@hot-updater/server 1.0.4 → 1.0.6

package/dist/core/api.d.cts

@@ -31,6 +31,8 @@ declare const createCoreApi: (db: CoreDatabase, storage: CoreStorage, options?:
   deleteBundles: (ids: readonly string[]) => Promise<void>;
   getReleaseCatalog(input: import("@hot-updater/plugin-core").ReleaseCatalogRequest): Promise<import("@hot-updater/protocol").ReleaseCatalog | null>;
   getArtifactInfo(targetBundleId: string, currentBundleId: string, artifactProtocolVersion: 1): Promise<import("@hot-updater/protocol").ArtifactInfo | null>;
+  getArtifactInfo(targetBundleId: string, currentBundleId: string, artifactProtocolVersion: 2): Promise<import("@hot-updater/protocol").ArtifactInfoV2 | null>;
+  getArtifactFiles(bundleId: string, paths: readonly string[]): Promise<import("@hot-updater/protocol").ArtifactFiles | null>;
   getBundle(id: string): Promise<import("@hot-updater/plugin-core").BundleDetail | null>;
   countBundleChildren(baseBundleIds: readonly string[]): Promise<Record<string, number>>;
   listPatchesFromBase(baseBundleId: string, input: import("@hot-updater/plugin-core").KeysetInput): Promise<import("@hot-updater/plugin-core").BundlePatchRow[]>;

package/dist/core/api.d.mts

@@ -31,6 +31,8 @@ declare const createCoreApi: (db: CoreDatabase, storage: CoreStorage, options?:
   deleteBundles: (ids: readonly string[]) => Promise<void>;
   getReleaseCatalog(input: import("@hot-updater/plugin-core").ReleaseCatalogRequest): Promise<import("@hot-updater/protocol").ReleaseCatalog | null>;
   getArtifactInfo(targetBundleId: string, currentBundleId: string, artifactProtocolVersion: 1): Promise<import("@hot-updater/protocol").ArtifactInfo | null>;
+  getArtifactInfo(targetBundleId: string, currentBundleId: string, artifactProtocolVersion: 2): Promise<import("@hot-updater/protocol").ArtifactInfoV2 | null>;
+  getArtifactFiles(bundleId: string, paths: readonly string[]): Promise<import("@hot-updater/protocol").ArtifactFiles | null>;
   getBundle(id: string): Promise<import("@hot-updater/plugin-core").BundleDetail | null>;
   countBundleChildren(baseBundleIds: readonly string[]): Promise<Record<string, number>>;
   listPatchesFromBase(baseBundleId: string, input: import("@hot-updater/plugin-core").KeysetInput): Promise<import("@hot-updater/plugin-core").BundlePatchRow[]>;

package/dist/core/reads.cjs

@@ -106,20 +106,34 @@ const createCoreReads = (db, storage) => {
 			return require_releaseCatalog.projectReleaseCatalogRow(row === null ? null : toCatalogRow(row), input, scopeKey);
 		},
 		/** Artifact resolution: one batch read of both bundles and one unique read of their patch. */
-		async getArtifactInfo(targetBundleId, currentBundleId, artifactProtocolVersion) {
+		getArtifactInfo: (async (targetBundleId, currentBundleId, artifactProtocolVersion) => {
 			const { readStorageText } = storage;
-			if (artifactProtocolVersion !== _hot_updater_protocol.ARTIFACT_PROTOCOL_VERSION || readStorageText === void 0) return null;
+			if (artifactProtocolVersion !== _hot_updater_protocol.ARTIFACT_PROTOCOL_VERSION && artifactProtocolVersion !== _hot_updater_protocol.ARTIFACT_FILES_PROTOCOL_VERSION || readStorageText === void 0) return null;
 			const withCurrent = currentBundleId !== _hot_updater_protocol.NIL_UUID;
 			const [[target, current], patch] = await Promise.all([db.findByKeys("bundles", withCurrent ? [{ id: targetBundleId }, { id: currentBundleId }] : [{ id: targetBundleId }]), withCurrent ? db.findOne("bundle_patches", {
 				bundle_id: targetBundleId,
 				base_bundle_id: currentBundleId
 			}) : null]);
 			if (target === null || target === void 0) return null;
-			return require_updateArtifacts.resolveManifestArtifacts({
+			const input = {
 				currentBundle: current ? (0, _hot_updater_plugin_core.rowToBundle)(toBundleRow(current)) : null,
 				readStorageText,
 				resolveFileUrl: storage.resolveFileUrl,
 				targetBundle: (0, _hot_updater_plugin_core.rowToBundle)(toBundleRow(target), patch === null ? [] : [toPatchRow(patch)])
+			};
+			return artifactProtocolVersion === _hot_updater_protocol.ARTIFACT_FILES_PROTOCOL_VERSION ? require_updateArtifacts.resolveManifestArtifactsV2(input) : require_updateArtifacts.resolveManifestArtifacts(input);
+		}),
+		/** A Bundle's file URLs: one point read of the bundle and its manifest. */
+		async getArtifactFiles(bundleId, paths) {
+			const { readStorageText } = storage;
+			if (readStorageText === void 0) return null;
+			const row = await db.findOne("bundles", { id: bundleId });
+			if (row === null) return null;
+			return require_updateArtifacts.resolveManifestArtifactFiles({
+				paths,
+				readStorageText,
+				resolveFileUrl: storage.resolveFileUrl,
+				targetBundle: (0, _hot_updater_plugin_core.rowToBundle)(toBundleRow(row))
 			});
 		},
 		/** A bundle, its patches, and how many patches start from it. */

package/dist/core/reads.mjs

@@ -1,8 +1,8 @@
 import { projectReleaseCatalogRow, releaseCatalogScopeKeyOf } from "../db/releaseCatalog.mjs";
-import { resolveManifestArtifacts } from "../db/updateArtifacts.mjs";
+import { resolveManifestArtifactFiles, resolveManifestArtifacts, resolveManifestArtifactsV2 } from "../db/updateArtifacts.mjs";
 import { baseBundleIdsOf } from "./baseCandidates.mjs";
 import { parseBaseCandidateKey, rowToBundle } from "@hot-updater/plugin-core";
-import { ARTIFACT_PROTOCOL_VERSION, NIL_UUID } from "@hot-updater/protocol";
+import { ARTIFACT_FILES_PROTOCOL_VERSION, ARTIFACT_PROTOCOL_VERSION, NIL_UUID } from "@hot-updater/protocol";
 //#region src/core/reads.ts
 const PAGE = 500;
 const pick = (fields) => (row) => Object.fromEntries(fields.map((field) => [field, row[field]]));
@@ -106,20 +106,34 @@ const createCoreReads = (db, storage) => {
 			return projectReleaseCatalogRow(row === null ? null : toCatalogRow(row), input, scopeKey);
 		},
 		/** Artifact resolution: one batch read of both bundles and one unique read of their patch. */
-		async getArtifactInfo(targetBundleId, currentBundleId, artifactProtocolVersion) {
+		getArtifactInfo: (async (targetBundleId, currentBundleId, artifactProtocolVersion) => {
 			const { readStorageText } = storage;
-			if (artifactProtocolVersion !== ARTIFACT_PROTOCOL_VERSION || readStorageText === void 0) return null;
+			if (artifactProtocolVersion !== ARTIFACT_PROTOCOL_VERSION && artifactProtocolVersion !== ARTIFACT_FILES_PROTOCOL_VERSION || readStorageText === void 0) return null;
 			const withCurrent = currentBundleId !== NIL_UUID;
 			const [[target, current], patch] = await Promise.all([db.findByKeys("bundles", withCurrent ? [{ id: targetBundleId }, { id: currentBundleId }] : [{ id: targetBundleId }]), withCurrent ? db.findOne("bundle_patches", {
 				bundle_id: targetBundleId,
 				base_bundle_id: currentBundleId
 			}) : null]);
 			if (target === null || target === void 0) return null;
-			return resolveManifestArtifacts({
+			const input = {
 				currentBundle: current ? rowToBundle(toBundleRow(current)) : null,
 				readStorageText,
 				resolveFileUrl: storage.resolveFileUrl,
 				targetBundle: rowToBundle(toBundleRow(target), patch === null ? [] : [toPatchRow(patch)])
+			};
+			return artifactProtocolVersion === ARTIFACT_FILES_PROTOCOL_VERSION ? resolveManifestArtifactsV2(input) : resolveManifestArtifacts(input);
+		}),
+		/** A Bundle's file URLs: one point read of the bundle and its manifest. */
+		async getArtifactFiles(bundleId, paths) {
+			const { readStorageText } = storage;
+			if (readStorageText === void 0) return null;
+			const row = await db.findOne("bundles", { id: bundleId });
+			if (row === null) return null;
+			return resolveManifestArtifactFiles({
+				paths,
+				readStorageText,
+				resolveFileUrl: storage.resolveFileUrl,
+				targetBundle: rowToBundle(toBundleRow(row))
 			});
 		},
 		/** A bundle, its patches, and how many patches start from it. */

package/dist/db/updateArtifacts.cjs

@@ -114,6 +114,11 @@ async function resolveAssets(plan, resolveFileUrl) {
 	const resolvedEntries = entries.filter((entry) => entry !== null);
 	return { assets: Object.fromEntries(resolvedEntries.map((entry) => entry.asset)) };
 }
+/**
+* Legacy: artifact protocol v1. Signs a URL for every file of the target, which grows with the
+* Bundle's file count; apps whose SDK predates protocol v2 still ask for it.
+* Remove with the `/artifacts/v1` route once no supported app uses it.
+*/
 async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
 	const manifestStorageUri = targetBundle ? (0, _hot_updater_protocol.getManifestStorageUri)(targetBundle) : null;
 	const manifestFileHash = targetBundle ? (0, _hot_updater_protocol.getManifestFileHash)(targetBundle) : null;
@@ -147,5 +152,99 @@ async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readSto
 		...archiveUrl ? { archiveUrl } : {}
 	};
 }
+/** The target's manifest and its plan, or null for a Bundle without one. */
+async function loadTargetPlan({ currentBundle, readStorageText, targetBundle }) {
+	const manifestStorageUri = (0, _hot_updater_protocol.getManifestStorageUri)(targetBundle);
+	const manifestFileHash = (0, _hot_updater_protocol.getManifestFileHash)(targetBundle);
+	const assetBaseStorageUri = (0, _hot_updater_protocol.getAssetBaseStorageUri)(targetBundle);
+	if (!manifestStorageUri || !manifestFileHash || !assetBaseStorageUri) return null;
+	const targetManifest = await fetchBundleManifest(manifestStorageUri, readStorageText);
+	if (!targetManifest) return null;
+	return {
+		manifestFileHash,
+		manifestStorageUri,
+		plan: createManifestArtifactPlan({
+			assetBaseStorageUri,
+			currentBundle,
+			targetBundle,
+			targetManifest
+		}),
+		targetManifest
+	};
+}
+/**
+* Artifact protocol v2: the manifest, the archive, and the one Hermes patch,
+* but no URL per file. A device asks {@link resolveManifestArtifactFiles}
+* for the files it downloads one by one, so signing and the response stay
+* the same size however many files the Bundle has.
+*/
+async function resolveManifestArtifactsV2({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
+	const target = await loadTargetPlan({
+		currentBundle,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const manifestUrl = await resolveFileUrl(target.manifestStorageUri);
+	if (!manifestUrl) return null;
+	const patched = target.plan.assets.find((asset) => asset.patch !== null);
+	let patch;
+	if (patched?.patch && !(patched.file.byteSize !== null && patched.patch.byteSize !== null && patched.patch.byteSize >= patched.file.byteSize)) try {
+		const patchUrl = await resolveFileUrl(patched.patch.storageUri);
+		if (patchUrl) patch = {
+			algorithm: "bsdiff",
+			assetPath: patched.assetPath,
+			baseBundleId: patched.patch.baseBundleId,
+			baseFileHash: patched.patch.baseFileHash,
+			patchFileHash: patched.patch.patchFileHash,
+			patchUrl,
+			...patched.patch.byteSize === null ? {} : { byteSize: patched.patch.byteSize }
+		};
+	} catch {}
+	let archiveUrl = null;
+	const archive = target.targetManifest.archive;
+	if (archive && (0, _hot_updater_plugin_core.isContentAddressedAssetFileHash)(archive.downloadFileHash) && (asByteSize(archive.downloadByteSize) ?? 0) > 0 && (asByteSize(archive.tarByteSize) ?? 0) > 0) try {
+		archiveUrl = await resolveFileUrl((0, _hot_updater_plugin_core.getBundleArchiveStorageUri)({
+			manifestStorageUri: target.manifestStorageUri,
+			bundleId: targetBundle.id
+		}));
+	} catch {}
+	return {
+		artifactProtocolVersion: _hot_updater_protocol.ARTIFACT_FILES_PROTOCOL_VERSION,
+		manifestFileHash: target.manifestFileHash,
+		manifestUrl,
+		...archiveUrl ? { archiveUrl } : {},
+		...patch ? { patch } : {}
+	};
+}
+/**
+* Download URLs for the files a device downloads one by one. Only paths the
+* target's manifest names are signed, at most
+* {@link ARTIFACT_FILES_REQUEST_LIMIT}; null when any path is unknown or a
+* URL cannot be resolved.
+*/
+async function resolveManifestArtifactFiles({ paths, resolveFileUrl, readStorageText, targetBundle }) {
+	if (paths.length === 0 || paths.length > _hot_updater_protocol.ARTIFACT_FILES_REQUEST_LIMIT || new Set(paths).size !== paths.length) return null;
+	const target = await loadTargetPlan({
+		currentBundle: null,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const planned = new Map(target.plan.assets.map((asset) => [asset.assetPath, asset]));
+	const requested = paths.map((path) => planned.get(path));
+	if (requested.some((asset) => asset === void 0)) return null;
+	const files = await Promise.all(requested.map(async (asset) => {
+		const url = await resolveFileUrl(asset.file.storageUri);
+		if (!url) return null;
+		const file = { url };
+		if (asset.file.compression) file.compression = asset.file.compression;
+		return [asset.assetPath, file];
+	}));
+	if (files.some((file) => file === null)) return null;
+	return { files: Object.fromEntries(files.filter((file) => file !== null)) };
+}
 //#endregion
+exports.resolveManifestArtifactFiles = resolveManifestArtifactFiles;
 exports.resolveManifestArtifacts = resolveManifestArtifacts;
+exports.resolveManifestArtifactsV2 = resolveManifestArtifactsV2;

package/dist/db/updateArtifacts.mjs

@@ -1,5 +1,5 @@
 import { getBundleArchiveStorageUri, getManifestAssetDownloadPath, isContentAddressedAssetFileHash, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
-import { ARTIFACT_PROTOCOL_VERSION, getAssetBaseStorageUri, getBundlePatch, getManifestFileHash, getManifestStorageUri } from "@hot-updater/protocol";
+import { ARTIFACT_FILES_PROTOCOL_VERSION, ARTIFACT_FILES_REQUEST_LIMIT, ARTIFACT_PROTOCOL_VERSION, getAssetBaseStorageUri, getBundlePatch, getManifestFileHash, getManifestStorageUri } from "@hot-updater/protocol";
 //#region src/db/updateArtifacts.ts
 const HBC_ASSET_PATH_RE = /\.bundle$/;
 const asByteSize = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
@@ -114,6 +114,11 @@ async function resolveAssets(plan, resolveFileUrl) {
 	const resolvedEntries = entries.filter((entry) => entry !== null);
 	return { assets: Object.fromEntries(resolvedEntries.map((entry) => entry.asset)) };
 }
+/**
+* Legacy: artifact protocol v1. Signs a URL for every file of the target, which grows with the
+* Bundle's file count; apps whose SDK predates protocol v2 still ask for it.
+* Remove with the `/artifacts/v1` route once no supported app uses it.
+*/
 async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
 	const manifestStorageUri = targetBundle ? getManifestStorageUri(targetBundle) : null;
 	const manifestFileHash = targetBundle ? getManifestFileHash(targetBundle) : null;
@@ -147,5 +152,97 @@ async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readSto
 		...archiveUrl ? { archiveUrl } : {}
 	};
 }
+/** The target's manifest and its plan, or null for a Bundle without one. */
+async function loadTargetPlan({ currentBundle, readStorageText, targetBundle }) {
+	const manifestStorageUri = getManifestStorageUri(targetBundle);
+	const manifestFileHash = getManifestFileHash(targetBundle);
+	const assetBaseStorageUri = getAssetBaseStorageUri(targetBundle);
+	if (!manifestStorageUri || !manifestFileHash || !assetBaseStorageUri) return null;
+	const targetManifest = await fetchBundleManifest(manifestStorageUri, readStorageText);
+	if (!targetManifest) return null;
+	return {
+		manifestFileHash,
+		manifestStorageUri,
+		plan: createManifestArtifactPlan({
+			assetBaseStorageUri,
+			currentBundle,
+			targetBundle,
+			targetManifest
+		}),
+		targetManifest
+	};
+}
+/**
+* Artifact protocol v2: the manifest, the archive, and the one Hermes patch,
+* but no URL per file. A device asks {@link resolveManifestArtifactFiles}
+* for the files it downloads one by one, so signing and the response stay
+* the same size however many files the Bundle has.
+*/
+async function resolveManifestArtifactsV2({ currentBundle, resolveFileUrl, readStorageText, targetBundle }) {
+	const target = await loadTargetPlan({
+		currentBundle,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const manifestUrl = await resolveFileUrl(target.manifestStorageUri);
+	if (!manifestUrl) return null;
+	const patched = target.plan.assets.find((asset) => asset.patch !== null);
+	let patch;
+	if (patched?.patch && !(patched.file.byteSize !== null && patched.patch.byteSize !== null && patched.patch.byteSize >= patched.file.byteSize)) try {
+		const patchUrl = await resolveFileUrl(patched.patch.storageUri);
+		if (patchUrl) patch = {
+			algorithm: "bsdiff",
+			assetPath: patched.assetPath,
+			baseBundleId: patched.patch.baseBundleId,
+			baseFileHash: patched.patch.baseFileHash,
+			patchFileHash: patched.patch.patchFileHash,
+			patchUrl,
+			...patched.patch.byteSize === null ? {} : { byteSize: patched.patch.byteSize }
+		};
+	} catch {}
+	let archiveUrl = null;
+	const archive = target.targetManifest.archive;
+	if (archive && isContentAddressedAssetFileHash(archive.downloadFileHash) && (asByteSize(archive.downloadByteSize) ?? 0) > 0 && (asByteSize(archive.tarByteSize) ?? 0) > 0) try {
+		archiveUrl = await resolveFileUrl(getBundleArchiveStorageUri({
+			manifestStorageUri: target.manifestStorageUri,
+			bundleId: targetBundle.id
+		}));
+	} catch {}
+	return {
+		artifactProtocolVersion: ARTIFACT_FILES_PROTOCOL_VERSION,
+		manifestFileHash: target.manifestFileHash,
+		manifestUrl,
+		...archiveUrl ? { archiveUrl } : {},
+		...patch ? { patch } : {}
+	};
+}
+/**
+* Download URLs for the files a device downloads one by one. Only paths the
+* target's manifest names are signed, at most
+* {@link ARTIFACT_FILES_REQUEST_LIMIT}; null when any path is unknown or a
+* URL cannot be resolved.
+*/
+async function resolveManifestArtifactFiles({ paths, resolveFileUrl, readStorageText, targetBundle }) {
+	if (paths.length === 0 || paths.length > ARTIFACT_FILES_REQUEST_LIMIT || new Set(paths).size !== paths.length) return null;
+	const target = await loadTargetPlan({
+		currentBundle: null,
+		readStorageText,
+		targetBundle
+	});
+	if (!target) return null;
+	const planned = new Map(target.plan.assets.map((asset) => [asset.assetPath, asset]));
+	const requested = paths.map((path) => planned.get(path));
+	if (requested.some((asset) => asset === void 0)) return null;
+	const files = await Promise.all(requested.map(async (asset) => {
+		const url = await resolveFileUrl(asset.file.storageUri);
+		if (!url) return null;
+		const file = { url };
+		if (asset.file.compression) file.compression = asset.file.compression;
+		return [asset.assetPath, file];
+	}));
+	if (files.some((file) => file === null)) return null;
+	return { files: Object.fromEntries(files.filter((file) => file !== null)) };
+}
 //#endregion
-export { resolveManifestArtifacts };
+export { resolveManifestArtifactFiles, resolveManifestArtifacts, resolveManifestArtifactsV2 };

package/dist/handler.cjs

@@ -90,6 +90,8 @@ function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins =
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");
+	addClientRoute("GET", "/artifacts/v2/:targetBundleId/from/:currentBundleId", "artifactV2");
+	addClientRoute("POST", "/artifacts/v2/:targetBundleId/files", "artifactFilesV2");
 	const adminRouter = require_internalRouter.createRouter();
 	const addAdminRoute = mount(adminRouter, true);
 	addAdminRoute("GET", "/version", "adminVersion");

package/dist/handler.mjs

@@ -91,6 +91,8 @@ function createHotUpdaterHandlers({ api, clientPolicy, endpoints = [], plugins =
 	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
 	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
 	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");
+	addClientRoute("GET", "/artifacts/v2/:targetBundleId/from/:currentBundleId", "artifactV2");
+	addClientRoute("POST", "/artifacts/v2/:targetBundleId/files", "artifactFilesV2");
 	const adminRouter = createRouter();
 	const addAdminRoute = mount(adminRouter, true);
 	addAdminRoute("GET", "/version", "adminVersion");

package/dist/handlerReleaseCatalogRoutes.cjs

@@ -4,6 +4,7 @@ let _hot_updater_protocol = require("@hot-updater/protocol");
 //#region src/handlerReleaseCatalogRoutes.ts
 const CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
 const ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
+const ARTIFACT_V2_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=2";
 const ORIGIN_CACHE_TTL_MS = 5e3;
 const ORIGIN_CACHE_MAX_ENTRIES = 128;
 /** Marks the 404 of a scope that has no catalog. */
@@ -26,6 +27,18 @@ const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
 * `Cache-Control`.
 */
 const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
+/** The paths of an artifact files request, or null when malformed. */
+const readArtifactFilePaths = async (request) => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return null;
+	}
+	const paths = body?.paths;
+	if (!Array.isArray(paths) || paths.length === 0 || paths.length > _hot_updater_protocol.ARTIFACT_FILES_REQUEST_LIMIT || !paths.every((path) => typeof path === "string" && path.length > 0) || new Set(paths).size !== paths.length) return null;
+	return paths;
+};
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
@@ -146,6 +159,30 @@ const createReleaseCatalogRouteHandlers = () => {
 			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
+		artifactV2: async (params, _request, { core }) => {
+			const info = await core.getArtifactInfo(require_handlerParameters.requireRouteParam(params, "targetBundleId"), require_handlerParameters.requireRouteParam(params, "currentBundleId"), 2);
+			if (info === null) return privateNotFound();
+			return new Response(JSON.stringify(info), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
+		artifactFilesV2: async (params, request, { core }) => {
+			const paths = await readArtifactFilePaths(request);
+			if (paths === null) return badRequest(`paths must be 1 to ${_hot_updater_protocol.ARTIFACT_FILES_REQUEST_LIMIT} unique strings`);
+			const files = await core.getArtifactFiles(require_handlerParameters.requireRouteParam(params, "targetBundleId"), paths);
+			if (files === null) return privateNotFound();
+			return new Response(JSON.stringify(files), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
 		artifactV1: async (params, _request, { core }) => {
 			const info = await core.getArtifactInfo(require_handlerParameters.requireRouteParam(params, "targetBundleId"), require_handlerParameters.requireRouteParam(params, "currentBundleId"), 1);
 			if (info === null) return privateNotFound();

package/dist/handlerReleaseCatalogRoutes.mjs

@@ -1,9 +1,10 @@
 import { requirePlatformParam, requireRouteParam } from "./handlerParameters.mjs";
 import { canonicalizeAppVersion } from "@hot-updater/plugin-core";
-import { createReleaseCatalogScopeKey } from "@hot-updater/protocol";
+import { ARTIFACT_FILES_REQUEST_LIMIT, createReleaseCatalogScopeKey } from "@hot-updater/protocol";
 //#region src/handlerReleaseCatalogRoutes.ts
 const CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
 const ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
+const ARTIFACT_V2_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=2";
 const ORIGIN_CACHE_TTL_MS = 5e3;
 const ORIGIN_CACHE_MAX_ENTRIES = 128;
 /** Marks the 404 of a scope that has no catalog. */
@@ -26,6 +27,18 @@ const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
 * `Cache-Control`.
 */
 const CATALOG_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=5, stale-if-error=0";
+/** The paths of an artifact files request, or null when malformed. */
+const readArtifactFilePaths = async (request) => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return null;
+	}
+	const paths = body?.paths;
+	if (!Array.isArray(paths) || paths.length === 0 || paths.length > ARTIFACT_FILES_REQUEST_LIMIT || !paths.every((path) => typeof path === "string" && path.length > 0) || new Set(paths).size !== paths.length) return null;
+	return paths;
+};
 const privateNotFound = () => Response.json({ error: "Not found" }, {
 	status: 404,
 	headers: { "cache-control": "private, no-store" }
@@ -146,6 +159,30 @@ const createReleaseCatalogRouteHandlers = () => {
 			if (invalid) return invalid;
 			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
 		},
+		artifactV2: async (params, _request, { core }) => {
+			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 2);
+			if (info === null) return privateNotFound();
+			return new Response(JSON.stringify(info), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
+		artifactFilesV2: async (params, request, { core }) => {
+			const paths = await readArtifactFilePaths(request);
+			if (paths === null) return badRequest(`paths must be 1 to ${ARTIFACT_FILES_REQUEST_LIMIT} unique strings`);
+			const files = await core.getArtifactFiles(requireRouteParam(params, "targetBundleId"), paths);
+			if (files === null) return privateNotFound();
+			return new Response(JSON.stringify(files), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_V2_CONTENT_TYPE
+				}
+			});
+		},
 		artifactV1: async (params, _request, { core }) => {
 			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 1);
 			if (info === null) return privateNotFound();

package/dist/package.cjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "1.0.4";
+var version = "1.0.6";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.0.4";
+var version = "1.0.6";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/server",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "type": "module",
   "description": "React Native OTA solution for self-hosted",
   "sideEffects": false,
@@ -50,11 +50,11 @@
   "dependencies": {
     "rou3": "0.7.9",
     "verkit": "0.4.0",
-    "@hot-updater/protocol": "1.0.4",
-    "@hot-updater/plugin-api-keys": "1.0.4",
-    "@hot-updater/plugin-insights": "1.0.4",
-    "@hot-updater/plugin-remote-config": "1.0.4",
-    "@hot-updater/plugin-core": "1.0.4"
+    "@hot-updater/plugin-core": "1.0.6",
+    "@hot-updater/protocol": "1.0.6",
+    "@hot-updater/plugin-api-keys": "1.0.6",
+    "@hot-updater/plugin-insights": "1.0.6",
+    "@hot-updater/plugin-remote-config": "1.0.6"
   },
   "peerDependencies": {
     "@prisma/client": "*",
@@ -95,8 +95,8 @@
     "prisma": "6.19.3",
     "uuidv7": "^1.0.2",
     "wrangler": "^4.69.0",
-    "@hot-updater/standalone": "1.0.4",
-    "@hot-updater/test-utils": "1.0.4"
+    "@hot-updater/standalone": "1.0.6",
+    "@hot-updater/test-utils": "1.0.6"
   },
   "nx": {
     "implicitDependencies": [