@hot-updater/aws 1.0.0-rc.42 → 1.0.0-rc.44

package/dist/index.cjs

@@ -7,9 +7,7 @@ let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 let _aws_sdk_cloudfront_signer = require("@aws-sdk/cloudfront-signer");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
-let _hot_updater_server_plugins_api_keys = require("@hot-updater/server/plugins/api-keys");
-let _hot_updater_server_plugins_insights = require("@hot-updater/server/plugins/insights");
-let _hot_updater_server_plugins_remote_config = require("@hot-updater/server/plugins/remote-config");
+let _hot_updater_server_plugins = require("@hot-updater/server/plugins");
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
 const DEFAULT_TIMEOUT_MS = 3e5;
@@ -438,10 +436,11 @@ const cloudFrontDownloadUrl = (config) => async ({ storageUri }) => {
 };
 //#endregion
 //#region src/s3Storage.ts
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, downloadUrlSigningKey, getDownloadUrl: configuredGetDownloadUrl, ...s3Config } = config;
-	const getDownloadUrl = configuredGetDownloadUrl ?? (downloadUrlSigningKey ? (0, _hot_updater_plugin_core.createStorageDownloadUrl)(downloadUrlSigningKey) : void 0);
+	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
 	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig(s3Config));
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(normalizedBasePath);
@@ -554,10 +553,15 @@ function s3Storage(config) {
 				throw error;
 			}
 		},
-		...getDownloadUrl ? { async getDownloadUrl(input) {
-			parseAndValidate(input.storageUri);
-			return getDownloadUrl(input);
-		} } : {},
+		async getDownloadUrl({ storageUri }) {
+			const { key } = parseAndValidate(storageUri);
+			if (getDownloadUrl) return getDownloadUrl({ storageUri });
+			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
+			return { url: await getSignedUrl(client, new _aws_sdk_client_s3.GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
+		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
@@ -588,9 +592,9 @@ function s3Storage(config) {
 * client route, and Remote Config. Its Lambda@Edge function imports this list.
 */
 const plugins = [
-	(0, _hot_updater_server_plugins_insights.insights)(),
-	(0, _hot_updater_server_plugins_api_keys.apiKeys)(),
-	(0, _hot_updater_server_plugins_remote_config.remoteConfig)()
+	(0, _hot_updater_server_plugins.insights)(),
+	(0, _hot_updater_server_plugins.apiKeys)(),
+	(0, _hot_updater_server_plugins.remoteConfig)()
 ];
 //#endregion
 exports.cloudFrontDownloadUrl = cloudFrontDownloadUrl;

package/dist/index.d.cts

@@ -56,16 +56,14 @@ interface S3StorageConfig extends S3ClientConfig {
   bucketName: string;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
-  downloadUrlSigningKey?: string;
+  /**
+   * The URL devices download an object from, such as
+   * `cloudFrontDownloadUrl(...)`. Without it, a presigned S3 URL that
+   * expires in an hour.
+   */
   getDownloadUrl?: StorageAdapter["getDownloadUrl"];
 }
-type S3StorageConfigWithDownloadUrl = S3StorageConfig & ({
-  downloadUrlSigningKey: string;
-} | {
-  getDownloadUrl: NonNullable<StorageAdapter["getDownloadUrl"]>;
-});
-type S3StorageOperations = "put" | "get" | "exists" | "delete" | "listObjects" | "deleteObjects";
-declare function s3Storage(config: S3StorageConfigWithDownloadUrl): StorageAdapterWith<S3StorageOperations | "getDownloadUrl">;
+type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
 //#region ../insights/dist/server/eventRow.d.mts
@@ -1081,4 +1079,4 @@ declare const plugins: readonly [import("@hot-updater/plugin-core").HotUpdaterPl
   endpoints: readonly import("@hot-updater/plugin-core").PluginEndpoint[];
 }, {}>];
 //#endregion
-export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, S3StorageConfigWithDownloadUrl, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, plugins, s3Storage };
+export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, plugins, s3Storage };

package/dist/index.d.mts

@@ -56,16 +56,14 @@ interface S3StorageConfig extends S3ClientConfig {
   bucketName: string;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
-  downloadUrlSigningKey?: string;
+  /**
+   * The URL devices download an object from, such as
+   * `cloudFrontDownloadUrl(...)`. Without it, a presigned S3 URL that
+   * expires in an hour.
+   */
   getDownloadUrl?: StorageAdapter["getDownloadUrl"];
 }
-type S3StorageConfigWithDownloadUrl = S3StorageConfig & ({
-  downloadUrlSigningKey: string;
-} | {
-  getDownloadUrl: NonNullable<StorageAdapter["getDownloadUrl"]>;
-});
-type S3StorageOperations = "put" | "get" | "exists" | "delete" | "listObjects" | "deleteObjects";
-declare function s3Storage(config: S3StorageConfigWithDownloadUrl): StorageAdapterWith<S3StorageOperations | "getDownloadUrl">;
+type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
 //#region ../insights/dist/server/eventRow.d.mts
@@ -1081,4 +1079,4 @@ declare const plugins: readonly [import("@hot-updater/plugin-core").HotUpdaterPl
   endpoints: readonly import("@hot-updater/plugin-core").PluginEndpoint[];
 }, {}>];
 //#endregion
-export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, S3StorageConfigWithDownloadUrl, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, plugins, s3Storage };
+export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, plugins, s3Storage };

package/dist/index.mjs

@@ -1,14 +1,12 @@
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageDownloadUrl, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
+import { createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
 import { CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { SSM } from "@aws-sdk/client-ssm";
 import { getSignedUrl } from "@aws-sdk/cloudfront-signer";
 import { DeleteObjectCommand, DeleteObjectsCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
-import { apiKeys } from "@hot-updater/server/plugins/api-keys";
-import { insights } from "@hot-updater/server/plugins/insights";
-import { remoteConfig } from "@hot-updater/server/plugins/remote-config";
+import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
 const DEFAULT_TIMEOUT_MS = 3e5;
@@ -437,10 +435,11 @@ const cloudFrontDownloadUrl = (config) => async ({ storageUri }) => {
 };
 //#endregion
 //#region src/s3Storage.ts
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, downloadUrlSigningKey, getDownloadUrl: configuredGetDownloadUrl, ...s3Config } = config;
-	const getDownloadUrl = configuredGetDownloadUrl ?? (downloadUrlSigningKey ? createStorageDownloadUrl(downloadUrlSigningKey) : void 0);
+	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
 	const client = new S3Client(applyS3RuntimeAwsConfig(s3Config));
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
@@ -553,10 +552,15 @@ function s3Storage(config) {
 				throw error;
 			}
 		},
-		...getDownloadUrl ? { async getDownloadUrl(input) {
-			parseAndValidate(input.storageUri);
-			return getDownloadUrl(input);
-		} } : {},
+		async getDownloadUrl({ storageUri }) {
+			const { key } = parseAndValidate(storageUri);
+			if (getDownloadUrl) return getDownloadUrl({ storageUri });
+			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
+			return { url: await getSignedUrl(client, new GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
+		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {

package/dist/init/index.cjs

@@ -47,9 +47,7 @@ let _aws_sdk_client_dynamodb = require("@aws-sdk/client-dynamodb");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
-let _hot_updater_server_plugins_api_keys = require("@hot-updater/server/plugins/api-keys");
-let _hot_updater_server_plugins_insights = require("@hot-updater/server/plugins/insights");
-let _hot_updater_server_plugins_remote_config = require("@hot-updater/server/plugins/remote-config");
+let _hot_updater_server_plugins = require("@hot-updater/server/plugins");
 let _aws_sdk_credential_providers = require("@aws-sdk/credential-providers");
 let _aws_sdk_client_lambda = require("@aws-sdk/client-lambda");
 let crypto$1 = require("crypto");
@@ -6633,9 +6631,9 @@ const dynamoDB = (config) => {
 * client route, and Remote Config. Its Lambda@Edge function imports this list.
 */
 const plugins = [
-	(0, _hot_updater_server_plugins_insights.insights)(),
-	(0, _hot_updater_server_plugins_api_keys.apiKeys)(),
-	(0, _hot_updater_server_plugins_remote_config.remoteConfig)()
+	(0, _hot_updater_server_plugins.insights)(),
+	(0, _hot_updater_server_plugins.apiKeys)(),
+	(0, _hot_updater_server_plugins.remoteConfig)()
 ];
 //#endregion
 //#region iac/init/index.ts
@@ -8457,10 +8455,14 @@ const awsOptions = {
 	}
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
-			pkg: "@hot-updater/aws",
-			named: ["plugins"]
+			pkg: "hot-updater/plugins",
+			named: [
+				"apiKeys",
+				"insights",
+				"remoteConfig"
+			]
 		}],
-		configString: "plugins"
+		configString: "[apiKeys(), insights(), remoteConfig()]"
 	}).setIntermediateCode(helperStatements.map((statement) => statement.code.trim()).join("\n\n"));
 	switch (authMode.mode) {
 		case "sso":

package/dist/init/index.mjs

@@ -20,9 +20,7 @@ import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, Dy
 import { SETTINGS_TABLE, aggregateBatchingTables, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, toolingTargetOf } from "@hot-updater/plugin-core";
 import { CloudFront, CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
-import { apiKeys } from "@hot-updater/server/plugins/api-keys";
-import { insights } from "@hot-updater/server/plugins/insights";
-import { remoteConfig } from "@hot-updater/server/plugins/remote-config";
+import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { fromIni, fromNodeProviderChain, fromSSO } from "@aws-sdk/credential-providers";
 import { Lambda } from "@aws-sdk/client-lambda";
 import crypto$1 from "crypto";
@@ -8452,10 +8450,14 @@ const awsOptions = {
 	}
 	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
-			pkg: "@hot-updater/aws",
-			named: ["plugins"]
+			pkg: "hot-updater/plugins",
+			named: [
+				"apiKeys",
+				"insights",
+				"remoteConfig"
+			]
 		}],
-		configString: "plugins"
+		configString: "[apiKeys(), insights(), remoteConfig()]"
 	}).setIntermediateCode(helperStatements.map((statement) => statement.code.trim()).join("\n\n"));
 	switch (authMode.mode) {
 		case "sso":

package/dist/lambda/index.cjs

@@ -1451,52 +1451,6 @@ var ReleaseCatalogMutationError = class extends Error {
 	}
 };
 //#endregion
-//#region ../plugin-core/dist/storageDownloadPath.mjs
-const encodeBase64Url$1 = (value) => {
-	let binary = "";
-	for (const byte of new TextEncoder().encode(value)) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-};
-const decodeBase64Url$1 = (value) => {
-	try {
-		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
-		const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
-		return new TextDecoder(void 0, { fatal: true }).decode(Uint8Array.from(binary, (character) => character.charCodeAt(0)));
-	} catch {
-		return null;
-	}
-};
-const encodeBytes = (bytes) => {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-};
-const createStorageDownloadPath = (storageUri, signature) => `/storage/${encodeBase64Url$1(storageUri)}/${encodeURIComponent(signature)}`;
-const parseStorageDownloadPath = (path) => {
-	const match = /^\/storage\/([^/]+)\/([^/]+)$/.exec(path);
-	if (!match) return null;
-	const storageUri = decodeBase64Url$1(match[1]);
-	if (storageUri === null) return null;
-	try {
-		return {
-			signature: decodeURIComponent(match[2]),
-			storageUri
-		};
-	} catch {
-		return null;
-	}
-};
-const createStorageDownloadUrl = (signingKey) => {
-	const key = crypto.subtle.importKey("raw", new TextEncoder().encode(signingKey), {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, false, ["sign"]);
-	return async ({ storageUri }) => {
-		const signature = encodeBytes(new Uint8Array(await crypto.subtle.sign("HMAC", await key, new TextEncoder().encode(storageUri))));
-		return { url: createStorageDownloadPath(storageUri, signature) };
-	};
-};
-//#endregion
 //#region ../plugin-core/dist/serverPlugin/definePlugin.mjs
 /** Declares a plugin; Hot Updater's own plugins and third-party ones use the same contract. */
 const definePlugin = (plugin) => plugin;
@@ -4637,7 +4591,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.0.0-rc.42";
+const HOT_UPDATER_SERVER_VERSION = "1.0.0-rc.44";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**
@@ -6803,10 +6757,42 @@ const ORIGIN_CACHE_MAX_ENTRIES = 128;
 const NO_CATALOG_HEADER = "x-hot-updater-catalog";
 /** A shared cache keeps a catalog, or a scope's lack of one, five seconds. */
 const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
+/**
+* The same five seconds for a CDN that reads `CDN-Cache-Control` (RFC 9213),
+* such as Cloudflare's Workers Cache, which then ignores `Cache-Control`.
+* `s-maxage` forbids serving stale, so there an expired catalog held requests
+* at that location until the origin answered. Here, for five more seconds,
+* the CDN answers with the expired copy while it revalidates in the
+* background. `stale-if-error=0` keeps origin errors visible: without it,
+* Cloudflare serves a stale copy on error indefinitely.
+*
+* A device can see a catalog up to 15 seconds after a deploy or a Roll back
+* replaced it: the origin's 5-second catalog memo, then 5 seconds fresh and
+* 5 stale at the CDN. A revoked API key can read a cached catalog up to
+* 10 seconds. Devices and caches that don't read the header keep
+* `Cache-Control`.
+*/
+const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
 });
+const badRequest = (error) => Response.json({ error }, {
+	status: 400,
+	headers: { "cache-control": "private, no-store" }
+});
+/**
+* A 400 for a catalog path whose scope is malformed, such as a channel name
+* where its base64url key belongs; null for a well-formed scope.
+*/
+const invalidScope = (input) => {
+	try {
+		createReleaseCatalogScopeKey(input);
+		return null;
+	} catch (error) {
+		return badRequest(error instanceof Error ? error.message : "Invalid Release Catalog scope");
+	}
+};
 /**
 * A scope with no catalog yet, such as a store version before its first
 * OTA release: cached like a catalog, so its update checks don't all reach
@@ -6818,6 +6804,7 @@ const missingCatalog = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: {
 		"cache-control": CATALOG_CACHE_CONTROL,
+		"cdn-cache-control": CATALOG_CDN_CACHE_CONTROL,
 		vary: "Accept-Encoding",
 		[NO_CATALOG_HEADER]: "none"
 	}
@@ -6832,6 +6819,7 @@ const catalogResponse = async (catalog, request) => {
 	const etag = `"sha256:${await responseHash(body)}"`;
 	const headers = {
 		"cache-control": CATALOG_CACHE_CONTROL,
+		"cdn-cache-control": CATALOG_CDN_CACHE_CONTROL,
 		"content-type": CATALOG_CONTENT_TYPE,
 		etag,
 		vary: "Accept-Encoding"
@@ -6883,16 +6871,15 @@ const createReleaseCatalogRouteHandlers = () => {
 		appVersionReleaseCatalog: async (params, request, { core }) => {
 			const rawAppVersion = requireRouteParam(params, "appVersion");
 			const appVersion = canonicalizeAppVersion(rawAppVersion);
-			if (appVersion === null || appVersion !== rawAppVersion) return Response.json({ error: "Invalid app version" }, {
-				status: 400,
-				headers: { "cache-control": "private, no-store" }
-			});
+			if (appVersion === null || appVersion !== rawAppVersion) return badRequest("Invalid app version");
 			const input = {
 				appVersion,
 				channelKey: requireRouteParam(params, "channelKey"),
 				platform: requirePlatformParam(params),
 				strategy: "APP_VERSION"
 			};
+			const invalid = invalidScope(input);
+			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`app-version:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
 		fingerprintReleaseCatalog: async (params, request, { core }) => {
@@ -6902,6 +6889,8 @@ const createReleaseCatalogRouteHandlers = () => {
 				platform: requirePlatformParam(params),
 				strategy: "FINGERPRINT"
 			};
+			const invalid = invalidScope(input);
+			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
 		artifactV1: async (params, _request, { core }) => {
@@ -6983,8 +6972,8 @@ const errorResponse = (error, status) => Response.json({ error }, {
 	headers: { "cache-control": "private, no-store" },
 	status
 });
-/** `/version` and storage downloads never pass through the client policy. */
-const PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version", "downloadStorageObject"]);
+/** `/version` never passes through the client policy. */
+const PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version"]);
 const routesOf = Symbol.for("@hot-updater/server/routes");
 const withVary = (response, varyHeaders) => {
 	const cacheControl = response.headers.get("cache-control") ?? "";
@@ -7029,26 +7018,11 @@ const createRequestHandler = ({ api, clientPolicy, privateResponses = false, rou
 		});
 	}
 };
-const createDownloadStorageRouteHandler = (downloadStorageObject) => async (params) => {
-	const token = params.token;
-	const signature = params.signature;
-	if (!token || !signature) return errorResponse("Not found", 404);
-	const response = await downloadStorageObject(token, signature);
-	if (!response) return errorResponse("Not found", 404);
-	const headers = new Headers(response.headers);
-	if (!headers.has("cache-control")) headers.set("cache-control", "public, max-age=31536000, immutable");
-	return new Response(response.body, {
-		headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-};
-function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, endpoints = [], plugins = [] }) {
+function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins = [] }) {
 	const routeHandlers = {
 		...createVersionRouteHandlers(plugins),
 		...createReleaseCatalogRouteHandlers(),
-		...createAdminRouteHandlers(),
-		...downloadStorageObject === void 0 ? {} : { downloadStorageObject: createDownloadStorageRouteHandler(downloadStorageObject) }
+		...createAdminRouteHandlers()
 	};
 	const routes = [];
 	const shapes = /* @__PURE__ */ new Map();
@@ -7067,7 +7041,6 @@ function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, en
 	const clientRouter = createRouter();
 	const addClientRoute = mount(clientRouter, false);
 	addClientRoute("GET", "/version", "version");
-	if (downloadStorageObject !== void 0) addClientRoute("GET", "/storage/:token/:signature", "downloadStorageObject");
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");
@@ -7099,33 +7072,23 @@ function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, en
 }
 //#endregion
 //#region ../../packages/server/dist/storageAccess.mjs
+/** A URL devices download from, which only an absolute HTTP(S) URL can be. */
 const assertRemoteUrl = (value) => {
-	const protocol = new URL(value).protocol;
-	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an HTTP(S) URL.");
+	let protocol;
+	try {
+		protocol = new URL(value).protocol;
+	} catch {}
+	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an absolute HTTP(S) URL.");
 	return value;
 };
 const getStorageProtocol = (storageUri) => new URL(storageUri).protocol.replace(":", "");
 const isRemoteUrlProtocol = (protocol) => protocol === "http" || protocol === "https";
-const resolveDownloadPath = (value, storageUri) => {
-	const parsed = parseStorageDownloadPath(value);
-	if (!parsed || parsed.storageUri !== storageUri) throw new Error("Storage getDownloadUrl must return an HTTP(S) URL or a valid storage download path.");
-	return value;
-};
-const tokensEqual = (left, right) => {
-	const leftBytes = new TextEncoder().encode(left);
-	const rightBytes = new TextEncoder().encode(right);
-	let difference = leftBytes.length ^ rightBytes.length;
-	const length = Math.max(leftBytes.length, rightBytes.length);
-	for (let index = 0; index < length; index += 1) difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
-	return difference === 0;
-};
-const createStorageAccess = (storageAdapters) => {
-	const protocols = /* @__PURE__ */ new Set();
-	for (const storage of storageAdapters) {
-		if (protocols.has(storage.protocol)) throw new Error(`Multiple storage adapters handle protocol: ${storage.protocol}`);
-		protocols.add(storage.protocol);
-	}
-	const findStorage = (protocol) => storageAdapters.find((item) => item.protocol === protocol);
+/**
+* Reads and download URLs over the server's storage, for the URIs of its
+* protocol; an HTTP(S) URI is used as it is.
+*/
+const createStorageAccess = (storageAdapter) => {
+	const findStorage = (protocol) => storageAdapter.protocol === protocol ? storageAdapter : void 0;
 	const readStorageResponse = async (storageUri) => {
 		const protocol = getStorageProtocol(storageUri);
 		const storage = findStorage(protocol);
@@ -7149,38 +7112,12 @@ const createStorageAccess = (storageAdapters) => {
 		}
 		if (!storage.getDownloadUrl) return null;
 		const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri });
-		try {
-			return assertRemoteUrl(downloadUrl);
-		} catch (error) {
-			if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) throw error;
-		}
-		return resolveDownloadPath(downloadUrl, storageUri);
+		return assertRemoteUrl(downloadUrl);
 	};
 	const readStorageText = async (storageUri) => {
 		return (await readStorageResponse(storageUri))?.text() ?? null;
 	};
 	return {
-		downloadStorageObject: storageAdapters.some((storage) => storage.getDownloadUrl !== void 0) ? async (storageUriToken, encodedSignature) => {
-			const requestedPath = `/storage/${storageUriToken}/${encodedSignature}`;
-			const requested = parseStorageDownloadPath(requestedPath);
-			if (!requested) return null;
-			let storage;
-			try {
-				storage = findStorage(getStorageProtocol(requested.storageUri));
-			} catch {
-				return null;
-			}
-			if (!storage?.getDownloadUrl || !storage.get) return null;
-			const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri: requested.storageUri });
-			try {
-				new URL(downloadUrl);
-				return null;
-			} catch {
-				if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) return null;
-			}
-			if (!tokensEqual(downloadUrl, requestedPath)) return null;
-			return (await storage.get({ storageUri: requested.storageUri })).response;
-		} : void 0,
 		readStorageText,
 		resolveFileUrl
 	};
@@ -7202,17 +7139,21 @@ const databaseOf = (value) => {
 	}
 	throw new HotUpdaterConfigError("database must be a Hot Updater 1.0 database, such as kyselyAdapter(...) or postgres(...). Upgrade the provider package that created it.");
 };
-/** `"public"`, or nothing; a `clientAccess` object says what replaced it. */
+/** The configured storage, when it is a storage adapter. */
+const storageOf = (value) => {
+	if (isRecord$4(value) && typeof value.name === "string" && typeof value.protocol === "string") return value;
+	throw new HotUpdaterConfigError("storage must be a storage adapter, such as s3Storage(...): the one hot-updater.config.ts uploads with.");
+};
+/** `"public"`, or nothing. */
 const isPublic = (value) => {
 	if (value === void 0) return false;
 	if (value === "public") return true;
-	throw new HotUpdaterConfigError(isRecord$4(value) ? "clientAccess objects were removed in 1.0. Set clientAccess: \"public\", or add a plugin that provides clientAuth to plugins." : "clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
+	throw new HotUpdaterConfigError("clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
 };
 function createHotUpdater(options) {
-	for (const key of ["authorityId", "catalogId"]) if (Object.hasOwn(options, key)) throw new TypeError(`Remove ${key} from createHotUpdater options. Catalog identity is managed internally.`);
 	const database = databaseOf(options.database);
-	const storage = Object.freeze([...options.storage ?? []]);
-	const { downloadStorageObject, readStorageText, resolveFileUrl } = createStorageAccess(storage);
+	const storage = storageOf(options.storage);
+	const { readStorageText, resolveFileUrl } = createStorageAccess(storage);
 	const publicClients = isPublic(options.clientAccess);
 	const configured = Object.freeze([...options.plugins ?? []]);
 	const plugins = assemblePlugins(configured, database, { storage: {
@@ -7231,7 +7172,6 @@ function createHotUpdater(options) {
 	const handlers = createHotUpdaterHandlers({
 		api: { core: plugins.core },
 		...clientPolicy === void 0 ? {} : { clientPolicy },
-		downloadStorageObject,
 		endpoints: plugins.endpoints,
 		plugins: Object.keys(plugins.api)
 	});
@@ -7240,7 +7180,7 @@ function createHotUpdater(options) {
 		adapterName: database.name,
 		get handlers() {
 			if (!serving) {
-				for (const adapter of storage) assertStorageOperations(adapter, ["get", "getDownloadUrl"]);
+				assertStorageOperations(storage, ["get", "getDownloadUrl"]);
 				serving = true;
 			}
 			return handlers;
@@ -13743,10 +13683,11 @@ const plugins = [
 ];
 //#endregion
 //#region src/s3Storage.ts
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, downloadUrlSigningKey, getDownloadUrl: configuredGetDownloadUrl, ...s3Config } = config;
-	const getDownloadUrl = configuredGetDownloadUrl ?? (downloadUrlSigningKey ? createStorageDownloadUrl(downloadUrlSigningKey) : void 0);
+	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
 	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig(s3Config));
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
@@ -13859,10 +13800,15 @@ function s3Storage(config) {
 				throw error;
 			}
 		},
-		...getDownloadUrl ? { async getDownloadUrl(input) {
-			parseAndValidate(input.storageUri);
-			return getDownloadUrl(input);
-		} } : {},
+		async getDownloadUrl({ storageUri }) {
+			const { key } = parseAndValidate(storageUri);
+			if (getDownloadUrl) return getDownloadUrl({ storageUri });
+			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
+			return { url: await getSignedUrl(client, new _aws_sdk_client_s3.GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
+		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
@@ -13906,7 +13852,7 @@ const getHotUpdater = (distributionDomainName) => {
 	const hotUpdater = createHotUpdater({
 		database,
 		plugins,
-		storage: [s3Storage({
+		storage: s3Storage({
 			bucketName: S3_BUCKET_NAME,
 			region: SSM_REGION,
 			getDownloadUrl: cloudFrontDownloadUrl({
@@ -13915,7 +13861,7 @@ const getHotUpdater = (distributionDomainName) => {
 				ssmParameterName: SSM_PARAMETER_NAME,
 				publicBaseUrl: `https://${distributionDomainName}`
 			})
-		})]
+		})
 	});
 	hotUpdaterByDistribution.set(distributionDomainName, hotUpdater);
 	return hotUpdater;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/aws",
   "type": "module",
-  "version": "1.0.0-rc.42",
+  "version": "1.0.0-rc.44",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -45,9 +45,9 @@
     "es-toolkit": "^1.32.0",
     "execa": "9.5.2",
     "mime": "^4.0.4",
-    "@hot-updater/mock": "1.0.0-rc.42",
-    "@hot-updater/test-utils": "1.0.0-rc.42",
-    "@hot-updater/protocol": "1.0.0-rc.42"
+    "@hot-updater/protocol": "1.0.0-rc.44",
+    "@hot-updater/mock": "1.0.0-rc.44",
+    "@hot-updater/test-utils": "1.0.0-rc.44"
   },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1066.0",
@@ -61,10 +61,11 @@
     "@aws-sdk/credential-providers": "3.1066.0",
     "@aws-sdk/lib-storage": "3.1066.0",
     "@aws-sdk/lib-dynamodb": "3.1066.0",
+    "@aws-sdk/s3-request-presigner": "3.1066.0",
     "hono": "4.12.34",
-    "@hot-updater/cli-tools": "1.0.0-rc.42",
-    "@hot-updater/server": "1.0.0-rc.42",
-    "@hot-updater/plugin-core": "1.0.0-rc.42"
+    "@hot-updater/cli-tools": "1.0.0-rc.44",
+    "@hot-updater/plugin-core": "1.0.0-rc.44",
+    "@hot-updater/server": "1.0.0-rc.44"
   },
   "scripts": {
     "build": "tsdown",