akanjs 3.0.2 → 3.1.0-rc.0

package/vendor/@akanjs/native/native/ios/Sources/AkanNativeUpdates.swift

@@ -1,13 +1,13 @@
-// Web bundle updates (UP-2): which bundle the shell serves, and the trial / confirm / rollback
+// Web bundle updates (UP-2, protocol v2): which bundle the shell serves, and the trial / confirm / rollback
 // state. @akanjs/native/plugins/updates downloads and verifies bundles and calls stage/apply/confirm; the
 // shell picks the bundle at launch (`launch`) and rolls back a trial that never confirms.
 //
-// Layout: Library/Application Support/akan-native-updates/{state.json, bundles/<bundle>/{…, manifest.json,
-// manifest.json.sig}} (the filesystem plugin's `data` is Application Support/files). A bundle is
-// served only while its signed manifest still verifies and its files are all there with their
-// sizes (checked at every launch).
-// state.json: { current?, pending?, trial?, failed: [bundle], rolledBack? } with entries
-// { bundle, sequence, nativeApi, attempts? }.
+// Layout: Library/Application Support/akan-native-updates/{state.json, bundles/<bundle>/{…, manifest.signed.json}}
+// (the filesystem plugin's `data` is Application Support/files). A bundle is served only while its envelope still
+// verifies under a key of updates.publicKeys that is not revoked, and its files are all there with their sizes
+// (checked at every launch).
+// state.json: { current?, pending?, trial?, failed: [bundle], rolledBack?, revokedKeys: [keyId] } with entries
+// { bundle, sequence, nativeApi, keyId, attempts? }. revokedKeys outlive reset(): a revocation is for good.
 // - A downloaded bundle is `pending`. At the next launch (or apply()) it becomes `trial` with one
 //   attempt. notifyReady() makes the trial `current`. A trial that is launched again without
 //   having confirmed (it crashed or hung) is marked failed and the previous bundle serves.
@@ -27,22 +27,26 @@ struct AkanNativeUpdateEntry: Equatable, Sendable {
     var bundle: String
     var sequence: Double
     var nativeApi: String
+    /// The key whose envelope the bundle came in.
+    var keyId: String
     var attempts: Int = 0
 
-    init(bundle: String, sequence: Double, nativeApi: String, attempts: Int = 0) {
+    init(bundle: String, sequence: Double, nativeApi: String, keyId: String, attempts: Int = 0) {
         self.bundle = bundle
         self.sequence = sequence
         self.nativeApi = nativeApi
+        self.keyId = keyId
         self.attempts = attempts
     }
 
     init?(_ json: Any?) {
         guard let o = json as? [String: Any], let bundle = o["bundle"] as? String, AkanNativeUpdates.isBundleId(bundle),
-              let sequence = (o["sequence"] as? NSNumber)?.doubleValue, let nativeApi = o["nativeApi"] as? String else { return nil }
-        self.init(bundle: bundle, sequence: sequence, nativeApi: nativeApi, attempts: (o["attempts"] as? NSNumber)?.intValue ?? 0)
+              let sequence = (o["sequence"] as? NSNumber)?.doubleValue, let nativeApi = o["nativeApi"] as? String,
+              let keyId = o["keyId"] as? String, AkanNativeKernel.isUpdateKeyId(keyId) else { return nil }
+        self.init(bundle: bundle, sequence: sequence, nativeApi: nativeApi, keyId: keyId, attempts: (o["attempts"] as? NSNumber)?.intValue ?? 0)
     }
 
-    var json: [String: Any] { ["bundle": bundle, "sequence": sequence, "nativeApi": nativeApi, "attempts": attempts] }
+    var json: [String: Any] { ["bundle": bundle, "sequence": sequence, "nativeApi": nativeApi, "keyId": keyId, "attempts": attempts] }
 }
 
 struct AkanNativeUpdateState: Sendable {
@@ -51,8 +55,11 @@ struct AkanNativeUpdateState: Sendable {
     var trial: AkanNativeUpdateEntry?
     var failed: [String] = []
     var rolledBack: String?
+    var revokedKeys: [String] = []
 
-    init() {}
+    init(revokedKeys: [String] = []) {
+        self.revokedKeys = revokedKeys
+    }
 
     init(_ o: [String: Any]) {
         current = AkanNativeUpdateEntry(o["current"])
@@ -60,10 +67,11 @@ struct AkanNativeUpdateState: Sendable {
         trial = AkanNativeUpdateEntry(o["trial"])
         failed = (o["failed"] as? [String] ?? []).filter(AkanNativeUpdates.isBundleId)
         rolledBack = o["rolledBack"] as? String
+        revokedKeys = (o["revokedKeys"] as? [String] ?? []).filter(AkanNativeKernel.isUpdateKeyId)
     }
 
     var json: [String: Any] {
-        var o: [String: Any] = ["failed": Array(failed.suffix(20))]
+        var o: [String: Any] = ["failed": Array(failed.suffix(20)), "revokedKeys": revokedKeys]
         if let current { o["current"] = current.json }
         if let pending { o["pending"] = pending.json }
         if let trial { o["trial"] = trial.json }
@@ -75,33 +83,62 @@ struct AkanNativeUpdateState: Sendable {
 /// updates.json from the build (akan-native.config.ts `updates`), nil when the app has no updates.
 struct AkanNativeUpdateConfig: Sendable {
     let app: String
+    let version: String
     let platform: String
     let nativeApi: String
     let embeddedSequence: Double
     let url: String
-    let publicKey: Data
+    /// updates.publicKeys in order: the order decides which key may revoke which (AkanNativeKernel.updateDecision).
+    let keys: [(keyId: String, key: Data)]
     let channel: String
     let readyTimeout: TimeInterval
     let dev: Bool
+    /// updates.report.url: where AkanNativeUpdateReports posts what became of each release; nil sends nothing.
+    let reportUrl: String?
+
+    var ring: [String] { keys.map(\.keyId) }
+
+    func key(_ keyId: String) -> Data? { keys.first { $0.keyId == keyId }?.key }
 
     static func load() -> AkanNativeUpdateConfig? {
         let o = AkanNativeResources.json("updates.json")
-        guard let app = o["app"] as? String, let url = o["url"] as? String, let key = (o["publicKey"] as? String).flatMap({ Data(base64Encoded: $0) }), key.count == 32,
+        let encoded = o["publicKeys"] as? [String] ?? (o["publicKey"] as? String).map { [$0] } ?? []
+        let raw = encoded.compactMap { Data(base64Encoded: $0) }.filter { $0.count == 32 }
+        guard let app = o["app"] as? String, let url = o["url"] as? String, !raw.isEmpty, raw.count == encoded.count,
               let nativeApi = o["nativeApi"] as? String else { return nil }
         return AkanNativeUpdateConfig(
             app: app,
+            version: o["version"] as? String ?? "",
             platform: o["platform"] as? String ?? "ios",
             nativeApi: nativeApi,
             embeddedSequence: (o["embeddedSequence"] as? NSNumber)?.doubleValue ?? 0,
             url: url,
-            publicKey: key,
+            keys: raw.map { (keyId: AkanNativeKernel.updateKeyId($0), key: $0) },
             channel: o["channel"] as? String ?? "production",
             readyTimeout: ((o["readyTimeout"] as? NSNumber)?.doubleValue ?? 10_000) / 1000,
-            dev: o["dev"] as? Bool ?? false
+            dev: o["dev"] as? Bool ?? false,
+            reportUrl: o["reportUrl"] as? String
         )
     }
 }
 
+/// A `<channel>/<nativeApi>.json` envelope, checked as far as its signature: what the manifest says is read after.
+struct AkanNativeUpdateEnvelope {
+    let manifest: Data
+    let keyId: String
+
+    /// nil: not an envelope, or signed by a key this binary does not trust or has revoked.
+    static func open(_ data: Data, _ config: AkanNativeUpdateConfig, revoked: [String]) -> AkanNativeUpdateEnvelope? {
+        guard let o = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let keyId = o["keyId"] as? String, AkanNativeKernel.isUpdateKeyId(keyId), !revoked.contains(keyId),
+              let raw = config.key(keyId), let key = try? Curve25519.Signing.PublicKey(rawRepresentation: raw),
+              let manifest = (o["manifest"] as? String).flatMap({ Data(base64Encoded: $0) }), manifest.count <= 1 << 20,
+              let signature = (o["signature"] as? String).flatMap({ Data(base64Encoded: $0) }),
+              key.isValidSignature(signature, for: manifest) else { return nil }
+        return AkanNativeUpdateEnvelope(manifest: manifest, keyId: keyId)
+    }
+}
+
 @MainActor
 enum AkanNativeUpdates {
     static let config = AkanNativeUpdateConfig.load()
@@ -147,24 +184,40 @@ enum AkanNativeUpdates {
         }
     }
 
-    /// Whether a bundle may run in this binary.
-    static func usable(_ entry: AkanNativeUpdateEntry?, _ config: AkanNativeUpdateConfig) -> Bool {
+    /// Whether a bundle may run in this binary: one it still takes, whose files are intact.
+    static func usable(_ entry: AkanNativeUpdateEntry?, _ config: AkanNativeUpdateConfig, revoked: [String]) -> Bool {
         guard let entry else { return false }
-        return entry.nativeApi == config.nativeApi && entry.sequence > config.embeddedSequence
-            && FileManager.default.fileExists(atPath: bundleDirectory(entry.bundle).appendingPathComponent("index.html").path)
-            && verified(entry, config)
+        return takes(entry, config, revoked: revoked) && intact(entry, config, revoked: revoked)
     }
 
-    /// The bundle's signed manifest (kept next to it by the plugin) verifies, describes this entry,
+    /// Built for its native API, newer than its own bundle, and signed by a key it trusts and has not revoked: a bundle
+    /// a new binary or a revocation left behind is dropped as expected, not reported as a failure.
+    private static func takes(_ entry: AkanNativeUpdateEntry, _ config: AkanNativeUpdateConfig, revoked: [String]) -> Bool {
+        entry.nativeApi == config.nativeApi && entry.sequence > config.embeddedSequence
+            && config.ring.contains(entry.keyId) && !revoked.contains(entry.keyId)
+    }
+
+    private static func intact(_ entry: AkanNativeUpdateEntry, _ config: AkanNativeUpdateConfig, revoked: [String]) -> Bool {
+        FileManager.default.fileExists(atPath: bundleDirectory(entry.bundle).appendingPathComponent("index.html").path)
+            && verified(entry, config, revoked: revoked)
+    }
+
+    /// Drops an entry this launch cannot serve, reporting `event` (reason verify) when its files were the reason.
+    private static func drop(_ entry: AkanNativeUpdateEntry?, _ config: AkanNativeUpdateConfig, revoked: [String], _ event: String) -> AkanNativeUpdateEntry? {
+        guard let entry else { return nil }
+        guard takes(entry, config, revoked: revoked) else { return nil }
+        if intact(entry, config, revoked: revoked) { return entry }
+        AkanNativeUpdateReports.record(event, entry, reason: "verify")
+        return nil
+    }
+
+    /// The bundle's envelope (kept next to it by the plugin) verifies, describes this entry,
     /// and every file it lists is there with its size. The hashes were checked at the download.
-    private static func verified(_ entry: AkanNativeUpdateEntry, _ config: AkanNativeUpdateConfig) -> Bool {
+    private static func verified(_ entry: AkanNativeUpdateEntry, _ config: AkanNativeUpdateConfig, revoked: [String]) -> Bool {
         let dir = bundleDirectory(entry.bundle)
-        guard let manifest = try? Data(contentsOf: dir.appendingPathComponent("manifest.json")),
-              let sigText = try? String(contentsOf: dir.appendingPathComponent("manifest.json.sig"), encoding: .utf8),
-              let signature = Data(base64Encoded: sigText.trimmingCharacters(in: .whitespacesAndNewlines)),
-              let key = try? Curve25519.Signing.PublicKey(rawRepresentation: config.publicKey),
-              key.isValidSignature(signature, for: manifest),
-              let o = try? JSONSerialization.jsonObject(with: manifest) as? [String: Any],
+        guard let data = try? Data(contentsOf: dir.appendingPathComponent("manifest.signed.json")),
+              let envelope = AkanNativeUpdateEnvelope.open(data, config, revoked: revoked), envelope.keyId == entry.keyId,
+              let o = try? JSONSerialization.jsonObject(with: envelope.manifest) as? [String: Any],
               o["bundle"] as? String == entry.bundle, (o["sequence"] as? NSNumber)?.doubleValue == entry.sequence,
               o["nativeApi"] as? String == entry.nativeApi, o["app"] as? String == config.app, o["platform"] as? String == config.platform,
               let files = o["files"] as? [[String: Any]] else { return false }
@@ -180,15 +233,16 @@ enum AkanNativeUpdates {
     static func launch() -> URL? {
         guard let config else { return nil }
         var state = readState()
-        if !usable(state.current, config) { state.current = nil }
-        if !usable(state.pending, config) { state.pending = nil }
-        if !usable(state.trial, config) { state.trial = nil }
+        state.current = drop(state.current, config, revoked: state.revokedKeys, "rolledBack")
+        state.pending = drop(state.pending, config, revoked: state.revokedKeys, "failed")
+        state.trial = drop(state.trial, config, revoked: state.revokedKeys, "rolledBack")
         if let trial = state.trial {
             // Launched again without notifyReady(): the trial crashed or hung.
             state.failed.append(trial.bundle)
             state.rolledBack = trial.bundle
             state.trial = nil
             NSLog("[akan-native] updates: bundle %@ did not confirm; rolled back", trial.bundle)
+            AkanNativeUpdateReports.record("rolledBack", trial, reason: "relaunch")
         }
         if var pending = state.pending, !state.failed.contains(pending.bundle) {
             pending.attempts = 1
@@ -198,8 +252,10 @@ enum AkanNativeUpdates {
         if !writeState(state), state.trial != nil {
             state.trial = nil // not on record: the pending bundle waits for a launch that can record it
         }
+        if let trial = state.trial { AkanNativeUpdateReports.record("applied", trial) }
         active = state.trial ?? state.current
         onTrial = state.trial != nil
+        AkanNativeUpdateReports.start()
         return active.map { bundleDirectory($0.bundle) }
     }
 
@@ -208,20 +264,21 @@ enum AkanNativeUpdates {
         var state = readState()
         state.pending = entry
         state.failed.removeAll { $0 == entry.bundle }
-        writeState(state)
+        if writeState(state) { AkanNativeUpdateReports.record("downloaded", entry) }
     }
 
     /// apply(): makes the pending bundle the trial now; returns its folder for the reload.
     static func applyPending() -> URL? {
         guard let config else { return nil }
         var state = readState()
-        guard var pending = state.pending, usable(pending, config) else { return nil }
+        guard var pending = state.pending, usable(pending, config, revoked: state.revokedKeys) else { return nil }
         pending.attempts = 1
         state.trial = pending
         state.pending = nil
         guard writeState(state) else { return nil }
         active = pending
         onTrial = true
+        AkanNativeUpdateReports.record("applied", pending)
         return bundleDirectory(pending.bundle)
     }
 
@@ -230,34 +287,46 @@ enum AkanNativeUpdates {
         guard onTrial, let trial = active else { return }
         var state = readState()
         guard state.trial?.bundle == trial.bundle else { return }
-        state.current = AkanNativeUpdateEntry(bundle: trial.bundle, sequence: trial.sequence, nativeApi: trial.nativeApi)
+        state.current = AkanNativeUpdateEntry(bundle: trial.bundle, sequence: trial.sequence, nativeApi: trial.nativeApi, keyId: trial.keyId)
         state.trial = nil
         state.rolledBack = nil
         writeState(state)
         onTrial = false
+        AkanNativeUpdateReports.record("confirmed", trial)
         prune(keep: [state.current?.bundle, state.pending?.bundle].compactMap { $0 })
     }
 
-    /// The trial did not confirm in time: back to the previous bundle. Returns its folder (nil: the app's own).
-    static func rollback() -> URL? {
-        guard onTrial, let trial = active else { return active.map { bundleDirectory($0.bundle) } }
+    /// The trial did not confirm in time: back to the previous bundle. Returns its folder (nil: the app's own) and the
+    /// trial it ended, whose report waits for the renderer probe to say whether the page timed out or hung.
+    static func rollback() -> (root: URL?, trial: AkanNativeUpdateEntry?) {
+        guard onTrial, let trial = active else { return (active.map { bundleDirectory($0.bundle) }, nil) }
         var state = readState()
         state.trial = nil
         state.failed.append(trial.bundle)
         state.rolledBack = trial.bundle
         writeState(state)
         onTrial = false
-        active = config.flatMap { usable(state.current, $0) ? state.current : nil }
+        active = config.flatMap { usable(state.current, $0, revoked: state.revokedKeys) ? state.current : nil }
         NSLog("[akan-native] updates: bundle %@ did not call notifyReady() in time; rolled back", trial.bundle)
-        return active.map { bundleDirectory($0.bundle) }
+        return (active.map { bundleDirectory($0.bundle) }, trial)
     }
 
-    /// reset(): the app's own bundle from the next launch on.
+    /// reset(): the app's own bundle from the next launch on. Revocations stay.
     static func reset() {
-        writeState(AkanNativeUpdateState())
+        writeState(AkanNativeUpdateState(revokedKeys: readState().revokedKeys))
         prune(keep: active.map { [$0.bundle] } ?? [])
     }
 
+    /// Keys a verified manifest revoked: no bundle they signed is served again, from the next launch on.
+    static func revoke(_ keyIds: [String]) {
+        var state = readState()
+        let added = keyIds.filter { !state.revokedKeys.contains($0) }
+        guard !added.isEmpty else { return }
+        state.revokedKeys += added
+        writeState(state)
+        NSLog("[akan-native] updates: revoked keys %@", added.joined(separator: ", "))
+    }
+
     /// A download in progress (bundles/<bundle>.partial) is the plugin's, which removes it.
     private static func prune(keep: [String]) {
         let folder = directory.appendingPathComponent("bundles", isDirectory: true)

package/vendor/@akanjs/native/native/ios/Sources/AkanNativeVectors.swift

@@ -141,6 +141,24 @@ enum AkanNativeVectors {
             check(valid == c[3] as? Bool, "ed25519 \(c[4])")
         }
 
+        // Updates protocol v2 (AkanNativeUpdates, AkanNativeKernel.updateDecision).
+        let updates = load("updates")
+        for c in rows(updates, "keyIds") {
+            check(AkanNativeKernel.updateKeyId(Data(base64Encoded: c[0] as! String) ?? Data()) == c[1] as? String, "update keyId \(c[0])")
+        }
+        for c in rows(updates, "decisions") {
+            let running = (c[7] as? [Any]).map { (sequence: ($0[0] as! NSNumber).doubleValue, keyId: $0[1] as! String) }
+            let got = AkanNativeKernel.updateDecision(
+                ring: c[0] as! [String], revoked: c[1] as! [String], signer: c[2] as! String, revokeKeys: c[3] as! [String],
+                resetSequence: c[4] as! Bool, sequence: (c[5] as! NSNumber).doubleValue, embedded: (c[6] as! NSNumber).doubleValue, running: running
+            )
+            check(got.wire == c[8] as? String, "update decision \(c[9]): \(got.wire)")
+        }
+        for c in rows(updates, "urls") {
+            let got = AkanNativeKernel.updateManifestURL(c[0] as! String, platform: c[1] as! String, channel: c[2] as! String, nativeApi: c[3] as! String)
+            check(got == c[4] as? String, "update url \(got)")
+        }
+
         // A missing or truncated file must not pass as fewer checks.
         for (name, count) in AkanNativeVectorData.counts where ran[name, default: 0] != count {
             failures.append("\(name): \(ran[name, default: 0]) of \(count) checks ran")

package/vendor/@akanjs/native/native/ios/Sources/AkanNativeViewController.swift

@@ -185,6 +185,7 @@ final class AkanNativeViewController: UIViewController, WKNavigationDelegate, WK
     // MARK: web bundle updates (UP-2)
 
     private var readyTimer: Timer?
+    private var rendererAnswered = false
 
     /// A bundle on trial must call notifyReady() within updates.readyTimeout of loading.
     private func startReadyTimer() {
@@ -194,12 +195,32 @@ final class AkanNativeViewController: UIViewController, WKNavigationDelegate, WK
         readyTimer = Timer.scheduledTimer(withTimeInterval: timeout, repeats: false) { [weak self] _ in
             MainActor.assumeIsolated {
                 guard let self, AkanNativeUpdates.onTrial else { return }
-                self.serveBundle(AkanNativeUpdates.rollback())
+                self.rollBackTrial()
             }
         }
         #endif
     }
 
+    #if AKAN_NATIVE_UPDATES
+    /// A web content process stuck in a script never runs the next load: one that does not answer is left behind with
+    /// its window, and a new window serves the bundle the rollback made active.
+    private func rollBackTrial() {
+        let (root, trial) = AkanNativeUpdates.rollback()
+        rendererAnswered = false
+        webView.evaluateJavaScript("0") { [weak self] _, _ in self?.rendererAnswered = true }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 2) { [weak self] in
+            guard let self else { return }
+            if let trial { AkanNativeUpdateReports.record("rolledBack", trial, reason: self.rendererAnswered ? "timeout" : "hang") }
+            if !self.rendererAnswered, let scene = self.view.window?.windowScene?.delegate as? AkanNativeSceneDelegate {
+                AkanNativeLog.info("updates: the page on trial does not answer; making the window again")
+                scene.recreate()
+            } else {
+                self.serveBundle(root)
+            }
+        }
+    }
+    #endif
+
     /// Serves another web bundle (nil: the app's own) and loads it from the start.
     func serveBundle(_ root: URL?) {
         readyTimer?.invalidate()
@@ -296,6 +317,8 @@ final class AkanNativeViewController: UIViewController, WKNavigationDelegate, WK
     /// fail or turn into a download and leave the page in place.
     func webView(_ webView: WKWebView, didCommit navigation: WKNavigation!) {
         bridge.endDocument()
+        // Armed at commit, not at didFinish: a bundle stuck in a script never finishes loading.
+        startReadyTimer()
     }
 
     /// The window is going away (the scene disconnected, or $host.recreate): its page's document ends.
@@ -306,7 +329,6 @@ final class AkanNativeViewController: UIViewController, WKNavigationDelegate, WK
 
     func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
         if config.splashAutoHide { hideSplash(fadeOut: 0.2) }
-        startReadyTimer()
     }
 
     func webViewWebContentProcessDidTerminate(_ webView: WKWebView) {

package/vendor/@akanjs/native/packages/cli/src/api.ts

@@ -6,6 +6,7 @@ import { type DoctorCheck, doctorChecks, hostPlatforms, runFixes } from "./comma
 import type { AkanNativeConfig } from "./config.ts";
 import { makeNativeBoot } from "./lib/boot.ts";
 import { BUNDLE_FILE, compatProblems, readBundleInfo } from "./lib/compat.ts";
+import { requestedDistribution } from "./lib/distribution.ts";
 import { CancelledError, withSignal } from "./lib/exec.ts";
 import { type HmrContext, lanAddress, resolveDevEntry, startHmrServer } from "./lib/hmr.ts";
 import type { Device, DeviceSelector, Launched } from "./lib/launch.ts";
@@ -47,6 +48,12 @@ import { androidDevices, launchAndroid } from "./platforms/android.ts";
 import { PLATFORM_TARGETS, type TargetPlatform } from "./platforms/index.ts";
 import { iosDevices, physicalIosDevice } from "./platforms/ios.ts";
 
+export { type UpdateDecision, type UpdateDecisionInput, updateDecision } from "../../core/src/kernel.ts";
+/**
+ * A phone's update protocol as the apps run it, for a signer or a server that checks what it publishes or registers:
+ * the envelope's verification, the keyId of a public key, and what a verified manifest means to a binary.
+ */
+export { keyIdOf, openEnvelope } from "./lib/updates.ts";
 export type {
   AkanNativeConfig,
   AndroidSigning,
@@ -71,10 +78,10 @@ export type {
  * environment (the API itself reads no variable): pass the result as `macos`.
  */
 /** The Authenticode settings the AKAN_NATIVE_WINDOWS_* variables name: pass the result as `windows.signing`. */
-export { macosDistributionFromEnv, windowsSigningFromEnv };
+export { macosDistributionFromEnv, requestedDistribution, windowsSigningFromEnv };
 
 /** semver of this API. A caller checks the major before it relies on anything here. */
-export const API_VERSION = "0.10.0";
+export const API_VERSION = "0.11.0";
 
 export type AkanNativeErrorCode =
   | "CONFIG_INVALID"
@@ -293,6 +300,8 @@ export interface PublishCheckOptions extends Pick<TaskOptions, "appDir" | "confi
   out?: string;
   /** Whether the release will carry a server; the config's `desktop.server` by default. */
   server?: boolean;
+  /** A desktop release's CPU, which names its feed folder: this computer's by default. */
+  arch?: DesktopArch;
 }
 
 /**
@@ -302,14 +311,18 @@ export interface PublishCheckOptions extends Pick<TaskOptions, "appDir" | "confi
  */
 export function checkPublishUpdate(options: PublishCheckOptions): { channel: string; out: string } {
   if (!options.config.updates)
-    throw new AkanNativeError("CONFIG_INVALID", "the config has no updates: { url, publicKey } to publish for");
+    throw new AkanNativeError("CONFIG_INVALID", "the config has no updates: { url, publicKeys } to publish for");
   const channel = options.channel ?? options.config.updates.channel ?? "production";
   const out = resolve(options.out ?? resolve(options.appDir, ".akan", "native", "updates"));
   try {
     if (options.channel !== undefined) assertChannel(options.channel);
-    assertSigningKey(options.config);
+    const { publicKey, publicKeys } = options.config.updates;
+    assertSigningKey(
+      { app: options.config.app, updates: { publicKeys: publicKeys ?? (publicKey ? [publicKey] : []) } },
+      options.platform,
+    );
     const server = options.server ?? !!options.config.desktop?.server;
-    assertServerOfChannel({ desktop: server ? { server } : {} }, options.platform, out, channel);
+    assertServerOfChannel({ desktop: server ? { server } : {} }, options.platform, out, channel, options.arch);
   } catch (error) {
     throw toAkanNativeError(error, "CONFIG_INVALID");
   }
@@ -329,6 +342,8 @@ export function publishUpdate(
     macos?: Pick<MacosBuild, "signing" | "notarize">;
     /** Authenticode for a Windows release's files. No setup program is made. */
     windows?: Pick<WindowsBuild, "signing">;
+    /** A desktop release's CPU, of the same OS: an x64 release from an arm64 machine. Default this computer's. */
+    arch?: DesktopArch;
   },
 ): Promise<PublishResult> {
   return task(options, async (warnings) => {
@@ -336,6 +351,7 @@ export function publishUpdate(
     const { ctx, artifact, result } = await buildIn(options, "release", options.mode ?? "production", warnings, {
       ...(options.macos ? { macos: { ...options.macos, dmg: false } } : {}),
       ...(options.windows?.signing ? { windows: { signing: options.windows.signing } } : {}),
+      ...(options.arch ? { arch: options.arch } : {}),
     });
     const { dir, manifest } = await publishRelease(ctx, options.platform, artifact, out, channel).catch((error) => {
       throw toAkanNativeError(error, "CONFIG_INVALID");
@@ -366,7 +382,7 @@ export function compareBundles(shipped: string, bundle: string): { compatible: b
 
 /**
  * The app's update signing key: made once (AKAN_NATIVE_UPDATE_KEY, else ~/.akan/native/keys/<app id>.update.key),
- * then read. `publicKey` goes into the config's `updates.publicKey`; the key file never leaves the machine.
+ * then read. `publicKey` goes into the config's `updates.publicKeys`; the key file never leaves the machine.
  */
 export function updateKeygen(options: { config: AkanNativeConfig }): {
   publicKey: string;

package/vendor/@akanjs/native/packages/cli/src/commands/build.ts

@@ -2,16 +2,25 @@
 
 import { relative } from "node:path";
 import { checkFlags, type ParsedArgs, parseArgs, stringFlag } from "../lib/args.ts";
+import { requestedDistribution } from "../lib/distribution.ts";
 import { bold, CliError, dim, log } from "../lib/log.ts";
-import { macosDistributionFromEnv } from "../lib/macossigning.ts";
 import { type BuildContext, type BuildProfile, prepare } from "../lib/prepare.ts";
 import { findAppDir, loadProject } from "../lib/project.ts";
 import type { DesktopArch } from "../lib/updates.ts";
-import { windowsSigningFromEnv } from "../lib/windowssigning.ts";
 import { PLATFORM_TARGETS, TARGETS, type TargetPlatform } from "../platforms/index.ts";
 import { physicalIosDevice } from "../platforms/ios.ts";
 
-export const BOOLEAN_FLAGS = ["skip-web-build", "open", "release", "debug", "headless", "aab", "installer"];
+export const BOOLEAN_FLAGS = [
+  "skip-web-build",
+  "open",
+  "release",
+  "debug",
+  "headless",
+  "aab",
+  "installer",
+  "sign",
+  "notarize",
+];
 
 /** Flags of every build: the app, the env mode (.env.<mode>), the profile, the web build. */
 export const BUILD_FLAGS = [
@@ -25,11 +34,13 @@ export const BUILD_FLAGS = [
   "device",
   "build",
   "arch",
+  "sign",
+  "notarize",
 ];
 /** Flags of launching a build (web server, simulators, emulators). */
 export const LAUNCH_FLAGS = ["port", "host", "open", "headless", "device", "avd"];
 
-export const BUILD_USAGE = `akan-native build <${TARGETS.join("|")}> [--app <dir>] [--mode <mode>] [--debug] [--skip-web-build] [--aab] [--installer] [--device] [--build <n>] [--arch <arm64|x64>]`;
+export const BUILD_USAGE = `akan-native build <${TARGETS.join("|")}> [--app <dir>] [--mode <mode>] [--debug] [--skip-web-build] [--aab] [--installer] [--device] [--build <n>] [--arch <arm64|x64>] [--sign] [--notarize]`;
 export const RUN_USAGE = `akan-native run <${TARGETS.join("|")}> [--app <dir>] [--mode <mode>] [--release] [--skip-web-build] [--port <n>] [--open] [--headless] [--device <name>] [--avd <name>] [--start <path>]`;
 
 export interface BuildDefaults {
@@ -77,6 +88,13 @@ export async function buildFromArgs(
   const device = args.flags.device;
   const iphone = platform === "ios" && typeof device === "string" ? await physicalIosDevice(device) : null;
   const iosDevice = platform === "ios" && (device === true || iphone !== null);
+  const distribution = requestedDistribution(platform, profile, {
+    sign: args.flags.sign === true,
+    notarize: args.flags.notarize === true,
+  });
+  if (distribution.notice) log.warn(distribution.notice);
+  else if (distribution.unused.length && (platform === "macos" || platform === "windows"))
+    log.info(dim(`${distribution.unused.join(", ")} set: this build is not signed without --sign`));
   const ctx = await prepare(project, platform, {
     mode: stringFlag(args, "mode") ?? defaults.mode,
     profile,
@@ -89,16 +107,14 @@ export async function buildFromArgs(
       ? {
           windows: {
             ...(args.flags.installer === true ? { installer: true } : {}),
-            
-            ...(profile === "release" ? { signing: windowsSigningFromEnv() } : {}),
+            ...distribution.windows,
           },
         }
       : {}),
-    
     ...(platform === "macos"
       ? {
           macos: {
-            ...(profile === "release" ? macosDistributionFromEnv() : {}),
+            ...distribution.macos,
             ...(args.flags.installer === true ? { dmg: true } : {}),
           },
         }

package/vendor/@akanjs/native/packages/cli/src/commands/update.ts

@@ -4,13 +4,14 @@ import { existsSync, statSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { checkFlags, type ParsedArgs, parseArgs, stringFlag } from "../lib/args.ts";
 import { bold, CliError, dim, log } from "../lib/log.ts";
+import { desktopArch } from "../lib/prepare.ts";
 import { findAppDir, loadProject } from "../lib/project.ts";
 import { assertServerOfChannel, assertSigningKey, publishRelease } from "../lib/publish.ts";
-import { assertChannel, generateUpdateKey, updateKeyPath } from "../lib/updates.ts";
+import { assertChannel, type DesktopArch, generateUpdateKey, updateKeyPath } from "../lib/updates.ts";
 import { BOOLEAN_FLAGS, buildFromArgs } from "./build.ts";
 
 export const UPDATE_USAGE =
-  "akan-native update keygen [--app <dir>] | akan-native update publish <ios|android|macos|windows|linux> [--app <dir>] [--mode <mode>] [--debug] [--channel <name>] [--out <dir>] | akan-native update serve [--app <dir>] [--out <dir>] [--port <n>]";
+  "akan-native update keygen [--app <dir>] | akan-native update publish <ios|android|macos|windows|linux> [--app <dir>] [--mode <mode>] [--debug] [--channel <name>] [--out <dir>] [--arch <arm64|x64>] [--sign] [--notarize] | akan-native update serve [--app <dir>] [--out <dir>] [--port <n>]";
 
 const outDir = (args: ParsedArgs, appDir: string) =>
   resolve(stringFlag(args, "out") ?? join(appDir, ".akan", "native", "updates"));
@@ -25,10 +26,10 @@ async function keygen(args: ParsedArgs): Promise<number> {
     );
   else log.info(`using the existing key ${path}`);
   log.info(
-    `Add to akan-native.config.ts:\n\n  updates: { url: "https://…/updates", publicKey: ${JSON.stringify(publicKey)} },\n`,
+    `Add to akan-native.config.ts:\n\n  updates: { url: "https://…/updates", publicKeys: [${JSON.stringify(publicKey)}] },\n`,
   );
-  if (project.config.updates && project.config.updates.publicKey !== publicKey)
-    log.warn("akan-native.config.ts has a different updates.publicKey");
+  if (project.config.updates && !project.config.updates.publicKeys.includes(publicKey))
+    log.warn("akan-native.config.ts has updates.publicKeys without this key");
   return 0;
 }
 
@@ -40,12 +41,13 @@ async function publish(args: ParsedArgs): Promise<number> {
   const requested = stringFlag(args, "channel");
   if (requested !== undefined) assertChannel(requested);
   const project = await loadProject(findAppDir(stringFlag(args, "app") ?? process.cwd()));
-  assertSigningKey(project.config);
+  assertSigningKey(project.config, platform);
   assertServerOfChannel(
     project.config,
     platform,
     outDir(args, project.appDir),
     requested ?? project.config.updates?.channel ?? "production",
+    desktopArch(platform, stringFlag(args, "arch") as DesktopArch | undefined),
   );
   const { ctx, artifact } = await buildFromArgs(
     { positional: [platform], flags: args.flags },
@@ -54,10 +56,10 @@ async function publish(args: ParsedArgs): Promise<number> {
   );
   const { config, appDir } = ctx.project;
   const channel = requested ?? config.updates?.channel ?? "production";
-  const { dir, manifest } = await publishRelease(ctx, platform, artifact, outDir(args, appDir), channel);
+  const { dir, manifest, file } = await publishRelease(ctx, platform, artifact, outDir(args, appDir), channel);
   const size = manifest.files.reduce((n, f) => n + f.size, 0);
   log.ok(
-    `published ${bold(manifest.bundle)} to ${relative(process.cwd(), dir) || dir}/${channel}.json ${dim(`(${manifest.files.length} files, ${(size / 1024).toFixed(0)} KiB${manifest.nativeApi ? `, native API ${manifest.nativeApi}` : ""})`)}`,
+    `published ${bold(manifest.bundle)} to ${relative(process.cwd(), file) || file} ${dim(`(${manifest.files.length} files, ${(size / 1024).toFixed(0)} KiB${manifest.nativeApi ? `, native API ${manifest.nativeApi}` : ""})`)}`,
   );
   log.info(
     dim(
@@ -97,7 +99,7 @@ export async function update(argv: string[]): Promise<number> {
   
   const known = {
     keygen: ["app"],
-    publish: ["app", "mode", "debug", "channel", "out", "skip-web-build"],
+    publish: ["app", "mode", "debug", "channel", "out", "skip-web-build", "arch", "sign", "notarize"],
     serve: ["app", "out", "port"],
   }[args.positional[0] as string];
   if (known) checkFlags(args, known, UPDATE_USAGE);