'sdk-core', version: '0.7.5-preview.1' };
+        const sdk = options.sdk ?? { name: 'sdk-core', version: '0.7.7-preview.1' };
         const build = options.build ?? { platform: 'web', appVersion: 'unknown', buildNumber: 'unknown' };
         if (!version(sdk.name) || !version(sdk.version) || !['ios', 'android', 'web', 'expo'].includes(build.platform) || !version(build.appVersion) || !version(build.buildNumber) || (options.installId !== undefined && !validId(options.installId)))
             throw new Error('Invalid observation configuration.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assetlib/sdk-core",
-  "version": "0.7.5-preview.1",
+  "version": "0.7.7-preview.1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",