@hot-updater/cloudflare 0.31.4 → 0.32.0

package/src/r2Storage.ts

@@ -1,126 +1,66 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-
 import {
-  createStorageKeyBuilder,
-  createNodeStoragePlugin,
-  getContentType,
-  parseStorageUri,
+  createUniversalStoragePlugin,
+  type StoragePluginHooks,
+  type UniversalStoragePlugin,
 } from "@hot-updater/plugin-core";
-import { ExecaError } from "execa";
 
-import { createWrangler } from "./utils/createWrangler";
+import {
+  createS3RuntimeStorageProfile,
+  createS3StorageProfile,
+  type R2S3StorageConfig,
+} from "./r2S3Storage";
+import {
+  createWranglerRuntimeStorageProfile,
+  createWranglerStorageProfile,
+  type R2WranglerStorageConfig,
+} from "./r2WranglerStorage";
 
-export interface R2StorageConfig {
-  cloudflareApiToken: string;
-  accountId: string;
-  bucketName: string;
-  /**
-   * Base path where bundles will be stored in the bucket
-   */
-  basePath?: string;
-}
+export type R2StorageConfig = R2S3StorageConfig | R2WranglerStorageConfig;
+
+export type { R2S3StorageConfig, R2WranglerStorageConfig };
+
+const hasS3Credentials = (
+  config: R2StorageConfig,
+): config is R2S3StorageConfig => {
+  return Boolean(config.credentials);
+};
 
 /**
  * Cloudflare R2 storage plugin for Hot Updater.
  */
-export const r2Storage = createNodeStoragePlugin<R2StorageConfig>({
+interface R2Storage {
+  (
+    config: R2S3StorageConfig,
+    hooks?: StoragePluginHooks,
+  ): () => UniversalStoragePlugin;
+  /**
+   * @deprecated `cloudflareApiToken` uses the Wrangler CLI for R2 operations,
+   * which is slower than direct S3-compatible API access. Create R2
+   * S3-compatible credentials in the Cloudflare dashboard and pass them with
+   * `r2Storage({ credentials })` instead.
+   */
+  (
+    config: R2WranglerStorageConfig,
+    hooks?: StoragePluginHooks,
+  ): () => UniversalStoragePlugin;
+}
+
+const createR2StoragePlugin = createUniversalStoragePlugin<R2StorageConfig>({
   name: "r2Storage",
   supportedProtocol: "r2",
   factory: (config) => {
-    const { bucketName, cloudflareApiToken, accountId } = config;
-    const wrangler = createWrangler({
-      accountId,
-      cloudflareApiToken: cloudflareApiToken,
-      cwd: process.cwd(),
-    });
-
-    const getStorageKey = createStorageKeyBuilder(config.basePath);
+    if (hasS3Credentials(config)) {
+      return {
+        node: createS3StorageProfile(config),
+        runtime: createS3RuntimeStorageProfile(config),
+      };
+    }
 
     return {
-      async delete(storageUri) {
-        const { bucket, key } = parseStorageUri(storageUri, "r2");
-        if (bucket !== bucketName) {
-          throw new Error(
-            `Bucket name mismatch: expected "${bucketName}", but found "${bucket}".`,
-          );
-        }
-
-        try {
-          await wrangler(
-            "r2",
-            "object",
-            "delete",
-            [bucketName, key].join("/"),
-            "--remote",
-          );
-        } catch {
-          throw new Error("Can not delete bundle");
-        }
-      },
-      async upload(key, filePath) {
-        const contentType = getContentType(filePath);
-
-        const filename = path.basename(filePath);
-
-        const Key = getStorageKey(key, filename);
-        try {
-          const { stderr, exitCode } = await wrangler(
-            "r2",
-            "object",
-            "put",
-            [bucketName, Key].join("/"),
-            "--file",
-            filePath,
-            "--content-type",
-            contentType,
-            "--remote",
-          );
-          if (exitCode !== 0 && stderr) {
-            throw new Error(stderr);
-          }
-        } catch (error) {
-          if (error instanceof ExecaError) {
-            throw new Error(error.stderr || error.stdout);
-          }
-
-          throw error;
-        }
-
-        return {
-          storageUri: `r2://${bucketName}/${Key}`,
-        };
-      },
-      async downloadFile(storageUri, filePath) {
-        const { bucket, key } = parseStorageUri(storageUri, "r2");
-        if (bucket !== bucketName) {
-          throw new Error(
-            `Bucket name mismatch: expected "${bucketName}", but found "${bucket}".`,
-          );
-        }
-
-        try {
-          await fs.mkdir(path.dirname(filePath), { recursive: true });
-          const { stderr, exitCode } = await wrangler(
-            "r2",
-            "object",
-            "get",
-            [bucketName, key].join("/"),
-            "--file",
-            filePath,
-            "--remote",
-          );
-          if (exitCode !== 0 && stderr) {
-            throw new Error(stderr);
-          }
-        } catch (error) {
-          if (error instanceof ExecaError) {
-            throw new Error(error.stderr || error.stdout);
-          }
-
-          throw error;
-        }
-      },
+      node: createWranglerStorageProfile(config),
+      runtime: createWranglerRuntimeStorageProfile(),
     };
   },
 });
+
+export const r2Storage: R2Storage = createR2StoragePlugin;

package/src/r2WranglerStorage.ts

@@ -0,0 +1,193 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  createStorageKeyBuilder,
+  getContentType,
+  type NodeStorageProfile,
+  parseStorageUri,
+  type RuntimeStorageProfile,
+} from "@hot-updater/plugin-core";
+import { ExecaError } from "execa";
+
+import { createWrangler } from "./utils/createWrangler";
+
+/**
+ * @deprecated `cloudflareApiToken` uses the Wrangler CLI for R2 operations,
+ * which is slower than direct S3-compatible API access. Create R2
+ * S3-compatible credentials in the Cloudflare dashboard and pass them with
+ * `r2Storage({ credentials })` instead.
+ */
+export interface R2WranglerStorageConfig {
+  accountId: string;
+  bucketName: string;
+  /**
+   * @deprecated This token keeps R2 access on the slower Wrangler CLI path.
+   * Create R2 S3-compatible credentials in the Cloudflare dashboard and use
+   * `credentials` instead.
+   */
+  cloudflareApiToken: string;
+  /**
+   * Base path where bundles will be stored in the bucket
+   */
+  basePath?: string;
+  credentials?: never;
+}
+
+const ensureExpectedR2Bucket = (bucket: string, bucketName: string) => {
+  if (bucket !== bucketName) {
+    throw new Error(
+      `Bucket name mismatch: expected "${bucketName}", but found "${bucket}".`,
+    );
+  }
+};
+
+const isR2ObjectNotFoundError = (error: ExecaError) => {
+  const output = [error.stderr, error.stdout, error.shortMessage, error.message]
+    .filter(Boolean)
+    .join("\n")
+    .toLowerCase();
+
+  return (
+    output.includes("not found") ||
+    output.includes("no such object") ||
+    output.includes("does not exist")
+  );
+};
+
+export const createWranglerStorageProfile = (
+  config: R2WranglerStorageConfig,
+): NodeStorageProfile => {
+  const { bucketName, cloudflareApiToken, accountId } = config;
+  const wrangler = createWrangler({
+    accountId,
+    cloudflareApiToken,
+    cwd: process.cwd(),
+  });
+  const getStorageKey = createStorageKeyBuilder(config.basePath);
+
+  return {
+    async delete(storageUri) {
+      const { bucket, key } = parseStorageUri(storageUri, "r2");
+      ensureExpectedR2Bucket(bucket, bucketName);
+
+      try {
+        await wrangler(
+          "r2",
+          "object",
+          "delete",
+          [bucketName, key].join("/"),
+          "--remote",
+        );
+      } catch {
+        throw new Error("Can not delete bundle");
+      }
+    },
+    async upload(key, filePath) {
+      const contentType = getContentType(filePath);
+
+      const filename = path.basename(filePath);
+
+      const Key = getStorageKey(key, filename);
+      try {
+        const { stderr, exitCode } = await wrangler(
+          "r2",
+          "object",
+          "put",
+          [bucketName, Key].join("/"),
+          "--file",
+          filePath,
+          "--content-type",
+          contentType,
+          "--remote",
+        );
+        if (exitCode !== 0 && stderr) {
+          throw new Error(stderr);
+        }
+      } catch (error) {
+        if (error instanceof ExecaError) {
+          throw new Error(error.stderr || error.stdout);
+        }
+
+        throw error;
+      }
+
+      return {
+        storageUri: `r2://${bucketName}/${Key}`,
+      };
+    },
+    async exists(storageUri: string) {
+      const { bucket, key } = parseStorageUri(storageUri, "r2");
+      ensureExpectedR2Bucket(bucket, bucketName);
+
+      const tempDir = await fs.mkdtemp(
+        path.join(os.tmpdir(), "hot-updater-r2-exists-"),
+      );
+      const tempFilePath = path.join(tempDir, "object");
+
+      try {
+        await wrangler(
+          "r2",
+          "object",
+          "get",
+          [bucketName, key].join("/"),
+          "--file",
+          tempFilePath,
+          "--remote",
+        );
+        return true;
+      } catch (error) {
+        if (error instanceof ExecaError && isR2ObjectNotFoundError(error)) {
+          return false;
+        }
+
+        throw error;
+      } finally {
+        await fs.rm(tempDir, { force: true, recursive: true });
+      }
+    },
+    async downloadFile(storageUri, filePath) {
+      const { bucket, key } = parseStorageUri(storageUri, "r2");
+      ensureExpectedR2Bucket(bucket, bucketName);
+
+      try {
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        const { stderr, exitCode } = await wrangler(
+          "r2",
+          "object",
+          "get",
+          [bucketName, key].join("/"),
+          "--file",
+          filePath,
+          "--remote",
+        );
+        if (exitCode !== 0 && stderr) {
+          throw new Error(stderr);
+        }
+      } catch (error) {
+        if (error instanceof ExecaError) {
+          throw new Error(error.stderr || error.stdout);
+        }
+
+        throw error;
+      }
+    },
+  };
+};
+
+export const createWranglerRuntimeStorageProfile =
+  (): RuntimeStorageProfile => {
+    const error = new Error(
+      "r2Storage runtime profile requires R2 S3 credentials. Wrangler-based R2 access is only supported by the node profile.",
+    );
+
+    return {
+      async readText() {
+        throw error;
+      },
+      async getDownloadUrl() {
+        throw error;
+      },
+    };
+  };

package/worker/dist/README.md

@@ -1 +1 @@
-This folder contains the built output assets for the worker "hot-updater" generated at 2026-05-18T15:42:26.357Z.
+This folder contains the built output assets for the worker "hot-updater" generated at 2026-05-21T13:59:33.325Z.

package/worker/dist/index.js

@@ -5236,6 +5236,52 @@ function calculatePagination(total, options) {
 }
 __name(calculatePagination, "calculatePagination");
 
+// ../plugin-core/dist/contentAddressedAssets.mjs
+init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_process();
+init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_console();
+init_performance2();
+var getContentAddressedAssetStoragePath = /* @__PURE__ */ __name(({ assetPath, fileHash }) => {
+  const extension = assetPath.endsWith(".br") ? ".br" : assetPath.includes(".") ? `.${assetPath.split(".").pop()}` : "";
+  return `sha256/${fileHash.slice(0, 2)}/${fileHash}${extension}`;
+}, "getContentAddressedAssetStoragePath");
+
+// ../plugin-core/dist/assetStorageLayout.mjs
+init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_process();
+init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_console();
+init_performance2();
+
+// ../plugin-core/dist/legacyAssetStorageLayout.mjs
+init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_process();
+init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_console();
+init_performance2();
+var getLegacyManifestAssetStoragePath = /* @__PURE__ */ __name(({ assetPath }) => assetPath, "getLegacyManifestAssetStoragePath");
+
+// ../plugin-core/dist/assetStorageLayout.mjs
+var createStorageUriWithRelativePath = /* @__PURE__ */ __name(({ baseStorageUri, relativePath }) => {
+  const storageUrl = new URL(baseStorageUri);
+  storageUrl.pathname = `${storageUrl.pathname.replace(/\/+$/, "")}/${relativePath.replace(/\\/g, "/").split("/").filter(Boolean).map((segment) => encodeURIComponent(segment)).join("/")}`;
+  return storageUrl.toString();
+}, "createStorageUriWithRelativePath");
+var getAssetStorageLayout = /* @__PURE__ */ __name((assetBaseStorageUri) => {
+  const pathname = new URL(assetBaseStorageUri).pathname.replace(/\/+$/, "");
+  return pathname.endsWith("/assets") || pathname === "/assets" ? "content-addressed" : "legacy-files";
+}, "getAssetStorageLayout");
+var getManifestAssetStoragePath = /* @__PURE__ */ __name(({ assetBaseStorageUri, assetPath, fileHash }) => {
+  if (getAssetStorageLayout(assetBaseStorageUri) === "content-addressed") return getContentAddressedAssetStoragePath({
+    assetPath,
+    fileHash
+  });
+  return getLegacyManifestAssetStoragePath({ assetPath });
+}, "getManifestAssetStoragePath");
+var resolveManifestAssetStorageUri = /* @__PURE__ */ __name(({ assetBaseStorageUri, assetPath, fileHash }) => createStorageUriWithRelativePath({
+  baseStorageUri: assetBaseStorageUri,
+  relativePath: getManifestAssetStoragePath({
+    assetBaseStorageUri,
+    assetPath,
+    fileHash
+  })
+}), "resolveManifestAssetStorageUri");
+
 // ../plugin-core/dist/createDatabasePlugin.mjs
 init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_process();
 init_virtual_unenv_global_polyfill_cloudflare_unenv_preset_node_console();
@@ -5707,7 +5753,7 @@ var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames2 = Object.getOwnPropertyNames;
 var __getProtoOf2 = Object.getPrototypeOf;
 var __hasOwnProp2 = Object.prototype.hasOwnProperty;
-var __commonJSMin = /* @__PURE__ */ __name((cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports), "__commonJSMin");
+var __commonJSMin = /* @__PURE__ */ __name((cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports), "__commonJSMin");
 var __copyProps2 = /* @__PURE__ */ __name((to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames2(from), i = 0, n = keys.length, key; i < n; i++) {
     key = keys[i];
@@ -6718,7 +6764,6 @@ var require_min_version2 = /* @__PURE__ */ __commonJSMin((exports, module) => {
           case "<":
           case "<=":
             break;
-          /* istanbul ignore next */
           default:
             throw new Error(`Unexpected operation: ${comparator.operator}`);
         }
@@ -8310,6 +8355,9 @@ var createProfiledStoragePlugin = /* @__PURE__ */ __name(({ createProfiles, name
     async downloadFile(storageUri, filePath) {
       return requireNodeProfile().downloadFile(storageUri, filePath);
     },
+    async exists(storageUri) {
+      return requireNodeProfile().exists(storageUri);
+    },
     async upload(key, filePath) {
       return requireNodeProfile().upload(key, filePath);
     }
@@ -8434,13 +8482,6 @@ var isBundleManifest = /* @__PURE__ */ __name((value) => {
     }
   );
 }, "isBundleManifest");
-var createChildStorageUri = /* @__PURE__ */ __name((baseStorageUri, relativePath) => {
-  const baseUrl = new URL(baseStorageUri);
-  const normalizedBasePath = baseUrl.pathname.replace(/\/+$/, "");
-  const relativeSegments = relativePath.split("/").filter(Boolean).map((segment) => encodeURIComponent(segment));
-  baseUrl.pathname = `${normalizedBasePath}/${relativeSegments.join("/")}`;
-  return baseUrl.toString();
-}, "createChildStorageUri");
 async function fetchBundleManifest(storageUri, readStorageText, resolveFileUrl, context2) {
   const [storageText, fileUrl] = await Promise.all([
     readStorageText(storageUri, context2),
@@ -8491,10 +8532,11 @@ async function resolveChangedAssets({
       }
       const usesBrotliAsset = BR_COMPRESSED_ASSET_PATH_RE.test(assetPath);
       const downloadPath = usesBrotliAsset ? `${assetPath}.br` : assetPath;
-      const storageUri = createChildStorageUri(
+      const storageUri = resolveManifestAssetStorageUri({
         assetBaseStorageUri,
-        downloadPath
-      );
+        assetPath: downloadPath,
+        fileHash: asset.fileHash
+      });
       const patch = patchDescriptor?.assetPath === assetPath ? patchDescriptor.patch : null;
       let fileUrl = null;
       try {
@@ -9022,7 +9064,7 @@ init_performance2();
 // ../../packages/server/package.json
 var package_default = {
   name: "@hot-updater/server",
-  version: "0.31.4",
+  version: "0.32.0",
   type: "module",
   description: "React Native OTA solution for self-hosted",
   sideEffects: false,
@@ -9120,6 +9162,8 @@ var HandlerBadRequestError = class extends Error {
 };
 var SDK_VERSION_HEADER = "Hot-Updater-SDK-Version";
 var EXPLICIT_NO_UPDATE_MIN_SDK_VERSION = "0.31.0";
+var DEFAULT_BUNDLE_LIST_LIMIT = 50;
+var MAX_BUNDLE_LIST_LIMIT = 100;
 var supportsExplicitNoUpdateResponse = /* @__PURE__ */ __name((request) => {
   const sdkVersion = request.headers.get(SDK_VERSION_HEADER)?.trim();
   if (!sdkVersion) {
@@ -9187,6 +9231,19 @@ var parseStringArraySearchParam = /* @__PURE__ */ __name((url, key) => {
   const values = url.searchParams.getAll(key);
   return values.length > 0 ? values : void 0;
 }, "parseStringArraySearchParam");
+var parsePositiveIntegerSearchParam = /* @__PURE__ */ __name((url, key, defaultValue, maxValue) => {
+  const value = url.searchParams.get(key);
+  if (value === null) {
+    return defaultValue;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > maxValue) {
+    throw new HandlerBadRequestError(
+      `The '${key}' query parameter must be a positive integer between 1 and ${maxValue}.`
+    );
+  }
+  return parsed;
+}, "parsePositiveIntegerSearchParam");
 var requirePlatformParam = /* @__PURE__ */ __name((params) => {
   const platform2 = requireRouteParam(params, "platform");
   if (!isPlatform(platform2)) {
@@ -9271,7 +9328,12 @@ var handleGetBundles = /* @__PURE__ */ __name(async (_params, request, api, cont
   const url = new URL(request.url);
   const channel2 = url.searchParams.get("channel") ?? void 0;
   const platform2 = url.searchParams.get("platform");
-  const limit = Number(url.searchParams.get("limit")) || 50;
+  const limit = parsePositiveIntegerSearchParam(
+    url,
+    "limit",
+    DEFAULT_BUNDLE_LIST_LIMIT,
+    MAX_BUNDLE_LIST_LIMIT
+  );
   const pageParam = url.searchParams.get("page");
   const offset = url.searchParams.get("offset");
   const after = url.searchParams.get("after") ?? void 0;
@@ -9407,14 +9469,13 @@ var routes = {
 };
 function createHandler(api, options = {}) {
   const basePath = options.basePath ?? "/api";
-  const updateCheckEnabled = options.routes?.updateCheck ?? true;
-  const versionEnabled = options.routes?.version ?? true;
-  const bundlesEnabled = options.routes?.bundles ?? true;
+  const routeOptions = {
+    updateCheck: options.routes?.updateCheck ?? true,
+    bundles: options.routes?.bundles ?? false
+  };
   const router = createRouter();
-  if (versionEnabled) {
-    addRoute(router, "GET", "/version", "version");
-  }
-  if (updateCheckEnabled) {
+  addRoute(router, "GET", "/version", "version");
+  if (routeOptions.updateCheck) {
     addRoute(
       router,
       "GET",
@@ -9440,7 +9501,7 @@ function createHandler(api, options = {}) {
       "appVersionUpdateWithCohort"
     );
   }
-  if (bundlesEnabled) {
+  if (routeOptions.bundles) {
     addRoute(router, "GET", "/api/bundles/channels", "getChannels");
     addRoute(router, "GET", "/api/bundles/:id", "getBundle");
     addRoute(router, "GET", "/api/bundles", "getBundles");
@@ -9461,7 +9522,8 @@ function createHandler(api, options = {}) {
           headers: { "Content-Type": "application/json" }
         });
       }
-      const handler = routes[match2.data];
+      const routeName = match2.data;
+      const handler = routes[routeName];
       if (!handler) {
         return new Response(JSON.stringify({ error: "Handler not found" }), {
           status: 500,
@@ -12318,7 +12380,6 @@ var hotUpdater = createHotUpdater({
   basePath: HOT_UPDATER_BASE_PATH,
   routes: {
     updateCheck: true,
-    version: true,
     bundles: false
   }
 });