@hot-updater/cloudflare 0.36.0 → 0.36.2

package/dist/iac/index.cjs

@@ -11233,7 +11233,7 @@ const SOURCE_TEMPLATE = `// add this to your App.tsx
 import { HotUpdater } from "@hot-updater/react-native";
 
 function App() {
-  return ...
+  return null; // Replace with your app root
 }
 
 export default HotUpdater.wrap({

package/dist/iac/index.mjs

@@ -11226,7 +11226,7 @@ const SOURCE_TEMPLATE = `// add this to your App.tsx
 import { HotUpdater } from "@hot-updater/react-native";
 
 function App() {
-  return ...
+  return null; // Replace with your app root
 }
 
 export default HotUpdater.wrap({

package/dist/worker/index.cjs

@@ -323,7 +323,7 @@ const resolveR2BucketFromContext = (context) => {
 	return bucket;
 };
 const createPublicObjectPath = (storageUrl) => `${storageUrl.host}${storageUrl.pathname}`;
-const createR2ObjectKey = (storageUrl) => storageUrl.pathname.replace(/^\/+/, "");
+const createR2ObjectKey = (storageUrl) => (0, _hot_updater_plugin_core.decodeStorageObjectKey)(storageUrl.pathname.replace(/^\/+/, ""));
 const r2WorkerStorage = (config) => {
 	return (0, _hot_updater_plugin_core.createRuntimeStoragePlugin)({
 		name: "r2WorkerStorage",

package/dist/worker/index.mjs

@@ -1,6 +1,6 @@
 import { signToken, verifyJwtSignedUrl } from "@hot-updater/js";
 import { DEFAULT_ROLLOUT_COHORT_COUNT, NIL_UUID, getAssetBaseStorageUri, getBundlePatches, getManifestFileHash, getManifestStorageUri, stripBundleArtifactMetadata } from "@hot-updater/core";
-import { calculatePagination, createDatabasePlugin, createRuntimeStoragePlugin, filterCompatibleAppVersions, resolveUpdateInfoFromBundles } from "@hot-updater/plugin-core";
+import { calculatePagination, createDatabasePlugin, createRuntimeStoragePlugin, decodeStorageObjectKey, filterCompatibleAppVersions, resolveUpdateInfoFromBundles } from "@hot-updater/plugin-core";
 //#region src/cloudflareWorkerDatabase.ts
 const buildJsonEachInClause = (columnName, values, params) => {
 	if (values.length === 0) return "1 = 0";
@@ -322,7 +322,7 @@ const resolveR2BucketFromContext = (context) => {
 	return bucket;
 };
 const createPublicObjectPath = (storageUrl) => `${storageUrl.host}${storageUrl.pathname}`;
-const createR2ObjectKey = (storageUrl) => storageUrl.pathname.replace(/^\/+/, "");
+const createR2ObjectKey = (storageUrl) => decodeStorageObjectKey(storageUrl.pathname.replace(/^\/+/, ""));
 const r2WorkerStorage = (config) => {
 	return createRuntimeStoragePlugin({
 		name: "r2WorkerStorage",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/cloudflare",
   "type": "module",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -61,11 +61,11 @@
     "cloudflare": "4.2.0",
     "hono": "4.12.9",
     "uuidv7": "^1.0.2",
-    "@hot-updater/cli-tools": "0.36.0",
-    "@hot-updater/core": "0.36.0",
-    "@hot-updater/js": "0.36.0",
-    "@hot-updater/plugin-core": "0.36.0",
-    "@hot-updater/server": "0.36.0"
+    "@hot-updater/core": "0.36.2",
+    "@hot-updater/cli-tools": "0.36.2",
+    "@hot-updater/js": "0.36.2",
+    "@hot-updater/plugin-core": "0.36.2",
+    "@hot-updater/server": "0.36.2"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "0.13.0",
@@ -82,7 +82,7 @@
     "vitest": "4.1.4",
     "wrangler": "^4.5.0",
     "xdg-app-paths": "^8.3.0",
-    "@hot-updater/test-utils": "0.36.0"
+    "@hot-updater/test-utils": "0.36.2"
   },
   "scripts": {
     "build": "tsdown && pnpm build:worker",

package/src/r2Storage.spec.ts

@@ -279,6 +279,28 @@ describe("r2Storage", () => {
     );
   });
 
+  it("decodes percent-encoded keys before signing through the S3 API", async () => {
+    mockS3Client();
+    const storage = r2Storage({
+      accountId: "account-id",
+      bucketName: "test-bucket",
+      credentials: {
+        accessKeyId: "access-key-id",
+        secretAccessKey: "secret-access-key",
+      },
+    })();
+
+    await storage.profiles.runtime.getDownloadUrl(
+      "r2://test-bucket/releases/logo%402x.png",
+    );
+
+    const command = vi.mocked(getSignedUrl).mock.calls.at(-1)?.[1];
+    expect(command).toBeInstanceOf(GetObjectCommand);
+    expect((command as GetObjectCommand).input.Key).toBe(
+      "releases/logo@2x.png",
+    );
+  });
+
   it("falls back to wrangler without S3 credentials", async () => {
     wrangler.mockImplementation(async (...args: string[]) => {
       const fileIndex = args.indexOf("--file");
@@ -382,6 +404,29 @@ describe("r2Storage", () => {
     );
   });
 
+  it("decodes percent-encoded keys before using Wrangler", async () => {
+    wrangler.mockResolvedValueOnce({ exitCode: 0, stderr: "" });
+    const storage = r2Storage({
+      accountId: "account-id",
+      bucketName: "test-bucket",
+      cloudflareApiToken: "api-token",
+    })();
+
+    await storage.profiles.node.exists(
+      "r2://test-bucket/releases/logo%402x.png",
+    );
+
+    expect(wrangler).toHaveBeenCalledWith(
+      "r2",
+      "object",
+      "get",
+      "test-bucket/releases/logo@2x.png",
+      "--file",
+      expect.any(String),
+      "--remote",
+    );
+  });
+
   it("rethrows non-missing R2 existence errors", async () => {
     const error = createExecaError("Authentication failed");
     wrangler.mockRejectedValueOnce(error);

package/src/r2WorkerStorage.spec.ts

@@ -30,6 +30,29 @@ describe("r2WorkerStorage", () => {
     expect(get).toHaveBeenCalledWith("app/manifest.json");
   });
 
+  it("decodes percent-encoded object keys before reading from R2", async () => {
+    const get = vi.fn(async (key: string) => ({
+      text: async () => `text:${key}`,
+    }));
+    const storage = r2WorkerStorage({
+      jwtSecret: "secret",
+      publicBaseUrl: "https://assets.example.com",
+    })();
+
+    await storage.profiles.runtime.readText(
+      "r2://bundles/assets/bootsplash/logo-ios%402x.png",
+      {
+        env: {
+          BUCKET: { get },
+          JWT_SECRET: "secret",
+        },
+        request: new Request("https://updates.example.com"),
+      } satisfies TestContext,
+    );
+
+    expect(get).toHaveBeenCalledWith("assets/bootsplash/logo-ios@2x.png");
+  });
+
   it("fails fast when the R2 binding is missing", async () => {
     const storage = r2WorkerStorage({
       jwtSecret: "secret",

package/src/r2WorkerStorage.ts

@@ -1,6 +1,7 @@
 import { signToken } from "@hot-updater/js";
 import {
   createRuntimeStoragePlugin,
+  decodeStorageObjectKey,
   type HotUpdaterContext,
   type RequestEnvContext,
 } from "@hot-updater/plugin-core";
@@ -64,7 +65,7 @@ const createPublicObjectPath = (storageUrl: URL) =>
   `${storageUrl.host}${storageUrl.pathname}`;
 
 const createR2ObjectKey = (storageUrl: URL) =>
-  storageUrl.pathname.replace(/^\/+/, "");
+  decodeStorageObjectKey(storageUrl.pathname.replace(/^\/+/, ""));
 
 export const r2WorkerStorage = <
   TContext extends RequestEnvContext<CloudflareWorkerStorageEnv> =

package/worker/dist/README.md

@@ -1 +1 @@
-This folder contains the built output assets for the worker "hot-updater" generated at 2026-08-13T07:56:54.999Z.
+This folder contains the built output assets for the worker "hot-updater" generated at 2026-08-20T12:36:25.676Z.