@akanjs/devkit 3.0.0-beta.27 → 3.0.0-beta.29

package/mobile/nativeApp.ts

@@ -1,8 +1,10 @@
-import { mkdir } from "node:fs/promises";
 import path from "node:path";
 import type { AkanNativeConfig } from "@akanjs/native/config";
+import type { MobileEnv } from "akanjs";
 import type { App } from "../commandDecorators";
 import { Executor } from "../executors";
+import { DesktopBin } from "./desktopBin";
+import type { DesktopServerBundle } from "./desktopServerStage";
 import {
   type DesktopPlatform,
   type MobilePlatform,
@@ -13,6 +15,7 @@ import {
 import { NativeApi, type NativeBuildApiModule } from "./nativeApi";
 import { NativeAppLine, type NativeAppLineRead } from "./nativeAppLine";
 import { NativeConfig } from "./nativeConfig";
+import { NativePluginFolders } from "./nativePluginFolders";
 import { NativeWebDir } from "./nativeWebDir";
 
 type TaskOptions = Parameters<NativeBuildApiModule["build"]>[0];
@@ -31,6 +34,14 @@ interface NativeDevBoot {
   lines: NativeAppLineRead[];
 }
 
+export interface NativeBuildOptions {
+  profile?: "debug" | "release";
+  /** The server a desktop app carries (the target's `native.desktop.server`), staged by DesktopServerStage. */
+  server?: DesktopServerBundle;
+  /** Windows: an NSIS setup program beside the app folder. */
+  installer?: boolean;
+}
+
 export interface NativeDevOptions extends NativeRunOptions {
   /** The akan dev server the gateway proxies. */
   upstream: string;
@@ -48,6 +59,7 @@ export class NativeApp {
   constructor(
     readonly app: App,
     readonly target: ResolvedMobileTarget,
+    readonly env?: MobileEnv,
   ) {
     this.targetRoot = path.join(app.cwdPath, ".akan", "mobile", target.name);
     this.web = new NativeWebDir(path.join(this.targetRoot, "web"));
@@ -57,6 +69,11 @@ export class NativeApp {
     return path.join(this.targetRoot, "native", platform);
   }
 
+  //? Apart from the builds: a desktop build empties its folder first, which would take a release and its installer.
+  devOutDir(platform: NativePlatform) {
+    return path.join(this.targetRoot, "dev", platform);
+  }
+
   /** The web root, from the production build the mobile commands run first. */
   async assembleWeb() {
     const dist = this.app.dist.cwdPath;
@@ -67,27 +84,59 @@ export class NativeApp {
     });
   }
 
-  async config() {
-    const [appConfig, plugins] = await Promise.all([this.app.getConfig(), this.app.collectPlugins()]);
+  /** Where a desktop build stages the executables it carries (akan.config.ts `bin`). */
+  get binDir() {
+    return path.join(this.targetRoot, "bin");
+  }
+
+  /** `stageBin: false` for a config nothing is built from (the update key's): staging downloads the `bin` sources. */
+  async config({
+    server,
+    platform,
+    stageBin = true,
+  }: {
+    server?: DesktopServerBundle;
+    platform: NativePlatform;
+    stageBin?: boolean;
+  }) {
+    const [appConfig, plugins, nativePlugins] = await Promise.all([
+      this.app.getConfig(),
+      this.app.collectPlugins(),
+      NativePluginFolders.of(this.app),
+    ]);
+    const desktop = platform === "macos" || platform === "windows" || platform === "linux";
+    const carried = desktop && stageBin ? await new DesktopBin(this.app, appConfig).stage(this.binDir) : [];
     return NativeConfig.build({
       appPath: this.app.cwdPath,
       target: this.target.config,
       webDir: this.web.dir,
       contributions: plugins.flatMap((plugin) => (plugin.native ? [plugin.native] : [])),
       locales: appConfig.i18n.locales,
+      env: this.env,
+      platform,
+      nativePlugins,
+      ...(server ? { desktopServer: server } : {}),
+      ...(carried.length ? { desktopBin: this.binDir } : {}),
     });
   }
 
   /** The API and the config it is about to build, refused here when the runtime would refuse it later. */
-  async prepare() {
-    const [api, { config, warnings }] = await Promise.all([NativeApi.load(this.app.cwdPath), this.config()]);
+  async prepare(platform: NativePlatform, server?: DesktopServerBundle) {
+    const [api, { config, warnings }] = await Promise.all([
+      NativeApi.load(this.app.cwdPath),
+      this.config({ platform, ...(server ? { server } : {}) }),
+    ]);
     for (const warning of warnings) this.app.logger.warn(warning);
+    this.#assertValid(api, config);
+    return { api, config };
+  }
+
+  #assertValid(api: NativeBuildApiModule, config: AkanNativeConfig) {
     const problems = api.validateConfig(config, { appDir: this.app.cwdPath });
     if (problems.length)
       throw new Error(
         `Mobile target '${this.target.name}' makes an invalid native config:\n- ${problems.join("\n- ")}`,
       );
-    return { api, config };
   }
 
   //? The app's own output: its console (mirrored by a dev build), the simulator log stream or logcat.
@@ -98,12 +147,12 @@ export class NativeApp {
   };
 
   //* `AKAN_PUBLIC_*` is already inlined into the CSR bundle, so the runtime reads no .env file of its own.
-  #task(platform: NativePlatform, config: AkanNativeConfig): TaskOptions {
+  #task(platform: NativePlatform, config: AkanNativeConfig, outDir = this.outDir(platform)): TaskOptions {
     return {
       appDir: this.app.cwdPath,
       config,
       platform,
-      outDir: this.outDir(platform),
+      outDir,
       envFiles: false,
       skipWebBuild: true,
       log: (event) => {
@@ -116,18 +165,25 @@ export class NativeApp {
     };
   }
 
-  async build(platform: NativePlatform, { profile = "release" }: { profile?: "debug" | "release" } = {}) {
+  async build(platform: NativePlatform, { profile = "release", server, installer = false }: NativeBuildOptions = {}) {
+    NativeApp.#assertServerPlatform(platform, server);
+    if (installer && platform !== "windows") throw new Error(`An installer is built for Windows, not for ${platform}.`);
     await this.assembleWeb();
-    const { api, config } = await this.prepare();
-    return await api.build({ ...this.#task(platform, config), profile });
+    const { api, config } = await this.prepare(platform, server);
+    return await api.build({
+      ...this.#task(platform, config),
+      profile,
+      ...(installer ? { windows: { installer } } : {}),
+    });
   }
 
   async run(
     platform: NativePlatform,
-    { device, teamId, profile = "debug" }: NativeRunOptions & { profile?: "debug" | "release" } = {},
+    { device, teamId, profile = "debug", server }: NativeRunOptions & NativeBuildOptions = {},
   ) {
+    NativeApp.#assertServerPlatform(platform, server);
     await this.assembleWeb();
-    const { api, config } = await this.prepare();
+    const { api, config } = await this.prepare(platform, server);
     return await api.run({
       ...this.#task(platform, config),
       profile,
@@ -137,21 +193,23 @@ export class NativeApp {
     });
   }
 
-  //* The gateway serves the page and its HMR socket on the app origin; API calls go to the dev server itself (baseEnv),
-  //* which an Android device reaches through the reversed port.
+  //* The gateway serves the page, its HMR socket and its API calls on the app origin. The dev server's own port is
+  //* reversed too: a browser the app hands off to (auth-session) opens it directly (baseEnv getServerOrigin).
   async dev(platform: NativePlatform, { upstream, lang, device, teamId }: NativeDevOptions) {
     const startedAt = performance.now();
     const boot: NativeDevBoot = { steps: [], lines: [] };
     this.#boot = boot;
     try {
-      await mkdir(this.web.dir, { recursive: true });
-      const [{ api, config }, { api: routes }] = await Promise.all([this.prepare(), this.app.getConfig()]);
+      //? The runtime bundles an index.html it finds here as the dev build's page, and a release build leaves one.
+      await this.web.clear();
+      const [{ api, config }, { api: routes }] = await Promise.all([this.prepare(platform), this.app.getConfig()]);
       const session = await api.dev({
-        ...this.#task(platform, config),
+        ...this.#task(platform, config, this.devOutDir(platform)),
         upstream,
         hmrPath: "/_akan/hmr",
         //? A dev page calls its own origin (akanjs baseEnv), so the gateway relays the socket it opens for the API too.
         wsPaths: [`${routes.prefix}${routes.websocketPrefix}`],
+        reversePorts: [Number(new URL(upstream).port)],
         onLine: this.#appLine,
         startPath: this.startPath(lang),
         ...(device ? { device } : {}),
@@ -185,7 +243,7 @@ export class NativeApp {
 
   async releaseIos({ teamId, adHoc = false }: { teamId?: string; adHoc?: boolean } = {}) {
     await this.assembleWeb();
-    const { api, config } = await this.prepare();
+    const { api, config } = await this.prepare("ios");
     return await api.release({
       ...this.#task("ios", config),
       platform: "ios",
@@ -193,13 +251,104 @@ export class NativeApp {
     });
   }
 
+  /** Where publishUpdate writes: upload this folder as the target's updates.url. */
+  get updatesDir() {
+    return path.join(this.targetRoot, "updates");
+  }
+
+  /** A signed release installed apps take through the updates plugin, from a release build of this bundle. */
+  async publishUpdate(
+    platform: NativePlatform,
+    { channel, server }: { channel?: string; server?: DesktopServerBundle } = {},
+  ) {
+    NativeApp.#assertServerPlatform(platform, server);
+    this.#assertUpdates();
+    await this.assembleWeb();
+    const { api, config } = await this.prepare(platform, server);
+    return await api.publishUpdate({
+      ...this.#task(platform, config),
+      platform,
+      out: this.updatesDir,
+      ...(channel ? { channel } : {}),
+    });
+  }
+
+  /**
+   * What publishing refuses once the release is built: no updates settings, an invalid config, no signing key or
+   * another app's, and a desktop release whose server presence is not its channel's previous release's.
+   */
+  async assertPublishable(
+    platform: NativePlatform,
+    { channel, server = false }: { channel?: string; server?: boolean } = {},
+  ) {
+    this.#assertUpdates();
+    const [api, { config }] = await Promise.all([
+      NativeApi.load(this.app.cwdPath),
+      this.config({ platform, stageBin: false }),
+    ]);
+    this.#assertValid(api, config);
+    try {
+      api.checkPublishUpdate({
+        appDir: this.app.cwdPath,
+        config,
+        platform,
+        out: this.updatesDir,
+        server,
+        ...(channel ? { channel } : {}),
+      });
+    } catch (error) {
+      throw new Error(
+        `Mobile target '${this.target.name}': ${error instanceof Error ? error.message : String(error)}`,
+        {
+          cause: error,
+        },
+      );
+    }
+  }
+
+  #assertUpdates() {
+    if (!this.target.config.updates)
+      throw new Error(
+        `Mobile target '${this.target.name}' has no updates: { url, publicKey } in akan.config.ts; \`akan update-keygen ${this.app.name}\` prints the key.`,
+      );
+  }
+
+  /** The key update releases of this target's app id on `platform` are signed with: made once, then read. */
+  async updateKeygen(platform: NativePlatform) {
+    const [api, { config }] = await Promise.all([
+      NativeApi.load(this.app.cwdPath),
+      this.config({ platform, stageBin: false }),
+    ]);
+    return api.updateKeygen({ config });
+  }
+
   async releaseAndroid({ formats = ["aab"] }: { formats?: ("aab" | "apk")[] } = {}) {
     const signing = NativeApp.androidSigning();
     await this.assembleWeb();
-    const { api, config } = await this.prepare();
+    const { api, config } = await this.prepare("android");
     return await api.release({ ...this.#task("android", config), platform: "android", signing, formats });
   }
 
+  /** An unsigned OTA update of this target's web bundle for `platform`, and the channel its binary follows. */
+  async packUpdate(platform: MobilePlatform, { out }: { out?: string } = {}) {
+    await this.assembleWeb();
+    const { api, config } = await this.prepare(platform);
+    if (!config.updates)
+      throw new Error(
+        `Mobile target '${this.target.name}' takes no updates: add mobile.updates: { url, publicKey } to akan.config.ts first.`,
+      );
+    const packed = await api.packUpdate({
+      ...this.#task(platform, config),
+      platform,
+      out: out ?? path.join(this.targetRoot, "updates", platform),
+    });
+    return { ...packed, channel: config.updates.channel ?? "production" };
+  }
+
+  static async compareBundles(appDir: string, shipped: string, bundle: string) {
+    return (await NativeApi.load(appDir)).compareBundles(shipped, bundle);
+  }
+
   //* The names the Gradle build read, so a CI that already holds these secrets keeps working.
   static androidSigning(env: Record<string, string | undefined> = process.env): AndroidSigning {
     const keystore = env.MYAPP_RELEASE_STORE_FILE;
@@ -232,6 +381,12 @@ export class NativeApp {
     return `/${home.join("/")}?${params}`;
   }
 
+  //? A phone runs no Bun, so only a desktop app can carry the server.
+  static #assertServerPlatform(platform: NativePlatform, server: DesktopServerBundle | undefined) {
+    if (server && (platform === "ios" || platform === "android"))
+      throw new Error(`Only a desktop app carries its server; ${platform} cannot run one.`);
+  }
+
   //* A desktop app builds only on its own OS, so the platform is this computer's.
   static desktopPlatform(host: NodeJS.Platform = process.platform): DesktopPlatform {
     if (host === "darwin") return "macos";

package/mobile/nativeAppLine.test.ts

@@ -24,6 +24,13 @@ describe("NativeAppLine", () => {
     });
   });
 
+  test("a carried server's line keeps the level its logger wrote, and one without a level stays visible", () => {
+    const line = "[server] [minimal] 81 - 09/30/2026, 12:30:06 PM   ERROR  boom +2ms";
+    expect(NativeAppLine.read(line)).toEqual({ level: "error", message: line });
+    expect(NativeAppLine.read("[server] \u001b[32m[minimal] 81 -\u001b[39m WARN  slow").level).toBe("warn");
+    expect(NativeAppLine.read("[server]     at run (main.js:1:2)").level).toBe("info");
+  });
+
   test("a second window is named, the first is not", () => {
     expect(NativeAppLine.read("[page#2 info] [App] ready")).toEqual({ level: "info", message: "[page#2:App] ready" });
   });

package/mobile/nativeAppLine.ts

@@ -13,6 +13,10 @@ export class NativeAppLine {
   static readonly #page = /^\[page(\+)?(?:#(\d+))? (trace|verbose|debug|log|info|warn|error)\] ?(.*)$/;
   static readonly #logcat = /^([VDIWEFA])\/([^(]+?)\s*\(\s*\d+\):\s?(.*)$/;
   static readonly #named = /^\[([^\]\s]+)\] ([\s\S]*)$/;
+  //? A server the desktop app carries (host server.ts): `[server] <its own log line>`, whose level word the akan logger
+  //? wrote; a line without one (a crash's stack) is still the app's and stays visible.
+  static readonly #server = /^\[server\] /;
+  static readonly #serverLevel = /\b(TRACE|VERBOSE|DEBUG|INFO|WARN|ERROR)\b/;
   static readonly #logcatLevels: { [priority: string]: LogLevel } = {
     V: "verbose",
     D: "debug",
@@ -42,6 +46,10 @@ export class NativeAppLine {
       });
     }
     if (line.startsWith("[akan-native")) return NativeAppLine.#hostLine(line, "info");
+    if (NativeAppLine.#server.test(line)) {
+      const word = NativeAppLine.#serverLevel.exec(Bun.stripANSI(line))?.[1];
+      return { level: word ? (word.toLowerCase() as LogLevel) : "info", message: line };
+    }
     return { level: verbose ? "info" : "debug", message: line };
   }
 

package/mobile/nativeConfig.test.ts

@@ -45,26 +45,29 @@ const adminTarget: AkanMobileTargetConfig = {
   },
 };
 
+const updatesKey = Buffer.alloc(32, 7).toString("base64");
+
 describe("NativeConfig.build", () => {
-  test("turns the minimal app's push target into the runtime's config", () => {
+  test("turns the minimal app's push target into the runtime's config, single-instance carrying its link scheme", () => {
     const { config, warnings } = NativeConfig.build({
       appPath: "/repo/apps/minimal",
       target: minimalTarget,
       webDir: "/repo/apps/minimal/.akan/mobile/default/web",
       contributions: [{ permission: "push", plugins: ["push"] }],
       locales: ["en", "ko"],
+      platform: "android",
     });
 
     expect(warnings).toEqual([]);
     expect(config).toEqual({
       app: { id: "com.minimal.dev.app", name: "minimal", fileName: "minimal", version: "0.0.1", build: 1 },
       web: { dir: "/repo/apps/minimal/.akan/mobile/default/web" },
-      plugins: [...NativeConfig.basePlugins, "push"],
+      plugins: [...NativeConfig.basePlugins, "single-instance", "push"],
       capabilities: [
         {
           identifier: "app",
           description: "The plugins minimal ships, each with its default permissions",
-          permissions: [...NativeConfig.basePlugins, "push"].map((plugin) => `${plugin}:default`),
+          permissions: [...NativeConfig.basePlugins, "single-instance", "push"].map((plugin) => `${plugin}:default`),
         },
       ],
       deepLinks: { schemes: ["minimal"], domains: ["example.com"] },
@@ -83,6 +86,7 @@ describe("NativeConfig.build", () => {
       webDir: "/repo/apps/portal/.akan/mobile/admin/web",
       contributions: [],
       locales: ["en", "ko"],
+      platform: "android",
     });
 
     expect(warnings).toEqual(["Permission 'speech' has no native plugin yet; the app ships without it."]);
@@ -138,6 +142,7 @@ describe("NativeConfig.build", () => {
         { permission: "push", plugins: ["push"] },
       ],
       locales: ["en"],
+      platform: "android",
     });
 
     expect(config.plugins).toEqual([...NativeConfig.basePlugins, "camera"]);
@@ -152,6 +157,75 @@ describe("NativeConfig.build", () => {
     });
   });
 
+  test("updates bring their plugin and follow the binary's backend unless a channel is named", () => {
+    const build = (updates: AkanMobileTargetConfig["updates"], env?: "main" | "develop") =>
+      NativeConfig.build({
+        appPath: "/repo/apps/portal",
+        target: { ...adminTarget, updates },
+        webDir: "/web",
+        contributions: [],
+        locales: ["en"],
+        platform: "android",
+        env,
+      }).config;
+    const url = "https://updates.example.com/portal";
+    expect(build({ url, publicKey: updatesKey }, "develop").updates).toEqual({
+      url,
+      publicKey: updatesKey,
+      channel: "develop",
+    });
+    expect(build({ url, publicKey: updatesKey, channel: "beta", readyTimeout: 15_000 }, "main").updates).toEqual({
+      url,
+      publicKey: updatesKey,
+      channel: "beta",
+      readyTimeout: 15_000,
+    });
+    expect(build({ url, publicKey: updatesKey }).updates).toEqual({ url, publicKey: updatesKey });
+    expect(build({ url, publicKey: updatesKey }, "main").plugins).toContain("updates");
+    expect(build(undefined, "main").plugins).not.toContain("updates");
+  });
+
+  test("push, privacy and the icon and splash objects reach the runtime, paths from the app folder", () => {
+    const { config } = NativeConfig.build({
+      appPath: "/repo/apps/portal",
+      target: {
+        ...adminTarget,
+        assets: {
+          icon: { image: "assets/icon.png", backgroundColor: "#ffffff" },
+          splash: { backgroundColor: { light: "#ffffff", dark: "#000000" }, autoHide: false },
+        },
+        native: {
+          push: { android: { smallIcon: "assets/noti.png", color: "#ff5a5f", channel: { id: "chat", name: "Chat" } } },
+          privacy: { tracking: false, accessedApis: { DiskSpace: ["E174.1"] } },
+        },
+      },
+      webDir: "/web",
+      contributions: [],
+      locales: ["en"],
+      platform: "android",
+    });
+    const abs = (relative: string) => path.resolve("/repo/apps/portal", relative);
+    expect(config.icon).toEqual({ image: abs("assets/icon.png"), backgroundColor: "#ffffff" });
+    expect(config.splash).toEqual({ backgroundColor: { light: "#ffffff", dark: "#000000" }, autoHide: false });
+    expect(config.push).toEqual({
+      android: { smallIcon: abs("assets/noti.png"), color: "#ff5a5f", channel: { id: "chat", name: "Chat" } },
+    });
+    expect(config.privacy).toEqual({ tracking: false, accessedApis: { DiskSpace: ["E174.1"] } });
+  });
+
+  test("an app id per platform gives each build its own", () => {
+    const idOn = (platform: "ios" | "android") =>
+      NativeConfig.build({
+        appPath: "/repo/apps/portal",
+        target: { ...adminTarget, appId: { ios: "com.puffinplanet.admin", android: "com.portal.admin" } },
+        webDir: "/web",
+        contributions: [],
+        locales: ["en"],
+        platform,
+      }).config.app.id;
+    expect([idOn("ios"), idOn("android")]).toEqual(["com.puffinplanet.admin", "com.portal.admin"]);
+  });
+
   test("the runtime accepts both configs as they are", async () => {
     const root = await makeTempRoot();
     for (const file of ["secrets/google-services.json", "assets/chime.mp3"])
@@ -164,18 +238,146 @@ describe("NativeConfig.build", () => {
     await writeFile(path.join(root, "web/index.html"), "<html><head></head><body></body></html>");
     const api = await NativeApi.load(repoApp);
 
-    for (const target of [minimalTarget, adminTarget]) {
+    const adminWithEverything: AkanMobileTargetConfig = {
+      ...adminTarget,
+      updates: { url: "https://updates.example.com/portal", publicKey: updatesKey },
+      native: {
+        ...adminTarget.native,
+        push: { android: { smallIcon: "assets/icon.png", color: "#ff5a5f" } },
+        privacy: { tracking: false },
+      },
+    };
+    for (const target of [minimalTarget, adminWithEverything]) {
       const { config } = NativeConfig.build({
         appPath: root,
+        env: "main",
         target,
         webDir: path.join(root, "web"),
         contributions: [],
         locales: ["en", "ko"],
+        platform: "android",
       });
       expect(api.validateConfig(config, { appDir: root })).toEqual([]);
     }
   });
 
+  test("ships the app's own native plugins by folder and names each by its id in the capability", async () => {
+    const root = await makeTempRoot();
+    const kiosk = await writeManifest(path.join(root, "native", "kiosk"), "kiosk");
+    await writeManifest(path.join(root, "vendor", "led-panel"), "led-panel");
+    const { config } = NativeConfig.build({
+      appPath: root,
+      target: { ...minimalTarget, permissions: [], native: { plugins: ["./vendor/led-panel"] }, deepLinks: undefined },
+      webDir: path.join(root, "web"),
+      contributions: [],
+      locales: ["en"],
+      platform: "macos",
+      nativePlugins: [{ id: "kiosk", dir: kiosk, owner: "apps/board" }],
+    });
+
+    expect(config.plugins).toEqual([...NativeConfig.basePlugins, "./vendor/led-panel", kiosk]);
+    expect(config.capabilities?.[0]?.permissions).toEqual(
+      [...NativeConfig.basePlugins, "led-panel", "kiosk"].map((id) => `${id}:default`),
+    );
+    await mkdir(path.join(root, "web"), { recursive: true });
+    await writeFile(path.join(root, "web/index.html"), "<html><head></head><body></body></html>");
+    const api = await NativeApi.load(repoApp);
+    expect(api.validateConfig(config, { appDir: root })).toEqual([]);
+  });
+
+  test("ships a native/ folder once when the target also lists it by path or by id", async () => {
+    const root = await makeTempRoot();
+    const kiosk = await writeManifest(path.join(root, "native", "kiosk"), "kiosk");
+    const { config } = NativeConfig.build({
+      appPath: root,
+      target: {
+        ...minimalTarget,
+        permissions: [],
+        native: { plugins: ["./native/kiosk/", "kiosk", "haptics"] },
+        deepLinks: undefined,
+      },
+      webDir: path.join(root, "web"),
+      contributions: [],
+      locales: ["en"],
+      platform: "macos",
+      nativePlugins: [{ id: "kiosk", dir: kiosk, owner: "apps/board" }],
+    });
+
+    expect(config.plugins).toEqual([...NativeConfig.basePlugins, kiosk]);
+  });
+
+  test("hands an unattended app's settings on: page recovery, a kiosk window, screen capture and Android autoplay", async () => {
+    const root = await makeTempRoot();
+    const { config } = NativeConfig.build({
+      appPath: root,
+      target: {
+        ...minimalTarget,
+        permissions: [],
+        deepLinks: undefined,
+        native: {
+          android: { autoplay: true },
+          desktop: { recovery: "reload", window: { fullscreen: true, skipTaskbar: true }, screenCapture: "auto" },
+        },
+      },
+      webDir: path.join(root, "web"),
+      contributions: [],
+      locales: ["en"],
+      platform: "macos",
+      desktopBin: root,
+    });
+
+    expect(config.desktop).toEqual({
+      recovery: "reload",
+      window: { fullscreen: true, skipTaskbar: true },
+      screenCapture: "auto",
+      bin: root,
+    });
+    expect(config.android).toEqual({ debugAppIdSuffix: ".debug", autoplay: true });
+    await mkdir(path.join(root, "web"), { recursive: true });
+    await writeFile(path.join(root, "web/index.html"), "<html><head></head><body></body></html>");
+    expect((await NativeApi.load(repoApp)).validateConfig(config, { appDir: root })).toEqual([]);
+  });
+
+  test("an app with updates ships the updates plugin and its settings", () => {
+    const updates = { url: "https://releases.example.com/board", publicKey: `${"a".repeat(43)}=`, channel: "pilot" };
+    const { config } = NativeConfig.build({
+      appPath: "/repo/apps/board",
+      target: { ...minimalTarget, permissions: [], deepLinks: undefined, native: undefined, updates },
+      webDir: "/web",
+      contributions: [],
+      locales: ["en"],
+      platform: "macos",
+    });
+
+    expect(config.plugins).toEqual([...NativeConfig.basePlugins, "updates"]);
+    expect(config.updates).toEqual(updates);
+  });
+
+  test("an updates channel left unnamed is the backend env the binary is built for", () => {
+    const updates = { url: "https://releases.example.com/board", publicKey: `${"a".repeat(43)}=` };
+    const build = (env?: "debug" | "main", channel?: string) =>
+      NativeConfig.build({
+        appPath: "/repo/apps/board",
+        target: {
+          ...minimalTarget,
+          permissions: [],
+          deepLinks: undefined,
+          native: undefined,
+          updates: { ...updates, ...(channel ? { channel } : {}) },
+        },
+        webDir: "/web",
+        contributions: [],
+        locales: ["en"],
+        platform: "macos",
+        ...(env ? { env } : {}),
+      }).config.updates;
+
+    expect(build("debug")).toEqual({ ...updates, channel: "debug" });
+    expect(build("main")).toEqual({ ...updates, channel: "main" });
+    expect(build("debug", "pilot")).toEqual({ ...updates, channel: "pilot" });
+    expect(build()).toEqual(updates);
+  });
+
   test("keeps a file name the runtime accepts", () => {
     expect(NativeConfig.fileNameOf("minimal")).toBe("minimal");
     expect(NativeConfig.fileNameOf("my app!")).toBe("my-app");
@@ -183,6 +385,15 @@ describe("NativeConfig.build", () => {
   });
 });
 
+const writeManifest = async (dir: string, id: string) => {
+  await mkdir(dir, { recursive: true });
+  await writeFile(
+    path.join(dir, "native-plugin.json"),
+    JSON.stringify({ id, apiVersion: 1, methods: [], events: [], web: null, desktop: null, ios: null, android: null }),
+  );
+  return dir;
+};
+
 const onePixelPng = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==";
 
 const googleServicesJson = JSON.stringify({