@zogien/native-sdk 0.11.0-fork.2 → 0.11.0-fork.4

package/src/platform/macos/appkit_host.m

@@ -13271,6 +13271,372 @@ int native_sdk_appkit_check_for_updates(native_sdk_appkit_host_t *host, int user
     return 1;
 }
 
+// ---------------------------------------------------------------------------
+// App-driven updates (`updates.mode = "app"`): the platform half of
+// src/updater/engine.zig, reached through src/updater/macos.zig. Unlike the
+// host flow above, nothing here shows UI; the engine calls these from its
+// worker threads and from the app loop. The release stages beside the app,
+// `<parent>/.<App.app>.native-update/`, so installing it is a rename on the
+// same volume, and a helper installs it once this process exits.
+
+enum {
+    NativeSdkUpdateOk = 0,
+    NativeSdkUpdateNetwork = 1,
+    NativeSdkUpdateHttpStatus = 2,
+    NativeSdkUpdateTooLarge = 3,
+    NativeSdkUpdateCancelled = 4,
+    NativeSdkUpdateDisk = 5,
+};
+
+static NSString *NativeSdkUpdateString(const char *bytes, size_t length) {
+    if (!bytes || length == 0) return @"";
+    return [[NSString alloc] initWithBytes:bytes length:length encoding:NSUTF8StringEncoding] ?: @"";
+}
+
+static size_t NativeSdkUpdateCopy(NSString *value, char *output, size_t capacity) {
+    const char *bytes = value.UTF8String;
+    const size_t length = bytes ? strlen(bytes) : 0;
+    if (length == 0 || length > capacity) return 0;
+    memcpy(output, bytes, length);
+    return length;
+}
+
+static NSString *NativeSdkUpdateBundlePath(void) {
+    return NSBundle.mainBundle.bundlePath.stringByStandardizingPath;
+}
+
+static NSString *NativeSdkUpdateSiblingPath(NSString *suffix) {
+    NSString *bundlePath = NativeSdkUpdateBundlePath();
+    return [bundlePath.stringByDeletingLastPathComponent stringByAppendingPathComponent:[NSString stringWithFormat:@".%@.%@", bundlePath.lastPathComponent, suffix]];
+}
+
+static NSString *NativeSdkUpdateResultPath(NSString *bundleIdentifier) {
+    NSURL *support = [[NSFileManager defaultManager] URLsForDirectory:NSApplicationSupportDirectory inDomains:NSUserDomainMask].firstObject;
+    if (!support || bundleIdentifier.length == 0) return nil;
+    return [[support.path stringByAppendingPathComponent:bundleIdentifier] stringByAppendingPathComponent:@".native-update-result"];
+}
+
+static BOOL NativeSdkUpdateURLAllowed(NSURL *url, BOOL allowLoopbackHttp) {
+    NSString *scheme = url.scheme.lowercaseString;
+    if ([scheme isEqualToString:@"https"]) return url.host.length > 0;
+    if (!allowLoopbackHttp || ![scheme isEqualToString:@"http"]) return NO;
+    NSString *host = url.host.lowercaseString;
+    return [host isEqualToString:@"127.0.0.1"] || [host isEqualToString:@"::1"] || [host isEqualToString:@"localhost"];
+}
+
+/// The one app bundle a staged release unpacked to, when it is this app at
+/// `version`; Info.plist is read directly because NSBundle caches bundles
+/// by path and the staging path is reused.
+static NSString *NativeSdkUpdateStagedBundle(NSString *stagePath, NSString *bundleIdentifier, NSString *version) {
+    NSFileManager *manager = [NSFileManager defaultManager];
+    NSArray<NSString *> *entries = [manager contentsOfDirectoryAtPath:stagePath error:nil];
+    NSString *bundleName = nil;
+    for (NSString *entry in entries ?: @[]) {
+        if ([entry isEqualToString:@".native-staged"]) continue;
+        if (bundleName || ![[entry pathExtension].lowercaseString isEqualToString:@"app"]) return nil;
+        bundleName = entry;
+    }
+    if (!bundleName) return nil;
+    NSString *candidate = [stagePath stringByAppendingPathComponent:bundleName];
+    NSNumber *isDirectory = nil;
+    NSNumber *isSymlink = nil;
+    [[NSURL fileURLWithPath:candidate] getResourceValue:&isDirectory forKey:NSURLIsDirectoryKey error:nil];
+    [[NSURL fileURLWithPath:candidate] getResourceValue:&isSymlink forKey:NSURLIsSymbolicLinkKey error:nil];
+    if (!isDirectory.boolValue || isSymlink.boolValue) return nil;
+    NSDictionary *info = [NSDictionary dictionaryWithContentsOfFile:[candidate stringByAppendingPathComponent:@"Contents/Info.plist"]];
+    id identifier = info[@"CFBundleIdentifier"];
+    id bundleVersion = info[@"CFBundleVersion"];
+    if (![identifier isKindOfClass:[NSString class]] || ![identifier isEqualToString:bundleIdentifier]) return nil;
+    if (![bundleVersion isKindOfClass:[NSString class]] || ![bundleVersion isEqualToString:version]) return nil;
+    return candidate;
+}
+
+/// A Developer ID app accepts only a release signed by the same team, as
+/// the host flow does; unsigned and ad-hoc installs rely on the feed's
+/// Ed25519 signature alone.
+static BOOL NativeSdkUpdateSignatureMatches(NSString *candidate, NSString *bundleIdentifier) {
+    NSString *teamIdentifier = NativeSdkSigningTeamIdentifier(NativeSdkUpdateBundlePath());
+    if (teamIdentifier.length == 0) return YES;
+    if ([teamIdentifier rangeOfCharacterFromSet:[[NSCharacterSet alphanumericCharacterSet] invertedSet]].location != NSNotFound ||
+        [bundleIdentifier rangeOfCharacterFromSet:[NSCharacterSet characterSetWithCharactersInString:@"\\\""]].location != NSNotFound) return NO;
+    NSString *requirement = [NSString stringWithFormat:@"anchor apple generic and certificate leaf[subject.OU] = \"%@\" and identifier \"%@\"", teamIdentifier, bundleIdentifier];
+    return NativeSdkRunTask(@"/usr/bin/codesign", @[ @"--verify", @"--deep", @"--strict", [@"-R=" stringByAppendingString:requirement], candidate ], NULL);
+}
+
+typedef void (*NativeSdkUpdateProgressFn)(void *context, uint64_t received);
+typedef int (*NativeSdkUpdateCancelledFn)(void *context);
+
+@interface NativeSdkUpdateTransfer : NSObject <NSURLSessionDataDelegate>
+@property(nonatomic) BOOL allowLoopbackHttp;
+@property(nonatomic) uint64_t limit;
+@property(nonatomic) uint64_t received;
+@property(atomic) int result;
+@property(nonatomic, strong) NSMutableData *data;
+@property(nonatomic, strong) NSFileHandle *file;
+@property(nonatomic) void *context;
+@property(nonatomic) NativeSdkUpdateProgressFn progress;
+@property(nonatomic, strong) dispatch_semaphore_t done;
+@end
+
+@implementation NativeSdkUpdateTransfer
+
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task willPerformHTTPRedirection:(NSHTTPURLResponse *)response newRequest:(NSURLRequest *)request completionHandler:(void (^)(NSURLRequest *))completionHandler {
+    (void)session;
+    (void)response;
+    if (NativeSdkUpdateURLAllowed(request.URL, self.allowLoopbackHttp)) {
+        completionHandler(request);
+        return;
+    }
+    self.result = NativeSdkUpdateNetwork;
+    completionHandler(nil);
+    [task cancel];
+}
+
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveResponse:(NSURLResponse *)response completionHandler:(void (^)(NSURLSessionResponseDisposition))completionHandler {
+    (void)session;
+    (void)dataTask;
+    NSHTTPURLResponse *http = [response isKindOfClass:[NSHTTPURLResponse class]] ? (NSHTTPURLResponse *)response : nil;
+    if (!http || !NativeSdkUpdateURLAllowed(response.URL, self.allowLoopbackHttp)) {
+        self.result = NativeSdkUpdateNetwork;
+    } else if (http.statusCode < 200 || http.statusCode >= 300) {
+        self.result = NativeSdkUpdateHttpStatus;
+    } else if (response.expectedContentLength > 0 && (uint64_t)response.expectedContentLength > self.limit) {
+        self.result = NativeSdkUpdateTooLarge;
+    }
+    completionHandler(self.result == NativeSdkUpdateOk ? NSURLSessionResponseAllow : NSURLSessionResponseCancel);
+}
+
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data {
+    (void)session;
+    if (self.result != NativeSdkUpdateOk) return;
+    if (data.length > self.limit - self.received) {
+        self.result = NativeSdkUpdateTooLarge;
+        [dataTask cancel];
+        return;
+    }
+    if (self.file) {
+        NSError *error = nil;
+        if (![self.file writeData:data error:&error]) {
+            self.result = NativeSdkUpdateDisk;
+            [dataTask cancel];
+            return;
+        }
+    } else {
+        [self.data appendData:data];
+    }
+    self.received += data.length;
+    if (self.progress) self.progress(self.context, self.received);
+}
+
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didCompleteWithError:(NSError *)error {
+    (void)session;
+    (void)task;
+    if (error && self.result == NativeSdkUpdateOk) self.result = NativeSdkUpdateNetwork;
+    dispatch_semaphore_signal(self.done);
+}
+
+@end
+
+/// GETs `url` through the user's network settings, waiting on the calling
+/// (worker) thread and honoring `cancelled` while the transfer stalls.
+static int NativeSdkUpdateTransferRun(NSURL *url, NativeSdkUpdateTransfer *transfer, void *context, NativeSdkUpdateCancelledFn cancelled) {
+    NSURLSessionConfiguration *configuration = NSURLSessionConfiguration.ephemeralSessionConfiguration;
+    configuration.timeoutIntervalForRequest = 30;
+    configuration.timeoutIntervalForResource = 60 * 60;
+    configuration.requestCachePolicy = NSURLRequestReloadIgnoringLocalCacheData;
+    NSOperationQueue *queue = [[NSOperationQueue alloc] init];
+    queue.maxConcurrentOperationCount = 1;
+    NSURLSession *session = [NSURLSession sessionWithConfiguration:configuration delegate:transfer delegateQueue:queue];
+    transfer.done = dispatch_semaphore_create(0);
+    NSURLSessionDataTask *task = [session dataTaskWithURL:url];
+    [task resume];
+    while (dispatch_semaphore_wait(transfer.done, dispatch_time(DISPATCH_TIME_NOW, 200 * NSEC_PER_MSEC)) != 0) {
+        if (cancelled && cancelled(context) && transfer.result == NativeSdkUpdateOk) {
+            transfer.result = NativeSdkUpdateCancelled;
+            [task cancel];
+        }
+    }
+    [session finishTasksAndInvalidate];
+    return transfer.result;
+}
+
+int native_sdk_macos_updates_eligibility(void) {
+    @autoreleasepool {
+        NSString *bundlePath = NativeSdkUpdateBundlePath();
+        if (![bundlePath.pathExtension.lowercaseString isEqualToString:@"app"]) return 1;
+        // A quarantined app Gatekeeper runs from a randomized read-only
+        // mount cannot replace itself until the user moves it.
+        if ([bundlePath rangeOfString:@"/AppTranslocation/"].location != NSNotFound) return 2;
+        if (![[NSFileManager defaultManager] isWritableFileAtPath:bundlePath.stringByDeletingLastPathComponent]) return 2;
+        return 0;
+    }
+}
+
+size_t native_sdk_macos_updates_staged_version(const char *bundle_id, size_t bundle_id_len, char *output, size_t capacity) {
+    @autoreleasepool {
+        NSString *stagePath = NativeSdkUpdateSiblingPath(@"native-update");
+        NSString *version = [NSString stringWithContentsOfFile:[stagePath stringByAppendingPathComponent:@".native-staged"] encoding:NSUTF8StringEncoding error:nil];
+        if (version.length == 0 || !NativeSdkUpdateStagedBundle(stagePath, NativeSdkUpdateString(bundle_id, bundle_id_len), version)) return 0;
+        return NativeSdkUpdateCopy(version, output, capacity);
+    }
+}
+
+size_t native_sdk_macos_updates_take_last(const char *bundle_id, size_t bundle_id_len, char *output, size_t capacity) {
+    @autoreleasepool {
+        NSString *resultPath = NativeSdkUpdateResultPath(NativeSdkUpdateString(bundle_id, bundle_id_len));
+        if (!resultPath) return 0;
+        NSString *record = [NSString stringWithContentsOfFile:resultPath encoding:NSUTF8StringEncoding error:nil];
+        if (!record) return 0;
+        [[NSFileManager defaultManager] removeItemAtPath:resultPath error:nil];
+        NSString *line = [record stringByTrimmingCharactersInSet:NSCharacterSet.whitespaceAndNewlineCharacterSet];
+        if (![line hasPrefix:@"updated "]) return 0;
+        return NativeSdkUpdateCopy([line substringFromIndex:8], output, capacity);
+    }
+}
+
+int native_sdk_macos_updates_fetch(const char *url, size_t url_len, int allow_loopback_http, uint8_t *output, size_t capacity, size_t *output_len) {
+    @autoreleasepool {
+        NSURL *target = [NSURL URLWithString:NativeSdkUpdateString(url, url_len)];
+        if (!target || !NativeSdkUpdateURLAllowed(target, allow_loopback_http != 0)) return NativeSdkUpdateNetwork;
+        NativeSdkUpdateTransfer *transfer = [[NativeSdkUpdateTransfer alloc] init];
+        transfer.allowLoopbackHttp = allow_loopback_http != 0;
+        transfer.limit = capacity;
+        transfer.data = [NSMutableData data];
+        const int result = NativeSdkUpdateTransferRun(target, transfer, NULL, NULL);
+        if (result != NativeSdkUpdateOk) return result;
+        memcpy(output, transfer.data.bytes, transfer.data.length);
+        *output_len = transfer.data.length;
+        return NativeSdkUpdateOk;
+    }
+}
+
+int native_sdk_macos_updates_download(const char *url, size_t url_len, int allow_loopback_http, uint64_t limit, char *path_output, size_t path_capacity, size_t *path_len, void *context, NativeSdkUpdateProgressFn progress, NativeSdkUpdateCancelledFn cancelled) {
+    @autoreleasepool {
+        NSURL *target = [NSURL URLWithString:NativeSdkUpdateString(url, url_len)];
+        if (!target || !NativeSdkUpdateURLAllowed(target, allow_loopback_http != 0)) return NativeSdkUpdateNetwork;
+        NSString *path = [NSTemporaryDirectory() stringByAppendingPathComponent:[NSString stringWithFormat:@"native-update-%@.zip", NSUUID.UUID.UUIDString]];
+        NSFileManager *manager = [NSFileManager defaultManager];
+        if (![manager createFileAtPath:path contents:nil attributes:@{ NSFilePosixPermissions: @0600 }]) return NativeSdkUpdateDisk;
+        NSFileHandle *file = [NSFileHandle fileHandleForWritingAtPath:path];
+        if (!file) {
+            [manager removeItemAtPath:path error:nil];
+            return NativeSdkUpdateDisk;
+        }
+        NativeSdkUpdateTransfer *transfer = [[NativeSdkUpdateTransfer alloc] init];
+        transfer.allowLoopbackHttp = allow_loopback_http != 0;
+        transfer.limit = limit;
+        transfer.file = file;
+        transfer.context = context;
+        transfer.progress = progress;
+        int result = NativeSdkUpdateTransferRun(target, transfer, context, cancelled);
+        if (![file closeAndReturnError:nil] && result == NativeSdkUpdateOk) result = NativeSdkUpdateDisk;
+        const size_t length = NativeSdkUpdateCopy(path, path_output, path_capacity);
+        if (result == NativeSdkUpdateOk && length == 0) result = NativeSdkUpdateDisk;
+        if (result != NativeSdkUpdateOk) {
+            [manager removeItemAtPath:path error:nil];
+            return result;
+        }
+        *path_len = length;
+        return NativeSdkUpdateOk;
+    }
+}
+
+int native_sdk_macos_updates_stage(const char *archive_path, size_t archive_path_len, const char *bundle_id, size_t bundle_id_len, const char *version, size_t version_len) {
+    @autoreleasepool {
+        NSFileManager *manager = [NSFileManager defaultManager];
+        NSString *bundleIdentifier = NativeSdkUpdateString(bundle_id, bundle_id_len);
+        NSString *expectedVersion = NativeSdkUpdateString(version, version_len);
+        NSString *stagePath = NativeSdkUpdateSiblingPath(@"native-update");
+        [manager removeItemAtPath:stagePath error:nil];
+        if (![manager createDirectoryAtPath:stagePath withIntermediateDirectories:NO attributes:nil error:nil]) return 2;
+        NSString *candidate = nil;
+        if (NativeSdkRunTask(@"/usr/bin/ditto", @[ @"-x", @"-k", NativeSdkUpdateString(archive_path, archive_path_len), stagePath ], NULL)) {
+            candidate = NativeSdkUpdateStagedBundle(stagePath, bundleIdentifier, expectedVersion);
+        }
+        if (!candidate || !NativeSdkUpdateSignatureMatches(candidate, bundleIdentifier)) {
+            [manager removeItemAtPath:stagePath error:nil];
+            return 1;
+        }
+        if (![expectedVersion writeToFile:[stagePath stringByAppendingPathComponent:@".native-staged"] atomically:YES encoding:NSUTF8StringEncoding error:nil]) {
+            [manager removeItemAtPath:stagePath error:nil];
+            return 2;
+        }
+        return 0;
+    }
+}
+
+void native_sdk_macos_updates_discard(void) {
+    @autoreleasepool {
+        [[NSFileManager defaultManager] removeItemAtPath:NativeSdkUpdateSiblingPath(@"native-update") error:nil];
+    }
+}
+
+/// Starts the helper that waits for this process to exit, replaces the app
+/// with the staged release (the old one returns if that fails), records
+/// the switch for the new version to report, and with `relaunch` opens it.
+int native_sdk_macos_updates_install(const char *bundle_id, size_t bundle_id_len, const char *from_version, size_t from_version_len, int relaunch) {
+    @autoreleasepool {
+        NSFileManager *manager = [NSFileManager defaultManager];
+        NSString *bundleIdentifier = NativeSdkUpdateString(bundle_id, bundle_id_len);
+        NSString *stagePath = NativeSdkUpdateSiblingPath(@"native-update");
+        NSString *version = [NSString stringWithContentsOfFile:[stagePath stringByAppendingPathComponent:@".native-staged"] encoding:NSUTF8StringEncoding error:nil];
+        NSString *candidate = version.length > 0 ? NativeSdkUpdateStagedBundle(stagePath, bundleIdentifier, version) : nil;
+        if (!candidate) return 0;
+        NSString *scriptPath = [NSTemporaryDirectory() stringByAppendingPathComponent:[NSString stringWithFormat:@"native-update-install-%@.sh", NSUUID.UUID.UUIDString]];
+        NSString *script = @"#!/bin/sh\n"
+            "set -u\n"
+            "pid=\"$1\"; current=\"$2\"; candidate=\"$3\"; backup=\"$4\"; stage=\"$5\"; relaunch=\"$6\"; result=\"$7\"; from=\"$8\"; to=\"$9\"\n"
+            "count=0\n"
+            "while /bin/kill -0 \"$pid\" 2>/dev/null; do\n"
+            "  count=$((count + 1))\n"
+            "  if [ \"$count\" -ge 600 ]; then /bin/rm -f \"$0\"; exit 1; fi\n"
+            "  /bin/sleep 0.1\n"
+            "done\n"
+            "/bin/rm -rf \"$backup\"\n"
+            "if /bin/mv \"$current\" \"$backup\"; then\n"
+            "  if /bin/mv \"$candidate\" \"$current\"; then\n"
+            "    if [ -n \"$result\" ]; then /bin/mkdir -p \"${result%/*}\" && /usr/bin/printf 'updated %s %s\\n' \"$from\" \"$to\" > \"$result\"; fi\n"
+            "    if [ \"$relaunch\" != 1 ] || /usr/bin/open \"$current\"; then\n"
+            "      /bin/rm -rf \"$backup\" \"$stage\"\n"
+            "      /bin/rm -f \"$0\"\n"
+            "      exit 0\n"
+            "    fi\n"
+            "    if [ -n \"$result\" ]; then /bin/rm -f \"$result\"; fi\n"
+            "    /bin/rm -rf \"$current\"\n"
+            "  fi\n"
+            "  /bin/mv \"$backup\" \"$current\"\n"
+            "fi\n"
+            "/bin/rm -rf \"$stage\"\n"
+            "if [ \"$relaunch\" = 1 ]; then /usr/bin/open \"$current\" >/dev/null 2>&1 || true; fi\n"
+            "/bin/rm -f \"$0\"\n"
+            "exit 1\n";
+        if (![script writeToFile:scriptPath atomically:YES encoding:NSUTF8StringEncoding error:nil] ||
+            ![manager setAttributes:@{ NSFilePosixPermissions: @0700 } ofItemAtPath:scriptPath error:nil]) {
+            [manager removeItemAtPath:scriptPath error:nil];
+            return 0;
+        }
+        NSTask *installer = [[NSTask alloc] init];
+        installer.executableURL = [NSURL fileURLWithPath:@"/bin/sh"];
+        installer.arguments = @[
+            scriptPath,
+            [NSString stringWithFormat:@"%d", getpid()],
+            NativeSdkUpdateBundlePath(),
+            candidate,
+            NativeSdkUpdateSiblingPath(@"native-update-backup"),
+            stagePath,
+            relaunch ? @"1" : @"0",
+            NativeSdkUpdateResultPath(bundleIdentifier) ?: @"",
+            NativeSdkUpdateString(from_version, from_version_len),
+            version,
+        ];
+        if (![installer launchAndReturnError:nil]) {
+            [manager removeItemAtPath:scriptPath error:nil];
+            return 0;
+        }
+        return 1;
+    }
+}
+
 void native_sdk_appkit_run(native_sdk_appkit_host_t *host, native_sdk_appkit_event_callback_t callback, void *context) {
     NativeSdkAppKitHost *object = (__bridge NativeSdkAppKitHost *)host;
     [object runWithCallback:callback context:context];

package/src/platform/macos/root.zig

@@ -9,6 +9,7 @@ const canvas = @import("canvas");
 // macOS mask/inset render so the Dock tile matches `native package`.
 const app_icon = canvas.app_icon;
 const updater_c_api = @import("../../updater/c_api.zig");
+const update_feed = @import("../../updater/feed.zig");
 
 comptime {
     _ = updater_c_api.native_sdk_update_verify_feed;
@@ -685,12 +686,10 @@ pub const MacPlatform = struct {
         const dock_icon = planDockIcon(app_info.icon_path);
         const icon_path = if (dock_icon == .host_file) app_info.icon_path else "";
         const host = native_sdk_appkit_create(app_info.app_name.ptr, app_info.app_name.len, display_name.ptr, display_name.len, app_info.version.ptr, app_info.version.len, app_info.description.ptr, app_info.description.len, if (app_info.has_web_content) 1 else 0, if (app_info.dock_visible) 1 else 0, window_title.ptr, window_title.len, app_info.bundle_id.ptr, app_info.bundle_id.len, icon_path.ptr, icon_path.len, window_options.label.ptr, window_options.label.len, frame.x, frame.y, frame.width, frame.height, if (window_options.restore_state) 1 else 0, initialPlacementInt(window_options.initial_placement), restorePolicyInt(window_options.restore_policy), if (window_options.resizable) 1 else 0, titlebarStyleInt(window_options.titlebar), showModeInt(window_options.show), windowFlags(window_options)) orelse return error.CreateFailed;
-        const update_target = comptime switch (builtin.cpu.arch) {
-            .aarch64 => "macos-aarch64",
-            .x86_64 => "macos-x86_64",
-            else => "macos-unsupported",
-        };
-        native_sdk_appkit_configure_updates(host, app_info.update_feed_url.ptr, app_info.update_feed_url.len, app_info.update_public_key.ptr, app_info.update_public_key.len, if (app_info.update_check_on_start) 1 else 0, update_target.ptr, update_target.len);
+        const update_target = comptime update_feed.currentTarget() orelse "macos-unsupported";
+        var update_feed_url_buffer: [update_feed.max_feed_url_bytes]u8 = undefined;
+        const update_feed_url = expandedUpdateFeedUrl(&update_feed_url_buffer, app_info.update_feed_url, update_target, app_info.version);
+        native_sdk_appkit_configure_updates(host, update_feed_url.ptr, update_feed_url.len, app_info.update_public_key.ptr, app_info.update_public_key.len, if (app_info.update_check_on_start) 1 else 0, update_target.ptr, update_target.len);
         switch (dock_icon) {
             .host_file => {},
             .masked_render => spawnDevDockIconRender(host, app_info.icon_path),
@@ -2390,6 +2389,18 @@ fn checkForUpdates(context: ?*anyopaque, user_initiated: bool) anyerror!void {
     if (native_sdk_appkit_check_for_updates(self.host, if (user_initiated) 1 else 0) == 0) return error.UnsupportedService;
 }
 
+/// The feed URL the host fetches: the manifest's, with `{target}` and
+/// `{current_version}` expanded for this install. A URL this build cannot
+/// expand leaves updates unconfigured rather than fetching some other
+/// target's feed.
+fn expandedUpdateFeedUrl(buffer: []u8, template: []const u8, target: []const u8, version: []const u8) []const u8 {
+    if (template.len == 0) return "";
+    return update_feed.expandFeedUrl(buffer, template, target, version) catch |err| {
+        std.log.warn("updates disabled: feed_url cannot be expanded for {s} {s} ({s})", .{ target, version, @errorName(err) });
+        return "";
+    };
+}
+
 fn configureSecurityPolicy(context: ?*anyopaque, policy: security.Policy) anyerror!void {
     const self: *MacPlatform = @ptrCast(@alignCast(context.?));
     var origins_buffer: [4096]u8 = undefined;
@@ -3103,6 +3114,18 @@ test "mac updater hashes archives off the main thread and treats user cancellati
     try std.testing.expect(std.mem.indexOf(u8, download_body, "strongSelf.updateCheckRunning = NO;") != null);
 }
 
+test "mac updater fetches the feed URL expanded for this install" {
+    var buffer: [update_feed.max_feed_url_bytes]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        "https://example.com/releases/macos-aarch64/native-update.json?from=1.2.3",
+        expandedUpdateFeedUrl(&buffer, "https://example.com/releases/{target}/native-update.json?from={current_version}", "macos-aarch64", "1.2.3"),
+    );
+    try std.testing.expectEqualStrings("", expandedUpdateFeedUrl(&buffer, "", "macos-aarch64", "1.2.3"));
+    // A build with no release format fetches nothing rather than another
+    // target's feed.
+    try std.testing.expectEqualStrings("", expandedUpdateFeedUrl(&buffer, "https://example.com/{target}.json", "macos-unsupported", "1.2.3"));
+}
+
 test "mac updater binds packaged releases to the installed bundle identity" {
     const host_source = @embedFile("appkit_host.m");
     try std.testing.expect(std.mem.indexOf(u8, host_source, "static NSString *NativeSdkPackagedBundleIdentifier(void)") != null);

package/src/platform/null_platform.zig

@@ -448,6 +448,11 @@ pub const NullPlatform = struct {
     /// real hosts' close delegates, hiding instead of closing under
     /// `.hide`.
     window_close_policy: [max_windows]types.WindowClosePolicy = [_]types.WindowClosePolicy{.quit} ** max_windows,
+    /// Close requests (`request_close_window_fn`) not yet handled, oldest
+    /// first. The Windows host posts WM_CLOSE, so a requested close
+    /// resolves on a later loop turn; `takeQueuedCloseRequest` models it.
+    queued_close_requests: [max_windows]WindowId = [_]WindowId{0} ** max_windows,
+    queued_close_request_count: usize = 0,
     /// Test seam: refuse one OS create without retaining a window identity.
     fail_next_create_window: bool = false,
     /// Test seam: make the NEXT `close_window_fn` call fail with
@@ -918,6 +923,9 @@ pub const NullPlatform = struct {
                 .focus_window_fn = focusWindow,
                 .close_window_fn = closeWindow,
                 .minimize_window_fn = minimizeWindow,
+                .maximize_window_fn = maximizeWindow,
+                .unmaximize_window_fn = unmaximizeWindow,
+                .request_close_window_fn = requestCloseWindow,
                 .hide_window_fn = hideWindow,
                 .show_window_fn = showWindow,
                 .set_dock_presence_fn = setDockPresence,
@@ -1319,6 +1327,36 @@ pub const NullPlatform = struct {
         self.window_occluded[index] = true;
     }
 
+    /// The modeled maximize: the refusals the Windows host makes, then the
+    /// state flip its WM_SIZE handler reports. `windowFrameEvent` hands a
+    /// test the frame event that report carries.
+    fn maximizeWindow(context: ?*anyopaque, window_id: WindowId) anyerror!void {
+        const self: *NullPlatform = @ptrCast(@alignCast(context.?));
+        const index = self.findWindowIndex(window_id) orelse return error.WindowNotFound;
+        if (!self.windows[index].open) return error.WindowNotFound;
+        if (!self.window_resizable[index]) return error.WindowNotResizable;
+        if (self.windows[index].hidden or !self.window_visible[index]) return error.WindowHidden;
+        self.windows[index].maximized = true;
+    }
+
+    fn unmaximizeWindow(context: ?*anyopaque, window_id: WindowId) anyerror!void {
+        const self: *NullPlatform = @ptrCast(@alignCast(context.?));
+        const index = self.findWindowIndex(window_id) orelse return error.WindowNotFound;
+        if (!self.windows[index].open) return error.WindowNotFound;
+        if (!self.windows[index].maximized) return;
+        if (self.windows[index].hidden or !self.window_visible[index]) return error.WindowHidden;
+        self.windows[index].maximized = false;
+    }
+
+    fn requestCloseWindow(context: ?*anyopaque, window_id: WindowId) anyerror!void {
+        const self: *NullPlatform = @ptrCast(@alignCast(context.?));
+        const index = self.findWindowIndex(window_id) orelse return error.WindowNotFound;
+        if (!self.windows[index].open) return error.WindowNotFound;
+        if (self.queued_close_request_count >= self.queued_close_requests.len) return error.WindowLimitReached;
+        self.queued_close_requests[self.queued_close_request_count] = window_id;
+        self.queued_close_request_count += 1;
+    }
+
     fn showWindow(context: ?*anyopaque, window_id: WindowId) anyerror!void {
         const self: *NullPlatform = @ptrCast(@alignCast(context.?));
         if (self.fail_next_show_window) {
@@ -2928,6 +2966,7 @@ pub const NullPlatform = struct {
                 .open = true,
                 .focused = false,
                 .hidden = true,
+                .maximized = info.maximized,
             } };
         }
         const info = self.windows[index];
@@ -2945,6 +2984,33 @@ pub const NullPlatform = struct {
         } };
     }
 
+    /// Test seam: drain the oldest queued close request, the modeled loop
+    /// turn on which the host handles its posted WM_CLOSE. It resolves
+    /// exactly like `userCloseWindow` (close_policy decides); dispatch the
+    /// returned event through the runtime. Null while nothing is queued,
+    /// or when the window closed before its turn (a WM_CLOSE posted to a
+    /// destroyed window is never delivered).
+    pub fn takeQueuedCloseRequest(self: *NullPlatform) ?Event {
+        if (self.queued_close_request_count == 0) return null;
+        const window_id = self.queued_close_requests[0];
+        var cursor: usize = 0;
+        while (cursor + 1 < self.queued_close_request_count) : (cursor += 1) {
+            self.queued_close_requests[cursor] = self.queued_close_requests[cursor + 1];
+        }
+        self.queued_close_request_count -= 1;
+        const index = self.findWindowIndex(window_id) orelse return null;
+        if (!self.windows[index].open) return null;
+        return self.userCloseWindow(window_id);
+    }
+
+    /// Test seam: the frame event for a window's current modeled state,
+    /// `maximized` included: what the Windows host emits when a maximize
+    /// or restore lands. Null for an unknown window.
+    pub fn windowFrameEvent(self: *const NullPlatform, window_id: WindowId) ?Event {
+        const index = self.findWindowIndex(window_id) orelse return null;
+        return .{ .window_frame_changed = self.windows[index].state() };
+    }
+
     /// Test seam: the user asked the app to come back with no window on
     /// the glass (the macOS Dock-icon reopen). Models the host's
     /// `applicationShouldHandleReopen:` — every window hidden by its

package/src/platform/root.zig

@@ -119,6 +119,7 @@ pub const ViewPatch = types.ViewPatch;
 pub const Cursor = types.Cursor;
 pub const ViewInfo = types.ViewInfo;
 pub const AppInfo = types.AppInfo;
+pub const UpdateMode = types.UpdateMode;
 pub const Surface = types.Surface;
 pub const BridgeMessage = types.BridgeMessage;
 pub const ViewFocusEvent = types.ViewFocusEvent;

package/src/platform/types.zig

@@ -718,6 +718,10 @@ pub const WindowInfo = struct {
     focused: bool = false,
     /// Alive but policy-hidden — see `WindowState.hidden`.
     hidden: bool = false,
+    /// Maximized as last reported by the host's frame event, whichever
+    /// path changed it (app call, caption double-click, system menu,
+    /// keyboard shortcut). Hosts that do not report it leave it false.
+    maximized: bool = false,
 
     pub fn state(self: WindowInfo) WindowState {
         return .{
@@ -729,6 +733,7 @@ pub const WindowInfo = struct {
             .open = self.open,
             .focused = self.focused,
             .hidden = self.hidden,
+            .maximized = self.maximized,
         };
     }
 };
@@ -1284,6 +1289,9 @@ pub const ViewInfo = struct {
     }
 };
 
+/// Who drives updates on macOS (the manifest's `updates.mode`).
+pub const UpdateMode = enum { host, app };
+
 pub const AppInfo = struct {
     app_name: []const u8 = "native-sdk",
     /// The human-facing application name (app.zon `display_name`) the
@@ -1318,9 +1326,15 @@ pub const AppInfo = struct {
     window_title: []const u8 = "",
     bundle_id: []const u8 = "dev.native_sdk.app",
     icon_path: []const u8 = "",
+    /// The manifest's feed URL, before the host expands `{target}` and
+    /// `{current_version}` for this install.
     update_feed_url: []const u8 = "",
+    /// The trusted update keys: base64 Ed25519 public keys, comma-joined.
     update_public_key: []const u8 = "",
     update_check_on_start: bool = false,
+    /// `.app`: the app drives updates through `native-sdk.updates` and the
+    /// macOS host shows no update UI of its own.
+    update_mode: UpdateMode = .host,
     main_window: WindowOptions = .{},
     windows: []const WindowOptions = &.{},
 
@@ -2708,6 +2722,23 @@ pub const PlatformServices = struct {
     /// controls — chromeless windows have no system button to click.
     /// Platforms without the concept leave this null.
     minimize_window_fn: ?*const fn (context: ?*anyopaque, window_id: WindowId) anyerror!void = null,
+    /// The OS maximize and restore-from-maximized verbs for app-drawn
+    /// window controls (Windows `SW_MAXIMIZE`/`SW_RESTORE`). Hosts refuse
+    /// a non-resizable window (`error.WindowNotResizable`, the system has
+    /// no maximize affordance for it) and a window that is not on the
+    /// glass (`error.WindowHidden`). Unmaximizing a window that is not
+    /// maximized succeeds without effect. The resulting state arrives on
+    /// the window's frame event (`WindowState.maximized`). Platforms
+    /// without the verbs leave these null.
+    maximize_window_fn: ?*const fn (context: ?*anyopaque, window_id: WindowId) anyerror!void = null,
+    unmaximize_window_fn: ?*const fn (context: ?*anyopaque, window_id: WindowId) anyerror!void = null,
+    /// Ask the window to close the way the user's close button does
+    /// (Windows posts `WM_CLOSE`), so `close_policy` decides between
+    /// hiding and closing. Unlike `close_window_fn` this only queues the
+    /// request: the outcome arrives later as the host's ordinary frame
+    /// events, exactly like a user close. Platforms without the verb
+    /// leave this null.
+    request_close_window_fn: ?*const fn (context: ?*anyopaque, window_id: WindowId) anyerror!void = null,
     /// Keep a live window and all of its views, but order it off the
     /// glass. The runtime marks `WindowInfo.hidden` while it is out;
     /// `show_window_fn` is the inverse. Platforms without a reliable
@@ -3167,6 +3198,21 @@ pub const PlatformServices = struct {
         return minimize_fn(self.context, window_id);
     }
 
+    pub fn maximizeWindow(self: PlatformServices, window_id: WindowId) anyerror!void {
+        const maximize_fn = self.maximize_window_fn orelse return error.UnsupportedService;
+        return maximize_fn(self.context, window_id);
+    }
+
+    pub fn unmaximizeWindow(self: PlatformServices, window_id: WindowId) anyerror!void {
+        const unmaximize_fn = self.unmaximize_window_fn orelse return error.UnsupportedService;
+        return unmaximize_fn(self.context, window_id);
+    }
+
+    pub fn requestCloseWindow(self: PlatformServices, window_id: WindowId) anyerror!void {
+        const request_fn = self.request_close_window_fn orelse return error.UnsupportedService;
+        return request_fn(self.context, window_id);
+    }
+
     pub fn hideWindow(self: PlatformServices, window_id: WindowId) anyerror!void {
         const hide_fn = self.hide_window_fn orelse return error.UnsupportedService;
         return hide_fn(self.context, window_id);