@zenbujs/core 0.0.5 → 0.0.8

package/dist/{build-electron-CNJ0dLND.mjs → build-electron-Dsbb1EMl.mjs}

@@ -1,4 +1,5 @@
-import { t as loadConfig } from "./load-config-xMf2wxH8.mjs";
+import { r as writeHostVersion, t as HOST_VERSION_FILENAME } from "./host-version-BIrF8tX7.mjs";
+import { t as loadConfig } from "./load-config-C4Oe2qZO.mjs";
 import { createRequire } from "node:module";
 import fs from "node:fs";
 import os from "node:os";
@@ -12,50 +13,29 @@ import { promisify } from "node:util";
 //#region src/cli/lib/toolchain.ts
 const execFileAsync = promisify(execFile);
 /**
-* Hardcoded bun + pnpm versions that the .app bundles for its first-launch
-* `pnpm install`. We download these from upstream releases on demand (cached
-* globally per-version), verify against pinned sha256, and stage them into
-* the build's `extraResources/toolchain/` directory.
+* Framework-pinned bun. Used as the runtime bun (the `node`-shim that hosts
+* `npm install`'s lifecycle scripts and JS-package PMs like npm/yarn) when
+* the user picks a non-bun PM.
 *
-* Bumping a version: update the entry, paste the upstream release tarball's
-* sha256, and the next `zen build:electron` will re-fetch into a new cache
-* directory automatically.
-*
-* Currently darwin-only — Linux/Windows support is a future-PR concern.
+* When the user picks bun as the PM, we provision bun at `spec.version`
+* instead and skip this constant entirely. The runtime bun and the PM bun
+* collapse into a single binary at the user's chosen version.
 */
-const TOOLCHAIN = {
-	bun: {
-		version: "1.3.12",
-		releaseTag: "bun-v1.3.12",
-		targets: {
-			"darwin-aarch64": {
-				asset: "bun-darwin-aarch64.zip",
-				sha256: "6c4bb87dd013ed1a8d6a16e357a3d094959fd5530b4d7061f7f3680c3c7cea1c"
-			},
-			"darwin-x64": {
-				asset: "bun-darwin-x64.zip",
-				sha256: "0f58c53a3e7947f1e626d2f8d285f97c14b7cadcca9c09ebafc0ae9d35b58c3d"
-			}
-		}
-	},
-	pnpm: {
-		version: "10.33.0",
-		releaseTag: "v10.33.0",
-		targets: {
-			"darwin-arm64": {
-				asset: "pnpm-macos-arm64",
-				sha256: "ed8a1f140f4de457b01ebe0be3ae28e9a7e28863315dcd53d22ff1e5a32d63ae"
-			},
-			"darwin-x64": {
-				asset: "pnpm-macos-x64",
-				sha256: "c31e29554b0e3f4e03f4617195c949595e4dca36085922003de4896c3ca4057d"
-			}
+const PINNED_BUN = {
+	version: "1.3.12",
+	targets: {
+		"darwin-aarch64": {
+			asset: "bun-darwin-aarch64.zip",
+			sha256: "6c4bb87dd013ed1a8d6a16e357a3d094959fd5530b4d7061f7f3680c3c7cea1c"
+		},
+		"darwin-x64": {
+			asset: "bun-darwin-x64.zip",
+			sha256: "0f58c53a3e7947f1e626d2f8d285f97c14b7cadcca9c09ebafc0ae9d35b58c3d"
 		}
 	}
 };
-TOOLCHAIN.pnpm.version;
-TOOLCHAIN.bun.version;
-function cacheRoot() {
+PINNED_BUN.version;
+function defaultCacheRoot() {
 	return path.join(os.homedir(), ".zenbu", "cache", "toolchain");
 }
 function bunTarget() {
@@ -63,11 +43,6 @@ function bunTarget() {
 	if (process.arch === "x64") return "darwin-x64";
 	throw new Error(`zenbu toolchain: unsupported architecture ${process.arch}`);
 }
-function pnpmTarget() {
-	if (process.arch === "arm64") return "darwin-arm64";
-	if (process.arch === "x64") return "darwin-x64";
-	throw new Error(`zenbu toolchain: unsupported architecture ${process.arch}`);
-}
 function download(url, dest) {
 	return new Promise((resolve, reject) => {
 		https.get(url, (res) => {
@@ -88,6 +63,29 @@ function download(url, dest) {
 		}).on("error", reject);
 	});
 }
+function fetchText(url) {
+	return new Promise((resolve, reject) => {
+		https.get(url, { headers: {
+			"User-Agent": "zenbu-toolchain",
+			Accept: "application/json, text/plain, */*"
+		} }, (res) => {
+			if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+				res.resume();
+				fetchText(new URL(res.headers.location, url).href).then(resolve, reject);
+				return;
+			}
+			if (res.statusCode !== 200) {
+				reject(/* @__PURE__ */ new Error(`GET ${url} -> ${res.statusCode}`));
+				res.resume();
+				return;
+			}
+			const chunks = [];
+			res.on("data", (chunk) => chunks.push(chunk));
+			res.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+			res.on("error", reject);
+		}).on("error", reject);
+	});
+}
 async function sha256(filePath) {
 	const hash = crypto.createHash("sha256");
 	await new Promise((resolve, reject) => {
@@ -98,9 +96,41 @@ async function sha256(filePath) {
 	});
 	return hash.digest("hex");
 }
-async function verify(filePath, expected) {
+async function sha512(filePath) {
+	const hash = crypto.createHash("sha512");
+	await new Promise((resolve, reject) => {
+		const stream = fs.createReadStream(filePath);
+		stream.on("data", (chunk) => hash.update(chunk));
+		stream.on("end", () => resolve());
+		stream.on("error", reject);
+	});
+	return hash.digest();
+}
+async function verifySha256(filePath, expected) {
 	const actual = await sha256(filePath);
-	if (actual !== expected) throw new Error(`zenbu toolchain: sha256 mismatch for ${path.basename(filePath)} (expected ${expected}, got ${actual})`);
+	if (actual.toLowerCase() !== expected.toLowerCase()) throw new Error(`zenbu toolchain: sha256 mismatch for ${path.basename(filePath)} (expected ${expected}, got ${actual})`);
+}
+/**
+* Verify a file against an SRI-format integrity string from the npm registry,
+* e.g. `sha512-LB7QO/<base64>=`. We only support the algorithms npm currently
+* publishes (sha512 + sha1 fallback for ancient packages).
+*/
+async function verifyIntegrity(filePath, integrity) {
+	const [algo, b64] = integrity.split("-", 2);
+	if (!algo || !b64) throw new Error(`zenbu toolchain: malformed integrity "${integrity}"`);
+	let actual;
+	if (algo === "sha512") actual = (await sha512(filePath)).toString("base64");
+	else if (algo === "sha256") {
+		const hash = crypto.createHash("sha256");
+		await new Promise((resolve, reject) => {
+			const s = fs.createReadStream(filePath);
+			s.on("data", (c) => hash.update(c));
+			s.on("end", () => resolve());
+			s.on("error", reject);
+		});
+		actual = hash.digest("base64");
+	} else throw new Error(`zenbu toolchain: unsupported integrity algo "${algo}"`);
+	if (actual !== b64) throw new Error(`zenbu toolchain: ${algo} integrity mismatch for ${path.basename(filePath)}`);
 }
 async function findExecutable(dir, name) {
 	const entries = await fsp.readdir(dir, { withFileTypes: true });
@@ -113,20 +143,28 @@ async function findExecutable(dir, name) {
 	}
 	return null;
 }
-async function ensureBunCached() {
+async function ensureBunCached(spec, cacheRoot) {
 	const target = bunTarget();
-	const info = TOOLCHAIN.bun.targets[target];
-	const dir = path.join(cacheRoot(), `bun-${TOOLCHAIN.bun.version}-${target}`);
+	const dir = path.join(cacheRoot, `bun-${spec.version}-${target}`);
 	const cached = path.join(dir, "bun");
 	if (fs.existsSync(cached)) return cached;
 	await fsp.mkdir(dir, { recursive: true });
 	const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), "zenbu-bun-"));
 	try {
-		const zipPath = path.join(tmp, info.asset);
-		const url = `https://github.com/oven-sh/bun/releases/download/${TOOLCHAIN.bun.releaseTag}/${info.asset}`;
-		console.log(`  → downloading bun ${TOOLCHAIN.bun.version} (${target})`);
+		const asset = `bun-${target}.zip`;
+		const releaseTag = `bun-v${spec.version}`;
+		const zipPath = path.join(tmp, asset);
+		const url = `https://github.com/oven-sh/bun/releases/download/${releaseTag}/${asset}`;
+		console.log(`  → downloading bun ${spec.version} (${target})`);
 		await download(url, zipPath);
-		await verify(zipPath, info.sha256);
+		let expected = spec.pinnedSha256;
+		if (!expected) {
+			const sumsUrl = `https://github.com/oven-sh/bun/releases/download/${releaseTag}/SHASUMS256.txt`;
+			const fromFile = parseShasumsFile(await fetchText(sumsUrl), asset);
+			if (!fromFile) throw new Error(`zenbu toolchain: could not locate sha256 for ${asset} in ${sumsUrl}`);
+			expected = fromFile;
+		}
+		await verifySha256(zipPath, expected);
 		await execFileAsync("unzip", [
 			"-q",
 			zipPath,
@@ -134,7 +172,7 @@ async function ensureBunCached() {
 			tmp
 		]);
 		const extracted = await findExecutable(tmp, "bun");
-		if (!extracted) throw new Error(`zenbu toolchain: could not find bun in ${info.asset}`);
+		if (!extracted) throw new Error(`zenbu toolchain: could not find bun in ${asset}`);
 		await fsp.copyFile(extracted, cached);
 		await fsp.chmod(cached, 493);
 	} finally {
@@ -145,53 +183,174 @@ async function ensureBunCached() {
 	}
 	return cached;
 }
-async function ensurePnpmCached() {
-	const target = pnpmTarget();
-	const info = TOOLCHAIN.pnpm.targets[target];
-	const dir = path.join(cacheRoot(), `pnpm-${TOOLCHAIN.pnpm.version}-${target}`);
-	const cached = path.join(dir, "pnpm");
+function parseShasumsFile(contents, target) {
+	for (const line of contents.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const [hash, name] = trimmed.split(/\s+/, 2);
+		if (!hash || !name) continue;
+		if (name === target || name === `./${target}` || name === `*${target}`) return hash;
+	}
+	return null;
+}
+async function fetchRegistryDist(pkg, version) {
+	const text = await fetchText(`https://registry.npmjs.org/${pkg}/${version}`);
+	const meta = JSON.parse(text);
+	if (!meta.dist?.tarball) throw new Error(`zenbu toolchain: registry response for ${pkg}@${version} has no dist.tarball`);
+	return meta.dist;
+}
+async function ensureNpmRegistryPackageCached(pkg, version, cacheRoot) {
+	const dir = path.join(cacheRoot, `${pkg}-${version}`);
+	const ready = path.join(dir, ".ready");
+	const pkgRoot = path.join(dir, "package");
+	if (fs.existsSync(ready) && fs.existsSync(pkgRoot)) return pkgRoot;
+	await fsp.rm(dir, {
+		recursive: true,
+		force: true
+	});
+	await fsp.mkdir(dir, { recursive: true });
+	const dist = await fetchRegistryDist(pkg, version);
+	const tarball = path.join(dir, "tarball.tgz");
+	console.log(`  → downloading ${pkg}@${version} tarball`);
+	await download(dist.tarball, tarball);
+	if (dist.integrity) await verifyIntegrity(tarball, dist.integrity);
+	else if (dist.shasum) {
+		const hash = crypto.createHash("sha1");
+		await new Promise((resolve, reject) => {
+			const s = fs.createReadStream(tarball);
+			s.on("data", (c) => hash.update(c));
+			s.on("end", () => resolve());
+			s.on("error", reject);
+		});
+		const actual = hash.digest("hex");
+		if (actual !== dist.shasum) throw new Error(`zenbu toolchain: sha1 mismatch for ${pkg}@${version} (expected ${dist.shasum}, got ${actual})`);
+	} else throw new Error(`zenbu toolchain: registry response for ${pkg}@${version} carries neither integrity nor shasum`);
+	await execFileAsync("tar", [
+		"-xzf",
+		tarball,
+		"-C",
+		dir
+	]);
+	await fsp.unlink(tarball);
+	if (!fs.existsSync(pkgRoot)) throw new Error(`zenbu toolchain: extracted ${pkg}@${version} tarball but no package/ dir found`);
+	await fsp.writeFile(ready, "");
+	return pkgRoot;
+}
+/**
+* Yarn 2+ does not publish a discoverable per-version checksum endpoint
+* (see corepack's hash table for context). We download from the official
+* `repo.yarnpkg.com` over HTTPS and record the file's sha256 in a sibling
+* `.sha256` file in the cache so subsequent provisions are content-stable.
+*
+* The verification script in `scripts/verify-package-managers.ts` exercises
+* the resulting file by actually running an install with it — so a tampered
+* payload would fail loudly there.
+*/
+async function ensureYarnBerryCached(version, cacheRoot) {
+	const dir = path.join(cacheRoot, `yarn-berry-${version}`);
+	const cached = path.join(dir, "yarn.cjs");
 	if (fs.existsSync(cached)) return cached;
 	await fsp.mkdir(dir, { recursive: true });
+	const url = `https://repo.yarnpkg.com/${version}/packages/yarnpkg-cli/bin/yarn.js`;
+	console.log(`  → downloading yarn ${version} (berry, https-only verify)`);
 	const tmp = path.join(dir, ".download");
-	const url = `https://github.com/pnpm/pnpm/releases/download/${TOOLCHAIN.pnpm.releaseTag}/${info.asset}`;
-	console.log(`  → downloading pnpm ${TOOLCHAIN.pnpm.version} (${target})`);
 	await download(url, tmp);
-	await verify(tmp, info.sha256);
-	await fsp.chmod(tmp, 493);
+	const stat = await fsp.stat(tmp);
+	if (stat.size < 1e5) throw new Error(`zenbu toolchain: yarn berry download for ${version} is suspiciously small (${stat.size} bytes)`);
+	const head = await fsp.readFile(tmp, {
+		encoding: "utf8",
+		flag: "r"
+	}).then((contents) => contents.slice(0, 200), () => "");
+	if (!/^#!\/usr\/bin\/env node|^"use strict"|^\(\(\)=>/.test(head)) throw new Error(`zenbu toolchain: yarn berry download for ${version} does not look like a JS file (head: ${head.slice(0, 80)}...)`);
+	await fsp.chmod(tmp, 420);
 	await fsp.rename(tmp, cached);
 	return cached;
 }
 /**
-* Stage hardcoded bun + pnpm into `<stagingDir>/{bun, pnpm}` so the build
-* can wire them into electron-builder as extraResources. Returns absolute
-* paths to the staged binaries.
+* Stage bun + the user-configured PM into `<stagingDir>/...` so the build
+* can wire them into electron-builder as extraResources.
+*
+* Layout produced inside `stagingDir`:
+*   bun          (always — runtime + node-shim)
+*   node         (always — symlink → bun)
+*   pnpm         (when packageManager.type === "pnpm")
+*   npm/         (when packageManager.type === "npm" — extracted tarball)
+*   yarn/        (when packageManager.type === "yarn" + classic)
+*   yarn.cjs     (when packageManager.type === "yarn" + berry)
+*   (nothing extra when packageManager.type === "bun" — bun IS the PM)
 *
-* The sibling `node` symlink (-> `bun`) is created so that any npm
-* lifecycle script that does `#!/usr/bin/env node` can resolve to bun
-* inside the launched .app.
+* The launcher reads `packageManager.type` from app-config.json and
+* dispatches to the matching codepath using this same convention.
 */
-async function provisionToolchain(stagingDir) {
+async function provisionToolchain(stagingDir, opts) {
 	if (process.platform !== "darwin") throw new Error(`zenbu toolchain: only darwin is supported today (got ${process.platform})`);
 	await fsp.mkdir(stagingDir, { recursive: true });
-	const cachedBun = await ensureBunCached();
-	const cachedPnpm = await ensurePnpmCached();
+	const cacheRoot = opts.cacheRoot ?? defaultCacheRoot();
+	const pm = opts.packageManager;
+	const bunSpec = pm.type === "bun" ? { version: pm.version } : (() => {
+		const target = bunTarget();
+		return {
+			version: PINNED_BUN.version,
+			pinnedSha256: PINNED_BUN.targets[target].sha256
+		};
+	})();
+	const cachedBun = await ensureBunCached(bunSpec, cacheRoot);
 	const bunOut = path.join(stagingDir, "bun");
-	const pnpmOut = path.join(stagingDir, "pnpm");
-	const nodeOut = path.join(stagingDir, "node");
 	await fsp.copyFile(cachedBun, bunOut);
 	await fsp.chmod(bunOut, 493);
-	await fsp.copyFile(cachedPnpm, pnpmOut);
-	await fsp.chmod(pnpmOut, 493);
+	const nodeOut = path.join(stagingDir, "node");
 	try {
 		await fsp.unlink(nodeOut);
 	} catch {}
 	await fsp.symlink("bun", nodeOut);
+	switch (pm.type) {
+		case "pnpm":
+			await copyDir(await ensureNpmRegistryPackageCached("pnpm", pm.version, cacheRoot), path.join(stagingDir, "pnpm"));
+			break;
+		case "npm":
+			await copyDir(await ensureNpmRegistryPackageCached("npm", pm.version, cacheRoot), path.join(stagingDir, "npm"));
+			break;
+		case "yarn":
+			if (isYarnBerry(pm.version)) {
+				const cached = await ensureYarnBerryCached(pm.version, cacheRoot);
+				const out = path.join(stagingDir, "yarn.cjs");
+				await fsp.copyFile(cached, out);
+				await fsp.chmod(out, 420);
+			} else await copyDir(await ensureNpmRegistryPackageCached("yarn", pm.version, cacheRoot), path.join(stagingDir, "yarn"));
+			break;
+		case "bun": break;
+	}
 	return {
 		bun: bunOut,
-		pnpm: pnpmOut,
-		node: nodeOut
+		node: nodeOut,
+		bunVersion: bunSpec.version,
+		packageManager: pm
 	};
 }
+function isYarnBerry(version) {
+	const major = parseInt(version.split(".")[0] ?? "", 10);
+	return Number.isFinite(major) && major >= 2;
+}
+async function copyDir(src, dest) {
+	await fsp.rm(dest, {
+		recursive: true,
+		force: true
+	});
+	await fsp.mkdir(dest, { recursive: true });
+	for (const entry of await fsp.readdir(src, { withFileTypes: true })) {
+		const s = path.join(src, entry.name);
+		const d = path.join(dest, entry.name);
+		if (entry.isDirectory()) await copyDir(s, d);
+		else if (entry.isSymbolicLink()) {
+			const target = await fsp.readlink(s);
+			await fsp.symlink(target, d);
+		} else {
+			await fsp.copyFile(s, d);
+			const stat = await fsp.stat(s);
+			await fsp.chmod(d, stat.mode & 511);
+		}
+	}
+}
 //#endregion
 //#region src/cli/commands/build-electron.ts
 const ELECTRON_BUILDER_CONFIG_NAMES = [
@@ -251,43 +410,27 @@ function expandMirrorUrl(target) {
 	if (/^[\w.-]+\/[\w.-]+$/.test(target)) return `https://github.com/${target}.git`;
 	return target;
 }
-function resolveCoreVersion() {
-	try {
-		const pkg = readJson(createRequire(import.meta.url).resolve("@zenbujs/core/package.json"));
-		if (pkg.version) return pkg.version;
-	} catch {}
-	try {
-		const here = fileURLToPath(import.meta.url);
-		let dir = path.dirname(here);
-		while (dir !== path.dirname(dir)) {
-			const candidate = path.join(dir, "package.json");
-			if (fs.existsSync(candidate)) {
-				const pkg = readJson(candidate);
-				if (pkg.name === "@zenbujs/core" && pkg.version) return pkg.version;
-				if (pkg.version) return pkg.version;
-			}
-			dir = path.dirname(dir);
-		}
-	} catch {}
-	return "0.0.0";
-}
 /**
-* Find the bundled `launcher.mjs` shipped inside `@zenbujs/core/dist/`. We
-* resolve it through Node's resolution from the user's project so that the
-* launcher matches the version of `@zenbujs/core` actually installed in the
-* app's `node_modules` (which is what runs in the bundled .app).
+* Find a sibling file inside `@zenbujs/core/dist/`. Resolved through
+* Node's resolution from the user's project so the artifact matches the
+* `@zenbujs/core` actually installed in their `node_modules` (which is
+* what runs in the bundled .app). Falls back to walking up from this
+* file's location for the in-monorepo dev case.
 */
-function resolveLauncher(projectDir) {
+function resolveCoreDistFile(projectDir, fileName) {
 	const localRequire = createRequire(path.join(projectDir, "package.json"));
 	try {
 		const pkgPath = localRequire.resolve("@zenbujs/core/package.json");
-		const launcher = path.join(path.dirname(pkgPath), "dist", "launcher.mjs");
-		if (fs.existsSync(launcher)) return launcher;
+		const candidate = path.join(path.dirname(pkgPath), "dist", fileName);
+		if (fs.existsSync(candidate)) return candidate;
 	} catch {}
 	const here = fileURLToPath(import.meta.url);
-	const candidate = path.resolve(path.dirname(here), "..", "launcher.mjs");
+	const candidate = path.resolve(path.dirname(here), "..", fileName);
 	if (fs.existsSync(candidate)) return candidate;
-	throw new Error("zen build:electron: cannot locate `@zenbujs/core/dist/launcher.mjs`. Make sure @zenbujs/core is installed in this project.");
+	throw new Error(`zen build:electron: cannot locate \`@zenbujs/core/dist/${fileName}\`. Make sure @zenbujs/core is installed in this project.`);
+}
+function resolveLauncher(projectDir) {
+	return resolveCoreDistFile(projectDir, "launcher.mjs");
 }
 function resolveElectronBuilder(projectDir) {
 	const candidates = [path.join(projectDir, "node_modules", ".bin", "electron-builder"), path.join(projectDir, "node_modules", "electron-builder", "out", "cli", "cli.js")];
@@ -382,7 +525,7 @@ function mergeElectronBuilderConfig(userConfig, overlay) {
 		output: overlay.output
 	};
 	merged.files = overlay.bundleFiles;
-	merged.extraResources = [...Array.isArray(userConfig.extraResources) ? userConfig.extraResources : [], overlay.extraResource];
+	merged.extraResources = [...Array.isArray(userConfig.extraResources) ? userConfig.extraResources : [], ...overlay.extraResources];
 	if (userConfig.npmRebuild !== false) merged.npmRebuild = false;
 	if (userConfig.asar === void 0) merged.asar = false;
 	return merged;
@@ -391,6 +534,19 @@ async function copyFile(src, dest) {
 	await fsp.mkdir(path.dirname(dest), { recursive: true });
 	await fsp.copyFile(src, dest);
 }
+/**
+* Stage the user's `installing.html` plus the framework's built-in
+* `installing-preload.cjs` into the bundle dir. The launcher loads both
+* from the .app's `Resources/` (next to `toolchain/`) before the user's
+* source has been cloned. Only the two canonical files; sibling assets
+* (CSS, fonts, images referenced from installing.html) are the user's
+* responsibility via their own `electron-builder.json#extraResources`.
+*/
+async function stageInstallingArtifacts(args) {
+	await copyFile(args.installingSrc, args.installingHtmlOut);
+	await copyFile(resolveCoreDistFile(args.projectDir, "installing-preload.cjs"), args.installingPreloadOut);
+	return true;
+}
 async function runBuildElectron(argv) {
 	const projectDir = resolveProjectDir();
 	const flags = parseFlags(argv);
@@ -409,25 +565,39 @@ async function runBuildElectron(argv) {
 	const bundlePkgOut = path.join(bundleDir, "package.json");
 	const appConfigOut = path.join(bundleDir, "app-config.json");
 	const mergedConfigPath = path.join(bundleDir, "electron-builder.merged.json");
+	const installingHtmlOut = path.join(bundleDir, "installing.html");
+	const installingPreloadOut = path.join(bundleDir, "installing-preload.cjs");
 	const sourceSha = currentSourceSha(projectDir);
+	const packageManager = config.packageManager;
+	const pmLabel = `${packageManager.type}@${packageManager.version}`;
 	console.log(`\n  zen build:electron`);
 	console.log(`    name:    ${appName}`);
 	console.log(`    version: ${appVersion}`);
+	console.log(`    host:    ${config.hostVersion}`);
 	console.log(`    source:  ${sourceSha === "uncommitted" ? "uncommitted" : sourceSha.slice(0, 7)}`);
 	console.log(`    mirror:  ${mirrorTarget} (${mirrorBranch})`);
+	console.log(`    pm:      ${pmLabel}`);
 	console.log(`    bundle:  ${bundleDir}`);
 	console.log("  → staging launcher.mjs");
 	await copyFile(resolveLauncher(projectDir), launcherOut);
-	console.log("  → provisioning bundled toolchain (bun + pnpm)");
-	await provisionToolchain(toolchainDir);
-	console.log("  → writing bundle package.json + app-config.json");
-	const host = resolveCoreVersion();
+	const stagedInstalling = resolved.installingPath ? await stageInstallingArtifacts({
+		projectDir,
+		installingSrc: resolved.installingPath,
+		installingHtmlOut,
+		installingPreloadOut
+	}) : null;
+	if (stagedInstalling) {
+		console.log(`  → staging installing.html (${path.relative(projectDir, resolved.installingPath)})`);
+		console.log(`  → staging installing-preload.cjs`);
+	}
+	console.log(`  → provisioning bundled toolchain (bun + ${pmLabel})`);
+	await provisionToolchain(toolchainDir, { packageManager });
+	console.log("  → writing bundle package.json + app-config.json + host.json");
 	const bundlePkg = {
 		name: appName,
 		version: appVersion,
 		main: "launcher.mjs",
 		type: "module",
-		zenbu: { host },
 		repository: {
 			type: "git",
 			url: mirrorUrl
@@ -439,34 +609,52 @@ async function runBuildElectron(argv) {
 		mirrorUrl,
 		branch: mirrorBranch,
 		version: appVersion,
-		host
+		packageManager,
+		...stagedInstalling ? {
+			installingHtml: "installing.html",
+			installingPreload: "installing-preload.cjs"
+		} : {}
 	};
 	await fsp.writeFile(appConfigOut, JSON.stringify(appConfig, null, 2) + "\n");
+	writeHostVersion(bundleDir, config.hostVersion);
 	const userConfig = readElectronBuilderConfig(projectDir);
 	const userOutput = userConfig.directories?.output ?? "dist";
 	const resolvedOutput = path.isAbsolute(userOutput) ? userOutput : path.resolve(projectDir, userOutput);
+	const overlayExtraResources = [{
+		from: toolchainDir,
+		to: "toolchain"
+	}];
+	if (stagedInstalling) overlayExtraResources.push({
+		from: installingHtmlOut,
+		to: "installing.html"
+	}, {
+		from: installingPreloadOut,
+		to: "installing-preload.cjs"
+	});
 	const merged = mergeElectronBuilderConfig(userConfig, {
 		appDir: bundleDir,
 		output: resolvedOutput,
 		bundleFiles: [
 			"package.json",
 			"app-config.json",
+			HOST_VERSION_FILENAME,
 			"launcher.mjs",
 			"!node_modules",
 			"!**/node_modules",
 			"!**/node_modules/**"
 		],
-		extraResource: {
-			from: toolchainDir,
-			to: "toolchain"
-		}
+		extraResources: overlayExtraResources
 	});
 	await fsp.writeFile(mergedConfigPath, JSON.stringify(merged, null, 2) + "\n");
 	console.log("  → injected into electron-builder config:");
 	console.log(`      directories.app    = ${bundleDir}`);
 	console.log(`      directories.output = ${resolvedOutput}`);
-	console.log(`      files              = [launcher + app-config + bundle pkg]`);
+	console.log(`      files              = [launcher + app-config + bundle pkg + ${HOST_VERSION_FILENAME}]`);
 	console.log(`      extraResources    += { from: <bundle>/toolchain, to: toolchain }`);
+	if (stagedInstalling) {
+		console.log(`      extraResources    += { from: installing.html, to: installing.html }`);
+		console.log(`      extraResources    += { from: installing-preload.cjs, to: installing-preload.cjs }`);
+	}
 	console.log(`      asar               = ${merged.asar !== void 0 ? merged.asar : "(unset)"}`);
 	console.log(`      npmRebuild         = false`);
 	console.log("  → invoking electron-builder");