@hot-updater/firebase 1.0.5 → 1.0.7

package/dist/firebase/functions/index.cjs

@@ -4525,7 +4525,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.0.5";
+const HOT_UPDATER_SERVER_VERSION = "1.0.7";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**
@@ -4816,6 +4816,11 @@ async function resolveAssets(plan, resolveFileUrl) {
 	const resolvedEntries = entries.filter((entry) => entry !== null);
 	return { assets: Object.fromEntries(resolvedEntries.map((entry) => entry.asset)) };
 }
+/**
+* Legacy: artifact protocol v1. Signs a URL for every file of the target, which grows with the
+* Bundle's file count; apps whose SDK predates protocol v2 still ask for it.
+* Remove with the `/artifacts/v1` route once no supported app uses it.
+*/
 async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
 	const manifestStorageUri = targetBundle ? getManifestStorageUri(targetBundle) : null;
 	const manifestFileHash = targetBundle ? getManifestFileHash(targetBundle) : null;
@@ -4849,6 +4854,98 @@ async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readSto
 		...archiveUrl ? { archiveUrl } : {}
 	};
 }
+/** The target's manifest and its plan, or null for a Bundle without one. */
+async function loadTargetPlan({ currentBundle, readStorageText, targetBundle }) {
+	const manifestStorageUri = getManifestStorageUri(targetBundle);
+	const manifestFileHash = getManifestFileHash(targetBundle);
+	const assetBaseStorageUri = getAssetBaseStorageUri(targetBundle);
+	if (!manifestStorageUri || !manifestFileHash || !assetBaseStorageUri) return null;
+	const targetManifest = await fetchBundleManifest(manifestStorageUri, readStorageText);
+	if (!targetManifest) return null;
+	return {
+		manifestFileHash,
+		manifestStorageUri,
+		plan: createManifestArtifactPlan({
+			assetBaseStorageUri,
+			currentBundle,
+			targetBundle,
+			targetManifest
+		}),
+		targetManifest
+	};
+}
+/**
+* Artifact protocol v2: the manifest, the archive, and the one Hermes patch,
+* but no URL per file. A device asks {@link resolveManifestArtifactFiles}
+* for the files it downloads one by one, so signing and the response stay
+* the same size however many files the Bundle has.
+*/
+async function resolveManifestArtifactsV2({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
+	const target = await loadTargetPlan({
+		currentBundle,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const manifestUrl = await resolveFileUrl(target.manifestStorageUri);
+	if (!manifestUrl) return null;
+	const patched = target.plan.assets.find((asset) => asset.patch !== null);
+	let patch;
+	if (patched?.patch && !(patched.file.byteSize !== null && patched.patch.byteSize !== null && patched.patch.byteSize >= patched.file.byteSize)) try {
+		const patchUrl = await resolveFileUrl(patched.patch.storageUri);
+		if (patchUrl) patch = {
+			algorithm: "bsdiff",
+			assetPath: patched.assetPath,
+			baseBundleId: patched.patch.baseBundleId,
+			baseFileHash: patched.patch.baseFileHash,
+			patchFileHash: patched.patch.patchFileHash,
+			patchUrl,
+			...patched.patch.byteSize === null ? {} : { byteSize: patched.patch.byteSize }
+		};
+	} catch {}
+	let archiveUrl = null;
+	const archive = target.targetManifest.archive;
+	if (archive && isContentAddressedAssetFileHash(archive.downloadFileHash) && (asByteSize(archive.downloadByteSize) ?? 0) > 0 && (asByteSize(archive.tarByteSize) ?? 0) > 0) try {
+		archiveUrl = await resolveFileUrl(getBundleArchiveStorageUri({
+			manifestStorageUri: target.manifestStorageUri,
+			bundleId: targetBundle.id
+		}));
+	} catch {}
+	return {
+		artifactProtocolVersion: 2,
+		manifestFileHash: target.manifestFileHash,
+		manifestUrl,
+		...archiveUrl ? { archiveUrl } : {},
+		...patch ? { patch } : {}
+	};
+}
+/**
+* Download URLs for the files a device downloads one by one. Only paths the
+* target's manifest names are signed, at most
+* {@link ARTIFACT_FILES_REQUEST_LIMIT}; null when any path is unknown or a
+* URL cannot be resolved.
+*/
+async function resolveManifestArtifactFiles({ paths, resolveFileUrl, readStorageText, targetBundle }) {
+	if (paths.length === 0 || paths.length > 100 || new Set(paths).size !== paths.length) return null;
+	const target = await loadTargetPlan({
+		currentBundle: null,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const planned = new Map(target.plan.assets.map((asset) => [asset.assetPath, asset]));
+	const requested = paths.map((path) => planned.get(path));
+	if (requested.some((asset) => asset === void 0)) return null;
+	const files = await Promise.all(requested.map(async (asset) => {
+		const url = await resolveFileUrl(asset.file.storageUri);
+		if (!url) return null;
+		const file = { url };
+		if (asset.file.compression) file.compression = asset.file.compression;
+		return [asset.assetPath, file];
+	}));
+	if (files.some((file) => file === null)) return null;
+	return { files: Object.fromEntries(files.filter((file) => file !== null)) };
+}
 //#endregion
 //#region ../../node_modules/.pnpm/verkit@0.4.0/node_modules/verkit/dist/comparison-DenM3wCn.js
 const LETTER_DASH_NUMBER = "[a-zA-Z0-9-]";
@@ -5322,20 +5419,34 @@ const createCoreReads = (db, storage) => {
 			return projectReleaseCatalogRow(row === null ? null : toCatalogRow(row), input, scopeKey);
 		},
 		/** Artifact resolution: one batch read of both bundles and one unique read of their patch. */
-		async getArtifactInfo(targetBundleId, currentBundleId, artifactProtocolVersion) {
+		getArtifactInfo: (async (targetBundleId, currentBundleId, artifactProtocolVersion) => {
 			const { readStorageText } = storage;
-			if (artifactProtocolVersion !== 1 || readStorageText === void 0) return null;
+			if (artifactProtocolVersion !== 1 && artifactProtocolVersion !== 2 || readStorageText === void 0) return null;
 			const withCurrent = currentBundleId !== NIL_UUID;
 			const [[target, current], patch] = await Promise.all([db.findByKeys("bundles", withCurrent ? [{ id: targetBundleId }, { id: currentBundleId }] : [{ id: targetBundleId }]), withCurrent ? db.findOne("bundle_patches", {
 				bundle_id: targetBundleId,
 				base_bundle_id: currentBundleId
 			}) : null]);
 			if (target === null || target === void 0) return null;
-			return resolveManifestArtifacts({
+			const input = {
 				currentBundle: current ? rowToBundle(toBundleRow(current)) : null,
 				readStorageText,
 				resolveFileUrl: storage.resolveFileUrl,
 				targetBundle: rowToBundle(toBundleRow(target), patch === null ? [] : [toPatchRow(patch)])
+			};
+			return artifactProtocolVersion === 2 ? resolveManifestArtifactsV2(input) : resolveManifestArtifacts(input);
+		}),
+		/** A Bundle's file URLs: one point read of the bundle and its manifest. */
+		async getArtifactFiles(bundleId, paths) {
+			const { readStorageText } = storage;
+			if (readStorageText === void 0) return null;
+			const row = await db.findOne("bundles", { id: bundleId });
+			if (row === null) return null;
+			return resolveManifestArtifactFiles({
+				paths,
+				readStorageText,
+				resolveFileUrl: storage.resolveFileUrl,
+				targetBundle: rowToBundle(toBundleRow(row))
 			});
 		},
 		/** A bundle, its patches, and how many patches start from it. */
@@ -6684,6 +6795,7 @@ const ADMIN_ROUTES = [
 //#region ../../packages/server/dist/handlerReleaseCatalogRoutes.mjs
 const CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
 const ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
+const ARTIFACT_V2_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=2";
 const ORIGIN_CACHE_TTL_MS = 5e3;
 const ORIGIN_CACHE_MAX_ENTRIES = 128;
 /** Marks the 404 of a scope that has no catalog. */
@@ -6706,6 +6818,18 @@ const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
 * `Cache-Control`.
 */
 const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
+/** The paths of an artifact files request, or null when malformed. */
+const readArtifactFilePaths = async (request) => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return null;
+	}
+	const paths = body?.paths;
+	if (!Array.isArray(paths) || paths.length === 0 || paths.length > 100 || !paths.every((path) => typeof path === "string" && path.length > 0) || new Set(paths).size !== paths.length) return null;
+	return paths;
+};
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
@@ -6826,6 +6950,30 @@ const createReleaseCatalogRouteHandlers = () => {
 			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
+		artifactV2: async (params, _request, { core }) => {
+			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 2);
+			if (info === null) return privateNotFound();
+			return new Response(JSON.stringify(info), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
+		artifactFilesV2: async (params, request, { core }) => {
+			const paths = await readArtifactFilePaths(request);
+			if (paths === null) return badRequest(`paths must be 1 to 100 unique strings`);
+			const files = await core.getArtifactFiles(requireRouteParam(params, "targetBundleId"), paths);
+			if (files === null) return privateNotFound();
+			return new Response(JSON.stringify(files), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
 		artifactV1: async (params, _request, { core }) => {
 			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 1);
 			if (info === null) return privateNotFound();
@@ -6977,6 +7125,8 @@ function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins =
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");
+	addClientRoute("GET", "/artifacts/v2/:targetBundleId/from/:currentBundleId", "artifactV2");
+	addClientRoute("POST", "/artifacts/v2/:targetBundleId/files", "artifactFilesV2");
 	const adminRouter = createRouter();
 	const addAdminRoute = mount(adminRouter, true);
 	addAdminRoute("GET", "/version", "adminVersion");
@@ -11476,10 +11626,44 @@ const firebaseDatabase = (config) => createEngineDatabase({
 });
 //#endregion
 //#region src/firebaseStorage.ts
+/** Signed URLs kept per adapter, enough for a few Bundles' assets. */
+const MAX_CACHED_SIGNED_URLS = 1e4;
 const firebaseStorage = (config) => {
 	const app = (0, firebase_admin_app.getApps)().length ? (0, firebase_admin_app.getApp)() : (0, firebase_admin_app.initializeApp)(config);
 	const bucket = (0, firebase_admin_storage.getStorage)(app).bucket(config.storageBucket);
 	const getStorageKey = createStorageKeyBuilder(config.basePath);
+	/**
+	* Signed URLs by object. Without a private key, as in Cloud Functions, each
+	* signature is an IAM signBlob request, and an update check returns a URL
+	* for every asset of its Bundle: each URL is reused until half its lifetime
+	* has passed.
+	*/
+	const signedUrls = /* @__PURE__ */ new Map();
+	const signUrl = async (key) => {
+		const expiresAt = Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3;
+		const [url] = await bucket.file(key).getSignedUrl({
+			action: "read",
+			expires: expiresAt
+		});
+		if (!url) throw new Error("Failed to generate Firebase download URL");
+		return url;
+	};
+	const getSignedUrl = (key) => {
+		const cached = signedUrls.get(key);
+		if (cached && Date.now() < cached.renewAt) return cached.url;
+		const url = signUrl(key);
+		const entry = {
+			url,
+			renewAt: Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3 / 2
+		};
+		signedUrls.delete(key);
+		signedUrls.set(key, entry);
+		if (signedUrls.size > MAX_CACHED_SIGNED_URLS) signedUrls.delete(signedUrls.keys().next().value);
+		url.catch(() => {
+			if (signedUrls.get(key) === entry) signedUrls.delete(key);
+		});
+		return url;
+	};
 	const parseAndValidate = (storageUri) => {
 		const parsed = parseStorageUri(storageUri, "gs");
 		if (parsed.bucket !== config.storageBucket) throw new Error(`Bucket name mismatch: expected "${config.storageBucket}", but found "${parsed.bucket}".`);
@@ -11525,12 +11709,7 @@ const firebaseStorage = (config) => {
 				downloadUrl.hash = "";
 				return { url: downloadUrl.toString() };
 			}
-			const [url] = await bucket.file(key).getSignedUrl({
-				action: "read",
-				expires: Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3
-			});
-			if (!url) throw new Error("Failed to generate Firebase download URL");
-			return { url };
+			return { url: await getSignedUrl(key) };
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);

package/dist/index.cjs

@@ -191,10 +191,44 @@ const firebaseDatabase = (config) => (0, _hot_updater_plugin_core.createEngineDa
 });
 //#endregion
 //#region src/firebaseStorage.ts
+/** Signed URLs kept per adapter, enough for a few Bundles' assets. */
+const MAX_CACHED_SIGNED_URLS = 1e4;
 const firebaseStorage = (config) => {
 	const app = (0, firebase_admin_app.getApps)().length ? (0, firebase_admin_app.getApp)() : (0, firebase_admin_app.initializeApp)(config);
 	const bucket = (0, firebase_admin_storage.getStorage)(app).bucket(config.storageBucket);
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
+	/**
+	* Signed URLs by object. Without a private key, as in Cloud Functions, each
+	* signature is an IAM signBlob request, and an update check returns a URL
+	* for every asset of its Bundle: each URL is reused until half its lifetime
+	* has passed.
+	*/
+	const signedUrls = /* @__PURE__ */ new Map();
+	const signUrl = async (key) => {
+		const expiresAt = Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3;
+		const [url] = await bucket.file(key).getSignedUrl({
+			action: "read",
+			expires: expiresAt
+		});
+		if (!url) throw new Error("Failed to generate Firebase download URL");
+		return url;
+	};
+	const getSignedUrl = (key) => {
+		const cached = signedUrls.get(key);
+		if (cached && Date.now() < cached.renewAt) return cached.url;
+		const url = signUrl(key);
+		const entry = {
+			url,
+			renewAt: Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3 / 2
+		};
+		signedUrls.delete(key);
+		signedUrls.set(key, entry);
+		if (signedUrls.size > MAX_CACHED_SIGNED_URLS) signedUrls.delete(signedUrls.keys().next().value);
+		url.catch(() => {
+			if (signedUrls.get(key) === entry) signedUrls.delete(key);
+		});
+		return url;
+	};
 	const parseAndValidate = (storageUri) => {
 		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "gs");
 		if (parsed.bucket !== config.storageBucket) throw new Error(`Bucket name mismatch: expected "${config.storageBucket}", but found "${parsed.bucket}".`);
@@ -240,12 +274,7 @@ const firebaseStorage = (config) => {
 				downloadUrl.hash = "";
 				return { url: downloadUrl.toString() };
 			}
-			const [url] = await bucket.file(key).getSignedUrl({
-				action: "read",
-				expires: Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3
-			});
-			if (!url) throw new Error("Failed to generate Firebase download URL");
-			return { url };
+			return { url: await getSignedUrl(key) };
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);

package/dist/index.mjs

@@ -190,10 +190,44 @@ const firebaseDatabase = (config) => createEngineDatabase({
 });
 //#endregion
 //#region src/firebaseStorage.ts
+/** Signed URLs kept per adapter, enough for a few Bundles' assets. */
+const MAX_CACHED_SIGNED_URLS = 1e4;
 const firebaseStorage = (config) => {
 	const app = getApps().length ? getApp() : initializeApp(config);
 	const bucket = getStorage(app).bucket(config.storageBucket);
 	const getStorageKey = createStorageKeyBuilder(config.basePath);
+	/**
+	* Signed URLs by object. Without a private key, as in Cloud Functions, each
+	* signature is an IAM signBlob request, and an update check returns a URL
+	* for every asset of its Bundle: each URL is reused until half its lifetime
+	* has passed.
+	*/
+	const signedUrls = /* @__PURE__ */ new Map();
+	const signUrl = async (key) => {
+		const expiresAt = Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3;
+		const [url] = await bucket.file(key).getSignedUrl({
+			action: "read",
+			expires: expiresAt
+		});
+		if (!url) throw new Error("Failed to generate Firebase download URL");
+		return url;
+	};
+	const getSignedUrl = (key) => {
+		const cached = signedUrls.get(key);
+		if (cached && Date.now() < cached.renewAt) return cached.url;
+		const url = signUrl(key);
+		const entry = {
+			url,
+			renewAt: Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3 / 2
+		};
+		signedUrls.delete(key);
+		signedUrls.set(key, entry);
+		if (signedUrls.size > MAX_CACHED_SIGNED_URLS) signedUrls.delete(signedUrls.keys().next().value);
+		url.catch(() => {
+			if (signedUrls.get(key) === entry) signedUrls.delete(key);
+		});
+		return url;
+	};
 	const parseAndValidate = (storageUri) => {
 		const parsed = parseStorageUri(storageUri, "gs");
 		if (parsed.bucket !== config.storageBucket) throw new Error(`Bucket name mismatch: expected "${config.storageBucket}", but found "${parsed.bucket}".`);
@@ -239,12 +273,7 @@ const firebaseStorage = (config) => {
 				downloadUrl.hash = "";
 				return { url: downloadUrl.toString() };
 			}
-			const [url] = await bucket.file(key).getSignedUrl({
-				action: "read",
-				expires: Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3
-			});
-			if (!url) throw new Error("Failed to generate Firebase download URL");
-			return { url };
+			return { url: await getSignedUrl(key) };
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/firebase",
   "type": "module",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "types": "dist/index.d.cts",
@@ -37,10 +37,10 @@
   ],
   "dependencies": {
     "hono": "4.12.34",
-    "@hot-updater/cli-tools": "1.0.5",
-    "@hot-updater/protocol": "1.0.5",
-    "@hot-updater/plugin-core": "1.0.5",
-    "@hot-updater/server": "1.0.5"
+    "@hot-updater/cli-tools": "1.0.7",
+    "@hot-updater/protocol": "1.0.7",
+    "@hot-updater/server": "1.0.7",
+    "@hot-updater/plugin-core": "1.0.7"
   },
   "publishConfig": {
     "access": "public"
@@ -55,8 +55,8 @@
     "firebase-tools": "15.29.0",
     "fkill": "^9.0.0",
     "mime": "^4.0.4",
-    "@hot-updater/mock": "1.0.5",
-    "@hot-updater/test-utils": "1.0.5"
+    "@hot-updater/mock": "1.0.7",
+    "@hot-updater/test-utils": "1.0.7"
   },
   "peerDependencies": {
     "firebase-admin": ">=11.10.0",