fb5-patch-pkg: every release zip carries MANIFEST.json (size + sha256 of each shipped non-art file, written after npm ci; the full, lite and update zips of a version list the same), and node tools/package.mjs --update --from <base>[,<base>…] builds Stronghold-Protocol-v<version>-update.zip — the full stage built as before, compared file by file with every base (an earlier full zip or its extracted folder; tools/package-update.mjs reads zips itself, zip64 included), shipping each file that is new or differs from at least one base plus MANIFEST.json and UPDATE.json (from, count, bytes, files, removed with each base's bytes); bases must be older, full (not lite or update) and distinct; the update stage gets the refusal and personal-info checks (sha256 values left out of the name scan); test/update-package.test.js (8), test/package.test.js expects MANIFEST.json in the zip

test/package.test.js

@@ -247,7 +247,8 @@ test('a --no-install build of the temporary checkout zips exactly the plan in on
     assert.deepEqual(fs.readdirSync(out), [path.basename(zip)], 'the stage is removed after zipping');
     if (hasUnzip) {
       const entries = spawnSync('unzip', ['-Z1', zip], { encoding: 'utf8' }).stdout.split('\n').filter((l) => l && !l.endsWith('/'));
-      assert.deepEqual(entries.sort(), [...SHIPPED_TRACKED, ...ART].map((f) => `${FOLDER}/${f}`).sort());
+      // and MANIFEST.json, written after npm ci (server/update.js; test/update-package.test.js checks its content)
+      assert.deepEqual(entries.sort(), [...SHIPPED_TRACKED, ...ART, 'MANIFEST.json'].map((f) => `${FOLDER}/${f}`).sort());
     }
     const again = runTool(['--root', dir, '--out', out, '--no-install', '--allow-dirty']);
     assert.equal(again.status, 1, 'an existing zip is not replaced without --force');