@akanjs/devkit 3.0.2 → 3.1.0-rc.0

package/mobile/desktopServerStage.ts

@@ -10,6 +10,16 @@ export interface DesktopServerBundle {
   dir: string;
   entry: string;
   env: Record<string, string>;
+  restart?: "forever" | number;
+  watchdog?: { intervalMs: number; failures: number };
+}
+
+/** How the targets that carry one build's server have it run (`desktop.server`, normalized). */
+export interface DesktopServerRun {
+  modules?: string[];
+  env?: Record<string, string>;
+  restart?: "forever" | number;
+  watchdog?: { intervalMs: number; failures: number };
 }
 
 //* A desktop app's carried server is the backend `akan build` wrote into dist, installed on its own as the image's
@@ -44,11 +54,16 @@ export class DesktopServerStage {
       );
   }
 
-  static env(config: AkanAppConfig, environment: NativeEnv): Record<string, string> {
+  static env(
+    config: AkanAppConfig,
+    environment: NativeEnv,
+    { modules = [], env = {} }: Pick<DesktopServerRun, "modules" | "env"> = {},
+  ): Record<string, string> {
     //? The launcher picks the port, and the log file stays on: a user's computer has no log collector.
     const { PORT: _port, AKAN_LOG_TO_FILE: _fileLog, ...image } = config.getProductionEnv(environment);
     return {
       ...image,
+      ...env,
       //? Neither the developer's machine (local, which derives a forgeable JWT secret) nor a deployment (cloud).
       AKAN_PUBLIC_OPERATION_MODE: "edge",
       AKAN_DATABASE_MODE: "single",
@@ -59,6 +74,7 @@ export class DesktopServerStage {
       AKAN_MCP: "false",
       //? Ahead of the launcher's 1.5 s grace before it signals, which sits inside the shell's 2 s quit budget.
       AKAN_SHUTDOWN_TIMEOUT_MS: "1000",
+      ...(modules.length ? { AKAN_MODULES: modules.join(",") } : {}),
     };
   }
 
@@ -162,7 +178,7 @@ export class DesktopServerStage {
   }
 
   //? Copies the build beside what `install` put in the stage, so it runs after both.
-  async prepare(environment: NativeEnv): Promise<DesktopServerBundle> {
+  async prepare(environment: NativeEnv, run: DesktopServerRun = {}): Promise<DesktopServerBundle> {
     const config = await this.app.getConfig();
     const dist = this.app.dist.cwdPath;
     await mkdir(this.dir, { recursive: true });
@@ -173,6 +189,12 @@ export class DesktopServerStage {
     const carried = [...DesktopBin.select(config, scanInfo.getLibs()).keys()];
     const notice = DesktopServerStage.imageStepsNotice(config, carried);
     if (notice) this.app.logger[notice.level](notice.message);
-    return { dir: this.dir, entry: "main.js", env: DesktopServerStage.env(config, environment) };
+    return {
+      dir: this.dir,
+      entry: "main.js",
+      env: DesktopServerStage.env(config, environment, run),
+      ...(run.restart !== undefined ? { restart: run.restart } : {}),
+      ...(run.watchdog ? { watchdog: run.watchdog } : {}),
+    };
   }
 }

package/mobile/index.ts

@@ -7,4 +7,5 @@ export * from "./nativeConfig";
 export * from "./nativePluginFolders";
 export * from "./nativeWebDir";
 export * from "./placeholderAppId";
+export * from "./updateUploader";
 export * from "./usageDescriptions";

package/mobile/nativeApp.test.ts

@@ -58,6 +58,7 @@ describe("NativeApp", () => {
         ({
           config: {},
           api: {
+            requestedDistribution: () => ({ notice: null, unused: [] }),
             build: async ({ env }: { env?: Record<string, string> }) => {
               seen = env;
               return { artifacts: [], warnings: [] };

package/mobile/nativeApp.ts

@@ -1,3 +1,4 @@
+import { rm } from "node:fs/promises";
 import path from "node:path";
 import type { AkanNativeConfig } from "@akanjs/native/config";
 import type { NativeEnv } from "akanjs";
@@ -17,6 +18,7 @@ import { NativeAppLine, type NativeAppLineRead } from "./nativeAppLine";
 import { NativeConfig } from "./nativeConfig";
 import { NativePluginFolders } from "./nativePluginFolders";
 import { NativeWebDir } from "./nativeWebDir";
+import { ServerBundleSecrets } from "./serverBundleSecrets";
 
 type TaskOptions = Parameters<NativeBuildApiModule["build"]>[0];
 type DeviceSelector = NonNullable<Parameters<NativeBuildApiModule["run"]>[0]["device"]>;
@@ -42,6 +44,10 @@ export interface NativeBuildOptions {
   installer?: boolean;
   /** The CPU the desktop app runs on, of the same OS; a macOS app is arm64 only. Default this computer's. */
   arch?: DesktopArch;
+  /** Sign with the identity AKAN_NATIVE_MACOS_* / AKAN_NATIVE_WINDOWS_* names; the env alone signs nothing. */
+  sign?: boolean;
+  /** macOS: upload the signed app to Apple's notary service. */
+  notarize?: boolean;
 }
 
 export interface NativeDevOptions extends NativeRunOptions {
@@ -50,6 +56,25 @@ export interface NativeDevOptions extends NativeRunOptions {
   lang: string;
 }
 
+/** `<out>/pack.json`: what a signer needs of a pack, read instead of the log. */
+export interface NativeUpdatePack {
+  schema: 1;
+  app: string;
+  target: string;
+  platform: MobilePlatform;
+  env: NativeEnv;
+  channel: string;
+  appId: string;
+  appVersion: string;
+  nativeApi: string;
+  /** bundle.json `web.hash`: the web files as served, the part of a bundle id that names its content. */
+  webHash: string;
+  files: number;
+  size: number;
+  out: string;
+  compat?: { against: string; compatible: boolean; problems: string[] };
+}
+
 /** One native target of an app on the native runtime (a phone, or this computer as a desktop app): where it builds,
  * what it ships, and the calls into the API. */
 export class NativeApp {
@@ -194,32 +219,19 @@ export class NativeApp {
 
   async build(
     platform: NativePlatform,
-    { profile = "release", server, installer = false, arch }: NativeBuildOptions = {},
+    { profile = "release", server, installer = false, arch, sign = false, notarize = false }: NativeBuildOptions = {},
   ) {
     NativeApp.#assertServerPlatform(platform, server);
     NativeApp.assertInstaller(platform, installer);
     await this.assembleWeb(platform);
     const { api, config } = await this.prepare(platform, server, arch);
+    const distribution = await this.#distribution(api, platform, profile, { sign, notarize }, server);
     return await api.build({
       ...this.#task(platform, config, { env: await this.#runtimeEnv(server) }),
       profile,
       ...(arch ? { arch } : {}),
-      ...(platform === "windows"
-        ? {
-            windows: {
-              ...(installer ? { installer } : {}),
-              ...(profile === "release" ? NativeApp.#windowsSigning(api) : {}),
-            },
-          }
-        : {}),
-      ...(platform === "macos"
-        ? {
-            macos: {
-              ...(profile === "release" ? api.macosDistributionFromEnv(process.env) : {}),
-              ...(installer ? { dmg: true } : {}),
-            },
-          }
-        : {}),
+      ...(platform === "windows" ? { windows: { ...(installer ? { installer } : {}), ...distribution.windows } } : {}),
+      ...(platform === "macos" ? { macos: { ...distribution.macos, ...(installer ? { dmg: true } : {}) } } : {}),
       ...(platform === "linux" && installer ? { linux: { appImage: true } } : {}),
     });
   }
@@ -306,30 +318,64 @@ export class NativeApp {
   /** A signed release installed apps take through the updates plugin, from a release build of this bundle. */
   async publishUpdate(
     platform: NativePlatform,
-    { channel, server }: { channel?: string; server?: DesktopServerBundle } = {},
+    {
+      channel,
+      server,
+      arch,
+      sign = false,
+      notarize = false,
+    }: { channel?: string; server?: DesktopServerBundle; arch?: DesktopArch; sign?: boolean; notarize?: boolean } = {},
   ) {
     NativeApp.#assertServerPlatform(platform, server);
     this.#assertUpdates();
     await this.assembleWeb(platform);
-    const { api, config } = await this.prepare(platform, server);
+    const { api, config } = await this.prepare(platform, server, arch);
+    //? The updater keeps the installed app's signature, so a release is signed as the downloaded app was.
+    const distribution = await this.#distribution(api, platform, "release", { sign, notarize }, server);
     return await api.publishUpdate({
       ...this.#task(platform, config, { env: await this.#runtimeEnv(server) }),
       platform,
       out: this.updatesDir,
       ...(channel ? { channel } : {}),
-      //? The updater keeps the installed app's signature, so a release is signed as the downloaded app was.
-      ...(platform === "macos" ? { macos: api.macosDistributionFromEnv(process.env) } : {}),
-      ...(platform === "windows" ? { windows: NativeApp.#windowsSigning(api) } : {}),
+      ...(arch ? { arch } : {}),
+      ...(distribution.macos ? { macos: distribution.macos } : {}),
+      ...(distribution.windows ? { windows: distribution.windows } : {}),
     });
   }
 
+  //* Only what the command asked for is signed or uploaded; a signed app's server is searched for the workspace's
+  //* secret values first, and the one line naming the identity and the service comes right before the build.
+  async #distribution(
+    api: NativeBuildApiModule,
+    platform: NativePlatform,
+    profile: "debug" | "release",
+    request: { sign: boolean; notarize: boolean },
+    server: DesktopServerBundle | undefined,
+  ) {
+    const distribution = api.requestedDistribution(platform, profile, request);
+    if (!distribution.notice) {
+      if (distribution.unused.length && (platform === "macos" || platform === "windows"))
+        this.app.logger.info(`${distribution.unused.join(", ")} set: this build is not signed without --sign.`);
+      return distribution;
+    }
+    if (server) {
+      const unread = await new ServerBundleSecrets(this.app.workspace.workspaceRoot, this.app.cwdPath).assertClean(
+        server.dir,
+      );
+      if (unread.length)
+        this.app.logger.warn(`Not searched for secrets, as they could not be evaluated: ${unread.join(", ")}.`);
+    }
+    this.app.logger.warn(distribution.notice);
+    return distribution;
+  }
+
   /**
    * What publishing refuses once the release is built: no updates settings, an invalid config, no signing key or
    * another app's, and a desktop release whose server presence is not its channel's previous release's.
    */
   async assertPublishable(
     platform: NativePlatform,
-    { channel, server = false }: { channel?: string; server?: boolean } = {},
+    { channel, server = false, arch }: { channel?: string; server?: boolean; arch?: DesktopArch } = {},
   ) {
     this.#assertUpdates();
     const [api, { config }] = await Promise.all([
@@ -345,6 +391,7 @@ export class NativeApp {
         out: this.updatesDir,
         server,
         ...(channel ? { channel } : {}),
+        ...(arch ? { arch } : {}),
       });
     } catch (error) {
       throw new Error(
@@ -384,7 +431,7 @@ export class NativeApp {
     });
   }
 
-  /** An unsigned OTA update of this target's web bundle for `platform`, and the channel its binary follows. */
+  /** An unsigned OTA update of this target's web bundle for `platform`, and the record `pack.json` keeps of it. */
   async packUpdate(platform: MobilePlatform, { out }: { out?: string } = {}) {
     await this.assembleWeb(platform);
     const { api, config } = await this.prepare(platform);
@@ -392,12 +439,32 @@ export class NativeApp {
       throw new Error(
         `Native target '${this.target.name}' takes no updates: add native.updates: { url, publicKey } to akan.config.ts first.`,
       );
-    const packed = await api.packUpdate({
-      ...this.#task(platform, config),
+    const dir = path.resolve(out ?? path.join(this.updatesDir, platform));
+    //? A pack that fails must not leave the previous pack's record behind for whoever reads the exit code.
+    await Promise.all(["pack.json", "compat.json"].map((name) => rm(path.join(dir, name), { force: true })));
+    const packed = await api.packUpdate({ ...this.#task(platform, config), platform, out: dir });
+    const channel = config.updates.channel ?? "production";
+    const bundle = (await Bun.file(path.join(packed.out, "bundle.json")).json()) as { web: { hash: string } };
+    const pack: NativeUpdatePack = {
+      schema: 1,
+      app: this.app.name,
+      target: this.target.name,
       platform,
-      out: out ?? path.join(this.updatesDir, platform),
-    });
-    return { ...packed, channel: config.updates.channel ?? "production" };
+      env: this.env ?? "main",
+      channel,
+      appId: packed.manifest.app,
+      appVersion: packed.manifest.version,
+      nativeApi: packed.manifest.nativeApi ?? "",
+      webHash: bundle.web.hash,
+      files: packed.manifest.files.length,
+      size: packed.manifest.files.reduce((sum, file) => sum + file.size, 0),
+      out: packed.out,
+    };
+    return { ...packed, channel, pack };
+  }
+
+  static async writePack(pack: NativeUpdatePack) {
+    await Bun.write(path.join(pack.out, "pack.json"), `${JSON.stringify(pack, null, 2)}\n`);
   }
 
   static async compareBundles(appDir: string, shipped: string, bundle: string) {
@@ -437,11 +504,6 @@ export class NativeApp {
     return `/${home.join("/")}?${params}`;
   }
 
-  static #windowsSigning(api: NativeBuildApiModule) {
-    const signing = api.windowsSigningFromEnv(process.env);
-    return signing ? { signing } : {};
-  }
-
   //* `installer` is the file a person downloads: a setup program on Windows, a disk image on macOS, an AppImage on Linux.
   static assertInstaller(platform: NativePlatform, installer: boolean) {
     if (installer && (platform === "ios" || platform === "android"))

package/mobile/nativeConfig.test.ts

@@ -67,6 +67,30 @@ describe("NativeConfig.build", () => {
     expect(build(undefined)).toBeUndefined();
   });
 
+  test("paints the window before its page with backgroundColor, and names the Windows publisher", () => {
+    const build = (target: Partial<AkanNativeTarget>) =>
+      NativeConfig.build({
+        appPath: "/repo/apps/minimal",
+        target: { ...minimalTarget, ...target },
+        webDir: "/repo/dist/native/minimal/default/web",
+        contributions: [],
+        locales: ["en"],
+        platform: "windows",
+      }).config;
+
+    expect(build({ backgroundColor: "#000000" }).shell).toEqual({ backgroundColor: "#000000" });
+    expect(build({ backgroundColor: { light: "#fafafa", dark: "#111111" } }).shell).toEqual({
+      backgroundColor: "#fafafa",
+      backgroundColorDark: "#111111",
+    });
+    expect(build({}).shell).toBeUndefined();
+    expect(build({ backgroundColor: "#000000", devtools: true }).shell).toEqual({
+      backgroundColor: "#000000",
+      devtools: true,
+    });
+    expect(build({ desktop: { publisher: "Leading Flight" } }).desktop?.publisher).toBe("Leading Flight");
+  });
+
   test("turns the minimal app's push target into the runtime's config, single-instance carrying its link scheme", () => {
     const { config, warnings } = NativeConfig.build({
       appPath: "/repo/apps/minimal",
@@ -208,10 +232,38 @@ describe("NativeConfig.build", () => {
       readyTimeout: 15_000,
     });
     expect(build({ url, publicKey: updatesKey }).updates).toEqual({ url, publicKey: updatesKey });
+    const spare = Buffer.alloc(32, 8).toString("base64");
+    expect(build({ url, publicKeys: [updatesKey, spare] }, "main").updates).toEqual({
+      url,
+      publicKeys: [updatesKey, spare],
+      channel: "main",
+    });
+    const report = { url: "https://cloud.example.com/api/ota/report/abcdefghijklmnop" };
+    expect(build({ url, publicKey: updatesKey, report }, "main").updates).toEqual({
+      url,
+      publicKey: updatesKey,
+      channel: "main",
+      report,
+    });
     expect(build({ url, publicKey: updatesKey }, "main").plugins).toContain("updates");
     expect(build(undefined, "main").plugins).not.toContain("updates");
   });
 
+  test("devtools opens the web inspector of a release build only when a target asks for it", () => {
+    const build = (devtools?: boolean) =>
+      NativeConfig.build({
+        appPath: "/repo/apps/portal",
+        target: { ...adminTarget, ...(devtools === undefined ? {} : { devtools }) },
+        webDir: "/web",
+        contributions: [],
+        locales: ["en"],
+        platform: "android",
+      }).config.shell;
+    expect(build(true)).toEqual({ devtools: true });
+    expect(build(false)).toBeUndefined();
+    expect(build()).toBeUndefined();
+  });
+
   test("push, privacy and the icon and splash objects reach the runtime, paths from the app folder", () => {
     const { config } = NativeConfig.build({
       appPath: "/repo/apps/portal",
@@ -342,7 +394,12 @@ describe("NativeConfig.build", () => {
         permissions: [],
         deepLinks: undefined,
         android: { autoplay: true },
-        desktop: { recovery: "reload", window: { fullscreen: true, skipTaskbar: true }, screenCapture: "auto" },
+        desktop: {
+          recovery: "reload",
+          window: { fullscreen: true, skipTaskbar: true },
+          screenCapture: "auto",
+          webview2: "standalone",
+        },
       },
       webDir: path.join(root, "web"),
       contributions: [],
@@ -355,6 +412,7 @@ describe("NativeConfig.build", () => {
       recovery: "reload",
       window: { fullscreen: true, skipTaskbar: true },
       screenCapture: "auto",
+      webview2: "standalone",
       bin: root,
     });
     expect(config.android).toEqual({ debugAppIdSuffix: ".debug", autoplay: true });

package/mobile/nativeConfig.ts

@@ -175,11 +175,19 @@ export class NativeConfig {
     const desktop = NativeConfig.#compact<NonNullable<AkanNativeConfig["desktop"]>>({
       recovery: target.desktop?.recovery,
       screenCapture: target.desktop?.screenCapture,
+      webview2: target.desktop?.webview2,
+      publisher: target.desktop?.publisher,
       window: NativeConfig.#compact({ ...target.desktop?.window }),
       server: desktopServer,
       bin: desktopBin,
       dmg: NativeConfig.#dmg(target.desktop?.dmg, abs),
     });
+    const background = target.backgroundColor;
+    const shell = NativeConfig.#compact<NonNullable<AkanNativeConfig["shell"]>>({
+      backgroundColor: typeof background === "string" ? background : background?.light,
+      backgroundColorDark: typeof background === "string" ? undefined : background?.dark,
+      devtools: target.devtools ? true : undefined,
+    });
     const config: AkanNativeConfig = {
       app: {
         id: resolveAppId(target.appId, platform),
@@ -223,6 +231,7 @@ export class NativeConfig {
       ...(desktop ? { desktop } : {}),
       ...(target.icon ? { icon: NativeConfig.#icon(target.icon, abs) } : {}),
       ...(target.splash ? { splash: NativeConfig.#splash(target.splash, abs) } : {}),
+      ...(shell ? { shell } : {}),
     };
     return { config, warnings };
   }
@@ -252,10 +261,11 @@ export class NativeConfig {
     };
   }
 
-  //? akanConfig refuses a target whose merged updates lack url or publicKey; the type still has them optional.
+  //? akanConfig refuses a target whose merged updates lack url or a key; the type still has them optional.
   static #updates(target: AkanNativeTarget, env?: NativeEnv): NonNullable<AkanNativeConfig["updates"]> | undefined {
-    const { url, publicKey, channel = env, ...rest } = target.updates ?? {};
-    return url && publicKey ? { ...rest, url, publicKey, ...(channel ? { channel } : {}) } : undefined;
+    const { url, publicKey, publicKeys, channel = env, ...rest } = target.updates ?? {};
+    const keys = publicKeys ? { publicKeys: [...publicKeys] } : publicKey ? { publicKey } : null;
+    return url && keys ? { ...rest, url, ...keys, ...(channel ? { channel } : {}) } : undefined;
   }
 
   /** Letters, digits, `.`, `_` and `-` only; the folder name of an akan app already is one almost always. */

package/mobile/serverBundleSecrets.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import { tempDirs, writeText as write } from "../testHelpers";
+import { ServerBundleSecrets } from "./serverBundleSecrets";
+
+const makeTempRoot = tempDirs("akan-devkit-server-bundle-secrets-");
+
+const workspace = async () => {
+  const root = await makeTempRoot();
+  await write(
+    path.join(root, "libs/util/env/env.server.testing.ts"),
+    `export const env = { hostname: "lib-host", security: { jwtSecret: "lib-jwt-0123456789" }, iapVerify: { apple: "0f9e8d7c6b5a49382716abcdef012345", google: { type: "service_account", private_key: "-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7\\n-----END PRIVATE KEY-----\\n" } } };\n`,
+  );
+  await write(path.join(root, "libs/util/env/env.server.type.ts"), "export type Env = object;\n");
+  await write(
+    path.join(root, "apps/demo/env/env.server.main.ts"),
+    'export const env = { mailer: { auth: { user: "ops", pass: "main-mail-pass" } } };\n',
+  );
+  const bundle = path.join(root, "bundle");
+  return { root, appDir: path.join(root, "apps/demo"), bundle };
+};
+
+describe("ServerBundleSecrets", () => {
+  test("passes a bundle that holds none of the workspace's secret values, constants of a credential block aside", async () => {
+    const { root, appDir, bundle } = await workspace();
+    await write(path.join(bundle, "server.js"), 'const t = "service_account"; const host = "lib-host";\n');
+    await write(path.join(bundle, "node_modules/leaky/index.js"), 'const k = "lib-jwt-0123456789";\n');
+    expect(await new ServerBundleSecrets(root, appDir).assertClean(bundle)).toEqual([]);
+  });
+
+  test("refuses one that does, naming the file, the env file and the key path and never the value", async () => {
+    const { root, appDir, bundle } = await workspace();
+    await write(
+      path.join(bundle, "chunk-a.js"),
+      'const e = { pass: "main-mail-pass", apple: "0f9e8d7c6b5a49382716abcdef012345" };\n',
+    );
+    await write(
+      path.join(bundle, "chunk-b.js"),
+      'const pem = "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7";\n',
+    );
+    const error = await new ServerBundleSecrets(root, appDir).assertClean(bundle).catch((e: Error) => e);
+    expect(error).toBeInstanceOf(Error);
+    const message = (error as Error).message;
+    expect(message).toContain("chunk-a.js holds apps/demo/env/env.server.main.ts mailer.auth.pass");
+    expect(message).toContain("chunk-a.js holds libs/util/env/env.server.testing.ts iapVerify.apple");
+    expect(message).toContain("chunk-b.js holds libs/util/env/env.server.testing.ts iapVerify.google.private_key");
+    for (const secret of ["main-mail-pass", "0f9e8d7c", "MIIEvQ"]) expect(message).not.toContain(secret);
+  });
+
+  test("names an env file it could not evaluate instead of passing it silently", async () => {
+    const { root, appDir, bundle } = await workspace();
+    await write(
+      path.join(appDir, "env/env.server.develop.ts"),
+      'import { gone } from "./missing";\nexport const env = gone;\n',
+    );
+    await write(path.join(bundle, "server.js"), "\n");
+    expect(await new ServerBundleSecrets(root, appDir).assertClean(bundle)).toEqual([
+      "apps/demo/env/env.server.develop.ts",
+    ]);
+  });
+});

package/mobile/serverBundleSecrets.ts

@@ -0,0 +1,85 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { ServerEnvProfile } from "../transforms/serverEnvProfile";
+
+interface SecretValue {
+  file: string;
+  path: string;
+  value: string;
+}
+
+//* A signed app leaves the building, and a notarized one goes to Apple first: before either, every secret value the
+//* workspace's server env files hold is looked for in the server the app carries, whatever put it there.
+export class ServerBundleSecrets {
+  static readonly #largestFile = 64 * 1024 * 1024;
+
+  constructor(
+    readonly workspaceRoot: string,
+    readonly appDir: string,
+  ) {}
+
+  /** The app's `env/env.server.<name>.ts` and every lib's, but the type and example files. */
+  async envFiles(): Promise<string[]> {
+    const libsDir = path.join(this.workspaceRoot, "libs");
+    const libs = await readdir(libsDir).catch(() => [] as string[]);
+    const dirs = [path.join(this.appDir, "env"), ...libs.map((lib) => path.join(libsDir, lib, "env"))];
+    const files = await Promise.all(
+      dirs.map(async (dir) =>
+        (await readdir(dir).catch(() => [] as string[]))
+          .filter((name) => /^env\.server\.[A-Za-z0-9.-]+\.ts$/.test(name) && !/\.(type|example)\.ts$/.test(name))
+          .map((name) => path.join(dir, name)),
+      ),
+    );
+    return files.flat();
+  }
+
+  /** Refuses, naming files and key paths and never a value, when the bundle holds one; returns the env files it could not read. */
+  async assertClean(bundleDir: string): Promise<string[]> {
+    const unread: string[] = [];
+    const secrets: SecretValue[] = [];
+    for (const file of await this.envFiles()) {
+      try {
+        const value = await ServerEnvProfile.evaluate(file, path.dirname(path.dirname(file)));
+        secrets.push(...ServerEnvProfile.secretValues(value).map((secret) => ({ file, ...secret })));
+      } catch {
+        unread.push(ServerBundleSecrets.#relative(this.workspaceRoot, file));
+      }
+    }
+    const found: string[] = [];
+    for (const bundled of await ServerBundleSecrets.#files(bundleDir)) {
+      const text = await readFile(bundled, "latin1");
+      for (const secret of secrets)
+        if (ServerBundleSecrets.#needles(secret.value).some((needle) => text.includes(needle)))
+          found.push(
+            `${ServerBundleSecrets.#relative(bundleDir, bundled)} holds ${ServerBundleSecrets.#relative(this.workspaceRoot, secret.file)} ${secret.path}`,
+          );
+    }
+    if (found.length)
+      throw new Error(
+        `The server this app carries holds secret values from the workspace's env files, so it is not signed or sent anywhere:\n  ${[...new Set(found)].join("\n  ")}\nBuild its server with a profile (native.desktop.server.profile), whose bundle carries no secret.`,
+      );
+    return unread;
+  }
+
+  //? A multi-line key sits in a bundle as a JS string, escaped; one long line of it is enough to recognise.
+  static #needles(value: string): string[] {
+    const escaped = JSON.stringify(value).slice(1, -1);
+    const line = value.split(/\r?\n/).find((part) => part.length >= 32);
+    return [...new Set([value, escaped, ...(line ? [line] : [])])];
+  }
+
+  static #relative(from: string, to: string) {
+    return path.relative(from, to).split(path.sep).join("/");
+  }
+
+  static async #files(dir: string): Promise<string[]> {
+    const files: string[] = [];
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      const file = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name !== "node_modules") files.push(...(await ServerBundleSecrets.#files(file)));
+      } else if (entry.isFile() && (await stat(file)).size <= ServerBundleSecrets.#largestFile) files.push(file);
+    }
+    return files;
+  }
+}

package/mobile/updateUploader.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { type UpdateBucket, UpdateUploader } from "./updateUploader";
+
+const fakeBucket = (held: string[] = []) => {
+  const writes: { key: string; type?: string }[] = [];
+  const bucket: UpdateBucket = {
+    exists: async (key) => held.includes(key),
+    write: async (key, _data, options) => {
+      writes.push({ key, ...(options?.type ? { type: options.type } : {}) });
+      return 0;
+    },
+  };
+  return { bucket, writes };
+};
+
+describe("UpdateUploader", () => {
+  test("reads s3://bucket/prefix and refuses anything else", () => {
+    expect(UpdateUploader.parseTarget("s3://releases/dcms/kiosk/")).toEqual({
+      bucket: "releases",
+      prefix: "dcms/kiosk",
+    });
+    expect(UpdateUploader.parseTarget("s3://releases")).toEqual({ bucket: "releases", prefix: "" });
+    expect(() => UpdateUploader.parseTarget("https://releases.example/dcms")).toThrow("s3://<bucket>/<prefix>");
+  });
+
+  test("uploads what the bucket lacks first, then each signature before its manifest", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "akan-update-upload-"));
+    try {
+      await mkdir(path.join(dir, "windows-x64", "files"), { recursive: true });
+      for (const file of ["windows-x64/files/2000-aa.tar.gz", "windows-x64/files/1000-bb.tar.gz"])
+        await writeFile(path.join(dir, file), "tar");
+      for (const file of ["windows-x64/main.json", "windows-x64/main.json.sig", "windows-x64/main.json.tmp"])
+        await writeFile(path.join(dir, file), "{}");
+      const { bucket, writes } = fakeBucket(["dcms/windows-x64/files/1000-bb.tar.gz"]);
+
+      expect(await new UpdateUploader(bucket, "dcms").upload(dir)).toEqual({ uploaded: 3, skipped: 1 });
+      expect(writes).toEqual([
+        { key: "dcms/windows-x64/files/2000-aa.tar.gz" },
+        { key: "dcms/windows-x64/main.json.sig", type: "text/plain" },
+        { key: "dcms/windows-x64/main.json", type: "application/json" },
+      ]);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});