@akanjs/devkit 3.1.0-rc.1 → 3.1.0-rc.2

package/mobile/serverBundleSecrets.ts

@@ -8,21 +8,20 @@ interface SecretValue {
   value: string;
 }
 
-//* A signed app leaves the building, and a notarized one goes to Apple first: before either, every secret value the
-//* workspace's server env files hold is looked for in the server the app carries, whatever put it there.
+//* A release leaves the building, signed or not, and an update goes to a feed anyone reads: before either, every secret
+//* value the workspace's server env files hold is looked for in the server the app carries, whatever put it there.
 export class ServerBundleSecrets {
   static readonly #largestFile = 64 * 1024 * 1024;
+  static readonly #printer = new Bun.Transpiler({ loader: "js", target: "bun" });
+  static readonly #notSource = new Set(["node_modules", "env", "private", "public", "dist"]);
 
   constructor(
     readonly workspaceRoot: string,
     readonly appDir: string,
   ) {}
 
-  /** The app's `env/env.server.<name>.ts` and every lib's, but the type and example files. */
   async envFiles(): Promise<string[]> {
-    const libsDir = path.join(this.workspaceRoot, "libs");
-    const libs = await readdir(libsDir).catch(() => [] as string[]);
-    const dirs = [path.join(this.appDir, "env"), ...libs.map((lib) => path.join(libsDir, lib, "env"))];
+    const dirs = [path.join(this.appDir, "env"), ...(await this.#libDirs()).map((lib) => path.join(lib, "env"))];
     const files = await Promise.all(
       dirs.map(async (dir) =>
         (await readdir(dir).catch(() => [] as string[]))
@@ -45,27 +44,59 @@ export class ServerBundleSecrets {
         unread.push(ServerBundleSecrets.#relative(this.workspaceRoot, file));
       }
     }
-    const found: string[] = [];
+    if (!secrets.length) return unread;
+    const sought = secrets.map((secret) => ({ secret, needles: ServerBundleSecrets.#needles(secret.value) }));
+    const found: { bundled: string; secret: SecretValue }[] = [];
     for (const bundled of await ServerBundleSecrets.#files(bundleDir)) {
       const text = await readFile(bundled, "latin1");
-      for (const secret of secrets)
-        if (ServerBundleSecrets.#needles(secret.value).some((needle) => text.includes(needle)))
-          found.push(
-            `${ServerBundleSecrets.#relative(bundleDir, bundled)} holds ${ServerBundleSecrets.#relative(this.workspaceRoot, secret.file)} ${secret.path}`,
-          );
+      for (const { secret, needles } of sought)
+        if (needles.some((needle) => text.includes(needle))) found.push({ bundled, secret });
     }
-    if (found.length)
+    const coded = found.length ? await this.#coded(found.map(({ secret }) => secret.value)) : new Set<string>();
+    const leaks = found
+      .filter(({ secret }) => !coded.has(secret.value))
+      .map(
+        ({ bundled, secret }) =>
+          `${ServerBundleSecrets.#relative(bundleDir, bundled)} holds ${ServerBundleSecrets.#relative(this.workspaceRoot, secret.file)} ${secret.path}`,
+      );
+    if (leaks.length)
       throw new Error(
-        `The server this app carries holds secret values from the workspace's env files, so it is not signed or sent anywhere:\n  ${[...new Set(found)].join("\n  ")}\nBuild its server with a profile (native.desktop.server.profile), whose bundle carries no secret.`,
+        `The server this app carries holds secret values of the workspace's env files, so the release stops here:\n  ${[...new Set(leaks)].join("\n  ")}\nBuild its server with a profile (native.desktop.server.profile), whose bundle leaves the env files' secrets out. A value a profile build still holds sits in code or a file the server carries: take it out there.`,
       );
     return unread;
   }
 
-  //? A multi-line key sits in a bundle as a JS string, escaped; one long line of it is enough to recognise.
+  //? A short or plain value the app's or a lib's own code holds as well (a default password) is that code's, which
+  //? the bundle carries with or without the env file; a long mixed one is a secret copied into the code.
+  async #coded(values: string[]): Promise<Set<string>> {
+    const plain = [...new Set(values)].filter((value) => !ServerEnvProfile.distinctive(value));
+    const coded = new Set<string>();
+    if (!plain.length) return coded;
+    for (const dir of [this.appDir, ...(await this.#libDirs())])
+      for (const file of await ServerBundleSecrets.#sources(dir)) {
+        const text = await readFile(file, "utf8");
+        for (const value of plain) if (text.includes(value)) coded.add(value);
+      }
+    return coded;
+  }
+
+  async #libDirs() {
+    const libsDir = path.join(this.workspaceRoot, "libs");
+    return (await readdir(libsDir).catch(() => [] as string[])).map((lib) => path.join(libsDir, lib));
+  }
+
+  //? A multi-line key sits in a bundle as a JS string, escaped; one long line of it is enough to recognise. Bun prints
+  //? a string's non-ASCII characters as `\xNN` / `\uNNNN`, and the bundle is read byte for byte, so as UTF-8.
   static #needles(value: string): string[] {
     const escaped = JSON.stringify(value).slice(1, -1);
     const line = value.split(/\r?\n/).find((part) => part.length >= 32);
-    return [...new Set([value, escaped, ...(line ? [line] : [])])];
+    const forms = [value, escaped, ServerBundleSecrets.#printed(value), ...(line ? [line] : [])];
+    return [...new Set(forms.map((form) => Buffer.from(form, "utf8").toString("latin1")))];
+  }
+
+  static #printed(value: string) {
+    const code = ServerBundleSecrets.#printer.transformSync(`export default ${JSON.stringify(value)};`);
+    return /^export default (["'`])([\s\S]*)\1;?\s*$/.exec(code)?.[2] ?? value;
   }
 
   static #relative(from: string, to: string) {
@@ -82,4 +113,17 @@ export class ServerBundleSecrets {
     }
     return files;
   }
+
+  static async #sources(dir: string): Promise<string[]> {
+    const files: string[] = [];
+    for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+      if (entry.name.startsWith(".")) continue;
+      const file = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!ServerBundleSecrets.#notSource.has(entry.name)) files.push(...(await ServerBundleSecrets.#sources(file)));
+      } else if (/\.(?:[cm]?[jt]sx?|json)$/.test(entry.name) && !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(entry.name))
+        files.push(file);
+    }
+    return files;
+  }
 }

package/mobile/updatePackFolder.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import { tempDirs, writeText } from "../testHelpers";
+import { UpdatePackFolder } from "./updatePackFolder";
+
+const makeTempRoot = tempDirs("akan-update-pack-");
+
+describe("a pack read back from its folder", () => {
+  test("takes the folder as the pack's place, and refuses what is not a takeable pack", async () => {
+    const root = await makeTempRoot();
+    const pack = {
+      schema: 1,
+      app: "lu",
+      target: "default",
+      platform: "android",
+      env: "main",
+      channel: "main",
+      appId: "com.lu",
+      appVersion: "1.0.0",
+      nativeApi: "0123456789abcdef",
+      webHash: "f".repeat(64),
+      files: 1,
+      size: 13,
+      out: "/elsewhere/updates/android",
+    };
+    const moved = path.join(root, "moved");
+    await writeText(path.join(moved, "pack.json"), JSON.stringify(pack));
+    expect(await UpdatePackFolder.read(moved)).toEqual({ ...pack, out: moved } as never);
+
+    await expect(UpdatePackFolder.read(path.join(root, "empty"))).rejects.toThrow("holds no pack.json");
+    const later = path.join(root, "later");
+    await writeText(path.join(later, "pack.json"), JSON.stringify({ ...pack, schema: 2 }));
+    await expect(UpdatePackFolder.read(later)).rejects.toThrow("schema 2");
+    const refused = path.join(root, "refused");
+    const compat = { against: "store/bundle.json", compatible: false, problems: ["deepLinks differ"] };
+    await writeText(path.join(refused, "pack.json"), JSON.stringify({ ...pack, compat }));
+    expect((await UpdatePackFolder.read(refused)).compat).toEqual(compat);
+  });
+
+  test("is written without the folder it was packed to, which holds this machine's paths", async () => {
+    const out = path.join(await makeTempRoot(), "updates", "android");
+    const pack = { schema: 1, app: "lu", target: "default", platform: "android", files: 1, out } as const;
+
+    await UpdatePackFolder.write(pack as never);
+
+    const written = await Bun.file(path.join(out, "pack.json")).text();
+    expect(written).not.toContain(out);
+    expect(JSON.parse(written)).toEqual({ schema: 1, app: "lu", target: "default", platform: "android", files: 1 });
+    expect((await UpdatePackFolder.read(out)).out).toBe(out);
+  });
+});
+
+describe("a pack's verdict on the store build it was compared with", () => {
+  test("is none without a comparison or for one it runs in, and exit 2 with what differs otherwise", () => {
+    const out = "/work/updates/android";
+    expect(UpdatePackFolder.storeBuildVerdict({ out })).toBeNull();
+    const against = "store/bundle.json";
+    expect(UpdatePackFolder.storeBuildVerdict({ out, compat: { against, compatible: true, problems: [] } })).toBeNull();
+
+    const verdict = UpdatePackFolder.storeBuildVerdict(
+      { out, compat: { against, compatible: false, problems: ["deepLinks differ", "camera added"] } },
+      "Run `akan release-android lu`, then register that build.",
+    );
+    expect(verdict?.exitCode).toBe(2);
+    expect(verdict?.message).toBe(
+      `The pack in ${out} needs a new store build; it differs from the one ${against} came from:\n- deepLinks differ\n- camera added\nRun \`akan release-android lu\`, then register that build.`,
+    );
+  });
+});
+
+describe("a pack's archive", () => {
+  test("holds the files its template lists and the records there, never another pack's files", async () => {
+    const out = path.join(await makeTempRoot(), "updates", "android");
+    const listed = "a".repeat(64);
+    await writeText(path.join(out, "manifest.template.json"), JSON.stringify({ files: [{ sha256: listed }] }));
+    await writeText(path.join(out, "bundle.json"), "{}");
+    await writeText(path.join(out, "pack.json"), "{}");
+    await writeText(path.join(out, "files", listed), "listed");
+    await writeText(path.join(out, "files", "b".repeat(64)), "an earlier pack's");
+
+    const entries = await UpdatePackFolder.withArchive({ out } as never, async (archive) =>
+      Bun.spawnSync(["tar", "-tzf", archive]).stdout.toString().split(/\r?\n/).filter(Boolean).sort(),
+    );
+
+    expect(entries).toEqual(["./bundle.json", `./files/${listed}`, "./manifest.template.json", "./pack.json"]);
+  });
+
+  test("refuses a template that names a file by anything but its sha256", async () => {
+    const out = path.join(await makeTempRoot(), "pack");
+    await writeText(path.join(out, "manifest.template.json"), JSON.stringify({ files: [{ sha256: "../pack.json" }] }));
+    await expect(UpdatePackFolder.withArchive({ out } as never, async () => null)).rejects.toThrow(
+      "lists a file whose sha256 is not 64 hex digits",
+    );
+    await expect(
+      UpdatePackFolder.withArchive({ out: path.join(out, "none") } as never, async () => null),
+    ).rejects.toThrow("holds no manifest.template.json");
+  });
+});

package/mobile/updatePackFolder.ts

@@ -0,0 +1,131 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { BundleInfo, UpdateManifest } from "@akanjs/native/api";
+import type { NativeEnv } from "akanjs";
+import { ExitCodeError } from "../commandDecorators/exitCodeError";
+import type { MobilePlatform } from "./mobileTarget";
+
+export interface NativeUpdatePackCompat {
+  /** The store build's bundle.json the pack was compared with. */
+  against: string;
+  compatible: boolean;
+  problems: string[];
+}
+
+/** `<out>/pack.json`: what a signer needs of a pack, read instead of the log. */
+export interface NativeUpdatePack {
+  schema: 1;
+  app: string;
+  target: string;
+  platform: MobilePlatform;
+  env: NativeEnv;
+  channel: string;
+  appId: string;
+  appVersion: string;
+  nativeApi: string;
+  /** bundle.json `web.hash`: the web files as served, the part of a bundle id that names its content. */
+  webHash: string;
+  /** bundle.json `web.publicEnvHash`: the AKAN_PUBLIC_* the page inlined, which the store build must share. */
+  publicEnvHash?: string;
+  files: number;
+  size: number;
+  /** The folder it was read from or packed to; pack.json leaves it out. */
+  out: string;
+  compat?: NativeUpdatePackCompat;
+}
+
+//* The folder `akan pack-update` writes for a signer or Akan Cloud: the native build API writes `files/<sha256>`,
+//* bundle.json and manifest.template.json, and akan writes pack.json and compat.json beside them.
+export class UpdatePackFolder {
+  static readonly packFile = "pack.json";
+  static readonly compatFile = "compat.json";
+  static readonly bundleFile = "bundle.json";
+  static readonly templateFile = "manifest.template.json";
+  static readonly filesDir = "files";
+  static readonly #records = [
+    UpdatePackFolder.templateFile,
+    UpdatePackFolder.bundleFile,
+    UpdatePackFolder.packFile,
+    UpdatePackFolder.compatFile,
+  ];
+  static readonly #sha256 = /^[0-9a-f]{64}$/;
+
+  /** akan's own records: a pack that fails must not leave the previous pack's behind for whoever reads the exit code. */
+  static async clear(dir: string) {
+    await Promise.all(
+      [UpdatePackFolder.packFile, UpdatePackFolder.compatFile].map((name) => rm(path.join(dir, name), { force: true })),
+    );
+  }
+
+  /** A pack read back from its folder wherever it was moved. */
+  static async read(dir: string): Promise<NativeUpdatePack> {
+    const file = Bun.file(path.join(dir, UpdatePackFolder.packFile));
+    if (!(await file.exists()))
+      throw new Error(`${dir} holds no ${UpdatePackFolder.packFile}: give the folder \`akan pack-update\` wrote.`);
+    const pack = (await file.json()) as NativeUpdatePack;
+    if (pack.schema !== 1)
+      throw new Error(`${dir}/${UpdatePackFolder.packFile} is schema ${pack.schema}, and this akan reads schema 1.`);
+    return { ...pack, out: path.resolve(dir) };
+  }
+
+  //? Without `out`: the record travels in the pack's archive, and the folder is wherever it is read from.
+  static async write({ out, ...record }: NativeUpdatePack) {
+    await Bun.write(path.join(out, UpdatePackFolder.packFile), `${JSON.stringify(record, null, 2)}\n`);
+  }
+
+  static async writeCompat(pack: NativeUpdatePack, compat: NativeUpdatePackCompat) {
+    pack.compat = compat;
+    await Bun.write(path.join(pack.out, UpdatePackFolder.compatFile), `${JSON.stringify(compat, null, 2)}\n`);
+  }
+
+  /** The bundle.json a store build and a pack both carry. */
+  static async readBundle(file: string): Promise<BundleInfo> {
+    return (await Bun.file(file).json()) as BundleInfo;
+  }
+
+  //* Exit 2, not a thrown 1: a CI tells "this needs a new store build" apart from a pack that broke.
+  static storeBuildVerdict({ out, compat }: Pick<NativeUpdatePack, "out" | "compat">, then?: string) {
+    if (!compat || compat.compatible) return null;
+    return new ExitCodeError(
+      `The pack in ${out} needs a new store build; it differs from the one ${compat.against} came from:\n- ${compat.problems.join("\n- ")}${then ? `\n${then}` : ""}`,
+      2,
+    );
+  }
+
+  /** The pack as the tgz Akan Cloud takes: the files its manifest template lists, and the records beside them. */
+  static async withArchive<T>(pack: NativeUpdatePack, use: (archive: string) => Promise<T>): Promise<T> {
+    const { templateFile, filesDir } = UpdatePackFolder;
+    const template = Bun.file(path.join(pack.out, templateFile));
+    if (!(await template.exists()))
+      throw new Error(`${pack.out} holds no ${templateFile}: give the folder \`akan pack-update\` wrote.`);
+    const { files = [] } = (await template.json()) as Partial<UpdateManifest>;
+    const hashes = [...new Set(files.map((file) => file.sha256 as unknown))];
+    if (!hashes.every((hash): hash is string => typeof hash === "string" && UpdatePackFolder.#sha256.test(hash)))
+      throw new Error(`${pack.out}/${templateFile} lists a file whose sha256 is not 64 hex digits.`);
+    const present = await Promise.all(
+      UpdatePackFolder.#records.map((name) => Bun.file(path.join(pack.out, name)).exists()),
+    );
+    const entries = [
+      ...UpdatePackFolder.#records.filter((_, idx) => present[idx]),
+      ...hashes.map((hash) => `${filesDir}/${hash}`),
+    ];
+    const dir = await mkdtemp(path.join(os.tmpdir(), "akan-pack-"));
+    try {
+      //? files/ keeps every earlier pack's files (content-addressed), so the folder itself is not the pack; the names
+      //? go on stdin, not argv, because a Windows command line holds 32 KiB.
+      // A relative archive name, so GNU tar never reads a Windows drive letter (`C:\…`) as a remote `host:file` spec.
+      const tar = Bun.spawn(["tar", "-czf", "pack.tgz", "-C", pack.out, "-T", "-"], {
+        cwd: dir,
+        stdin: new Blob([entries.map((entry) => `./${entry}\n`).join("")]),
+        stdout: "ignore",
+        stderr: "pipe",
+      });
+      const [code, stderr] = await Promise.all([tar.exited, new Response(tar.stderr).text()]);
+      if (code !== 0) throw new Error(`tar of ${pack.out} failed: ${stderr.trim()}`);
+      return await use(path.join(dir, "pack.tgz"));
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  }
+}

package/mobile/updateUploader.test.ts

@@ -16,34 +16,126 @@ const fakeBucket = (held: string[] = []) => {
   return { bucket, writes };
 };
 
+const sha = (char: string) => char.repeat(64);
+
+const inUpdatesDir = async (files: Record<string, string>, run: (updatesDir: string) => Promise<void>) => {
+  const updatesDir = await mkdtemp(path.join(tmpdir(), "akan-update-upload-"));
+  try {
+    for (const [file, content] of Object.entries(files)) {
+      await mkdir(path.dirname(path.join(updatesDir, file)), { recursive: true });
+      await writeFile(path.join(updatesDir, file), content);
+    }
+    await run(updatesDir);
+  } finally {
+    await rm(updatesDir, { recursive: true, force: true });
+  }
+};
+
+const envelope = (manifest: object) =>
+  JSON.stringify({
+    manifest: Buffer.from(JSON.stringify(manifest)).toString("base64"),
+    keyId: "0011223344556677",
+    signature: "c2lnbmF0dXJl",
+  });
+
 describe("UpdateUploader", () => {
   test("reads s3://bucket/prefix and refuses anything else", () => {
-    expect(UpdateUploader.parseTarget("s3://releases/dcms/kiosk/")).toEqual({
+    expect(UpdateUploader.parseTarget("s3://releases/acme/kiosk/")).toEqual({
       bucket: "releases",
-      prefix: "dcms/kiosk",
+      prefix: "acme/kiosk",
     });
     expect(UpdateUploader.parseTarget("s3://releases")).toEqual({ bucket: "releases", prefix: "" });
-    expect(() => UpdateUploader.parseTarget("https://releases.example/dcms")).toThrow("s3://<bucket>/<prefix>");
+    expect(() => UpdateUploader.parseTarget("https://releases.example/acme")).toThrow("s3://<bucket>/<prefix>");
   });
 
-  test("uploads what the bucket lacks first, then each signature before its manifest", async () => {
-    const dir = await mkdtemp(path.join(tmpdir(), "akan-update-upload-"));
-    try {
-      await mkdir(path.join(dir, "windows-x64", "files"), { recursive: true });
-      for (const file of ["windows-x64/files/2000-aa.tar.gz", "windows-x64/files/1000-bb.tar.gz"])
-        await writeFile(path.join(dir, file), "tar");
-      for (const file of ["windows-x64/main.json", "windows-x64/main.json.sig", "windows-x64/main.json.tmp"])
-        await writeFile(path.join(dir, file), "{}");
-      const { bucket, writes } = fakeBucket(["dcms/windows-x64/files/1000-bb.tar.gz"]);
-
-      expect(await new UpdateUploader(bucket, "dcms").upload(dir)).toEqual({ uploaded: 3, skipped: 1 });
-      expect(writes).toEqual([
-        { key: "dcms/windows-x64/files/2000-aa.tar.gz" },
-        { key: "dcms/windows-x64/main.json.sig", type: "text/plain" },
-        { key: "dcms/windows-x64/main.json", type: "application/json" },
-      ]);
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
+  test("uploads a desktop release's archives the bucket lacks first, then the signature before the manifest", async () => {
+    const manifest = {
+      bundle: "1.2.0-2000",
+      archive: { url: `app/${sha("b")}.tar.gz` },
+      patches: [{ url: `app/${sha("a")}-${sha("b")}.delta.gz` }],
+    };
+    await inUpdatesDir(
+      {
+        [`windows-x64/app/${sha("a")}.tar.gz`]: "previous release",
+        [`windows-x64/app/${sha("b")}.tar.gz`]: "tar",
+        [`windows-x64/app/${sha("a")}-${sha("b")}.delta.gz`]: "delta",
+        "windows-x64/main.json": JSON.stringify(manifest),
+        "windows-x64/main.json.sig": "sig",
+        "windows-x64/main.json.tmp": "{}",
+        "windows-x64/develop.json": JSON.stringify({ ...manifest, bundle: "1.1.0-1000" }),
+        "windows-x64/develop.json.sig": "sig",
+      },
+      async (updatesDir) => {
+        const { bucket, writes } = fakeBucket([`acme/windows-x64/app/${sha("a")}-${sha("b")}.delta.gz`]);
+        const release = { dir: path.join(updatesDir, "windows-x64"), channel: "main", bundle: "1.2.0-2000" };
+
+        expect(await new UpdateUploader(bucket, "acme").upload(updatesDir, release)).toEqual({
+          uploaded: 3,
+          skipped: 1,
+        });
+        expect(writes).toEqual([
+          { key: `acme/windows-x64/app/${sha("b")}.tar.gz` },
+          { key: "acme/windows-x64/main.json.sig", type: "text/plain" },
+          { key: "acme/windows-x64/main.json", type: "application/json" },
+        ]);
+      },
+    );
+  });
+
+  test("uploads a phone release's own files and envelope, never pack records or another manifest beside them", async () => {
+    await inUpdatesDir(
+      {
+        "android/pack.json": JSON.stringify({ out: "/Users/someone/work/dist/native/demo/default/updates/android" }),
+        "android/manifest.template.json": "{}",
+        "android/bundle.json": "{}",
+        "android/compat.json": "{}",
+        [`android/files/${sha("a")}`]: "index.html",
+        [`android/files/${sha("b")}`]: "env.runtime.json",
+        [`android/files/${sha("c")}`]: "an earlier pack's file",
+        "android/main/api2.json": envelope({
+          bundle: "3000-aaaaaaaa",
+          files: [{ sha256: sha("a") }, { sha256: sha("b") }, { sha256: sha("a") }],
+        }),
+        "android/main/api1.json": envelope({ bundle: "1000-cccccccc", files: [{ sha256: sha("c") }] }),
+        "android/develop/api2.json": envelope({ bundle: "2000-bbbbbbbb", files: [{ sha256: sha("b") }] }),
+      },
+      async (updatesDir) => {
+        const { bucket, writes } = fakeBucket();
+        const release = { dir: path.join(updatesDir, "android"), channel: "main", bundle: "3000-aaaaaaaa" };
+
+        expect(await new UpdateUploader(bucket, "").upload(updatesDir, release)).toEqual({ uploaded: 3, skipped: 0 });
+        expect(writes).toEqual([
+          { key: `android/files/${sha("a")}` },
+          { key: `android/files/${sha("b")}` },
+          { key: "android/main/api2.json", type: "application/json" },
+        ]);
+      },
+    );
+  });
+
+  test("uploads nothing when the release is not there or names a file outside its folder", async () => {
+    await inUpdatesDir(
+      {
+        "linux-x64/main.json": JSON.stringify({ bundle: "1.0.0-10", archive: { url: "../../.ssh/id_ed25519" } }),
+        "linux-x64/main.json.sig": "sig",
+        "ios/main/api1.json": envelope({ bundle: "10-aaaaaaaa", files: [{ sha256: "../pack.json" }] }),
+      },
+      async (updatesDir) => {
+        const { bucket, writes } = fakeBucket();
+        const uploader = new UpdateUploader(bucket, "acme");
+        const linux = path.join(updatesDir, "linux-x64");
+
+        await expect(uploader.upload(updatesDir, { dir: linux, channel: "main", bundle: "1.0.0-9" })).rejects.toThrow(
+          "holds no main manifest of release 1.0.0-9",
+        );
+        await expect(uploader.upload(updatesDir, { dir: linux, channel: "main", bundle: "1.0.0-10" })).rejects.toThrow(
+          "which is not inside that folder",
+        );
+        await expect(
+          uploader.upload(updatesDir, { dir: path.join(updatesDir, "ios"), channel: "main", bundle: "10-aaaaaaaa" }),
+        ).rejects.toThrow("not 64 hex digits");
+        expect(writes).toEqual([]);
+      },
+    );
   });
 });

package/mobile/updateUploader.ts

@@ -1,4 +1,8 @@
+import { readdir } from "node:fs/promises";
 import path from "node:path";
+import type { UpdateEnvelope, UpdateManifest } from "@akanjs/native/api";
+import { isRecord } from "akanjs/common";
+import { UpdatePackFolder } from "./updatePackFolder";
 
 /** What the uploader needs of an S3 client; Bun.S3Client is one. */
 export interface UpdateBucket {
@@ -11,6 +15,15 @@ export interface UpdateUploadResult {
   skipped: number;
 }
 
+/** The release one `publish-update` wrote, as it reports it. */
+export interface PublishedUpdate {
+  /** `<updates>/<os>-<arch>` for a desktop app, `<updates>/<platform>` for a phone's web bundle. */
+  dir: string;
+  channel: string;
+  /** Its manifest's `bundle`, which tells it from the other manifests of the channel there. */
+  bundle: string;
+}
+
 //* A manifest names files that must already be there, so they go first and the manifests last, each signature before
 //* its manifest as `publish-update` writes them. A release file never changes once published (its name carries its
 //* hash), so one the bucket holds is skipped; a manifest is always written.
@@ -34,6 +47,64 @@ export class UpdateUploader {
     };
   }
 
+  //* Never the whole folder: pack-update's records sit there too, and so do manifests of other channels and native
+  //* APIs, which a later publish from another machine may have replaced.
+  static async releaseFiles(updatesDir: string, { dir, channel, bundle }: PublishedUpdate): Promise<string[]> {
+    const keyOf = (file: unknown) => UpdateUploader.#keyOf(updatesDir, dir, file);
+    const desktop = await UpdateUploader.#read<UpdateManifest>(path.join(dir, `${channel}.json`));
+    if (desktop?.bundle === bundle) {
+      const archive = desktop.archive?.url;
+      const patches = UpdateUploader.#field(desktop.patches, "url");
+      return [archive, ...patches, `${channel}.json.sig`, `${channel}.json`].map(keyOf);
+    }
+    const names = await readdir(path.join(dir, channel)).catch(() => [] as string[]);
+    for (const name of names.filter((name) => name.endsWith(".json"))) {
+      const envelope = await UpdateUploader.#read<UpdateEnvelope>(path.join(dir, channel, name));
+      const manifest =
+        typeof envelope?.manifest === "string"
+          ? UpdateUploader.#parse<UpdateManifest>(Buffer.from(envelope.manifest, "base64").toString("utf8"))
+          : null;
+      if (manifest?.bundle !== bundle) continue;
+      const hashes = [...new Set(UpdateUploader.#field(manifest.files, "sha256"))];
+      if (!hashes.every((hash): hash is string => typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash)))
+        throw new Error(
+          `${path.join(dir, channel, name)} lists a file whose sha256 is not 64 hex digits; nothing was uploaded.`,
+        );
+      return [...hashes.map((hash) => `${UpdatePackFolder.filesDir}/${hash}`), `${channel}/${name}`].map(keyOf);
+    }
+    throw new Error(`${dir} holds no ${channel} manifest of release ${bundle}; nothing was uploaded.`);
+  }
+
+  static #keyOf(updatesDir: string, dir: string, file: unknown) {
+    const resolved = typeof file === "string" ? path.resolve(dir, file) : "";
+    const key = path.relative(updatesDir, resolved);
+    if (!resolved.startsWith(`${path.resolve(dir)}${path.sep}`) || key.startsWith("..") || path.isAbsolute(key))
+      throw new Error(
+        `The release in ${dir} names ${typeof file === "string" ? JSON.stringify(file) : "a file with no path"}, which is not inside that folder; nothing was uploaded.`,
+      );
+    return key.split(path.sep).join("/");
+  }
+
+  static #field(list: unknown, key: string): unknown[] {
+    return Array.isArray(list) ? list.map((item) => (isRecord(item) ? item[key] : undefined)) : [];
+  }
+
+  static async #read<T>(file: string) {
+    const text = await Bun.file(file)
+      .text()
+      .catch(() => "");
+    return UpdateUploader.#parse<T>(text);
+  }
+
+  static #parse<T>(text: string): Partial<T> | null {
+    try {
+      const value: unknown = JSON.parse(text);
+      return isRecord(value) ? (value as Partial<T>) : null;
+    } catch {
+      return null;
+    }
+  }
+
   constructor(
     readonly bucket: UpdateBucket,
     readonly prefix: string,
@@ -44,12 +115,8 @@ export class UpdateUploader {
     return new UpdateUploader(new Bun.S3Client({ bucket }), prefix);
   }
 
-  async upload(dir: string): Promise<UpdateUploadResult> {
-    const files: string[] = [];
-    for await (const file of new Bun.Glob("**/*").scan({ cwd: dir, onlyFiles: true })) {
-      if (!file.endsWith(".tmp")) files.push(file.split(path.sep).join("/"));
-    }
-    const { releases, manifests } = UpdateUploader.order(files);
+  async upload(updatesDir: string, release: PublishedUpdate): Promise<UpdateUploadResult> {
+    const { releases, manifests } = UpdateUploader.order(await UpdateUploader.releaseFiles(updatesDir, release));
     const keyOf = (file: string) => (this.prefix ? `${this.prefix}/${file}` : file);
     let uploaded = 0;
     let skipped = 0;
@@ -58,12 +125,12 @@ export class UpdateUploader {
         skipped++;
         continue;
       }
-      await this.bucket.write(keyOf(file), Bun.file(path.join(dir, file)));
+      await this.bucket.write(keyOf(file), Bun.file(path.join(updatesDir, file)));
       uploaded++;
     }
     for (const file of manifests) {
       const type = file.endsWith(".json") ? "application/json" : "text/plain";
-      await this.bucket.write(keyOf(file), Bun.file(path.join(dir, file)), { type });
+      await this.bucket.write(keyOf(file), Bun.file(path.join(updatesDir, file)), { type });
       uploaded++;
     }
     return { uploaded, skipped };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.1.0-rc.1",
+  "version": "3.1.0-rc.2",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -48,7 +48,7 @@
     "@earendil-works/pi-tui": "0.86.1",
     "@inquirer/prompts": "^8.4.3",
     "@tailwindcss/node": "^4.3.0",
-    "akanjs": "3.1.0-rc.1",
+    "akanjs": "3.1.0-rc.2",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",