@drops-it/dpm 1.0.6 → 1.1.5

package/dist/runtime.d.ts

@@ -0,0 +1,39 @@
+import type { DpmConfig } from "./config.js";
+/** Pinned managed runtime version (oven-sh/bun release tag without prefix). */
+export declare const RUNTIME_VERSION = "1.2.19";
+export declare function managedRuntimePath(): string;
+/**
+ * Ensures the managed DPM runtime binary exists at a stable path.
+ * Downloads a pinned release from GitHub when missing or version-mismatched.
+ */
+export declare function ensureRuntime(): Promise<string>;
+/**
+ * Resolves a runnable runtime path: managed binary, else PATH fallback branded as DPM.
+ */
+export declare function resolveRuntime(): Promise<string>;
+export type SpawnRuntimeOptions = {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    /** Extra args after the runtime binary (e.g. ["install"], ["run", "start"]). */
+    args: string[];
+    /** When true, pipe + rewrite stdout/stderr so bun never leaks into the UI. */
+    brandOutput?: boolean;
+};
+/**
+ * Spawns the managed runtime with inherited stdio and returns the exit code.
+ * With `brandOutput`, both stdout and stderr are piped, branded, and each
+ * write starts on a clean line so it never glues onto a DPM spinner.
+ */
+export declare function spawnRuntime(opts: SpawnRuntimeOptions): Promise<number>;
+/**
+ * Resolves the install registry URL.
+ * DPM hosts use the `/npm` facade; bootstrap / this app monorepo / npmjs → public npm.
+ */
+export declare function resolveInstallRegistryUrl(registry: string, cwd?: string): string;
+/**
+ * Writes project-local registry config so the runtime installer hits the DPM npm facade
+ * (or public npm when bootstrapping / installing this app monorepo).
+ */
+export declare function ensureInstallConfig(config: DpmConfig, cwd?: string): Promise<void>;
+/** Builds npm_config_* env for a one-shot install without relying only on files. */
+export declare function runtimeInstallEnv(config: DpmConfig, cwd?: string): NodeJS.ProcessEnv;

package/dist/runtime.js

@@ -0,0 +1,279 @@
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { access, chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { homedir, platform, tmpdir } from "node:os";
+import path from "node:path";
+/** Public npm — used when this app must install while its own registry is offline. */
+const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
+/** Pinned managed runtime version (oven-sh/bun release tag without prefix). */
+export const RUNTIME_VERSION = "1.2.19";
+const RUNTIME_NAME = process.platform === "win32" ? "dpm-runtime.exe" : "dpm-runtime";
+function runtimeRoot() {
+    if (process.env.DPM_RUNTIME_DIR)
+        return process.env.DPM_RUNTIME_DIR;
+    if (process.platform === "win32") {
+        const base = process.env.LOCALAPPDATA || path.join(homedir(), "AppData", "Local");
+        return path.join(base, "Programs", "DPM", "runtime");
+    }
+    return path.join(homedir(), ".dpm", "runtime");
+}
+export function managedRuntimePath() {
+    return path.join(runtimeRoot(), RUNTIME_NAME);
+}
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function assetForPlatform() {
+    const os = platform();
+    const arch = process.arch;
+    if (os === "win32") {
+        return {
+            asset: arch === "arm64" ? "bun-windows-x64.zip" : "bun-windows-x64.zip",
+            isZip: true,
+        };
+    }
+    if (os === "darwin") {
+        return {
+            asset: arch === "arm64" ? "bun-darwin-aarch64.zip" : "bun-darwin-x64.zip",
+            isZip: true,
+        };
+    }
+    // linux
+    if (arch === "arm64") {
+        return { asset: "bun-linux-aarch64.zip", isZip: true };
+    }
+    return { asset: "bun-linux-x64.zip", isZip: true };
+}
+function releaseUrl(asset) {
+    return `https://github.com/oven-sh/bun/releases/download/bun-v${RUNTIME_VERSION}/${asset}`;
+}
+async function downloadFile(url, dest) {
+    const res = await fetch(url, {
+        headers: { "user-agent": "dpm-runtime-installer" },
+        redirect: "follow",
+    });
+    if (!res.ok) {
+        throw new Error(`DPM runtime download failed (${res.status}).`);
+    }
+    await mkdir(path.dirname(dest), { recursive: true });
+    await writeFile(dest, Buffer.from(await res.arrayBuffer()));
+}
+async function extractZip(zipPath, destDir) {
+    await mkdir(destDir, { recursive: true });
+    if (process.platform === "win32") {
+        const ps = `
+$ErrorActionPreference = 'Stop'
+Expand-Archive -LiteralPath '${zipPath.replace(/'/g, "''")}' -DestinationPath '${destDir.replace(/'/g, "''")}' -Force
+`;
+        execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { windowsHide: true, stdio: "ignore" });
+    }
+    else {
+        execFileSync("unzip", ["-o", zipPath, "-d", destDir], { stdio: "ignore" });
+    }
+    const walk = (dir) => {
+        for (const name of readdirSync(dir)) {
+            const full = path.join(dir, name);
+            const st = statSync(full);
+            if (st.isDirectory()) {
+                const found = walk(full);
+                if (found)
+                    return found;
+            }
+            else if (/^bun(\.exe)?$/i.test(name)) {
+                return full;
+            }
+        }
+        return null;
+    };
+    const binary = walk(destDir);
+    if (!binary)
+        throw new Error("DPM runtime archive did not contain a binary.");
+    return binary;
+}
+/**
+ * Ensures the managed DPM runtime binary exists at a stable path.
+ * Downloads a pinned release from GitHub when missing or version-mismatched.
+ */
+export async function ensureRuntime() {
+    if (process.env.DPM_RUNTIME && (await exists(process.env.DPM_RUNTIME))) {
+        return process.env.DPM_RUNTIME;
+    }
+    const target = managedRuntimePath();
+    const versionFile = path.join(runtimeRoot(), "version");
+    if (await exists(target) && (await exists(versionFile))) {
+        const v = (await readFile(versionFile, "utf8")).trim();
+        if (v === RUNTIME_VERSION)
+            return target;
+    }
+    const { asset } = assetForPlatform();
+    const url = releaseUrl(asset);
+    const tmpDir = path.join(tmpdir(), `dpm-runtime-${Date.now()}`);
+    await mkdir(tmpDir, { recursive: true });
+    const zipPath = path.join(tmpDir, asset);
+    try {
+        process.stderr.write("Installing DPM runtime…\n");
+        await downloadFile(url, zipPath);
+        const extracted = await extractZip(zipPath, path.join(tmpDir, "out"));
+        await mkdir(runtimeRoot(), { recursive: true });
+        const tmpTarget = `${target}.tmp`;
+        await rm(tmpTarget, { force: true });
+        // copy via read/write for cross-device moves
+        const data = await readFile(extracted);
+        await writeFile(tmpTarget, data);
+        if (process.platform !== "win32")
+            await chmod(tmpTarget, 0o755);
+        await rm(target, { force: true });
+        await rename(tmpTarget, target);
+        await writeFile(versionFile, `${RUNTIME_VERSION}\n`);
+        return target;
+    }
+    finally {
+        await rm(tmpDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Resolves a runnable runtime path: managed binary, else PATH fallback branded as DPM.
+ */
+export async function resolveRuntime() {
+    try {
+        return await ensureRuntime();
+    }
+    catch (err) {
+        const fallback = process.platform === "win32" ? "bun.exe" : "bun";
+        const which = spawnSync(process.platform === "win32" ? "where" : "which", [fallback.replace(/\.exe$/, "")], {
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        if (which.status === 0 && which.stdout?.trim()) {
+            return which.stdout.trim().split(/\r?\n/)[0];
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`DPM runtime is not available (${msg}). Re-run the DPM installer or set DPM_RUNTIME.`);
+    }
+}
+/** Rewrites managed-runtime banners so users only see DPM branding. */
+function brandText(text) {
+    return text
+        .replace(/\bBun\b/g, "DPM")
+        .replace(/\bbun\b/g, "dpm");
+}
+/**
+ * Spawns the managed runtime with inherited stdio and returns the exit code.
+ * With `brandOutput`, both stdout and stderr are piped, branded, and each
+ * write starts on a clean line so it never glues onto a DPM spinner.
+ */
+export async function spawnRuntime(opts) {
+    const bin = await resolveRuntime();
+    const env = {
+        ...process.env,
+        ...opts.env,
+        // Keep npm-compatible clients pointed at DPM when nested tools spawn.
+        npm_config_registry: opts.env?.npm_config_registry ?? process.env.npm_config_registry,
+    };
+    return new Promise((resolve, reject) => {
+        const brand = Boolean(opts.brandOutput);
+        const child = spawn(bin, opts.args, {
+            cwd: opts.cwd ?? process.cwd(),
+            env,
+            stdio: brand ? ["inherit", "pipe", "pipe"] : "inherit",
+            windowsHide: true,
+        });
+        let needClear = brand;
+        const writeBranded = (stream, chunk) => {
+            let text = brandText(chunk.toString("utf8"));
+            if (!text)
+                return;
+            if (needClear) {
+                // Drop any leftover `\r`-style status line before the first child byte.
+                stream.write("\r\x1b[2K");
+                needClear = false;
+            }
+            // If a chunk starts mid-line after a previous incomplete write, keep as-is;
+            // only force a newline when the previous paint left the cursor mid-status.
+            stream.write(text);
+        };
+        if (brand && child.stdout) {
+            child.stdout.on("data", (chunk) => {
+                writeBranded(process.stdout, chunk);
+            });
+        }
+        if (brand && child.stderr) {
+            child.stderr.on("data", (chunk) => {
+                writeBranded(process.stderr, chunk);
+            });
+        }
+        child.on("error", reject);
+        child.on("close", (code) => resolve(code ?? 1));
+    });
+}
+/**
+ * True for the DPM registry app monorepo (`package.json` name dpm + private).
+ * That tree must install from public npm — its own /npm façade is down during restart.
+ */
+function isDpmAppMonorepo(cwd) {
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf8"));
+        return pkg.name === "dpm" && pkg.private === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolves the install registry URL.
+ * DPM hosts use the `/npm` facade; bootstrap / this app monorepo / npmjs → public npm.
+ */
+export function resolveInstallRegistryUrl(registry, cwd = process.cwd()) {
+    if (isDpmAppMonorepo(cwd))
+        return PUBLIC_NPM_REGISTRY;
+    const base = registry.replace(/\/$/, "").replace(/\/npm$/i, "");
+    const usePublicNpm = process.env.DPM_BOOTSTRAP === "1" ||
+        process.env.DPM_USE_NPM_UPSTREAM === "1" ||
+        /registry\.npmjs\.org/i.test(base);
+    if (usePublicNpm)
+        return PUBLIC_NPM_REGISTRY;
+    return `${base}/npm/`;
+}
+/**
+ * Writes project-local registry config so the runtime installer hits the DPM npm facade
+ * (or public npm when bootstrapping / installing this app monorepo).
+ */
+export async function ensureInstallConfig(config, cwd = process.cwd()) {
+    const registryUrl = resolveInstallRegistryUrl(config.registry, cwd);
+    const host = new URL(registryUrl).host;
+    const pathPrefix = registryUrl.includes("/npm") ? "/npm" : "";
+    const token = registryUrl.includes("registry.npmjs.org")
+        ? ""
+        : (config.token ?? "");
+    const npmrcLines = [
+        `registry=${registryUrl}`,
+        `//${host}${pathPrefix}/:_authToken=${token}`,
+    ];
+    await writeFile(path.join(cwd, ".npmrc"), `${npmrcLines.join("\n")}\n`, {
+        mode: 0o600,
+    });
+    const bunfig = `[install]
+registry = "${registryUrl}"
+`;
+    await writeFile(path.join(cwd, "bunfig.toml"), bunfig);
+}
+/** Builds npm_config_* env for a one-shot install without relying only on files. */
+export function runtimeInstallEnv(config, cwd = process.cwd()) {
+    const registryUrl = resolveInstallRegistryUrl(config.registry, cwd);
+    const useToken = !registryUrl.includes("registry.npmjs.org") && config.token;
+    return {
+        npm_config_registry: registryUrl,
+        ...(useToken
+            ? {
+                npm_config__authToken: config.token,
+                BUN_CONFIG_TOKEN: config.token,
+            }
+            : {}),
+    };
+}

package/dist/updateCheck.d.ts

@@ -1,7 +1,7 @@
-export declare const CLI_NAME: string;
+export declare const CLI_NAME = "@drops-it/dpm";
 export declare const CLI_VERSION: string;
 /**
  * On the first dpm command in a new terminal session, checks the DPM registry
- * for a newer CLI and prints how to update with dpm. Never blocks on failure.
+ * for a newer CLI and prints a one-line hint (non-blocking on failure).
  */
 export declare function maybeNotifyUpdate(): Promise<void>;

package/dist/updateCheck.js

@@ -1,17 +1,55 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import semver from "semver";
 import { c } from "./colors.js";
 import { loadConfig } from "./config.js";
-const require = createRequire(import.meta.url);
-const pkg = require("../package.json");
-export const CLI_NAME = pkg.name;
-export const CLI_VERSION = pkg.version;
+/**
+ * Resolves CLI version from esbuild inject, nearby package.json (npm layout),
+ * or a safe fallback — never throws at import time.
+ */
+function resolveCliVersion() {
+    // Windows single-file bundle: esbuild define replaces this identifier.
+    try {
+        const injected = new Function("return typeof __DPM_CLI_VERSION__ !== 'undefined' ? __DPM_CLI_VERSION__ : undefined")();
+        if (typeof injected === "string" && injected.length > 0)
+            return injected;
+    }
+    catch {
+        /* not injected (tsc / npm dist) */
+    }
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    for (const file of [
+        path.join(here, "..", "package.json"),
+        path.join(here, "package.json"),
+    ]) {
+        try {
+            const pkg = JSON.parse(readFileSync(file, "utf8"));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    try {
+        const req = createRequire(import.meta.url);
+        const pkg = req("../package.json");
+        if (pkg.version)
+            return pkg.version;
+    }
+    catch {
+        /* bundled exe has no sibling package.json */
+    }
+    return "1.1.5";
+}
+export const CLI_NAME = "@drops-it/dpm";
+export const CLI_VERSION = resolveCliVersion();
 const STATE_DIR = path.join(homedir(), ".dpm");
 const STATE_PATH = path.join(STATE_DIR, "update-check.json");
-/** Identifies the current terminal so we only notify once per new shell. */
 function sessionKey() {
     const parts = [`ppid:${process.ppid}`];
     if (process.env.WT_SESSION)
@@ -22,11 +60,12 @@ function sessionKey() {
 }
 async function loadState() {
     try {
-        const raw = JSON.parse(await readFile(STATE_PATH, "utf8"));
-        if (Array.isArray(raw.sessions)) {
-            return { sessions: raw.sessions.slice(-40), latest: raw.latest };
-        }
-        return { sessions: [], latest: raw.latest };
+        const raw = await readFile(STATE_PATH, "utf8");
+        const parsed = JSON.parse(raw);
+        return {
+            sessions: Array.isArray(parsed.sessions) ? parsed.sessions : [],
+            latest: parsed.latest,
+        };
     }
     catch {
         return { sessions: [] };
@@ -34,48 +73,44 @@ async function loadState() {
 }
 async function saveState(state) {
     await mkdir(STATE_DIR, { recursive: true });
-    await writeFile(STATE_PATH, JSON.stringify({ sessions: state.sessions.slice(-40), latest: state.latest }), { mode: 0o600 });
+    await writeFile(STATE_PATH, JSON.stringify(state), { mode: 0o600 });
 }
 async function fetchLatestFromDpm(registry) {
     const url = `${registry.replace(/\/$/, "")}/dpm/v1/packages/dpm`;
     const res = await fetch(url, {
-        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
-        signal: AbortSignal.timeout(2500),
+        headers: {
+            accept: "application/json",
+            "user-agent": `dpm-cli/${CLI_VERSION}`,
+        },
     });
     if (!res.ok)
         return null;
-    const data = (await res.json());
-    return data.latest || data["dist-tags"]?.latest || null;
+    const body = (await res.json());
+    return body.latest ?? body["dist-tags"]?.latest ?? null;
 }
 /**
  * On the first dpm command in a new terminal session, checks the DPM registry
- * for a newer CLI and prints how to update with dpm. Never blocks on failure.
+ * for a newer CLI and prints a one-line hint (non-blocking on failure).
  */
 export async function maybeNotifyUpdate() {
-    const session = sessionKey();
-    const prev = await loadState();
-    if (prev.sessions.includes(session))
-        return;
-    await saveState({ sessions: [...prev.sessions, session], latest: prev.latest });
     try {
+        const key = sessionKey();
+        const state = await loadState();
+        if (state.sessions.includes(key))
+            return;
         const config = await loadConfig();
         const latest = await fetchLatestFromDpm(config.registry);
+        state.sessions = [...state.sessions.filter((s) => s !== key), key].slice(-20);
+        if (latest)
+            state.latest = latest;
+        await saveState(state);
         if (!latest || !semver.valid(latest) || !semver.valid(CLI_VERSION))
             return;
-        await saveState({
-            sessions: [...prev.sessions, session],
-            latest,
-        });
         if (!semver.gt(latest, CLI_VERSION))
             return;
-        console.error([
-            "",
-            `${c.yellow("▲")} ${c.bold("dpm")} update available: ${c.dim(CLI_VERSION)} ${c.cyan("→")} ${c.green(latest)}`,
-            `  Update with: ${c.bold("dpm i -g dpm")}`,
-            "",
-        ].join("\n"));
+        console.error(`${c.yellow("▲")} ${c.bold("dpm")} update available: ${c.dim(CLI_VERSION)} ${c.cyan("→")} ${c.green(latest)}`);
     }
     catch {
-        // Ignore network / parse errors — update checks must never break commands.
+        /* never block the command */
     }
 }

package/dist/windowsInstall.d.ts

@@ -0,0 +1,16 @@
+import type { Ui } from "./ui.js";
+/** `%LOCALAPPDATA%\Programs\DPM` — where `dpm.exe` setup installs. */
+export declare function windowsExeInstallDir(): string;
+export declare function windowsExePath(): string;
+/** True when the Windows launcher install is present. */
+export declare function hasWindowsExeInstall(): Promise<boolean>;
+/**
+ * Uninstalls the Windows `dpm.exe` layout (PATH, shortcut, cache, install dir).
+ * Schedules delete of the running tree after this process exits.
+ */
+export declare function uninstallWindowsExe(ui: Ui): Promise<void>;
+/**
+ * Replaces `%LOCALAPPDATA%\\Programs\\DPM\\dpm.exe` from the registry site's
+ * `/download/dpm.exe` (see latest.json). Used for `dpm i -g dpm` on Windows exe installs.
+ */
+export declare function updateWindowsExe(ui: Ui): Promise<void>;

package/dist/windowsInstall.js

@@ -0,0 +1,175 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { access, mkdir, rename, rm, writeFile, } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+import { loadConfig } from "./config.js";
+import { CLI_VERSION } from "./updateCheck.js";
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** `%LOCALAPPDATA%\Programs\DPM` — where `dpm.exe` setup installs. */
+export function windowsExeInstallDir() {
+    const base = process.env.LOCALAPPDATA || path.join(homedir(), "AppData", "Local");
+    return path.join(base, "Programs", "DPM");
+}
+export function windowsExePath() {
+    return path.join(windowsExeInstallDir(), "dpm.exe");
+}
+/** True when the Windows launcher install is present. */
+export async function hasWindowsExeInstall() {
+    return process.platform === "win32" && exists(windowsExePath());
+}
+function startMenuShortcutPath() {
+    const appData = process.env.APPDATA || path.join(homedir(), "AppData", "Roaming");
+    return path.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "DPM.lnk");
+}
+function cliCacheRoot() {
+    const base = process.env.LOCALAPPDATA || path.join(homedir(), "AppData", "Local");
+    return path.join(base, "dpm", "cli");
+}
+/** Removes `dir` from the user PATH (HKCU Environment). */
+function removeFromUserPath(dir) {
+    const ps = `
+$dir = [IO.Path]::GetFullPath('${dir.replace(/'/g, "''")}')
+$key = 'HKCU:\\Environment'
+$cur = (Get-ItemProperty -Path $key -Name Path -ErrorAction SilentlyContinue).Path
+if (-not $cur) { return }
+$parts = $cur -split ';' | Where-Object {
+  $_.Trim() -ne '' -and [IO.Path]::GetFullPath($_.Trim()) -ne $dir
+}
+$next = ($parts -join ';').Trim(';')
+Set-ItemProperty -Path $key -Name Path -Value $next
+Add-Type -Namespace Win32 -Name Native -MemberDefinition '[DllImport("user32.dll", SetLastError=true, CharSet=CharSet.Auto)] public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);'
+$hwnd = [IntPtr]0xffff; $r = [UIntPtr]::Zero
+[Win32.Native]::SendMessageTimeout($hwnd, 0x1A, [UIntPtr]::Zero, 'Environment', 2, 5000, [ref]$r) | Out-Null
+`;
+    spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { windowsHide: true, stdio: "ignore" });
+}
+/**
+ * Uninstalls the Windows `dpm.exe` layout (PATH, shortcut, cache, install dir).
+ * Schedules delete of the running tree after this process exits.
+ */
+export async function uninstallWindowsExe(ui) {
+    const installDir = windowsExeInstallDir();
+    const exe = windowsExePath();
+    if (!(await exists(exe))) {
+        ui.warn("No Windows dpm.exe install found under Local\\Programs\\DPM");
+        return;
+    }
+    ui.info("Removing Windows DPM install…");
+    removeFromUserPath(installDir);
+    await rm(startMenuShortcutPath(), { force: true });
+    await rm(cliCacheRoot(), { recursive: true, force: true });
+    // Cannot delete the running exe reliably — cmd deletes the folder after exit.
+    const bat = path.join(process.env.TEMP || installDir, `dpm-uninstall-${Date.now()}.cmd`);
+    const batBody = [
+        "@echo off",
+        "timeout /t 2 /nobreak >nul",
+        `rmdir /s /q "${installDir}"`,
+        `del /f /q "%~f0"`,
+        "",
+    ].join("\r\n");
+    await writeFile(bat, batBody, "utf8");
+    const child = spawn("cmd.exe", ["/c", "start", "/b", "", bat], {
+        windowsHide: true,
+        stdio: "ignore",
+        detached: true,
+    });
+    child.unref();
+    ui.success("Uninstalled DPM from PATH and Start Menu. Install folder will be removed shortly — open a new terminal.");
+}
+function siteBaseFromRegistry(registry) {
+    return registry.replace(/\/$/, "").replace(/\/npm$/i, "");
+}
+async function fetchLatestMeta(site) {
+    const url = `${site}/download/latest.json`;
+    const res = await fetch(url, {
+        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
+    });
+    if (!res.ok) {
+        throw new Error(`Could not fetch ${url} (${res.status})`);
+    }
+    return (await res.json());
+}
+async function downloadToFile(url, dest) {
+    const res = await fetch(url, {
+        headers: { "user-agent": `dpm-cli/${CLI_VERSION}` },
+        redirect: "follow",
+    });
+    if (!res.ok || !res.body) {
+        throw new Error(`Download failed (${res.status}): ${url}`);
+    }
+    await mkdir(path.dirname(dest), { recursive: true });
+    const tmp = `${dest}.download`;
+    await pipeline(Readable.fromWeb(res.body), createWriteStream(tmp));
+    await rename(tmp, dest);
+}
+/**
+ * Replaces `%LOCALAPPDATA%\\Programs\\DPM\\dpm.exe` from the registry site's
+ * `/download/dpm.exe` (see latest.json). Used for `dpm i -g dpm` on Windows exe installs.
+ */
+export async function updateWindowsExe(ui) {
+    const installDir = windowsExeInstallDir();
+    const exe = windowsExePath();
+    if (!(await exists(exe))) {
+        throw new Error("No Windows dpm.exe install found. Run the downloaded dpm.exe installer first.");
+    }
+    const config = await loadConfig();
+    const site = siteBaseFromRegistry(config.registry);
+    ui.info(`Checking ${site}/download/latest.json…`);
+    const meta = await fetchLatestMeta(site);
+    const remoteVer = meta.version || "unknown";
+    if (remoteVer === CLI_VERSION) {
+        ui.success(`Already up to date (${CLI_VERSION})`);
+        return;
+    }
+    const downloadPath = meta.downloadPath || "/download/dpm.exe";
+    const url = `${site}${downloadPath.startsWith("/") ? "" : "/"}${downloadPath}`;
+    const staging = path.join(installDir, "dpm.exe.new");
+    ui.info(`Downloading DPM ${remoteVer}…`);
+    await downloadToFile(url, staging);
+    const backup = path.join(installDir, "dpm.exe.old");
+    await rm(backup, { force: true });
+    try {
+        await rename(exe, backup);
+    }
+    catch {
+        // Running from another copy — overwrite in place via cmd after exit
+    }
+    try {
+        await rename(staging, exe);
+    }
+    catch {
+        // Locked: schedule replace
+        const bat = path.join(process.env.TEMP || installDir, `dpm-update-${Date.now()}.cmd`);
+        await writeFile(bat, [
+            "@echo off",
+            "timeout /t 2 /nobreak >nul",
+            `move /y "${staging}" "${exe}"`,
+            `del /f /q "${backup}" 2>nul`,
+            `del /f /q "%~f0"`,
+            "",
+        ].join("\r\n"), "utf8");
+        const child = spawn("cmd.exe", ["/c", "start", "/b", "", bat], {
+            windowsHide: true,
+            stdio: "ignore",
+            detached: true,
+        });
+        child.unref();
+        ui.success(`DPM ${remoteVer} downloaded — restart the terminal (or wait a second) to use it.`);
+        return;
+    }
+    await rm(backup, { force: true });
+    // Drop old embedded CLI cache so next launch unpacks the new bundle.
+    await rm(cliCacheRoot(), { recursive: true, force: true });
+    ui.success(`Updated Windows DPM ${CLI_VERSION} → ${remoteVer}. Open a new terminal if \`dpm -v\` still shows the old version.`);
+}