@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.4

package/src/tooling/manifest.zig

@@ -212,6 +212,9 @@ pub const Metadata = struct {
         if (self.url_schemes.len > 0) allocator.free(self.url_schemes);
         if (self.updates.feed_url) |value| allocator.free(value);
         if (self.updates.public_key) |value| allocator.free(value);
+        for (self.updates.public_keys) |value| allocator.free(value);
+        if (self.updates.public_keys.len > 0) allocator.free(self.updates.public_keys);
+        if (self.updates.mode) |value| allocator.free(value);
         if (self.dmg.volume_name) |value| allocator.free(value);
         if (self.dmg.background) |value| allocator.free(value);
         for (self.dmg.items) |item| {
@@ -425,11 +428,50 @@ pub const DmgMetadata = struct {
 pub const UpdateMetadata = struct {
     feed_url: ?[]const u8 = null,
     public_key: ?[]const u8 = null,
+    public_keys: []const []const u8 = &.{},
     check_on_start: bool = false,
+    /// `host` or `app`; null leaves the host default.
+    mode: ?[]const u8 = null,
 
     pub fn enabled(self: UpdateMetadata) bool {
         return self.feed_url != null;
     }
+
+    /// Whether `public_key` is set and it and every `public_keys` entry
+    /// decode as base64 Ed25519 public keys.
+    pub fn publicKeysAreValid(self: UpdateMetadata) bool {
+        const primary = self.public_key orelse return false;
+        if (decodeUpdatePublicKey(primary) == null) return false;
+        for (self.public_keys) |key| {
+            if (decodeUpdatePublicKey(key) == null) return false;
+        }
+        return true;
+    }
+
+    /// Whether `public_key` or one of `public_keys` decodes to the same key
+    /// as this base64 public key.
+    pub fn trustsPublicKey(self: UpdateMetadata, public_key: []const u8) bool {
+        const wanted = decodeUpdatePublicKey(public_key) orelse return false;
+        if (self.public_key) |primary| {
+            if (decodeUpdatePublicKey(primary)) |bytes| {
+                if (std.mem.eql(u8, &bytes, &wanted)) return true;
+            }
+        }
+        for (self.public_keys) |key| {
+            if (decodeUpdatePublicKey(key)) |bytes| {
+                if (std.mem.eql(u8, &bytes, &wanted)) return true;
+            }
+        }
+        return false;
+    }
+
+    fn decodeUpdatePublicKey(value: []const u8) ?[32]u8 {
+        var bytes: [32]u8 = undefined;
+        const size = std.base64.standard.Decoder.calcSizeForSlice(value) catch return null;
+        if (size != bytes.len) return null;
+        std.base64.standard.Decoder.decode(&bytes, value) catch return null;
+        return bytes;
+    }
 };
 
 pub const FrontendDevMetadata = struct {
@@ -580,7 +622,9 @@ pub fn validateFile(allocator: std.mem.Allocator, io: std.Io, path: []const u8)
     defer allocator.free(file_associations);
     const url_schemes = parseUrlSchemes(allocator, metadata.url_schemes) catch return .{ .ok = false, .message = "app manifest URL schemes are invalid" };
     defer allocator.free(url_schemes);
-    const updates = convertUpdates(metadata.updates) catch return .{ .ok = false, .message = "app manifest updates are invalid - updates require an HTTPS feed_url and a base64 Ed25519 public_key; check_on_start requires both" };
+    const updates_message = "app manifest updates are invalid - updates require an HTTPS feed_url and a base64 Ed25519 public_key; public_keys adds at most 3 further distinct keys; feed_url may name {target} and {current_version} in its path or query; check_on_start requires both; mode is \"host\" or \"app\"";
+    const updates = convertUpdates(metadata.updates) catch return .{ .ok = false, .message = updates_message };
+    app_manifest.validateUpdates(updates) catch return .{ .ok = false, .message = updates_message };
     // General manifest validation owns only values the app explicitly
     // declared. Archive-time fallbacks (notably display_name as the volume
     // name) are validated when a macOS archive is actually requested, so an
@@ -751,17 +795,20 @@ fn duplicateRawUpdates(allocator: std.mem.Allocator, raw: RawUpdates) !UpdateMet
     return .{
         .feed_url = try duplicateOptionalString(allocator, raw.feed_url),
         .public_key = try duplicateOptionalString(allocator, raw.public_key),
+        .public_keys = try duplicateStringList(allocator, raw.public_keys),
         .check_on_start = raw.check_on_start,
+        .mode = try duplicateOptionalString(allocator, raw.mode),
     };
 }
 
 fn convertUpdates(updates: UpdateMetadata) !app_manifest.UpdateConfig {
-    if (updates.feed_url == null and updates.public_key == null and !updates.check_on_start) return .{};
+    if (updates.feed_url == null and updates.public_key == null and updates.public_keys.len == 0 and !updates.check_on_start and updates.mode == null) return .{};
     const feed_url = updates.feed_url orelse return error.InvalidUpdates;
     const public_key = updates.public_key orelse return error.InvalidUpdates;
     if (!std.mem.startsWith(u8, feed_url, "https://")) return error.InvalidUpdates;
     if (public_key.len == 0) return error.InvalidUpdates;
-    return .{ .feed_url = feed_url, .public_key = public_key, .check_on_start = updates.check_on_start };
+    const mode: app_manifest.UpdateMode = if (updates.mode) |value| std.meta.stringToEnum(app_manifest.UpdateMode, value) orelse return error.InvalidUpdates else .host;
+    return .{ .feed_url = feed_url, .public_key = public_key, .public_keys = updates.public_keys, .check_on_start = updates.check_on_start, .mode = mode };
 }
 
 fn duplicateRawServicePackages(allocator: std.mem.Allocator, packages: []const raw_manifest.RawServicePackage) ![]const ServicePackageMetadata {
@@ -2555,6 +2602,67 @@ test "JSON manifest parser carries native update configuration" {
     try std.testing.expectEqualStrings("https://example.com/native-update.json", metadata.updates.feed_url.?);
 }
 
+test "JSON manifest parser carries per-target feeds and rotated update keys" {
+    const metadata = try parseJsonText(std.testing.allocator,
+        \\{
+        \\  "id": "com.example.updates",
+        \\  "name": "updates",
+        \\  "version": "1.2.3",
+        \\  "updates": {
+        \\    "feed_url": "https://example.com/releases/{target}/native-update.json",
+        \\    "public_key": "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo=",
+        \\    "public_keys": ["11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="],
+        \\    "mode": "app"
+        \\  }
+        \\}
+    );
+    defer metadata.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("https://example.com/releases/{target}/native-update.json", metadata.updates.feed_url.?);
+    try std.testing.expectEqualStrings("app", metadata.updates.mode.?);
+    try std.testing.expectEqual(app_manifest.UpdateMode.app, (try convertUpdates(metadata.updates)).mode);
+    try std.testing.expect(metadata.updates.trustsPublicKey("wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo="));
+    try std.testing.expect(metadata.updates.trustsPublicKey("11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="));
+    try std.testing.expect(!metadata.updates.trustsPublicKey("IBLLkMpg6OXY2vZuInLSIz4EhtVX6MZhQe2JIBd9frc="));
+}
+
+test "manifest validation names the update rules" {
+    var cwd = std.Io.Dir.cwd();
+    const root = ".zig-cache/test-validate-updates";
+    try cwd.deleteTree(std.testing.io, root);
+    defer cwd.deleteTree(std.testing.io, root) catch {};
+    try cwd.createDirPath(std.testing.io, root);
+    try cwd.writeFile(std.testing.io, .{ .sub_path = root ++ "/app.json", .data =
+        \\{
+        \\  "id": "com.example.updates",
+        \\  "name": "updates",
+        \\  "version": "1.2.3",
+        \\  "updates": {
+        \\    "feed_url": "https://example.com/{arch}/native-update.json",
+        \\    "public_key": "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo="
+        \\  }
+        \\}
+    });
+    const result = try validateFile(std.testing.allocator, std.testing.io, root ++ "/app.json");
+    try std.testing.expect(!result.ok);
+    try std.testing.expect(std.mem.indexOf(u8, result.message, "{target} and {current_version}") != null);
+
+    try cwd.writeFile(std.testing.io, .{ .sub_path = root ++ "/app.json", .data =
+        \\{
+        \\  "id": "com.example.updates",
+        \\  "name": "updates",
+        \\  "version": "1.2.3",
+        \\  "updates": {
+        \\    "feed_url": "https://example.com/{target}/native-update.json",
+        \\    "public_key": "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo=",
+        \\    "mode": "automatic"
+        \\  }
+        \\}
+    });
+    const mode_result = try validateFile(std.testing.allocator, std.testing.io, root ++ "/app.json");
+    try std.testing.expect(!mode_result.ok);
+    try std.testing.expect(std.mem.indexOf(u8, mode_result.message, "mode is \"host\" or \"app\"") != null);
+}
+
 test "JSON file validation rejects null with a teaching diagnostic regardless of extension case" {
     var cwd = std.Io.Dir.cwd();
     const root = ".zig-cache/test-validate-json-null";

package/src/tooling/package.zig

@@ -9,6 +9,7 @@ const diagnostics = @import("diagnostics");
 const ios_tool = @import("ios.zig");
 const manifest_tool = @import("manifest.zig");
 const web_engine_tool = @import("web_engine.zig");
+const windows_installer = @import("windows_installer.zig");
 const xcodeproj_tool = @import("xcodeproj.zig");
 
 /// The SDK's default app icon (kept in sync by `zig build generate-icon`):
@@ -86,9 +87,14 @@ pub const PackageOptions = struct {
     /// then staple and validate its ticket. Requires identity signing and a
     /// notarytool Keychain profile in `signing.profile`.
     notarize: bool = false,
-    /// Emit the ZIP consumed by the native updater. macOS only; unlike the
-    /// user-facing DMG, this archive contains exactly the packaged .app.
+    /// Emit the ZIP consumed by the native updater. On macOS it contains
+    /// exactly the packaged .app (unlike the user-facing DMG); on Windows
+    /// it is the install image a setup program carries
+    /// (windows_installer.zig).
     update_archive: bool = false,
+    /// Emit a per-user setup program beside a Windows artifact
+    /// (windows_installer.zig). Windows only.
+    installer: bool = false,
     /// The process environment, when the caller has one (the CLI). The
     /// Android artifact probes it for the SDK/NDK toolchain to assemble
     /// the debug APK; without it the generated project is still complete
@@ -161,6 +167,7 @@ pub const PackageStats = struct {
     web_layer: ?manifest_tool.WebLayer = null,
     archive_path: ?[]const u8 = null,
     update_archive_path: ?[]const u8 = null,
+    installer_path: ?[]const u8 = null,
     /// The Windows subsystem verdict: `console` when the package
     /// wrapped a CONSOLE-subsystem exe (the app will flash a terminal
     /// window behind itself on every launch), `gui` for a GUI-subsystem
@@ -278,13 +285,51 @@ pub fn createPackage(allocator: std.mem.Allocator, io: std.Io, options: PackageO
         stats.notarized = true;
     }
     if (options.update_archive) {
-        if (options.target != .macos) return error.UnsupportedUpdateTarget;
         if (!options.metadata.updates.enabled()) return error.UpdatesNotConfigured;
-        stats.update_archive_path = try createUpdateArchive(allocator, io, options);
+        stats.update_archive_path = switch (options.target) {
+            .macos => try createUpdateArchive(allocator, io, options),
+            .windows => try createWindowsImageFile(allocator, io, options, .update_archive),
+            else => return error.UnsupportedUpdateTarget,
+        };
+    }
+    if (options.installer) {
+        if (options.target != .windows) return error.UnsupportedInstallerTarget;
+        stats.installer_path = try createWindowsImageFile(allocator, io, options, .setup);
     }
     return stats;
 }
 
+/// The per-user setup program or the update archive, beside the artifact
+/// directory, for the architecture of the packaged executable.
+fn createWindowsImageFile(allocator: std.mem.Allocator, io: std.Io, options: PackageOptions, kind: enum { setup, update_archive }) ![]const u8 {
+    const binary_path = options.binary_path orelse {
+        std.debug.print("error: --installer and --update-archive need the app executable; pass --binary\n", .{});
+        return error.MissingBinary;
+    };
+    const arch: windows_installer.Arch = if (try peExecutableIsArm64(io, binary_path)) .aarch64 else .x86_64;
+    const executable = try std.fmt.allocPrint(allocator, "{s}.exe", .{options.metadata.name});
+    defer allocator.free(executable);
+    const file_name = switch (kind) {
+        .setup => try windows_installer.setupFileName(allocator, options.metadata, arch),
+        .update_archive => try windows_installer.updateArchiveFileName(allocator, options.metadata, arch),
+    };
+    defer allocator.free(file_name);
+    const path = try std.fs.path.join(allocator, &.{ std.fs.path.dirname(options.output_path) orelse ".", file_name });
+    errdefer allocator.free(path);
+    const image_options: windows_installer.Options = .{
+        .artifact_dir = options.output_path,
+        .metadata = options.metadata,
+        .executable = executable,
+        .arch = arch,
+        .output_path = path,
+    };
+    switch (kind) {
+        .setup => try windows_installer.createSetup(allocator, io, image_options),
+        .update_archive => try windows_installer.createUpdateArchive(allocator, io, image_options),
+    }
+    return path;
+}
+
 fn metadataHasCapability(metadata: manifest_tool.Metadata, name: []const u8) bool {
     for (metadata.capabilities) |capability| {
         if (std.mem.eql(u8, capability, name)) return true;
@@ -332,6 +377,9 @@ pub fn printDiagnostic(stats: PackageStats) void {
     if (stats.update_archive_path) |archive| {
         std.debug.print("  update archive: {s}\n", .{archive});
     }
+    if (stats.installer_path) |installer| {
+        std.debug.print("  installer: {s}\n", .{installer});
+    }
 }
 
 fn createUpdateArchive(allocator: std.mem.Allocator, io: std.Io, options: PackageOptions) ![]const u8 {
@@ -500,7 +548,7 @@ fn createDesktopArtifact(allocator: std.mem.Allocator, io: std.Io, options: Pack
         try makeExecutable(dir, io, service_subpath);
     }
 
-    const assets_output = try assetOutputPath(allocator, options.output_path, "resources", options);
+    const assets_output = try desktopAssetOutputPath(allocator, options);
     defer allocator.free(assets_output);
     const bundle_stats = try assets_tool.bundle(allocator, io, options.assets_dir, assets_output);
     try writeFile(dir, io, "README.txt", artifactReadme(options.target));
@@ -787,6 +835,20 @@ fn macosAssetOutputPath(allocator: std.mem.Allocator, options: PackageOptions) !
     return std.fs.path.join(allocator, &.{ options.output_path, "Contents/Resources" });
 }
 
+/// Where a Windows or Linux artifact carries the app's assets: the macOS
+/// bundle's layout (macosAssetOutputPath) under resources/. The packaged
+/// runner and Windows host resolve relative asset paths against the
+/// resources/ directory beside the executable's bin/, so a relative path
+/// the app reads ("assets/fonts/mono.ttf") names the same file it names
+/// in a dev run.
+fn desktopAssetOutputPath(allocator: std.mem.Allocator, options: PackageOptions) ![]const u8 {
+    if (options.frontend != null) return assetOutputPath(allocator, options.output_path, "resources", options);
+    if (appRelativeAssetSubpath(options.assets_dir)) |subpath| {
+        return std.fs.path.join(allocator, &.{ options.output_path, "resources", subpath });
+    }
+    return std.fs.path.join(allocator, &.{ options.output_path, "resources" });
+}
+
 /// The asset directory as an app-relative bundle subpath, or null when
 /// it cannot honestly be one (empty, ".", absolute, or escaping the app
 /// root through a ".." segment).
@@ -1465,7 +1527,7 @@ fn elfStringAt(strtab: []const u8, offset: u64) ?[]const u8 {
 /// Whether a PE executable targets arm64, read from the COFF machine
 /// field. Anything unrecognized falls back to x64, the default Windows
 /// build target.
-fn peExecutableIsArm64(io: std.Io, path: []const u8) !bool {
+pub fn peExecutableIsArm64(io: std.Io, path: []const u8) !bool {
     var file = try std.Io.Dir.cwd().openFile(io, path, .{});
     defer file.close(io);
     var read_buffer: [4096]u8 = undefined;
@@ -1798,7 +1860,7 @@ fn appendFmt(allocator: std.mem.Allocator, out: *std.ArrayList(u8), comptime for
     try out.appendSlice(allocator, text);
 }
 
-fn trimExtensionDot(extension: []const u8) []const u8 {
+pub fn trimExtensionDot(extension: []const u8) []const u8 {
     if (extension.len > 0 and extension[0] == '.') return extension[1..];
     return extension;
 }
@@ -2109,7 +2171,7 @@ fn windowsRegistrationScript(allocator: std.mem.Allocator, metadata: manifest_to
     return out.toOwnedSlice(allocator);
 }
 
-fn windowsProgId(allocator: std.mem.Allocator, metadata: manifest_tool.Metadata, association: manifest_tool.FileAssociationMetadata) ![]const u8 {
+pub fn windowsProgId(allocator: std.mem.Allocator, metadata: manifest_tool.Metadata, association: manifest_tool.FileAssociationMetadata) ![]const u8 {
     const app = try windowsIdentifierComponentAlloc(allocator, metadata.id);
     defer allocator.free(app);
     const name = try windowsIdentifierComponentAlloc(allocator, association.name);
@@ -3432,6 +3494,34 @@ test "macOS package mirrors app assets at their app-relative path" {
     try std.testing.expectEqualStrings("mp3-bytes", bundled);
 }
 
+test "windows and linux packages mirror app assets at their app-relative path" {
+    // The packaged runner resolves "assets/music/track.mp3" against the
+    // resources/ directory beside bin/, so the artifact keeps the asset
+    // tree at the relative path a dev run reads.
+    var cwd = std.Io.Dir.cwd();
+    const root = ".zig-cache/test-package-desktop-asset-layout";
+    try cwd.deleteTree(std.testing.io, root);
+    defer cwd.deleteTree(std.testing.io, root) catch {};
+    try cwd.createDirPath(std.testing.io, root ++ "/assets/music");
+    try cwd.writeFile(std.testing.io, .{ .sub_path = root ++ "/assets/music/track.mp3", .data = "mp3-bytes" });
+
+    const metadata: manifest_tool.Metadata = .{ .id = "dev.example.app", .name = "demo", .version = "1.2.3" };
+    inline for (.{ PackageTarget.windows, PackageTarget.linux }) |target| {
+        const output = root ++ "/demo-" ++ @tagName(target);
+        const stats = try createPackage(std.testing.allocator, std.testing.io, .{
+            .metadata = metadata,
+            .target = target,
+            .output_path = output,
+            .assets_dir = root ++ "/assets",
+        });
+        try std.testing.expectEqual(@as(usize, 1), stats.asset_count);
+        const packaged = try readPath(std.testing.allocator, std.testing.io, output ++ "/resources/" ++ root ++ "/assets/music/track.mp3");
+        defer std.testing.allocator.free(packaged);
+        try std.testing.expectEqualStrings("mp3-bytes", packaged);
+        try std.testing.expectError(error.FileNotFound, readPath(std.testing.allocator, std.testing.io, output ++ "/resources/music/track.mp3"));
+    }
+}
+
 test "app-relative asset subpaths accept plain trees and reject escapes" {
     try std.testing.expectEqualStrings("assets", appRelativeAssetSubpath("assets").?);
     try std.testing.expectEqualStrings("data/sounds", appRelativeAssetSubpath("data/sounds").?);

package/src/tooling/raw_manifest.zig

@@ -19,6 +19,11 @@ pub const RawManifest = struct {
     /// startup window is created; the runtime dock-presence command may
     /// still promote or demote the app later.
     dock_visible: bool = true,
+    /// Whether one process per bundle id, user, and login session owns
+    /// the app. A later launch hands its working directory and arguments
+    /// to the owner over the `native-sdk.app.launches` channel source and
+    /// exits before creating windows (Windows today).
+    single_instance: bool = false,
     persist: ?RawPersist = null,
     images: RawImages = .{},
     service_packages: []const RawServicePackage = &.{},
@@ -55,7 +60,9 @@ pub const RawManifest = struct {
 pub const RawUpdates = struct {
     feed_url: ?[]const u8 = null,
     public_key: ?[]const u8 = null,
+    public_keys: []const []const u8 = &.{},
     check_on_start: bool = false,
+    mode: ?[]const u8 = null,
 };
 
 pub const RawImages = struct {

package/src/tooling/root.zig

@@ -21,6 +21,8 @@ pub const android = @import("android.zig");
 pub const xcodeproj = @import("xcodeproj.zig");
 pub const db = @import("db.zig");
 pub const update = @import("update.zig");
+pub const zip_writer = @import("zip_writer.zig");
+pub const windows_installer = @import("windows_installer.zig");
 
 test {
     @import("std").testing.refAllDecls(@This());

package/src/tooling/templates.zig

@@ -1597,6 +1597,9 @@ fn buildZig(allocator: std.mem.Allocator, names: TemplateNames, framework_path:
         \\    package.addArgs(&.{ "--web-layer", if (web_layer) "include" else "exclude" });
         \\    if (cef_auto_install) package.addArg("--cef-auto-install");
         \\    if (app_config.updates_enabled and package_target == .macos and b.graph.host.result.os.tag == .macos) package.addArg("--update-archive");
+        \\    // Windows updates reach only installed apps, so an app with updates
+        \\    // ships the per-user setup program beside the archive its feed names.
+        \\    if (app_config.updates_enabled and package_target == .windows) package.addArgs(&.{ "--installer", "--update-archive" });
         \\    package.step.dependOn(&package_exe.step);
         \\    package.step.dependOn(&frontend_build.step);
         \\    const package_step = b.step("package", "Create a local package artifact");
@@ -2440,8 +2443,9 @@ fn runnerZig() []const u8 {
     \\            .bundle_id = self.bundle_id,
     \\            .icon_path = self.icon_path,
     \\            .update_feed_url = manifestUpdateString("feed_url"),
-    \\            .update_public_key = manifestUpdateString("public_key"),
+    \\            .update_public_key = manifestUpdatePublicKeys(),
     \\            .update_check_on_start = manifestUpdateCheckOnStart(),
+    \\            .update_mode = manifestUpdateMode(),
     \\        };
     \\        const windows = manifestWindowOptions(buffers);
     \\        if (windows.len > 0) {
@@ -2518,6 +2522,36 @@ fn runnerZig() []const u8 {
     \\    return app_manifest.updates.check_on_start;
     \\}
     \\
+    \\/// The trusted update keys the updater verifies feeds against:
+    \\/// `public_key` followed by any `public_keys`, comma-joined.
+    \\fn manifestUpdatePublicKeys() []const u8 {
+    \\    const primary = comptime manifestUpdateString("public_key");
+    \\    if (comptime primary.len == 0) return "";
+    \\    if (comptime !@hasField(@TypeOf(app_manifest.updates), "public_keys")) return primary;
+    \\    comptime var keys: []const u8 = primary;
+    \\    inline for (app_manifest.updates.public_keys) |key| keys = keys ++ "," ++ key;
+    \\    return keys;
+    \\}
+    \\
+    \\fn manifestUpdateMode() native_sdk.platform.UpdateMode {
+    \\    if (comptime !@hasField(@TypeOf(app_manifest), "updates")) return .host;
+    \\    if (comptime !@hasField(@TypeOf(app_manifest.updates), "mode")) return .host;
+    \\    return comptime std.meta.stringToEnum(native_sdk.platform.UpdateMode, app_manifest.updates.mode) orelse
+    \\        @compileError("app manifest updates.mode must be \"host\" or \"app\"");
+    \\}
+    \\
+    \\/// Points the app-driven updater at this installation (see
+    \\/// `updater.configureApp`).
+    \\fn configureUpdates(app_info: *native_sdk.platform.AppInfo, environ_map: *std.process.Environ.Map) void {
+    \\    const host: native_sdk.updater.Host = comptime if (std.mem.eql(u8, build_options.platform, "windows"))
+    \\        .windows
+    \\    else if (std.mem.eql(u8, build_options.platform, "macos") and std.mem.eql(u8, build_options.web_engine, "system"))
+    \\        .macos_appkit
+    \\    else
+    \\        .other;
+    \\    native_sdk.updater.configureApp(host, app_info, environ_map);
+    \\}
+    \\
     \\const CommandStorage = struct {
     \\    commands: [native_sdk.app_manifest.max_commands]native_sdk.Command = undefined,
     \\
@@ -3062,6 +3096,7 @@ fn runnerZig() []const u8 {
     \\fn runMacos(app: native_sdk.App, options: RunOptions, init: std.process.Init) !void {
     \\    var buffers: StateBuffers = undefined;
     \\    var app_info = options.appInfo(&buffers);
+    \\    configureUpdates(&app_info, init.environ_map);
     \\    const store = prepareStateStore(init.io, init.environ_map, &app_info, &buffers);
     \\    // Heap wrapper, latch-gated free: worker threads hold this address
     \\    // as the channel wake context and an abandoned wake call may
@@ -3120,6 +3155,7 @@ fn runnerZig() []const u8 {
     \\fn runLinux(app: native_sdk.App, options: RunOptions, init: std.process.Init) !void {
     \\    var buffers: StateBuffers = undefined;
     \\    var app_info = options.appInfo(&buffers);
+    \\    configureUpdates(&app_info, init.environ_map);
     \\    const store = prepareStateStore(init.io, init.environ_map, &app_info, &buffers);
     \\    // Heap wrapper, latch-gated free: worker threads hold this address
     \\    // as the channel wake context and an abandoned wake call may
@@ -3178,6 +3214,7 @@ fn runnerZig() []const u8 {
     \\fn runWindows(app: native_sdk.App, options: RunOptions, init: std.process.Init) !void {
     \\    var buffers: StateBuffers = undefined;
     \\    var app_info = options.appInfo(&buffers);
+    \\    configureUpdates(&app_info, init.environ_map);
     \\    const store = prepareStateStore(init.io, init.environ_map, &app_info, &buffers);
     \\    // Heap wrapper, latch-gated free: worker threads hold this address
     \\    // as the channel wake context and an abandoned wake call may
@@ -4272,6 +4309,7 @@ test "writeDefaultApp emits Vite project files" {
     // the packaged artifact structurally agrees with the compiled exe.
     try std.testing.expect(std.mem.indexOf(u8, build_zig_text, "package.addArgs(&.{ \"--web-layer\", if (web_layer) \"include\" else \"exclude\" })") != null);
     try std.testing.expect(std.mem.indexOf(u8, build_zig_text, "package.addArg(\"--update-archive\")") != null);
+    try std.testing.expect(std.mem.indexOf(u8, build_zig_text, "package_target == .windows) package.addArgs(&.{ \"--installer\", \"--update-archive\" })") != null);
     try std.testing.expect(std.mem.indexOf(u8, build_zig_text, "options.addOption(bool, \"web_layer\", web_layer)") != null);
     try std.testing.expect(std.mem.indexOf(u8, build_zig_text, "std.json.parseFromSliceLeaky(InferenceManifest") != null);
     try std.testing.expect(std.mem.indexOf(u8, build_zig_text, "fn appManifestModule") != null);
@@ -4336,8 +4374,12 @@ test "writeDefaultApp emits Vite project files" {
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, "fn appInfo(self: RunOptions, buffers: *StateBuffers)") != null);
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, ".version = manifestStringField(\"version\")") != null);
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, ".update_feed_url = manifestUpdateString(\"feed_url\")") != null);
-    try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, ".update_public_key = manifestUpdateString(\"public_key\")") != null);
+    try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, ".update_public_key = manifestUpdatePublicKeys()") != null);
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, ".update_check_on_start = manifestUpdateCheckOnStart()") != null);
+    try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, ".update_mode = manifestUpdateMode()") != null);
+    // Ejected apps configure the app-driven updater on every desktop
+    // platform.
+    try std.testing.expectEqual(@as(usize, 3), std.mem.count(u8, runner_zig_text, "configureUpdates(&app_info, init.environ_map);"));
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, "fn manifestWindowOptions") != null);
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, "info.windows = windows") != null);
     try std.testing.expect(std.mem.indexOf(u8, runner_zig_text, "for (restored_windows, 0..)") != null);