akanjs 3.1.1-rc.7 → 3.1.1-rc.9

package/index.ts

@@ -127,20 +127,20 @@ export interface AkanNativeDeepLinks {
  */
 export interface AkanNativeUpdatesConfig {
   /**
-   * A static base URL, https in a release build, with no query: `<url>/<os>-<arch>/<channel>.json` (desktop) or
+   * A static base URL, https in a release build, with no query: `<url>/<os>-<arch>/<channel>/app.json` (desktop) or
    * `<url>/<platform>/<channel>/<nativeApi>.json` (a phone's web bundle, one envelope per binary generation).
    */
   url: string;
   /**
-   * The keys a phone binary trusts, raw 32-byte Ed25519 public keys in base64 (`akan update-keygen` prints one), 1 to
-   * 3: the online signing key first, offline spares after it, since a key may revoke only keys listed before it. A
-   * desktop app trusts the first.
+   * The keys a binary trusts, raw 32-byte Ed25519 public keys in base64 (`akan update-keygen` prints one), 1 to 3:
+   * the online signing key first, offline spares after it, since a key may revoke only keys listed before it. A desktop
+   * app built before protocol v2 trusts the first.
    */
   publicKeys?: string[];
   /** The one-key form of `publicKeys`, never beside it: a target overriding native.updates' keys keeps its form. */
   publicKey?: string;
   /**
-   * keyIds every phone release revokes (`akan update-keygen` prints a key's), kept here so a release published from a
+   * keyIds every release revokes (`akan update-keygen` prints a key's), kept here so a release published from a
    * fresh checkout still revokes them; `akan publish-update --revoke` starts a revocation. A key may revoke only keys
    * listed before it in publicKeys, so a release is signed with one listed after them.
    */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.1.1-rc.7",
+  "version": "3.1.1-rc.9",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/types/index.d.ts

@@ -113,20 +113,20 @@ export interface AkanNativeDeepLinks {
  */
 export interface AkanNativeUpdatesConfig {
     /**
-     * A static base URL, https in a release build, with no query: `<url>/<os>-<arch>/<channel>.json` (desktop) or
+     * A static base URL, https in a release build, with no query: `<url>/<os>-<arch>/<channel>/app.json` (desktop) or
      * `<url>/<platform>/<channel>/<nativeApi>.json` (a phone's web bundle, one envelope per binary generation).
      */
     url: string;
     /**
-     * The keys a phone binary trusts, raw 32-byte Ed25519 public keys in base64 (`akan update-keygen` prints one), 1 to
-     * 3: the online signing key first, offline spares after it, since a key may revoke only keys listed before it. A
-     * desktop app trusts the first.
+     * The keys a binary trusts, raw 32-byte Ed25519 public keys in base64 (`akan update-keygen` prints one), 1 to 3:
+     * the online signing key first, offline spares after it, since a key may revoke only keys listed before it. A desktop
+     * app built before protocol v2 trusts the first.
      */
     publicKeys?: string[];
     /** The one-key form of `publicKeys`, never beside it: a target overriding native.updates' keys keeps its form. */
     publicKey?: string;
     /**
-     * keyIds every phone release revokes (`akan update-keygen` prints a key's), kept here so a release published from a
+     * keyIds every release revokes (`akan update-keygen` prints a key's), kept here so a release published from a
      * fresh checkout still revokes them; `akan publish-update --revoke` starts a revocation. A key may revoke only keys
      * listed before it in publicKeys, so a release is signed with one listed after them.
      */

package/types/vendor/@akanjs/native/packages/cli/src/api.d.ts

@@ -18,7 +18,7 @@ export type { UpdateEnvelope, UpdateFile, UpdateManifest } from "./lib/updates.t
  * A phone's update protocol as the apps run it, for a signer or a server that checks what it publishes or registers:
  * the envelope's verification, the keyId of a public key, and what a verified manifest means to a binary.
  */
-export { keyIdOf, openEnvelope } from "./lib/updates.ts";
+export { keyIdOf, openEnvelope, verifyManifest } from "./lib/updates.ts";
 export type { AkanNativeConfig, AndroidSigning, DesktopArch, Device, DeviceSelector, DoctorCheck, IosBuild, IosSigning, IosSigningResult, LinuxBuild, LogEvent, MacosBuild, MacosNotarization, MacosSigning, TargetPlatform, WindowsBuild, WindowsSigning, };
 /**
  * The macOS signing and notarization the AKAN_NATIVE_MACOS_* variables name, for a caller that keeps them in its
@@ -27,7 +27,7 @@ export type { AkanNativeConfig, AndroidSigning, DesktopArch, Device, DeviceSelec
 /** The Authenticode settings the AKAN_NATIVE_WINDOWS_* variables name: pass the result as `windows.signing`. */
 export { macosDistributionFromEnv, requestedDistribution, windowsSigningFromEnv };
 /** semver of this API. A caller checks the major before it relies on anything here. */
-export declare const API_VERSION = "0.12.0";
+export declare const API_VERSION = "0.13.0";
 export type AkanNativeErrorCode = "CONFIG_INVALID" | "TOOLCHAIN_MISSING" | "WEB_INPUT_INVALID" | "WEB_BUILD_FAILED" | "NATIVE_BUILD_FAILED" | "SIGNING_FAILED" | "DEVICE_FAILED" | "CANCELLED" | "INTERNAL";
 export declare class AkanNativeError extends Error {
     readonly code: AkanNativeErrorCode;
@@ -159,17 +159,17 @@ export interface PublishCheckOptions extends Pick<TaskOptions, "appDir" | "confi
     /** A desktop release's CPU, which names its feed folder: this computer's by default. */
     arch?: DesktopArch;
     /**
-     * A phone release: keyIds of updates.publicKeys it starts revoking, beside updates.revokedKeys and what the channel's
-     * releases revoke. It is signed with a key listed after every key it revokes.
+     * keyIds of updates.publicKeys the release starts revoking, beside updates.revokedKeys and what the channel's releases
+     * revoke. It is signed with a key listed after every key it revokes.
      */
     revoke?: string[];
-    /** A phone release that revokes a key: phones compare it with their own bundle instead of the running one. */
+    /** A release that revokes a key: apps compare it with their own build instead of the running release. */
     resetSequence?: boolean;
 }
 /**
  * What publishUpdate() refuses before it builds, without building (CONFIG_INVALID): no updates settings, a channel no
  * app could be configured for, no signing key on this machine or another app's, a desktop release whose server
- * presence is not the channel's previous release's, and a phone release whose revocations no phone would take. For a
+ * presence is not the channel's previous release's, and a release whose revocations no app would take. For a
  * caller with a long build of its own before publishUpdate.
  */
 export declare function checkPublishUpdate(options: PublishCheckOptions): {
@@ -177,8 +177,8 @@ export declare function checkPublishUpdate(options: PublishCheckOptions): {
     out: string;
 };
 /**
- * A signed release for the updates plugin (UP-1, UP-2): a release build, then `<channel>.json`, its signature and
- * its files under `out` (default <appDir>/.akan/native/updates), signed with the key updateKeygen() made.
+ * A signed release for the updates plugin (UP-1, UP-2): a release build, then its envelope and its files under `out`
+ * (default <appDir>/.akan/native/updates), signed with the key updateKeygen() made.
  */
 export declare function publishUpdate(options: TaskOptions & {
     platform: Exclude<TargetPlatform, "web">;
@@ -190,9 +190,9 @@ export declare function publishUpdate(options: TaskOptions & {
     windows?: Pick<WindowsBuild, "signing">;
     /** A desktop release's CPU, of the same OS: an x64 release from an arm64 machine. Default this computer's. */
     arch?: DesktopArch;
-    /** A phone release: keyIds of updates.publicKeys it starts revoking (PublishCheckOptions.revoke). */
+    /** keyIds of updates.publicKeys the release starts revoking (PublishCheckOptions.revoke). */
     revoke?: string[];
-    /** A phone release that revokes a key: phones compare it with their own bundle instead of the running one. */
+    /** A release that revokes a key: apps compare it with their own build instead of the running release. */
     resetSequence?: boolean;
 }): Promise<PublishResult>;
 /**

package/types/vendor/@akanjs/native/packages/cli/src/config.d.ts

@@ -115,17 +115,17 @@ export interface AkanNativeConfig {
     /**
      * Over-the-air updates (UP-2 web bundles on iOS / Android, UP-1 app updates on macOS), used by
      * @akanjs/native/plugins/updates. `akan-native update keygen` makes the signing key and prints its public key;
-     * `akan-native update publish <platform>` writes signed releases for `url`. `publicKeys` lists the keys a phone
+     * `akan-native update publish <platform>` writes signed releases for `url`. `publicKeys` lists the keys an app
      * trusts, the online signing key first and offline spares after (a key revokes only keys before it); `publicKey` is
-     * the one-key form, and a desktop app trusts the first. `report.url` is where a phone posts what became of each
-     * release, at its next launch or return to the foreground.
+     * the one-key form, and a desktop app built before protocol v2 trusts the first. `report.url` is where a phone posts
+     * what became of each release, at its next launch or return to the foreground.
      */
     updates?: {
         url: string;
         publicKey?: string;
         publicKeys?: string[];
         /**
-         * keyIds every phone release revokes (`update keygen` prints a key's), kept here so a release published from a fresh
+         * keyIds every release revokes (`update keygen` prints a key's), kept here so a release published from a fresh
          * folder still revokes them; `update publish --revoke` starts a revocation. A key may revoke only keys listed
          * before it in publicKeys, so a release is signed with one listed after them.
          */
@@ -135,6 +135,11 @@ export interface AkanNativeConfig {
         report?: {
             url: string;
         };
+        /**
+         * The release target a desktop binary is built for: its manifests name it and the app takes only its own, so a
+         * release signed for one target cannot be served to another's apps. akan sets the native target's name.
+         */
+        target?: string;
     };
     /** Links that open the app, delivered through the app plugin's urlOpen (and getLaunchUrl). */
     deepLinks?: {

package/types/vendor/@akanjs/native/packages/cli/src/lib/publish.d.ts

@@ -5,7 +5,7 @@ export interface PublishedRelease {
     /** `<out>/<os>-<arch>` for a desktop app, `<out>/<platform>` for a phone's web bundle. */
     dir: string;
     manifest: UpdateManifest;
-    /** The file installed apps read: `<dir>/<channel>.json`, or a phone's `<dir>/<channel>/<nativeApi>.json`. */
+    /** The envelope installed apps read: a desktop's `<dir>/<channel>/app.json`, a phone's `<dir>/<channel>/<nativeApi>.json`. */
     file: string;
 }
 /**
@@ -22,23 +22,19 @@ export declare function assertServerOfChannel(config: {
         server?: unknown;
     };
 }, platform: ReleasePlatform, out: string, channel: string, arch?: DesktopArch): void;
-/**
- * Refuses before the build a release that could not be signed: no key on this machine, another app's, or for a desktop
- * app one the app does not trust (it trusts the first of updates.publicKeys).
- */
+/** Refuses before the build a release that could not be signed: no key on this machine, or another app's. */
 export declare function assertSigningKey(config: {
     app: {
         id: string;
     };
     updates?: {
         publicKeys: string[];
-        revokedKeys?: readonly string[];
     } | null;
-}, platform?: ReleasePlatform): void;
+}): void;
 export interface RevocationRequest {
     /** keyIds of updates.publicKeys this release starts revoking (`update publish --revoke`). */
     revoke?: readonly string[];
-    /** With a revocation, a phone compares the release with its own bundle instead of the running one. */
+    /** With a revocation, an app compares the release with its own build instead of the running release. */
     resetSequence?: boolean;
 }
 interface RevocationConfig {
@@ -51,16 +47,20 @@ interface RevocationConfig {
     } | null;
 }
 /**
- * The revokeKeys and resetSequence of a phone release of `channel` under `out`: updates.revokedKeys, what the channel's
- * releases revoke, and `revoke`, since a phone that never saw a revocation (a new install, cleared data) learns it only
+ * The revokeKeys and resetSequence of a release of `channel` under `out`: updates.revokedKeys, what the channel's
+ * releases revoke, and `revoke`, since an app that never saw a revocation (a new install, cleared data) learns it only
  * from a later manifest. Refuses a `revoke` the ring does not hold, more keys than a manifest may revoke, a reset that
- * revokes nothing, and a signing key the release revokes or that is listed before a key it revokes: every phone would
+ * revokes nothing, and a signing key the release revokes or that is listed before a key it revokes: every app would
  * refuse that manifest, since a key may revoke only keys listed before it.
  */
-export declare function releaseRevocations(config: RevocationConfig, platform: ReleasePlatform, out: string, channel: string, { revoke, resetSequence }?: RevocationRequest): {
+export declare function releaseRevocations(config: RevocationConfig, platform: ReleasePlatform, out: string, channel: string, { revoke, resetSequence }?: RevocationRequest, arch?: DesktopArch): {
     revokeKeys: string[];
     resetSequence: boolean;
 };
-/** Writes the release of `artifact` (the app a release build made) and its signed manifest under `out`. */
+/**
+ * Writes the release of `artifact` (the app a release build made) and its envelope under `out`. A desktop release also
+ * gets the v1 pair when signed with the first key, the only one an app built before protocol v2 trusts: that is how
+ * such an app takes a binary that reads envelopes.
+ */
 export declare function publishRelease(ctx: BuildContext, platform: ReleasePlatform, artifact: string, out: string, channel: string, request?: RevocationRequest): Promise<PublishedRelease>;
 export {};

package/types/vendor/@akanjs/native/packages/cli/src/lib/updates.d.ts

@@ -3,17 +3,22 @@ export interface UpdatesConfig {
     /** Base URL of the update files, e.g. "https://example.com/updates". http:// only for localhost / 10.0.2.2 in dev builds. */
     url: string;
     /**
-     * Raw 32-byte Ed25519 public keys, base64 (`akan-native update keygen` prints one): the keys a phone binary trusts, the
+     * Raw 32-byte Ed25519 public keys, base64 (`akan-native update keygen` prints one): the keys a binary trusts, the
      * online signing key first and offline spares after it, since a key may revoke only keys listed before it. A desktop
-     * app trusts the first.
+     * app built before protocol v2 trusts the first.
      */
     publicKeys: string[];
     /**
-     * keyIds every phone release revokes, kept in the config so a release published from another folder (a fresh CI
-     * checkout) still revokes them. `akan-native update publish --revoke` starts a revocation. A phone build trusts none
-     * of them, though publicKeys still lists them.
+     * keyIds every release revokes, kept in the config so a release published from another folder (a fresh CI checkout)
+     * still revokes them. `akan-native update publish --revoke` starts a revocation. A build trusts none of them, though
+     * publicKeys still lists them.
      */
     revokedKeys: string[];
+    /**
+     * The release target a desktop binary is built for (akan's native target): its manifests name it and the app takes
+     * only its own, so a release signed for one target cannot be served to another's apps. null: the manifest names none.
+     */
+    target: string | null;
     /** Manifest name under <platform>/. Default "production". */
     channel: string;
     /** How long a newly applied bundle has to call notifyReady() before it is rolled back, ms. Default 10000. */
@@ -31,7 +36,7 @@ export type DesktopArch = "arm64" | "x64";
 /** The CPU of the desktop apps this machine builds (cargo and bun build for the host). */
 export declare function hostArch(): DesktopArch;
 export interface UpdateManifest {
-    /** 2 for a phone's web bundle, which travels in an UpdateEnvelope; 1 for a desktop app. */
+    /** 2 for a release in an UpdateEnvelope (a phone's web bundle, a desktop app); 1 for a desktop app's v1 pair. */
     schema: 1 | 2;
     kind: "web" | "app";
     app: string;
@@ -67,12 +72,17 @@ export interface UpdateManifest {
     }[];
     /** App updates: whether the app carries a server; an installed app refuses a release that differs from itself. */
     server?: boolean;
-    /** Web bundles: keyIds the phone stops trusting for good; each listed before the signer's key in its updates.publicKeys. */
+    /** App updates of schema 2: updates.target of the apps the release is for; absent when that is null. */
+    target?: string;
+    /** Schema 2: keyIds the app stops trusting for good; each listed before the signer's key in its updates.publicKeys. */
     revokeKeys?: string[];
-    /** Web bundles: with a new revocation, compare this release with the binary's own bundle instead of the running one. */
+    /** Schema 2: with a new revocation, compare this release with the binary's own bundle instead of the running one. */
     resetSequence?: boolean;
 }
-/** A phone's `<platform>/<channel>/<nativeApi>.json`: one object, so a new manifest never meets an old signature. */
+/**
+ * A phone's `<platform>/<channel>/<nativeApi>.json` or a desktop app's `<os>-<arch>/<channel>/app.json`: one object, so
+ * a new manifest never meets an old signature.
+ */
 export interface UpdateEnvelope {
     /** The manifest's exact bytes, base64. */
     manifest: string;
@@ -146,10 +156,10 @@ export declare function updatesResource(updates: UpdatesConfig, app: {
     version: string;
 }, platform: Platform, nativeApi: string | undefined, dev: boolean, embeddedSequence?: number): string;
 /**
- * The keys a phone build trusts: updates.publicKeys without the revoked ones, so a fresh install trusts none of them
- * before its first release tells it. A manifest that revokes a key the binary does not hold is still taken.
+ * The keys a build trusts: updates.publicKeys without the revoked ones, so a fresh install trusts none of them before
+ * its first release tells it. A manifest that revokes a key the binary does not hold is still taken.
  */
-export declare const phoneRing: (updates: Pick<UpdatesConfig, "publicKeys" | "revokedKeys">) => string[];
+export declare const updateRing: (updates: Pick<UpdatesConfig, "publicKeys" | "revokedKeys">) => string[];
 /**
  * updates.json of a phone build, and the same facts in the build's bundle.json: a signer that registers the store build
  * checks the binary reads its URL and keys, and takes `embeddedSequence` as the floor every release must pass.

package/types/vendor/@akanjs/native/packages/cli/src/platforms/desktop-update.d.ts

@@ -1,6 +1,11 @@
 import type { BuildContext } from "../lib/prepare.ts";
 import { type UpdateManifest } from "../lib/updates.ts";
 import { type DesktopOs } from "./desktop.ts";
+/**
+ * The release of `channel` in `dir`: the manifest of its envelope, else the v1 `<channel>.json` of a folder published
+ * before protocol v2. Read unverified, as the publisher's own folder.
+ */
+export declare function publishedApp(dir: string, channel: string): Partial<UpdateManifest> | null;
 /**
  * An installed app refuses a release whose server presence is not its own (plugins/updates): published, this one would
  * be refused by every app the channel reached, and so would every release after it. A manifest from before the field

package/types/vendor/@akanjs/native/packages/core/src/kernel.d.ts

@@ -146,8 +146,19 @@ export declare function updateDecision(input: UpdateDecisionInput): UpdateDecisi
 export declare const updateDecisionWire: (decision: UpdateDecision) => string;
 /** The v2 envelope of a channel for one native API: one file per binary generation, so each takes its own fixes. */
 export declare const updateManifestUrl: (url: string, platform: string, channel: string, nativeApi: string) => string;
+/**
+ * A desktop app's v2 envelope of a channel: the whole app is one release per OS and CPU, so one file. `app` is a
+ * reserved channel name, since `<os>-<arch>/app/` holds the archives.
+ */
+export declare const appManifestUrl: (url: string, os: string, arch: string, channel: string) => string;
 /** An envelope's signer or a revokeKeys entry: the first 8 bytes of the raw public key's SHA-256, in hex. */
 export declare const isUpdateKeyId: (s: string) => boolean;
+/**
+ * Whether a base64 string is an Ed25519 public key a release may be signed for: strict base64 of 32 bytes, the
+ * canonical encoding of a curve point (RFC 8032 §5.1.3, y < p and no negative zero), not of small order. A small-order
+ * key verifies signatures nobody made with a private key, so a config listing one would trust forged releases.
+ */
+export declare function isUpdatePublicKey(key: string): boolean;
 /** The most keys a manifest may revoke: every host refuses a longer revokeKeys. */
 export declare const MAX_REVOKE_KEYS = 16;
 /** The largest manifest an envelope may carry, in bytes. */

package/types/vendor/@akanjs/native/plugins/updates/src/desktop.d.ts

@@ -7,7 +7,14 @@ export interface UpdatesConfig {
     nativeApi: string | null;
     embeddedSequence: number;
     url: string;
-    publicKey: string;
+    /** 2: envelopes signed by any key of `publicKeys`; absent, the v1 pair signed by `publicKey`. */
+    protocol?: number;
+    /** v2: the keys of updates.publicKeys this build trusts, revoked ones left out. */
+    publicKeys?: string[];
+    /** The first of updates.publicKeys, the one key v1 trusts. */
+    publicKey?: string;
+    /** v2: updates.target, which a release must name; absent, it must name none. */
+    target?: string;
     channel: string;
     readyTimeout: number;
 }

package/vendor/@akanjs/native/packages/cli/src/api.ts

@@ -76,7 +76,7 @@ export type { UpdateEnvelope, UpdateFile, UpdateManifest } from "./lib/updates.t
  * A phone's update protocol as the apps run it, for a signer or a server that checks what it publishes or registers:
  * the envelope's verification, the keyId of a public key, and what a verified manifest means to a binary.
  */
-export { keyIdOf, openEnvelope } from "./lib/updates.ts";
+export { keyIdOf, openEnvelope, verifyManifest } from "./lib/updates.ts";
 export type {
   AkanNativeConfig,
   AndroidSigning,
@@ -104,7 +104,7 @@ export type {
 export { macosDistributionFromEnv, requestedDistribution, windowsSigningFromEnv };
 
 /** semver of this API. A caller checks the major before it relies on anything here. */
-export const API_VERSION = "0.12.0";
+export const API_VERSION = "0.13.0";
 
 export type AkanNativeErrorCode =
   | "CONFIG_INVALID"
@@ -326,18 +326,18 @@ export interface PublishCheckOptions extends Pick<TaskOptions, "appDir" | "confi
   /** A desktop release's CPU, which names its feed folder: this computer's by default. */
   arch?: DesktopArch;
   /**
-   * A phone release: keyIds of updates.publicKeys it starts revoking, beside updates.revokedKeys and what the channel's
-   * releases revoke. It is signed with a key listed after every key it revokes.
+   * keyIds of updates.publicKeys the release starts revoking, beside updates.revokedKeys and what the channel's releases
+   * revoke. It is signed with a key listed after every key it revokes.
    */
   revoke?: string[];
-  /** A phone release that revokes a key: phones compare it with their own bundle instead of the running one. */
+  /** A release that revokes a key: apps compare it with their own build instead of the running release. */
   resetSequence?: boolean;
 }
 
 /**
  * What publishUpdate() refuses before it builds, without building (CONFIG_INVALID): no updates settings, a channel no
  * app could be configured for, no signing key on this machine or another app's, a desktop release whose server
- * presence is not the channel's previous release's, and a phone release whose revocations no phone would take. For a
+ * presence is not the channel's previous release's, and a release whose revocations no app would take. For a
  * caller with a long build of its own before publishUpdate.
  */
 export function checkPublishUpdate(options: PublishCheckOptions): { channel: string; out: string } {
@@ -352,8 +352,8 @@ export function checkPublishUpdate(options: PublishCheckOptions): { channel: str
   try {
     if (options.channel !== undefined) assertChannel(options.channel);
     const target = { app: options.config.app, updates };
-    assertSigningKey(target, options.platform);
-    releaseRevocations(target, options.platform, out, channel, options);
+    assertSigningKey(target);
+    releaseRevocations(target, options.platform, out, channel, options, options.arch);
     const server = options.server ?? !!options.config.desktop?.server;
     assertServerOfChannel({ desktop: server ? { server } : {} }, options.platform, out, channel, options.arch);
   } catch (error) {
@@ -363,8 +363,8 @@ export function checkPublishUpdate(options: PublishCheckOptions): { channel: str
 }
 
 /**
- * A signed release for the updates plugin (UP-1, UP-2): a release build, then `<channel>.json`, its signature and
- * its files under `out` (default <appDir>/.akan/native/updates), signed with the key updateKeygen() made.
+ * A signed release for the updates plugin (UP-1, UP-2): a release build, then its envelope and its files under `out`
+ * (default <appDir>/.akan/native/updates), signed with the key updateKeygen() made.
  */
 export function publishUpdate(
   options: TaskOptions & {
@@ -377,9 +377,9 @@ export function publishUpdate(
     windows?: Pick<WindowsBuild, "signing">;
     /** A desktop release's CPU, of the same OS: an x64 release from an arm64 machine. Default this computer's. */
     arch?: DesktopArch;
-    /** A phone release: keyIds of updates.publicKeys it starts revoking (PublishCheckOptions.revoke). */
+    /** keyIds of updates.publicKeys the release starts revoking (PublishCheckOptions.revoke). */
     revoke?: string[];
-    /** A phone release that revokes a key: phones compare it with their own bundle instead of the running one. */
+    /** A release that revokes a key: apps compare it with their own build instead of the running release. */
     resetSequence?: boolean;
   },
 ): Promise<PublishResult> {

package/vendor/@akanjs/native/packages/cli/src/commands/update.ts

@@ -64,16 +64,11 @@ async function publish(args: ParsedArgs, request: RevocationRequest): Promise<nu
   const requested = stringFlag(args, "channel");
   if (requested !== undefined) assertChannel(requested);
   const project = await loadProject(findAppDir(stringFlag(args, "app") ?? process.cwd()));
-  assertSigningKey(project.config, platform);
+  assertSigningKey(project.config);
   const planned = requested ?? project.config.updates?.channel ?? "production";
-  assertServerOfChannel(
-    project.config,
-    platform,
-    outDir(args, project.appDir),
-    planned,
-    desktopArch(platform, stringFlag(args, "arch") as DesktopArch | undefined),
-  );
-  releaseRevocations(project.config, platform, outDir(args, project.appDir), planned, request);
+  const arch = desktopArch(platform, stringFlag(args, "arch") as DesktopArch | undefined);
+  assertServerOfChannel(project.config, platform, outDir(args, project.appDir), planned, arch);
+  releaseRevocations(project.config, platform, outDir(args, project.appDir), planned, request, arch);
   const { ctx, artifact } = await buildFromArgs(
     { positional: [platform], flags: args.flags },
     { mode: "production", profile: "release" },

package/vendor/@akanjs/native/packages/cli/src/config.ts

@@ -115,17 +115,17 @@ export interface AkanNativeConfig {
   /**
    * Over-the-air updates (UP-2 web bundles on iOS / Android, UP-1 app updates on macOS), used by
    * @akanjs/native/plugins/updates. `akan-native update keygen` makes the signing key and prints its public key;
-   * `akan-native update publish <platform>` writes signed releases for `url`. `publicKeys` lists the keys a phone
+   * `akan-native update publish <platform>` writes signed releases for `url`. `publicKeys` lists the keys an app
    * trusts, the online signing key first and offline spares after (a key revokes only keys before it); `publicKey` is
-   * the one-key form, and a desktop app trusts the first. `report.url` is where a phone posts what became of each
-   * release, at its next launch or return to the foreground.
+   * the one-key form, and a desktop app built before protocol v2 trusts the first. `report.url` is where a phone posts
+   * what became of each release, at its next launch or return to the foreground.
    */
   updates?: {
     url: string;
     publicKey?: string;
     publicKeys?: string[];
     /**
-     * keyIds every phone release revokes (`update keygen` prints a key's), kept here so a release published from a fresh
+     * keyIds every release revokes (`update keygen` prints a key's), kept here so a release published from a fresh
      * folder still revokes them; `update publish --revoke` starts a revocation. A key may revoke only keys listed
      * before it in publicKeys, so a release is signed with one listed after them.
      */
@@ -133,6 +133,11 @@ export interface AkanNativeConfig {
     channel?: string;
     readyTimeout?: number;
     report?: { url: string };
+    /**
+     * The release target a desktop binary is built for: its manifests name it and the app takes only its own, so a
+     * release signed for one target cannot be served to another's apps. akan sets the native target's name.
+     */
+    target?: string;
   };
   /** Links that open the app, delivered through the app plugin's urlOpen (and getLaunchUrl). */
   deepLinks?: {

package/vendor/@akanjs/native/packages/cli/src/lib/configkeys.ts

@@ -20,7 +20,16 @@ const KNOWN: Shape = {
   usageDescriptions: true,
   privacy: { tracking: true, trackingDomains: true, collectedDataTypes: true, accessedApis: true },
   permissions: { camera: true, microphone: true, location: true },
-  updates: { url: true, publicKey: true, publicKeys: true, channel: true, readyTimeout: true, report: { url: true } },
+  updates: {
+    url: true,
+    publicKey: true,
+    publicKeys: true,
+    revokedKeys: true,
+    channel: true,
+    readyTimeout: true,
+    report: { url: true },
+    target: true,
+  },
   deepLinks: { schemes: true, domains: { "[]": { host: true, pathPrefixes: true } } },
   native: {
     ios: { infoPlist: true, entitlements: true },