akanjs 3.0.2 → 3.1.0-rc.0

package/vendor/@akanjs/native/packages/cli/src/lib/updates.ts

@@ -11,12 +11,18 @@ import { akanNativeHome } from "./toolchains.ts";
 export interface UpdatesConfig {
   /** Base URL of the update files, e.g. "https://example.com/updates". http:// only for localhost / 10.0.2.2 in dev builds. */
   url: string;
-  /** Raw 32-byte Ed25519 public key, base64 (`akan-native update keygen` prints it). */
-  publicKey: string;
+  /**
+   * Raw 32-byte Ed25519 public keys, base64 (`akan-native update keygen` prints one): the keys a phone binary trusts, the
+   * online signing key first and offline spares after it, since a key may revoke only keys listed before it. A desktop
+   * app trusts the first.
+   */
+  publicKeys: string[];
   /** Manifest name under <platform>/. Default "production". */
   channel: string;
   /** How long a newly applied bundle has to call notifyReady() before it is rolled back, ms. Default 10000. */
   readyTimeout: number;
+  /** Where a phone posts what became of each release (downloaded, applied, confirmed, rolled back, failed); null: no reports. */
+  reportUrl: string | null;
 }
 
 export interface UpdateFile {
@@ -35,7 +41,8 @@ export function hostArch(): DesktopArch {
 }
 
 export interface UpdateManifest {
-  schema: 1;
+  /** 2 for a phone's web bundle, which travels in an UpdateEnvelope; 1 for a desktop app. */
+  schema: 1 | 2;
   kind: "web" | "app";
   app: string;
   platform: Platform;
@@ -60,6 +67,19 @@ export interface UpdateManifest {
   patches?: { from: string; url: string; sha256: string; size: number }[];
   /** App updates: whether the app carries a server; an installed app refuses a release that differs from itself. */
   server?: boolean;
+  /** Web bundles: keyIds the phone stops trusting for good; each listed before the signer's key in its updates.publicKeys. */
+  revokeKeys?: string[];
+  /** Web bundles: with a new revocation, compare this release with the binary's own bundle instead of the running one. */
+  resetSequence?: boolean;
+}
+
+/** A phone's `<platform>/<channel>/<nativeApi>.json`: one object, so a new manifest never meets an old signature. */
+export interface UpdateEnvelope {
+  /** The manifest's exact bytes, base64. */
+  manifest: string;
+  keyId: string;
+  /** Ed25519 over the manifest bytes, base64. */
+  signature: string;
 }
 
 /** Every file of a web bundle as the app serves it: index.html with the init script and CSP, public/, env.runtime.json. */
@@ -106,7 +126,7 @@ export function webManifest(release: {
   files: UpdateFile[];
 }): UpdateManifest {
   return {
-    schema: 1,
+    schema: 2,
     kind: "web",
     app: release.app.id,
     platform: release.platform,
@@ -122,15 +142,15 @@ export function webManifest(release: {
 
 /** A channel is a file name in the release folder and a string an app's config compares: lowercase, no separators. */
 const CHANNEL_NAME = /^[a-z0-9][a-z0-9._-]{0,40}$/;
-/** `<channel>.json` of these would overwrite what an unsigned phone update (packUpdate) writes to the same folder. */
-const RESERVED_CHANNELS = ["bundle", "manifest.template", "compat"];
+/** These would land on what an unsigned phone update (packUpdate) writes to the same folder, or on its `files/`. */
+const RESERVED_CHANNELS = ["bundle", "manifest.template", "compat", "pack", "files", "app"];
 
 /** Refuses a channel no app could be configured for: it would be written but never taken. */
 export function assertChannel(channel: string): void {
   if (!CHANNEL_NAME.test(channel))
     throw new CliError(`channel "${channel}" is not a short lowercase name like "production" or "pilot"`);
   if (RESERVED_CHANNELS.includes(channel))
-    throw new CliError(`channel "${channel}" would overwrite ${channel}.json of an unsigned update: name another`);
+    throw new CliError(`channel "${channel}" is a name the update folder already uses: name another`);
 }
 
 export function validateUpdates(raw: unknown, problems: string[]): UpdatesConfig | null {
@@ -140,10 +160,10 @@ export function validateUpdates(raw: unknown, problems: string[]): UpdatesConfig
     return null;
   }
   const r = raw as Record<string, unknown>;
-  if (typeof r.url !== "string" || !/^https?:\/\/[^/]+/.test(r.url))
-    problems.push("updates.url must be an http(s) URL");
-  if (typeof r.publicKey !== "string" || Buffer.from(r.publicKey, "base64").length !== 32)
-    problems.push("updates.publicKey must be a base64 Ed25519 public key (akan-native update keygen)");
+  
+  if (typeof r.url !== "string" || !/^https?:\/\/[^/?#]+[^?#]*$/.test(r.url))
+    problems.push("updates.url must be an http(s) URL without a query or fragment");
+  const publicKeys = updatePublicKeys(r, problems);
   if (
     r.channel !== undefined &&
     (typeof r.channel !== "string" || !CHANNEL_NAME.test(r.channel) || RESERVED_CHANNELS.includes(r.channel))
@@ -151,18 +171,56 @@ export function validateUpdates(raw: unknown, problems: string[]): UpdatesConfig
     problems.push('updates.channel must be a short name like "production"');
   if (r.readyTimeout !== undefined && (typeof r.readyTimeout !== "number" || r.readyTimeout < 1000))
     problems.push("updates.readyTimeout must be a number of milliseconds >= 1000");
+  const reportUrl = updateReportUrl(r.report, problems);
   for (const key of Object.keys(r))
-    if (!["url", "publicKey", "channel", "readyTimeout"].includes(key))
+    if (!["url", "publicKey", "publicKeys", "channel", "readyTimeout", "report"].includes(key))
       problems.push(`updates.${key} is not supported`);
-  if (typeof r.url !== "string" || typeof r.publicKey !== "string") return null;
+  if (typeof r.url !== "string" || !publicKeys) return null;
   return {
     url: r.url.replace(/\/+$/, ""),
-    publicKey: r.publicKey,
+    publicKeys,
     channel: (r.channel as string | undefined) ?? "production",
     readyTimeout: (r.readyTimeout as number | undefined) ?? 10_000,
+    reportUrl,
   };
 }
 
+/** `report: { url }`, posted to as it is: the address is the receiver's, a path of its own included. */
+function updateReportUrl(raw: unknown, problems: string[]): string | null {
+  if (raw === undefined) return null;
+  const url = raw && typeof raw === "object" && !Array.isArray(raw) ? (raw as Record<string, unknown>).url : undefined;
+  if (typeof url !== "string" || !/^https?:\/\/[^/?#]+[^#]*$/.test(url) || Object.keys(raw as object).length !== 1) {
+    problems.push("updates.report must be { url } with an http(s) URL");
+    return null;
+  }
+  return url.replace(/\/+$/, "");
+}
+
+/** `publicKeys` (1–3, no repeats) or the one-key `publicKey`, never both. */
+function updatePublicKeys(r: Record<string, unknown>, problems: string[]): string[] | null {
+  if (r.publicKey !== undefined && r.publicKeys !== undefined) {
+    problems.push("updates takes publicKey or publicKeys, not both");
+    return null;
+  }
+  const keys = r.publicKeys ?? (r.publicKey === undefined ? undefined : [r.publicKey]);
+  const isKey = (key: unknown) => typeof key === "string" && Buffer.from(key, "base64").length === 32;
+  if (!Array.isArray(keys) || keys.length < 1 || keys.length > 3 || !keys.every(isKey)) {
+    problems.push(
+      "updates.publicKeys must be 1 to 3 base64 Ed25519 public keys (akan-native update keygen), or publicKey one",
+    );
+    return null;
+  }
+  if (new Set(keys.map(keyIdOf)).size !== keys.length) {
+    problems.push("updates.publicKeys lists a key twice");
+    return null;
+  }
+  return keys as string[];
+}
+
+/** What an envelope names its signer by: the first 8 bytes of the raw public key's SHA-256, in hex. */
+export const keyIdOf = (publicKey: string) =>
+  createHash("sha256").update(Buffer.from(publicKey, "base64")).digest().subarray(0, 8).toString("hex");
+
 /** Where the signing key of an app lives: AKAN_NATIVE_UPDATE_KEY (a file path), else ~/.akan/native/keys/<app id>.update.key. */
 export function updateKeyPath(appId: string, env: Record<string, string | undefined> = process.env): string {
   return env.AKAN_NATIVE_UPDATE_KEY ?? join(akanNativeHome(env), "keys", `${appId}.update.key`);
@@ -189,16 +247,60 @@ function publicKeyOf(privateKey: ReturnType<typeof createPrivateKey>): string {
   return der.subarray(der.length - 32).toString("base64");
 }
 
-/** The key at `keyPath`, refused unless it is the one whose public half the apps were built with. */
-export function signingKey(keyPath: string, expectedPublicKey: string) {
+/** The key at `keyPath` and where it sits in `publicKeys`, refused unless the apps were built to trust it. */
+export function signingKey(keyPath: string, publicKeys: readonly string[]) {
   const key = readPrivateKey(keyPath);
-  if (publicKeyOf(key) !== expectedPublicKey)
-    throw new CliError(`the key at ${keyPath} does not match updates.publicKey in akan-native.config.ts`);
-  return key;
+  const publicKey = publicKeyOf(key);
+  const index = publicKeys.indexOf(publicKey);
+  if (index < 0) throw new CliError(`the key at ${keyPath} is not one of updates.publicKeys in akan-native.config.ts`);
+  return { key, keyId: keyIdOf(publicKey), index };
+}
+
+/** A desktop app's base64 signature (protocol v1), with the key the app trusts: the first of updates.publicKeys. */
+export function signManifest(bytes: Uint8Array, keyPath: string, publicKeys: readonly string[]): string {
+  const { key, index } = signingKey(keyPath, publicKeys);
+  if (index !== 0)
+    throw new CliError(
+      `a desktop app trusts the first of updates.publicKeys only, and the key at ${keyPath} is not it`,
+    );
+  return sign(null, bytes, key).toString("base64");
 }
 
-export function signManifest(bytes: Uint8Array, keyPath: string, expectedPublicKey: string): string {
-  return sign(null, bytes, signingKey(keyPath, expectedPublicKey)).toString("base64");
+/** A phone's envelope (protocol v2) for the manifest's exact bytes, signed with any key of `publicKeys`. */
+export function sealManifest(bytes: Uint8Array, keyPath: string, publicKeys: readonly string[]): UpdateEnvelope {
+  const { key, keyId } = signingKey(keyPath, publicKeys);
+  return {
+    manifest: Buffer.from(bytes).toString("base64"),
+    keyId,
+    signature: sign(null, bytes, key).toString("base64"),
+  };
+}
+
+/**
+ * The manifest bytes of an envelope, verified as a phone verifies it against `publicKeys` (minus `revoked`). What it
+ * then decides (revocation, sequence) is AkanNativeKernel.updateDecision, kernel.ts updateDecision.
+ */
+export function openEnvelope(
+  text: string,
+  publicKeys: readonly string[],
+  revoked: readonly string[] = [],
+): { manifest: Uint8Array; keyId: string } {
+  let envelope: Partial<UpdateEnvelope>;
+  try {
+    envelope = JSON.parse(text) as Partial<UpdateEnvelope>;
+  } catch {
+    throw new CliError("the update envelope is not JSON");
+  }
+  const { manifest, keyId, signature } = envelope;
+  if (typeof manifest !== "string" || typeof keyId !== "string" || typeof signature !== "string")
+    throw new CliError("the update envelope needs manifest, keyId and signature");
+  const publicKey = publicKeys.find((key) => keyIdOf(key) === keyId);
+  if (!publicKey || revoked.includes(keyId))
+    throw new CliError(`the update envelope is signed by key ${keyId}, which is not trusted`);
+  const bytes = Buffer.from(manifest, "base64");
+  if (!verifyManifest(bytes, signature, publicKey))
+    throw new CliError("the update envelope's signature does not verify");
+  return { manifest: new Uint8Array(bytes), keyId };
 }
 
 /** Verifies like the apps do: raw public key, base64 signature over the exact manifest bytes. */
@@ -226,17 +328,51 @@ export function updatesResource(
   platform: Platform,
   nativeApi: string | undefined,
   dev: boolean,
+  embeddedSequence = Math.floor(Date.now() / 1000),
 ): string {
   return JSON.stringify({
     app: app.id,
     version: app.version,
     platform,
     nativeApi: nativeApi ?? null,
-    embeddedSequence: Math.floor(Date.now() / 1000),
+    embeddedSequence,
     dev,
     url: updates.url,
-    publicKey: updates.publicKey,
+    protocol: platform === "ios" || platform === "android" ? 2 : 1,
+    publicKeys: updates.publicKeys,
+    
+    publicKey: updates.publicKeys[0],
     channel: updates.channel,
     readyTimeout: updates.readyTimeout,
+    ...(updates.reportUrl && (platform === "ios" || platform === "android") ? { reportUrl: updates.reportUrl } : {}),
   });
 }
+
+/**
+ * updates.json of a phone build, and the same facts in the build's bundle.json: a signer that registers the store build
+ * checks the binary reads its URL and keys, and takes `embeddedSequence` as the floor every release must pass.
+ */
+export function writePhoneUpdates(
+  path: string,
+  outDir: string,
+  updates: UpdatesConfig,
+  app: { id: string; version: string },
+  platform: "ios" | "android",
+  nativeApi: string | undefined,
+  dev: boolean,
+): void {
+  const embeddedSequence = Math.floor(Date.now() / 1000);
+  writeFileSync(path, updatesResource(updates, app, platform, nativeApi, dev, embeddedSequence));
+  const bundlePath = join(outDir, "bundle.json");
+  if (!existsSync(bundlePath)) return;
+  const bundle = JSON.parse(readFileSync(bundlePath, "utf8")) as Record<string, unknown>;
+  bundle.updates = {
+    protocol: 2,
+    url: updates.url,
+    channel: updates.channel,
+    keyIds: updates.publicKeys.map(keyIdOf),
+    embeddedSequence,
+    ...(updates.reportUrl ? { reportUrl: updates.reportUrl } : {}),
+  };
+  writeFileSync(bundlePath, `${JSON.stringify(bundle, null, 2)}\n`);
+}

package/vendor/@akanjs/native/packages/cli/src/lib/vectors.ts

@@ -14,6 +14,7 @@ export const VECTOR_FILES = [
   "acl",
   "retained",
   "ed25519",
+  "updates",
 ] as const;
 
 /**
@@ -33,6 +34,7 @@ export function vectorCounts(): Record<string, number> {
     acl: (v.acl.cases as { checks: unknown[] }[]).reduce((sum, c) => sum + 1 + c.checks.length, 0),
     retained: n(v.retained.cases),
     ed25519: n(v.ed25519.cases),
+    updates: n(v.updates.keyIds) + n(v.updates.decisions) + n(v.updates.urls),
   };
 }
 

package/vendor/@akanjs/native/packages/cli/src/platforms/android.ts

@@ -63,7 +63,7 @@ import { androidFeaturesFor, androidPermissionsFor } from "../lib/permissions.ts
 import { type AndroidSigning, type BuildContext, SigningError } from "../lib/prepare.ts";
 import type { AndroidManifest, ResolvedConfig } from "../lib/project.ts";
 import { PACKAGE_ROOT } from "../lib/root.ts";
-import { updatesResource } from "../lib/updates.ts";
+import { writePhoneUpdates } from "../lib/updates.ts";
 import { kotlinVectorData } from "../lib/vectors.ts";
 
 const SHELL_SRC = join(PACKAGE_ROOT, "native", "android", "src");
@@ -488,9 +488,14 @@ export async function buildAndroid(ctx: BuildContext): Promise<string> {
   const boot = makeNativeBoot(ctx, "android");
   writeFileSync(join(assets, "akan-native", "boot.json"), JSON.stringify(boot));
   if (config.updates)
-    writeFileSync(
+    writePhoneUpdates(
       join(assets, "akan-native", "updates.json"),
-      updatesResource(config.updates, config.app, "android", boot.nativeApi, ctx.dev),
+      ctx.outDir,
+      config.updates,
+      config.app,
+      "android",
+      boot.nativeApi,
+      ctx.dev,
     );
   writeFileSync(join(assets, "akan-native", "env.runtime.json"), JSON.stringify(ctx.env, null, 2));
   writeFileSync(
@@ -498,7 +503,7 @@ export async function buildAndroid(ctx: BuildContext): Promise<string> {
     JSON.stringify({
       backgroundColor: config.shell.backgroundColor,
       backgroundColorDark: config.shell.backgroundColorDark,
-      devtools: ctx.dev,
+      devtools: ctx.dev || config.shell.devtools,
       splash: { autoHide: config.splash.autoHide, timeout: config.splash.timeout },
       
       externalSchemes: config.security?.shell?.externalSchemes ?? [],

package/vendor/@akanjs/native/packages/cli/src/platforms/desktop-update.ts

@@ -95,7 +95,7 @@ export async function publishAppUpdate(
     build: (
       JSON.parse(readFileSync(join(resourcesOf(os, app), "updates.json"), "utf8")) as { embeddedSequence: number }
     ).embeddedSequence,
-    arch: hostArch(),
+    arch: ctx.arch ?? hostArch(),
     files: [{ path: basename(app), sha256: tarSha, size: tar.length }],
     archive: { sha256: tarSha, url: `app/${tarSha}.tar.gz`, size: gz.length, gzSha256: sha256(gz) },
     patches,

package/vendor/@akanjs/native/packages/cli/src/platforms/desktop.ts

@@ -232,7 +232,8 @@ export function writeDesktopResources(
         `the server's native addons would not load on a user's computer:\n  - ${addons.problems.join("\n  - ")}`,
       );
     cpSync(server.dir, join(resources, "server"), { recursive: true, verbatimSymlinks: true });
-    writeFileSync(join(resources, "server.json"), JSON.stringify({ entry: server.entry, env: server.env }));
+    const { entry, env, restart, watchdog } = server;
+    writeFileSync(join(resources, "server.json"), JSON.stringify({ entry, env, restart, watchdog }));
     writeFileSync(join(resources, "server.bunfig.toml"), "");
   }
   if (config.desktop.bin)
@@ -243,12 +244,13 @@ export function writeDesktopResources(
       title: config.app.name,
       backgroundColor: config.shell.backgroundColor,
       backgroundColorDark: config.shell.backgroundColorDark,
-      devtools: ctx.dev,
+      devtools: ctx.dev || config.shell.devtools,
       quitOnLastWindowClosed: config.desktop.quitOnLastWindowClosed,
       recovery: config.desktop.recovery,
       screenCapture: config.desktop.screenCapture,
       fullscreen: config.desktop.window.fullscreen,
       skipTaskbar: config.desktop.window.skipTaskbar,
+      frameless: config.desktop.window.frameless,
       
       deepLinks: config.deepLinks.schemes,
       

package/vendor/@akanjs/native/packages/cli/src/platforms/ios.ts

@@ -52,7 +52,7 @@ import { type BuildContext, SigningError } from "../lib/prepare.ts";
 import { privacyApiProblems, privacyManifest } from "../lib/privacy.ts";
 import type { IosManifest } from "../lib/project.ts";
 import { PACKAGE_ROOT } from "../lib/root.ts";
-import { updatesResource } from "../lib/updates.ts";
+import { writePhoneUpdates } from "../lib/updates.ts";
 import { swiftVectorData } from "../lib/vectors.ts";
 
 const SHELL_SRC = join(PACKAGE_ROOT, "native", "ios", "Sources");
@@ -192,9 +192,14 @@ export async function buildIos(ctx: BuildContext): Promise<string> {
   const boot = makeNativeBoot(ctx, "ios");
   writeFileSync(join(appPath, "boot.json"), JSON.stringify(boot));
   if (config.updates)
-    writeFileSync(
+    writePhoneUpdates(
       join(appPath, "updates.json"),
-      updatesResource(config.updates, config.app, "ios", boot.nativeApi, ctx.dev),
+      ctx.outDir,
+      config.updates,
+      config.app,
+      "ios",
+      boot.nativeApi,
+      ctx.dev,
     );
   writeFileSync(join(appPath, "env.runtime.json"), JSON.stringify(ctx.env, null, 2));
   writeFileSync(
@@ -202,7 +207,7 @@ export async function buildIos(ctx: BuildContext): Promise<string> {
     JSON.stringify({
       backgroundColor: config.shell.backgroundColor,
       backgroundColorDark: config.shell.backgroundColorDark,
-      devtools: ctx.dev,
+      devtools: ctx.dev || config.shell.devtools,
       splash: { autoHide: config.splash.autoHide, timeout: config.splash.timeout },
       
       externalSchemes: config.security?.shell?.externalSchemes ?? [],

package/vendor/@akanjs/native/packages/cli/src/platforms/windows-installer.ts

@@ -12,6 +12,11 @@ import { windowsVersion } from "./windows.ts";
 
 /** Microsoft's permanent link to the Evergreen Bootstrapper (MicrosoftEdgeWebview2Setup.exe). */
 export const WEBVIEW2_BOOTSTRAPPER_URL = "https://go.microsoft.com/fwlink/p/?LinkId=2124703";
+/** The Evergreen Standalone Installer per CPU (MicrosoftEdgeWebView2RuntimeInstaller<X64|ARM64>.exe). */
+export const WEBVIEW2_STANDALONE_URLS = {
+  x64: "https://go.microsoft.com/fwlink/?linkid=2124701",
+  arm64: "https://go.microsoft.com/fwlink/?linkid=2099616",
+} as const;
 /** The WebView2 Runtime's EdgeUpdate client id; its `pv` value is the installed version. */
 const WEBVIEW2_CLIENT = "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}";
 /** MAX_PATH less its NUL: what a PC without long paths enabled (the Windows default) can open or unpack. */
@@ -39,6 +44,8 @@ export interface InstallerInput {
   /** deepLinks.schemes: the uninstaller removes those the app registered for its own executable. */
   schemes: string[];
   icon?: string;
+  /** desktop.publisher: the Publisher Apps & features lists, and the setup program's company name. */
+  publisher?: string;
   bootstrapper: string;
   stopScript: string;
   outFile: string;
@@ -108,7 +115,7 @@ VIAddVersionKey "ProductName" "\${APP_NAME}"
 VIAddVersionKey "ProductVersion" "${nsis(input.version)}"
 VIAddVersionKey "FileVersion" "${version}"
 VIAddVersionKey "FileDescription" "\${APP_NAME} Setup"
-
+${input.publisher ? `VIAddVersionKey "CompanyName" "${nsis(input.publisher)}"\n` : ""}
 ${icon}!define MUI_FINISHPAGE_RUN "$INSTDIR\\\${EXE}"
 !insertmacro MUI_PAGE_INSTFILES
 !insertmacro MUI_PAGE_FINISH
@@ -399,7 +406,7 @@ ${moveIn(input.entries)}
   CreateShortcut "$SMPROGRAMS\\\${APP_NAME}.lnk" "$INSTDIR\\\${EXE}"
   WriteRegStr HKCU "\${UNINSTALL_KEY}" "DisplayName" "\${APP_NAME}"
   WriteRegStr HKCU "\${UNINSTALL_KEY}" "DisplayVersion" "${nsis(input.version)}"
-  WriteRegStr HKCU "\${UNINSTALL_KEY}" "DisplayIcon" "$INSTDIR\\\${EXE}"
+${input.publisher ? `  WriteRegStr HKCU "\${UNINSTALL_KEY}" "Publisher" "${nsis(input.publisher)}"\n` : ""}  WriteRegStr HKCU "\${UNINSTALL_KEY}" "DisplayIcon" "$INSTDIR\\\${EXE}"
   WriteRegStr HKCU "\${UNINSTALL_KEY}" "InstallLocation" "$INSTDIR"
   WriteRegStr HKCU "\${UNINSTALL_KEY}" "UninstallString" '"$INSTDIR.uninstall.exe"'
   WriteRegStr HKCU "\${UNINSTALL_KEY}" "QuietUninstallString" '"$INSTDIR.uninstall.exe" /S'
@@ -525,16 +532,22 @@ export function findMakensis(env: Record<string, string | undefined> = process.e
   return null;
 }
 
-/** The Evergreen Bootstrapper, downloaded once into the akan-native cache and checked. */
-async function webview2Bootstrapper(): Promise<string> {
-  const file = join(akanNativeHome(), "cache", "webview2", "MicrosoftEdgeWebview2Setup.exe");
+/** The WebView2 setup the installer embeds, downloaded once into the akan-native cache and checked. */
+async function webview2Setup(mode: "bootstrapper" | "standalone", arch: "x64" | "arm64"): Promise<string> {
+  const [name, url, minBytes] =
+    mode === "standalone"
+      ? [`MicrosoftEdgeWebView2RuntimeInstaller${arch.toUpperCase()}.exe`, WEBVIEW2_STANDALONE_URLS[arch], 50_000_000]
+      : ["MicrosoftEdgeWebview2Setup.exe", WEBVIEW2_BOOTSTRAPPER_URL, 100_000];
+  const file = join(akanNativeHome(), "cache", "webview2", name);
   if (!existsSync(file)) {
-    log.info(`downloading the WebView2 Evergreen Bootstrapper (${WEBVIEW2_BOOTSTRAPPER_URL})`);
-    const response = await fetch(WEBVIEW2_BOOTSTRAPPER_URL, { redirect: "follow" });
-    if (!response.ok) throw new CliError(`the WebView2 bootstrapper download answered ${response.status}`);
+    log.info(
+      `downloading the WebView2 ${mode === "standalone" ? `Runtime for ${arch}` : "Evergreen Bootstrapper"} (${url})`,
+    );
+    const response = await fetch(url, { redirect: "follow" });
+    if (!response.ok) throw new CliError(`the WebView2 ${mode} download answered ${response.status}`);
     const bytes = new Uint8Array(await response.arrayBuffer());
-    if (bytes.length < 100_000 || bytes[0] !== 0x4d || bytes[1] !== 0x5a)
-      throw new CliError("the WebView2 bootstrapper download is not a Windows program");
+    if (bytes.length < minBytes || bytes[0] !== 0x4d || bytes[1] !== 0x5a)
+      throw new CliError(`the WebView2 ${mode} download is not a Windows program`);
     mkdirSync(join(file, ".."), { recursive: true });
     writeFileSync(file, bytes);
   }
@@ -592,7 +605,7 @@ export async function buildWindowsInstaller(ctx: BuildContext, folder: string):
     log.warn(
       `${deepest} reaches about ${longest} characters under %LOCALAPPDATA%\\Programs while an update unpacks: Windows refuses paths over ${WINDOWS_MAX_PATH} unless long paths are enabled, so the installer or an update fails on such a PC. Shorten app.name or that path.`,
     );
-  const bootstrapper = await webview2Bootstrapper();
+  const bootstrapper = await webview2Setup(config.desktop.webview2, ctx.arch ?? hostArch());
   const size = folderSize(folder);
   writeFileSync(
     script,
@@ -607,6 +620,7 @@ export async function buildWindowsInstaller(ctx: BuildContext, folder: string):
       space: { install: size.disk, unpack: size.bytes + statSync(bootstrapper).size },
       schemes: config.deepLinks.schemes,
       ...(existsSync(icon) ? { icon } : {}),
+      ...(config.desktop.publisher ? { publisher: config.desktop.publisher } : {}),
       bootstrapper,
       stopScript,
       outFile,

package/vendor/@akanjs/native/packages/cli/src/platforms/windows.ts

@@ -35,6 +35,19 @@ export function windowsVersion(version: string, build: number): string {
   return [...parts, Math.max(0, Math.floor(build))].join(".");
 }
 
+export function windowsVersionInfo(
+  app: { name: string; version: string; build: number },
+  publisher?: string,
+): string[] {
+  return [
+    `--windows-title=${app.name}`,
+    `--windows-description=${app.name}`,
+    `--windows-version=${windowsVersion(app.version, app.build)}`,
+    
+    `--windows-publisher=${publisher ?? app.name}`,
+  ];
+}
+
 const exePath = (ctx: BuildContext, dir: string) => join(dir, `${ctx.project.config.app.fileName}.exe`);
 
 export async function buildWindows(ctx: BuildContext): Promise<string> {
@@ -57,9 +70,7 @@ export async function buildWindows(ctx: BuildContext): Promise<string> {
   const flags = [
     
     "--windows-hide-console",
-    `--windows-title=${config.app.name}`,
-    `--windows-description=${config.app.name}`,
-    `--windows-version=${windowsVersion(config.app.version, config.app.build)}`,
+    ...windowsVersionInfo(config.app, config.desktop.publisher),
   ];
   if (art) {
     const icon = join(outDir, "gen", "app.ico");

package/vendor/@akanjs/native/packages/core/src/kernel.ts

@@ -279,3 +279,52 @@ export function decideNavigation(
   if (!topLevel) return FRAME_SCHEMES.includes(scheme) ? "load" : "drop";
   return externalSchemes(extra).includes(scheme) ? "open" : "drop";
 }
+
+export interface UpdateDecisionInput {
+  /** The binary's keyIds, in `updates.publicKeys` order. */
+  ring: readonly string[];
+  /** keyIds state.json has revoked. */
+  revoked: readonly string[];
+  /** The envelope's keyId, whose signature over the manifest verified. */
+  signer: string;
+  revokeKeys: readonly string[];
+  resetSequence: boolean;
+  sequence: number;
+  /** The binary's own bundle (updates.json `embeddedSequence`). */
+  embedded: number;
+  /** The bundle running now, null for the binary's own. */
+  running: { sequence: number; keyId: string } | null;
+}
+
+export type UpdateDecision =
+  | { kind: "untrusted" | "revoked" | "self-revoke" | "revoke-later" }
+  | { kind: "take" | "stale"; baseline: number; revoke: string[] };
+
+/**
+ * Whether a web bundle manifest is taken (updates protocol v2, vectors/updates.json). A key may revoke only keys listed
+ * before it, so a leaked online key — listed first — cannot revoke the offline spares that recover from it, and
+ * `resetSequence` counts only on a manifest that newly revokes a key, so replaying it cannot roll anyone back. A bundle a
+ * revoked key signed sets no bar, and revocations apply even when the release itself is not newer.
+ */
+export function updateDecision(input: UpdateDecisionInput): UpdateDecision {
+  const { ring, revoked, signer, revokeKeys } = input;
+  const index = ring.indexOf(signer);
+  if (index < 0) return { kind: "untrusted" };
+  if (revoked.includes(signer)) return { kind: "revoked" };
+  if (revokeKeys.includes(signer)) return { kind: "self-revoke" };
+  if (revokeKeys.some((id) => ring.indexOf(id) > index)) return { kind: "revoke-later" };
+  const revoke = ring.filter((id) => revokeKeys.includes(id) && !revoked.includes(id));
+  const running = input.running && ![...revoked, ...revoke].includes(input.running.keyId) ? input.running.sequence : 0;
+  const baseline = input.resetSequence && revoke.length ? input.embedded : Math.max(input.embedded, running);
+  return { kind: input.sequence > baseline ? "take" : "stale", baseline, revoke };
+}
+
+/** One answer of updateDecision as the vectors write it. */
+export const updateDecisionWire = (decision: UpdateDecision) =>
+  decision.kind === "take" || decision.kind === "stale"
+    ? `${decision.kind}:${decision.baseline}:${decision.revoke.join(",")}`
+    : decision.kind;
+
+/** The v2 envelope of a channel for one native API: one file per binary generation, so each takes its own fixes. */
+export const updateManifestUrl = (url: string, platform: string, channel: string, nativeApi: string) =>
+  `${url}/${platform}/${channel}/${nativeApi}.json`;

package/vendor/@akanjs/native/packages/core/vectors/updates.json

@@ -0,0 +1,31 @@
+{
+  "about": "Web bundle updates, protocol v2 (architecture.md \"업데이트\"). keyIds: [raw Ed25519 public key in base64, its keyId: the first 8 bytes of its sha256 in hex]. decisions: [the binary's keyIds in updates.publicKeys order, keyIds state.json has revoked, the envelope's keyId, the manifest's revokeKeys, its resetSequence, its sequence, the binary's embeddedSequence, the running bundle as [sequence, keyId] or null for the app's own, the answer, why] for a manifest whose signature verified; the answer is untrusted | revoked | self-revoke | revoke-later, or take|stale:<the sequence it had to beat>:<keyIds it newly revokes, comma-separated>, revocations applying even to a stale manifest. urls: [updates.url, platform, channel, nativeApi, the envelope's URL].",
+  "keyIds": [
+    ["BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=", "4bb06f8e4e3a7715"],
+    ["11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=", "21fe31dfa154a261"],
+    ["AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", "66687aadf862bd77"]
+  ],
+  "decisions": [
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "a1a1a1a1a1a1a1a1", [], false, 200, 100, null, "take:100:", "signed by the first key, nothing running but the app's own bundle"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "d4d4d4d4d4d4d4d4", [], false, 200, 100, null, "untrusted", "a key the binary does not carry"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], ["a1a1a1a1a1a1a1a1"], "a1a1a1a1a1a1a1a1", [], false, 200, 100, null, "revoked", "a key revoked earlier signs nothing"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "b2b2b2b2b2b2b2b2", ["b2b2b2b2b2b2b2b2"], false, 200, 100, null, "self-revoke", "a key never revokes itself"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "a1a1a1a1a1a1a1a1", ["b2b2b2b2b2b2b2b2"], false, 200, 100, null, "revoke-later", "a key revokes only keys listed before it"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "b2b2b2b2b2b2b2b2", ["a1a1a1a1a1a1a1a1"], false, 300, 100, [500, "a1a1a1a1a1a1a1a1"], "take:100:a1a1a1a1a1a1a1a1", "the bundle a revoked key signed no longer sets the bar"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "b2b2b2b2b2b2b2b2", ["a1a1a1a1a1a1a1a1"], true, 300, 100, [500, "b2b2b2b2b2b2b2b2"], "take:100:a1a1a1a1a1a1a1a1", "resetSequence with a new revocation compares with the app's own bundle"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], ["a1a1a1a1a1a1a1a1"], "b2b2b2b2b2b2b2b2", ["a1a1a1a1a1a1a1a1"], true, 300, 100, [500, "b2b2b2b2b2b2b2b2"], "stale:500:", "replayed: nothing new revoked, so the reset does not apply"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "b2b2b2b2b2b2b2b2", ["a1a1a1a1a1a1a1a1", "d4d4d4d4d4d4d4d4"], false, 200, 100, null, "take:100:a1a1a1a1a1a1a1a1", "an id this binary does not carry is ignored"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "a1a1a1a1a1a1a1a1", [], false, 100, 100, null, "stale:100:", "no newer than the app's own bundle"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "a1a1a1a1a1a1a1a1", [], false, 150, 100, [150, "a1a1a1a1a1a1a1a1"], "stale:150:", "the bundle already running"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "c3c3c3c3c3c3c3c3", ["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2"], false, 120, 100, null, "take:100:a1a1a1a1a1a1a1a1,b2b2b2b2b2b2b2b2", "the last key revokes both before it"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "b2b2b2b2b2b2b2b2", ["a1a1a1a1a1a1a1a1", "a1a1a1a1a1a1a1a1"], false, 200, 100, null, "take:100:a1a1a1a1a1a1a1a1", "listed twice, revoked once"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "a1a1a1a1a1a1a1a1", [], false, 160, 100, [150, "b2b2b2b2b2b2b2b2"], "take:150:", "another trusted key's bundle sets the bar"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], ["a1a1a1a1a1a1a1a1"], "c3c3c3c3c3c3c3c3", ["b2b2b2b2b2b2b2b2"], false, 200, 100, [900, "a1a1a1a1a1a1a1a1"], "take:100:b2b2b2b2b2b2b2b2", "a bundle of a key revoked before still runs this session but sets no bar"],
+    [["a1a1a1a1a1a1a1a1", "b2b2b2b2b2b2b2b2", "c3c3c3c3c3c3c3c3"], [], "a1a1a1a1a1a1a1a1", [], true, 300, 100, [500, "a1a1a1a1a1a1a1a1"], "stale:500:", "resetSequence without a revocation does nothing"],
+    [["a1a1a1a1a1a1a1a1"], [], "a1a1a1a1a1a1a1a1", [], false, 200, 100, null, "take:100:", "a ring of one"]
+  ],
+  "urls": [
+    ["https://asset.akamir.com/ota/inst1/pathA", "ios", "main", "0123456789abcdef", "https://asset.akamir.com/ota/inst1/pathA/ios/main/0123456789abcdef.json"],
+    ["http://10.0.2.2:8790", "android", "pilot", "fedcba9876543210", "http://10.0.2.2:8790/android/pilot/fedcba9876543210.json"]
+  ]
+}

package/vendor/@akanjs/native/packages/desktop/src/main.ts

@@ -49,6 +49,7 @@ interface ShellConfig {
   /** desktop.window: the main window from its first frame, unless the launch phase says otherwise. */
   fullscreen?: boolean;
   skipTaskbar?: boolean;
+  frameless?: boolean;
 }
 
 const finite = (v: unknown): v is number => typeof v === "number" && Number.isFinite(v);
@@ -62,6 +63,7 @@ export function launchBounds(window: LaunchWindow): LaunchWindow {
   if (window.maximized === true) out.maximized = true;
   if (typeof window.fullscreen === "boolean") out.fullscreen = window.fullscreen;
   if (typeof window.skipTaskbar === "boolean") out.skipTaskbar = window.skipTaskbar;
+  if (typeof window.frameless === "boolean") out.frameless = window.frameless;
   return out;
 }
 
@@ -154,6 +156,7 @@ export async function startMain(workerUrl: string): Promise<never> {
     height: shell.height ?? 720,
     fullscreen: shell.fullscreen === true,
     skipTaskbar: shell.skipTaskbar === true,
+    frameless: shell.frameless === true,
     ...bounds,
     appDir: paths.appDir,
     initJs,

package/vendor/@akanjs/native/packages/desktop/src/plugin.ts

@@ -170,6 +170,8 @@ export interface LaunchWindow {
   fullscreen?: boolean;
   /** No taskbar button (Windows, Linux; macOS has none). */
   skipTaskbar?: boolean;
+  /** No title bar or border. */
+  frameless?: boolean;
 }
 
 /** What the launch phase decided; sent to the main thread with "ready". */