native-update 1.4.9 → 3.1.0

package/dist/esm/index.js

@@ -1,5 +1,8 @@
 // Main plugin export
 export { NativeUpdate } from './plugin';
+// Runtime enums — MUST be `export {}` not `export type {}` so they survive
+// TypeScript erasure and reach the published bundle.
+export { BackgroundUpdateType, NotificationPriority, UpdateStrategy, UpdateMode, InstallMode, ChecksumAlgorithm, SyncStatus, BundleStatus, InstallStatus, UpdateErrorCode, } from './definitions';
 // Error exports
 export { ErrorCode, NativeUpdateError, ConfigurationError, DownloadError, ValidationError, StorageError, UpdateError as UpdateErrorClass, } from './core/errors';
 // Core exports for advanced users
@@ -8,11 +11,8 @@ export { Logger, LogLevel } from './core/logger';
 export { SecurityValidator } from './core/security';
 export { PluginManager } from './core/plugin-manager';
 export { CacheManager } from './core/cache-manager';
-// Security/Crypto exports
-export { CryptoUtils } from './security/crypto';
 // Manager exports for advanced users
 export { BundleManager } from './live-update/bundle-manager';
 export { DownloadManager } from './live-update/download-manager';
 export { VersionManager } from './live-update/version-manager';
 export { UpdateManager } from './live-update/update-manager';
-//# sourceMappingURL=index.js.map

package/dist/esm/live-update/bundle-manager.d.ts

@@ -1,4 +1,5 @@
 import type { BundleInfo } from '../definitions';
+import type { DownloadManager } from './download-manager';
 /**
  * Manages bundle storage and lifecycle
  */
@@ -10,7 +11,14 @@ export declare class BundleManager {
     private readonly configManager;
     private cache;
     private cacheExpiry;
+    private downloadManager;
     constructor();
+    /**
+     * Wire the DownloadManager so deleteBundle can also remove the
+     * persisted bundle file. Without this, deleted bundles leave their
+     * blob on disk forever.
+     */
+    setDownloadManager(downloadManager: DownloadManager): void;
     /**
      * Initialize the bundle manager with preferences
      */

package/dist/esm/live-update/bundle-manager.js

@@ -11,9 +11,18 @@ export class BundleManager {
         this.preferences = null;
         this.cache = new Map();
         this.cacheExpiry = 0;
+        this.downloadManager = null;
         this.logger = Logger.getInstance();
         this.configManager = ConfigManager.getInstance();
     }
+    /**
+     * Wire the DownloadManager so deleteBundle can also remove the
+     * persisted bundle file. Without this, deleted bundles leave their
+     * blob on disk forever.
+     */
+    setDownloadManager(downloadManager) {
+        this.downloadManager = downloadManager;
+    }
     /**
      * Initialize the bundle manager with preferences
      */
@@ -127,6 +136,17 @@ export class BundleManager {
         if (activeBundleId === bundleId) {
             await this.clearActiveBundle();
         }
+        // Remove the persisted bundle file from filesystem. Failure to delete
+        // metadata earlier was a storage leak: the on-disk zip stayed forever
+        // because deleteBundle only cleaned the metadata cache.
+        if (this.downloadManager) {
+            try {
+                await this.downloadManager.deleteBlob(bundleId);
+            }
+            catch (error) {
+                this.logger.warn('Failed to delete bundle file', { bundleId, error });
+            }
+        }
         this.logger.info('Bundle deleted', { bundleId });
     }
     /**
@@ -322,4 +342,3 @@ export class BundleManager {
         }
     }
 }
-//# sourceMappingURL=bundle-manager.js.map

package/dist/esm/live-update/certificate-pinning.js

@@ -75,4 +75,3 @@ export class CertificatePinning {
         };
     }
 }
-//# sourceMappingURL=certificate-pinning.js.map

package/dist/esm/live-update/delta-processor.d.ts

@@ -7,7 +7,7 @@
  * For production, a WASM-based bsdiff/bspatch implementation can be added
  * for better performance on binary files.
  */
-import type { UpdateCheckResponse } from '../firestore/schema';
+import type { UpdateCheckResponse } from '../types/rollout';
 /**
  * Delta patch information
  */

package/dist/esm/live-update/delta-processor.js

@@ -10,6 +10,7 @@
 import { Logger } from '../core/logger';
 import { ConfigManager } from '../core/config';
 import { DownloadError, ErrorCode, ValidationError } from '../core/errors';
+import { SecurityValidator } from '../core/security';
 /**
  * Delta processor for applying patch updates
  */
@@ -92,6 +93,7 @@ export class DeltaProcessor {
      * Download a delta patch file
      */
     async downloadPatch(url) {
+        SecurityValidator.validateDownloadUrl(url);
         const response = await fetch(url);
         if (!response.ok) {
             throw new DownloadError(ErrorCode.DOWNLOAD_FAILED, `Failed to download delta patch: ${response.status}`);
@@ -102,6 +104,7 @@ export class DeltaProcessor {
      * Download full bundle
      */
     async downloadFull(url, onProgress) {
+        SecurityValidator.validateDownloadUrl(url);
         const response = await fetch(url);
         if (!response.ok) {
             throw new DownloadError(ErrorCode.DOWNLOAD_FAILED, `Failed to download bundle: ${response.status}`);
@@ -296,4 +299,3 @@ export class DeltaProcessor {
 export function createDeltaProcessor() {
     return new DeltaProcessor();
 }
-//# sourceMappingURL=delta-processor.js.map

package/dist/esm/live-update/download-manager.d.ts

@@ -1,9 +1,26 @@
 import type { DownloadProgressEvent } from '../definitions';
+export interface DownloadOptions {
+    onProgress?: (event: DownloadProgressEvent) => void;
+    /**
+     * Byte offset to resume from. When set, the request carries a
+     * `Range: bytes=<N>-` header. If the server responds with 200 instead
+     * of 206, the plugin discards any partial data the caller held and
+     * treats the response as a full download (see resumeDownload).
+     */
+    resumePosition?: number;
+}
 /**
  * Manages file downloads with progress tracking and resume capability
  */
 export declare class DownloadManager {
     private activeDownloads;
+    /**
+     * Persisted-past-request metadata for the most recent `download()`
+     * call per bundleId. Today we only stash whether the server honoured
+     * a Range request (HTTP 206 vs 200). resumeDownload() consults this
+     * to decide whether to concatenate or discard its partial prefix.
+     */
+    private lastResponseMeta;
     private readonly logger;
     private readonly configManager;
     private filesystem;
@@ -17,11 +34,25 @@ export declare class DownloadManager {
      */
     private validateUrl;
     /**
-     * Download a file with progress tracking
-     */
-    download(url: string, bundleId: string, onProgress?: (event: DownloadProgressEvent) => void): Promise<Blob>;
-    /**
-     * Resume a previously interrupted download
+     * Download a file with progress tracking.
+     *
+     * Accepts either a bare `onProgress` callback (back-compat) or a full
+     * DownloadOptions object. When `resumePosition` is set, the request
+     * carries a Range header; the resulting download state records
+     * whether the server actually honoured it (`serverReturnedPartial`).
+     */
+    download(url: string, bundleId: string, onProgressOrOptions?: ((event: DownloadProgressEvent) => void) | DownloadOptions): Promise<Blob>;
+    /**
+     * Resume a previously interrupted download.
+     *
+     * Emits a Range-request download starting at the partial-data offset.
+     * If the server honours the range (HTTP 206), the partial + remaining
+     * bytes are concatenated. If the server returns a full response
+     * (HTTP 200 — common when the upstream URL's ETag changed, or when a
+     * CDN doesn't honour ranges) the partial data is discarded and the
+     * full response is used. Previously this path silently double-wrote
+     * bytes when the server fell back to 200; this was a latent
+     * bundle-corruption bug.
      */
     resumeDownload(url: string, bundleId: string, partialData: Blob, onProgress?: (event: DownloadProgressEvent) => void): Promise<Blob>;
     /**

package/dist/esm/live-update/download-manager.js

@@ -8,6 +8,13 @@ import { Directory } from '@capacitor/filesystem';
 export class DownloadManager {
     constructor() {
         this.activeDownloads = new Map();
+        /**
+         * Persisted-past-request metadata for the most recent `download()`
+         * call per bundleId. Today we only stash whether the server honoured
+         * a Range request (HTTP 206 vs 200). resumeDownload() consults this
+         * to decide whether to concatenate or discard its partial prefix.
+         */
+        this.lastResponseMeta = new Map();
         this.filesystem = null;
         this.logger = Logger.getInstance();
         this.configManager = ConfigManager.getInstance();
@@ -45,9 +52,20 @@ export class DownloadManager {
         }
     }
     /**
-     * Download a file with progress tracking
+     * Download a file with progress tracking.
+     *
+     * Accepts either a bare `onProgress` callback (back-compat) or a full
+     * DownloadOptions object. When `resumePosition` is set, the request
+     * carries a Range header; the resulting download state records
+     * whether the server actually honoured it (`serverReturnedPartial`).
      */
-    async download(url, bundleId, onProgress) {
+    async download(url, bundleId, onProgressOrOptions) {
+        var _a;
+        const options = typeof onProgressOrOptions === 'function'
+            ? { onProgress: onProgressOrOptions }
+            : onProgressOrOptions !== null && onProgressOrOptions !== void 0 ? onProgressOrOptions : {};
+        const onProgress = options.onProgress;
+        const resumePosition = (_a = options.resumePosition) !== null && _a !== void 0 ? _a : 0;
         // Validate inputs
         this.validateUrl(url);
         if (!bundleId) {
@@ -62,6 +80,7 @@ export class DownloadManager {
         const downloadState = {
             controller: abortController,
             startTime: Date.now(),
+            resumePosition: resumePosition > 0 ? resumePosition : undefined,
         };
         this.activeDownloads.set(bundleId, downloadState);
         try {
@@ -73,8 +92,8 @@ export class DownloadManager {
                 Accept: 'application/octet-stream, application/zip',
             };
             // Add Range header if resuming from a previous position
-            if (downloadState.resumePosition && downloadState.resumePosition > 0) {
-                headers['Range'] = `bytes=${downloadState.resumePosition}-`;
+            if (resumePosition > 0) {
+                headers['Range'] = `bytes=${resumePosition}-`;
             }
             const response = await fetch(url, {
                 signal: abortController.signal,
@@ -84,6 +103,13 @@ export class DownloadManager {
             if (!response.ok) {
                 throw new DownloadError(ErrorCode.DOWNLOAD_FAILED, `Download failed: ${response.status} ${response.statusText}`, { status: response.status, statusText: response.statusText });
             }
+            // Record whether the server actually honoured the Range request.
+            // Stored on both the live state (for introspection during the
+            // download) and the lastResponseMeta map (so resumeDownload can
+            // read it after download() cleans up the live state).
+            const serverReturnedPartial = resumePosition > 0 && response.status === 206;
+            downloadState.serverReturnedPartial = serverReturnedPartial;
+            this.lastResponseMeta.set(bundleId, { partial: serverReturnedPartial });
             // Validate content type
             const contentType = response.headers.get('content-type');
             if (contentType && !this.isValidContentType(contentType)) {
@@ -155,25 +181,31 @@ export class DownloadManager {
         }
     }
     /**
-     * Resume a previously interrupted download
+     * Resume a previously interrupted download.
+     *
+     * Emits a Range-request download starting at the partial-data offset.
+     * If the server honours the range (HTTP 206), the partial + remaining
+     * bytes are concatenated. If the server returns a full response
+     * (HTTP 200 — common when the upstream URL's ETag changed, or when a
+     * CDN doesn't honour ranges) the partial data is discarded and the
+     * full response is used. Previously this path silently double-wrote
+     * bytes when the server fell back to 200; this was a latent
+     * bundle-corruption bug.
      */
     async resumeDownload(url, bundleId, partialData, onProgress) {
-        // Update download state with resume position
-        const downloadState = this.activeDownloads.get(bundleId);
-        if (downloadState) {
-            downloadState.resumePosition = partialData.size;
-        }
-        try {
-            // Download remaining bytes
-            const remainingData = await this.download(url, bundleId, onProgress);
-            // Combine partial and remaining data
-            return new Blob([partialData, remainingData]);
-        }
-        catch (error) {
-            // Resume failed, clean up
-            this.activeDownloads.delete(bundleId);
-            throw error;
+        const responseBlob = await this.download(url, bundleId, {
+            onProgress,
+            resumePosition: partialData.size,
+        });
+        // Read the flag download() set in lastResponseMeta. If the server
+        // returned 206 we concatenate; if 200 we discard the partial.
+        const meta = this.lastResponseMeta.get(bundleId);
+        this.lastResponseMeta.delete(bundleId);
+        if (meta === null || meta === void 0 ? void 0 : meta.partial) {
+            return new Blob([partialData, responseBlob]);
         }
+        this.logger.info('Resume: server returned full response; discarding partial data', { bundleId, partialSize: partialData.size, responseSize: responseBlob.size });
+        return responseBlob;
     }
     /**
      * Check if a download can be resumed
@@ -259,9 +291,16 @@ export class DownloadManager {
         let lastError = null;
         for (let attempt = 0; attempt < maxRetries; attempt++) {
             try {
-                // Add delay between retries (exponential backoff)
+                // Exponential backoff with ±25% jitter, capped at 30s. Jitter
+                // avoids a thundering-herd when many clients retry in lockstep
+                // after a common failure (CDN blip, server restart) — without
+                // it every client would wake up at exactly the same moment and
+                // DDoS the recovering server. 25% is enough desync without
+                // making the retry interval feel unpredictable.
                 if (attempt > 0) {
-                    const delay = Math.min(retryDelay * Math.pow(2, attempt - 1), 30000);
+                    const base = retryDelay * Math.pow(2, attempt - 1);
+                    const jitter = (Math.random() - 0.5) * 0.5 * base;
+                    const delay = Math.min(Math.max(base + jitter, 100), 30000);
                     await new Promise((resolve) => setTimeout(resolve, delay));
                     this.logger.debug('Retrying download', { bundleId, attempt, delay });
                 }
@@ -296,7 +335,15 @@ export class DownloadManager {
             throw new DownloadError(ErrorCode.MISSING_DEPENDENCY, 'Filesystem not initialized');
         }
         const arrayBuffer = await this.blobToArrayBuffer(blob);
-        const base64 = btoa(String.fromCharCode(...new Uint8Array(arrayBuffer)));
+        // Spreading a 100MB Uint8Array into String.fromCharCode is a stack
+        // overflow on most engines. Chunk the conversion in 32KB blocks.
+        const bytes = new Uint8Array(arrayBuffer);
+        const chunkSize = 0x8000;
+        let binary = '';
+        for (let i = 0; i < bytes.length; i += chunkSize) {
+            binary += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + chunkSize)));
+        }
+        const base64 = btoa(binary);
         const path = `bundles/${bundleId}/bundle.zip`;
         await this.filesystem.writeFile({
             path,
@@ -363,4 +410,3 @@ export class DownloadManager {
         }
     }
 }
-//# sourceMappingURL=download-manager.js.map

package/dist/esm/live-update/rollout-checker.d.ts

@@ -4,7 +4,7 @@
  * Client-side rollout eligibility checking for staged deployments.
  * Uses deterministic hashing for consistent rollout decisions.
  */
-import type { RolloutConfig, DeviceInfo } from '../firestore/schema';
+import type { RolloutConfig, DeviceInfo } from '../types/rollout';
 /**
  * Rollout eligibility result
  */

package/dist/esm/live-update/rollout-checker.js

@@ -4,7 +4,7 @@
  * Client-side rollout eligibility checking for staged deployments.
  * Uses deterministic hashing for consistent rollout decisions.
  */
-import { timestampToDate } from '../firestore/schema';
+import { toEpochMs } from '../types/rollout';
 import { Logger } from '../core/logger';
 import { ConfigManager } from '../core/config';
 /**
@@ -77,7 +77,7 @@ export class RolloutChecker {
      */
     checkTimeWindow(rollout) {
         const now = Date.now();
-        const startTime = timestampToDate(rollout.startTime).getTime();
+        const startTime = toEpochMs(rollout.startTime);
         if (now < startTime) {
             return {
                 eligible: false,
@@ -85,7 +85,7 @@ export class RolloutChecker {
             };
         }
         if (rollout.endTime) {
-            const endTime = timestampToDate(rollout.endTime).getTime();
+            const endTime = toEpochMs(rollout.endTime);
             if (now > endTime) {
                 return {
                     eligible: false,
@@ -100,7 +100,7 @@ export class RolloutChecker {
      */
     checkScheduled(scheduledTime) {
         const now = Date.now();
-        const scheduled = timestampToDate(scheduledTime).getTime();
+        const scheduled = toEpochMs(scheduledTime);
         if (now < scheduled) {
             return {
                 eligible: false,
@@ -170,7 +170,7 @@ export class RolloutChecker {
         if (!gradualSteps || !gradualInterval) {
             return rollout.percentage;
         }
-        const startTime = timestampToDate(rollout.startTime).getTime();
+        const startTime = toEpochMs(rollout.startTime);
         const elapsedHours = (Date.now() - startTime) / (1000 * 60 * 60);
         const stepIndex = Math.floor(elapsedHours / gradualInterval);
         if (stepIndex >= gradualSteps.length) {
@@ -302,4 +302,3 @@ export async function collectDeviceInfo() {
         region: undefined, // Could be determined via geolocation or timezone
     };
 }
-//# sourceMappingURL=rollout-checker.js.map

package/dist/esm/live-update/update-manager.d.ts

@@ -18,7 +18,18 @@ export declare class UpdateManager {
      */
     applyUpdate(bundleId: string, options?: UpdateOptions): Promise<void>;
     /**
-     * Validate update before applying
+     * Validate update before applying.
+     *
+     * Version-safety checks here are the last line of defense before a bundle
+     * is activated. We enforce two invariants:
+     *   1. Active-bundle monotonicity — new bundle must be strictly newer than
+     *      whatever is currently active on this device.
+     *   2. Persisted high-water-mark — new bundle must be strictly newer than
+     *      the highest version this device has ever applied in this channel.
+     *      Catches an attacker who wipes the download cache (or serves an
+     *      older manifest) to force a downgrade to a vulnerable build.
+     * The old `allowDowngrade` escape hatch was removed in v2 — downgrades are
+     * a debug/recovery flow and belong in a dedicated API, not an option flag.
      */
     private validateUpdate;
     /**

package/dist/esm/live-update/update-manager.js

@@ -26,6 +26,7 @@ export class UpdateManager {
      * Apply bundle update atomically
      */
     async applyUpdate(bundleId, options) {
+        var _a;
         if (this.updateInProgress) {
             throw new UpdateError(ErrorCode.UPDATE_FAILED, 'Another update is already in progress');
         }
@@ -64,9 +65,20 @@ export class UpdateManager {
             await this.verifyUpdate(newBundle);
             // Mark as active
             await bundleManager.setActiveBundle(bundleId);
-            // Clean up old bundles if configured
-            if (options === null || options === void 0 ? void 0 : options.cleanupOldBundles) {
-                await bundleManager.cleanupOldBundles(options.keepBundleCount || 3);
+            // Advance the monotonic high-water mark so future update checks and
+            // reinstalls cannot be tricked into applying an older version.
+            const versionManager = this.pluginManager.getVersionManager();
+            const configManager = this.pluginManager.getConfigManager();
+            await versionManager.rememberAppliedVersion(configManager.get('channel'), newBundle.version);
+            // Auto-cleanup by default. The old opt-in flag left most
+            // integrations accumulating bundles forever, which is a disk
+            // exhaustion path on devices with limited storage. Host apps
+            // that genuinely want every historical bundle can pass
+            // cleanupOldBundles: false explicitly.
+            const shouldCleanup = (options === null || options === void 0 ? void 0 : options.cleanupOldBundles) !== false;
+            if (shouldCleanup) {
+                const keep = (_a = options === null || options === void 0 ? void 0 : options.keepBundleCount) !== null && _a !== void 0 ? _a : 3;
+                await bundleManager.cleanupOldBundles(keep);
             }
             logger.info('Bundle update completed successfully', {
                 bundleId,
@@ -89,16 +101,32 @@ export class UpdateManager {
         }
     }
     /**
-     * Validate update before applying
+     * Validate update before applying.
+     *
+     * Version-safety checks here are the last line of defense before a bundle
+     * is activated. We enforce two invariants:
+     *   1. Active-bundle monotonicity — new bundle must be strictly newer than
+     *      whatever is currently active on this device.
+     *   2. Persisted high-water-mark — new bundle must be strictly newer than
+     *      the highest version this device has ever applied in this channel.
+     *      Catches an attacker who wipes the download cache (or serves an
+     *      older manifest) to force a downgrade to a vulnerable build.
+     * The old `allowDowngrade` escape hatch was removed in v2 — downgrades are
+     * a debug/recovery flow and belong in a dedicated API, not an option flag.
      */
-    async validateUpdate(currentBundle, newBundle, options) {
+    async validateUpdate(currentBundle, newBundle, _options) {
         const logger = this.pluginManager.getLogger();
         const versionManager = this.pluginManager.getVersionManager();
-        // Check if downgrade
-        if (currentBundle && !(options === null || options === void 0 ? void 0 : options.allowDowngrade)) {
-            if (versionManager.shouldBlockDowngrade(currentBundle.version, newBundle.version)) {
-                throw new ValidationError(ErrorCode.VERSION_DOWNGRADE, `Cannot downgrade from ${currentBundle.version} to ${newBundle.version}`);
-            }
+        const configManager = this.pluginManager.getConfigManager();
+        if (currentBundle &&
+            versionManager.shouldBlockDowngrade(currentBundle.version, newBundle.version)) {
+            throw new ValidationError(ErrorCode.VERSION_DOWNGRADE, `Cannot downgrade from ${currentBundle.version} to ${newBundle.version}`);
+        }
+        const channel = configManager.get('channel');
+        const maxSeen = await versionManager.getMaxSeenVersion(channel);
+        if (maxSeen &&
+            versionManager.shouldBlockDowngrade(maxSeen, newBundle.version)) {
+            throw new ValidationError(ErrorCode.VERSION_DOWNGRADE, `Cannot apply ${newBundle.version} - device has previously applied ${maxSeen} on channel ${channel}`);
         }
         // Verify bundle integrity
         if (!newBundle.verified) {
@@ -291,4 +319,3 @@ export class UpdateManager {
         this.currentState = null;
     }
 }
-//# sourceMappingURL=update-manager.js.map

package/dist/esm/live-update/version-manager.d.ts

@@ -1,5 +1,4 @@
 import type { LatestVersion } from '../definitions';
-import type { DeviceInfo, UpdateCheckResponse } from '../firestore/schema';
 /**
  * Manages version checking and comparison
  */
@@ -11,8 +10,6 @@ export declare class VersionManager {
     private readonly securityValidator;
     private preferences;
     private memoryCache;
-    private firestoreClient;
-    private manifestReader;
     constructor();
     /**
      * Compare two semantic versions
@@ -30,15 +27,6 @@ export declare class VersionManager {
      * Initialize the version manager
      */
     initialize(): Promise<void>;
-    /**
-     * Check for updates from Firestore backend
-     * Uses ManifestReader for efficient single-document reads
-     */
-    checkForUpdatesFromFirestore(currentVersion: string, deviceInfo: DeviceInfo): Promise<UpdateCheckResponse | null>;
-    /**
-     * Get the appropriate update checker based on backend type
-     */
-    checkForUpdatesAuto(currentVersion: string, deviceInfo?: DeviceInfo): Promise<LatestVersion | UpdateCheckResponse | null>;
     /**
      * Check for latest version from server
      */
@@ -93,4 +81,13 @@ export declare class VersionManager {
      * Check if downgrade protection should block update
      */
     shouldBlockDowngrade(currentVersion: string, newVersion: string): boolean;
+    /**
+     * Persisted high-water-mark version per channel. Survives reinstalls that
+     * leave Preferences intact; protects against an attacker feeding an older
+     * (and potentially vulnerable) bundle even after a full cache wipe of
+     * downloaded bundles. Paired with `rememberAppliedVersion`.
+     */
+    private maxVersionKey;
+    getMaxSeenVersion(channel: string): Promise<string | null>;
+    rememberAppliedVersion(channel: string, version: string): Promise<void>;
 }