@hot-updater/aws 1.0.5 → 1.0.6

package/dist/index.cjs

@@ -397,6 +397,8 @@ const applySsmRuntimeAwsConfig = (config) => {
 //#endregion
 //#region src/cloudFrontDownloadUrl.ts
 const ONE_YEAR_IN_SECONDS = 31536e3;
+/** Signatures kept per process; one per Bundle plus one for shared assets. */
+const MAX_CACHED_SIGNATURES = 1e3;
 const privateKeyCache = /* @__PURE__ */ new Map();
 const getPrivateKeyFromSsm = async (region, parameterName) => {
 	const value = (await new _aws_sdk_client_ssm.SSM(applySsmRuntimeAwsConfig({ region })).getParameter({
@@ -420,18 +422,67 @@ const resolvePrivateKey = (config) => {
 	privateKeyCache.set(cacheKey, pending);
 	return pending;
 };
-const cloudFrontDownloadUrl = (config) => async ({ storageUri }) => {
-	const storageUrl = new URL(storageUri);
-	if (storageUrl.protocol !== "s3:") throw new Error("CloudFront download URLs require an s3 storage URI.");
-	const url = new URL(config.publicBaseUrl);
-	url.pathname = storageUrl.pathname;
-	url.search = "";
-	return { url: (0, _aws_sdk_cloudfront_signer.getSignedUrl)({
-		url: url.toString(),
-		keyPairId: config.keyPairId,
-		privateKey: await resolvePrivateKey(config),
-		dateLessThan: new Date(Date.now() + (config.expiresSeconds ?? ONE_YEAR_IN_SECONDS) * 1e3).toISOString()
-	}) };
+/**
+* The URL path one signature covers: every file of one Bundle
+* (`bundles/<bundleId>/*`), or every content-addressed asset (`assets/*`),
+* whose SHA-256 names cannot be listed without a manifest that names them.
+* Any other object is signed alone.
+*/
+const getSignedPathScope = (pathname) => {
+	const segments = pathname.split("/");
+	const assets = segments.length - 4;
+	if (segments[assets] === _hot_updater_plugin_core.CONTENT_ADDRESSED_ASSET_PREFIX && segments[assets + 1] === "sha256") return `${segments.slice(0, assets + 1).join("/")}/*`;
+	const bundles = segments.lastIndexOf(_hot_updater_plugin_core.BUNDLE_STORAGE_PREFIX);
+	if (bundles >= 0 && segments.length - bundles > 2) return `${segments.slice(0, bundles + 2).join("/")}/*`;
+	return pathname;
+};
+/**
+* Download URLs signed with a CloudFront key pair. An update check returns a
+* URL for every file of the Bundle, hundreds for an app with many assets, so
+* one custom-policy signature covers a Bundle's files and another the shared
+* assets: each is reused for every URL under it until half its lifetime has
+* passed, instead of one RSA signature per file.
+*/
+const cloudFrontDownloadUrl = (config) => {
+	/**
+	* Signed query strings by policy resource, for this configuration only.
+	* A signing in flight is shared, so a batch of URLs asks the private key
+	* once per scope, and a cached signature needs no key at all.
+	*/
+	const signatureCache = /* @__PURE__ */ new Map();
+	return async ({ storageUri }) => {
+		const storageUrl = new URL(storageUri);
+		if (storageUrl.protocol !== "s3:") throw new Error("CloudFront download URLs require an s3 storage URI.");
+		const url = new URL(config.publicBaseUrl);
+		url.pathname = storageUrl.pathname;
+		url.search = "";
+		url.hash = "";
+		const resource = `${url.origin}${getSignedPathScope(url.pathname)}`;
+		const cached = signatureCache.get(resource);
+		if (cached && Date.now() < cached.renewAt) return { url: `${url}${await cached.query}` };
+		const expiresSeconds = config.expiresSeconds ?? ONE_YEAR_IN_SECONDS;
+		const signedAt = Date.now();
+		const query = resolvePrivateKey(config).then((privateKey) => new URL((0, _aws_sdk_cloudfront_signer.getSignedUrl)({
+			url: url.toString(),
+			keyPairId: config.keyPairId,
+			privateKey,
+			policy: JSON.stringify({ Statement: [{
+				Resource: resource,
+				Condition: { DateLessThan: { "AWS:EpochTime": Math.floor((signedAt + expiresSeconds * 1e3) / 1e3) } }
+			}] })
+		})).search);
+		const entry = {
+			query,
+			renewAt: signedAt + expiresSeconds * 1e3 / 2
+		};
+		signatureCache.delete(resource);
+		signatureCache.set(resource, entry);
+		if (signatureCache.size > MAX_CACHED_SIGNATURES) signatureCache.delete(signatureCache.keys().next().value);
+		query.catch(() => {
+			if (signatureCache.get(resource) === entry) signatureCache.delete(resource);
+		});
+		return { url: `${url}${await query}` };
+	};
 };
 //#endregion
 //#region src/s3Storage.ts

package/dist/index.d.cts

@@ -45,6 +45,13 @@ type CloudFrontDownloadUrlOptions = (CloudFrontPrivateKeyFromGetter | CloudFront
   publicBaseUrl: string;
   expiresSeconds?: number;
 };
+/**
+ * Download URLs signed with a CloudFront key pair. An update check returns a
+ * URL for every file of the Bundle, hundreds for an app with many assets, so
+ * one custom-policy signature covers a Bundle's files and another the shared
+ * assets: each is reused for every URL under it until half its lifetime has
+ * passed, instead of one RSA signature per file.
+ */
 declare const cloudFrontDownloadUrl: (config: CloudFrontDownloadUrlOptions) => ({ storageUri }: {
   storageUri: string;
 }) => Promise<{

package/dist/index.d.mts

@@ -45,6 +45,13 @@ type CloudFrontDownloadUrlOptions = (CloudFrontPrivateKeyFromGetter | CloudFront
   publicBaseUrl: string;
   expiresSeconds?: number;
 };
+/**
+ * Download URLs signed with a CloudFront key pair. An update check returns a
+ * URL for every file of the Bundle, hundreds for an app with many assets, so
+ * one custom-policy signature covers a Bundle's files and another the shared
+ * assets: each is reused for every URL under it until half its lifetime has
+ * passed, instead of one RSA signature per file.
+ */
 declare const cloudFrontDownloadUrl: (config: CloudFrontDownloadUrlOptions) => ({ storageUri }: {
   storageUri: string;
 }) => Promise<{

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
+import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
 import { CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { SSM } from "@aws-sdk/client-ssm";
@@ -396,6 +396,8 @@ const applySsmRuntimeAwsConfig = (config) => {
 //#endregion
 //#region src/cloudFrontDownloadUrl.ts
 const ONE_YEAR_IN_SECONDS = 31536e3;
+/** Signatures kept per process; one per Bundle plus one for shared assets. */
+const MAX_CACHED_SIGNATURES = 1e3;
 const privateKeyCache = /* @__PURE__ */ new Map();
 const getPrivateKeyFromSsm = async (region, parameterName) => {
 	const value = (await new SSM(applySsmRuntimeAwsConfig({ region })).getParameter({
@@ -419,18 +421,67 @@ const resolvePrivateKey = (config) => {
 	privateKeyCache.set(cacheKey, pending);
 	return pending;
 };
-const cloudFrontDownloadUrl = (config) => async ({ storageUri }) => {
-	const storageUrl = new URL(storageUri);
-	if (storageUrl.protocol !== "s3:") throw new Error("CloudFront download URLs require an s3 storage URI.");
-	const url = new URL(config.publicBaseUrl);
-	url.pathname = storageUrl.pathname;
-	url.search = "";
-	return { url: getSignedUrl({
-		url: url.toString(),
-		keyPairId: config.keyPairId,
-		privateKey: await resolvePrivateKey(config),
-		dateLessThan: new Date(Date.now() + (config.expiresSeconds ?? ONE_YEAR_IN_SECONDS) * 1e3).toISOString()
-	}) };
+/**
+* The URL path one signature covers: every file of one Bundle
+* (`bundles/<bundleId>/*`), or every content-addressed asset (`assets/*`),
+* whose SHA-256 names cannot be listed without a manifest that names them.
+* Any other object is signed alone.
+*/
+const getSignedPathScope = (pathname) => {
+	const segments = pathname.split("/");
+	const assets = segments.length - 4;
+	if (segments[assets] === CONTENT_ADDRESSED_ASSET_PREFIX && segments[assets + 1] === "sha256") return `${segments.slice(0, assets + 1).join("/")}/*`;
+	const bundles = segments.lastIndexOf(BUNDLE_STORAGE_PREFIX);
+	if (bundles >= 0 && segments.length - bundles > 2) return `${segments.slice(0, bundles + 2).join("/")}/*`;
+	return pathname;
+};
+/**
+* Download URLs signed with a CloudFront key pair. An update check returns a
+* URL for every file of the Bundle, hundreds for an app with many assets, so
+* one custom-policy signature covers a Bundle's files and another the shared
+* assets: each is reused for every URL under it until half its lifetime has
+* passed, instead of one RSA signature per file.
+*/
+const cloudFrontDownloadUrl = (config) => {
+	/**
+	* Signed query strings by policy resource, for this configuration only.
+	* A signing in flight is shared, so a batch of URLs asks the private key
+	* once per scope, and a cached signature needs no key at all.
+	*/
+	const signatureCache = /* @__PURE__ */ new Map();
+	return async ({ storageUri }) => {
+		const storageUrl = new URL(storageUri);
+		if (storageUrl.protocol !== "s3:") throw new Error("CloudFront download URLs require an s3 storage URI.");
+		const url = new URL(config.publicBaseUrl);
+		url.pathname = storageUrl.pathname;
+		url.search = "";
+		url.hash = "";
+		const resource = `${url.origin}${getSignedPathScope(url.pathname)}`;
+		const cached = signatureCache.get(resource);
+		if (cached && Date.now() < cached.renewAt) return { url: `${url}${await cached.query}` };
+		const expiresSeconds = config.expiresSeconds ?? ONE_YEAR_IN_SECONDS;
+		const signedAt = Date.now();
+		const query = resolvePrivateKey(config).then((privateKey) => new URL(getSignedUrl({
+			url: url.toString(),
+			keyPairId: config.keyPairId,
+			privateKey,
+			policy: JSON.stringify({ Statement: [{
+				Resource: resource,
+				Condition: { DateLessThan: { "AWS:EpochTime": Math.floor((signedAt + expiresSeconds * 1e3) / 1e3) } }
+			}] })
+		})).search);
+		const entry = {
+			query,
+			renewAt: signedAt + expiresSeconds * 1e3 / 2
+		};
+		signatureCache.delete(resource);
+		signatureCache.set(resource, entry);
+		if (signatureCache.size > MAX_CACHED_SIGNATURES) signatureCache.delete(signatureCache.keys().next().value);
+		query.catch(() => {
+			if (signatureCache.get(resource) === entry) signatureCache.delete(resource);
+		});
+		return { url: `${url}${await query}` };
+	};
 };
 //#endregion
 //#region src/s3Storage.ts

package/dist/lambda/index.cjs

@@ -30,7 +30,6 @@ let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
-//#region ../plugin-core/dist/contentAddressedAssets.mjs
 const SHA256_FILE_HASH_RE = /^[0-9a-f]{64}$/;
 const isContentAddressedAssetFileHash = (value) => {
 	return typeof value === "string" && SHA256_FILE_HASH_RE.test(value);
@@ -4550,7 +4549,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.0.5";
+const HOT_UPDATER_SERVER_VERSION = "1.0.6";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**
@@ -4841,6 +4840,11 @@ async function resolveAssets(plan, resolveFileUrl) {
 	const resolvedEntries = entries.filter((entry) => entry !== null);
 	return { assets: Object.fromEntries(resolvedEntries.map((entry) => entry.asset)) };
 }
+/**
+* Legacy: artifact protocol v1. Signs a URL for every file of the target, which grows with the
+* Bundle's file count; apps whose SDK predates protocol v2 still ask for it.
+* Remove with the `/artifacts/v1` route once no supported app uses it.
+*/
 async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
 	const manifestStorageUri = targetBundle ? getManifestStorageUri(targetBundle) : null;
 	const manifestFileHash = targetBundle ? getManifestFileHash(targetBundle) : null;
@@ -4874,6 +4878,98 @@ async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readSto
 		...archiveUrl ? { archiveUrl } : {}
 	};
 }
+/** The target's manifest and its plan, or null for a Bundle without one. */
+async function loadTargetPlan({ currentBundle, readStorageText, targetBundle }) {
+	const manifestStorageUri = getManifestStorageUri(targetBundle);
+	const manifestFileHash = getManifestFileHash(targetBundle);
+	const assetBaseStorageUri = getAssetBaseStorageUri(targetBundle);
+	if (!manifestStorageUri || !manifestFileHash || !assetBaseStorageUri) return null;
+	const targetManifest = await fetchBundleManifest(manifestStorageUri, readStorageText);
+	if (!targetManifest) return null;
+	return {
+		manifestFileHash,
+		manifestStorageUri,
+		plan: createManifestArtifactPlan({
+			assetBaseStorageUri,
+			currentBundle,
+			targetBundle,
+			targetManifest
+		}),
+		targetManifest
+	};
+}
+/**
+* Artifact protocol v2: the manifest, the archive, and the one Hermes patch,
+* but no URL per file. A device asks {@link resolveManifestArtifactFiles}
+* for the files it downloads one by one, so signing and the response stay
+* the same size however many files the Bundle has.
+*/
+async function resolveManifestArtifactsV2({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
+	const target = await loadTargetPlan({
+		currentBundle,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const manifestUrl = await resolveFileUrl(target.manifestStorageUri);
+	if (!manifestUrl) return null;
+	const patched = target.plan.assets.find((asset) => asset.patch !== null);
+	let patch;
+	if (patched?.patch && !(patched.file.byteSize !== null && patched.patch.byteSize !== null && patched.patch.byteSize >= patched.file.byteSize)) try {
+		const patchUrl = await resolveFileUrl(patched.patch.storageUri);
+		if (patchUrl) patch = {
+			algorithm: "bsdiff",
+			assetPath: patched.assetPath,
+			baseBundleId: patched.patch.baseBundleId,
+			baseFileHash: patched.patch.baseFileHash,
+			patchFileHash: patched.patch.patchFileHash,
+			patchUrl,
+			...patched.patch.byteSize === null ? {} : { byteSize: patched.patch.byteSize }
+		};
+	} catch {}
+	let archiveUrl = null;
+	const archive = target.targetManifest.archive;
+	if (archive && isContentAddressedAssetFileHash(archive.downloadFileHash) && (asByteSize(archive.downloadByteSize) ?? 0) > 0 && (asByteSize(archive.tarByteSize) ?? 0) > 0) try {
+		archiveUrl = await resolveFileUrl(getBundleArchiveStorageUri({
+			manifestStorageUri: target.manifestStorageUri,
+			bundleId: targetBundle.id
+		}));
+	} catch {}
+	return {
+		artifactProtocolVersion: 2,
+		manifestFileHash: target.manifestFileHash,
+		manifestUrl,
+		...archiveUrl ? { archiveUrl } : {},
+		...patch ? { patch } : {}
+	};
+}
+/**
+* Download URLs for the files a device downloads one by one. Only paths the
+* target's manifest names are signed, at most
+* {@link ARTIFACT_FILES_REQUEST_LIMIT}; null when any path is unknown or a
+* URL cannot be resolved.
+*/
+async function resolveManifestArtifactFiles({ paths, resolveFileUrl, readStorageText, targetBundle }) {
+	if (paths.length === 0 || paths.length > 100 || new Set(paths).size !== paths.length) return null;
+	const target = await loadTargetPlan({
+		currentBundle: null,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const planned = new Map(target.plan.assets.map((asset) => [asset.assetPath, asset]));
+	const requested = paths.map((path) => planned.get(path));
+	if (requested.some((asset) => asset === void 0)) return null;
+	const files = await Promise.all(requested.map(async (asset) => {
+		const url = await resolveFileUrl(asset.file.storageUri);
+		if (!url) return null;
+		const file = { url };
+		if (asset.file.compression) file.compression = asset.file.compression;
+		return [asset.assetPath, file];
+	}));
+	if (files.some((file) => file === null)) return null;
+	return { files: Object.fromEntries(files.filter((file) => file !== null)) };
+}
 //#endregion
 //#region ../../node_modules/.pnpm/verkit@0.4.0/node_modules/verkit/dist/comparison-DenM3wCn.js
 const LETTER_DASH_NUMBER = "[a-zA-Z0-9-]";
@@ -5347,20 +5443,34 @@ const createCoreReads = (db, storage) => {
 			return projectReleaseCatalogRow(row === null ? null : toCatalogRow(row), input, scopeKey);
 		},
 		/** Artifact resolution: one batch read of both bundles and one unique read of their patch. */
-		async getArtifactInfo(targetBundleId, currentBundleId, artifactProtocolVersion) {
+		getArtifactInfo: (async (targetBundleId, currentBundleId, artifactProtocolVersion) => {
 			const { readStorageText } = storage;
-			if (artifactProtocolVersion !== 1 || readStorageText === void 0) return null;
+			if (artifactProtocolVersion !== 1 && artifactProtocolVersion !== 2 || readStorageText === void 0) return null;
 			const withCurrent = currentBundleId !== NIL_UUID;
 			const [[target, current], patch] = await Promise.all([db.findByKeys("bundles", withCurrent ? [{ id: targetBundleId }, { id: currentBundleId }] : [{ id: targetBundleId }]), withCurrent ? db.findOne("bundle_patches", {
 				bundle_id: targetBundleId,
 				base_bundle_id: currentBundleId
 			}) : null]);
 			if (target === null || target === void 0) return null;
-			return resolveManifestArtifacts({
+			const input = {
 				currentBundle: current ? rowToBundle(toBundleRow(current)) : null,
 				readStorageText,
 				resolveFileUrl: storage.resolveFileUrl,
 				targetBundle: rowToBundle(toBundleRow(target), patch === null ? [] : [toPatchRow(patch)])
+			};
+			return artifactProtocolVersion === 2 ? resolveManifestArtifactsV2(input) : resolveManifestArtifacts(input);
+		}),
+		/** A Bundle's file URLs: one point read of the bundle and its manifest. */
+		async getArtifactFiles(bundleId, paths) {
+			const { readStorageText } = storage;
+			if (readStorageText === void 0) return null;
+			const row = await db.findOne("bundles", { id: bundleId });
+			if (row === null) return null;
+			return resolveManifestArtifactFiles({
+				paths,
+				readStorageText,
+				resolveFileUrl: storage.resolveFileUrl,
+				targetBundle: rowToBundle(toBundleRow(row))
 			});
 		},
 		/** A bundle, its patches, and how many patches start from it. */
@@ -6709,6 +6819,7 @@ const ADMIN_ROUTES = [
 //#region ../../packages/server/dist/handlerReleaseCatalogRoutes.mjs
 const CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
 const ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
+const ARTIFACT_V2_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=2";
 const ORIGIN_CACHE_TTL_MS = 5e3;
 const ORIGIN_CACHE_MAX_ENTRIES = 128;
 /** Marks the 404 of a scope that has no catalog. */
@@ -6731,6 +6842,18 @@ const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
 * `Cache-Control`.
 */
 const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
+/** The paths of an artifact files request, or null when malformed. */
+const readArtifactFilePaths = async (request) => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return null;
+	}
+	const paths = body?.paths;
+	if (!Array.isArray(paths) || paths.length === 0 || paths.length > 100 || !paths.every((path) => typeof path === "string" && path.length > 0) || new Set(paths).size !== paths.length) return null;
+	return paths;
+};
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
@@ -6851,6 +6974,30 @@ const createReleaseCatalogRouteHandlers = () => {
 			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
+		artifactV2: async (params, _request, { core }) => {
+			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 2);
+			if (info === null) return privateNotFound();
+			return new Response(JSON.stringify(info), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
+		artifactFilesV2: async (params, request, { core }) => {
+			const paths = await readArtifactFilePaths(request);
+			if (paths === null) return badRequest(`paths must be 1 to 100 unique strings`);
+			const files = await core.getArtifactFiles(requireRouteParam(params, "targetBundleId"), paths);
+			if (files === null) return privateNotFound();
+			return new Response(JSON.stringify(files), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
 		artifactV1: async (params, _request, { core }) => {
 			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 1);
 			if (info === null) return privateNotFound();
@@ -7002,6 +7149,8 @@ function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins =
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");
+	addClientRoute("GET", "/artifacts/v2/:targetBundleId/from/:currentBundleId", "artifactV2");
+	addClientRoute("POST", "/artifacts/v2/:targetBundleId/files", "artifactFilesV2");
 	const adminRouter = createRouter();
 	const addAdminRoute = mount(adminRouter, true);
 	addAdminRoute("GET", "/version", "adminVersion");
@@ -13249,6 +13398,8 @@ const applySsmRuntimeAwsConfig = (config) => {
 //#endregion
 //#region src/cloudFrontDownloadUrl.ts
 const ONE_YEAR_IN_SECONDS = 31536e3;
+/** Signatures kept per process; one per Bundle plus one for shared assets. */
+const MAX_CACHED_SIGNATURES = 1e3;
 const privateKeyCache = /* @__PURE__ */ new Map();
 const getPrivateKeyFromSsm = async (region, parameterName) => {
 	const value = (await new _aws_sdk_client_ssm.SSM(applySsmRuntimeAwsConfig({ region })).getParameter({
@@ -13272,18 +13423,67 @@ const resolvePrivateKey = (config) => {
 	privateKeyCache.set(cacheKey, pending);
 	return pending;
 };
-const cloudFrontDownloadUrl = (config) => async ({ storageUri }) => {
-	const storageUrl = new URL(storageUri);
-	if (storageUrl.protocol !== "s3:") throw new Error("CloudFront download URLs require an s3 storage URI.");
-	const url = new URL(config.publicBaseUrl);
-	url.pathname = storageUrl.pathname;
-	url.search = "";
-	return { url: (0, _aws_sdk_cloudfront_signer.getSignedUrl)({
-		url: url.toString(),
-		keyPairId: config.keyPairId,
-		privateKey: await resolvePrivateKey(config),
-		dateLessThan: new Date(Date.now() + (config.expiresSeconds ?? ONE_YEAR_IN_SECONDS) * 1e3).toISOString()
-	}) };
+/**
+* The URL path one signature covers: every file of one Bundle
+* (`bundles/<bundleId>/*`), or every content-addressed asset (`assets/*`),
+* whose SHA-256 names cannot be listed without a manifest that names them.
+* Any other object is signed alone.
+*/
+const getSignedPathScope = (pathname) => {
+	const segments = pathname.split("/");
+	const assets = segments.length - 4;
+	if (segments[assets] === "assets" && segments[assets + 1] === "sha256") return `${segments.slice(0, assets + 1).join("/")}/*`;
+	const bundles = segments.lastIndexOf(BUNDLE_STORAGE_PREFIX);
+	if (bundles >= 0 && segments.length - bundles > 2) return `${segments.slice(0, bundles + 2).join("/")}/*`;
+	return pathname;
+};
+/**
+* Download URLs signed with a CloudFront key pair. An update check returns a
+* URL for every file of the Bundle, hundreds for an app with many assets, so
+* one custom-policy signature covers a Bundle's files and another the shared
+* assets: each is reused for every URL under it until half its lifetime has
+* passed, instead of one RSA signature per file.
+*/
+const cloudFrontDownloadUrl = (config) => {
+	/**
+	* Signed query strings by policy resource, for this configuration only.
+	* A signing in flight is shared, so a batch of URLs asks the private key
+	* once per scope, and a cached signature needs no key at all.
+	*/
+	const signatureCache = /* @__PURE__ */ new Map();
+	return async ({ storageUri }) => {
+		const storageUrl = new URL(storageUri);
+		if (storageUrl.protocol !== "s3:") throw new Error("CloudFront download URLs require an s3 storage URI.");
+		const url = new URL(config.publicBaseUrl);
+		url.pathname = storageUrl.pathname;
+		url.search = "";
+		url.hash = "";
+		const resource = `${url.origin}${getSignedPathScope(url.pathname)}`;
+		const cached = signatureCache.get(resource);
+		if (cached && Date.now() < cached.renewAt) return { url: `${url}${await cached.query}` };
+		const expiresSeconds = config.expiresSeconds ?? ONE_YEAR_IN_SECONDS;
+		const signedAt = Date.now();
+		const query = resolvePrivateKey(config).then((privateKey) => new URL((0, _aws_sdk_cloudfront_signer.getSignedUrl)({
+			url: url.toString(),
+			keyPairId: config.keyPairId,
+			privateKey,
+			policy: JSON.stringify({ Statement: [{
+				Resource: resource,
+				Condition: { DateLessThan: { "AWS:EpochTime": Math.floor((signedAt + expiresSeconds * 1e3) / 1e3) } }
+			}] })
+		})).search);
+		const entry = {
+			query,
+			renewAt: signedAt + expiresSeconds * 1e3 / 2
+		};
+		signatureCache.delete(resource);
+		signatureCache.set(resource, entry);
+		if (signatureCache.size > MAX_CACHED_SIGNATURES) signatureCache.delete(signatureCache.keys().next().value);
+		query.catch(() => {
+			if (signatureCache.get(resource) === entry) signatureCache.delete(resource);
+		});
+		return { url: `${url}${await query}` };
+	};
 };
 //#endregion
 //#region src/cloudFrontInvalidation.ts

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/aws",
   "type": "module",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -45,9 +45,9 @@
     "es-toolkit": "^1.32.0",
     "execa": "9.5.2",
     "mime": "^4.0.4",
-    "@hot-updater/protocol": "1.0.5",
-    "@hot-updater/mock": "1.0.5",
-    "@hot-updater/test-utils": "1.0.5"
+    "@hot-updater/protocol": "1.0.6",
+    "@hot-updater/mock": "1.0.6",
+    "@hot-updater/test-utils": "1.0.6"
   },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1066.0",
@@ -63,9 +63,9 @@
     "@aws-sdk/lib-dynamodb": "3.1066.0",
     "@aws-sdk/s3-request-presigner": "3.1066.0",
     "hono": "4.12.34",
-    "@hot-updater/cli-tools": "1.0.5",
-    "@hot-updater/plugin-core": "1.0.5",
-    "@hot-updater/server": "1.0.5"
+    "@hot-updater/plugin-core": "1.0.6",
+    "@hot-updater/server": "1.0.6",
+    "@hot-updater/cli-tools": "1.0.6"
   },
   "scripts": {
     "build": "tsdown",