@akanjs/devkit 3.1.1-rc.7 → 3.1.1-rc.8

package/cloud/cloudApi.ts

@@ -1,4 +1,4 @@
-import { isRecord } from "akanjs/common";
+import { isRecord, Logger } from "akanjs/common";
 import type { Workspace } from "../commandDecorators";
 import { CloudHttpError } from "./cloudHttpError";
 import type { AccessToken, AccessTokenDto, HostConfig } from "./constants";
@@ -123,8 +123,11 @@ export class CloudApi {
     if (error.status === 401)
       return new Error("The server did not accept your sign-in: run `akan login`, then try again.", { cause: error });
     if (error.status === 403) return new Error(`The project refused: ${who}.`, { cause: error });
-    if (error.status === 400)
-      return new Error(`The project refused the request${error.error ? `: ${error.error}` : ""}.`, { cause: error });
+    if (error.status === 400) {
+      const { data } = error;
+      const why = `${error.error ? `: ${error.error}` : ""}${data ? ` ${Logger.inlineData(data)}` : ""}`;
+      return new Error(`The project refused the request${why}.`, { cause: error });
+    }
     //? A proxy, or the gateway with no replica ready, answers 503 too; only the server's own names a domain Err key.
     const { errKey } = error;
     if (error.status === 503 && unavailable && errKey && errKey !== "base.error.serverUnavailable")

package/cloud/cloudHttpError.test.ts

@@ -20,6 +20,14 @@ describe("CloudHttpError", () => {
     expect(plain.errKey).toBeNull();
   });
 
+  test("reads the data a server Err carried, and none from a body without it", () => {
+    const body = JSON.stringify({ error: "release.error.desktopMalformed", data: { reason: "a directory entry" } });
+
+    expect(new CloudHttpError(400, "Bad Request", "/x", body).data).toEqual({ reason: "a directory entry" });
+    expect(new CloudHttpError(400, "Bad Request", "/x", '{"error":"Bad Request","data":"x"}').data).toBeNull();
+    expect(new CloudHttpError(502, "Bad Gateway", "/x", "<html>502</html>").data).toBeNull();
+  });
+
   test("takes Retry-After as seconds or as a date, and nothing else", () => {
     expect(CloudHttpError.retryAfterMs("7")).toBe(7000);
     expect(CloudHttpError.retryAfterMs(new Date(Date.now() + 60_000).toUTCString())).toBeGreaterThan(55_000);

package/cloud/cloudHttpError.ts

@@ -26,9 +26,19 @@ export class CloudHttpError extends Error {
 
   /** The `error` of a JSON refusal: an Err key from the server itself, or whatever a proxy put there. */
   get error(): string | null {
+    const error = this.#payload?.error;
+    return typeof error === "string" ? error : null;
+  }
+
+  get data(): Record<string, unknown> | null {
+    const data = this.#payload?.data;
+    return isRecord(data) ? data : null;
+  }
+
+  get #payload(): Record<string, unknown> | null {
     try {
       const parsed: unknown = JSON.parse(this.body);
-      return isRecord(parsed) && typeof parsed.error === "string" ? parsed.error : null;
+      return isRecord(parsed) ? parsed : null;
     } catch {
       return null;
     }

package/cloud/cloudUpdates.ts

@@ -9,6 +9,7 @@ import { NativeApp } from "../mobile/nativeApp";
 import { NativePublicEnv } from "../mobile/nativePublicEnv";
 import { type NativeUpdatePack, UpdatePackFolder } from "../mobile/updatePackFolder";
 import { type AppBinaryDistribution, CloudApi } from "./cloudApi";
+import { CloudHttpError } from "./cloudHttpError";
 import { UpdatePackUpload } from "./updatePackUpload";
 
 //* A phone app's over-the-air updates through an Akan Cloud project, which keeps the signing key: a pack uploaded for
@@ -61,7 +62,7 @@ export class CloudUpdates {
       const release = await new UpdatePackUpload(this.cloudApi, this.devProjectId)
         .send(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel: target, notes })
         .catch((error: unknown) => {
-          throw CloudApi.refusal(error, "a pack is uploaded by a project member signed in with `akan login`");
+          throw CloudUpdates.#refusal(error, "a pack is uploaded by a project member signed in with `akan login`");
         });
       const label = `${pack.app} ${pack.target} ${pack.platform} on channel ${target}: release ${release.id}`;
       if (release.status === "rejected")
@@ -95,7 +96,7 @@ export class CloudUpdates {
       const record = await new UpdatePackUpload(this.cloudApi, this.devProjectId)
         .send(archive, { appName, target, platform, kind: "app", arch, channel, notes })
         .catch((error: unknown) => {
-          throw CloudApi.refusal(error, "a release is uploaded by a project member signed in with `akan login`");
+          throw CloudUpdates.#refusal(error, "a release is uploaded by a project member signed in with `akan login`");
         });
       const label = `${appName} ${target} ${platform}-${arch} on channel ${channel}: release ${record.id}`;
       const problems = (record.problems ?? []).map((problem) => `  - ${problem}`).join("\n");
@@ -113,6 +114,14 @@ export class CloudUpdates {
     });
   }
 
+  //? A 400 naming a release Err key is the project's verdict on the release, as a rejected one is: a retry changes nothing.
+  static #refusal(error: unknown, who: string) {
+    const refusal = CloudApi.refusal(error, who);
+    const verdict =
+      error instanceof CloudHttpError && error.status === 400 && !!error.errKey?.startsWith("release.error.");
+    return verdict && refusal instanceof Error ? new ExitCodeError(refusal.message, 2) : refusal;
+  }
+
   //? The store build first, then a pack of the same commit: a server that registers the binary checks the pack runs in it.
   async registerBinary(
     app: App,

package/mobile/desktopRelease.test.ts

@@ -88,6 +88,29 @@ const read = (
 const entriesOf = (archive: string) =>
   Bun.spawnSync(["tar", "-tf", archive]).stdout.toString().split(/\r?\n/).filter(Boolean);
 
+//? Every header, a pax one too: a file's name is the `path` of the pax header before it, else its own name field.
+const headersOf = (bytes: Uint8Array) => {
+  const headers: { type: string; name: string; prefix: string; paxKeys: string[] }[] = [];
+  let paxPath: string | null = null;
+  for (let at = 0; at + 512 <= bytes.length; ) {
+    const block = Buffer.from(bytes.subarray(at, at + 512));
+    if (block.every((byte) => byte === 0)) break;
+    const field = (from: number, width: number) => block.toString("latin1", from, from + width).replace(/\0.*$/s, "");
+    const type = field(156, 1);
+    const size = Number.parseInt(field(124, 12), 8);
+    const records = Buffer.from(bytes.subarray(at + 512, at + 512 + size))
+      .toString("utf8")
+      .split("\n")
+      .filter(Boolean);
+    at += 512 + Math.ceil(size / 512) * 512;
+    const pax = type === "x" ? records.map((record) => record.slice(record.indexOf(" ") + 1)) : [];
+    const paxKeys = pax.map((record) => record.slice(0, record.indexOf("=")));
+    headers.push({ type, name: (type === "x" ? null : paxPath) ?? field(0, 100), prefix: field(345, 155), paxKeys });
+    paxPath = type === "x" ? (pax.find((record) => record.startsWith("path="))?.slice(5) ?? null) : null;
+  }
+  return headers;
+};
+
 const extract = async (archive: string) => {
   const out = await makeDir();
   expect(Bun.spawnSync(["tar", "-xf", archive, "-C", out]).exitCode).toBe(0);
@@ -117,6 +140,24 @@ describe("DesktopRelease", () => {
     ]);
   });
 
+  test("keeps the one tar shape Akan Cloud accepts, a pax name of a long patch included", async () => {
+    const published = await publish();
+    const release = await read(published);
+
+    const headers = await release.withArchive(release.record(null), async (archive) =>
+      headersOf(await readFile(archive)),
+    );
+
+    expect(new Set(headers.map(({ type }) => type))).toEqual(new Set(["0", "x"]));
+    expect(headers.filter(({ prefix }) => prefix)).toEqual([]);
+    expect(headers.filter(({ type }) => type === "x").map(({ paxKeys }) => paxKeys)).toEqual([["path"]]);
+    const files = headers.filter(({ type }) => type === "0").map(({ name }) => name);
+    expect(files.slice(0, 3)).toEqual(["./release.json", "./main.json", "./main.json.sig"]);
+    expect(files.slice(3).every((name) => name.startsWith("./app/"))).toBe(true);
+    expect(files.slice(3)).toEqual([`./app/${published.tarSha}.tar.gz`, `./app/${published.delta}`]);
+    expect(Buffer.byteLength(`./app/${published.delta}`)).toBeGreaterThan(100);
+  });
+
   test("the manifest and its signature go in byte for byte, beside a release.json of the CLI and the build time", async () => {
     const published = await publish();
     const release = await read(published);

package/mobile/desktopRelease.ts

@@ -129,8 +129,9 @@ Set-Content -LiteralPath $env:AKAN_SIGNER_OUT -Value $subject -Encoding UTF8`;
     return { schema: 1, cli: AkanAppConfig.akanVersion, platform, arch, channel, signer, builtAt };
   }
 
-  //* Uncompressed, regular files only under `./` names, no directory entries; what the manifest names is checked
-  //* against it while it is copied, so the archive holds the bytes the manifest signs for.
+  //* Akan Cloud refuses every push in any other shape: uncompressed, regular files under `./` names, no directory
+  //* entry, no ustar prefix, no GNU L/K, a pax 'x' holding `path` alone, and release.json and the manifest pair before
+  //* any `app/` entry. What the manifest names is checked against it as it is copied.
   async withArchive<T>(record: DesktopReleaseRecord, use: (archive: string) => Promise<T>): Promise<T> {
     const tmp = await mkdtemp(path.join(os.tmpdir(), "akan-release-"));
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.1.1-rc.7",
+  "version": "3.1.1-rc.8",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -48,7 +48,7 @@
     "@earendil-works/pi-tui": "1.3.0",
     "@inquirer/prompts": "^8.7.3",
     "@tailwindcss/node": "^4.3.3",
-    "akanjs": "3.1.1-rc.7",
+    "akanjs": "3.1.1-rc.8",
     "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "dayjs": "^1.11.23",