@hot-updater/cloudflare 1.0.0-rc.5 → 1.0.0

package/src/d1Schema.ts

@@ -0,0 +1,26 @@
+import {
+  coreTarget,
+  createTableStatements,
+  WRITE_GUARD_TABLE,
+  generateEngineSql,
+  type ToolingTarget,
+} from "@hot-updater/plugin-core";
+
+/**
+ * D1's schema: the guard table batch writes need, then the shared SQL
+ * schema of core and the target's plugins, settings last. Every statement can
+ * run again, so a migration for a server's plugin tables repeats core's.
+ */
+export const d1SchemaStatements = ({
+  schema,
+  settings,
+}: ToolingTarget = coreTarget): string[] => [
+  ...createTableStatements("sqlite", [WRITE_GUARD_TABLE]),
+  ...generateEngineSql("sqlite", schema, settings),
+];
+
+/** The schema as a D1 migration, which `wrangler d1 migrations apply` runs. */
+export const d1SchemaSql = (target?: ToolingTarget): string =>
+  `-- HotUpdater.schema\n\n${d1SchemaStatements(target)
+    .map((statement) => `${statement};`)
+    .join("\n\n")}\n`;

package/src/presignR2Url.ts

@@ -0,0 +1,103 @@
+const encoder = new TextEncoder();
+
+const hex = (bytes: ArrayBuffer) =>
+  Array.from(new Uint8Array(bytes), (byte) =>
+    byte.toString(16).padStart(2, "0"),
+  ).join("");
+
+const hmac = async (key: BufferSource, value: string) =>
+  crypto.subtle.sign(
+    "HMAC",
+    await crypto.subtle.importKey(
+      "raw",
+      key,
+      { hash: "SHA-256", name: "HMAC" },
+      false,
+      ["sign"],
+    ),
+    encoder.encode(value),
+  );
+
+/** RFC 3986 encoding, which S3 signs keys and query values in. */
+const encodeRfc3986 = (value: string) =>
+  encodeURIComponent(value).replace(
+    /[!'()*]/g,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+
+/** R2's S3-compatible credentials. */
+export interface R2Credentials {
+  readonly accessKeyId: string;
+  readonly secretAccessKey: string;
+}
+
+/**
+ * A presigned GET URL for an object on R2's S3-compatible API: AWS Signature
+ * Version 4 on Web Crypto, in the form `getSignedUrl` from
+ * `@aws-sdk/s3-request-presigner` signs, so a Worker presigns without the
+ * AWS SDK.
+ */
+export const presignR2GetUrl = async ({
+  accountId,
+  bucketName,
+  credentials,
+  expiresInSeconds,
+  key,
+  signingDate = new Date(),
+}: {
+  readonly accountId: string;
+  readonly bucketName: string;
+  readonly credentials: R2Credentials;
+  readonly expiresInSeconds: number;
+  /** The object's key, unencoded. */
+  readonly key: string;
+  readonly signingDate?: Date;
+}): Promise<string> => {
+  const host = `${accountId}.r2.cloudflarestorage.com`;
+  const path = `/${bucketName}/${key.split("/").map(encodeRfc3986).join("/")}`;
+  const amzDate = signingDate.toISOString().replace(/[-:]|\.\d{3}/g, "");
+  const scope = `${amzDate.slice(0, 8)}/auto/s3/aws4_request`;
+  // Sorted by name, as the canonical request orders them.
+  const query: [string, string][] = [
+    ["X-Amz-Algorithm", "AWS4-HMAC-SHA256"],
+    ["X-Amz-Content-Sha256", "UNSIGNED-PAYLOAD"],
+    ["X-Amz-Credential", `${credentials.accessKeyId}/${scope}`],
+    ["X-Amz-Date", amzDate],
+    ["X-Amz-Expires", String(expiresInSeconds)],
+    ["X-Amz-SignedHeaders", "host"],
+    ["x-id", "GetObject"],
+  ];
+  const queryString = (entries: [string, string][]) =>
+    entries
+      .map(([name, value]) => `${encodeRfc3986(name)}=${encodeRfc3986(value)}`)
+      .join("&");
+  const canonicalRequest = [
+    "GET",
+    path,
+    queryString(query),
+    `host:${host}\n`,
+    "host",
+    "UNSIGNED-PAYLOAD",
+  ].join("\n");
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    hex(
+      await crypto.subtle.digest("SHA-256", encoder.encode(canonicalRequest)),
+    ),
+  ].join("\n");
+  let signingKey: ArrayBuffer = encoder.encode(
+    `AWS4${credentials.secretAccessKey}`,
+  ).buffer as ArrayBuffer;
+  for (const part of [amzDate.slice(0, 8), "auto", "s3", "aws4_request"]) {
+    signingKey = await hmac(signingKey, part);
+  }
+  const signature = hex(await hmac(signingKey, stringToSign));
+  const signed: [string, string][] = [
+    ...query.slice(0, 5),
+    ["X-Amz-Signature", signature],
+    ...query.slice(5),
+  ];
+  return `https://${host}${path}?${queryString(signed)}`;
+};

package/src/r2S3Storage.ts

@@ -6,13 +6,13 @@ import {
   type S3ClientConfig,
 } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import {
   createStorageKeyBuilder,
-  createStorageDownloadUrl,
-  createStoragePlugin,
+  createStorageAdapter,
   createStorageUri,
   parseStorageUri,
-  type StoragePluginWith,
+  type StorageAdapterWith,
 } from "@hot-updater/plugin-core";
 
 export interface R2S3StorageConfig extends S3ClientConfig {
@@ -21,10 +21,11 @@ export interface R2S3StorageConfig extends S3ClientConfig {
   credentials: NonNullable<S3ClientConfig["credentials"]>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
-  /** Required when this storage serves downloads through createHotUpdater. */
-  downloadUrlSigningKey?: string;
 }
 
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
+
 const isObjectNotFoundError = (error: unknown) => {
   if (
     error instanceof Error &&
@@ -43,12 +44,13 @@ const isObjectNotFoundError = (error: unknown) => {
 
 export const createR2S3Storage = (
   config: R2S3StorageConfig,
-): StoragePluginWith<"put" | "get" | "exists" | "delete"> => {
+): StorageAdapterWith<
+  "put" | "get" | "getDownloadUrl" | "exists" | "delete"
+> => {
   const {
     accountId,
     basePath,
     bucketName,
-    downloadUrlSigningKey,
     endpoint,
     forcePathStyle,
     region,
@@ -61,9 +63,6 @@ export const createR2S3Storage = (
     region: region ?? "auto",
   });
   const getStorageKey = createStorageKeyBuilder(basePath);
-  const getDownloadUrl = downloadUrlSigningKey
-    ? createStorageDownloadUrl(downloadUrlSigningKey)
-    : undefined;
 
   const parseAndValidate = (storageUri: string) => {
     const parsed = parseStorageUri(storageUri, "r2");
@@ -75,7 +74,7 @@ export const createR2S3Storage = (
     return parsed;
   };
 
-  return createStoragePlugin({
+  return createStorageAdapter({
     name: "r2Storage",
     protocol: "r2",
     async put({ key, body, contentLength, contentType }) {
@@ -122,14 +121,16 @@ export const createR2S3Storage = (
         throw error;
       }
     },
-    ...(getDownloadUrl
-      ? {
-          async getDownloadUrl({ storageUri }: { storageUri: string }) {
-            parseAndValidate(storageUri);
-            return getDownloadUrl({ storageUri });
-          },
-        }
-      : {}),
+    async getDownloadUrl({ storageUri }) {
+      const { key } = parseAndValidate(storageUri);
+      return {
+        url: await getSignedUrl(
+          client,
+          new GetObjectCommand({ Bucket: bucketName, Key: key }),
+          { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS },
+        ),
+      };
+    },
     async exists({ storageUri }) {
       const { key } = parseAndValidate(storageUri);
       try {

package/src/r2Storage.ts

@@ -1,4 +1,4 @@
-import type { StoragePluginWith } from "@hot-updater/plugin-core";
+import type { StorageAdapterWith } from "@hot-updater/plugin-core";
 
 import { createR2S3Storage, type R2S3StorageConfig } from "./r2S3Storage";
 
@@ -7,10 +7,12 @@ export type { R2S3StorageConfig };
 
 export const r2Storage = (
   config: R2S3StorageConfig,
-): StoragePluginWith<"put" | "get" | "exists" | "delete"> => {
+): StorageAdapterWith<
+  "put" | "get" | "getDownloadUrl" | "exists" | "delete"
+> => {
   if (!config.credentials) {
     throw new Error(
-      "r2Storage requires S3-compatible credentials. The Wrangler fallback was removed.",
+      "r2Storage requires S3-compatible credentials: pass credentials with an R2 access key ID and secret access key.",
     );
   }
 

package/src/r2WorkerStorage.ts

@@ -1,26 +1,52 @@
 import {
   createStorageKeyBuilder,
-  createStorageDownloadUrl,
-  createStoragePlugin,
+  createStorageAdapter,
   createStorageUri,
   parseStorageUri,
-  type StoragePluginWith,
+  type StorageAdapterWith,
 } from "@hot-updater/plugin-core";
 
-export interface CloudflareWorkerStorageConfig {
+import { presignR2GetUrl, type R2Credentials } from "./presignR2Url";
+
+export type CloudflareWorkerStorageConfig = {
   readonly bucket: R2Bucket;
   readonly bucketName: string;
   readonly basePath?: string;
-  readonly downloadUrlSigningKey: string;
-}
+} & (
+  | {
+      /** The account whose R2 endpoint download URLs name. */
+      readonly accountId: string;
+      /**
+       * R2's S3-compatible credentials, which presign download URLs, as
+       * `r2Storage` from `@hot-updater/cloudflare` does: what a server needs
+       * to serve downloads.
+       */
+      readonly credentials: R2Credentials;
+    }
+  | { readonly accountId?: undefined; readonly credentials?: undefined }
+);
+
+/** Devices download right after the update check that returns the URL. */
+const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 
-export const r2WorkerStorage = (
+/**
+ * Storage on the Worker's R2 binding. With R2's S3-compatible credentials,
+ * its download URLs are presigned and devices download from the bucket;
+ * without them, it has no `getDownloadUrl`, as a Console that only reads
+ * needs.
+ */
+export function r2WorkerStorage(
+  config: CloudflareWorkerStorageConfig & {
+    readonly credentials: R2Credentials;
+  },
+): StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+export function r2WorkerStorage(
   config: CloudflareWorkerStorageConfig,
-): StoragePluginWith<
-  "put" | "get" | "getDownloadUrl" | "exists" | "delete"
-> => {
+): StorageAdapterWith<"put" | "get" | "exists" | "delete">;
+export function r2WorkerStorage(
+  config: CloudflareWorkerStorageConfig,
+): StorageAdapterWith<"put" | "get" | "exists" | "delete"> {
   const getStorageKey = createStorageKeyBuilder(config.basePath);
-  const getDownloadUrl = createStorageDownloadUrl(config.downloadUrlSigningKey);
 
   const parseAndValidate = (storageUri: string) => {
     const parsed = parseStorageUri(storageUri, "r2");
@@ -32,7 +58,7 @@ export const r2WorkerStorage = (
     return parsed;
   };
 
-  return createStoragePlugin({
+  return createStorageAdapter({
     name: "r2Storage",
     protocol: "r2",
     async put({ key, body, contentLength, contentType }) {
@@ -77,10 +103,22 @@ export const r2WorkerStorage = (
       headers.set("content-length", String(object.size));
       return { response: new Response(object.body, { headers }) };
     },
-    async getDownloadUrl({ storageUri }) {
-      parseAndValidate(storageUri);
-      return getDownloadUrl({ storageUri });
-    },
+    ...(config.credentials === undefined
+      ? {}
+      : {
+          async getDownloadUrl({ storageUri }: { storageUri: string }) {
+            const { key } = parseAndValidate(storageUri);
+            return {
+              url: await presignR2GetUrl({
+                accountId: config.accountId,
+                bucketName: config.bucketName,
+                credentials: config.credentials,
+                expiresInSeconds: PRESIGNED_URL_EXPIRES_IN_SECONDS,
+                key,
+              }),
+            };
+          },
+        }),
     async exists({ storageUri }) {
       const { key } = parseAndValidate(storageUri);
       return { exists: (await config.bucket.head(key)) !== null };
@@ -91,4 +129,4 @@ export const r2WorkerStorage = (
       return { deleted: true };
     },
   });
-};
+}

package/src/worker/d1Database.ts

@@ -1,15 +1,14 @@
-import { createDatabasePlugin } from "@hot-updater/plugin-core";
-import { createDatabasePluginAdapter } from "@hot-updater/plugin-core/internal";
+import type { EngineDatabase } from "@hot-updater/plugin-core";
 
-import { createD1Implementation, D1ExecutionError } from "../d1Implementation";
-
-type D1Result = {
-  readonly results?: readonly unknown[];
-  readonly success?: boolean;
-};
+import {
+  createD1Database,
+  D1ExecutionError,
+  type D1ResultLike,
+  toSqlResult,
+} from "../d1Executor";
 
 type D1BoundStatement = {
-  all: () => Promise<D1Result>;
+  all: () => Promise<D1ResultLike>;
 };
 
 type D1PreparedStatement = {
@@ -18,43 +17,26 @@ type D1PreparedStatement = {
 
 export type D1Like = {
   prepare(sql: string): D1PreparedStatement;
-  batch(statements: D1BoundStatement[]): Promise<readonly D1Result[]>;
+  batch(statements: D1BoundStatement[]): Promise<readonly D1ResultLike[]>;
 };
 
-export interface CloudflareWorkerDatabaseEnv {
-  readonly DB: D1Like;
-}
-
-export const d1Database = (database: D1Like) => {
-  const implementation = createD1Implementation({
-    async query(sql, params) {
-      const result = await database
-        .prepare(sql)
-        .bind(...params)
-        .all();
-      if (result.success === false) throw new D1ExecutionError();
-      return result.results ?? [];
-    },
+/** Hot Updater's database on a D1 binding, inside a Worker. */
+export const d1Database = (database: D1Like): EngineDatabase =>
+  createD1Database({
+    query: async ({ sql, params }) =>
+      toSqlResult(
+        await database
+          .prepare(sql)
+          .bind(...params)
+          .all(),
+      ),
     async batch(statements) {
       const results = await database.batch(
         statements.map(({ sql, params }) =>
           database.prepare(sql).bind(...params),
         ),
       );
-      if (
-        results.length !== statements.length ||
-        results.some(({ success }) => success === false)
-      ) {
-        throw new D1ExecutionError();
-      }
-      return results.map(({ results }) => results ?? []);
+      if (results.length !== statements.length) throw new D1ExecutionError();
+      return results.map(toSqlResult);
     },
   });
-  const adapter = createDatabasePluginAdapter("d1Database", implementation);
-  return createDatabasePlugin({
-    name: "d1Database",
-    models: adapter.models,
-    commit: adapter.commit,
-    ...(adapter.dispose ? { dispose: adapter.dispose } : {}),
-  });
-};

package/worker/dist/README.md

@@ -1 +1 @@
-This folder contains the built output assets for the worker "hot-updater" generated at 2026-09-08T01:48:53.178Z.
+This folder contains the built output assets for the worker "hot-updater" generated at 2026-10-11T01:49:38.431Z.