@hot-updater/react-native 1.0.5 → 1.0.6

package/android/src/main/java/com/hotupdater/BundleFileStorageService.kt

@@ -124,6 +124,7 @@ interface BundleStorageService {
         manifestFileHash: String,
         assets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String? = null,
+        fileResolver: ArtifactFileResolver? = null,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult
 
@@ -239,6 +240,16 @@ class BundleFileStorageService(
         private const val MAX_SAFE_INTEGER = 9_007_199_254_740_991L
         private val SHA256_PATTERN = Regex("^[0-9a-f]{64}$")
 
+        /** Files downloaded at once when the archive is not used. */
+        private const val PARALLEL_FILE_DOWNLOADS = 16
+
+        /**
+         * What one request costs beyond the first [PARALLEL_FILE_DOWNLOADS], in
+         * bytes: each waits a round trip for a free slot, about 100 ms, which
+         * at 5 MB/s over 16 slots is the time of 32 KiB.
+         */
+        private const val REQUEST_OVERHEAD_BYTES = 32L * 1024
+
         /** A patch produced a file that does not match the target, or none at all. */
         private val PATCH_FAILURE =
             UpdateFailure(UpdateFailureStage.INSTALL, UpdateFailureReason.PATCH, resource = UpdateFailureResource.PATCH)
@@ -718,10 +729,35 @@ class BundleFileStorageService(
         if (resolveBundleFile(bundleDir, bundleId) == null) return false
         return manifest.assets.all { (assetPath, asset) ->
             val file = RelativePathResolver.resolveInside(bundleDir, assetPath)
-            file?.isFile == true && runCatching { verifyManifestAssetFileOrThrow(file, asset) }.isSuccess
+            file?.isFile == true &&
+                (
+                    runCatching { verifyManifestAssetFileOrThrow(file, asset) }.isSuccess ||
+                        isBuiltInEquivalent(assetPath, file, asset)
+                )
         }
     }
 
+    /**
+     * Whether [file] holds the packaged bytes of the built-in asset the native
+     * build recorded with the manifest's source hash, as AAPT2 re-encodes a
+     * PNG. Both come from the APK, never from app storage. The manifest's
+     * signature still covers that source hash.
+     */
+    private fun isBuiltInEquivalent(
+        assetPath: String,
+        file: File,
+        asset: ParsedManifestAsset,
+    ): Boolean {
+        val packagedHash = builtInAssetResolver.packagedHashIfSourceMatches(assetPath, asset.fileHash) ?: return false
+        return HashUtils.calculateSHA256(file).equals(packagedHash, ignoreCase = true) &&
+            runCatching {
+                if (SignatureVerifier.isSigningEnabled(context)) {
+                    val signature = asset.signature ?: throw SignatureVerificationException.InvalidSignatureFormat()
+                    SignatureVerifier.verifyHashSignature(context, asset.fileHash, signature)
+                }
+            }.isSuccess
+    }
+
     private fun recoverInterruptedPromotions(): Boolean {
         val bundleStoreDir = getBundleStoreDir()
         val backups =
@@ -1610,6 +1646,7 @@ class BundleFileStorageService(
         manifestFileHash: String,
         assets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String?,
+        fileResolver: ArtifactFileResolver?,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult =
         updateMutex.withLock {
@@ -1619,6 +1656,7 @@ class BundleFileStorageService(
                 manifestFileHash = manifestFileHash,
                 changedAssets = assets,
                 archiveUrl = archiveUrl,
+                fileResolver = fileResolver,
                 progressCallback = progressCallback,
             )
         }
@@ -1629,6 +1667,7 @@ class BundleFileStorageService(
         manifestFileHash: String,
         changedAssets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String?,
+        fileResolver: ArtifactFileResolver?,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult {
         Log.d(
@@ -1660,6 +1699,7 @@ class BundleFileStorageService(
                 manifestFileHash = manifestFileHash,
                 changedAssets = changedAssets,
                 archiveUrl = archiveUrl,
+                fileResolver = fileResolver,
                 bundleStoreDir = bundleStoreDir,
                 finalBundleDir = finalBundleDir,
                 progressCallback = progressCallback,
@@ -1710,6 +1750,35 @@ class BundleFileStorageService(
             }
         }
 
+    /**
+     * Asks [fileResolver] for the URLs of [downloads], in requests of at most
+     * [ArtifactFileResolver.ARTIFACT_FILES_REQUEST_LIMIT] paths.
+     */
+    private suspend fun resolveFileUrls(
+        fileResolver: ArtifactFileResolver,
+        downloads: MutableMap<String, ChangedAssetDescriptor>,
+    ) {
+        for (paths in downloads.keys.sorted().chunked(ArtifactFileResolver.ARTIFACT_FILES_REQUEST_LIMIT)) {
+            val files =
+                try {
+                    fileResolver.resolve(paths)
+                } catch (error: CancellationException) {
+                    throw error
+                } catch (error: Exception) {
+                    throw downloadError(error)
+                }
+            for (path in paths) {
+                val file = files[path] ?: throw HotUpdaterException.invalidBundle()
+                try {
+                    URL(file.url)
+                } catch (error: java.net.MalformedURLException) {
+                    throw HotUpdaterException.invalidFileUrl(path, file.url, UpdateFailureResource.FILE)
+                }
+                downloads[path] = downloads.getValue(path).copy(fileUrl = file.url, fileCompression = file.compression)
+            }
+        }
+    }
+
     /** The rejection for a download that returned [error]. */
     private fun downloadError(error: Exception): HotUpdaterException =
         if (error is IncompleteDownloadException) {
@@ -1945,10 +2014,15 @@ class BundleFileStorageService(
         }
         if (archive.tarByteSize < logicalBytes) return null
         val tarFramingBytes = archive.tarByteSize - logicalBytes
-        if (individualBytes > MAX_SAFE_INTEGER - tarFramingBytes) return null
-        val framedByteLimit = individualBytes + tarFramingBytes
-
-        if (archive.downloadByteSize <= individualBytes) return archive
+        // Many small files cost more in requests than in bytes.
+        val requestOverheadBytes =
+            (downloads.size - PARALLEL_FILE_DOWNLOADS).coerceAtLeast(0) * REQUEST_OVERHEAD_BYTES
+        if (individualBytes > MAX_SAFE_INTEGER - requestOverheadBytes) return null
+        val individualCost = individualBytes + requestOverheadBytes
+        if (individualCost > MAX_SAFE_INTEGER - tarFramingBytes) return null
+        val framedByteLimit = individualCost + tarFramingBytes
+
+        if (archive.downloadByteSize <= individualCost) return archive
         if (downloads.size != manifest.assets.size || downloads.values.any { it.patch != null }) return null
         return archive.takeIf { it.downloadByteSize <= framedByteLimit }
     }
@@ -2074,6 +2148,7 @@ class BundleFileStorageService(
         manifestFileHash: String,
         changedAssets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String?,
+        fileResolver: ArtifactFileResolver?,
         bundleStoreDir: File,
         finalBundleDir: File,
         progressCallback: (UpdateProgressPayload) -> Unit,
@@ -2135,14 +2210,20 @@ class BundleFileStorageService(
                     if (manifest.bundleId != bundleId) {
                         throw HotUpdaterException.invalidBundle()
                     }
-                    // Reuse never bypasses the complete artifact contract.
-                    if (manifest.assets.keys != changedAssets.keys) throw HotUpdaterException.invalidBundle()
+                    if (fileResolver == null) {
+                        // Legacy: artifact protocol v1, where every file comes with its URL.
+                        // Reuse never bypasses the complete artifact contract.
+                        if (manifest.assets.keys != changedAssets.keys) throw HotUpdaterException.invalidBundle()
+                    } else if (!manifest.assets.keys.containsAll(changedAssets.keys)) {
+                        // In v2, `assets` holds only the Hermes patch.
+                        throw HotUpdaterException.invalidBundle()
+                    }
                     manifest.assets.forEach { (path, asset) ->
-                        val descriptor = changedAssets.getValue(path)
+                        val descriptor = changedAssets[path]
                         if (RelativePathResolver.normalizeRelativePath(path) != path ||
                             path == "manifest.json" ||
-                            descriptor.fileUrl.isNullOrBlank() ||
-                            !descriptor.fileHash.equals(asset.fileHash, ignoreCase = true) ||
+                            (fileResolver == null && descriptor?.fileUrl.isNullOrBlank()) ||
+                            (fileResolver == null && !descriptor!!.fileHash.equals(asset.fileHash, ignoreCase = true)) ||
                             RelativePathResolver.resolveInside(tmpDir, path) == null
                         ) {
                             throw HotUpdaterException.invalidBundle()
@@ -2150,6 +2231,20 @@ class BundleFileStorageService(
                     }
                     manifest
                 }
+            // In v2, the manifest names every file; URLs come once the install
+            // knows which files it downloads.
+            val plannedAssets =
+                if (fileResolver == null) {
+                    changedAssets
+                } else {
+                    targetManifest.assets.mapValues { (path, asset) ->
+                        ChangedAssetDescriptor(
+                            fileUrl = null,
+                            fileHash = asset.fileHash,
+                            patch = changedAssets[path]?.patch,
+                        )
+                    }
+                }
             updateStep(UpdateFailureStage.INSTALL, resource = null) {
                 if (!tmpDir.isDirectory && !tmpDir.mkdirs()) throw HotUpdaterException.directoryCreationFailed()
                 pruneStagingDirectory(tmpDir, targetManifest.assets.keys)
@@ -2194,7 +2289,12 @@ class BundleFileStorageService(
                             verifyManifestAssetFileOrThrow(targetFile, expectedAsset)
                             return@forEachIndexed
                         }
-                        downloads[assetPath] = changedAssets.getValue(assetPath)
+                        val packagedHash = builtInAssetResolver.copyIfSourceMatches(assetPath, expectedAsset.fileHash, targetFile)
+                        if (packagedHash != null && isBuiltInEquivalent(assetPath, targetFile, expectedAsset)) {
+                            return@forEachIndexed
+                        }
+                        if (packagedHash != null) targetFile.delete()
+                        downloads[assetPath] = plannedAssets.getValue(assetPath)
                     }
                     downloads
                 }
@@ -2222,11 +2322,16 @@ class BundleFileStorageService(
                     diffFiles = archiveProgress
                     emptyList()
                 } else {
+                    if (fileResolver != null) {
+                        updateStep(UpdateFailureStage.DOWNLOAD, UpdateFailureResource.FILE) {
+                            resolveFileUrls(fileResolver, downloads)
+                        }
+                    }
                     diffFiles = createDiffProgressFiles(downloads)
                     emitDiffProgress(progressCallback, "downloading", diffFiles)
                     val progressLock = Any()
                     coroutineScope {
-                        val permits = Semaphore(4)
+                        val permits = Semaphore(PARALLEL_FILE_DOWNLOADS)
                         diffFiles
                             .toList()
                             .map { progressFile ->

package/android/src/main/java/com/hotupdater/HotUpdaterImpl.kt

@@ -162,65 +162,16 @@ class HotUpdaterImpl {
             ) ?: DEFAULT_CHANNEL
 
         /**
-         * Get minimum bundle ID string
-         * @return The minimum bundle ID string
+         * The bundle ID of the bundle this build ships (MIN_BUNDLE_ID),
+         * written by the generateHotUpdaterMinBundleId build task
          */
         fun getMinBundleId(): String {
             if (BuildConfig.DEBUG) {
                 return "00000000-0000-0000-0000-000000000000"
             }
-            return BuildConfig.MIN_BUNDLE_ID.takeIf { it != "null" } ?: generateMinBundleIdFromBuildTimestamp()
+            return HotUpdaterMinBundleId.get()
         }
 
-        /**
-         * Generates a bundle ID based on build timestamp
-         * @return The generated minimum bundle ID string
-         */
-        private fun generateMinBundleIdFromBuildTimestamp(): String =
-            try {
-                val buildTimestampMs = BuildConfig.BUILD_TIMESTAMP
-                val bytes =
-                    ByteArray(16).apply {
-                        this[0] = ((buildTimestampMs shr 40) and 0xFF).toByte()
-                        this[1] = ((buildTimestampMs shr 32) and 0xFF).toByte()
-                        this[2] = ((buildTimestampMs shr 24) and 0xFF).toByte()
-                        this[3] = ((buildTimestampMs shr 16) and 0xFF).toByte()
-                        this[4] = ((buildTimestampMs shr 8) and 0xFF).toByte()
-                        this[5] = (buildTimestampMs and 0xFF).toByte()
-                        this[6] = 0x70.toByte()
-                        this[7] = 0x00.toByte()
-                        this[8] = 0x80.toByte()
-                        this[9] = 0x00.toByte()
-                        this[10] = 0x00.toByte()
-                        this[11] = 0x00.toByte()
-                        this[12] = 0x00.toByte()
-                        this[13] = 0x00.toByte()
-                        this[14] = 0x00.toByte()
-                        this[15] = 0x00.toByte()
-                    }
-                String.format(
-                    "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-                    bytes[0].toInt() and 0xFF,
-                    bytes[1].toInt() and 0xFF,
-                    bytes[2].toInt() and 0xFF,
-                    bytes[3].toInt() and 0xFF,
-                    bytes[4].toInt() and 0xFF,
-                    bytes[5].toInt() and 0xFF,
-                    bytes[6].toInt() and 0xFF,
-                    bytes[7].toInt() and 0xFF,
-                    bytes[8].toInt() and 0xFF,
-                    bytes[9].toInt() and 0xFF,
-                    bytes[10].toInt() and 0xFF,
-                    bytes[11].toInt() and 0xFF,
-                    bytes[12].toInt() and 0xFF,
-                    bytes[13].toInt() and 0xFF,
-                    bytes[14].toInt() and 0xFF,
-                    bytes[15].toInt() and 0xFF,
-                )
-            } catch (e: Exception) {
-                "00000000-0000-0000-0000-000000000000"
-            }
-
         /**
          * Gets the current fingerprint hash
          * @param context Application context
@@ -290,6 +241,7 @@ class HotUpdaterImpl {
         channel: String?,
         selection: PersistedSelection? = null,
         archiveUrl: String? = null,
+        fileResolver: ArtifactFileResolver? = null,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult {
         if (selection != null && !bundleStorage.stageReleaseSelection(selection)) {
@@ -302,6 +254,7 @@ class HotUpdaterImpl {
                 manifestFileHash,
                 assets,
                 archiveUrl,
+                fileResolver,
                 progressCallback,
             )
 

package/android/src/newarch/HotUpdaterModule.kt

@@ -59,7 +59,8 @@ class HotUpdaterModule internal constructor(
         while (iterator.hasNextKey()) {
             val assetPath = iterator.nextKey()
             val assetMap = changedAssetsMap.getMap(assetPath) ?: continue
-            val assetHash = assetMap.getString("fileHash") ?: continue
+            // In artifact protocol v2, an entry holds only the Hermes patch.
+            val assetHash = if (assetMap.hasKey("fileHash")) assetMap.getString("fileHash") else null
             val patchMap = assetMap.getMap("patch")
             val patch =
                 if (patchMap != null) {
@@ -107,10 +108,13 @@ class HotUpdaterModule internal constructor(
             if (assetUrl == null && patch == null) {
                 continue
             }
+            if (assetHash == null && assetUrl != null) {
+                continue
+            }
             parsedAssets[assetPath] =
                 ChangedAssetDescriptor(
                     fileUrl = assetUrl,
-                    fileHash = assetHash,
+                    fileHash = assetHash ?: "",
                     fileCompression = fileCompression,
                     patch = patch,
                 )
@@ -119,6 +123,21 @@ class HotUpdaterModule internal constructor(
         return parsedAssets
     }
 
+    /** The update check's request headers, which the artifact files request repeats. */
+    private fun parseRequestHeaders(params: ReadableMap): Map<String, String> {
+        if (!params.hasKey("requestHeaders") || params.isNull("requestHeaders")) return emptyMap()
+        val headers = params.getMap("requestHeaders") ?: return emptyMap()
+        val parsed = linkedMapOf<String, String>()
+        val iterator = headers.keySetIterator()
+        while (iterator.hasNextKey()) {
+            val name = iterator.nextKey()
+            if (headers.getType(name) == com.facebook.react.bridge.ReadableType.String) {
+                headers.getString(name)?.let { parsed[name] = it }
+            }
+        }
+        return parsed
+    }
+
     private fun parseSelection(params: ReadableMap): PersistedSelection? {
         if (!params.hasKey("selection") || params.isNull("selection")) return null
         val selection = params.getMap("selection") ?: return null
@@ -211,6 +230,30 @@ class HotUpdaterModule internal constructor(
                     }
                 }
                 val selection = parseSelection(params)
+                val filesUrl =
+                    if (params.hasKey("filesUrl") && !params.isNull("filesUrl")) {
+                        params.getString("filesUrl")
+                    } else {
+                        null
+                    }
+                if (filesUrl != null) {
+                    try {
+                        java.net.URL(filesUrl)
+                    } catch (e: java.net.MalformedURLException) {
+                        promise.rejectUpdateBundle(
+                            HotUpdaterException.invalidFileUrl("filesUrl", filesUrl, UpdateFailureResource.FILE),
+                        )
+                        return@launch
+                    }
+                }
+                val requestTimeoutMs =
+                    if (params.hasKey("requestTimeout") && !params.isNull("requestTimeout")) {
+                        params.getDouble("requestTimeout").toLong().takeIf { it > 0 }
+                    } else {
+                        null
+                    } ?: HttpArtifactFileResolver.DEFAULT_TIMEOUT_MS
+                val fileResolver =
+                    filesUrl?.let { HttpArtifactFileResolver(it, parseRequestHeaders(params), requestTimeoutMs) }
 
                 val impl = getInstance()
 
@@ -223,6 +266,7 @@ class HotUpdaterModule internal constructor(
                         channel,
                         selection,
                         archiveUrl,
+                        fileResolver,
                     ) { progress ->
                         // Post to Main thread for React Native event emission
                         Handler(Looper.getMainLooper()).post {

package/android/src/oldarch/HotUpdaterModule.kt

@@ -59,7 +59,8 @@ class HotUpdaterModule internal constructor(
         while (iterator.hasNextKey()) {
             val assetPath = iterator.nextKey()
             val assetMap = changedAssetsMap.getMap(assetPath) ?: continue
-            val assetHash = assetMap.getString("fileHash") ?: continue
+            // In artifact protocol v2, an entry holds only the Hermes patch.
+            val assetHash = if (assetMap.hasKey("fileHash")) assetMap.getString("fileHash") else null
             val patchMap = assetMap.getMap("patch")
             val patch =
                 if (patchMap != null) {
@@ -107,10 +108,13 @@ class HotUpdaterModule internal constructor(
             if (assetUrl == null && patch == null) {
                 continue
             }
+            if (assetHash == null && assetUrl != null) {
+                continue
+            }
             parsedAssets[assetPath] =
                 ChangedAssetDescriptor(
                     fileUrl = assetUrl,
-                    fileHash = assetHash,
+                    fileHash = assetHash ?: "",
                     fileCompression = fileCompression,
                     patch = patch,
                 )
@@ -119,6 +123,21 @@ class HotUpdaterModule internal constructor(
         return parsedAssets
     }
 
+    /** The update check's request headers, which the artifact files request repeats. */
+    private fun parseRequestHeaders(params: ReadableMap): Map<String, String> {
+        if (!params.hasKey("requestHeaders") || params.isNull("requestHeaders")) return emptyMap()
+        val headers = params.getMap("requestHeaders") ?: return emptyMap()
+        val parsed = linkedMapOf<String, String>()
+        val iterator = headers.keySetIterator()
+        while (iterator.hasNextKey()) {
+            val name = iterator.nextKey()
+            if (headers.getType(name) == com.facebook.react.bridge.ReadableType.String) {
+                headers.getString(name)?.let { parsed[name] = it }
+            }
+        }
+        return parsed
+    }
+
     private fun parseSelection(params: ReadableMap): PersistedSelection? {
         if (!params.hasKey("selection") || params.isNull("selection")) return null
         val selection = params.getMap("selection") ?: return null
@@ -215,6 +234,30 @@ class HotUpdaterModule internal constructor(
                     }
                 }
                 val selection = parseSelection(params)
+                val filesUrl =
+                    if (params.hasKey("filesUrl") && !params.isNull("filesUrl")) {
+                        params.getString("filesUrl")
+                    } else {
+                        null
+                    }
+                if (filesUrl != null) {
+                    try {
+                        java.net.URL(filesUrl)
+                    } catch (e: java.net.MalformedURLException) {
+                        promise.rejectUpdateBundle(
+                            HotUpdaterException.invalidFileUrl("filesUrl", filesUrl, UpdateFailureResource.FILE),
+                        )
+                        return@launch
+                    }
+                }
+                val requestTimeoutMs =
+                    if (params.hasKey("requestTimeout") && !params.isNull("requestTimeout")) {
+                        params.getDouble("requestTimeout").toLong().takeIf { it > 0 }
+                    } else {
+                        null
+                    } ?: HttpArtifactFileResolver.DEFAULT_TIMEOUT_MS
+                val fileResolver =
+                    filesUrl?.let { HttpArtifactFileResolver(it, parseRequestHeaders(params), requestTimeoutMs) }
 
                 val impl = getInstance()
 
@@ -227,6 +270,7 @@ class HotUpdaterModule internal constructor(
                         channel,
                         selection,
                         archiveUrl,
+                        fileResolver,
                     ) { progress ->
                         // Post to Main thread for React Native event emission
                         Handler(Looper.getMainLooper()).post {

package/ios/HotUpdater/Interface/HotUpdaterInterface.h

@@ -0,0 +1,66 @@
+#import <Foundation/Foundation.h>
+#import <React/RCTBridgeModule.h>
+
+// Swift Package Manager builds HotUpdater's Swift implementation as its own
+// target, and HotUpdater.mm (Objective-C++) can't import that target's
+// generated header: it is reachable only as a Clang module, and React
+// Native's headers don't build as C++ modules. HotUpdater.mm calls the Swift
+// classes through these protocols instead, and the Swift classes conform to
+// them in HotUpdaterInterface.swift, so the compiler checks both sides.
+// CocoaPods builds import HotUpdater-Swift.h and don't use this file.
+
+NS_ASSUME_NONNULL_BEGIN
+
+@protocol HotUpdaterImplInterface <NSObject>
+- (NSString *)getChannel;
+- (NSString *)getDefaultChannel;
+- (nullable NSString *)getFingerprintHash;
+- (void)setCohort:(NSString *)cohort;
+- (NSString *)getCohort;
+- (nullable NSURL *)bundleURLWithBundle:(NSBundle *)bundle NS_SWIFT_NAME(bundleURL(bundle:));
+- (void)updateBundle:(nullable NSDictionary *)params
+            resolver:(RCTPromiseResolveBlock)resolve
+            rejecter:(RCTPromiseRejectBlock)reject;
+- (BOOL)acceptReleaseCatalog:(nullable NSDictionary *)params;
+- (NSDictionary<NSString *, id> *)getActiveUpdateState;
+- (void)getReleaseCatalogCache:(NSString *)partition
+                      resolver:(RCTPromiseResolveBlock)resolve
+                      rejecter:(RCTPromiseRejectBlock)reject;
+- (void)setReleaseCatalogCache:(NSString *)partition
+                       payload:(NSString *)payload
+                      resolver:(RCTPromiseResolveBlock)resolve
+                      rejecter:(RCTPromiseRejectBlock)reject;
+- (void)removeReleaseCatalogCache:(NSString *)partition
+                         resolver:(RCTPromiseResolveBlock)resolve
+                         rejecter:(RCTPromiseRejectBlock)reject;
+- (BOOL)isReleaseSelectionCurrent:(nullable NSDictionary *)params;
+- (void)commitReleaseSelection:(nullable NSDictionary *)params
+                      resolver:(RCTPromiseResolveBlock)resolve
+                      rejecter:(RCTPromiseRejectBlock)reject;
+- (NSDictionary<NSString *, id> *)notifyAppReady;
+- (NSArray<NSString *> *)getCrashHistory;
+- (BOOL)clearCrashHistory;
+- (NSString *)getInstallId;
+- (nullable NSString *)getStorageItem:(NSString *)key;
+- (void)setStorageItem:(NSString *)key value:(nullable NSString *)value;
+- (nullable NSString *)getBaseURL;
+- (nullable NSString *)getBundleId;
+- (NSDictionary<NSString *, id> *)getManifest;
+- (void)resetLaunchPreparation;
+- (void)resetChannel:(RCTPromiseResolveBlock)resolve rejecter:(RCTPromiseRejectBlock)reject;
+@end
+
+@protocol HotUpdaterConfigInterface <NSObject>
+- (void)configureWithFingerprintHash:(nullable NSString *)fingerprintHash
+                           publicKey:(nullable NSString *)publicKey
+                             channel:(nullable NSString *)channel
+                        isolationKey:(nullable NSString *)isolationKey
+    NS_SWIFT_NAME(configureWithFingerprintHash(_:publicKey:channel:isolationKey:));
+@end
+
+// Implemented in HotUpdaterInterface.swift.
+FOUNDATION_EXTERN id<HotUpdaterImplInterface> HotUpdaterMakeImpl(void);
+FOUNDATION_EXTERN NSString *_Nullable HotUpdaterAppVersion(void);
+FOUNDATION_EXTERN id<HotUpdaterConfigInterface> HotUpdaterSharedConfig(void);
+
+NS_ASSUME_NONNULL_END

package/ios/HotUpdater/Interface/HotUpdaterInterface.m

@@ -0,0 +1,3 @@
+// Xcode links every Swift Package Manager target's object file, so the
+// header-only HotUpdaterInterface target needs one translation unit.
+#import "HotUpdaterInterface.h"

package/ios/HotUpdater/Internal/ArtifactFileResolver.swift

@@ -0,0 +1,87 @@
+import Foundation
+
+/// A download URL the server signed for one manifest file.
+public struct ResolvedArtifactFile: Equatable {
+    public let url: URL
+    public let compression: String?
+
+    public init(url: URL, compression: String?) {
+        self.url = url
+        self.compression = compression
+    }
+}
+
+/// Artifact protocol v2: the server signs only the files an install
+/// downloads one by one, after reusing local files and choosing the archive.
+public protocol ArtifactFileResolver {
+    /// Download URLs for `paths`, at most `artifactFilesRequestLimit`.
+    func resolve(paths: [String]) throws -> [String: ResolvedArtifactFile]
+}
+
+/// `ARTIFACT_FILES_REQUEST_LIMIT` in @hot-updater/protocol.
+public let artifactFilesRequestLimit = 100
+
+enum ArtifactFileResolverError: Error {
+    case invalidResponse
+}
+
+/// POSTs `{ paths }` to the files URL the SDK composed, with the update
+/// check's headers and request timeout.
+final class HTTPArtifactFileResolver: ArtifactFileResolver {
+    /// The SDK's request timeout when the app sets none.
+    static let defaultTimeout: TimeInterval = 5
+
+    private let filesUrl: URL
+    private let headers: [String: String]
+    private let timeout: TimeInterval
+    private let session: URLSession
+
+    init(filesUrl: URL, headers: [String: String], timeout: TimeInterval = defaultTimeout, session: URLSession = .shared) {
+        self.filesUrl = filesUrl
+        self.headers = headers
+        self.timeout = timeout
+        self.session = session
+    }
+
+    func resolve(paths: [String]) throws -> [String: ResolvedArtifactFile] {
+        var request = URLRequest(url: filesUrl, timeoutInterval: timeout)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "Accept")
+        for (name, value) in headers {
+            request.setValue(value, forHTTPHeaderField: name)
+        }
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.httpBody = try JSONSerialization.data(withJSONObject: ["paths": paths])
+
+        let finished = DispatchSemaphore(value: 0)
+        var result: Result<Data, Error> = .failure(ArtifactFileResolverError.invalidResponse)
+        let task = session.dataTask(with: request) { data, response, error in
+            defer { finished.signal() }
+            if let error {
+                result = .failure(error)
+                return
+            }
+            guard let httpResponse = response as? HTTPURLResponse else { return }
+            guard (200..<300).contains(httpResponse.statusCode) else {
+                result = .failure(DownloadError.httpStatus(httpResponse.statusCode))
+                return
+            }
+            result = .success(data ?? Data())
+        }
+        task.resume()
+        finished.wait()
+
+        guard let json = try JSONSerialization.jsonObject(with: result.get()) as? [String: Any],
+              let files = json["files"] as? [String: [String: Any]] else {
+            throw ArtifactFileResolverError.invalidResponse
+        }
+        return try paths.reduce(into: [:]) { resolved, path in
+            guard let file = files[path],
+                  let urlString = file["url"] as? String,
+                  let url = URL(string: urlString) else {
+                throw ArtifactFileResolverError.invalidResponse
+            }
+            resolved[path] = ResolvedArtifactFile(url: url, compression: file["compression"] as? String)
+        }
+    }
+}