@hot-updater/react-native 1.0.5 → 1.0.7

package/android/src/oldarch/HotUpdaterModule.kt

@@ -47,7 +47,14 @@ class HotUpdaterModule internal constructor(
      */
     private fun getInstance(): HotUpdaterImpl = HotUpdater.getInstance(mReactApplicationContext)
 
-    private fun parseAssets(params: ReadableMap): Map<String, ChangedAssetDescriptor>? {
+    /**
+     * Every changed file with its hash and URL or Hermes patch; with
+     * [requireFileHash] false, also entries that hold only the Hermes patch.
+     */
+    private fun parseAssets(
+        params: ReadableMap,
+        requireFileHash: Boolean,
+    ): Map<String, ChangedAssetDescriptor>? {
         if (!params.hasKey("assets") || params.isNull("assets")) {
             return null
         }
@@ -59,38 +66,10 @@ class HotUpdaterModule internal constructor(
         while (iterator.hasNextKey()) {
             val assetPath = iterator.nextKey()
             val assetMap = changedAssetsMap.getMap(assetPath) ?: continue
-            val assetHash = assetMap.getString("fileHash") ?: continue
+            val assetHash = if (assetMap.hasKey("fileHash")) assetMap.getString("fileHash") else null
+            if (assetHash == null && requireFileHash) continue
             val patchMap = assetMap.getMap("patch")
-            val patch =
-                if (patchMap != null) {
-                    val algorithm = patchMap.getString("algorithm")
-                    val baseBundleId = patchMap.getString("baseBundleId")
-                    val baseFileHash = patchMap.getString("baseFileHash")
-                    val patchFileHash = patchMap.getString("patchFileHash")
-                    val patchUrl = patchMap.getString("patchUrl")
-                    val byteSize = readSafeInteger(patchMap, "byteSize")
-
-                    if (
-                        algorithm != null &&
-                        baseBundleId != null &&
-                        baseFileHash != null &&
-                        patchFileHash != null &&
-                        patchUrl != null
-                    ) {
-                        BsdiffPatchDescriptor(
-                            algorithm = algorithm,
-                            baseBundleId = baseBundleId,
-                            baseFileHash = baseFileHash,
-                            patchFileHash = patchFileHash,
-                            patchUrl = patchUrl,
-                            byteSize = byteSize,
-                        )
-                    } else {
-                        null
-                    }
-                } else {
-                    null
-                }
+            val patch = parsePatch(patchMap)
             val fileMap =
                 if (assetMap.hasKey("file") && !assetMap.isNull("file")) {
                     assetMap.getMap("file")
@@ -107,10 +86,13 @@ class HotUpdaterModule internal constructor(
             if (assetUrl == null && patch == null) {
                 continue
             }
+            if (assetHash == null && assetUrl != null) {
+                continue
+            }
             parsedAssets[assetPath] =
                 ChangedAssetDescriptor(
                     fileUrl = assetUrl,
-                    fileHash = assetHash,
+                    fileHash = assetHash ?: "",
                     fileCompression = fileCompression,
                     patch = patch,
                 )
@@ -119,6 +101,94 @@ class HotUpdaterModule internal constructor(
         return parsedAssets
     }
 
+    /** The update check's request headers, which the artifact files request repeats. */
+    private fun parseRequestHeaders(params: ReadableMap): Map<String, String> {
+        if (!params.hasKey("requestHeaders") || params.isNull("requestHeaders")) return emptyMap()
+        val headers = params.getMap("requestHeaders") ?: return emptyMap()
+        val parsed = linkedMapOf<String, String>()
+        val iterator = headers.keySetIterator()
+        while (iterator.hasNextKey()) {
+            val name = iterator.nextKey()
+            if (headers.getType(name) == com.facebook.react.bridge.ReadableType.String) {
+                headers.getString(name)?.let { parsed[name] = it }
+            }
+        }
+        return parsed
+    }
+
+    private fun parsePatch(patchMap: ReadableMap?): BsdiffPatchDescriptor? {
+        if (patchMap == null) return null
+        val algorithm = patchMap.getString("algorithm")
+        val baseBundleId = patchMap.getString("baseBundleId")
+        val baseFileHash = patchMap.getString("baseFileHash")
+        val patchFileHash = patchMap.getString("patchFileHash")
+        val patchUrl = patchMap.getString("patchUrl")
+        val byteSize = readSafeInteger(patchMap, "byteSize")
+
+        return if (
+            algorithm != null &&
+            baseBundleId != null &&
+            baseFileHash != null &&
+            patchFileHash != null &&
+            patchUrl != null
+        ) {
+            BsdiffPatchDescriptor(
+                algorithm = algorithm,
+                baseBundleId = baseBundleId,
+                baseFileHash = baseFileHash,
+                patchFileHash = patchFileHash,
+                patchUrl = patchUrl,
+                byteSize = byteSize,
+            )
+        } else {
+            null
+        }
+    }
+
+    /**
+     * The resolver that asks `filesUrl` for the files native downloads one by
+     * one; null when `filesUrl` is missing.
+     */
+    private fun parseFileResolver(params: ReadableMap): ArtifactFileResolver? {
+        val filesUrl =
+            if (params.hasKey("filesUrl") && !params.isNull("filesUrl")) {
+                params.getString("filesUrl")?.takeIf { it.isNotEmpty() }
+            } else {
+                null
+            } ?: return null
+        try {
+            java.net.URL(filesUrl)
+        } catch (e: java.net.MalformedURLException) {
+            throw HotUpdaterException.invalidFileUrl("filesUrl", filesUrl, UpdateFailureResource.FILE)
+        }
+        val requestTimeoutMs =
+            if (params.hasKey("requestTimeout") && !params.isNull("requestTimeout")) {
+                params.getDouble("requestTimeout").toLong().takeIf { it > 0 }
+            } else {
+                null
+            } ?: HttpArtifactFileResolver.DEFAULT_TIMEOUT_MS
+        return HttpArtifactFileResolver(filesUrl, parseRequestHeaders(params), requestTimeoutMs)
+    }
+
+    /**
+     * Artifact protocol v2: the Hermes patch as the only planned asset, and
+     * the resolver that asks `filesUrl` for the files native downloads one by
+     * one; null when `filesUrl` is missing.
+     */
+    private fun parseArtifactInstall(params: ReadableMap): Pair<Map<String, ChangedAssetDescriptor>, ArtifactFileResolver?>? {
+        val fileResolver = parseFileResolver(params) ?: return null
+        val patchMap = if (params.hasKey("patch") && !params.isNull("patch")) params.getMap("patch") else null
+        val assetPath = patchMap?.getString("assetPath")
+        val patch = parsePatch(patchMap)
+        val assets =
+            if (assetPath != null && patch != null) {
+                mapOf(assetPath to ChangedAssetDescriptor(fileUrl = null, fileHash = "", patch = patch))
+            } else {
+                emptyMap()
+            }
+        return assets to fileResolver
+    }
+
     private fun parseSelection(params: ReadableMap): PersistedSelection? {
         if (!params.hasKey("selection") || params.isNull("selection")) return null
         val selection = params.getMap("selection") ?: return null
@@ -173,6 +243,29 @@ class HotUpdaterModule internal constructor(
     override fun updateBundle(
         params: ReadableMap,
         promise: Promise,
+    ) {
+        // Legacy: artifact protocol v1, where every file comes with its URL.
+        // JavaScript from the first protocol v2 SDK also sends `filesUrl`
+        // here, with only the Hermes patch in `assets`; its OTA Bundles must
+        // still install.
+        stage(params, promise) {
+            val fileResolver = parseFileResolver(params)
+            parseAssets(params, requireFileHash = fileResolver == null)?.let { it to fileResolver }
+        }
+    }
+
+    @ReactMethod
+    override fun installArtifact(
+        params: ReadableMap,
+        promise: Promise,
+    ) {
+        stage(params, promise) { parseArtifactInstall(params) }
+    }
+
+    private fun stage(
+        params: ReadableMap,
+        promise: Promise,
+        plan: () -> Pair<Map<String, ChangedAssetDescriptor>, ArtifactFileResolver?>?,
     ) {
         moduleScope.launch {
             try {
@@ -184,7 +277,8 @@ class HotUpdaterModule internal constructor(
 
                 val manifestUrl = params.getString("manifestUrl")
                 val manifestFileHash = params.getString("manifestFileHash")
-                val assets = parseAssets(params)
+                val planned = plan()
+                val assets = planned?.first
                 if (manifestUrl.isNullOrEmpty() || manifestFileHash.isNullOrEmpty() || assets == null) {
                     promise.rejectUpdateBundle(HotUpdaterException.invalidManifestParams())
                     return@launch
@@ -215,6 +309,7 @@ class HotUpdaterModule internal constructor(
                     }
                 }
                 val selection = parseSelection(params)
+                val fileResolver = planned.second
 
                 val impl = getInstance()
 
@@ -227,6 +322,7 @@ class HotUpdaterModule internal constructor(
                         channel,
                         selection,
                         archiveUrl,
+                        fileResolver,
                     ) { progress ->
                         // Post to Main thread for React Native event emission
                         Handler(Looper.getMainLooper()).post {

package/android/src/oldarch/HotUpdaterSpec.kt

@@ -13,6 +13,11 @@ abstract class HotUpdaterSpec internal constructor(
         promise: Promise,
     )
 
+    abstract fun installArtifact(
+        params: ReadableMap,
+        promise: Promise,
+    )
+
     abstract fun acceptReleaseCatalog(params: ReadableMap): Boolean
 
     abstract fun getActiveUpdateState(): String

package/ios/HotUpdater/Interface/HotUpdaterInterface.h

@@ -0,0 +1,69 @@
+#import <Foundation/Foundation.h>
+#import <React/RCTBridgeModule.h>
+
+// Swift Package Manager builds HotUpdater's Swift implementation as its own
+// target, and HotUpdater.mm (Objective-C++) can't import that target's
+// generated header: it is reachable only as a Clang module, and React
+// Native's headers don't build as C++ modules. HotUpdater.mm calls the Swift
+// classes through these protocols instead, and the Swift classes conform to
+// them in HotUpdaterInterface.swift, so the compiler checks both sides.
+// CocoaPods builds import HotUpdater-Swift.h and don't use this file.
+
+NS_ASSUME_NONNULL_BEGIN
+
+@protocol HotUpdaterImplInterface <NSObject>
+- (NSString *)getChannel;
+- (NSString *)getDefaultChannel;
+- (nullable NSString *)getFingerprintHash;
+- (void)setCohort:(NSString *)cohort;
+- (NSString *)getCohort;
+- (nullable NSURL *)bundleURLWithBundle:(NSBundle *)bundle NS_SWIFT_NAME(bundleURL(bundle:));
+- (void)updateBundle:(nullable NSDictionary *)params
+            resolver:(RCTPromiseResolveBlock)resolve
+            rejecter:(RCTPromiseRejectBlock)reject;
+- (void)installArtifact:(nullable NSDictionary *)params
+               resolver:(RCTPromiseResolveBlock)resolve
+               rejecter:(RCTPromiseRejectBlock)reject;
+- (BOOL)acceptReleaseCatalog:(nullable NSDictionary *)params;
+- (NSDictionary<NSString *, id> *)getActiveUpdateState;
+- (void)getReleaseCatalogCache:(NSString *)partition
+                      resolver:(RCTPromiseResolveBlock)resolve
+                      rejecter:(RCTPromiseRejectBlock)reject;
+- (void)setReleaseCatalogCache:(NSString *)partition
+                       payload:(NSString *)payload
+                      resolver:(RCTPromiseResolveBlock)resolve
+                      rejecter:(RCTPromiseRejectBlock)reject;
+- (void)removeReleaseCatalogCache:(NSString *)partition
+                         resolver:(RCTPromiseResolveBlock)resolve
+                         rejecter:(RCTPromiseRejectBlock)reject;
+- (BOOL)isReleaseSelectionCurrent:(nullable NSDictionary *)params;
+- (void)commitReleaseSelection:(nullable NSDictionary *)params
+                      resolver:(RCTPromiseResolveBlock)resolve
+                      rejecter:(RCTPromiseRejectBlock)reject;
+- (NSDictionary<NSString *, id> *)notifyAppReady;
+- (NSArray<NSString *> *)getCrashHistory;
+- (BOOL)clearCrashHistory;
+- (NSString *)getInstallId;
+- (nullable NSString *)getStorageItem:(NSString *)key;
+- (void)setStorageItem:(NSString *)key value:(nullable NSString *)value;
+- (nullable NSString *)getBaseURL;
+- (nullable NSString *)getBundleId;
+- (NSDictionary<NSString *, id> *)getManifest;
+- (void)resetLaunchPreparation;
+- (void)resetChannel:(RCTPromiseResolveBlock)resolve rejecter:(RCTPromiseRejectBlock)reject;
+@end
+
+@protocol HotUpdaterConfigInterface <NSObject>
+- (void)configureWithFingerprintHash:(nullable NSString *)fingerprintHash
+                           publicKey:(nullable NSString *)publicKey
+                             channel:(nullable NSString *)channel
+                        isolationKey:(nullable NSString *)isolationKey
+    NS_SWIFT_NAME(configureWithFingerprintHash(_:publicKey:channel:isolationKey:));
+@end
+
+// Implemented in HotUpdaterInterface.swift.
+FOUNDATION_EXTERN id<HotUpdaterImplInterface> HotUpdaterMakeImpl(void);
+FOUNDATION_EXTERN NSString *_Nullable HotUpdaterAppVersion(void);
+FOUNDATION_EXTERN id<HotUpdaterConfigInterface> HotUpdaterSharedConfig(void);
+
+NS_ASSUME_NONNULL_END

package/ios/HotUpdater/Interface/HotUpdaterInterface.m

@@ -0,0 +1,3 @@
+// Xcode links every Swift Package Manager target's object file, so the
+// header-only HotUpdaterInterface target needs one translation unit.
+#import "HotUpdaterInterface.h"

package/ios/HotUpdater/Internal/ArtifactFileResolver.swift

@@ -0,0 +1,87 @@
+import Foundation
+
+/// A download URL the server signed for one manifest file.
+public struct ResolvedArtifactFile: Equatable {
+    public let url: URL
+    public let compression: String?
+
+    public init(url: URL, compression: String?) {
+        self.url = url
+        self.compression = compression
+    }
+}
+
+/// Artifact protocol v2: the server signs only the files an install
+/// downloads one by one, after reusing local files and choosing the archive.
+public protocol ArtifactFileResolver {
+    /// Download URLs for `paths`, at most `artifactFilesRequestLimit`.
+    func resolve(paths: [String]) throws -> [String: ResolvedArtifactFile]
+}
+
+/// `ARTIFACT_FILES_REQUEST_LIMIT` in @hot-updater/protocol.
+public let artifactFilesRequestLimit = 100
+
+enum ArtifactFileResolverError: Error {
+    case invalidResponse
+}
+
+/// POSTs `{ paths }` to the files URL the SDK composed, with the update
+/// check's headers and request timeout.
+final class HTTPArtifactFileResolver: ArtifactFileResolver {
+    /// The SDK's request timeout when the app sets none.
+    static let defaultTimeout: TimeInterval = 5
+
+    private let filesUrl: URL
+    private let headers: [String: String]
+    private let timeout: TimeInterval
+    private let session: URLSession
+
+    init(filesUrl: URL, headers: [String: String], timeout: TimeInterval = defaultTimeout, session: URLSession = .shared) {
+        self.filesUrl = filesUrl
+        self.headers = headers
+        self.timeout = timeout
+        self.session = session
+    }
+
+    func resolve(paths: [String]) throws -> [String: ResolvedArtifactFile] {
+        var request = URLRequest(url: filesUrl, timeoutInterval: timeout)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "Accept")
+        for (name, value) in headers {
+            request.setValue(value, forHTTPHeaderField: name)
+        }
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.httpBody = try JSONSerialization.data(withJSONObject: ["paths": paths])
+
+        let finished = DispatchSemaphore(value: 0)
+        var result: Result<Data, Error> = .failure(ArtifactFileResolverError.invalidResponse)
+        let task = session.dataTask(with: request) { data, response, error in
+            defer { finished.signal() }
+            if let error {
+                result = .failure(error)
+                return
+            }
+            guard let httpResponse = response as? HTTPURLResponse else { return }
+            guard (200..<300).contains(httpResponse.statusCode) else {
+                result = .failure(DownloadError.httpStatus(httpResponse.statusCode))
+                return
+            }
+            result = .success(data ?? Data())
+        }
+        task.resume()
+        finished.wait()
+
+        guard let json = try JSONSerialization.jsonObject(with: result.get()) as? [String: Any],
+              let files = json["files"] as? [String: [String: Any]] else {
+            throw ArtifactFileResolverError.invalidResponse
+        }
+        return try paths.reduce(into: [:]) { resolved, path in
+            guard let file = files[path],
+                  let urlString = file["url"] as? String,
+                  let url = URL(string: urlString) else {
+                throw ArtifactFileResolverError.invalidResponse
+            }
+            resolved[path] = ResolvedArtifactFile(url: url, compression: file["compression"] as? String)
+        }
+    }
+}

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -285,7 +285,7 @@ public protocol BundleStorageService {
     func prepareLaunch(bundle: Bundle, pendingRecovery: PendingCrashRecovery?) -> LaunchSelection
 
     // Bundle update
-    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL?, assets: [String: ChangedAssetDescriptor], progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void)
+    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL?, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver?, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void)
     func stageReleaseSelection(_ selection: PersistedSelection) -> Bool
     func acceptReleaseCatalog(catalogId: String, scopeKey: String, generation: Int64, catalogHash: String, channel: String, selectionContextHash: String) -> Bool
     func getActiveUpdateState() -> [String: Any]
@@ -336,6 +336,12 @@ public extension BundleStorageService {
 
 class BundleFileStorageService: BundleStorageService {
     private static let maximumSafeByteSize: Int64 = 9_007_199_254_740_991
+    /// Files downloaded at once when the archive is not used.
+    static let parallelFileDownloads = 16
+    /// What one request costs beyond the first `parallelFileDownloads`, in
+    /// bytes: each waits a round trip for a free slot, about 100 ms, which at
+    /// 5 MB/s over 16 slots is the time of 32 KiB.
+    private static let requestOverheadByteSize: Int64 = 32 * 1024
 
     private struct ActiveBundleMetadataSnapshot {
         let activeBundleId: String
@@ -1168,7 +1174,15 @@ class BundleFileStorageService: BundleStorageService {
         guard !overheadUnderflowed,
               tarOverhead >= 0 else { return false }
 
-        if archive.downloadByteSize <= individualLowerBound {
+        // Many small files cost more in requests than in bytes.
+        let requestOverhead = Int64(max(0, downloads.count - Self.parallelFileDownloads))
+            * Self.requestOverheadByteSize
+        let (individualCost, costOverflowed) = individualLowerBound
+            .addingReportingOverflow(requestOverhead)
+        guard !costOverflowed,
+              individualCost <= Self.maximumSafeByteSize else { return false }
+
+        if archive.downloadByteSize <= individualCost {
             return true
         }
 
@@ -1176,7 +1190,7 @@ class BundleFileStorageService: BundleStorageService {
               !hasOfferedPatch else {
             return false
         }
-        let (archiveBound, boundOverflowed) = individualLowerBound
+        let (archiveBound, boundOverflowed) = individualCost
             .addingReportingOverflow(tarOverhead)
         guard !boundOverflowed,
               archiveBound <= Self.maximumSafeByteSize else { return false }
@@ -2015,7 +2029,7 @@ class BundleFileStorageService: BundleStorageService {
      * @param progressHandler Callback for download and extraction progress (0.0 to 1.0)
      * @param completion Callback with result of the operation
      */
-    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL? = nil, assets: [String: ChangedAssetDescriptor], progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void) {
+    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL? = nil, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver? = nil, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void) {
         // Check if bundle is in crashed history
         if getCrashHistory().contains(bundleId) {
             NSLog("[BundleStorage] Bundle '\(bundleId)' is in crashed history, rejecting update")
@@ -2038,6 +2052,7 @@ class BundleFileStorageService: BundleStorageService {
                 manifestFileHash: manifestFileHash,
                 archiveUrl: archiveUrl,
                 changedAssets: assets,
+                fileResolver: fileResolver,
                 storeDir: storeDir,
                 progressHandler: progressHandler,
                 completion: completion
@@ -2045,6 +2060,35 @@ class BundleFileStorageService: BundleStorageService {
         }
     }
 
+    /// Asks `fileResolver` for the URLs of `downloads`, in requests of at
+    /// most `artifactFilesRequestLimit` paths.
+    private func resolveFileUrls(
+        fileResolver: ArtifactFileResolver,
+        downloads: inout [String: ChangedAssetDescriptor]
+    ) throws {
+        let paths = downloads.keys.sorted()
+        for start in stride(from: 0, to: paths.count, by: artifactFilesRequestLimit) {
+            let chunk = Array(paths[start..<min(start + artifactFilesRequestLimit, paths.count)])
+            let files: [String: ResolvedArtifactFile]
+            do {
+                files = try fileResolver.resolve(paths: chunk)
+            } catch {
+                throw BundleStorageError.downloadFailed(error)
+            }
+            for path in chunk {
+                guard let file = files[path], let descriptor = downloads[path] else {
+                    throw BundleStorageError.invalidBundle
+                }
+                downloads[path] = ChangedAssetDescriptor(
+                    fileUrl: file.url,
+                    fileHash: descriptor.fileHash,
+                    fileCompression: file.compression,
+                    patch: descriptor.patch
+                )
+            }
+        }
+    }
+
     /// How the per-file install produced one file.
     private enum AssetInstallOutcome {
         case patched
@@ -2490,6 +2534,7 @@ class BundleFileStorageService: BundleStorageService {
         manifestFileHash: String,
         archiveUrl: URL?,
         changedAssets: [String: ChangedAssetDescriptor],
+        fileResolver: ArtifactFileResolver?,
         storeDir: String,
         progressHandler: @escaping (UpdateProgressPayload) -> Void,
         completion: @escaping (Result<UpdateDelivery, Error>) -> Void
@@ -2576,20 +2621,43 @@ class BundleFileStorageService: BundleStorageService {
             else {
                 throw BundleStorageError.invalidBundle
             }
-            // Validate the entire wire contract even when every byte can be reused.
-            guard Set(targetManifest.assets.keys) == Set(changedAssets.keys) else {
-                throw BundleStorageError.invalidBundle
+            if fileResolver == nil {
+                // Legacy: artifact protocol v1, where every file comes with its URL.
+                // Validate the entire wire contract even when every byte can be reused.
+                guard Set(targetManifest.assets.keys) == Set(changedAssets.keys) else {
+                    throw BundleStorageError.invalidBundle
+                }
+            } else {
+                // In v2, `assets` holds only the Hermes patch.
+                guard Set(changedAssets.keys).isSubset(of: Set(targetManifest.assets.keys)) else {
+                    throw BundleStorageError.invalidBundle
+                }
             }
             for (path, asset) in targetManifest.assets {
                 guard FileUtilities.normalizedRelativePath(from: path) == path,
-                      path != "manifest.json",
-                      let descriptor = changedAssets[path],
-                      descriptor.fileUrl != nil,
-                      descriptor.fileHash.caseInsensitiveCompare(asset.fileHash) == .orderedSame else {
+                      path != "manifest.json" else {
                     throw BundleStorageError.invalidBundle
                 }
+                if fileResolver == nil {
+                    guard let descriptor = changedAssets[path],
+                          descriptor.fileUrl != nil,
+                          descriptor.fileHash.caseInsensitiveCompare(asset.fileHash) == .orderedSame else {
+                        throw BundleStorageError.invalidBundle
+                    }
+                }
                 _ = try FileUtilities.fileURL(for: path, destinationRoot: tmpDir)
             }
+            // In v2, the manifest names every file; URLs come once the install
+            // knows which files it downloads.
+            let plannedAssets: [String: ChangedAssetDescriptor] = fileResolver == nil
+                ? changedAssets
+                : targetManifest.assets.reduce(into: [:]) { planned, entry in
+                    planned[entry.key] = ChangedAssetDescriptor(
+                        fileUrl: nil,
+                        fileHash: entry.value.fileHash,
+                        patch: changedAssets[entry.key]?.patch
+                    )
+                }
 
             // Downloads, patches, and extraction below classify their own errors.
             failurePhase = .storage
@@ -2642,7 +2710,7 @@ class BundleFileStorageService: BundleStorageService {
                     }
                     continue
                 }
-                downloads[assetPath] = changedAssets[assetPath]
+                downloads[assetPath] = plannedAssets[assetPath]
             }
 
             var archiveInstalled = false
@@ -2677,11 +2745,18 @@ class BundleFileStorageService: BundleStorageService {
             }
 
             if !archiveInstalled {
+                if let fileResolver {
+                    failurePhase = .transfer
+                    failureResource = .file
+                    try resolveFileUrls(fileResolver: fileResolver, downloads: &downloads)
+                    failurePhase = .storage
+                    failureResource = nil
+                }
                 diffFiles = createDiffProgressFiles(changedAssets: downloads)
                 emitDiffProgress(progressHandler: progressHandler, phase: "downloading", files: diffFiles)
                 let progressLock = NSLock()
                 let workers = OperationQueue()
-                workers.maxConcurrentOperationCount = 4
+                workers.maxConcurrentOperationCount = Self.parallelFileDownloads
                 var installError: Error?
                 var installOutcomes: [AssetInstallOutcome] = []
                 for progressFile in diffFiles {