@hot-updater/server 1.0.0-rc.42 → 1.0.0-rc.44

package/dist/createHotUpdaterCore.cjs

@@ -19,17 +19,21 @@ const databaseOf = (value) => {
 	}
 	throw new _hot_updater_plugin_core.HotUpdaterConfigError("database must be a Hot Updater 1.0 database, such as kyselyAdapter(...) or postgres(...). Upgrade the provider package that created it.");
 };
-/** `"public"`, or nothing; a `clientAccess` object says what replaced it. */
+/** The configured storage, when it is a storage adapter. */
+const storageOf = (value) => {
+	if (isRecord(value) && typeof value.name === "string" && typeof value.protocol === "string") return value;
+	throw new _hot_updater_plugin_core.HotUpdaterConfigError("storage must be a storage adapter, such as s3Storage(...): the one hot-updater.config.ts uploads with.");
+};
+/** `"public"`, or nothing. */
 const isPublic = (value) => {
 	if (value === void 0) return false;
 	if (value === "public") return true;
-	throw new _hot_updater_plugin_core.HotUpdaterConfigError(isRecord(value) ? "clientAccess objects were removed in 1.0. Set clientAccess: \"public\", or add a plugin that provides clientAuth to plugins." : "clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
+	throw new _hot_updater_plugin_core.HotUpdaterConfigError("clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
 };
 function createHotUpdater(options) {
-	for (const key of ["authorityId", "catalogId"]) if (Object.hasOwn(options, key)) throw new TypeError(`Remove ${key} from createHotUpdater options. Catalog identity is managed internally.`);
 	const database = databaseOf(options.database);
-	const storage = Object.freeze([...options.storage ?? []]);
-	const { downloadStorageObject, readStorageText, resolveFileUrl } = require_storageAccess.createStorageAccess(storage);
+	const storage = storageOf(options.storage);
+	const { readStorageText, resolveFileUrl } = require_storageAccess.createStorageAccess(storage);
 	const publicClients = isPublic(options.clientAccess);
 	const configured = Object.freeze([...options.plugins ?? []]);
 	const plugins = require_assemblePlugins.assemblePlugins(configured, database, { storage: {
@@ -48,7 +52,6 @@ function createHotUpdater(options) {
 	const handlers = require_handler.createHotUpdaterHandlers({
 		api: { core: plugins.core },
 		...clientPolicy === void 0 ? {} : { clientPolicy },
-		downloadStorageObject,
 		endpoints: plugins.endpoints,
 		plugins: Object.keys(plugins.api)
 	});
@@ -57,7 +60,7 @@ function createHotUpdater(options) {
 		adapterName: database.name,
 		get handlers() {
 			if (!serving) {
-				for (const adapter of storage) (0, _hot_updater_plugin_core.assertStorageOperations)(adapter, ["get", "getDownloadUrl"]);
+				(0, _hot_updater_plugin_core.assertStorageOperations)(storage, ["get", "getDownloadUrl"]);
 				serving = true;
 			}
 			return handlers;

package/dist/createHotUpdaterCore.d.cts

@@ -24,10 +24,10 @@ interface ClientAuthProvider {
 }
 type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly AnyHotUpdaterPlugin[]> = {
   /**
-   * The routes a host mounts. On first access every storage adapter must
-   * serve downloads (`get` and `getDownloadUrl`), so a server fails where it
+   * The routes a host mounts. On first access the storage must serve
+   * downloads (`get` and `getDownloadUrl`), so a server fails where it
    * mounts them, while tooling that only reads the definition, such as the
-   * CLI, can list storage that only uploads.
+   * CLI, can configure storage that only uploads.
    */
   readonly handlers: HotUpdaterHandlers;
   /**
@@ -54,8 +54,8 @@ type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = read
    * closes it (`dispose`).
    */
   readonly database: ToolingDatabase;
-  /** The storage as configured, in order, as a frozen copy. */
-  readonly storage: readonly StorageAdapter[];
+  /** The storage as configured. */
+  readonly storage: StorageAdapter;
   /** The plugins as configured, as a frozen copy, whose tables tooling creates. */
   readonly plugins: TPlugins;
   /**
@@ -72,18 +72,8 @@ type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = read
   readonly clientAuth?: ClientAuthProvider;
 };
 type HotUpdaterAPI = RuntimeHotUpdaterAPI;
-declare const REMOVED_CLIENT_ACCESS = "clientAccess objects were removed in 1.0: set clientAccess: \"public\", or add a plugin that provides clientAuth";
-/**
- * A `clientAccess` object from before 1.0. Its `type` names the fix, so
- * TypeScript reports it where the object is written.
- */
-interface RemovedClientAccess {
-  readonly type: typeof REMOVED_CLIENT_ACCESS;
-  readonly headerName?: string;
-}
-type ClientAccessPolicy =
 /** Leaves client routes public; required when no plugin provides clientAuth. */
-"public" | RemovedClientAccess;
+type ClientAccessPolicy = "public";
 type ProvidesClientAuth<TPlugin> = TPlugin extends {
   readonly provides?: infer TProvides;
 } ? TProvides extends {
@@ -113,13 +103,14 @@ type CreateHotUpdaterOptions<TPlugins extends readonly AnyHotUpdaterPlugin[] = r
   /** A provider's database on the storage engine, such as `kyselyAdapter(...)` or `postgres(...)`. */
   readonly database: ToolingDatabase;
   /**
-   * Where bundles are stored: the server reads and signs the URIs of each
-   * adapter's protocol.
+   * Where bundles are stored, the same adapter `hot-updater.config.ts`
+   * uploads with: the server reads the URIs of its protocol and returns
+   * their download URLs.
    */
-  readonly storage?: readonly StorageAdapter[];
+  readonly storage: StorageAdapter;
   /** The plugins the server runs; at most one provides clientAuth. Defaults to none. */
   readonly plugins?: TPlugins;
 } & ClientAccessRule<TPlugins>;
 declare function createHotUpdater<const TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly []>(options: CreateHotUpdaterOptions<TPlugins>): RuntimeHotUpdaterAPI<NoInfer<TPlugins>>;
 //#endregion
-export { ClientAccessPolicy, ClientAccessRule, ClientAuthProvider, ClientEndpoint, CreateHotUpdaterOptions, HotUpdaterAPI, RemovedClientAccess, RuntimeHotUpdaterAPI, createHotUpdater };
+export { ClientAccessPolicy, ClientAccessRule, ClientAuthProvider, ClientEndpoint, CreateHotUpdaterOptions, HotUpdaterAPI, RuntimeHotUpdaterAPI, createHotUpdater };

package/dist/createHotUpdaterCore.d.mts

@@ -24,10 +24,10 @@ interface ClientAuthProvider {
 }
 type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly AnyHotUpdaterPlugin[]> = {
   /**
-   * The routes a host mounts. On first access every storage adapter must
-   * serve downloads (`get` and `getDownloadUrl`), so a server fails where it
+   * The routes a host mounts. On first access the storage must serve
+   * downloads (`get` and `getDownloadUrl`), so a server fails where it
    * mounts them, while tooling that only reads the definition, such as the
-   * CLI, can list storage that only uploads.
+   * CLI, can configure storage that only uploads.
    */
   readonly handlers: HotUpdaterHandlers;
   /**
@@ -54,8 +54,8 @@ type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = read
    * closes it (`dispose`).
    */
   readonly database: ToolingDatabase;
-  /** The storage as configured, in order, as a frozen copy. */
-  readonly storage: readonly StorageAdapter[];
+  /** The storage as configured. */
+  readonly storage: StorageAdapter;
   /** The plugins as configured, as a frozen copy, whose tables tooling creates. */
   readonly plugins: TPlugins;
   /**
@@ -72,18 +72,8 @@ type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = read
   readonly clientAuth?: ClientAuthProvider;
 };
 type HotUpdaterAPI = RuntimeHotUpdaterAPI;
-declare const REMOVED_CLIENT_ACCESS = "clientAccess objects were removed in 1.0: set clientAccess: \"public\", or add a plugin that provides clientAuth";
-/**
- * A `clientAccess` object from before 1.0. Its `type` names the fix, so
- * TypeScript reports it where the object is written.
- */
-interface RemovedClientAccess {
-  readonly type: typeof REMOVED_CLIENT_ACCESS;
-  readonly headerName?: string;
-}
-type ClientAccessPolicy =
 /** Leaves client routes public; required when no plugin provides clientAuth. */
-"public" | RemovedClientAccess;
+type ClientAccessPolicy = "public";
 type ProvidesClientAuth<TPlugin> = TPlugin extends {
   readonly provides?: infer TProvides;
 } ? TProvides extends {
@@ -113,13 +103,14 @@ type CreateHotUpdaterOptions<TPlugins extends readonly AnyHotUpdaterPlugin[] = r
   /** A provider's database on the storage engine, such as `kyselyAdapter(...)` or `postgres(...)`. */
   readonly database: ToolingDatabase;
   /**
-   * Where bundles are stored: the server reads and signs the URIs of each
-   * adapter's protocol.
+   * Where bundles are stored, the same adapter `hot-updater.config.ts`
+   * uploads with: the server reads the URIs of its protocol and returns
+   * their download URLs.
    */
-  readonly storage?: readonly StorageAdapter[];
+  readonly storage: StorageAdapter;
   /** The plugins the server runs; at most one provides clientAuth. Defaults to none. */
   readonly plugins?: TPlugins;
 } & ClientAccessRule<TPlugins>;
 declare function createHotUpdater<const TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly []>(options: CreateHotUpdaterOptions<TPlugins>): RuntimeHotUpdaterAPI<NoInfer<TPlugins>>;
 //#endregion
-export { ClientAccessPolicy, ClientAccessRule, ClientAuthProvider, ClientEndpoint, CreateHotUpdaterOptions, HotUpdaterAPI, RemovedClientAccess, RuntimeHotUpdaterAPI, createHotUpdater };
+export { ClientAccessPolicy, ClientAccessRule, ClientAuthProvider, ClientEndpoint, CreateHotUpdaterOptions, HotUpdaterAPI, RuntimeHotUpdaterAPI, createHotUpdater };

package/dist/createHotUpdaterCore.mjs

@@ -20,17 +20,21 @@ const databaseOf = (value) => {
 	}
 	throw new HotUpdaterConfigError("database must be a Hot Updater 1.0 database, such as kyselyAdapter(...) or postgres(...). Upgrade the provider package that created it.");
 };
-/** `"public"`, or nothing; a `clientAccess` object says what replaced it. */
+/** The configured storage, when it is a storage adapter. */
+const storageOf = (value) => {
+	if (isRecord(value) && typeof value.name === "string" && typeof value.protocol === "string") return value;
+	throw new HotUpdaterConfigError("storage must be a storage adapter, such as s3Storage(...): the one hot-updater.config.ts uploads with.");
+};
+/** `"public"`, or nothing. */
 const isPublic = (value) => {
 	if (value === void 0) return false;
 	if (value === "public") return true;
-	throw new HotUpdaterConfigError(isRecord(value) ? "clientAccess objects were removed in 1.0. Set clientAccess: \"public\", or add a plugin that provides clientAuth to plugins." : "clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
+	throw new HotUpdaterConfigError("clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
 };
 function createHotUpdater(options) {
-	for (const key of ["authorityId", "catalogId"]) if (Object.hasOwn(options, key)) throw new TypeError(`Remove ${key} from createHotUpdater options. Catalog identity is managed internally.`);
 	const database = databaseOf(options.database);
-	const storage = Object.freeze([...options.storage ?? []]);
-	const { downloadStorageObject, readStorageText, resolveFileUrl } = createStorageAccess(storage);
+	const storage = storageOf(options.storage);
+	const { readStorageText, resolveFileUrl } = createStorageAccess(storage);
 	const publicClients = isPublic(options.clientAccess);
 	const configured = Object.freeze([...options.plugins ?? []]);
 	const plugins = assemblePlugins(configured, database, { storage: {
@@ -49,7 +53,6 @@ function createHotUpdater(options) {
 	const handlers = createHotUpdaterHandlers({
 		api: { core: plugins.core },
 		...clientPolicy === void 0 ? {} : { clientPolicy },
-		downloadStorageObject,
 		endpoints: plugins.endpoints,
 		plugins: Object.keys(plugins.api)
 	});
@@ -58,7 +61,7 @@ function createHotUpdater(options) {
 		adapterName: database.name,
 		get handlers() {
 			if (!serving) {
-				for (const adapter of storage) assertStorageOperations(adapter, ["get", "getDownloadUrl"]);
+				assertStorageOperations(storage, ["get", "getDownloadUrl"]);
 				serving = true;
 			}
 			return handlers;

package/dist/handler.cjs

@@ -18,8 +18,8 @@ const errorResponse = (error, status) => Response.json({ error }, {
 	headers: { "cache-control": "private, no-store" },
 	status
 });
-/** `/version` and storage downloads never pass through the client policy. */
-const PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version", "downloadStorageObject"]);
+/** `/version` never passes through the client policy. */
+const PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version"]);
 const routesOf = Symbol.for("@hot-updater/server/routes");
 const withVary = (response, varyHeaders) => {
 	const cacheControl = response.headers.get("cache-control") ?? "";
@@ -64,26 +64,11 @@ const createRequestHandler = ({ api, clientPolicy, privateResponses = false, rou
 		});
 	}
 };
-const createDownloadStorageRouteHandler = (downloadStorageObject) => async (params) => {
-	const token = params.token;
-	const signature = params.signature;
-	if (!token || !signature) return errorResponse("Not found", 404);
-	const response = await downloadStorageObject(token, signature);
-	if (!response) return errorResponse("Not found", 404);
-	const headers = new Headers(response.headers);
-	if (!headers.has("cache-control")) headers.set("cache-control", "public, max-age=31536000, immutable");
-	return new Response(response.body, {
-		headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-};
-function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, endpoints = [], plugins = [] }) {
+function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins = [] }) {
 	const routeHandlers = {
 		...require_handlerVersionRoutes.createVersionRouteHandlers(plugins),
 		...require_handlerReleaseCatalogRoutes.createReleaseCatalogRouteHandlers(),
-		...require_handlerAdminRoutes.createAdminRouteHandlers(),
-		...downloadStorageObject === void 0 ? {} : { downloadStorageObject: createDownloadStorageRouteHandler(downloadStorageObject) }
+		...require_handlerAdminRoutes.createAdminRouteHandlers()
 	};
 	const routes = [];
 	const shapes = /* @__PURE__ */ new Map();
@@ -102,7 +87,6 @@ function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, en
 	const clientRouter = require_internalRouter.createRouter();
 	const addClientRoute = mount(clientRouter, false);
 	addClientRoute("GET", "/version", "version");
-	if (downloadStorageObject !== void 0) addClientRoute("GET", "/storage/:token/:signature", "downloadStorageObject");
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");

package/dist/handler.mjs

@@ -19,8 +19,8 @@ const errorResponse = (error, status) => Response.json({ error }, {
 	headers: { "cache-control": "private, no-store" },
 	status
 });
-/** `/version` and storage downloads never pass through the client policy. */
-const PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version", "downloadStorageObject"]);
+/** `/version` never passes through the client policy. */
+const PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version"]);
 const routesOf = Symbol.for("@hot-updater/server/routes");
 const withVary = (response, varyHeaders) => {
 	const cacheControl = response.headers.get("cache-control") ?? "";
@@ -65,26 +65,11 @@ const createRequestHandler = ({ api, clientPolicy, privateResponses = false, rou
 		});
 	}
 };
-const createDownloadStorageRouteHandler = (downloadStorageObject) => async (params) => {
-	const token = params.token;
-	const signature = params.signature;
-	if (!token || !signature) return errorResponse("Not found", 404);
-	const response = await downloadStorageObject(token, signature);
-	if (!response) return errorResponse("Not found", 404);
-	const headers = new Headers(response.headers);
-	if (!headers.has("cache-control")) headers.set("cache-control", "public, max-age=31536000, immutable");
-	return new Response(response.body, {
-		headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-};
-function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, endpoints = [], plugins = [] }) {
+function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins = [] }) {
 	const routeHandlers = {
 		...createVersionRouteHandlers(plugins),
 		...createReleaseCatalogRouteHandlers(),
-		...createAdminRouteHandlers(),
-		...downloadStorageObject === void 0 ? {} : { downloadStorageObject: createDownloadStorageRouteHandler(downloadStorageObject) }
+		...createAdminRouteHandlers()
 	};
 	const routes = [];
 	const shapes = /* @__PURE__ */ new Map();
@@ -103,7 +88,6 @@ function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, en
 	const clientRouter = createRouter();
 	const addClientRoute = mount(clientRouter, false);
 	addClientRoute("GET", "/version", "version");
-	if (downloadStorageObject !== void 0) addClientRoute("GET", "/storage/:token/:signature", "downloadStorageObject");
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");

package/dist/handlerReleaseCatalogRoutes.cjs

@@ -1,5 +1,6 @@
 const require_handlerParameters = require("./handlerParameters.cjs");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
+let _hot_updater_protocol = require("@hot-updater/protocol");
 //#region src/handlerReleaseCatalogRoutes.ts
 const CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
 const ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
@@ -9,10 +10,42 @@ const ORIGIN_CACHE_MAX_ENTRIES = 128;
 const NO_CATALOG_HEADER = "x-hot-updater-catalog";
 /** A shared cache keeps a catalog, or a scope's lack of one, five seconds. */
 const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
+/**
+* The same five seconds for a CDN that reads `CDN-Cache-Control` (RFC 9213),
+* such as Cloudflare's Workers Cache, which then ignores `Cache-Control`.
+* `s-maxage` forbids serving stale, so there an expired catalog held requests
+* at that location until the origin answered. Here, for five more seconds,
+* the CDN answers with the expired copy while it revalidates in the
+* background. `stale-if-error=0` keeps origin errors visible: without it,
+* Cloudflare serves a stale copy on error indefinitely.
+*
+* A device can see a catalog up to 15 seconds after a deploy or a Roll back
+* replaced it: the origin's 5-second catalog memo, then 5 seconds fresh and
+* 5 stale at the CDN. A revoked API key can read a cached catalog up to
+* 10 seconds. Devices and caches that don't read the header keep
+* `Cache-Control`.
+*/
+const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
 });
+const badRequest = (error) => Response.json({ error }, {
+	status: 400,
+	headers: { "cache-control": "private, no-store" }
+});
+/**
+* A 400 for a catalog path whose scope is malformed, such as a channel name
+* where its base64url key belongs; null for a well-formed scope.
+*/
+const invalidScope = (input) => {
+	try {
+		(0, _hot_updater_protocol.createReleaseCatalogScopeKey)(input);
+		return null;
+	} catch (error) {
+		return badRequest(error instanceof Error ? error.message : "Invalid Release Catalog scope");
+	}
+};
 /**
 * A scope with no catalog yet, such as a store version before its first
 * OTA release: cached like a catalog, so its update checks don't all reach
@@ -24,6 +57,7 @@ const missingCatalog = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: {
 		"cache-control": CATALOG_CACHE_CONTROL,
+		"cdn-cache-control": CATALOG_CDN_CACHE_CONTROL,
 		vary: "Accept-Encoding",
 		[NO_CATALOG_HEADER]: "none"
 	}
@@ -38,6 +72,7 @@ const catalogResponse = async (catalog, request) => {
 	const etag = `"sha256:${await responseHash(body)}"`;
 	const headers = {
 		"cache-control": CATALOG_CACHE_CONTROL,
+		"cdn-cache-control": CATALOG_CDN_CACHE_CONTROL,
 		"content-type": CATALOG_CONTENT_TYPE,
 		etag,
 		vary: "Accept-Encoding"
@@ -89,16 +124,15 @@ const createReleaseCatalogRouteHandlers = () => {
 		appVersionReleaseCatalog: async (params, request, { core }) => {
 			const rawAppVersion = require_handlerParameters.requireRouteParam(params, "appVersion");
 			const appVersion = (0, _hot_updater_plugin_core.canonicalizeAppVersion)(rawAppVersion);
-			if (appVersion === null || appVersion !== rawAppVersion) return Response.json({ error: "Invalid app version" }, {
-				status: 400,
-				headers: { "cache-control": "private, no-store" }
-			});
+			if (appVersion === null || appVersion !== rawAppVersion) return badRequest("Invalid app version");
 			const input = {
 				appVersion,
 				channelKey: require_handlerParameters.requireRouteParam(params, "channelKey"),
 				platform: require_handlerParameters.requirePlatformParam(params),
 				strategy: "APP_VERSION"
 			};
+			const invalid = invalidScope(input);
+			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`app-version:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
 		fingerprintReleaseCatalog: async (params, request, { core }) => {
@@ -108,6 +142,8 @@ const createReleaseCatalogRouteHandlers = () => {
 				platform: require_handlerParameters.requirePlatformParam(params),
 				strategy: "FINGERPRINT"
 			};
+			const invalid = invalidScope(input);
+			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
 		artifactV1: async (params, _request, { core }) => {

package/dist/handlerReleaseCatalogRoutes.mjs

@@ -1,5 +1,6 @@
 import { requirePlatformParam, requireRouteParam } from "./handlerParameters.mjs";
 import { canonicalizeAppVersion } from "@hot-updater/plugin-core";
+import { createReleaseCatalogScopeKey } from "@hot-updater/protocol";
 //#region src/handlerReleaseCatalogRoutes.ts
 const CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
 const ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
@@ -9,10 +10,42 @@ const ORIGIN_CACHE_MAX_ENTRIES = 128;
 const NO_CATALOG_HEADER = "x-hot-updater-catalog";
 /** A shared cache keeps a catalog, or a scope's lack of one, five seconds. */
 const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
+/**
+* The same five seconds for a CDN that reads `CDN-Cache-Control` (RFC 9213),
+* such as Cloudflare's Workers Cache, which then ignores `Cache-Control`.
+* `s-maxage` forbids serving stale, so there an expired catalog held requests
+* at that location until the origin answered. Here, for five more seconds,
+* the CDN answers with the expired copy while it revalidates in the
+* background. `stale-if-error=0` keeps origin errors visible: without it,
+* Cloudflare serves a stale copy on error indefinitely.
+*
+* A device can see a catalog up to 15 seconds after a deploy or a Roll back
+* replaced it: the origin's 5-second catalog memo, then 5 seconds fresh and
+* 5 stale at the CDN. A revoked API key can read a cached catalog up to
+* 10 seconds. Devices and caches that don't read the header keep
+* `Cache-Control`.
+*/
+const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
 });
+const badRequest = (error) => Response.json({ error }, {
+	status: 400,
+	headers: { "cache-control": "private, no-store" }
+});
+/**
+* A 400 for a catalog path whose scope is malformed, such as a channel name
+* where its base64url key belongs; null for a well-formed scope.
+*/
+const invalidScope = (input) => {
+	try {
+		createReleaseCatalogScopeKey(input);
+		return null;
+	} catch (error) {
+		return badRequest(error instanceof Error ? error.message : "Invalid Release Catalog scope");
+	}
+};
 /**
 * A scope with no catalog yet, such as a store version before its first
 * OTA release: cached like a catalog, so its update checks don't all reach
@@ -24,6 +57,7 @@ const missingCatalog = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: {
 		"cache-control": CATALOG_CACHE_CONTROL,
+		"cdn-cache-control": CATALOG_CDN_CACHE_CONTROL,
 		vary: "Accept-Encoding",
 		[NO_CATALOG_HEADER]: "none"
 	}
@@ -38,6 +72,7 @@ const catalogResponse = async (catalog, request) => {
 	const etag = `"sha256:${await responseHash(body)}"`;
 	const headers = {
 		"cache-control": CATALOG_CACHE_CONTROL,
+		"cdn-cache-control": CATALOG_CDN_CACHE_CONTROL,
 		"content-type": CATALOG_CONTENT_TYPE,
 		etag,
 		vary: "Accept-Encoding"
@@ -89,16 +124,15 @@ const createReleaseCatalogRouteHandlers = () => {
 		appVersionReleaseCatalog: async (params, request, { core }) => {
 			const rawAppVersion = requireRouteParam(params, "appVersion");
 			const appVersion = canonicalizeAppVersion(rawAppVersion);
-			if (appVersion === null || appVersion !== rawAppVersion) return Response.json({ error: "Invalid app version" }, {
-				status: 400,
-				headers: { "cache-control": "private, no-store" }
-			});
+			if (appVersion === null || appVersion !== rawAppVersion) return badRequest("Invalid app version");
 			const input = {
 				appVersion,
 				channelKey: requireRouteParam(params, "channelKey"),
 				platform: requirePlatformParam(params),
 				strategy: "APP_VERSION"
 			};
+			const invalid = invalidScope(input);
+			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`app-version:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
 		fingerprintReleaseCatalog: async (params, request, { core }) => {
@@ -108,6 +142,8 @@ const createReleaseCatalogRouteHandlers = () => {
 				platform: requirePlatformParam(params),
 				strategy: "FINGERPRINT"
 			};
+			const invalid = invalidScope(input);
+			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
 		artifactV1: async (params, _request, { core }) => {

package/dist/package.cjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "1.0.0-rc.42";
+var version = "1.0.0-rc.44";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.0.0-rc.42";
+var version = "1.0.0-rc.44";
 //#endregion
 export { version };

package/dist/plugins/index.cjs

@@ -0,0 +1,27 @@
+var _hot_updater_plugin_api_keys_server = require("@hot-updater/plugin-api-keys/server");
+Object.keys(_hot_updater_plugin_api_keys_server).forEach(function(k) {
+	if (k !== "default" && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+		enumerable: true,
+		get: function() {
+			return _hot_updater_plugin_api_keys_server[k];
+		}
+	});
+});
+var _hot_updater_plugin_insights_server = require("@hot-updater/plugin-insights/server");
+Object.keys(_hot_updater_plugin_insights_server).forEach(function(k) {
+	if (k !== "default" && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+		enumerable: true,
+		get: function() {
+			return _hot_updater_plugin_insights_server[k];
+		}
+	});
+});
+var _hot_updater_plugin_remote_config_server = require("@hot-updater/plugin-remote-config/server");
+Object.keys(_hot_updater_plugin_remote_config_server).forEach(function(k) {
+	if (k !== "default" && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+		enumerable: true,
+		get: function() {
+			return _hot_updater_plugin_remote_config_server[k];
+		}
+	});
+});

package/dist/plugins/index.d.cts

@@ -0,0 +1,6 @@
+import "./api-keys/index.cjs";
+import "./insights/index.cjs";
+import "./remote-config/index.cjs";
+export * from "@hot-updater/plugin-api-keys/server";
+export * from "@hot-updater/plugin-insights/server";
+export * from "@hot-updater/plugin-remote-config/server";

package/dist/plugins/index.d.mts

@@ -0,0 +1,6 @@
+import "./api-keys/index.mjs";
+import "./insights/index.mjs";
+import "./remote-config/index.mjs";
+export * from "@hot-updater/plugin-api-keys/server";
+export * from "@hot-updater/plugin-insights/server";
+export * from "@hot-updater/plugin-remote-config/server";

package/dist/plugins/index.mjs

@@ -0,0 +1,4 @@
+export * from "@hot-updater/plugin-api-keys/server";
+export * from "@hot-updater/plugin-insights/server";
+export * from "@hot-updater/plugin-remote-config/server";
+export {};

package/dist/storageAccess.cjs

@@ -1,32 +1,21 @@
-let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 //#region src/storageAccess.ts
+/** A URL devices download from, which only an absolute HTTP(S) URL can be. */
 const assertRemoteUrl = (value) => {
-	const protocol = new URL(value).protocol;
-	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an HTTP(S) URL.");
+	let protocol;
+	try {
+		protocol = new URL(value).protocol;
+	} catch {}
+	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an absolute HTTP(S) URL.");
 	return value;
 };
 const getStorageProtocol = (storageUri) => new URL(storageUri).protocol.replace(":", "");
 const isRemoteUrlProtocol = (protocol) => protocol === "http" || protocol === "https";
-const resolveDownloadPath = (value, storageUri) => {
-	const parsed = (0, _hot_updater_plugin_core.parseStorageDownloadPath)(value);
-	if (!parsed || parsed.storageUri !== storageUri) throw new Error("Storage getDownloadUrl must return an HTTP(S) URL or a valid storage download path.");
-	return value;
-};
-const tokensEqual = (left, right) => {
-	const leftBytes = new TextEncoder().encode(left);
-	const rightBytes = new TextEncoder().encode(right);
-	let difference = leftBytes.length ^ rightBytes.length;
-	const length = Math.max(leftBytes.length, rightBytes.length);
-	for (let index = 0; index < length; index += 1) difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
-	return difference === 0;
-};
-const createStorageAccess = (storageAdapters) => {
-	const protocols = /* @__PURE__ */ new Set();
-	for (const storage of storageAdapters) {
-		if (protocols.has(storage.protocol)) throw new Error(`Multiple storage adapters handle protocol: ${storage.protocol}`);
-		protocols.add(storage.protocol);
-	}
-	const findStorage = (protocol) => storageAdapters.find((item) => item.protocol === protocol);
+/**
+* Reads and download URLs over the server's storage, for the URIs of its
+* protocol; an HTTP(S) URI is used as it is.
+*/
+const createStorageAccess = (storageAdapter) => {
+	const findStorage = (protocol) => storageAdapter.protocol === protocol ? storageAdapter : void 0;
 	const readStorageResponse = async (storageUri) => {
 		const protocol = getStorageProtocol(storageUri);
 		const storage = findStorage(protocol);
@@ -50,38 +39,12 @@ const createStorageAccess = (storageAdapters) => {
 		}
 		if (!storage.getDownloadUrl) return null;
 		const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri });
-		try {
-			return assertRemoteUrl(downloadUrl);
-		} catch (error) {
-			if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) throw error;
-		}
-		return resolveDownloadPath(downloadUrl, storageUri);
+		return assertRemoteUrl(downloadUrl);
 	};
 	const readStorageText = async (storageUri) => {
 		return (await readStorageResponse(storageUri))?.text() ?? null;
 	};
 	return {
-		downloadStorageObject: storageAdapters.some((storage) => storage.getDownloadUrl !== void 0) ? async (storageUriToken, encodedSignature) => {
-			const requestedPath = `/storage/${storageUriToken}/${encodedSignature}`;
-			const requested = (0, _hot_updater_plugin_core.parseStorageDownloadPath)(requestedPath);
-			if (!requested) return null;
-			let storage;
-			try {
-				storage = findStorage(getStorageProtocol(requested.storageUri));
-			} catch {
-				return null;
-			}
-			if (!storage?.getDownloadUrl || !storage.get) return null;
-			const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri: requested.storageUri });
-			try {
-				new URL(downloadUrl);
-				return null;
-			} catch {
-				if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) return null;
-			}
-			if (!tokensEqual(downloadUrl, requestedPath)) return null;
-			return (await storage.get({ storageUri: requested.storageUri })).response;
-		} : void 0,
 		readStorageText,
 		resolveFileUrl
 	};

package/dist/storageAccess.mjs

@@ -1,32 +1,21 @@
-import { parseStorageDownloadPath } from "@hot-updater/plugin-core";
 //#region src/storageAccess.ts
+/** A URL devices download from, which only an absolute HTTP(S) URL can be. */
 const assertRemoteUrl = (value) => {
-	const protocol = new URL(value).protocol;
-	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an HTTP(S) URL.");
+	let protocol;
+	try {
+		protocol = new URL(value).protocol;
+	} catch {}
+	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an absolute HTTP(S) URL.");
 	return value;
 };
 const getStorageProtocol = (storageUri) => new URL(storageUri).protocol.replace(":", "");
 const isRemoteUrlProtocol = (protocol) => protocol === "http" || protocol === "https";
-const resolveDownloadPath = (value, storageUri) => {
-	const parsed = parseStorageDownloadPath(value);
-	if (!parsed || parsed.storageUri !== storageUri) throw new Error("Storage getDownloadUrl must return an HTTP(S) URL or a valid storage download path.");
-	return value;
-};
-const tokensEqual = (left, right) => {
-	const leftBytes = new TextEncoder().encode(left);
-	const rightBytes = new TextEncoder().encode(right);
-	let difference = leftBytes.length ^ rightBytes.length;
-	const length = Math.max(leftBytes.length, rightBytes.length);
-	for (let index = 0; index < length; index += 1) difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
-	return difference === 0;
-};
-const createStorageAccess = (storageAdapters) => {
-	const protocols = /* @__PURE__ */ new Set();
-	for (const storage of storageAdapters) {
-		if (protocols.has(storage.protocol)) throw new Error(`Multiple storage adapters handle protocol: ${storage.protocol}`);
-		protocols.add(storage.protocol);
-	}
-	const findStorage = (protocol) => storageAdapters.find((item) => item.protocol === protocol);
+/**
+* Reads and download URLs over the server's storage, for the URIs of its
+* protocol; an HTTP(S) URI is used as it is.
+*/
+const createStorageAccess = (storageAdapter) => {
+	const findStorage = (protocol) => storageAdapter.protocol === protocol ? storageAdapter : void 0;
 	const readStorageResponse = async (storageUri) => {
 		const protocol = getStorageProtocol(storageUri);
 		const storage = findStorage(protocol);
@@ -50,38 +39,12 @@ const createStorageAccess = (storageAdapters) => {
 		}
 		if (!storage.getDownloadUrl) return null;
 		const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri });
-		try {
-			return assertRemoteUrl(downloadUrl);
-		} catch (error) {
-			if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) throw error;
-		}
-		return resolveDownloadPath(downloadUrl, storageUri);
+		return assertRemoteUrl(downloadUrl);
 	};
 	const readStorageText = async (storageUri) => {
 		return (await readStorageResponse(storageUri))?.text() ?? null;
 	};
 	return {
-		downloadStorageObject: storageAdapters.some((storage) => storage.getDownloadUrl !== void 0) ? async (storageUriToken, encodedSignature) => {
-			const requestedPath = `/storage/${storageUriToken}/${encodedSignature}`;
-			const requested = parseStorageDownloadPath(requestedPath);
-			if (!requested) return null;
-			let storage;
-			try {
-				storage = findStorage(getStorageProtocol(requested.storageUri));
-			} catch {
-				return null;
-			}
-			if (!storage?.getDownloadUrl || !storage.get) return null;
-			const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri: requested.storageUri });
-			try {
-				new URL(downloadUrl);
-				return null;
-			} catch {
-				if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) return null;
-			}
-			if (!tokensEqual(downloadUrl, requestedPath)) return null;
-			return (await storage.get({ storageUri: requested.storageUri })).response;
-		} : void 0,
 		readStorageText,
 		resolveFileUrl
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/server",
-  "version": "1.0.0-rc.42",
+  "version": "1.0.0-rc.44",
   "type": "module",
   "description": "React Native OTA solution for self-hosted",
   "sideEffects": false,
@@ -28,17 +28,9 @@
       "import": "./dist/adapters/prisma.mjs",
       "require": "./dist/adapters/prisma.cjs"
     },
-    "./plugins/api-keys": {
-      "import": "./dist/plugins/api-keys/index.mjs",
-      "require": "./dist/plugins/api-keys/index.cjs"
-    },
-    "./plugins/insights": {
-      "import": "./dist/plugins/insights/index.mjs",
-      "require": "./dist/plugins/insights/index.cjs"
-    },
-    "./plugins/remote-config": {
-      "import": "./dist/plugins/remote-config/index.mjs",
-      "require": "./dist/plugins/remote-config/index.cjs"
+    "./plugins": {
+      "import": "./dist/plugins/index.mjs",
+      "require": "./dist/plugins/index.cjs"
     },
     "./package.json": "./package.json"
   },
@@ -58,11 +50,11 @@
   "dependencies": {
     "rou3": "0.7.9",
     "verkit": "0.4.0",
-    "@hot-updater/plugin-api-keys": "1.0.0-rc.42",
-    "@hot-updater/plugin-insights": "1.0.0-rc.42",
-    "@hot-updater/plugin-remote-config": "1.0.0-rc.42",
-    "@hot-updater/protocol": "1.0.0-rc.42",
-    "@hot-updater/plugin-core": "1.0.0-rc.42"
+    "@hot-updater/plugin-insights": "1.0.0-rc.44",
+    "@hot-updater/protocol": "1.0.0-rc.44",
+    "@hot-updater/plugin-api-keys": "1.0.0-rc.44",
+    "@hot-updater/plugin-remote-config": "1.0.0-rc.44",
+    "@hot-updater/plugin-core": "1.0.0-rc.44"
   },
   "peerDependencies": {
     "@prisma/client": "*",
@@ -103,8 +95,8 @@
     "prisma": "6.19.3",
     "uuidv7": "^1.0.2",
     "wrangler": "^4.69.0",
-    "@hot-updater/standalone": "1.0.0-rc.42",
-    "@hot-updater/test-utils": "1.0.0-rc.42"
+    "@hot-updater/standalone": "1.0.0-rc.44",
+    "@hot-updater/test-utils": "1.0.0-rc.44"
   },
   "nx": {
     "implicitDependencies": [