@hot-updater/server 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/assembly/assemblePlugins.mjs

@@ -0,0 +1,139 @@
+import { createCoreReads } from "../core/reads.mjs";
+import { createCoreApi } from "../core/api.mjs";
+import { HotUpdaterConfigError } from "./configError.mjs";
+import { checkReservedId } from "../plugins/official.mjs";
+import { clientPluginsOf } from "./clientPlugins.mjs";
+import { createEngine } from "@hot-updater/plugin-core";
+//#region src/assembly/assemblePlugins.ts
+const PLUGIN_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"provides",
+	"schemaVersion",
+	"schema",
+	"namespace",
+	"init",
+	"cli"
+]);
+const CLI_KEYS = /* @__PURE__ */ new Set(["clientCredential", "clientPlugin"]);
+const INSTANCE_KEYS = /* @__PURE__ */ new Set([
+	"api",
+	"endpoints",
+	"clientAuth"
+]);
+const METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** An id that prefixes table names is a SQL name; one that does not may use camelCase. */
+const PREFIX_ID = /^[a-z][a-z0-9_]*$/u;
+const UNPREFIXED_ID = /^[a-z][A-Za-z0-9_]*$/u;
+const PATH = /^(\/(:?[A-Za-z0-9_.~-]+))+$/u;
+const fail = (message) => {
+	throw new HotUpdaterConfigError(message);
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const checkPlugin = (value, at) => {
+	if (!isRecord(value)) return fail(`${at} is not a plugin.`);
+	if ("kind" in value) fail(`${at} has a kind; core is built in and is never passed as a plugin.`);
+	const unknown = Object.keys(value).find((key) => !PLUGIN_KEYS.has(key));
+	if (unknown !== void 0) fail(`${at} has an unknown key "${unknown}".`);
+	const plugin = value;
+	if (plugin.namespace !== void 0 && plugin.namespace !== false) fail(`${at} may only set namespace: false.`);
+	const pattern = plugin.namespace === false ? UNPREFIXED_ID : PREFIX_ID;
+	if (typeof plugin.id !== "string" || !pattern.test(plugin.id)) fail(`${at} needs an id matching ${pattern.source}.`);
+	if (plugin.id === "core") fail(`${at} uses the id "core", which is core's own.`);
+	checkReservedId(value, at);
+	if (typeof plugin.schemaVersion !== "string" || !isRecord(plugin.schema) || typeof plugin.init !== "function") fail(`Plugin "${plugin.id}" needs a schemaVersion, a schema, and init.`);
+	const provides = plugin.provides;
+	if (provides !== void 0 && (!isRecord(provides) || Object.entries(provides).some(([key, flag]) => key !== "clientAuth" || flag !== true))) fail(`Plugin "${plugin.id}" may only declare provides: { clientAuth: true }.`);
+	const cli = value.cli;
+	if (cli !== void 0) {
+		if (!isRecord(cli) || Object.keys(cli).some((key) => !CLI_KEYS.has(key))) fail(`Plugin "${plugin.id}" cli may only hold clientCredential and clientPlugin.`);
+		if (cli.clientCredential !== void 0 && plugin.provides?.clientAuth !== true) fail(`Plugin "${plugin.id}" adds cli.clientCredential without declaring provides: { clientAuth: true }.`);
+	}
+	return plugin;
+};
+const checkEndpoint = (id, value) => {
+	const endpoint = isRecord(value) ? value : {};
+	if (!METHODS.has(endpoint.method) || typeof endpoint.path !== "string" || !PATH.test(endpoint.path) || endpoint.access !== "client" && endpoint.access !== "admin" || typeof endpoint.handler !== "function") fail(`Plugin "${id}" has an endpoint that needs a method, a path like /name/:param, access "client" or "admin", and a handler.`);
+	return {
+		...endpoint,
+		plugin: id
+	};
+};
+const checkInstance = (plugin, instance) => {
+	const { id } = plugin;
+	if (!isRecord(instance)) return fail(`Plugin "${id}" init returned no instance.`);
+	if (typeof instance.then === "function") fail(`Plugin "${id}" init returned a promise; init must be synchronous.`);
+	const unknown = Object.keys(instance).find((key) => !INSTANCE_KEYS.has(key));
+	if (unknown !== void 0 || !("api" in instance)) fail(`Plugin "${id}" init must return { api, endpoints?, clientAuth? }${unknown === void 0 ? "" : `, not "${unknown}"`}.`);
+	const declared = plugin.provides?.clientAuth === true;
+	const clientAuth = instance.clientAuth;
+	if (declared !== (clientAuth !== void 0)) fail(declared ? `Plugin "${id}" declares provides: { clientAuth: true } but its instance has no clientAuth.` : `Plugin "${id}" returns clientAuth without declaring provides: { clientAuth: true }.`);
+	if (clientAuth !== void 0 && (typeof clientAuth.authenticate !== "function" || !Array.isArray(clientAuth.varyHeaders) || !clientAuth.varyHeaders.every((header) => typeof header === "string"))) fail(`Plugin "${id}" clientAuth needs varyHeaders and authenticate.`);
+	const endpoints = instance.endpoints ?? [];
+	if (!Array.isArray(endpoints)) fail(`Plugin "${id}" endpoints must be an array.`);
+	return {
+		api: instance.api,
+		clientAuth,
+		endpoints: endpoints.map((endpoint) => checkEndpoint(id, endpoint))
+	};
+};
+/**
+* Checks every plugin, runs each `init` once against one engine over the
+* database, and collects APIs, endpoints, and clientAuth. Core's reads run
+* on the same engine, so plugins read core through `ctx.core`.
+*/
+const assemblePlugins = (value, database, { now = Date.now, storage = { resolveFileUrl: async () => null } } = {}) => {
+	if (!Array.isArray(value)) return fail("plugins must be an array of plugins.");
+	const plugins = value.map((plugin, position) => checkPlugin(plugin, `plugins[${position}]`));
+	const ids = /* @__PURE__ */ new Set();
+	for (const { id } of plugins) {
+		if (ids.has(id)) fail(`Plugin "${id}" is registered twice.`);
+		ids.add(id);
+	}
+	clientPluginsOf(plugins);
+	const engine = createEngine(database, {
+		plugins,
+		now
+	});
+	const { onCachedRoutesChange } = database;
+	const core = createCoreApi(engine.core, storage, {
+		now,
+		...onCachedRoutesChange === void 0 ? {} : { onCachedRoutesChange: () => onCachedRoutesChange.call(database) }
+	});
+	const reads = createCoreReads(engine.core, storage);
+	const api = {};
+	const endpoints = [];
+	let clientAuth;
+	for (const plugin of plugins) {
+		const instance = checkInstance(plugin, plugin.init({
+			db: engine.database(plugin),
+			core: reads,
+			now
+		}));
+		if (instance.clientAuth !== void 0) {
+			if (clientAuth !== void 0) fail(`Plugins "${clientAuth.plugin}" and "${plugin.id}" both provide clientAuth; keep one.`);
+			const provided = instance.clientAuth;
+			clientAuth = {
+				plugin: plugin.id,
+				varyHeaders: provided.varyHeaders,
+				authenticate: (headers) => provided.authenticate(headers)
+			};
+		}
+		endpoints.push(...instance.endpoints);
+		api[plugin.id] = instance.api;
+	}
+	return {
+		core,
+		api,
+		endpoints,
+		...clientAuth === void 0 ? {} : { clientAuth },
+		flush: engine.flush
+	};
+};
+//#endregion
+export { HotUpdaterConfigError, assemblePlugins };

package/dist/assembly/clientPlugins.cjs

@@ -0,0 +1,88 @@
+const require_official = require("../plugins/official.cjs");
+let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
+//#region src/assembly/clientPlugins.ts
+const EXPORT_NAME = /^[A-Za-z_$][\w$]*$/u;
+/**
+* Names app code cannot import as they are: reserved words, and the names
+* the printed app code declares itself.
+*/
+const UNAVAILABLE_NAMES = /* @__PURE__ */ new Set([
+	"App",
+	"HotUpdater",
+	"arguments",
+	"await",
+	"break",
+	"case",
+	"catch",
+	"class",
+	"const",
+	"continue",
+	"debugger",
+	"default",
+	"delete",
+	"do",
+	"else",
+	"enum",
+	"eval",
+	"export",
+	"extends",
+	"false",
+	"finally",
+	"for",
+	"function",
+	"if",
+	"implements",
+	"import",
+	"in",
+	"instanceof",
+	"interface",
+	"let",
+	"new",
+	"null",
+	"package",
+	"private",
+	"protected",
+	"public",
+	"return",
+	"static",
+	"super",
+	"switch",
+	"this",
+	"throw",
+	"true",
+	"try",
+	"typeof",
+	"var",
+	"void",
+	"while",
+	"with",
+	"yield"
+]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The client plugins an app adds for the plugins, each once, in plugin
+* order: what init prints in `HotUpdater.init`'s `plugins`. A malformed one,
+* or one name from two modules, throws `HotUpdaterConfigError`.
+*/
+const clientPluginsOf = (plugins) => {
+	if (!Array.isArray(plugins)) throw new _hot_updater_plugin_core.HotUpdaterConfigError("plugins must be an array of plugins.");
+	const found = [];
+	plugins.forEach((plugin, position) => require_official.checkReservedId(plugin, `plugins[${position}]`));
+	for (const plugin of plugins) {
+		if (!isRecord(plugin) || !isRecord(plugin.cli)) continue;
+		const value = plugin.cli.clientPlugin;
+		if (value === void 0) continue;
+		const id = String(plugin.id);
+		if (!isRecord(value) || typeof value.module !== "string" || value.module === "" || typeof value.name !== "string" || !EXPORT_NAME.test(value.name) || UNAVAILABLE_NAMES.has(value.name)) throw new _hot_updater_plugin_core.HotUpdaterConfigError(`Plugin "${id}" cli.clientPlugin needs a module and an export name the app can import: an identifier other than a reserved word, App, or HotUpdater.`);
+		const { module, name } = value;
+		const named = found.find((entry) => entry.name === name);
+		if (named === void 0) found.push({
+			module,
+			name
+		});
+		else if (named.module !== module) throw new _hot_updater_plugin_core.HotUpdaterConfigError(`Plugin "${id}" names the client plugin "${name}" from ${module}, but another plugin names it from ${named.module}.`);
+	}
+	return found;
+};
+//#endregion
+exports.clientPluginsOf = clientPluginsOf;

package/dist/assembly/clientPlugins.mjs

@@ -0,0 +1,88 @@
+import { HotUpdaterConfigError } from "./configError.mjs";
+import { checkReservedId } from "../plugins/official.mjs";
+//#region src/assembly/clientPlugins.ts
+const EXPORT_NAME = /^[A-Za-z_$][\w$]*$/u;
+/**
+* Names app code cannot import as they are: reserved words, and the names
+* the printed app code declares itself.
+*/
+const UNAVAILABLE_NAMES = /* @__PURE__ */ new Set([
+	"App",
+	"HotUpdater",
+	"arguments",
+	"await",
+	"break",
+	"case",
+	"catch",
+	"class",
+	"const",
+	"continue",
+	"debugger",
+	"default",
+	"delete",
+	"do",
+	"else",
+	"enum",
+	"eval",
+	"export",
+	"extends",
+	"false",
+	"finally",
+	"for",
+	"function",
+	"if",
+	"implements",
+	"import",
+	"in",
+	"instanceof",
+	"interface",
+	"let",
+	"new",
+	"null",
+	"package",
+	"private",
+	"protected",
+	"public",
+	"return",
+	"static",
+	"super",
+	"switch",
+	"this",
+	"throw",
+	"true",
+	"try",
+	"typeof",
+	"var",
+	"void",
+	"while",
+	"with",
+	"yield"
+]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The client plugins an app adds for the plugins, each once, in plugin
+* order: what init prints in `HotUpdater.init`'s `plugins`. A malformed one,
+* or one name from two modules, throws `HotUpdaterConfigError`.
+*/
+const clientPluginsOf = (plugins) => {
+	if (!Array.isArray(plugins)) throw new HotUpdaterConfigError("plugins must be an array of plugins.");
+	const found = [];
+	plugins.forEach((plugin, position) => checkReservedId(plugin, `plugins[${position}]`));
+	for (const plugin of plugins) {
+		if (!isRecord(plugin) || !isRecord(plugin.cli)) continue;
+		const value = plugin.cli.clientPlugin;
+		if (value === void 0) continue;
+		const id = String(plugin.id);
+		if (!isRecord(value) || typeof value.module !== "string" || value.module === "" || typeof value.name !== "string" || !EXPORT_NAME.test(value.name) || UNAVAILABLE_NAMES.has(value.name)) throw new HotUpdaterConfigError(`Plugin "${id}" cli.clientPlugin needs a module and an export name the app can import: an identifier other than a reserved word, App, or HotUpdater.`);
+		const { module, name } = value;
+		const named = found.find((entry) => entry.name === name);
+		if (named === void 0) found.push({
+			module,
+			name
+		});
+		else if (named.module !== module) throw new HotUpdaterConfigError(`Plugin "${id}" names the client plugin "${name}" from ${module}, but another plugin names it from ${named.module}.`);
+	}
+	return found;
+};
+//#endregion
+export { clientPluginsOf };

package/dist/assembly/configError.d.cts

@@ -0,0 +1,2 @@
+import { HotUpdaterConfigError } from "@hot-updater/plugin-core";
+export { HotUpdaterConfigError };

package/dist/assembly/configError.d.mts

@@ -0,0 +1,2 @@
+import { HotUpdaterConfigError } from "@hot-updater/plugin-core";
+export { HotUpdaterConfigError };

package/dist/assembly/configError.mjs

@@ -0,0 +1,2 @@
+import { HotUpdaterConfigError } from "@hot-updater/plugin-core";
+export { HotUpdaterConfigError };

package/dist/core/api.cjs

@@ -0,0 +1,51 @@
+const require_reads = require("./reads.cjs");
+const require_operations = require("./operations.cjs");
+//#region src/core/api.ts
+/**
+* The update check answers from one Release Catalog row, so a transaction
+* changes what the cacheable client routes answer only when it writes one.
+* The purge runs once, after the attempt that commits.
+*/
+const purgingCachedRoutes = (db, onCachedRoutesChange) => {
+	if (onCachedRoutesChange === void 0) return db;
+	return {
+		...db,
+		async transaction(fn) {
+			let changed = false;
+			const result = await db.transaction((tx) => {
+				changed = false;
+				return fn({
+					...tx,
+					create: (model, row) => {
+						changed ||= model === "release_catalogs";
+						tx.create(model, row);
+					},
+					update: (model, row, set) => {
+						changed ||= model === "release_catalogs";
+						tx.update(model, row, set);
+					},
+					delete: (model, row) => {
+						changed ||= model === "release_catalogs";
+						return tx.delete(model, row);
+					}
+				});
+			});
+			if (changed) await onCachedRoutesChange();
+			return result;
+		}
+	};
+};
+/** Core's reads and typed writes over one database handle. */
+const createCoreApi = (db, storage, options = {}) => {
+	const reads = require_reads.createCoreReads(db, storage);
+	return {
+		...reads,
+		...require_operations.createCoreOperations(purgingCachedRoutes(db, options.onCachedRoutesChange), options),
+		/** One read, which checks the schema settings first. */
+		ready: async () => {
+			await reads.listReleaseCatalogs({ limit: 1 });
+		}
+	};
+};
+//#endregion
+exports.createCoreApi = createCoreApi;

package/dist/core/api.d.cts

@@ -0,0 +1,54 @@
+import { CoreDatabase, CoreStorage } from "./reads.cjs";
+//#region src/core/api.d.ts
+interface CoreApiOptions {
+  readonly now?: () => number;
+  /** The database's CDN purge, called after a write that changes a Release Catalog. */
+  readonly onCachedRoutesChange?: () => Promise<void>;
+}
+/** Core's reads and typed writes over one database handle. */
+declare const createCoreApi: (db: CoreDatabase, storage: CoreStorage, options?: CoreApiOptions) => {
+  /** One read, which checks the schema settings first. */
+  ready: () => Promise<void>;
+  deploy: (deployments: readonly import("@hot-updater/plugin-core").Deployment[]) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationResult[]>;
+  updateReleasePolicy: (input: import("@hot-updater/plugin-core").ReleaseTarget & {
+    readonly patch: import("@hot-updater/plugin-core").ReleasePolicyPatch;
+  }) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationResult>;
+  preflightReleasePolicy: (input: import("@hot-updater/plugin-core").ReleaseTarget & {
+    readonly patch: import("@hot-updater/plugin-core").ReleasePolicyPatch;
+  }) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationPreflight>;
+  deleteRelease: (input: import("@hot-updater/plugin-core").ReleaseTarget) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationResult>;
+  promoteRelease: (input: import("@hot-updater/plugin-core").ReleaseTarget & {
+    readonly targetChannel: string;
+    readonly action?: "copy" | "move";
+  }) => Promise<import("@hot-updater/plugin-core").PromoteReleaseResult>;
+  rebuildReleaseCatalog: (scopeKey: string) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogRebuildResult>;
+  preflightReleaseCatalogRebuild: (scopeKey: string) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogRebuildPreflight>;
+  ensureChannel: (name: string) => Promise<import("@hot-updater/plugin-core").ChannelRow>;
+  deleteChannel: (id: string) => Promise<import("@hot-updater/plugin-core").ChannelDeleteResult>;
+  updateBundle: (id: string, update: Partial<Omit<import("@hot-updater/protocol").Bundle, "id" | "patches">> & {
+    readonly patches?: import("@hot-updater/protocol").Bundle["patches"];
+  }) => Promise<void>;
+  deleteBundles: (ids: readonly string[]) => Promise<void>;
+  getReleaseCatalog(input: import("@hot-updater/plugin-core").ReleaseCatalogRequest): Promise<import("@hot-updater/protocol").ReleaseCatalog | null>;
+  getArtifactInfo(targetBundleId: string, currentBundleId: string, artifactProtocolVersion: 1): Promise<import("@hot-updater/protocol").ArtifactInfo | null>;
+  getBundle(id: string): Promise<import("@hot-updater/plugin-core").BundleDetail | null>;
+  countBundleChildren(baseBundleIds: readonly string[]): Promise<Record<string, number>>;
+  listPatchesFromBase(baseBundleId: string, input: import("@hot-updater/plugin-core").KeysetInput): Promise<import("@hot-updater/plugin-core").BundlePatchRow[]>;
+  listBundles(input: import("@hot-updater/plugin-core").KeysetInput & {
+    readonly platform?: "ios" | "android";
+  }): Promise<import("@hot-updater/plugin-core").BundleDetail[]>;
+  countBundles(platform?: "ios" | "android"): Promise<number>;
+  findBaseBundleIds(candidateKey: string, bundleId: string, limit: number): Promise<string[]>;
+  getRelease(id: string): Promise<import("@hot-updater/plugin-core").ReleaseRow | null>;
+  listReleases(input: import("@hot-updater/plugin-core").KeysetInput & {
+    readonly filter: import("@hot-updater/plugin-core").ReleaseFilter;
+  }): Promise<import("@hot-updater/plugin-core").ReleaseRow[]>;
+  latestReleaseId(scopeKey: string): Promise<string | null>;
+  getReleaseCatalogRow(scopeKey: string): Promise<import("@hot-updater/plugin-core").ReleaseCatalogRow | null>;
+  listReleaseCatalogs(input: import("@hot-updater/plugin-core").KeysetInput): Promise<import("@hot-updater/plugin-core").ReleaseCatalogRow[]>;
+  listChannels(): Promise<import("@hot-updater/plugin-core").ChannelRow[]>;
+  findChannelByName(name: string): Promise<import("@hot-updater/plugin-core").ChannelRow | null>;
+};
+type CoreApi = ReturnType<typeof createCoreApi>;
+//#endregion
+export { CoreApi, CoreApiOptions, createCoreApi };

package/dist/core/api.d.mts

@@ -0,0 +1,54 @@
+import { CoreDatabase, CoreStorage } from "./reads.mjs";
+//#region src/core/api.d.ts
+interface CoreApiOptions {
+  readonly now?: () => number;
+  /** The database's CDN purge, called after a write that changes a Release Catalog. */
+  readonly onCachedRoutesChange?: () => Promise<void>;
+}
+/** Core's reads and typed writes over one database handle. */
+declare const createCoreApi: (db: CoreDatabase, storage: CoreStorage, options?: CoreApiOptions) => {
+  /** One read, which checks the schema settings first. */
+  ready: () => Promise<void>;
+  deploy: (deployments: readonly import("@hot-updater/plugin-core").Deployment[]) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationResult[]>;
+  updateReleasePolicy: (input: import("@hot-updater/plugin-core").ReleaseTarget & {
+    readonly patch: import("@hot-updater/plugin-core").ReleasePolicyPatch;
+  }) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationResult>;
+  preflightReleasePolicy: (input: import("@hot-updater/plugin-core").ReleaseTarget & {
+    readonly patch: import("@hot-updater/plugin-core").ReleasePolicyPatch;
+  }) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationPreflight>;
+  deleteRelease: (input: import("@hot-updater/plugin-core").ReleaseTarget) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogMutationResult>;
+  promoteRelease: (input: import("@hot-updater/plugin-core").ReleaseTarget & {
+    readonly targetChannel: string;
+    readonly action?: "copy" | "move";
+  }) => Promise<import("@hot-updater/plugin-core").PromoteReleaseResult>;
+  rebuildReleaseCatalog: (scopeKey: string) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogRebuildResult>;
+  preflightReleaseCatalogRebuild: (scopeKey: string) => Promise<import("@hot-updater/plugin-core").ReleaseCatalogRebuildPreflight>;
+  ensureChannel: (name: string) => Promise<import("@hot-updater/plugin-core").ChannelRow>;
+  deleteChannel: (id: string) => Promise<import("@hot-updater/plugin-core").ChannelDeleteResult>;
+  updateBundle: (id: string, update: Partial<Omit<import("@hot-updater/protocol").Bundle, "id" | "patches">> & {
+    readonly patches?: import("@hot-updater/protocol").Bundle["patches"];
+  }) => Promise<void>;
+  deleteBundles: (ids: readonly string[]) => Promise<void>;
+  getReleaseCatalog(input: import("@hot-updater/plugin-core").ReleaseCatalogRequest): Promise<import("@hot-updater/protocol").ReleaseCatalog | null>;
+  getArtifactInfo(targetBundleId: string, currentBundleId: string, artifactProtocolVersion: 1): Promise<import("@hot-updater/protocol").ArtifactInfo | null>;
+  getBundle(id: string): Promise<import("@hot-updater/plugin-core").BundleDetail | null>;
+  countBundleChildren(baseBundleIds: readonly string[]): Promise<Record<string, number>>;
+  listPatchesFromBase(baseBundleId: string, input: import("@hot-updater/plugin-core").KeysetInput): Promise<import("@hot-updater/plugin-core").BundlePatchRow[]>;
+  listBundles(input: import("@hot-updater/plugin-core").KeysetInput & {
+    readonly platform?: "ios" | "android";
+  }): Promise<import("@hot-updater/plugin-core").BundleDetail[]>;
+  countBundles(platform?: "ios" | "android"): Promise<number>;
+  findBaseBundleIds(candidateKey: string, bundleId: string, limit: number): Promise<string[]>;
+  getRelease(id: string): Promise<import("@hot-updater/plugin-core").ReleaseRow | null>;
+  listReleases(input: import("@hot-updater/plugin-core").KeysetInput & {
+    readonly filter: import("@hot-updater/plugin-core").ReleaseFilter;
+  }): Promise<import("@hot-updater/plugin-core").ReleaseRow[]>;
+  latestReleaseId(scopeKey: string): Promise<string | null>;
+  getReleaseCatalogRow(scopeKey: string): Promise<import("@hot-updater/plugin-core").ReleaseCatalogRow | null>;
+  listReleaseCatalogs(input: import("@hot-updater/plugin-core").KeysetInput): Promise<import("@hot-updater/plugin-core").ReleaseCatalogRow[]>;
+  listChannels(): Promise<import("@hot-updater/plugin-core").ChannelRow[]>;
+  findChannelByName(name: string): Promise<import("@hot-updater/plugin-core").ChannelRow | null>;
+};
+type CoreApi = ReturnType<typeof createCoreApi>;
+//#endregion
+export { CoreApi, CoreApiOptions, createCoreApi };

package/dist/core/api.mjs

@@ -0,0 +1,51 @@
+import { createCoreReads } from "./reads.mjs";
+import { createCoreOperations } from "./operations.mjs";
+//#region src/core/api.ts
+/**
+* The update check answers from one Release Catalog row, so a transaction
+* changes what the cacheable client routes answer only when it writes one.
+* The purge runs once, after the attempt that commits.
+*/
+const purgingCachedRoutes = (db, onCachedRoutesChange) => {
+	if (onCachedRoutesChange === void 0) return db;
+	return {
+		...db,
+		async transaction(fn) {
+			let changed = false;
+			const result = await db.transaction((tx) => {
+				changed = false;
+				return fn({
+					...tx,
+					create: (model, row) => {
+						changed ||= model === "release_catalogs";
+						tx.create(model, row);
+					},
+					update: (model, row, set) => {
+						changed ||= model === "release_catalogs";
+						tx.update(model, row, set);
+					},
+					delete: (model, row) => {
+						changed ||= model === "release_catalogs";
+						return tx.delete(model, row);
+					}
+				});
+			});
+			if (changed) await onCachedRoutesChange();
+			return result;
+		}
+	};
+};
+/** Core's reads and typed writes over one database handle. */
+const createCoreApi = (db, storage, options = {}) => {
+	const reads = createCoreReads(db, storage);
+	return {
+		...reads,
+		...createCoreOperations(purgingCachedRoutes(db, options.onCachedRoutesChange), options),
+		/** One read, which checks the schema settings first. */
+		ready: async () => {
+			await reads.listReleaseCatalogs({ limit: 1 });
+		}
+	};
+};
+//#endregion
+export { createCoreApi };

package/dist/core/baseCandidates.cjs

@@ -0,0 +1,28 @@
+const require_releaseCatalog = require("../db/releaseCatalog.cjs");
+let verkit = require("verkit");
+//#region src/core/baseCandidates.ts
+/** A compiled segment as a range: its version when it holds exactly one. */
+const segmentRange = ({ lower, upper }) => lower?.inclusive && upper?.inclusive && lower.version === upper.version ? lower.version : [lower === null ? "" : `${lower.inclusive ? ">=" : ">"}${lower.version}`, upper === null ? "" : `${upper.inclusive ? "<=" : "<"}${upper.version}`].join(" ").trim() || "*";
+/**
+* Auto-patch bases from a scope's compiled Release Catalog, which holds
+* every enabled bundle release of the scope: those whose range intersects
+* `range` (all of them in a fingerprint scope), newest release first, each
+* bundle once and older than `bundleId`, at most `limit`.
+*/
+const baseBundleIdsOf = (row, range, bundleId, limit) => {
+	const catalog = require_releaseCatalog.parseCompiledCatalog(row.payload, row.strategy);
+	const serving = new Set(catalog.strategy === "FINGERPRINT" ? catalog.rollbackReleaseIndexes : catalog.segments.flatMap((segment) => range !== null && (0, verkit.rangesIntersect)(range, segmentRange(segment)) ? segment.rollbackReleaseIndexes : []));
+	const newestFirst = catalog.releaseDescriptors.map((descriptor, index) => ({
+		descriptor,
+		index
+	})).sort((left, right) => left.descriptor.releaseId < right.descriptor.releaseId ? 1 : -1);
+	const ids = [];
+	for (const { descriptor, index } of newestFirst) {
+		if (ids.length >= limit) break;
+		const id = descriptor.bundleId;
+		if (serving.has(index) && descriptor.kind === "BUNDLE" && id !== null && id < bundleId && !ids.includes(id)) ids.push(id);
+	}
+	return ids;
+};
+//#endregion
+exports.baseBundleIdsOf = baseBundleIdsOf;

package/dist/core/baseCandidates.mjs

@@ -0,0 +1,28 @@
+import { parseCompiledCatalog } from "../db/releaseCatalog.mjs";
+import { rangesIntersect } from "verkit";
+//#region src/core/baseCandidates.ts
+/** A compiled segment as a range: its version when it holds exactly one. */
+const segmentRange = ({ lower, upper }) => lower?.inclusive && upper?.inclusive && lower.version === upper.version ? lower.version : [lower === null ? "" : `${lower.inclusive ? ">=" : ">"}${lower.version}`, upper === null ? "" : `${upper.inclusive ? "<=" : "<"}${upper.version}`].join(" ").trim() || "*";
+/**
+* Auto-patch bases from a scope's compiled Release Catalog, which holds
+* every enabled bundle release of the scope: those whose range intersects
+* `range` (all of them in a fingerprint scope), newest release first, each
+* bundle once and older than `bundleId`, at most `limit`.
+*/
+const baseBundleIdsOf = (row, range, bundleId, limit) => {
+	const catalog = parseCompiledCatalog(row.payload, row.strategy);
+	const serving = new Set(catalog.strategy === "FINGERPRINT" ? catalog.rollbackReleaseIndexes : catalog.segments.flatMap((segment) => range !== null && rangesIntersect(range, segmentRange(segment)) ? segment.rollbackReleaseIndexes : []));
+	const newestFirst = catalog.releaseDescriptors.map((descriptor, index) => ({
+		descriptor,
+		index
+	})).sort((left, right) => left.descriptor.releaseId < right.descriptor.releaseId ? 1 : -1);
+	const ids = [];
+	for (const { descriptor, index } of newestFirst) {
+		if (ids.length >= limit) break;
+		const id = descriptor.bundleId;
+		if (serving.has(index) && descriptor.kind === "BUNDLE" && id !== null && id < bundleId && !ids.includes(id)) ids.push(id);
+	}
+	return ids;
+};
+//#endregion
+export { baseBundleIdsOf };