feat(diff): record copiesCrc for every copied entry in package diffs

Same-path copies previously carried no content checksum, so a client
applying a pdiff on a rebuilt binary could copy a path-matched but
content-drifted resource unverified (BUNDLEHASH_MIGRATION.md §4.2.1).
Existing clients only consult copiesCrc when the path lookup fails, so
the extra entries are backward-compatible; verification lands with the
client-side consumer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sunnylqm

src/diff.ts

@@ -663,11 +663,14 @@ async function diffFromPackage(
 
   let originSource: BundleSource | undefined;
 
-  // Content checksum (CRC32) for entries that are copied from a *different*
-  // path in the origin package ("moved" entries). On Android these are the
-  // res/ drawables (images), whose on-device path differs between an APK
-  // baseline and an AAB(split-apk) install due to resource path shortening,
-  // so the client cannot locate them by path and must fall back to content.
+  // Content checksum (CRC32) for every copied entry, keyed by target path.
+  // Two consumers on the client: locating a file by content when its origin
+  // path is not present verbatim on device (APK baseline diff applied on an
+  // AAB/split-apk install whose res/ paths were shortened), and verifying
+  // that a path-matched file still has the expected bytes before copying
+  // (BUNDLEHASH_MIGRATION.md §4.2.1 — a rebuilt binary may keep the path but
+  // drift the content; mismatch must fall back to full instead of silently
+  // installing a wrong resource).
   const copiesCrc: Record<string, number> = {};
 
   await enumZipEntries(origin, async (entry, zipFile) => {
@@ -723,15 +726,13 @@ async function diffFromPackage(
       // If same file.
       if (originEntries[entry.fileName] === entry.crc32) {
         copies[entry.fileName] = '';
+        copiesCrc[entry.fileName] = entry.crc32;
         return;
       }
       // If moved from other place
       const movedFrom = originMap[entry.crc32];
       if (movedFrom) {
         copies[entry.fileName] = movedFrom;
-        // Record the content checksum so the client can locate this file by
-        // content when the origin path does not exist verbatim on device
-        // (APK baseline -> AAB install path shortening).
         copiesCrc[entry.fileName] = entry.crc32;
         return;
       }

tests/diff.test.ts

@@ -452,7 +452,7 @@ describe('diff commands', () => {
     expect(result.files['assets/new.txt']?.toString('utf-8')).toBe('new-file');
   });
 
-  test('hdiffFromApk emits copiesCrc for moved (res/) entries only', async () => {
+  test('hdiffFromApk emits copiesCrc for every copied entry', async () => {
     const originPath = path.join(tempRoot, 'origin-crc.apk');
     const nextPath = path.join(tempRoot, 'next-crc.ppk');
     const outputPath = path.join(tempRoot, 'out', 'apk-crc-diff.ppk');
@@ -506,9 +506,16 @@ describe('diff commands', () => {
       'res/drawable-xhdpi-v4/x.webp',
     );
     expect(diffMeta.copiesCrc['drawable-xhdpi/x.webp']).toBe(originImageCrc);
-    // same-path asset -> no crc needed (efficiency: only moved entries get one)
+    // same-path asset -> crc recorded too, so the client can verify a
+    // path-matched file before copying (rebuilt binary may drift content)
+    let keepCrc = -1;
+    await enumZipEntries(originPath, async (entry) => {
+      if (entry.fileName === 'assets/keep.txt') {
+        keepCrc = entry.crc32;
+      }
+    });
     expect(diffMeta.copies['assets/keep.txt']).toBe('');
-    expect(diffMeta.copiesCrc['assets/keep.txt']).toBeUndefined();
+    expect(diffMeta.copiesCrc['assets/keep.txt']).toBe(keepCrc);
   });
 
   test('hdiffFromApk does not match OTA files against excluded native entries', async () => {