@akanjs/cli 3.1.0-rc.1 → 3.1.0-rc.11

package/{index-1w2qaee2.js → index-g1mbppa9.js}

@@ -2,16 +2,19 @@
 import {
   binPlatforms,
   ServerEnvProfile,
-  Executor
-} from "./index-55mynnqs.js";
+  Executor,
+  WorkspaceExecutor
+} from "./index-va06nr10.js";
 import {
   resolveAppId,
   targetHtmlFilename
-} from "./index-q958tqqg.js";
-
-// pkgs/@akanjs/devkit/mobile/nativeApp.ts
-import { rm as rm3 } from "fs/promises";
-import path7 from "path";
+} from "./index-m9jj544v.js";
+import {
+  ExitCodeError
+} from "./index-jw1zm273.js";
+import {
+  CsrArtifactBuilder
+} from "./index-665zp9rs.js";
 
 // pkgs/@akanjs/devkit/mobile/desktopBin.ts
 import { chmod, mkdir, rename, rm, writeFile } from "fs/promises";
@@ -138,6 +141,7 @@ import path2 from "path";
 
 class NativeApi {
   static supportedMajor = 0;
+  static minimumVersion = "0.12.0";
   static entryOf(appDir) {
     const workspaceEntry = NativeApi.#resolve("@akanjs/native/api", appDir);
     if (workspaceEntry)
@@ -153,8 +157,8 @@ class NativeApi {
       throw new Error(`The installed akanjs has no native build at ${entry}; update akanjs.`);
     const api = await import(entry);
     const major = Number(api.API_VERSION.split(".")[0]);
-    if (major !== NativeApi.supportedMajor)
-      throw new Error(`The native build API is ${api.API_VERSION}, and this akan CLI speaks ${NativeApi.supportedMajor}.x; install matching versions of akanjs and @akanjs/cli.`);
+    if (major !== NativeApi.supportedMajor || Bun.semver.order(api.API_VERSION, NativeApi.minimumVersion) < 0)
+      throw new Error(`The native build API is ${api.API_VERSION}, and this akan CLI speaks ${NativeApi.minimumVersion} or a later ${NativeApi.supportedMajor}.x; install matching versions of akanjs and @akanjs/cli.`);
     return api;
   }
   static #resolve(specifier, from) {
@@ -166,6 +170,10 @@ class NativeApi {
   }
 }
 
+// pkgs/@akanjs/devkit/mobile/nativeApp.ts
+import path8 from "path";
+import { toError } from "akanjs/common";
+
 // pkgs/@akanjs/devkit/mobile/nativeAppLine.ts
 class NativeAppLine {
   static #page = /^\[page(\+)?(?:#(\d+))? (trace|verbose|debug|log|info|warn|error)\] ?(.*)$/;
@@ -224,6 +232,7 @@ class NativeAppLine {
 // pkgs/@akanjs/devkit/mobile/nativeConfig.ts
 import { readFileSync } from "fs";
 import path3 from "path";
+import { trimSlashes } from "akanjs/common";
 
 // pkgs/@akanjs/devkit/mobile/usageDescriptions.ts
 import { capitalize } from "akanjs/common";
@@ -425,7 +434,7 @@ class NativeConfig {
     return url && keys ? { ...rest, url, ...keys, ...channel ? { channel } : {} } : undefined;
   }
   static fileNameOf(name) {
-    return name.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[-.]+|[-.]+$/g, "") || "app";
+    return /[^-.](?:.*[^-.])?/.exec(name.replace(/[^A-Za-z0-9._-]/g, "-"))?.[0] ?? "app";
   }
   static #pluginId(appPath, spec) {
     if (NativeConfig.#isId(spec))
@@ -448,7 +457,7 @@ class NativeConfig {
     return Object.assign({}, ...contributed, own);
   }
   static #deepLinks(target, locales) {
-    const basePath = target.basePath?.replace(/^\/+|\/+$/g, "");
+    const basePath = target.basePath ? trimSlashes(target.basePath) : "";
     const pathPrefixes = basePath ? locales.map((locale) => `/${locale}/${basePath}`) : undefined;
     return {
       ...target.deepLinks?.schemes?.length ? { schemes: target.deepLinks.schemes } : {},
@@ -500,9 +509,109 @@ class NativePluginFolders {
   }
 }
 
+// pkgs/@akanjs/devkit/mobile/nativePublicEnv.ts
+import { createHash } from "crypto";
+class NativePublicEnv {
+  static derivedKeys = [
+    "AKAN_PUBLIC_APP_NAME",
+    "AKAN_PUBLIC_BASE_PATHS",
+    "AKAN_PUBLIC_API_PREFIX",
+    "AKAN_PUBLIC_WS_PREFIX",
+    "AKAN_PUBLIC_RENDER_ENV",
+    "AKAN_PUBLIC_DEFAULT_LOCALE",
+    "AKAN_PUBLIC_LOCALES"
+  ];
+  static #keyPattern = /^AKAN_PUBLIC_[A-Z0-9_]{1,128}$/;
+  static #secretWords = ["SECRET", "TOKEN", "PASSWORD", "PRIVATE", "CREDENTIAL"];
+  static #maxKeys = 256;
+  static #maxBytes = 64 * 1024;
+  static of(env) {
+    return Object.fromEntries(Object.keys(env).filter((key) => key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key)).sort().map((key) => [key, String(env[key])]));
+  }
+  static hash(publicEnv) {
+    return createHash("sha256").update(JSON.stringify(NativePublicEnv.of(publicEnv))).digest("hex");
+  }
+  static problems(publicEnv) {
+    const keys = Object.keys(publicEnv);
+    const problems = keys.flatMap((key) => {
+      const value = publicEnv[key];
+      if (!NativePublicEnv.#keyPattern.test(key))
+        return [`${key} is not an AKAN_PUBLIC_[A-Z0-9_] name`];
+      const word = NativePublicEnv.#secretWords.find((secret) => key.includes(secret));
+      if (word)
+        return [`${key} names a ${word.toLowerCase()}, which a page bundle must not carry`];
+      if (typeof value !== "string")
+        return [`${key} is not a string`];
+      if (/[\u0000-\u001f\u007f]/.test(value))
+        return [`${key} holds a control character`];
+      return [];
+    });
+    if (keys.length > NativePublicEnv.#maxKeys)
+      problems.push(`${keys.length} keys, more than ${NativePublicEnv.#maxKeys}`);
+    const bytes = Buffer.byteLength(JSON.stringify(publicEnv));
+    if (bytes > NativePublicEnv.#maxBytes)
+      problems.push(`${bytes} bytes, more than ${NativePublicEnv.#maxBytes}`);
+    return problems;
+  }
+  static diff(a, b) {
+    return [...new Set([...Object.keys(a), ...Object.keys(b)])].filter((key) => a[key] !== b[key]).sort((x, y) => x < y ? -1 : x > y ? 1 : 0);
+  }
+  static async built(app) {
+    const file = Bun.file(CsrArtifactBuilder.publicEnvPath(app));
+    if (!await file.exists())
+      return null;
+    return NativePublicEnv.of(await file.json());
+  }
+  static async recordedIn(bundleFile) {
+    const file = Bun.file(bundleFile);
+    if (!await file.exists())
+      return null;
+    const bundle = await file.json();
+    return bundle.web?.publicEnv ?? null;
+  }
+  static async load(file) {
+    const source = Bun.file(file);
+    if (!await source.exists())
+      throw new Error(`--public-env ${file} does not exist.`);
+    const json = await source.json().catch(() => null);
+    if (!json || typeof json !== "object" || Array.isArray(json))
+      throw new Error(`--public-env ${file} is not a JSON object of AKAN_PUBLIC_* values or a bundle.json.`);
+    const isBundle = json.schema === 1 && typeof json.web === "object";
+    const map = isBundle ? json.web.publicEnv : json;
+    if (!map)
+      throw new Error(`--public-env ${file} is a bundle.json from a build that recorded no public env.`);
+    const derived = Object.keys(map).filter((key) => NativePublicEnv.derivedKeys.includes(key));
+    if (derived.length)
+      throw new Error(`--public-env ${file} sets ${derived.join(", ")}, which akan.config.ts decides.`);
+    const problems = NativePublicEnv.problems(map);
+    if (problems.length)
+      throw new Error(`--public-env ${file} is refused:
+- ${problems.join(`
+- `)}`);
+    return NativePublicEnv.of(map);
+  }
+  static pin(publicEnv) {
+    for (const key of Object.keys(process.env))
+      if (key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key))
+        delete process.env[key];
+    Object.assign(process.env, publicEnv);
+    WorkspaceExecutor.publicEnvPin = publicEnv;
+  }
+  static async problemAgainst(shipped, bundle) {
+    const [before, now] = await Promise.all([NativePublicEnv.recordedIn(shipped), NativePublicEnv.recordedIn(bundle)]);
+    if (!before)
+      return null;
+    const differs = NativePublicEnv.diff(before, now ?? {});
+    if (!differs.length)
+      return null;
+    return `public env ${differs.join(", ")} differs from the store build's (pass --public-env ${shipped} to repeat it)`;
+  }
+}
+
 // pkgs/@akanjs/devkit/mobile/nativeWebDir.ts
 import { cp, mkdir as mkdir2, rm as rm2, stat } from "fs/promises";
 import path5 from "path";
+import { trimSlashes as trimSlashes2 } from "akanjs/common";
 
 class NativeWebDir {
   dir;
@@ -513,13 +622,13 @@ class NativeWebDir {
   static injectTarget(html, target) {
     if (html.includes(NativeWebDir.#targetTag))
       return html;
-    const basePath = target.basePath?.replace(/^\/+|\/+$/g, "") ?? "";
+    const basePath = target.basePath ? trimSlashes2(target.basePath) : "";
     const script = `${NativeWebDir.#targetTag}${JSON.stringify({
       name: target.name,
       basePath,
       indexPath: target.indexPath
     })};</script>`;
-    const head = /<head(?:\s[^>]*)?>/i.exec(html);
+    const head = /<head(?:\s[^<>]*)?>/i.exec(html);
     if (!head)
       return `${script}
 ${html}`;
@@ -562,14 +671,14 @@ class ServerBundleSecrets {
   workspaceRoot;
   appDir;
   static #largestFile = 64 * 1024 * 1024;
+  static #printer = new Bun.Transpiler({ loader: "js", target: "bun" });
+  static #notSource = new Set(["node_modules", "env", "private", "public", "dist"]);
   constructor(workspaceRoot, appDir) {
     this.workspaceRoot = workspaceRoot;
     this.appDir = appDir;
   }
   async envFiles() {
-    const libsDir = path6.join(this.workspaceRoot, "libs");
-    const libs = await readdir2(libsDir).catch(() => []);
-    const dirs = [path6.join(this.appDir, "env"), ...libs.map((lib) => path6.join(libsDir, lib, "env"))];
+    const dirs = [path6.join(this.appDir, "env"), ...(await this.#libDirs()).map((lib) => path6.join(lib, "env"))];
     const files = await Promise.all(dirs.map(async (dir) => (await readdir2(dir).catch(() => [])).filter((name) => /^env\.server\.[A-Za-z0-9.-]+\.ts$/.test(name) && !/\.(type|example)\.ts$/.test(name)).map((name) => path6.join(dir, name))));
     return files.flat();
   }
@@ -584,24 +693,52 @@ class ServerBundleSecrets {
         unread.push(ServerBundleSecrets.#relative(this.workspaceRoot, file));
       }
     }
+    if (!secrets.length)
+      return unread;
+    const sought = secrets.map((secret) => ({ secret, needles: ServerBundleSecrets.#needles(secret.value) }));
     const found = [];
     for (const bundled of await ServerBundleSecrets.#files(bundleDir)) {
       const text = await readFile(bundled, "latin1");
-      for (const secret of secrets)
-        if (ServerBundleSecrets.#needles(secret.value).some((needle) => text.includes(needle)))
-          found.push(`${ServerBundleSecrets.#relative(bundleDir, bundled)} holds ${ServerBundleSecrets.#relative(this.workspaceRoot, secret.file)} ${secret.path}`);
+      for (const { secret, needles } of sought)
+        if (needles.some((needle) => text.includes(needle)))
+          found.push({ bundled, secret });
     }
-    if (found.length)
-      throw new Error(`The server this app carries holds secret values from the workspace's env files, so it is not signed or sent anywhere:
-  ${[...new Set(found)].join(`
+    const coded = found.length ? await this.#coded(found.map(({ secret }) => secret.value)) : new Set;
+    const leaks = found.filter(({ secret }) => !coded.has(secret.value)).map(({ bundled, secret }) => `${ServerBundleSecrets.#relative(bundleDir, bundled)} holds ${ServerBundleSecrets.#relative(this.workspaceRoot, secret.file)} ${secret.path}`);
+    if (leaks.length)
+      throw new Error(`The server this app carries holds secret values of the workspace's env files, so the release stops here:
+  ${[...new Set(leaks)].join(`
   `)}
-Build its server with a profile (native.desktop.server.profile), whose bundle carries no secret.`);
+Build its server with a profile (native.desktop.server.profile), whose bundle leaves the env files' secrets out. A value a profile build still holds sits in code or a file the server carries: take it out there.`);
     return unread;
   }
+  async#coded(values) {
+    const plain = [...new Set(values)].filter((value) => !ServerEnvProfile.distinctive(value));
+    const coded = new Set;
+    if (!plain.length)
+      return coded;
+    for (const dir of [this.appDir, ...await this.#libDirs()])
+      for (const file of await ServerBundleSecrets.#sources(dir)) {
+        const text = await readFile(file, "utf8");
+        for (const value of plain)
+          if (text.includes(value))
+            coded.add(value);
+      }
+    return coded;
+  }
+  async#libDirs() {
+    const libsDir = path6.join(this.workspaceRoot, "libs");
+    return (await readdir2(libsDir).catch(() => [])).map((lib) => path6.join(libsDir, lib));
+  }
   static #needles(value) {
     const escaped = JSON.stringify(value).slice(1, -1);
     const line = value.split(/\r?\n/).find((part) => part.length >= 32);
-    return [...new Set([value, escaped, ...line ? [line] : []])];
+    const forms = [value, escaped, ServerBundleSecrets.#printed(value), ...line ? [line] : []];
+    return [...new Set(forms.map((form) => Buffer.from(form, "utf8").toString("latin1")))];
+  }
+  static #printed(value) {
+    const code = ServerBundleSecrets.#printer.transformSync(`export default ${JSON.stringify(value)};`);
+    return /^export default (["'`])([\s\S]*)\1;?\s*$/.exec(code)?.[2] ?? value;
   }
   static #relative(from, to) {
     return path6.relative(from, to).split(path6.sep).join("/");
@@ -618,6 +755,102 @@ Build its server with a profile (native.desktop.server.profile), whose bundle ca
     }
     return files;
   }
+  static async#sources(dir) {
+    const files = [];
+    for (const entry of await readdir2(dir, { withFileTypes: true }).catch(() => [])) {
+      if (entry.name.startsWith("."))
+        continue;
+      const file = path6.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!ServerBundleSecrets.#notSource.has(entry.name))
+          files.push(...await ServerBundleSecrets.#sources(file));
+      } else if (/\.(?:[cm]?[jt]sx?|json)$/.test(entry.name) && !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(entry.name))
+        files.push(file);
+    }
+    return files;
+  }
+}
+
+// pkgs/@akanjs/devkit/mobile/updatePackFolder.ts
+import { mkdtemp, rm as rm3 } from "fs/promises";
+import os from "os";
+import path7 from "path";
+class UpdatePackFolder {
+  static packFile = "pack.json";
+  static compatFile = "compat.json";
+  static bundleFile = "bundle.json";
+  static templateFile = "manifest.template.json";
+  static filesDir = "files";
+  static #records = [
+    UpdatePackFolder.templateFile,
+    UpdatePackFolder.bundleFile,
+    UpdatePackFolder.packFile,
+    UpdatePackFolder.compatFile
+  ];
+  static #sha256 = /^[0-9a-f]{64}$/;
+  static async clear(dir) {
+    await Promise.all([UpdatePackFolder.packFile, UpdatePackFolder.compatFile].map((name) => rm3(path7.join(dir, name), { force: true })));
+  }
+  static async read(dir) {
+    const file = Bun.file(path7.join(dir, UpdatePackFolder.packFile));
+    if (!await file.exists())
+      throw new Error(`${dir} holds no ${UpdatePackFolder.packFile}: give the folder \`akan pack-update\` wrote.`);
+    const pack = await file.json();
+    if (pack.schema !== 1)
+      throw new Error(`${dir}/${UpdatePackFolder.packFile} is schema ${pack.schema}, and this akan reads schema 1.`);
+    return { ...pack, out: path7.resolve(dir) };
+  }
+  static async write({ out, ...record }) {
+    await Bun.write(path7.join(out, UpdatePackFolder.packFile), `${JSON.stringify(record, null, 2)}
+`);
+  }
+  static async writeCompat(pack, compat) {
+    pack.compat = compat;
+    await Bun.write(path7.join(pack.out, UpdatePackFolder.compatFile), `${JSON.stringify(compat, null, 2)}
+`);
+  }
+  static async readBundle(file) {
+    return await Bun.file(file).json();
+  }
+  static storeBuildVerdict({ out, compat }, then) {
+    if (!compat || compat.compatible)
+      return null;
+    return new ExitCodeError(`The pack in ${out} needs a new store build; it differs from the one ${compat.against} came from:
+- ${compat.problems.join(`
+- `)}${then ? `
+${then}` : ""}`, 2);
+  }
+  static async withArchive(pack, use) {
+    const { templateFile, filesDir } = UpdatePackFolder;
+    const template = Bun.file(path7.join(pack.out, templateFile));
+    if (!await template.exists())
+      throw new Error(`${pack.out} holds no ${templateFile}: give the folder \`akan pack-update\` wrote.`);
+    const { files = [] } = await template.json();
+    const hashes = [...new Set(files.map((file) => file.sha256))];
+    if (!hashes.every((hash) => typeof hash === "string" && UpdatePackFolder.#sha256.test(hash)))
+      throw new Error(`${pack.out}/${templateFile} lists a file whose sha256 is not 64 hex digits.`);
+    const present = await Promise.all(UpdatePackFolder.#records.map((name) => Bun.file(path7.join(pack.out, name)).exists()));
+    const entries = [
+      ...UpdatePackFolder.#records.filter((_, idx) => present[idx]),
+      ...hashes.map((hash) => `${filesDir}/${hash}`)
+    ];
+    const dir = await mkdtemp(path7.join(os.tmpdir(), "akan-pack-"));
+    try {
+      const tar = Bun.spawn(["tar", "-czf", "pack.tgz", "-C", pack.out, "-T", "-"], {
+        cwd: dir,
+        stdin: new Blob([entries.map((entry) => `./${entry}
+`).join("")]),
+        stdout: "ignore",
+        stderr: "pipe"
+      });
+      const [code, stderr] = await Promise.all([tar.exited, new Response(tar.stderr).text()]);
+      if (code !== 0)
+        throw new Error(`tar of ${pack.out} failed: ${stderr.trim()}`);
+      return await use(path7.join(dir, "pack.tgz"));
+    } finally {
+      await rm3(dir, { recursive: true, force: true });
+    }
+  }
 }
 
 // pkgs/@akanjs/devkit/mobile/nativeApp.ts
@@ -632,14 +865,14 @@ class NativeApp {
     this.app = app;
     this.target = target;
     this.env = env;
-    this.targetRoot = path7.join(app.workspace.workspaceRoot, "dist", "native", app.name, target.name);
-    this.web = new NativeWebDir(path7.join(this.targetRoot, "web"));
+    this.targetRoot = path8.join(app.workspace.workspaceRoot, "dist", "native", app.name, target.name);
+    this.web = new NativeWebDir(path8.join(this.targetRoot, "web"));
   }
   outDir(platform) {
-    return path7.join(this.targetRoot, "build", platform);
+    return path8.join(this.targetRoot, "build", platform);
   }
   devOutDir(platform) {
-    return path7.join(this.targetRoot, "dev", platform);
+    return path8.join(this.targetRoot, "dev", platform);
   }
   indexPath(platform) {
     const { config } = this.target;
@@ -649,13 +882,13 @@ class NativeApp {
   async assembleWeb(platform) {
     const dist = this.app.dist.cwdPath;
     return await this.web.assemble({ ...this.target.config, indexPath: this.indexPath(platform) }, {
-      html: path7.join(dist, "csr", targetHtmlFilename(this.target.config)),
-      publicDir: path7.join(dist, "public"),
-      fontsDir: path7.join(dist, ".akan", "artifact", "fonts")
+      html: path8.join(dist, "csr", targetHtmlFilename(this.target.config)),
+      publicDir: path8.join(dist, "public"),
+      fontsDir: path8.join(dist, ".akan", "artifact", "fonts")
     });
   }
   get binDir() {
-    return path7.join(this.targetRoot, "bin");
+    return path8.join(this.targetRoot, "bin");
   }
   async config({
     server,
@@ -739,16 +972,17 @@ class NativeApp {
     NativeApp.#assertServerPlatform(platform, server);
     NativeApp.assertInstaller(platform, installer);
     await this.assembleWeb(platform);
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare(platform, server, arch);
     const distribution = await this.#distribution(api, platform, profile, { sign, notarize }, server);
-    return await api.build({
+    return await this.#recorded(this.outDir(platform), publicEnv, api.build({
       ...this.#task(platform, config, { env: await this.#runtimeEnv(server) }),
       profile,
       ...arch ? { arch } : {},
       ...platform === "windows" ? { windows: { ...installer ? { installer } : {}, ...distribution.windows } } : {},
       ...platform === "macos" ? { macos: { ...distribution.macos, ...installer ? { dmg: true } : {} } } : {},
       ...platform === "linux" && installer ? { linux: { appImage: true } } : {}
-    });
+    }));
   }
   async run(platform, { device, teamId, profile = "debug", server } = {}) {
     NativeApp.#assertServerPlatform(platform, server);
@@ -804,22 +1038,25 @@ class NativeApp {
   }
   async releaseIos({ teamId, adHoc = false } = {}) {
     await this.assembleWeb("ios");
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare("ios");
-    return await api.release({
+    return await this.#recorded(this.outDir("ios"), publicEnv, api.release({
       ...this.#task("ios", config, { env: await this.#runtimeEnv() }),
       platform: "ios",
       signing: { ...teamId ? { teamId } : {}, ...adHoc ? { distribution: "ad-hoc" } : {} }
-    });
+    }));
   }
   get updatesDir() {
-    return path7.join(this.targetRoot, "updates");
+    return path8.join(this.targetRoot, "updates");
   }
   async publishUpdate(platform, {
     channel,
     server,
     arch,
     sign = false,
-    notarize = false
+    notarize = false,
+    revoke,
+    resetSequence
   } = {}) {
     NativeApp.#assertServerPlatform(platform, server);
     this.#assertUpdates();
@@ -833,25 +1070,35 @@ class NativeApp {
       ...channel ? { channel } : {},
       ...arch ? { arch } : {},
       ...distribution.macos ? { macos: distribution.macos } : {},
-      ...distribution.windows ? { windows: distribution.windows } : {}
+      ...distribution.windows ? { windows: distribution.windows } : {},
+      ...revoke?.length ? { revoke } : {},
+      ...resetSequence ? { resetSequence } : {}
     });
   }
   async#distribution(api, platform, profile, request, server) {
     const distribution = api.requestedDistribution(platform, profile, request);
+    if (server && profile === "release")
+      await this.#assertServerClean(server);
     if (!distribution.notice) {
       if (distribution.unused.length && (platform === "macos" || platform === "windows"))
         this.app.logger.info(`${distribution.unused.join(", ")} set: this build is not signed without --sign.`);
       return distribution;
     }
-    if (server) {
-      const unread = await new ServerBundleSecrets(this.app.workspace.workspaceRoot, this.app.cwdPath).assertClean(server.dir);
-      if (unread.length)
-        this.app.logger.warn(`Not searched for secrets, as they could not be evaluated: ${unread.join(", ")}.`);
-    }
     this.app.logger.warn(distribution.notice);
     return distribution;
   }
-  async assertPublishable(platform, { channel, server = false, arch } = {}) {
+  async#assertServerClean(server) {
+    const unread = await new ServerBundleSecrets(this.app.workspace.workspaceRoot, this.app.cwdPath).assertClean(server.dir);
+    if (unread.length)
+      throw new Error(`The server this app carries was not searched for the secret values of ${unread.join(", ")}, which could not be evaluated with no app env set, so the release stops here.`);
+  }
+  async assertPublishable(platform, {
+    channel,
+    server = false,
+    arch,
+    revoke,
+    resetSequence
+  } = {}) {
     this.#assertUpdates();
     const [api, { config }] = await Promise.all([
       NativeApi.load(this.app.cwdPath),
@@ -866,10 +1113,12 @@ class NativeApp {
         out: this.updatesDir,
         server,
         ...channel ? { channel } : {},
-        ...arch ? { arch } : {}
+        ...arch ? { arch } : {},
+        ...revoke?.length ? { revoke } : {},
+        ...resetSequence ? { resetSequence } : {}
       });
     } catch (error) {
-      throw new Error(`Native target '${this.target.name}': ${error instanceof Error ? error.message : String(error)}`, {
+      throw new Error(`Native target '${this.target.name}': ${toError(error).message}`, {
         cause: error
       });
     }
@@ -888,24 +1137,26 @@ class NativeApp {
   async releaseAndroid({ formats = ["aab"] } = {}) {
     const signing = NativeApp.androidSigning();
     await this.assembleWeb("android");
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare("android");
-    return await api.release({
+    return await this.#recorded(this.outDir("android"), publicEnv, api.release({
       ...this.#task("android", config, { env: await this.#runtimeEnv() }),
       platform: "android",
       signing,
       formats
-    });
+    }));
   }
   async packUpdate(platform, { out } = {}) {
     await this.assembleWeb(platform);
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare(platform);
     if (!config.updates)
       throw new Error(`Native target '${this.target.name}' takes no updates: add native.updates: { url, publicKey } to akan.config.ts first.`);
-    const dir = path7.resolve(out ?? path7.join(this.updatesDir, platform));
-    await Promise.all(["pack.json", "compat.json"].map((name) => rm3(path7.join(dir, name), { force: true })));
-    const packed = await api.packUpdate({ ...this.#task(platform, config), platform, out: dir });
+    const dir = path8.resolve(out ?? path8.join(this.updatesDir, platform));
+    await UpdatePackFolder.clear(dir);
+    const packed = await this.#recorded(dir, publicEnv, api.packUpdate({ ...this.#task(platform, config), platform, out: dir }));
     const channel = config.updates.channel ?? "production";
-    const bundle = await Bun.file(path7.join(packed.out, "bundle.json")).json();
+    const bundle = await UpdatePackFolder.readBundle(path8.join(packed.out, UpdatePackFolder.bundleFile));
     const pack = {
       schema: 1,
       app: this.app.name,
@@ -917,24 +1168,39 @@ class NativeApp {
       appVersion: packed.manifest.version,
       nativeApi: packed.manifest.nativeApi ?? "",
       webHash: bundle.web.hash,
+      ...bundle.web.publicEnvHash ? { publicEnvHash: bundle.web.publicEnvHash } : {},
       files: packed.manifest.files.length,
       size: packed.manifest.files.reduce((sum, file) => sum + file.size, 0),
       out: packed.out
     };
     return { ...packed, channel, pack };
   }
-  static async writePack(pack) {
-    await Bun.write(path7.join(pack.out, "pack.json"), `${JSON.stringify(pack, null, 2)}
+  async#publicEnv() {
+    const publicEnv = await NativePublicEnv.built(this.app);
+    if (!publicEnv)
+      return null;
+    const problems = NativePublicEnv.problems(publicEnv);
+    if (!problems.length)
+      return publicEnv;
+    const message = `The web build inlines public env an update cannot carry:
+- ${problems.join(`
+- `)}`;
+    if (this.target.config.updates)
+      throw new Error(message);
+    this.app.logger.warn(`${message}
+bundle.json records none, so no update can be checked against this build.`);
+    return null;
+  }
+  async#recorded(dir, publicEnv, build) {
+    const result = await build;
+    const file = path8.join(dir, UpdatePackFolder.bundleFile);
+    if (!publicEnv || !await Bun.file(file).exists())
+      return result;
+    const bundle = await UpdatePackFolder.readBundle(file);
+    const web = { ...bundle.web, publicEnv, publicEnvHash: NativePublicEnv.hash(publicEnv) };
+    await Bun.write(file, `${JSON.stringify({ ...bundle, web }, null, 2)}
 `);
-  }
-  static async readPack(dir) {
-    const file = Bun.file(path7.join(dir, "pack.json"));
-    if (!await file.exists())
-      throw new Error(`${dir} holds no pack.json: give the folder \`akan pack-update\` wrote.`);
-    const pack = await file.json();
-    if (pack.schema !== 1)
-      throw new Error(`${dir}/pack.json is schema ${pack.schema}, and this akan reads schema 1.`);
-    return { ...pack, out: path7.resolve(dir) };
+    return result;
   }
   static async compareBundles(appDir, shipped, bundle) {
     return (await NativeApi.load(appDir)).compareBundles(shipped, bundle);
@@ -990,198 +1256,4 @@ class NativeApp {
   }
 }
 
-// pkgs/@akanjs/devkit/mobile/placeholderAppId.ts
-var PLACEHOLDER_APP_IDS = [
-  "com.myapp.app",
-  "com.myorg.myapp",
-  "com.example.app",
-  "com.example.myapp"
-];
-var placeholderAppIdSegment = /^(example|examples|myorg|myapp|mycompany|myorganization|changeme|todo|sample|test)$/;
-var isPlaceholderAppId = (appId) => {
-  const normalized = appId?.trim().toLowerCase() ?? "";
-  if (!normalized)
-    return true;
-  if (PLACEHOLDER_APP_IDS.includes(normalized))
-    return true;
-  return normalized.split(".").some((segment) => placeholderAppIdSegment.test(segment));
-};
-// pkgs/@akanjs/devkit/mobile/desktopServerStage.ts
-import { cp as cp2, mkdir as mkdir3, readdir as readdir3, rm as rm4, writeFile as writeFile2 } from "fs/promises";
-import path8 from "path";
-class DesktopServerStage {
-  app;
-  static uncarried = new Set([
-    "Dockerfile",
-    "package.json",
-    "rscWorker.js",
-    "console.js",
-    "console-runtime.js",
-    "csr",
-    "public",
-    ".akan"
-  ]);
-  static rscRenderer = "react-server-dom-webpack";
-  dir;
-  constructor(app) {
-    this.app = app;
-    this.dir = path8.join(app.cwdPath, ".akan", "desktop", "server");
-  }
-  static assertCarriable(config) {
-    if (!config.database.modes.includes("single"))
-      throw new Error(`desktop.server in native puts the server in the app, where only database mode single runs (no Redis or Postgres); apps/${config.app.name}/akan.config.ts declares ${config.database.modes.join(", ")}.`);
-  }
-  static env(config, environment, { modules = [], env = {} } = {}) {
-    const { PORT: _port, AKAN_LOG_TO_FILE: _fileLog, ...image } = config.getProductionEnv(environment);
-    return {
-      ...image,
-      ...env,
-      AKAN_PUBLIC_OPERATION_MODE: "edge",
-      AKAN_DATABASE_MODE: "single",
-      AKAN_DATABASE_MODES: "single",
-      AKAN_SSR: "false",
-      AKAN_CSR: "false",
-      AKAN_MCP: "false",
-      AKAN_SHUTDOWN_TIMEOUT_MS: "1000",
-      ...modules.length ? { AKAN_MODULES: modules.join(",") } : {}
-    };
-  }
-  static imageStepsNotice(config, carried) {
-    const steps = typeof config.docker === "string" ? null : config.docker.preRuns.length + config.docker.postRuns.length;
-    if (steps === 0)
-      return null;
-    const image = steps === null ? `apps/${config.app.name}/akan.config.ts writes its own Dockerfile` : `The image runs ${steps} docker step${steps === 1 ? "" : "s"} from the app and its libs`;
-    return carried.length ? {
-      level: "info",
-      message: `${image}; the desktop app's server runs none of them and carries only bin: ${carried.join(", ")}.`
-    } : {
-      level: "warn",
-      message: `${image}, and a desktop app's server runs none of them: declare in bin the executables its code spawns, or those calls fail on the user's computer.`
-    };
-  }
-  static packageJson(config, built, omit = []) {
-    const otherDrivers = new Set(config.database.modes.filter((mode) => mode !== "single").flatMap((mode) => config.getDatabaseModeRuntimePackages(mode)));
-    const dependencies = Object.entries(built.dependencies ?? {}).filter(([name]) => !omit.includes(name) && (config.externalLibs.includes(name) || name !== DesktopServerStage.rscRenderer && !otherDrivers.has(name)));
-    return { ...built, dependencies: Object.fromEntries(dependencies) };
-  }
-  static async dependentsOf(nodeModules, name) {
-    const dependents = new Set;
-    for await (const manifest of new Bun.Glob("**/package.json").scan({ cwd: nodeModules, onlyFiles: true })) {
-      const json = await Bun.file(path8.join(nodeModules, manifest)).json().catch(() => null);
-      if (!json?.name || json.name === name)
-        continue;
-      const declared = { ...json.dependencies, ...json.optionalDependencies, ...json.peerDependencies };
-      if (name in declared)
-        dependents.add(json.name);
-    }
-    return [...dependents].sort();
-  }
-  static installArgs(arch) {
-    return ["install", "--production", "--prefer-offline", ...arch && arch !== process.arch ? [`--cpu=${arch}`] : []];
-  }
-  async install(arch, omit = []) {
-    const config = await this.app.getConfig();
-    DesktopServerStage.assertCarriable(config);
-    await rm4(this.dir, { recursive: true, force: true });
-    await mkdir3(this.dir, { recursive: true });
-    const built = config.getProductionPackageJson();
-    for (const name of omit.filter((name) => !(name in (built.dependencies ?? {}))))
-      this.app.logger.warn(`desktop.server.omit names ${name}, which the server does not depend on directly.`);
-    await writeFile2(path8.join(this.dir, "package.json"), JSON.stringify(DesktopServerStage.packageJson(config, built, omit), null, 2));
-    try {
-      await this.app.spawn(process.execPath, DesktopServerStage.installArgs(arch), { cwd: this.dir });
-    } catch (error) {
-      throw new Error(`The desktop app's server could not install its packages in ${this.dir}: it needs the npm registry, or a Bun cache that already holds every one of them.
-${error instanceof Error ? error.message : String(error)}`, { cause: error });
-    }
-    await rm4(path8.join(this.dir, "node_modules", ".bin"), { recursive: true, force: true });
-    await this.#assertOmitted(omit);
-  }
-  async#assertOmitted(omit) {
-    const nodeModules = path8.join(this.dir, "node_modules");
-    const kept = [];
-    for (const name of omit) {
-      if (!await Bun.file(path8.join(nodeModules, name, "package.json")).exists())
-        continue;
-      const dependents = await DesktopServerStage.dependentsOf(nodeModules, name);
-      kept.push(`${name} (needed by ${dependents.join(", ") || "a package that names it"})`);
-    }
-    if (kept.length)
-      throw new Error(`desktop.server.omit leaves out packages another dependency still installs: ${kept.join("; ")}. Omit those too, or keep the package.`);
-  }
-  async prepare(environment, run = {}) {
-    const config = await this.app.getConfig();
-    const dist = this.app.dist.cwdPath;
-    await mkdir3(this.dir, { recursive: true });
-    for (const name of await readdir3(dist))
-      if (!DesktopServerStage.uncarried.has(name))
-        await cp2(path8.join(dist, name), path8.join(this.dir, name), { recursive: true });
-    const scanInfo = this.app.getScanInfo({ allowEmpty: true }) ?? await this.app.scan({ write: false });
-    const carried = [...DesktopBin.select(config, scanInfo.getLibs()).keys()];
-    const notice = DesktopServerStage.imageStepsNotice(config, carried);
-    if (notice)
-      this.app.logger[notice.level](notice.message);
-    return {
-      dir: this.dir,
-      entry: "main.js",
-      env: DesktopServerStage.env(config, environment, run),
-      ...run.restart !== undefined ? { restart: run.restart } : {},
-      ...run.watchdog ? { watchdog: run.watchdog } : {}
-    };
-  }
-}
-// pkgs/@akanjs/devkit/mobile/updateUploader.ts
-import path9 from "path";
-
-class UpdateUploader {
-  bucket;
-  prefix;
-  static #manifest = /\.json(?:\.sig)?$/;
-  static parseTarget(target) {
-    const match = /^s3:\/\/([^/]+)\/?(.*)$/.exec(target.trim());
-    if (!match?.[1])
-      throw new Error(`--upload takes s3://<bucket>/<prefix>, not ${JSON.stringify(target)}.`);
-    return { bucket: match[1], prefix: (match[2] ?? "").replace(/\/+$/, "") };
-  }
-  static order(files) {
-    const manifests = files.filter((file) => UpdateUploader.#manifest.test(file));
-    return {
-      releases: files.filter((file) => !UpdateUploader.#manifest.test(file)).sort((a, b) => a.localeCompare(b)),
-      manifests: manifests.sort((a, b) => Number(a.endsWith(".json")) - Number(b.endsWith(".json")) || a.localeCompare(b))
-    };
-  }
-  constructor(bucket, prefix) {
-    this.bucket = bucket;
-    this.prefix = prefix;
-  }
-  static forTarget(target) {
-    const { bucket, prefix } = UpdateUploader.parseTarget(target);
-    return new UpdateUploader(new Bun.S3Client({ bucket }), prefix);
-  }
-  async upload(dir) {
-    const files = [];
-    for await (const file of new Bun.Glob("**/*").scan({ cwd: dir, onlyFiles: true })) {
-      if (!file.endsWith(".tmp"))
-        files.push(file.split(path9.sep).join("/"));
-    }
-    const { releases, manifests } = UpdateUploader.order(files);
-    const keyOf = (file) => this.prefix ? `${this.prefix}/${file}` : file;
-    let uploaded = 0;
-    let skipped = 0;
-    for (const file of releases) {
-      if (await this.bucket.exists(keyOf(file))) {
-        skipped++;
-        continue;
-      }
-      await this.bucket.write(keyOf(file), Bun.file(path9.join(dir, file)));
-      uploaded++;
-    }
-    for (const file of manifests) {
-      const type = file.endsWith(".json") ? "application/json" : "text/plain";
-      await this.bucket.write(keyOf(file), Bun.file(path9.join(dir, file)), { type });
-      uploaded++;
-    }
-    return { uploaded, skipped };
-  }
-}
-export { DesktopServerStage, NativeApp, isPlaceholderAppId, UpdateUploader };
+export { DesktopBin, NativePublicEnv, UpdatePackFolder, NativeApp };