bleam 0.0.10 → 0.0.12

package/templates/updates/README.md

@@ -1,152 +1,75 @@
-# Bleam Update Service
+# Bleam OTA Update Service
 
-This Worker is the local proof for issues #14 and #15. It resolves public OTA
-and platform manifests from a local R2 simulation and serves release artifacts
-through opaque Bleam download URLs.
-
-It has no deployment command, no Cloudflare account ID, no remote binding, no
-publisher endpoint, and no authentication. Running it cannot create or mutate
-remote Cloudflare resources.
+This local-only Worker publishes and resolves OTA releases from an R2 simulation
+and serves their artifacts through opaque Bleam download URLs. It has no
+deployment command, Cloudflare account ID, remote binding, authentication, or
+remote publisher endpoint. Running it cannot mutate remote resources.
 
 ## Local Development
 
-The normal app workflow does not require a separate update-service command.
-`bleam dev` starts the packaged Worker automatically at
-`http://127.0.0.1:8787`, waits for `/v1/health`, and stops the Worker when the
-owning dev session exits. If a healthy Worker is already running, it is reused
-and left running.
-
-Local R2 state and Worker logs persist globally at:
+`bleam dev` normally starts the packaged Worker at `http://127.0.0.1:8787`,
+waits for `/v1/health`, and stops it with the owning dev session. Local state and
+logs persist at:
 
-```txt
+```text
 ~/Library/Caches/bleam/updates/state
 ~/Library/Caches/bleam/updates/worker.log
 ```
 
-Use Wrangler directly only while developing the update service itself.
-Wrangler 4.110.0 or newer is required:
+Use Wrangler directly only while developing this service. Wrangler 4.110.0 or
+newer is required:
 
 ```sh
 wrangler dev --config services/updates/wrangler.jsonc --local \
   --persist-to services/updates/.wrangler/state
 ```
 
-This repository-local R2 data lives under `services/updates/.wrangler/state`
-and is ignored by Git. Seed repository-local artifacts with Wrangler, always
-passing both `--local` and the same `--persist-to` directory:
-
-```sh
-wrangler r2 object put bleam-updates-local/releases/com.example.notes/ota/0.0.10.json \
-  --file release.json \
-  --local \
-  --persist-to services/updates/.wrangler/state \
-  --config services/updates/wrangler.jsonc
-```
-
-Run the end-to-end local proof with:
+Run the seeded R2 resolver and download smoke test with:
 
 ```sh
 sh services/updates/scripts/smoke.sh
 ```
 
-The smoke script creates temporary OTA and platform ZIP artifacts, seeds a
-temporary local R2 state directory, starts Wrangler on `127.0.0.1:8791`, and
-verifies both resolver routes, opaque artifact downloads, response hashes and
-sizes, and a missing-release `404`.
-
-Run the real CLI publication proof with:
+Run the real `bleam publish ota` publication and download loop with:
 
 ```sh
 sh services/updates/scripts/ota-e2e.sh
 ```
 
-This starts an isolated local Worker/R2 instance, creates a temporary Bleam
-project, runs `bleam publish ota`, resolves and downloads the published release,
-verifies its SHA-256, and extracts its `bundle/bundle.js` payload.
-
-Publish a signed full-app platform archive from a configured project with:
-
-```sh
-bleam publish platform --service-url http://127.0.0.1:8787
-```
-
-This runs the standalone Release build, packages the signed app as
-`bleam-macos-app-zip-v1`, validates the declared bytes and SHA-256 through the
-local service, and activates the stable `macos-arm64` resolver record.
-
-With a configured Apple development team, run the full standalone lifecycle:
+With a configured Apple development team, the installed-app harness validates
+next-launch OTA activation, successful startup confirmation, rejection of a
+hash-valid broken bundle, and fallback to the embedded bundle:
 
 ```sh
 sh services/updates/scripts/ota-installed-e2e.sh
 ```
 
-This builds and launches an isolated signed app, confirms an OTA download and
-next-launch activation, publishes a hash-valid broken bundle, and confirms the
-following launch rejects it and returns to the embedded bundle. It also verifies
-the app's per-user helper remains registered with launchd after the app quits.
-Finally, it publishes the signed app as a platform release, verifies and caches
-it through the dedicated helper, applies Update and Relaunch, checks the rollback
-backup and replacement receipt, validates the installed app and helper
-signatures, and confirms a moved copy cannot self-update.
-
-Before a release, run the same lifecycle with clean-state preflight and cleanup
-assertions:
-
-```sh
-sh services/updates/scripts/platform-release-readiness.sh
-```
-
-This refuses existing state for the isolated test identity and verifies the app,
-preferences, caches, helper copy, LaunchAgent, launchd registration, and update
-receipts are absent again after the lifecycle. A release still requires this
-check on a separate clean Mac; the local harness cannot substitute for fresh
-hardware and user-account validation.
+The installed-app harness builds and launches an isolated signed app. It is not
+part of the normal service test suite and should only be run when native testing
+is intended.
 
-## Public API
+## API
 
 ```text
+GET /v1/health
 GET /v1/apps/:bundleIdentifier/ota/:runtimeVersion
-GET /v1/apps/:bundleIdentifier/platform/macos-arm64
 GET /v1/downloads/:downloadId
 POST /v1/local/releases/ota
-POST /v1/local/releases/platform
 ```
 
-The POST routes are accepted only on `localhost` and exist solely for local
-publishing development. They validate the release record, artifact byte size,
-and SHA-256 before writing the immutable artifact and activating its matching
-resolver record.
-
-`bundleIdentifier` is the Bleam app identity. A release manifest always binds
-it to the Apple `teamIdentifier`; the Worker validates both from the stored
-record before it responds.
+The POST route accepts only `localhost` requests. It validates the manifest,
+artifact byte size, and SHA-256 before writing the immutable artifact and
+activating its runtime-specific resolver record.
 
-Resolver responses are `Cache-Control: no-store` because release activation
-and future rollout decisions must remain server-controlled. Download IDs are
-immutable, so artifact responses are cacheable and use one-year immutable
-caching. The R2 object key is present only in the internal download record.
+Resolver responses use `Cache-Control: no-store`. Opaque download IDs are
+immutable, so artifact responses use one-year immutable caching. R2 object keys
+remain private in internal download records.
 
 ## Manifest Contract
 
-### Terminology
-
-- An **OTA update** replaces the app's JavaScript bundle and assets without
-  replacing the installed `.app`.
-- A **platform update** replaces the complete signed `.app`, including the
-  Bleam runtime, helper, native APIs, and native dependencies.
-- The **runtime version** identifies the native environment required by an OTA
-  release. Compatibility is an exact string match.
-- A **release manifest** describes one immutable artifact. A **resolver record**
-  selects the currently active release for an app, channel, and target.
-- A release is **staged** after its artifact has been downloaded, verified, and
-  extracted. It becomes active on the next cold launch.
-
-Both release forms use `schemaVersion: 1`, `channel: "stable"`, a unique
-`releaseId`, `bundleIdentifier`, `teamIdentifier`, `publishedAt`, and an
-artifact containing its format, opaque `downloadId`, exact byte size, lowercase
-SHA-256 digest, and the resolver-provided download URL.
-
-OTA releases add `bundleVersion` and an exact `runtimeVersion`:
+An OTA release replaces JavaScript and ordinary application assets without
+replacing the installed app. Its `runtimeVersion` is the exact native runtime it
+requires.
 
 ```json
 {
@@ -157,7 +80,7 @@ OTA releases add `bundleVersion` and an exact `runtimeVersion`:
   "channel": "stable",
   "releaseId": "ota_release_01",
   "bundleVersion": "1.2.0+4",
-  "runtimeVersion": "0.0.10",
+  "runtimeVersion": "0.0.12",
   "artifact": {
     "format": "bleam-ota-zip-v1",
     "downloadId": "ota_release_01",
@@ -169,104 +92,25 @@ OTA releases add `bundleVersion` and an exact `runtimeVersion`:
 }
 ```
 
-Platform releases add signed-app identity and target metadata:
-
-```json
-{
-  "schemaVersion": 1,
-  "kind": "platform",
-  "bundleIdentifier": "com.example.notes",
-  "teamIdentifier": "ABCDE12345",
-  "channel": "stable",
-  "releaseId": "platform_release_01",
-  "appVersion": "1.3.0",
-  "buildNumber": "5",
-  "bleamPlatformVersion": "0.0.10",
-  "platformFingerprint": "82a09a48ea84e66a65615e30f0f62b7c10f2d5137f4eafa67ca44d90bd9c8823",
-  "redeploy": false,
-  "target": {
-    "os": "macos",
-    "architecture": "arm64",
-    "installLocation": "user-applications",
-    "minimumMacOSVersion": "13.4"
-  },
-  "artifact": {
-    "format": "bleam-macos-app-zip-v1",
-    "downloadId": "platform_release_01",
-    "url": "http://127.0.0.1:8787/v1/downloads/platform_release_01",
-    "sizeBytes": 182743921,
-    "sha256": "ab851b776c2656b3725a31882ca8a9bf0e64ae508703a32cd4f8400eb1bdc6ec"
-  },
-  "publishedAt": "2026-07-12T16:00:00Z"
-}
-```
-
-### Platform Feed And Archive
-
-The initial platform feed is the stable, Apple-silicon resolver at
-`GET /v1/apps/:bundleIdentifier/platform/macos-arm64`. It returns only releases
-targeting `macos`, `arm64`, and the `user-applications` install location. The
-helper must reject a release whose app version is not semantic, whose build
-number is not decimal, or whose minimum macOS version exceeds the current OS.
-
-`platformFingerprint` is a deterministic SHA-256 over Bleam runtime identity
-and supported signed bundle inputs. It excludes developer TypeScript and
-ordinary OTA assets. Local publication rejects an unchanged fingerprint unless
-the manifest records an explicit `redeploy: true`; redeployment does not bypass
-artifact or installed-app verification. Legacy manifests without a fingerprint
-remain readable only so their next normal publication can establish one.
-
-`bleam-macos-app-zip-v1` is a ZIP containing exactly one top-level `app/`
-directory and exactly one complete `.app` beneath it:
-
-```text
-app/<display name>.app/
-```
-
-The archive must not contain another top-level entry, multiple app bundles,
-absolute paths, or entries that escape `app/` through `..` or symlink traversal.
-The helper extracts into the app-specific cache, never directly into
-`~/Applications`, and treats the extracted bundle as untrusted until checkpoint
-verification of SHA-256, bundle ID, team ID, app/build versions, architecture,
-and code signature succeeds. The release ID and artifact download ID are
-immutable; changing app bytes requires a new release and download ID.
-
-The R2 layout is internal:
+The stored manifest omits only the resolver-provided artifact URL. The internal
+R2 layout is:
 
 ```text
 releases/<bundleIdentifier>/ota/<runtimeVersion>.json
-releases/<bundleIdentifier>/platform/macos-arm64.json
 downloads/<downloadId>.json
-artifacts/<private release path>
+artifacts/ota/<downloadId>.zip
 ```
 
 ## Verification And Recovery
 
-Publication validates the manifest schema, declared artifact byte size, and
-SHA-256 before activating a resolver record. The app repeats size and SHA-256
-verification after download and rejects mismatched artifacts before extraction.
-Both release types bind the artifact to a bundle identifier and Apple team
-identifier. OTA releases additionally require the app's exact runtime version.
+Publication verifies the declared artifact size and SHA-256 before activating a
+resolver record. The app repeats both checks after download and requires exact
+bundle identifier, Apple team identifier, and runtime version compatibility.
 
 OTA bundles are cached under
-`~/Library/Caches/Bleam/OTA/<bundleIdentifier>/<releaseId>/`. The active release
-ID is stored separately from the bundle so an incomplete download cannot become
-active. A staged release is selected only on a later cold launch and is marked
-as attempted before React Native starts.
-
-Startup is confirmed when React Native reports either JavaScript loading on the
-bridge runtime or root content appearing on Fabric. If the app exits or the
-bundle fails before confirmation, the next launch rejects that release, clears
-its active and attempted state, and loads the embedded `main.jsbundle`. A
-rejected release is not selected again while it remains the resolver's active
-release.
-
-Platform artifacts are downloaded and applied by the per-app helper. It verifies
-the artifact hash, archive layout, bundle and team identity, app and build
-versions, Bleam runtime and platform fingerprint, arm64 architecture, code
-signature, and minimum macOS version before replacement. Hosted authentication,
-ownership, entitlement, and deployment remain separate follow-up work.
-
-Standalone builds configured with `BLEAM_UPDATE_SERVICE_URL` check the matching
-OTA resolver after React starts. A verified release is cached for the next cold
-launch and follows the activation and recovery behavior above.
+`~/Library/Caches/Bleam/OTA/<bundleIdentifier>/<releaseId>/`. A verified release
+is selected only on a later cold launch and marked attempted before React Native
+starts. After startup confirmation, the attempted state is cleared. If startup
+fails first, the following launch rejects the release, clears its active state,
+and loads the embedded bundle. A rejected release is not selected again while
+it remains active in the resolver.

package/templates/updates/src/index.ts

@@ -1,11 +1,9 @@
 import {
-  compareRuntimeVersions,
   type DownloadRecord,
   isBundleIdentifier,
   isDownloadId,
   isRuntimeVersion,
   parseDownloadRecord,
-  parsePublishedRelease,
   parseStoredRelease,
   resolveRelease,
   type StoredRelease,
@@ -89,11 +87,7 @@ async function sha256(bytes: Uint8Array) {
   ).join('')
 }
 
-async function publishLocalRelease(
-  request: Request,
-  bucket: UpdatesBucket,
-  expectedKind: StoredRelease['kind'],
-) {
+async function publishLocalRelease(request: Request, bucket: UpdatesBucket) {
   if (!isLocalRequest(request)) return notFound(request.method)
 
   let input: Record<string, unknown>
@@ -108,10 +102,7 @@ async function publishLocalRelease(
   }
 
   try {
-    const release = parsePublishedRelease(input.release)
-    if (release.kind !== expectedKind) {
-      return error('invalid_request', 400, request.method)
-    }
+    const release = parseStoredRelease(input.release)
     const artifact = base64Bytes(input.artifactBase64)
     if (artifact.byteLength !== release.artifact.sizeBytes) {
       return error('invalid_request', 400, request.method)
@@ -120,37 +111,9 @@ async function publishLocalRelease(
       return error('invalid_request', 400, request.method)
     }
 
-    const releaseKey =
-      release.kind === 'ota'
-        ? `releases/${release.bundleIdentifier}/ota/${release.runtimeVersion}.json`
-        : `releases/${release.bundleIdentifier}/platform/macos-arm64.json`
-    if (release.kind === 'platform') {
-      const currentValue = await readStoredJson(bucket, releaseKey)
-      const current = currentValue
-        ? parseStoredRelease(currentValue)
-        : undefined
-      const unchanged =
-        current?.kind === 'platform' &&
-        current.platformFingerprint !== undefined &&
-        current.platformFingerprint === release.platformFingerprint
-      if (
-        current?.kind === 'platform' &&
-        compareRuntimeVersions(
-          release.bleamPlatformVersion,
-          current.bleamPlatformVersion,
-        ) < 0
-      ) {
-        return error('platform_downgrade', 409, request.method)
-      }
-      if (unchanged && !release.redeploy) {
-        return error('platform_unchanged', 409, request.method)
-      }
-      if (!unchanged && release.redeploy) {
-        return error('redeploy_not_required', 400, request.method)
-      }
-    }
+    const releaseKey = `releases/${release.bundleIdentifier}/ota/${release.runtimeVersion}.json`
 
-    const artifactKey = `artifacts/${release.kind}/${release.artifact.downloadId}.zip`
+    const artifactKey = `artifacts/ota/${release.artifact.downloadId}.zip`
     const download: DownloadRecord = {
       schemaVersion: 1,
       downloadId: release.artifact.downloadId,
@@ -246,38 +209,6 @@ async function resolveOta(
   }
 }
 
-async function resolvePlatform(
-  bucket: UpdatesBucket,
-  request: Request,
-  bundleIdentifier: string,
-  target: string,
-  method: string,
-) {
-  if (!isBundleIdentifier(bundleIdentifier) || target !== 'macos-arm64') {
-    return notFound(method)
-  }
-
-  const stored = await readStoredJson(
-    bucket,
-    `releases/${bundleIdentifier}/platform/${target}.json`,
-  )
-  if (!stored) return notFound(method)
-
-  try {
-    const release = parseStoredRelease(stored)
-    if (
-      release.kind !== 'platform' ||
-      release.bundleIdentifier !== bundleIdentifier ||
-      `${release.target.os}-${release.target.architecture}` !== target
-    ) {
-      return unavailable(method)
-    }
-    return releaseResponse(release, request, method)
-  } catch {
-    return unavailable(method)
-  }
-}
-
 async function downloadArtifact(
   bucket: UpdatesBucket,
   downloadId: string,
@@ -322,13 +253,7 @@ export default {
       request.method === 'POST' &&
       url.pathname === '/v1/local/releases/ota'
     ) {
-      return publishLocalRelease(request, env.UPDATES, 'ota')
-    }
-    if (
-      request.method === 'POST' &&
-      url.pathname === '/v1/local/releases/platform'
-    ) {
-      return publishLocalRelease(request, env.UPDATES, 'platform')
+      return publishLocalRelease(request, env.UPDATES)
     }
 
     if (request.method !== 'GET' && request.method !== 'HEAD') {
@@ -356,24 +281,6 @@ export default {
       )
     }
 
-    if (
-      path.length === 5 &&
-      path[0] === 'v1' &&
-      path[1] === 'apps' &&
-      path[3] === 'platform'
-    ) {
-      const bundleIdentifier = decodedSegment(path[2])
-      const target = decodedSegment(path[4])
-      if (!bundleIdentifier || !target) return notFound(method)
-      return resolvePlatform(
-        env.UPDATES,
-        request,
-        bundleIdentifier,
-        target,
-        method,
-      )
-    }
-
     if (path.length === 3 && path[0] === 'v1' && path[1] === 'downloads') {
       const downloadId = decodedSegment(path[2])
       if (!downloadId) return notFound(method)