@hot-updater/cloudflare 1.0.0-rc.42 → 1.0.0-rc.44

package/dist/index.cjs

@@ -26,9 +26,8 @@ let cloudflare = require("cloudflare");
 cloudflare = __toESM(cloudflare, 1);
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
-let _hot_updater_server_plugins_api_keys = require("@hot-updater/server/plugins/api-keys");
-let _hot_updater_server_plugins_insights = require("@hot-updater/server/plugins/insights");
-let _hot_updater_server_plugins_remote_config = require("@hot-updater/server/plugins/remote-config");
+let _aws_sdk_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
+let _hot_updater_server_plugins = require("@hot-updater/server/plugins");
 //#region src/d1Executor.ts
 var D1ExecutionError = class extends Error {
 	name = "D1ExecutionError";
@@ -134,12 +133,14 @@ const d1Database = (config) => {
 };
 //#endregion
 //#region src/r2S3Storage.ts
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => {
 	if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey")) return true;
 	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
 };
 const createR2S3Storage = (config) => {
-	const { accountId, basePath, bucketName, downloadUrlSigningKey, endpoint, forcePathStyle, region, ...s3Config } = config;
+	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, ...s3Config } = config;
 	const client = new _aws_sdk_client_s3.S3Client({
 		...s3Config,
 		endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
@@ -147,7 +148,6 @@ const createR2S3Storage = (config) => {
 		region: region ?? "auto"
 	});
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(basePath);
-	const getDownloadUrl = downloadUrlSigningKey ? (0, _hot_updater_plugin_core.createStorageDownloadUrl)(downloadUrlSigningKey) : void 0;
 	const parseAndValidate = (storageUri) => {
 		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "r2");
 		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
@@ -192,10 +192,13 @@ const createR2S3Storage = (config) => {
 				throw error;
 			}
 		},
-		...getDownloadUrl ? { async getDownloadUrl({ storageUri }) {
-			parseAndValidate(storageUri);
-			return getDownloadUrl({ storageUri });
-		} } : {},
+		async getDownloadUrl({ storageUri }) {
+			const { key } = parseAndValidate(storageUri);
+			return { url: await (0, _aws_sdk_s3_request_presigner.getSignedUrl)(client, new _aws_sdk_client_s3.GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
+		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
@@ -222,7 +225,7 @@ const createR2S3Storage = (config) => {
 //#endregion
 //#region src/r2Storage.ts
 const r2Storage = (config) => {
-	if (!config.credentials) throw new Error("r2Storage requires S3-compatible credentials. The Wrangler fallback was removed.");
+	if (!config.credentials) throw new Error("r2Storage requires S3-compatible credentials: pass credentials with an R2 access key ID and secret access key.");
 	return createR2S3Storage(config);
 };
 //#endregion
@@ -232,9 +235,9 @@ const r2Storage = (config) => {
 * client route, and Remote Config. Its Worker imports this list.
 */
 const plugins = [
-	(0, _hot_updater_server_plugins_insights.insights)(),
-	(0, _hot_updater_server_plugins_api_keys.apiKeys)(),
-	(0, _hot_updater_server_plugins_remote_config.remoteConfig)()
+	(0, _hot_updater_server_plugins.insights)(),
+	(0, _hot_updater_server_plugins.apiKeys)(),
+	(0, _hot_updater_server_plugins.remoteConfig)()
 ];
 //#endregion
 exports.D1ExecutionError = D1ExecutionError;

package/dist/index.d.cts

@@ -28,13 +28,11 @@ interface R2S3StorageConfig extends S3ClientConfig {
   credentials: NonNullable<S3ClientConfig["credentials"]>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
-  /** Required when this storage serves downloads through createHotUpdater. */
-  downloadUrlSigningKey?: string;
 }
 //#endregion
 //#region src/r2Storage.d.ts
 type R2StorageConfig = R2S3StorageConfig;
-declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<"put" | "get" | "exists" | "delete">;
+declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
 //#region ../insights/dist/server/eventRow.d.mts
 //#region src/server/eventRow.d.ts

package/dist/index.d.mts

@@ -28,13 +28,11 @@ interface R2S3StorageConfig extends S3ClientConfig {
   credentials: NonNullable<S3ClientConfig["credentials"]>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
-  /** Required when this storage serves downloads through createHotUpdater. */
-  downloadUrlSigningKey?: string;
 }
 //#endregion
 //#region src/r2Storage.d.ts
 type R2StorageConfig = R2S3StorageConfig;
-declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<"put" | "get" | "exists" | "delete">;
+declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
 //#region ../insights/dist/server/eventRow.d.mts
 //#region src/server/eventRow.d.ts

package/dist/index.mjs

@@ -1,10 +1,9 @@
-import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createStorageAdapter, createStorageDownloadUrl, createStorageKeyBuilder, createStorageUri, createTableStatements, generateEngineSql, parseStorageUri } from "@hot-updater/plugin-core";
+import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, createTableStatements, generateEngineSql, parseStorageUri } from "@hot-updater/plugin-core";
 import Cloudflare from "cloudflare";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
-import { apiKeys } from "@hot-updater/server/plugins/api-keys";
-import { insights } from "@hot-updater/server/plugins/insights";
-import { remoteConfig } from "@hot-updater/server/plugins/remote-config";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 //#region src/d1Executor.ts
 var D1ExecutionError = class extends Error {
 	name = "D1ExecutionError";
@@ -110,12 +109,14 @@ const d1Database = (config) => {
 };
 //#endregion
 //#region src/r2S3Storage.ts
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => {
 	if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey")) return true;
 	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
 };
 const createR2S3Storage = (config) => {
-	const { accountId, basePath, bucketName, downloadUrlSigningKey, endpoint, forcePathStyle, region, ...s3Config } = config;
+	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, ...s3Config } = config;
 	const client = new S3Client({
 		...s3Config,
 		endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
@@ -123,7 +124,6 @@ const createR2S3Storage = (config) => {
 		region: region ?? "auto"
 	});
 	const getStorageKey = createStorageKeyBuilder(basePath);
-	const getDownloadUrl = downloadUrlSigningKey ? createStorageDownloadUrl(downloadUrlSigningKey) : void 0;
 	const parseAndValidate = (storageUri) => {
 		const parsed = parseStorageUri(storageUri, "r2");
 		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
@@ -168,10 +168,13 @@ const createR2S3Storage = (config) => {
 				throw error;
 			}
 		},
-		...getDownloadUrl ? { async getDownloadUrl({ storageUri }) {
-			parseAndValidate(storageUri);
-			return getDownloadUrl({ storageUri });
-		} } : {},
+		async getDownloadUrl({ storageUri }) {
+			const { key } = parseAndValidate(storageUri);
+			return { url: await getSignedUrl(client, new GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
+		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
@@ -198,7 +201,7 @@ const createR2S3Storage = (config) => {
 //#endregion
 //#region src/r2Storage.ts
 const r2Storage = (config) => {
-	if (!config.credentials) throw new Error("r2Storage requires S3-compatible credentials. The Wrangler fallback was removed.");
+	if (!config.credentials) throw new Error("r2Storage requires S3-compatible credentials: pass credentials with an R2 access key ID and secret access key.");
 	return createR2S3Storage(config);
 };
 //#endregion

package/dist/init/index.cjs

@@ -22,17 +22,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-let crypto = require("crypto");
-crypto = __toESM(crypto, 1);
 let path = require("path");
 path = __toESM(path, 1);
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
 let cloudflare = require("cloudflare");
 cloudflare = __toESM(cloudflare, 1);
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
-let _hot_updater_server_plugins_api_keys = require("@hot-updater/server/plugins/api-keys");
-let _hot_updater_server_plugins_insights = require("@hot-updater/server/plugins/insights");
-let _hot_updater_server_plugins_remote_config = require("@hot-updater/server/plugins/remote-config");
+let _hot_updater_server_plugins = require("@hot-updater/server/plugins");
 let node_url = require("node:url");
 let node_child_process = require("node:child_process");
 let node_string_decoder = require("node:string_decoder");
@@ -168,9 +164,9 @@ const d1Database = (config) => {
 * client route, and Remote Config. Its Worker imports this list.
 */
 const plugins = [
-	(0, _hot_updater_server_plugins_insights.insights)(),
-	(0, _hot_updater_server_plugins_api_keys.apiKeys)(),
-	(0, _hot_updater_server_plugins_remote_config.remoteConfig)()
+	(0, _hot_updater_server_plugins.insights)(),
+	(0, _hot_updater_server_plugins.apiKeys)(),
+	(0, _hot_updater_server_plugins.remoteConfig)()
 ];
 //#endregion
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
@@ -11429,20 +11425,24 @@ const getConfigScaffold = (build) => {
   })`
 	}).setPlugins({
 		imports: [{
-			pkg: "@hot-updater/cloudflare",
-			named: ["plugins"]
+			pkg: "hot-updater/plugins",
+			named: [
+				"apiKeys",
+				"insights",
+				"remoteConfig"
+			]
 		}],
-		configString: "plugins"
+		configString: "[apiKeys(), insights(), remoteConfig()]"
 	}));
 };
 //#endregion
 //#region iac/managedWorker.ts
 /**
 * Readies the staged prebuilt Worker for Wrangler as init deploys it: its
-* bindings to the D1 database and R2 bucket, and the bucket's name, which
-* the Worker reads from its vars.
+* bindings to the D1 database and R2 bucket, and the bucket's name and the
+* account's ID, which the Worker reads from its vars to presign R2 URLs.
 */
-const prepareWorkerDeployment = async (workerRoot, { d1DatabaseId, d1DatabaseName, r2BucketName }) => {
+const prepareWorkerDeployment = async (workerRoot, { accountId, d1DatabaseId, d1DatabaseName, r2BucketName }) => {
 	const configPath = path.default.join(workerRoot, "wrangler.json");
 	const config = JSON.parse(await fs_promises.default.readFile(configPath, "utf-8"));
 	config.d1_databases = [{
@@ -11454,12 +11454,15 @@ const prepareWorkerDeployment = async (workerRoot, { d1DatabaseId, d1DatabaseNam
 		binding: "BUCKET",
 		bucket_name: r2BucketName
 	}];
-	config.vars = { BUCKET_NAME: r2BucketName };
+	config.vars = {
+		ACCOUNT_ID: accountId,
+		BUCKET_NAME: r2BucketName
+	};
 	await fs_promises.default.writeFile(configPath, JSON.stringify(config, null, 2));
 };
 //#endregion
 //#region iac/index.ts
-const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseId, d1DatabaseName, nonInteractive, r2BucketName, workerName }) => {
+const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseId, d1DatabaseName, nonInteractive, r2BucketName, r2Credentials, workerName }) => {
 	const cwd = (0, _hot_updater_cli_tools.getCwd)();
 	const cloudflarePackagePath = require.resolve("@hot-updater/cloudflare/package.json", { paths: [cwd] });
 	const cloudflarePackageRoot = path.default.dirname(cloudflarePackagePath);
@@ -11467,6 +11470,7 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 	const workerRoot = path.default.join(tmpDir, "worker");
 	try {
 		await prepareWorkerDeployment(workerRoot, {
+			accountId,
 			d1DatabaseId,
 			d1DatabaseName,
 			r2BucketName
@@ -11480,16 +11484,19 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 		});
 		await wrangler("d1", "migrations", "apply", d1DatabaseName, "--remote");
 		await wrangler("deploy", "--name", workerName);
-		const secretCommand = createWrangler({
+		const secretWrangler = createWrangler({
 			stdio: "pipe",
 			cloudflareApiToken: apiToken,
 			cwd: workerRoot,
 			accountId,
 			nonInteractive
-		})("secret", "put", "STORAGE_DOWNLOAD_URL_SIGNING_KEY", "--name", workerName);
-		if (!secretCommand.stdin) throw new Error("Failed to open Wrangler secret input.");
-		secretCommand.stdin.end(crypto.default.randomBytes(32).toString("hex"));
-		await secretCommand;
+		});
+		for (const [name, value] of [["R2_ACCESS_KEY_ID", r2Credentials.accessKeyId], ["R2_SECRET_ACCESS_KEY", r2Credentials.secretAccessKey]]) {
+			const secretCommand = secretWrangler("secret", "put", name, "--name", workerName);
+			if (!secretCommand.stdin) throw new Error("Failed to open Wrangler secret input.");
+			secretCommand.stdin.end(value);
+			await secretCommand;
+		}
 		return workerName;
 	} catch (error) {
 		if (error instanceof Error) throw toCloudflareDeploymentError(error, credentialSource);
@@ -11821,6 +11828,10 @@ const runInit = async ({ build, envFile }) => {
 		d1DatabaseName,
 		nonInteractive,
 		r2BucketName: selectedBucketName,
+		r2Credentials: {
+			accessKeyId,
+			secretAccessKey
+		},
 		workerName
 	});
 	const database = d1Database({

package/dist/init/index.mjs

@@ -1,12 +1,9 @@
 import { createRequire } from "node:module";
-import crypto from "crypto";
 import path from "path";
 import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import Cloudflare$1, { Cloudflare } from "cloudflare";
 import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createTableStatements, generateEngineSql } from "@hot-updater/plugin-core";
-import { apiKeys } from "@hot-updater/server/plugins/api-keys";
-import { insights } from "@hot-updater/server/plugins/insights";
-import { remoteConfig } from "@hot-updater/server/plugins/remote-config";
+import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -11421,20 +11418,24 @@ const getConfigScaffold = (build) => {
   })`
 	}).setPlugins({
 		imports: [{
-			pkg: "@hot-updater/cloudflare",
-			named: ["plugins"]
+			pkg: "hot-updater/plugins",
+			named: [
+				"apiKeys",
+				"insights",
+				"remoteConfig"
+			]
 		}],
-		configString: "plugins"
+		configString: "[apiKeys(), insights(), remoteConfig()]"
 	}));
 };
 //#endregion
 //#region iac/managedWorker.ts
 /**
 * Readies the staged prebuilt Worker for Wrangler as init deploys it: its
-* bindings to the D1 database and R2 bucket, and the bucket's name, which
-* the Worker reads from its vars.
+* bindings to the D1 database and R2 bucket, and the bucket's name and the
+* account's ID, which the Worker reads from its vars to presign R2 URLs.
 */
-const prepareWorkerDeployment = async (workerRoot, { d1DatabaseId, d1DatabaseName, r2BucketName }) => {
+const prepareWorkerDeployment = async (workerRoot, { accountId, d1DatabaseId, d1DatabaseName, r2BucketName }) => {
 	const configPath = path.join(workerRoot, "wrangler.json");
 	const config = JSON.parse(await fs$1.readFile(configPath, "utf-8"));
 	config.d1_databases = [{
@@ -11446,12 +11447,15 @@ const prepareWorkerDeployment = async (workerRoot, { d1DatabaseId, d1DatabaseNam
 		binding: "BUCKET",
 		bucket_name: r2BucketName
 	}];
-	config.vars = { BUCKET_NAME: r2BucketName };
+	config.vars = {
+		ACCOUNT_ID: accountId,
+		BUCKET_NAME: r2BucketName
+	};
 	await fs$1.writeFile(configPath, JSON.stringify(config, null, 2));
 };
 //#endregion
 //#region iac/index.ts
-const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseId, d1DatabaseName, nonInteractive, r2BucketName, workerName }) => {
+const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseId, d1DatabaseName, nonInteractive, r2BucketName, r2Credentials, workerName }) => {
 	const cwd = getCwd();
 	const cloudflarePackagePath = __require.resolve("@hot-updater/cloudflare/package.json", { paths: [cwd] });
 	const cloudflarePackageRoot = path.dirname(cloudflarePackagePath);
@@ -11459,6 +11463,7 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 	const workerRoot = path.join(tmpDir, "worker");
 	try {
 		await prepareWorkerDeployment(workerRoot, {
+			accountId,
 			d1DatabaseId,
 			d1DatabaseName,
 			r2BucketName
@@ -11472,16 +11477,19 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 		});
 		await wrangler("d1", "migrations", "apply", d1DatabaseName, "--remote");
 		await wrangler("deploy", "--name", workerName);
-		const secretCommand = createWrangler({
+		const secretWrangler = createWrangler({
 			stdio: "pipe",
 			cloudflareApiToken: apiToken,
 			cwd: workerRoot,
 			accountId,
 			nonInteractive
-		})("secret", "put", "STORAGE_DOWNLOAD_URL_SIGNING_KEY", "--name", workerName);
-		if (!secretCommand.stdin) throw new Error("Failed to open Wrangler secret input.");
-		secretCommand.stdin.end(crypto.randomBytes(32).toString("hex"));
-		await secretCommand;
+		});
+		for (const [name, value] of [["R2_ACCESS_KEY_ID", r2Credentials.accessKeyId], ["R2_SECRET_ACCESS_KEY", r2Credentials.secretAccessKey]]) {
+			const secretCommand = secretWrangler("secret", "put", name, "--name", workerName);
+			if (!secretCommand.stdin) throw new Error("Failed to open Wrangler secret input.");
+			secretCommand.stdin.end(value);
+			await secretCommand;
+		}
 		return workerName;
 	} catch (error) {
 		if (error instanceof Error) throw toCloudflareDeploymentError(error, credentialSource);
@@ -11813,6 +11821,10 @@ const runInit = async ({ build, envFile }) => {
 		d1DatabaseName,
 		nonInteractive,
 		r2BucketName: selectedBucketName,
+		r2Credentials: {
+			accessKeyId,
+			secretAccessKey
+		},
 		workerName
 	});
 	const database = d1Database({

package/dist/worker/index.cjs

@@ -1,8 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
-let _hot_updater_server_plugins_api_keys = require("@hot-updater/server/plugins/api-keys");
-let _hot_updater_server_plugins_insights = require("@hot-updater/server/plugins/insights");
-let _hot_updater_server_plugins_remote_config = require("@hot-updater/server/plugins/remote-config");
+let _hot_updater_server_plugins = require("@hot-updater/server/plugins");
 //#region src/d1Executor.ts
 var D1ExecutionError = class extends Error {
 	name = "D1ExecutionError";
@@ -68,15 +66,75 @@ const d1Database = (database) => createD1Database({
 * client route, and Remote Config. Its Worker imports this list.
 */
 const plugins = [
-	(0, _hot_updater_server_plugins_insights.insights)(),
-	(0, _hot_updater_server_plugins_api_keys.apiKeys)(),
-	(0, _hot_updater_server_plugins_remote_config.remoteConfig)()
+	(0, _hot_updater_server_plugins.insights)(),
+	(0, _hot_updater_server_plugins.apiKeys)(),
+	(0, _hot_updater_server_plugins.remoteConfig)()
 ];
 //#endregion
+//#region src/presignR2Url.ts
+const encoder = new TextEncoder();
+const hex = (bytes) => Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+const hmac = async (key, value) => crypto.subtle.sign("HMAC", await crypto.subtle.importKey("raw", key, {
+	hash: "SHA-256",
+	name: "HMAC"
+}, false, ["sign"]), encoder.encode(value));
+/** RFC 3986 encoding, which S3 signs keys and query values in. */
+const encodeRfc3986 = (value) => encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+/**
+* A presigned GET URL for an object on R2's S3-compatible API: AWS Signature
+* Version 4 on Web Crypto, in the form `getSignedUrl` from
+* `@aws-sdk/s3-request-presigner` signs, so a Worker presigns without the
+* AWS SDK.
+*/
+const presignR2GetUrl = async ({ accountId, bucketName, credentials, expiresInSeconds, key, signingDate = /* @__PURE__ */ new Date() }) => {
+	const host = `${accountId}.r2.cloudflarestorage.com`;
+	const path = `/${bucketName}/${key.split("/").map(encodeRfc3986).join("/")}`;
+	const amzDate = signingDate.toISOString().replace(/[-:]|\.\d{3}/g, "");
+	const scope = `${amzDate.slice(0, 8)}/auto/s3/aws4_request`;
+	const query = [
+		["X-Amz-Algorithm", "AWS4-HMAC-SHA256"],
+		["X-Amz-Content-Sha256", "UNSIGNED-PAYLOAD"],
+		["X-Amz-Credential", `${credentials.accessKeyId}/${scope}`],
+		["X-Amz-Date", amzDate],
+		["X-Amz-Expires", String(expiresInSeconds)],
+		["X-Amz-SignedHeaders", "host"],
+		["x-id", "GetObject"]
+	];
+	const queryString = (entries) => entries.map(([name, value]) => `${encodeRfc3986(name)}=${encodeRfc3986(value)}`).join("&");
+	const canonicalRequest = [
+		"GET",
+		path,
+		queryString(query),
+		`host:${host}\n`,
+		"host",
+		"UNSIGNED-PAYLOAD"
+	].join("\n");
+	const stringToSign = [
+		"AWS4-HMAC-SHA256",
+		amzDate,
+		scope,
+		hex(await crypto.subtle.digest("SHA-256", encoder.encode(canonicalRequest)))
+	].join("\n");
+	let signingKey = encoder.encode(`AWS4${credentials.secretAccessKey}`).buffer;
+	for (const part of [
+		amzDate.slice(0, 8),
+		"auto",
+		"s3",
+		"aws4_request"
+	]) signingKey = await hmac(signingKey, part);
+	const signature = hex(await hmac(signingKey, stringToSign));
+	return `https://${host}${path}?${queryString([
+		...query.slice(0, 5),
+		["X-Amz-Signature", signature],
+		...query.slice(5)
+	])}`;
+};
+//#endregion
 //#region src/r2WorkerStorage.ts
-const r2WorkerStorage = (config) => {
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
+function r2WorkerStorage(config) {
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
-	const getDownloadUrl = (0, _hot_updater_plugin_core.createStorageDownloadUrl)(config.downloadUrlSigningKey);
 	const parseAndValidate = (storageUri) => {
 		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "r2");
 		if (parsed.bucket !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${parsed.bucket}".`);
@@ -114,10 +172,16 @@ const r2WorkerStorage = (config) => {
 			headers.set("content-length", String(object.size));
 			return { response: new Response(object.body, { headers }) };
 		},
-		async getDownloadUrl({ storageUri }) {
-			parseAndValidate(storageUri);
-			return getDownloadUrl({ storageUri });
-		},
+		...config.credentials === void 0 ? {} : { async getDownloadUrl({ storageUri }) {
+			const { key } = parseAndValidate(storageUri);
+			return { url: await presignR2GetUrl({
+				accountId: config.accountId,
+				bucketName: config.bucketName,
+				credentials: config.credentials,
+				expiresInSeconds: PRESIGNED_URL_EXPIRES_IN_SECONDS,
+				key
+			}) };
+		} },
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			return { exists: await config.bucket.head(key) !== null };
@@ -128,7 +192,7 @@ const r2WorkerStorage = (config) => {
 			return { deleted: true };
 		}
 	});
-};
+}
 //#endregion
 exports.d1Database = d1Database;
 exports.plugins = plugins;

package/dist/worker/index.d.cts

@@ -1037,13 +1037,40 @@ declare const plugins: readonly [import("@hot-updater/plugin-core").HotUpdaterPl
   endpoints: readonly import("@hot-updater/plugin-core").PluginEndpoint[];
 }, {}>];
 //#endregion
+//#region src/presignR2Url.d.ts
+/** R2's S3-compatible credentials. */
+interface R2Credentials {
+  readonly accessKeyId: string;
+  readonly secretAccessKey: string;
+}
+//#endregion
 //#region src/r2WorkerStorage.d.ts
-interface CloudflareWorkerStorageConfig {
+type CloudflareWorkerStorageConfig = {
   readonly bucket: R2Bucket;
   readonly bucketName: string;
   readonly basePath?: string;
-  readonly downloadUrlSigningKey: string;
-}
-declare const r2WorkerStorage: (config: CloudflareWorkerStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+} & ({
+  /** The account whose R2 endpoint download URLs name. */
+  readonly accountId: string;
+  /**
+   * R2's S3-compatible credentials, which presign download URLs, as
+   * `r2Storage` from `@hot-updater/cloudflare` does: what a server needs
+   * to serve downloads.
+   */
+  readonly credentials: R2Credentials;
+} | {
+  readonly accountId?: undefined;
+  readonly credentials?: undefined;
+});
+/**
+ * Storage on the Worker's R2 binding. With R2's S3-compatible credentials,
+ * its download URLs are presigned and devices download from the bucket;
+ * without them, it has no `getDownloadUrl`, as a Console that only reads
+ * needs.
+ */
+declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig & {
+  readonly credentials: R2Credentials;
+}): StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig): StorageAdapterWith<"put" | "get" | "exists" | "delete">;
 //#endregion
 export { type CloudflareWorkerStorageConfig, type D1Like, d1Database, plugins, r2WorkerStorage as r2Storage };

package/dist/worker/index.d.mts

@@ -1037,13 +1037,40 @@ declare const plugins: readonly [import("@hot-updater/plugin-core").HotUpdaterPl
   endpoints: readonly import("@hot-updater/plugin-core").PluginEndpoint[];
 }, {}>];
 //#endregion
+//#region src/presignR2Url.d.ts
+/** R2's S3-compatible credentials. */
+interface R2Credentials {
+  readonly accessKeyId: string;
+  readonly secretAccessKey: string;
+}
+//#endregion
 //#region src/r2WorkerStorage.d.ts
-interface CloudflareWorkerStorageConfig {
+type CloudflareWorkerStorageConfig = {
   readonly bucket: R2Bucket;
   readonly bucketName: string;
   readonly basePath?: string;
-  readonly downloadUrlSigningKey: string;
-}
-declare const r2WorkerStorage: (config: CloudflareWorkerStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+} & ({
+  /** The account whose R2 endpoint download URLs name. */
+  readonly accountId: string;
+  /**
+   * R2's S3-compatible credentials, which presign download URLs, as
+   * `r2Storage` from `@hot-updater/cloudflare` does: what a server needs
+   * to serve downloads.
+   */
+  readonly credentials: R2Credentials;
+} | {
+  readonly accountId?: undefined;
+  readonly credentials?: undefined;
+});
+/**
+ * Storage on the Worker's R2 binding. With R2's S3-compatible credentials,
+ * its download URLs are presigned and devices download from the bucket;
+ * without them, it has no `getDownloadUrl`, as a Console that only reads
+ * needs.
+ */
+declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig & {
+  readonly credentials: R2Credentials;
+}): StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig): StorageAdapterWith<"put" | "get" | "exists" | "delete">;
 //#endregion
 export { type CloudflareWorkerStorageConfig, type D1Like, d1Database, plugins, r2WorkerStorage as r2Storage };