@zenbujs/core 0.0.8 → 0.0.12

package/dist/updater-DCkz9M1c.mjs

@@ -1,1008 +0,0 @@
-import { n as __exportAll } from "./chunk-DsiFFCwN.mjs";
-import { Service, runtime } from "./runtime.mjs";
-import { t as createLogger } from "./log-6rzaCV0I.mjs";
-import { n as tryReadHostVersion } from "./host-version-BIrF8tX7.mjs";
-import fs, { existsSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import semver from "semver";
-import { spawn } from "node:child_process";
-import crypto from "node:crypto";
-import fsp from "node:fs/promises";
-import { app } from "electron";
-import * as git from "isomorphic-git";
-import http from "isomorphic-git/http/node";
-import { pauseWatcherPath } from "@zenbujs/hmr/pause";
-//#region src/shared/pm-install.ts
-/**
-* Bundled-toolchain `<pm> install` helpers.
-*
-* Imported by both:
-*   - `packages/core/src/launcher.ts` (tsdown inlines this into
-*     `dist/launcher.mjs`; the launcher cannot `import "@zenbujs/core"`)
-*   - `packages/core/src/services/updater.ts` (resolved through normal
-*     `@zenbujs/core/...` resolution at runtime)
-*
-* Both call sites operate on the apps-dir (`~/.zenbu/apps/<name>/`) and
-* the .app's `Resources/` (where `provisionToolchain` staged
-* `bun`, `pnpm`, etc.). The launcher kicks off the FIRST install at
-* launch; the updater service runs the SAME logic when an `update()`
-* lockfile-diff says deps drifted.
-*/
-function lockfileFor(type) {
-	switch (type) {
-		case "pnpm": return "pnpm-lock.yaml";
-		case "npm": return "package-lock.json";
-		case "yarn": return "yarn.lock";
-		case "bun": return "bun.lock";
-	}
-}
-function isYarnBerry(version) {
-	const major = parseInt(version.split(".")[0] ?? "", 10);
-	return Number.isFinite(major) && major >= 2;
-}
-function bundledToolPath(name, resourcesPath) {
-	const candidates = [path.join(resourcesPath, "toolchain", "bin", name), path.join(resourcesPath, "toolchain", name)];
-	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
-	return null;
-}
-/**
-* Resolve the entrypoint we'll exec for a given PM, mirroring the layout
-* `provisionToolchain` writes into the bundle's `Resources/toolchain/`.
-*/
-function bundledPmEntry(pm, resourcesPath) {
-	switch (pm.type) {
-		case "pnpm": {
-			const p = path.join(resourcesPath, "toolchain", "pnpm", "bin", "pnpm.cjs");
-			if (!existsSync(p)) throw new Error(`bundled pnpm entry not found at ${p}. The .app's toolchain is incomplete.`);
-			return {
-				kind: "js",
-				path: p
-			};
-		}
-		case "npm": {
-			const p = path.join(resourcesPath, "toolchain", "npm", "bin", "npm-cli.js");
-			if (!existsSync(p)) throw new Error(`bundled npm entry not found at ${p}. The .app's toolchain is incomplete.`);
-			return {
-				kind: "js",
-				path: p
-			};
-		}
-		case "yarn": {
-			if (isYarnBerry(pm.version)) {
-				const p = path.join(resourcesPath, "toolchain", "yarn.cjs");
-				if (!existsSync(p)) throw new Error(`bundled yarn (berry) entry not found at ${p}. The .app's toolchain is incomplete.`);
-				return {
-					kind: "js",
-					path: p
-				};
-			}
-			const p = path.join(resourcesPath, "toolchain", "yarn", "bin", "yarn.js");
-			if (!existsSync(p)) throw new Error(`bundled yarn (classic) entry not found at ${p}. The .app's toolchain is incomplete.`);
-			return {
-				kind: "js",
-				path: p
-			};
-		}
-		case "bun": return { kind: "bun" };
-	}
-}
-function electronTargetVersion(appsDir) {
-	if (process.versions.electron) return process.versions.electron;
-	try {
-		const pkg = JSON.parse(fs.readFileSync(path.join(appsDir, "package.json"), "utf8"));
-		return (pkg.devDependencies?.electron ?? pkg.dependencies?.electron ?? "").replace(/^[^\d]*/, "") || "42.0.0";
-	} catch {
-		return "42.0.0";
-	}
-}
-function buildInstallEnv(appsDir) {
-	const target = electronTargetVersion(appsDir);
-	return {
-		...process.env,
-		CI: "true",
-		HOME: path.join(appsDir, ".zenbu", ".node-gyp"),
-		npm_config_runtime: "electron",
-		npm_config_target: target,
-		npm_config_disturl: "https://electronjs.org/headers",
-		npm_config_arch: process.arch
-	};
-}
-/**
-* Best-effort progress regex per package manager. We pass each stdout line
-* through these and return a `progress` payload when one matches; otherwise
-* `null`. Failing to match is fine — the UI just won't show fine-grained
-* progress for that PM.
-*/
-const PNPM_RESOLVED_RE = /Progress:\s+resolved\s+(\d+),\s+reused\s+(\d+),\s+downloaded\s+(\d+)/i;
-const PNPM_PROGRESS_RE = /(\d+)\s*\/\s*(\d+)/;
-function parseInstallProgress(pm, line) {
-	if (pm === "pnpm") {
-		const m = line.match(PNPM_RESOLVED_RE);
-		if (m) {
-			const resolved = parseInt(m[1], 10);
-			const reused = parseInt(m[2], 10);
-			const downloaded = parseInt(m[3], 10);
-			return {
-				phase: "resolve",
-				loaded: reused + downloaded,
-				total: resolved,
-				ratio: resolved > 0 ? (reused + downloaded) / resolved : void 0
-			};
-		}
-	}
-	const m = line.match(PNPM_PROGRESS_RE);
-	if (m) {
-		const loaded = parseInt(m[1], 10);
-		const total = parseInt(m[2], 10);
-		if (total > 0) return {
-			loaded,
-			total,
-			ratio: loaded / total
-		};
-	}
-	return null;
-}
-function spawnInstall(args) {
-	const { bin, cliArgs, cwd, env, label, pmType, reporter, signal } = args;
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) {
-			reject(/* @__PURE__ */ new Error(`${label} aborted before start`));
-			return;
-		}
-		const usePiped = reporter != null;
-		const child = spawn(bin, cliArgs, {
-			cwd,
-			stdio: usePiped ? [
-				"inherit",
-				"pipe",
-				"pipe"
-			] : "inherit",
-			env
-		});
-		const onAbort = () => {
-			try {
-				child.kill("SIGTERM");
-			} catch {}
-		};
-		signal?.addEventListener("abort", onAbort, { once: true });
-		if (usePiped) {
-			const wireStream = (stream, which) => {
-				if (!stream) return;
-				let buf = "";
-				stream.setEncoding("utf8");
-				stream.on("data", (chunk) => {
-					buf += chunk;
-					let nl;
-					while ((nl = buf.indexOf("\n")) >= 0) {
-						const rawLine = buf.slice(0, nl);
-						buf = buf.slice(nl + 1);
-						reporter?.rawLine?.(which, rawLine);
-						const line = rawLine.replace(/\r/g, "").trimEnd();
-						if (!line) continue;
-						reporter?.message?.(line);
-						const progress = parseInstallProgress(pmType, line);
-						if (progress) reporter?.progress?.(progress);
-					}
-				});
-				stream.on("end", () => {
-					if (buf.length > 0) {
-						reporter?.rawLine?.(which, buf);
-						const line = buf.replace(/\r/g, "").trimEnd();
-						if (line) reporter?.message?.(line);
-					}
-				});
-			};
-			wireStream(child.stdout, "stdout");
-			wireStream(child.stderr, "stderr");
-		}
-		child.on("error", (err) => {
-			signal?.removeEventListener("abort", onAbort);
-			reject(err);
-		});
-		child.on("close", (code, sig) => {
-			signal?.removeEventListener("abort", onAbort);
-			if (code === 0) resolve();
-			else if (signal?.aborted) reject(/* @__PURE__ */ new Error(`${label} aborted (${sig ?? code})`));
-			else reject(/* @__PURE__ */ new Error(`${label} exited with code ${code}`));
-		});
-	});
-}
-async function runInstall(opts) {
-	const { appsDir, resourcesPath, pm, reporter = null, signal } = opts;
-	const env = buildInstallEnv(appsDir);
-	const entry = bundledPmEntry(pm, resourcesPath);
-	switch (pm.type) {
-		case "pnpm": {
-			if (entry.kind !== "js") throw new Error("internal: pnpm entry shape");
-			const bun = bundledToolPath("bun", resourcesPath);
-			if (!bun) throw new Error(`bundled bun not found in ${resourcesPath}/toolchain (required to host the pnpm.cjs entry)`);
-			await spawnInstall({
-				bin: bun,
-				cliArgs: [
-					entry.path,
-					"install",
-					"--reporter=append-only"
-				],
-				cwd: appsDir,
-				env,
-				label: "pnpm install",
-				pmType: pm.type,
-				reporter,
-				signal
-			});
-			return;
-		}
-		case "npm": {
-			if (entry.kind !== "js") throw new Error("internal: npm entry shape");
-			const bun = bundledToolPath("bun", resourcesPath);
-			if (!bun) throw new Error(`bundled bun not found in ${resourcesPath}/toolchain (required to host the npm-cli.js entry)`);
-			await spawnInstall({
-				bin: bun,
-				cliArgs: [
-					entry.path,
-					"install",
-					"--no-audit",
-					"--no-fund",
-					"--no-progress"
-				],
-				cwd: appsDir,
-				env,
-				label: "npm install",
-				pmType: pm.type,
-				reporter,
-				signal
-			});
-			return;
-		}
-		case "yarn": {
-			if (entry.kind !== "js") throw new Error("internal: yarn entry shape");
-			const bun = bundledToolPath("bun", resourcesPath);
-			if (!bun) throw new Error(`bundled bun not found in ${resourcesPath}/toolchain (required to host the yarn.js entry)`);
-			if (isYarnBerry(pm.version)) await spawnInstall({
-				bin: bun,
-				cliArgs: [entry.path, "install"],
-				cwd: appsDir,
-				env: {
-					...env,
-					YARN_ENABLE_IMMUTABLE_INSTALLS: "false"
-				},
-				label: `yarn install (${pm.version})`,
-				pmType: pm.type,
-				reporter,
-				signal
-			});
-			else {
-				const rcPath = path.join(appsDir, ".zenbu", "yarn-classic-bun.yarnrc");
-				await fsp.mkdir(path.dirname(rcPath), { recursive: true });
-				await fsp.writeFile(rcPath, "strict-ssl false\n");
-				await spawnInstall({
-					bin: bun,
-					cliArgs: [
-						entry.path,
-						"install",
-						"--non-interactive",
-						"--no-progress",
-						"--network-timeout",
-						"600000",
-						"--use-yarnrc",
-						rcPath,
-						"--registry",
-						"https://registry.npmjs.org/"
-					],
-					cwd: appsDir,
-					env,
-					label: `yarn install (${pm.version})`,
-					pmType: pm.type,
-					reporter,
-					signal
-				});
-			}
-			return;
-		}
-		case "bun": {
-			const bun = bundledToolPath("bun", resourcesPath);
-			if (!bun) throw new Error(`bundled bun not found in ${resourcesPath}/toolchain. The .app is missing required toolchain binaries.`);
-			await spawnInstall({
-				bin: bun,
-				cliArgs: ["install", "--no-progress"],
-				cwd: appsDir,
-				env,
-				label: "bun install",
-				pmType: pm.type,
-				reporter,
-				signal
-			});
-			return;
-		}
-	}
-}
-async function fileHash(hash, filePath) {
-	hash.update(filePath);
-	hash.update("\0");
-	try {
-		hash.update(await fsp.readFile(filePath));
-	} catch {}
-	hash.update("\0");
-}
-async function depsSignature(appsDir, pm) {
-	const hash = crypto.createHash("sha256");
-	await fileHash(hash, path.join(appsDir, "package.json"));
-	await fileHash(hash, path.join(appsDir, lockfileFor(pm.type)));
-	hash.update(`${pm.type}@${pm.version}`);
-	hash.update("\0");
-	hash.update(process.versions.electron ?? "no-electron");
-	hash.update("\0");
-	hash.update(process.platform);
-	hash.update("\0");
-	hash.update(process.arch);
-	return hash.digest("hex");
-}
-/**
-* Read `<appsDir>/.zenbu/deps-sig` (the signature recorded after the
-* last successful install). Returns `null` when missing.
-*/
-async function readDepsSig(appsDir) {
-	const sigPath = path.join(appsDir, ".zenbu", "deps-sig");
-	try {
-		return await fsp.readFile(sigPath, "utf8");
-	} catch {
-		return null;
-	}
-}
-async function writeDepsSig(appsDir, sig) {
-	const sigPath = path.join(appsDir, ".zenbu", "deps-sig");
-	await fsp.mkdir(path.dirname(sigPath), { recursive: true });
-	await fsp.writeFile(sigPath, sig);
-}
-//#endregion
-//#region src/shared/range-resolver.ts
-/**
-* Resolves the latest commit on a source-mirror branch whose
-* `package.json#zenbu.host` semver range still satisfies the running
-* .app's `host.json#version`. Pure functions over `isomorphic-git` plus
-* `semver` — no Electron dependency.
-*
-* Imported by both:
-*   - `packages/core/src/launcher.ts` (tsdown inlines this into
-*     `dist/launcher.mjs`; the launcher cannot `import "@zenbujs/core"`)
-*   - `packages/core/src/services/updater.ts` (resolved through normal
-*     `@zenbujs/core/...` resolution at runtime)
-*
-* Algorithm:
-*   1. Hot path — resolve `refs/remotes/origin/<branch>` (caller is
-*      responsible for an upstream-fresh ref; the launcher and updater
-*      both `git.fetch` before invoking us). If the tip's
-*      `package.json#zenbu.host` already satisfies `hostVersion`,
-*      return tip.
-*   2. Cold path — deepen the local shallow history geometrically
-*      (`git.fetch({depth: nextDepth, relative: false})`), running
-*      `git.log({depth: nextDepth})` to enumerate the now-known history.
-*      Lower-bound binary search inside that window for the smallest
-*      index whose commit is compatible — i.e. the LATEST compatible
-*      commit. The search assumes monotonic ranges (newer commits'
-*      `zenbu.host` is equal-or-stricter than older commits'); if a
-*      project violates this, the resolver may pick a slightly older
-*      compatible commit than the absolute latest.
-*   3. If deepen exhausts the branch's history without finding a
-*      compatible commit, return `targetSha: null`. The caller decides
-*      what to do (the launcher errors out; the updater service surfaces
-*      `phase: "incompatible"`).
-*/
-const FIRST_DEEPEN_DEPTH = 16;
-const MAX_DEEPEN_DEPTH = 4096;
-async function readZenbuHostAt(args) {
-	try {
-		const { blob } = await git.readBlob({
-			fs: args.fs,
-			dir: args.dir,
-			oid: args.commitOid,
-			filepath: "package.json"
-		});
-		const text = Buffer.from(blob).toString("utf8");
-		const raw = JSON.parse(text).zenbu?.host;
-		if (typeof raw !== "string" || raw.trim().length === 0) return {
-			range: null,
-			missing: true
-		};
-		return {
-			range: raw.trim(),
-			missing: false
-		};
-	} catch {
-		return {
-			range: null,
-			missing: true
-		};
-	}
-}
-function isCompatible(hostVersion, range) {
-	if (!range) return true;
-	try {
-		return semver.satisfies(hostVersion, range, { includePrerelease: true });
-	} catch {
-		return false;
-	}
-}
-async function resolveTargetSha(input) {
-	const { fs, http, dir, mirror, hostVersion, reporter = null, signal } = input;
-	const remoteRef = `refs/remotes/origin/${mirror.branch}`;
-	reporter?.step?.("resolve", `Resolving compatible commit (host=${hostVersion})`);
-	const tipSha = await git.resolveRef({
-		fs,
-		dir,
-		ref: remoteRef
-	});
-	let consideredCommits = 1;
-	const tipInfo = await readZenbuHostAt({
-		fs,
-		dir,
-		commitOid: tipSha
-	});
-	if (isCompatible(hostVersion, tipInfo.range)) {
-		reporter?.message?.(`[resolve] tip ${tipSha.slice(0, 7)} ` + (tipInfo.range ? `range="${tipInfo.range}" ok for host=${hostVersion}` : `no zenbu.host declared; assuming compatible`));
-		reporter?.done?.("resolve");
-		return {
-			targetSha: tipSha,
-			tipSha,
-			consideredCommits,
-			exhaustedHistory: false
-		};
-	}
-	reporter?.message?.(`[resolve] tip ${tipSha.slice(0, 7)} range="${tipInfo.range}" does not satisfy host=${hostVersion}; deepening history...`);
-	let depth = FIRST_DEEPEN_DEPTH;
-	let lastSeen = 1;
-	let exhausted = false;
-	while (depth <= MAX_DEEPEN_DEPTH) {
-		if (signal?.aborted) throw new Error("resolveTargetSha aborted");
-		reporter?.progress?.({
-			phase: "resolve",
-			loaded: depth,
-			total: MAX_DEEPEN_DEPTH
-		});
-		try {
-			await git.fetch({
-				fs,
-				http,
-				dir,
-				url: mirror.url,
-				ref: mirror.branch,
-				singleBranch: true,
-				depth,
-				relative: false,
-				tags: false
-			});
-		} catch (err) {
-			reporter?.message?.(`[resolve] deepen depth=${depth} failed: ${err.message}`);
-			break;
-		}
-		const log = await git.log({
-			fs,
-			dir,
-			ref: remoteRef,
-			depth
-		});
-		if (log.length <= lastSeen) {
-			exhausted = true;
-			break;
-		}
-		lastSeen = log.length;
-		consideredCommits = log.length;
-		const oids = log.map((c) => c.oid);
-		let lo = 0;
-		let hi = oids.length;
-		while (lo < hi) {
-			if (signal?.aborted) throw new Error("resolveTargetSha aborted");
-			const mid = lo + hi >>> 1;
-			if (isCompatible(hostVersion, (await readZenbuHostAt({
-				fs,
-				dir,
-				commitOid: oids[mid]
-			})).range)) hi = mid;
-			else lo = mid + 1;
-		}
-		if (lo < oids.length) {
-			const targetSha = oids[lo];
-			reporter?.message?.(`[resolve] picked ${targetSha.slice(0, 7)} (${oids.length - lo} commits behind tip; host=${hostVersion} ok)`);
-			reporter?.done?.("resolve");
-			return {
-				targetSha,
-				tipSha,
-				consideredCommits,
-				exhaustedHistory: false
-			};
-		}
-		depth *= 2;
-	}
-	reporter?.message?.(`[resolve] no compatible commit found in ${consideredCommits} commits on origin/${mirror.branch} (host=${hostVersion})`);
-	reporter?.error?.({
-		id: "resolve",
-		message: `no commit on origin/${mirror.branch} declares zenbu.host that satisfies host=${hostVersion}`
-	});
-	return {
-		targetSha: null,
-		tipSha,
-		consideredCommits,
-		exhaustedHistory: exhausted
-	};
-}
-//#endregion
-//#region src/services/updater.ts
-/**
-* In-process source updater. Pulls the configured mirror via
-* `isomorphic-git`, finds the newest commit whose
-* `package.json#zenbu.host` semver range still satisfies the running
-* .app's `host.json#version`, applies it with HMR paused, and re-runs
-* the bundled package manager when the lockfile changes.
-*
-* Boundary contract:
-*   - In dev (`ZENBU_LAUNCHED_FROM_BUNDLE !== "1"` or no `app-config.json`),
-*     every action returns `{ status: "dev-mode" }` immediately. We
-*     never touch git or run an install in `pnpm dev`.
-*   - In production, all heavy work happens inside `update()`; `check()`
-*     does fetch + resolve but never modifies the working tree.
-*
-* Companion: `packages/core/src/launcher.ts` runs the SAME range
-* resolver (`shared/range-resolver.ts`) at every launch, so first
-* launches and updater-driven updates always agree on the target sha.
-*/
-var updater_exports = /* @__PURE__ */ __exportAll({ UpdaterService: () => UpdaterService });
-const log = createLogger("updater");
-const LEGACY_PACKAGE_MANAGER = {
-	type: "pnpm",
-	version: "10.33.0"
-};
-function isBundleMode() {
-	return process.env.ZENBU_LAUNCHED_FROM_BUNDLE === "1";
-}
-function readAppConfig(appPath) {
-	const configPath = path.join(appPath, "app-config.json");
-	try {
-		return JSON.parse(fs.readFileSync(configPath, "utf8"));
-	} catch {
-		return null;
-	}
-}
-function appsDirFor(name) {
-	if (process.env.ZENBU_APPS_DIR) return path.resolve(process.env.ZENBU_APPS_DIR);
-	return path.join(os.homedir(), ".zenbu", "apps", name);
-}
-async function hasLocalModifications(dir) {
-	try {
-		return (await git.statusMatrix({
-			fs,
-			dir
-		})).some(([, head, workdir, stage]) => head !== 1 || workdir !== 1 || stage !== 1);
-	} catch {
-		return false;
-	}
-}
-async function tryResolveHead(dir) {
-	try {
-		return await git.resolveRef({
-			fs,
-			dir,
-			ref: "HEAD"
-		});
-	} catch {
-		return null;
-	}
-}
-var UpdaterService = class extends Service.create({ key: "updater" }) {
-	status = { phase: "idle" };
-	listeners = /* @__PURE__ */ new Set();
-	inflight = null;
-	pollDisposers = /* @__PURE__ */ new Set();
-	evaluate() {
-		this.status = { phase: "idle" };
-		this.setup("updater-cancel", () => {
-			return () => {
-				this.inflight?.abort();
-				this.inflight = null;
-				for (const dispose of this.pollDisposers) try {
-					dispose();
-				} catch {}
-				this.pollDisposers.clear();
-			};
-		});
-		log.verbose(`updater service ready (mode=${isBundleMode() ? "bundle" : "dev"})`);
-	}
-	/**
-	* Returns the current `UpdaterPhase`. Cheap; safe to poll from the
-	* renderer at ~250ms cadence to drive a progress UI while
-	* `update()` runs.
-	*/
-	async getStatus() {
-		return this.status;
-	}
-	/**
-	* Synchronous-ish snapshot of the updater's environment. Doesn't
-	* touch the network. `currentSha` is read off-disk so very recent
-	* checkouts may lag by a few ms; callers that care about exactness
-	* should call `check()` first.
-	*/
-	async getInfo() {
-		if (!isBundleMode()) return {
-			mode: "dev",
-			appsDir: null,
-			hostVersion: null,
-			currentSha: null,
-			mirror: null,
-			packageManager: null
-		};
-		const ctx = this.loadContext();
-		if (!ctx) return {
-			mode: "bundle",
-			appsDir: null,
-			hostVersion: null,
-			currentSha: null,
-			mirror: null,
-			packageManager: null
-		};
-		const currentSha = await tryResolveHead(ctx.appsDir);
-		return {
-			mode: "bundle",
-			appsDir: ctx.appsDir,
-			hostVersion: ctx.hostVersion,
-			currentSha,
-			mirror: ctx.mirror,
-			packageManager: ctx.packageManager
-		};
-	}
-	/**
-	* Fetch + resolve target sha without touching the working tree. Use
-	* this for "is there an update?" UI. Cheap enough to call on a timer.
-	*/
-	async check() {
-		if (!isBundleMode()) return {
-			status: "dev-mode",
-			currentSha: null,
-			targetSha: null,
-			tipSha: null,
-			hasUpdate: false,
-			incompatibleHead: false
-		};
-		const ctx = this.loadContext();
-		if (!ctx) return {
-			status: ctx === null ? "no-mirror" : "no-host-version",
-			currentSha: null,
-			targetSha: null,
-			tipSha: null,
-			hasUpdate: false,
-			incompatibleHead: false,
-			error: "missing app-config.json or host.json (rebuild .app)"
-		};
-		this.setStatus({ phase: "checking" });
-		const reporter = this.makeReporter("checking");
-		const ac = new AbortController();
-		try {
-			await git.fetch({
-				fs,
-				http,
-				dir: ctx.appsDir,
-				url: ctx.mirror.url,
-				ref: ctx.mirror.branch,
-				singleBranch: true,
-				depth: 1,
-				tags: false,
-				onProgress: (e) => this.setStatus({
-					phase: "fetching",
-					loaded: e.loaded,
-					total: e.total,
-					ratio: e.total ? e.loaded / e.total : void 0
-				})
-			});
-			const result = await resolveTargetSha({
-				fs,
-				http,
-				dir: ctx.appsDir,
-				mirror: ctx.mirror,
-				hostVersion: ctx.hostVersion,
-				reporter,
-				signal: ac.signal
-			});
-			const currentSha = await tryResolveHead(ctx.appsDir);
-			const incompatibleHead = result.targetSha !== result.tipSha;
-			this.setStatus({ phase: "idle" });
-			return {
-				status: "ok",
-				currentSha,
-				targetSha: result.targetSha,
-				tipSha: result.tipSha,
-				hasUpdate: result.targetSha !== null && result.targetSha !== currentSha,
-				incompatibleHead
-			};
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			this.setStatus({
-				phase: "error",
-				message
-			});
-			return {
-				status: "error",
-				currentSha: null,
-				targetSha: null,
-				tipSha: null,
-				hasUpdate: false,
-				incompatibleHead: false,
-				error: message
-			};
-		}
-	}
-	/**
-	* Apply the latest compatible commit. Pauses HMR while git operations
-	* and `<pm> install` run, so the renderer never sees a half-applied
-	* tree. Refuses when the apps-dir has uncommitted edits.
-	*/
-	async update(opts) {
-		if (this.inflight) return { status: "in-progress" };
-		if (!isBundleMode()) return { status: "dev-mode" };
-		const ctx = this.loadContext();
-		if (!ctx) return {
-			status: "no-mirror",
-			error: "missing app-config.json or host.json (rebuild .app)"
-		};
-		const ac = this.inflight = new AbortController();
-		const release = pauseWatcherPath(ctx.appsDir);
-		let releaseCalled = false;
-		const safeRelease = () => {
-			if (releaseCalled) return;
-			releaseCalled = true;
-			try {
-				release();
-			} catch {}
-		};
-		try {
-			if (await hasLocalModifications(ctx.appsDir)) {
-				this.setStatus({ phase: "idle" });
-				return {
-					status: "dirty-tree",
-					error: `uncommitted changes in ${ctx.appsDir}; refusing to update`
-				};
-			}
-			const reporter = this.makeReporter("update");
-			this.setStatus({ phase: "fetching" });
-			await git.fetch({
-				fs,
-				http,
-				dir: ctx.appsDir,
-				url: ctx.mirror.url,
-				ref: ctx.mirror.branch,
-				singleBranch: true,
-				depth: 1,
-				tags: false,
-				onProgress: (e) => this.setStatus({
-					phase: "fetching",
-					loaded: e.loaded,
-					total: e.total,
-					ratio: e.total ? e.loaded / e.total : void 0
-				})
-			});
-			this.setStatus({
-				phase: "resolving",
-				depthConsidered: 1
-			});
-			const resolution = await resolveTargetSha({
-				fs,
-				http,
-				dir: ctx.appsDir,
-				mirror: ctx.mirror,
-				hostVersion: ctx.hostVersion,
-				reporter,
-				signal: ac.signal
-			});
-			if (resolution.targetSha === null) {
-				const message = `no commit on origin/${ctx.mirror.branch} declares zenbu.host that satisfies host=${ctx.hostVersion}`;
-				this.setStatus({
-					phase: "incompatible",
-					remoteHead: resolution.tipSha,
-					reason: message
-				});
-				return {
-					status: "incompatible",
-					error: message
-				};
-			}
-			const currentSha = await tryResolveHead(ctx.appsDir);
-			if (currentSha === resolution.targetSha) {
-				this.setStatus({
-					phase: "up-to-date",
-					sha: resolution.targetSha
-				});
-				return {
-					status: "up-to-date",
-					appliedSha: resolution.targetSha
-				};
-			}
-			if (opts?.dryRun) {
-				this.setStatus({ phase: "idle" });
-				return {
-					status: "applied",
-					appliedSha: resolution.targetSha,
-					reranInstall: false
-				};
-			}
-			log.verbose(`checking out ${resolution.targetSha.slice(0, 7)} (was ${currentSha?.slice(0, 7) ?? "?"})`);
-			await git.checkout({
-				fs,
-				dir: ctx.appsDir,
-				ref: resolution.targetSha,
-				force: true
-			});
-			const nextSig = await depsSignature(ctx.appsDir, ctx.packageManager);
-			const prevSig = await readDepsSig(ctx.appsDir);
-			let reranInstall = false;
-			if (prevSig !== nextSig) {
-				log.verbose(`lockfile changed; running ${ctx.packageManager.type}@${ctx.packageManager.version}`);
-				this.setStatus({
-					phase: "installing",
-					pm: `${ctx.packageManager.type}@${ctx.packageManager.version}`
-				});
-				await runInstall({
-					appsDir: ctx.appsDir,
-					resourcesPath: ctx.resourcesPath,
-					pm: ctx.packageManager,
-					reporter: this.makeInstallReporter(ctx.packageManager),
-					signal: ac.signal
-				});
-				await writeDepsSig(ctx.appsDir, nextSig);
-				reranInstall = true;
-			} else log.verbose("lockfile unchanged; skipping install");
-			this.setStatus({
-				phase: "applied",
-				sha: resolution.targetSha,
-				reranInstall
-			});
-			return {
-				status: "applied",
-				appliedSha: resolution.targetSha,
-				reranInstall
-			};
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			log.error(`update failed: ${message}`);
-			this.setStatus({
-				phase: "error",
-				message
-			});
-			return {
-				status: "error",
-				error: message
-			};
-		} finally {
-			safeRelease();
-			if (this.inflight === ac) this.inflight = null;
-		}
-	}
-	/**
-	* Subscribe to phase transitions. Fires synchronously with the
-	* current status on attach so callers can render initial state
-	* without a separate read.
-	*/
-	onChange(cb) {
-		this.listeners.add(cb);
-		try {
-			cb(this.status);
-		} catch (err) {
-			log.warn(`updater listener threw: ${err.message}`);
-		}
-		return () => {
-			this.listeners.delete(cb);
-		};
-	}
-	/**
-	* Convenience polling loop. Calls `check()` every `intervalMs` and,
-	* when `autoApply` is set, invokes `update()` whenever a new
-	* compatible target is found. Returns a disposer.
-	*/
-	startPolling(intervalMs, opts) {
-		if (!Number.isFinite(intervalMs) || intervalMs < 1e3) throw new Error(`[updater] startPolling requires intervalMs >= 1000 (got ${intervalMs})`);
-		let cancelled = false;
-		let timer = null;
-		const tick = async () => {
-			if (cancelled) return;
-			try {
-				const result = await this.check();
-				if (opts?.autoApply && result.status === "ok" && result.hasUpdate && result.targetSha) await this.update();
-			} catch (err) {
-				log.warn(`updater poll failed: ${err.message}`);
-			} finally {
-				if (!cancelled) {
-					timer = setTimeout(tick, intervalMs);
-					timer.unref?.();
-				}
-			}
-		};
-		timer = setTimeout(tick, intervalMs);
-		timer.unref?.();
-		const dispose = () => {
-			cancelled = true;
-			if (timer) {
-				clearTimeout(timer);
-				timer = null;
-			}
-			this.pollDisposers.delete(dispose);
-		};
-		this.pollDisposers.add(dispose);
-		return dispose;
-	}
-	loadContext() {
-		const appPath = app.getAppPath();
-		const cfg = readAppConfig(appPath);
-		if (!cfg || !cfg.mirrorUrl) return null;
-		const host = tryReadHostVersion(appPath);
-		if (!host) return null;
-		return {
-			appsDir: appsDirFor(cfg.name),
-			resourcesPath: path.dirname(appPath),
-			mirror: {
-				url: cfg.mirrorUrl,
-				branch: cfg.branch ?? "main"
-			},
-			packageManager: cfg.packageManager ?? LEGACY_PACKAGE_MANAGER,
-			hostVersion: host.version,
-			appName: cfg.name
-		};
-	}
-	setStatus(next) {
-		this.status = next;
-		for (const cb of this.listeners) try {
-			cb(next);
-		} catch (err) {
-			log.warn(`updater listener threw: ${err.message}`);
-		}
-	}
-	makeReporter(_label) {
-		return {
-			step: (id, _label2) => {
-				if (id === "resolve") this.setStatus({
-					phase: "resolving",
-					depthConsidered: 1
-				});
-			},
-			progress: (p) => {
-				const current = this.status;
-				if (current.phase === "resolving") this.setStatus({
-					phase: "resolving",
-					depthConsidered: p.loaded ?? current.depthConsidered
-				});
-				else if (current.phase === "fetching") this.setStatus({
-					phase: "fetching",
-					loaded: p.loaded,
-					total: p.total,
-					ratio: p.ratio
-				});
-			},
-			message: (text) => log.verbose(text),
-			error: ({ message }) => log.warn(`reporter error: ${message}`)
-		};
-	}
-	makeInstallReporter(pm) {
-		const pmLabel = `${pm.type}@${pm.version}`;
-		return {
-			message: (line) => {
-				const cur = this.status;
-				if (cur.phase === "installing") this.setStatus({
-					...cur,
-					line
-				});
-			},
-			progress: (p) => {
-				const cur = this.status;
-				if (cur.phase === "installing") this.setStatus({
-					...cur,
-					pm: pmLabel,
-					loaded: p.loaded,
-					total: p.total,
-					ratio: p.ratio
-				});
-			},
-			step: () => {},
-			done: () => {},
-			error: ({ message }) => log.warn(`install reporter error: ${message}`)
-		};
-	}
-};
-runtime.register(UpdaterService, import.meta);
-//#endregion
-export { updater_exports as n, UpdaterService as t };