@akanjs/devkit 3.1.0-rc.0 → 3.1.0-rc.2

package/mobile/nativeApp.ts

@@ -1,7 +1,7 @@
-import { rm } from "node:fs/promises";
 import path from "node:path";
 import type { AkanNativeConfig } from "@akanjs/native/config";
 import type { NativeEnv } from "akanjs";
+import { toError } from "akanjs/common";
 import type { App } from "../commandDecorators";
 import { Executor } from "../executors";
 import { type DesktopArch, DesktopBin } from "./desktopBin";
@@ -17,13 +17,16 @@ import { NativeApi, type NativeBuildApiModule } from "./nativeApi";
 import { NativeAppLine, type NativeAppLineRead } from "./nativeAppLine";
 import { NativeConfig } from "./nativeConfig";
 import { NativePluginFolders } from "./nativePluginFolders";
+import { NativePublicEnv, type PublicEnv } from "./nativePublicEnv";
 import { NativeWebDir } from "./nativeWebDir";
 import { ServerBundleSecrets } from "./serverBundleSecrets";
+import { type NativeUpdatePack, UpdatePackFolder } from "./updatePackFolder";
 
 type TaskOptions = Parameters<NativeBuildApiModule["build"]>[0];
 type DeviceSelector = NonNullable<Parameters<NativeBuildApiModule["run"]>[0]["device"]>;
 type ReleaseOptions = Parameters<NativeBuildApiModule["release"]>[0];
 type AndroidSigning = Extract<ReleaseOptions, { platform: "android" }>["signing"];
+type PhoneRevocation = Pick<Parameters<NativeBuildApiModule["checkPublishUpdate"]>[0], "revoke" | "resetSequence">;
 
 export interface NativeRunOptions {
   device?: DeviceSelector;
@@ -56,25 +59,6 @@ export interface NativeDevOptions extends NativeRunOptions {
   lang: string;
 }
 
-/** `<out>/pack.json`: what a signer needs of a pack, read instead of the log. */
-export interface NativeUpdatePack {
-  schema: 1;
-  app: string;
-  target: string;
-  platform: MobilePlatform;
-  env: NativeEnv;
-  channel: string;
-  appId: string;
-  appVersion: string;
-  nativeApi: string;
-  /** bundle.json `web.hash`: the web files as served, the part of a bundle id that names its content. */
-  webHash: string;
-  files: number;
-  size: number;
-  out: string;
-  compat?: { against: string; compatible: boolean; problems: string[] };
-}
-
 /** One native target of an app on the native runtime (a phone, or this computer as a desktop app): where it builds,
  * what it ships, and the calls into the API. */
 export class NativeApp {
@@ -224,16 +208,23 @@ export class NativeApp {
     NativeApp.#assertServerPlatform(platform, server);
     NativeApp.assertInstaller(platform, installer);
     await this.assembleWeb(platform);
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare(platform, server, arch);
     const distribution = await this.#distribution(api, platform, profile, { sign, notarize }, server);
-    return await api.build({
-      ...this.#task(platform, config, { env: await this.#runtimeEnv(server) }),
-      profile,
-      ...(arch ? { arch } : {}),
-      ...(platform === "windows" ? { windows: { ...(installer ? { installer } : {}), ...distribution.windows } } : {}),
-      ...(platform === "macos" ? { macos: { ...distribution.macos, ...(installer ? { dmg: true } : {}) } } : {}),
-      ...(platform === "linux" && installer ? { linux: { appImage: true } } : {}),
-    });
+    return await this.#recorded(
+      this.outDir(platform),
+      publicEnv,
+      api.build({
+        ...this.#task(platform, config, { env: await this.#runtimeEnv(server) }),
+        profile,
+        ...(arch ? { arch } : {}),
+        ...(platform === "windows"
+          ? { windows: { ...(installer ? { installer } : {}), ...distribution.windows } }
+          : {}),
+        ...(platform === "macos" ? { macos: { ...distribution.macos, ...(installer ? { dmg: true } : {}) } } : {}),
+        ...(platform === "linux" && installer ? { linux: { appImage: true } } : {}),
+      }),
+    );
   }
 
   async run(
@@ -302,12 +293,17 @@ export class NativeApp {
 
   async releaseIos({ teamId, adHoc = false }: { teamId?: string; adHoc?: boolean } = {}) {
     await this.assembleWeb("ios");
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare("ios");
-    return await api.release({
-      ...this.#task("ios", config, { env: await this.#runtimeEnv() }),
-      platform: "ios",
-      signing: { ...(teamId ? { teamId } : {}), ...(adHoc ? { distribution: "ad-hoc" as const } : {}) },
-    });
+    return await this.#recorded(
+      this.outDir("ios"),
+      publicEnv,
+      api.release({
+        ...this.#task("ios", config, { env: await this.#runtimeEnv() }),
+        platform: "ios",
+        signing: { ...(teamId ? { teamId } : {}), ...(adHoc ? { distribution: "ad-hoc" as const } : {}) },
+      }),
+    );
   }
 
   /** Where publishUpdate writes: upload this folder as the target's updates.url. */
@@ -324,7 +320,15 @@ export class NativeApp {
       arch,
       sign = false,
       notarize = false,
-    }: { channel?: string; server?: DesktopServerBundle; arch?: DesktopArch; sign?: boolean; notarize?: boolean } = {},
+      revoke,
+      resetSequence,
+    }: {
+      channel?: string;
+      server?: DesktopServerBundle;
+      arch?: DesktopArch;
+      sign?: boolean;
+      notarize?: boolean;
+    } & PhoneRevocation = {},
   ) {
     NativeApp.#assertServerPlatform(platform, server);
     this.#assertUpdates();
@@ -340,11 +344,14 @@ export class NativeApp {
       ...(arch ? { arch } : {}),
       ...(distribution.macos ? { macos: distribution.macos } : {}),
       ...(distribution.windows ? { windows: distribution.windows } : {}),
+      ...(revoke?.length ? { revoke } : {}),
+      ...(resetSequence ? { resetSequence } : {}),
     });
   }
 
-  //* Only what the command asked for is signed or uploaded; a signed app's server is searched for the workspace's
-  //* secret values first, and the one line naming the identity and the service comes right before the build.
+  //* Only what the command asked for is signed or uploaded. A release's server is searched for the workspace's secret
+  //* values first, signed or not: an unsigned app is handed out too, and an update is published to every install. The
+  //* one line naming the identity and the service comes right before the build.
   async #distribution(
     api: NativeBuildApiModule,
     platform: NativePlatform,
@@ -353,29 +360,40 @@ export class NativeApp {
     server: DesktopServerBundle | undefined,
   ) {
     const distribution = api.requestedDistribution(platform, profile, request);
+    if (server && profile === "release") await this.#assertServerClean(server);
     if (!distribution.notice) {
       if (distribution.unused.length && (platform === "macos" || platform === "windows"))
         this.app.logger.info(`${distribution.unused.join(", ")} set: this build is not signed without --sign.`);
       return distribution;
     }
-    if (server) {
-      const unread = await new ServerBundleSecrets(this.app.workspace.workspaceRoot, this.app.cwdPath).assertClean(
-        server.dir,
-      );
-      if (unread.length)
-        this.app.logger.warn(`Not searched for secrets, as they could not be evaluated: ${unread.join(", ")}.`);
-    }
     this.app.logger.warn(distribution.notice);
     return distribution;
   }
 
+  async #assertServerClean(server: DesktopServerBundle) {
+    const unread = await new ServerBundleSecrets(this.app.workspace.workspaceRoot, this.app.cwdPath).assertClean(
+      server.dir,
+    );
+    if (unread.length)
+      throw new Error(
+        `The server this app carries was not searched for the secret values of ${unread.join(", ")}, which could not be evaluated with no app env set, so the release stops here.`,
+      );
+  }
+
   /**
    * What publishing refuses once the release is built: no updates settings, an invalid config, no signing key or
-   * another app's, and a desktop release whose server presence is not its channel's previous release's.
+   * another app's, a desktop release whose server presence is not its channel's previous release's, and a phone release
+   * whose revocations no phone would take.
    */
   async assertPublishable(
     platform: NativePlatform,
-    { channel, server = false, arch }: { channel?: string; server?: boolean; arch?: DesktopArch } = {},
+    {
+      channel,
+      server = false,
+      arch,
+      revoke,
+      resetSequence,
+    }: { channel?: string; server?: boolean; arch?: DesktopArch } & PhoneRevocation = {},
   ) {
     this.#assertUpdates();
     const [api, { config }] = await Promise.all([
@@ -392,14 +410,13 @@ export class NativeApp {
         server,
         ...(channel ? { channel } : {}),
         ...(arch ? { arch } : {}),
+        ...(revoke?.length ? { revoke } : {}),
+        ...(resetSequence ? { resetSequence } : {}),
       });
     } catch (error) {
-      throw new Error(
-        `Native target '${this.target.name}': ${error instanceof Error ? error.message : String(error)}`,
-        {
-          cause: error,
-        },
-      );
+      throw new Error(`Native target '${this.target.name}': ${toError(error).message}`, {
+        cause: error,
+      });
     }
   }
 
@@ -422,29 +439,38 @@ export class NativeApp {
   async releaseAndroid({ formats = ["aab"] }: { formats?: ("aab" | "apk")[] } = {}) {
     const signing = NativeApp.androidSigning();
     await this.assembleWeb("android");
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare("android");
-    return await api.release({
-      ...this.#task("android", config, { env: await this.#runtimeEnv() }),
-      platform: "android",
-      signing,
-      formats,
-    });
+    return await this.#recorded(
+      this.outDir("android"),
+      publicEnv,
+      api.release({
+        ...this.#task("android", config, { env: await this.#runtimeEnv() }),
+        platform: "android",
+        signing,
+        formats,
+      }),
+    );
   }
 
   /** An unsigned OTA update of this target's web bundle for `platform`, and the record `pack.json` keeps of it. */
   async packUpdate(platform: MobilePlatform, { out }: { out?: string } = {}) {
     await this.assembleWeb(platform);
+    const publicEnv = await this.#publicEnv();
     const { api, config } = await this.prepare(platform);
     if (!config.updates)
       throw new Error(
         `Native target '${this.target.name}' takes no updates: add native.updates: { url, publicKey } to akan.config.ts first.`,
       );
     const dir = path.resolve(out ?? path.join(this.updatesDir, platform));
-    //? A pack that fails must not leave the previous pack's record behind for whoever reads the exit code.
-    await Promise.all(["pack.json", "compat.json"].map((name) => rm(path.join(dir, name), { force: true })));
-    const packed = await api.packUpdate({ ...this.#task(platform, config), platform, out: dir });
+    await UpdatePackFolder.clear(dir);
+    const packed = await this.#recorded(
+      dir,
+      publicEnv,
+      api.packUpdate({ ...this.#task(platform, config), platform, out: dir }),
+    );
     const channel = config.updates.channel ?? "production";
-    const bundle = (await Bun.file(path.join(packed.out, "bundle.json")).json()) as { web: { hash: string } };
+    const bundle = await UpdatePackFolder.readBundle(path.join(packed.out, UpdatePackFolder.bundleFile));
     const pack: NativeUpdatePack = {
       schema: 1,
       app: this.app.name,
@@ -456,6 +482,7 @@ export class NativeApp {
       appVersion: packed.manifest.version,
       nativeApi: packed.manifest.nativeApi ?? "",
       webHash: bundle.web.hash,
+      ...(bundle.web.publicEnvHash ? { publicEnvHash: bundle.web.publicEnvHash } : {}),
       files: packed.manifest.files.length,
       size: packed.manifest.files.reduce((sum, file) => sum + file.size, 0),
       out: packed.out,
@@ -463,8 +490,27 @@ export class NativeApp {
     return { ...packed, channel, pack };
   }
 
-  static async writePack(pack: NativeUpdatePack) {
-    await Bun.write(path.join(pack.out, "pack.json"), `${JSON.stringify(pack, null, 2)}\n`);
+  //* Checked before anything is built or signed: a target with updates would ship a binary Akan Cloud cannot update.
+  async #publicEnv() {
+    const publicEnv = await NativePublicEnv.built(this.app);
+    if (!publicEnv) return null;
+    const problems = NativePublicEnv.problems(publicEnv);
+    if (!problems.length) return publicEnv;
+    const message = `The web build inlines public env an update cannot carry:\n- ${problems.join("\n- ")}`;
+    if (this.target.config.updates) throw new Error(message);
+    this.app.logger.warn(`${message}\nbundle.json records none, so no update can be checked against this build.`);
+    return null;
+  }
+
+  //? After the build: the native CLI writes bundle.json, and a phone build with updates rewrites it once more.
+  async #recorded<T>(dir: string, publicEnv: PublicEnv | null, build: Promise<T>) {
+    const result = await build;
+    const file = path.join(dir, UpdatePackFolder.bundleFile);
+    if (!publicEnv || !(await Bun.file(file).exists())) return result;
+    const bundle = await UpdatePackFolder.readBundle(file);
+    const web = { ...bundle.web, publicEnv, publicEnvHash: NativePublicEnv.hash(publicEnv) };
+    await Bun.write(file, `${JSON.stringify({ ...bundle, web }, null, 2)}\n`);
+    return result;
   }
 
   static async compareBundles(appDir: string, shipped: string, bundle: string) {

package/mobile/nativeConfig.ts

@@ -261,7 +261,8 @@ export class NativeConfig {
     };
   }
 
-  //? akanConfig refuses a target whose merged updates lack url or a key; the type still has them optional.
+  //? akanConfig refuses a target whose merged updates lack url or a key, or hold both key forms; the type still has
+  //? them optional.
   static #updates(target: AkanNativeTarget, env?: NativeEnv): NonNullable<AkanNativeConfig["updates"]> | undefined {
     const { url, publicKey, publicKeys, channel = env, ...rest } = target.updates ?? {};
     const keys = publicKeys ? { publicKeys: [...publicKeys] } : publicKey ? { publicKey } : null;

package/mobile/nativePublicEnv.test.ts

@@ -0,0 +1,131 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { WorkspaceExecutor } from "../executors";
+import { tempDirs, writeText } from "../testHelpers";
+import { NativePublicEnv } from "./nativePublicEnv";
+
+const makeTempRoot = tempDirs("akan-native-public-env-");
+
+const recorded = {
+  AKAN_PUBLIC_ENV: "main",
+  AKAN_PUBLIC_REPO_NAME: "softs2",
+  AKAN_PUBLIC_SERVE_DOMAIN: "akamir.com",
+};
+
+describe("NativePublicEnv", () => {
+  test("keeps the AKAN_PUBLIC_* the app sets, sorted, and leaves out what akan.config.ts derives", () => {
+    expect(
+      Object.keys(
+        NativePublicEnv.of({
+          AKAN_PUBLIC_SERVE_DOMAIN: "akamir.com",
+          AKAN_PUBLIC_APP_NAME: "lu",
+          AKAN_PUBLIC_BASE_PATHS: "",
+          AKAN_PUBLIC_RENDER_ENV: "csr",
+          AKAN_PUBLIC_ENV: "main",
+          JWT_SECRET: "never",
+        }),
+      ),
+    ).toEqual(["AKAN_PUBLIC_ENV", "AKAN_PUBLIC_SERVE_DOMAIN"]);
+  });
+
+  test("hashes the sorted map as JSON, whatever order it was written in", () => {
+    const reversed = Object.fromEntries(Object.entries(recorded).reverse());
+    const expected = createHash("sha256").update(JSON.stringify(recorded)).digest("hex");
+    expect(NativePublicEnv.hash(reversed)).toBe(expected);
+  });
+
+  test("refuses what Akan Cloud refuses in a recorded env", () => {
+    expect(NativePublicEnv.problems(recorded)).toEqual([]);
+    expect(
+      NativePublicEnv.problems({
+        AKAN_PUBLIC_lower: "x",
+        AKAN_PUBLIC_MAP_TOKEN: "x",
+        AKAN_PUBLIC_PORT: 8282,
+        AKAN_PUBLIC_NOTE: "line\nbreak",
+      }),
+    ).toEqual([
+      "AKAN_PUBLIC_lower is not an AKAN_PUBLIC_[A-Z0-9_] name",
+      "AKAN_PUBLIC_MAP_TOKEN names a token, which a page bundle must not carry",
+      "AKAN_PUBLIC_PORT is not a string",
+      "AKAN_PUBLIC_NOTE holds a control character",
+    ]);
+    const many = Object.fromEntries(Array.from({ length: 257 }, (_, idx) => [`AKAN_PUBLIC_K${idx}`, "v"]));
+    expect(NativePublicEnv.problems(many)).toEqual(["257 keys, more than 256"]);
+    expect(NativePublicEnv.problems({ AKAN_PUBLIC_BIG: "x".repeat(70_000) })[0]).toContain("bytes, more than 65536");
+  });
+
+  test("names the keys two maps disagree on, either side missing included", () => {
+    expect(
+      NativePublicEnv.diff(recorded, { ...recorded, AKAN_PUBLIC_SERVE_DOMAIN: "try.akanjs.com", AKAN_PUBLIC_X: "1" }),
+    ).toEqual(["AKAN_PUBLIC_SERVE_DOMAIN", "AKAN_PUBLIC_X"]);
+  });
+
+  test("loads --public-env from a JSON map or from a store build's bundle.json, and refuses the rest", async () => {
+    const root = await makeTempRoot();
+    const map = path.join(root, "store.env.json");
+    await writeText(map, JSON.stringify(recorded));
+    expect(await NativePublicEnv.load(map)).toEqual(recorded);
+
+    const bundle = path.join(root, "bundle.json");
+    await writeText(bundle, JSON.stringify({ schema: 1, web: { hash: "h", files: 1, publicEnv: recorded } }));
+    expect(await NativePublicEnv.load(bundle)).toEqual(recorded);
+    expect(await NativePublicEnv.recordedIn(bundle)).toEqual(recorded);
+
+    const older = path.join(root, "older.json");
+    await writeText(older, JSON.stringify({ schema: 1, web: { hash: "h", files: 1 } }));
+    await expect(NativePublicEnv.load(older)).rejects.toThrow("recorded no public env");
+    expect(await NativePublicEnv.recordedIn(older)).toBeNull();
+    expect(await NativePublicEnv.recordedIn(path.join(root, "missing.json"))).toBeNull();
+
+    const derived = path.join(root, "derived.json");
+    await writeText(derived, JSON.stringify({ ...recorded, AKAN_PUBLIC_APP_NAME: "lu" }));
+    await expect(NativePublicEnv.load(derived)).rejects.toThrow("AKAN_PUBLIC_APP_NAME, which akan.config.ts decides");
+
+    const secret = path.join(root, "secret.json");
+    await writeText(secret, JSON.stringify({ AKAN_PUBLIC_API_PASSWORD: "x" }));
+    await expect(NativePublicEnv.load(secret)).rejects.toThrow("names a password");
+    await expect(NativePublicEnv.load(path.join(root, "nope.json"))).rejects.toThrow("does not exist");
+  });
+
+  test("says which keys keep a pack out of a store build that recorded its env, and nothing when it recorded none", async () => {
+    const root = await makeTempRoot();
+    const shipped = path.join(root, "store.json");
+    const pack = path.join(root, "pack.json");
+    await writeText(shipped, JSON.stringify({ schema: 1, web: { publicEnv: recorded } }));
+    await writeText(
+      pack,
+      JSON.stringify({ schema: 1, web: { publicEnv: { ...recorded, AKAN_PUBLIC_SERVE_DOMAIN: "try.akanjs.com" } } }),
+    );
+    expect(await NativePublicEnv.problemAgainst(shipped, pack)).toBe(
+      `public env AKAN_PUBLIC_SERVE_DOMAIN differs from the store build's (pass --public-env ${shipped} to repeat it)`,
+    );
+    expect(await NativePublicEnv.problemAgainst(shipped, shipped)).toBeNull();
+    expect(await NativePublicEnv.problemAgainst(pack.replace("pack", "none"), pack)).toBeNull();
+  });
+
+  describe("pin", () => {
+    const saved = { ...process.env };
+    afterEach(() => {
+      for (const key of Object.keys(process.env)) if (!(key in saved)) delete process.env[key];
+      Object.assign(process.env, saved);
+      WorkspaceExecutor.publicEnvPin = null;
+    });
+
+    test("leaves exactly the pinned values and the derived ones, and outranks the root .env", async () => {
+      const root = await makeTempRoot();
+      const envFile = path.join(root, ".env");
+      await writeText(
+        envFile,
+        "AKAN_PUBLIC_REPO_NAME=from-dotenv\nAKAN_PUBLIC_SERVE_DOMAIN=try.akanjs.com\nAKAN_PUBLIC_LOG_LEVEL=debug\n",
+      );
+      Object.assign(process.env, { AKAN_PUBLIC_LOG_LEVEL: "debug", AKAN_PUBLIC_APP_NAME: "lu" });
+      NativePublicEnv.pin(recorded);
+      expect(NativePublicEnv.of(process.env)).toEqual(recorded);
+      expect(process.env.AKAN_PUBLIC_APP_NAME).toBe("lu");
+      const base = WorkspaceExecutor.getBaseDevEnv(envFile);
+      expect(base.repoName).toBe("softs2");
+      expect(base.serveDomain).toBe("akamir.com");
+    });
+  });
+});

package/mobile/nativePublicEnv.ts

@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import type { App } from "../commandDecorators";
+import { WorkspaceExecutor } from "../executors";
+import { CsrArtifactBuilder } from "../frontendBuild/csrArtifactBuilder";
+
+export type PublicEnv = Record<string, string>;
+
+//* The `AKAN_PUBLIC_*` a native web build inlines: an update has to repeat them, because the API host and the env an
+//* installed binary talks to live there and nowhere else. Keys akan.config.ts derives are left out, as Akan Cloud does.
+export class NativePublicEnv {
+  static readonly derivedKeys = [
+    "AKAN_PUBLIC_APP_NAME",
+    "AKAN_PUBLIC_BASE_PATHS",
+    "AKAN_PUBLIC_API_PREFIX",
+    "AKAN_PUBLIC_WS_PREFIX",
+    "AKAN_PUBLIC_RENDER_ENV",
+    "AKAN_PUBLIC_DEFAULT_LOCALE",
+    "AKAN_PUBLIC_LOCALES",
+  ];
+  //? Akan Cloud's own limits on a recorded env: a build it would refuse fails here, before anything is signed.
+  static readonly #keyPattern = /^AKAN_PUBLIC_[A-Z0-9_]{1,128}$/;
+  static readonly #secretWords = ["SECRET", "TOKEN", "PASSWORD", "PRIVATE", "CREDENTIAL"];
+  static readonly #maxKeys = 256;
+  static readonly #maxBytes = 64 * 1024;
+
+  static of(env: Record<string, unknown>): PublicEnv {
+    return Object.fromEntries(
+      Object.keys(env)
+        .filter((key) => key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key))
+        .sort()
+        .map((key) => [key, String(env[key])]),
+    );
+  }
+
+  static hash(publicEnv: PublicEnv) {
+    return createHash("sha256")
+      .update(JSON.stringify(NativePublicEnv.of(publicEnv)))
+      .digest("hex");
+  }
+
+  static problems(publicEnv: Record<string, unknown>) {
+    const keys = Object.keys(publicEnv);
+    const problems = keys.flatMap((key) => {
+      const value = publicEnv[key];
+      if (!NativePublicEnv.#keyPattern.test(key)) return [`${key} is not an AKAN_PUBLIC_[A-Z0-9_] name`];
+      const word = NativePublicEnv.#secretWords.find((secret) => key.includes(secret));
+      if (word) return [`${key} names a ${word.toLowerCase()}, which a page bundle must not carry`];
+      if (typeof value !== "string") return [`${key} is not a string`];
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: the control characters are what is refused
+      if (/[\u0000-\u001f\u007f]/.test(value)) return [`${key} holds a control character`];
+      return [];
+    });
+    if (keys.length > NativePublicEnv.#maxKeys)
+      problems.push(`${keys.length} keys, more than ${NativePublicEnv.#maxKeys}`);
+    const bytes = Buffer.byteLength(JSON.stringify(publicEnv));
+    if (bytes > NativePublicEnv.#maxBytes) problems.push(`${bytes} bytes, more than ${NativePublicEnv.#maxBytes}`);
+    return problems;
+  }
+
+  /** The keys whose values differ, or that only one side has. */
+  static diff(a: PublicEnv, b: PublicEnv) {
+    return [...new Set([...Object.keys(a), ...Object.keys(b)])]
+      .filter((key) => a[key] !== b[key])
+      .sort((x, y) => (x < y ? -1 : x > y ? 1 : 0));
+  }
+
+  /** What the app's last `akan build` inlined, or null when it built no CSR bundle. */
+  static async built(app: App): Promise<PublicEnv | null> {
+    const file = Bun.file(CsrArtifactBuilder.publicEnvPath(app));
+    if (!(await file.exists())) return null;
+    return NativePublicEnv.of((await file.json()) as Record<string, unknown>);
+  }
+
+  /** A bundle.json's record, or null when it has none (a build from before the record, or no file at all). */
+  static async recordedIn(bundleFile: string): Promise<PublicEnv | null> {
+    const file = Bun.file(bundleFile);
+    if (!(await file.exists())) return null;
+    const bundle = (await file.json()) as { web?: { publicEnv?: PublicEnv } };
+    return bundle.web?.publicEnv ?? null;
+  }
+
+  /** `--public-env`: a JSON map of the values, or the bundle.json of the store build that recorded them. */
+  static async load(file: string): Promise<PublicEnv> {
+    const source = Bun.file(file);
+    if (!(await source.exists())) throw new Error(`--public-env ${file} does not exist.`);
+    const json = (await source.json().catch(() => null)) as Record<string, unknown> | null;
+    if (!json || typeof json !== "object" || Array.isArray(json))
+      throw new Error(`--public-env ${file} is not a JSON object of AKAN_PUBLIC_* values or a bundle.json.`);
+    const isBundle = json.schema === 1 && typeof json.web === "object";
+    const map = isBundle ? (json.web as { publicEnv?: Record<string, unknown> }).publicEnv : json;
+    if (!map) throw new Error(`--public-env ${file} is a bundle.json from a build that recorded no public env.`);
+    const derived = Object.keys(map).filter((key) => NativePublicEnv.derivedKeys.includes(key));
+    if (derived.length)
+      throw new Error(`--public-env ${file} sets ${derived.join(", ")}, which akan.config.ts decides.`);
+    const problems = NativePublicEnv.problems(map);
+    if (problems.length) throw new Error(`--public-env ${file} is refused:\n- ${problems.join("\n- ")}`);
+    return NativePublicEnv.of(map);
+  }
+
+  //* Exactly these values and the ones akan.config.ts derives: the shell's and `.env`'s other AKAN_PUBLIC_* are dropped.
+  static pin(publicEnv: PublicEnv) {
+    for (const key of Object.keys(process.env))
+      if (key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key)) delete process.env[key];
+    Object.assign(process.env, publicEnv);
+    WorkspaceExecutor.publicEnvPin = publicEnv;
+  }
+
+  /** Why a pack's bundle cannot ship to the store build `shipped`, as far as the public env goes. */
+  static async problemAgainst(shipped: string, bundle: string) {
+    const [before, now] = await Promise.all([NativePublicEnv.recordedIn(shipped), NativePublicEnv.recordedIn(bundle)]);
+    if (!before) return null;
+    const differs = NativePublicEnv.diff(before, now ?? {});
+    if (!differs.length) return null;
+    return `public env ${differs.join(", ")} differs from the store build's (pass --public-env ${shipped} to repeat it)`;
+  }
+}

package/mobile/serverBundleSecrets.test.ts

@@ -47,6 +47,85 @@ describe("ServerBundleSecrets", () => {
     for (const secret of ["main-mail-pass", "0f9e8d7c", "MIIEvQ"]) expect(message).not.toContain(secret);
   });
 
+  test("passes a server whose vendor and lib code hold a token endpoint and a default password the env files hold too", async () => {
+    const { root, appDir, bundle } = await workspace();
+    await write(
+      path.join(root, "libs/shared/env/env.server.testing.ts"),
+      'export const env = { rootAdminInfo: { accountId: "admin@example.com", password: "admin1234" }, iapVerify: { google: { token_uri: "https://oauth2.googleapis.com/token" } } };\n',
+    );
+    await write(
+      path.join(root, "libs/shared/lib/option.ts"),
+      'export const rootAdmin = { accountId: "admin@mydomain.com", password: "admin1234" };\n',
+    );
+    await write(
+      path.join(root, "libs/shared/env/env.server.example.ts"),
+      'export const env = { pass: "main-mail-pass" };\n',
+    );
+    await write(path.join(bundle, "chunk-vendor.js"), 'const tokenUrl = "https://oauth2.googleapis.com/token";\n');
+    await write(path.join(bundle, "chunk-shared.js"), 'const fallback = { password: "admin1234" };\n');
+    expect(await new ServerBundleSecrets(root, appDir).assertClean(bundle)).toEqual([]);
+
+    await write(path.join(bundle, "chunk-mail.js"), 'const pass = "main-mail-pass";\n');
+    await expect(new ServerBundleSecrets(root, appDir).assertClean(bundle)).rejects.toThrow(
+      "chunk-mail.js holds apps/demo/env/env.server.main.ts mailer.auth.pass",
+    );
+  });
+
+  test("still refuses a long secret the code holds as well, a webhook and a URL's password", async () => {
+    const { root, appDir, bundle } = await workspace();
+    const hook = "https://hooks.slack.com/services/T0/B0/AbCdEf0123456789XyZ";
+    await write(
+      path.join(appDir, "env/env.server.develop.ts"),
+      `export const env = { slack: { webhookUrl: "${hook}" }, database: { postgres: { url: "postgres://app:pg-pass-0123@db/app" } } };\n`,
+    );
+    await write(
+      path.join(root, "libs/util/srvkit/fallback.ts"),
+      `export const jwt = "lib-jwt-0123456789";\nexport const hook = "${hook}";\n`,
+    );
+    await write(
+      path.join(bundle, "server.js"),
+      `const jwt = "lib-jwt-0123456789"; const hook = "${hook}"; const pg = "postgres://app:" + (process.env.PG ?? "pg-pass-0123") + "@db/app";\n`,
+    );
+    const message = await new ServerBundleSecrets(root, appDir)
+      .assertClean(bundle)
+      .then(() => "")
+      .catch((error: Error) => error.message);
+    expect(message).toContain("server.js holds libs/util/env/env.server.testing.ts security.jwtSecret");
+    expect(message).toContain("server.js holds apps/demo/env/env.server.develop.ts slack.webhookUrl");
+    expect(message).toContain("server.js holds apps/demo/env/env.server.develop.ts database.postgres.url");
+    expect(message).toContain(
+      "A value a profile build still holds sits in code or a file the server carries: take it out there.",
+    );
+    for (const secret of ["lib-jwt-0123456789", "hooks.slack.com", "pg-pass-0123"])
+      expect(message).not.toContain(secret);
+  });
+
+  test("finds a secret with non-ASCII characters in the bundle Bun printed, and in a file copied as UTF-8", async () => {
+    const { root, appDir, bundle } = await workspace();
+    const secrets = { pass: "pässwörd-ünïcode-1234", apiKey: `비밀 "it's" ${"😀"}-5678` };
+    await write(
+      path.join(appDir, "env/env.server.debug.ts"),
+      `export const env = { mailer: ${JSON.stringify(secrets)} };\n`,
+    );
+    const source = path.join(root, "carried.ts");
+    await write(source, `export const mailer = ${JSON.stringify(secrets)};\n`);
+    const built = await Bun.build({ entrypoints: [source], outdir: bundle, target: "bun", minify: true });
+    expect(built.success).toBe(true);
+    expect(await Bun.file(path.join(bundle, "carried.js")).text()).not.toContain("ä");
+    const message = await new ServerBundleSecrets(root, appDir)
+      .assertClean(bundle)
+      .then(() => "")
+      .catch((error: Error) => error.message);
+    expect(message).toContain("carried.js holds apps/demo/env/env.server.debug.ts mailer.pass");
+    expect(message).toContain("carried.js holds apps/demo/env/env.server.debug.ts mailer.apiKey");
+
+    await Bun.write(path.join(bundle, "carried.js"), "\n");
+    await Bun.write(path.join(bundle, "settings.json"), JSON.stringify({ pass: secrets.pass }));
+    await expect(new ServerBundleSecrets(root, appDir).assertClean(bundle)).rejects.toThrow(
+      "settings.json holds apps/demo/env/env.server.debug.ts mailer.pass",
+    );
+  });
+
   test("names an env file it could not evaluate instead of passing it silently", async () => {
     const { root, appDir, bundle } = await workspace();
     await write(