@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.5

package/src/runtime/system_services.zig

@@ -404,95 +404,77 @@ pub fn RuntimeSystemServices(comptime Runtime: type) type {
             return writeTrueJson(output);
         }
 
-        pub fn openFileDialogFromJson(self: *Runtime, payload: []const u8, output: []u8) ![]const u8 {
-            var storage = json.StringStorage.init(output);
-            const title = jsonStringField(payload, "title", &storage) orelse "";
-            const default_path = jsonStringField(payload, "defaultPath", &storage) orelse "";
-            const allow_dirs = jsonBoolField(payload, "allowDirectories") orelse false;
-            const allow_multi = jsonBoolField(payload, "allowMultiple") orelse false;
-            var dialog_buffer: [platform.max_dialog_paths_bytes]u8 = undefined;
-            const result = try self.showOpenDialog(.{
-                .title = title,
-                .default_path = default_path,
-                .allow_directories = allow_dirs,
-                .allow_multiple = allow_multi,
-            }, &dialog_buffer);
-
-            var writer = std.Io.Writer.fixed(output);
-            if (result.count == 0) {
-                try writer.writeAll("null");
-            } else {
-                try writer.writeByte('[');
-                var start: usize = 0;
-                var i: usize = 0;
-                for (result.paths, 0..) |ch, pos| {
-                    if (ch == '\n') {
-                        if (i > 0) try writer.writeByte(',');
-                        try json.writeString(&writer, result.paths[start..pos]);
-                        start = pos + 1;
-                        i += 1;
-                    }
-                }
-                if (start < result.paths.len) {
-                    if (i > 0) try writer.writeByte(',');
-                    try json.writeString(&writer, result.paths[start..]);
-                }
-                try writer.writeByte(']');
+        /// Read a `native-sdk.dialog.*` bridge payload. Strings land in
+        /// `storage` and borrow it.
+        pub fn dialogOptionsFromJson(kind: platform.DialogKind, payload: []const u8, storage: *json.StringStorage) !platform.DialogOptions {
+            switch (kind) {
+                .open => return .{ .open = .{
+                    .title = jsonStringField(payload, "title", storage) orelse "",
+                    .default_path = jsonStringField(payload, "defaultPath", storage) orelse "",
+                    .allow_directories = jsonBoolField(payload, "allowDirectories") orelse false,
+                    .allow_multiple = jsonBoolField(payload, "allowMultiple") orelse false,
+                } },
+                .save => return .{ .save = .{
+                    .title = jsonStringField(payload, "title", storage) orelse "",
+                    .default_path = jsonStringField(payload, "defaultPath", storage) orelse "",
+                    .default_name = jsonStringField(payload, "defaultName", storage) orelse "",
+                } },
+                .message => {
+                    const title = jsonStringField(payload, "title", storage) orelse "";
+                    const message = jsonStringField(payload, "message", storage) orelse "";
+                    const informative = jsonStringField(payload, "informativeText", storage) orelse "";
+                    const primary = jsonStringField(payload, "primaryButton", storage) orelse "OK";
+                    const secondary = jsonStringField(payload, "secondaryButton", storage) orelse "";
+                    const tertiary = jsonStringField(payload, "tertiaryButton", storage) orelse "";
+                    const style_str = jsonStringField(payload, "style", storage) orelse "info";
+                    const style: platform.MessageDialogStyle = if (std.mem.eql(u8, style_str, "warning"))
+                        .warning
+                    else if (std.mem.eql(u8, style_str, "critical"))
+                        .critical
+                    else
+                        .info;
+                    return .{ .message = .{
+                        .style = style,
+                        .title = title,
+                        .message = message,
+                        .informative_text = informative,
+                        .primary_button = primary,
+                        .secondary_button = secondary,
+                        .tertiary_button = tertiary,
+                    } };
+                },
             }
-            return writer.buffered();
         }
 
-        pub fn saveFileDialogFromJson(self: *Runtime, payload: []const u8, output: []u8) ![]const u8 {
-            var storage = json.StringStorage.init(output);
-            const title = jsonStringField(payload, "title", &storage) orelse "";
-            const default_path = jsonStringField(payload, "defaultPath", &storage) orelse "";
-            const default_name = jsonStringField(payload, "defaultName", &storage) orelse "";
-            var dialog_buffer: [platform.max_dialog_path_bytes]u8 = undefined;
-            const path = try self.showSaveDialog(.{
-                .title = title,
-                .default_path = default_path,
-                .default_name = default_name,
-            }, &dialog_buffer);
-
+        /// The bridge result for a finished dialog: open dialogs answer an
+        /// array of paths, save dialogs a path, message dialogs the
+        /// pressed button's name. A dialog closed without a choice answers
+        /// `null` (open, save) or `"dismissed"` (message).
+        pub fn writeDialogResultJson(kind: platform.DialogKind, result: platform.DialogResult, output: []u8) ![]const u8 {
             var writer = std.Io.Writer.fixed(output);
-            if (path) |p| {
-                try json.writeString(&writer, p);
-            } else {
-                try writer.writeAll("null");
+            const chosen = result.outcome == .selected;
+            switch (kind) {
+                .open => {
+                    if (!chosen or result.count == 0) {
+                        try writer.writeAll("null");
+                        return writer.buffered();
+                    }
+                    try writer.writeByte('[');
+                    var paths = std.mem.splitScalar(u8, result.paths, '\n');
+                    var first = true;
+                    while (paths.next()) |path| {
+                        if (path.len == 0) continue;
+                        if (!first) try writer.writeByte(',');
+                        first = false;
+                        try json.writeString(&writer, path);
+                    }
+                    try writer.writeByte(']');
+                },
+                .save => if (chosen and result.paths.len > 0) try json.writeString(&writer, result.paths) else try writer.writeAll("null"),
+                .message => try json.writeString(&writer, if (chosen) @tagName(result.button) else "dismissed"),
             }
             return writer.buffered();
         }
-
-        pub fn showMessageDialogFromJson(self: *Runtime, payload: []const u8, output: []u8) ![]const u8 {
-            var storage = json.StringStorage.init(output);
-            const title = jsonStringField(payload, "title", &storage) orelse "";
-            const message = jsonStringField(payload, "message", &storage) orelse "";
-            const informative = jsonStringField(payload, "informativeText", &storage) orelse "";
-            const primary = jsonStringField(payload, "primaryButton", &storage) orelse "OK";
-            const secondary = jsonStringField(payload, "secondaryButton", &storage) orelse "";
-            const tertiary = jsonStringField(payload, "tertiaryButton", &storage) orelse "";
-            const style_str = jsonStringField(payload, "style", &storage) orelse "info";
-            const style: platform.MessageDialogStyle = if (std.mem.eql(u8, style_str, "warning"))
-                .warning
-            else if (std.mem.eql(u8, style_str, "critical"))
-                .critical
-            else
-                .info;
-
-            const result = try self.showMessageDialog(.{
-                .style = style,
-                .title = title,
-                .message = message,
-                .informative_text = informative,
-                .primary_button = primary,
-                .secondary_button = secondary,
-                .tertiary_button = tertiary,
-            });
-
-            var writer = std.Io.Writer.fixed(output);
-            try json.writeString(&writer, @tagName(result));
-            return writer.buffered();
-        }
     };
 }
 

package/src/runtime/ui_app.zig

@@ -47,6 +47,7 @@ const component_policy = @import("component_policy.zig");
 const hover_policy = @import("canvas_hover_policy.zig");
 const launch_timing = @import("launch_timing.zig");
 const runtime_effects = @import("effects.zig");
+const runtime_dialogs = @import("dialogs.zig");
 const terminal_session = @import("terminal_session.zig");
 const ui_app_provenance = @import("ui_app_provenance.zig");
 const markup_development = @import("markup_development_policy.zig");
@@ -1684,6 +1685,8 @@ pub fn UiAppWithFeatures(comptime ModelT: type, comptime MsgT: type, comptime fe
                 .reveal_path_fn = effectsRevealPath,
                 .format_local_time_fn = effectsFormatLocalTime,
                 .execute_capability_fn = effectsExecuteCapability,
+                .start_capability_fn = effectsStartCapability,
+                .cancel_capability_fn = effectsCancelCapability,
                 .replay_window_result_fn = effectsRestoreWindowResult,
             });
             if (runtime.options.session_recorder) |recorder| {
@@ -7025,6 +7028,70 @@ fn effectsRestoreWindowResult(context: *anyopaque, label: []const u8, closed: bo
     runtime.restoreWindowCapabilityResult(label, closed);
 }
 
+/// What a directory picker needs to answer its capability request, kept in
+/// the dialog's completion tag until the picker finishes.
+const DirectoryPickerRequest = struct {
+    completion: runtime_effects.DesktopCapabilityCompletion,
+    /// The request's correlation prefix, echoed in the reply header.
+    prefix: [36]u8,
+    prefix_len: u8,
+};
+
+comptime {
+    std.debug.assert(@sizeOf(DirectoryPickerRequest) <= runtime_dialogs.max_dialog_tag_bytes);
+}
+
+/// `native-sdk.dialog.openDirectory` opens a native folder picker without
+/// blocking the event loop; the reply follows when the picker finishes.
+/// Other capabilities, and the picker on a platform without asynchronous
+/// dialogs, keep the synchronous `effectsExecuteCapability` and its
+/// replies.
+fn effectsStartCapability(context: *anyopaque, name: []const u8, payload: []const u8, completion: runtime_effects.DesktopCapabilityCompletion) anyerror!?u64 {
+    if (!std.mem.eql(u8, name, "native-sdk.dialog.openDirectory")) return null;
+    const runtime: *Runtime = @ptrCast(@alignCast(context));
+    if (!runtime.options.platform.services.supportsAsyncDialogs()) return null;
+    const desktop_files = @import("desktop_files.zig");
+    if (!authorization.hasPermission(runtime.authorization_policy, runtime.options.security.permissions, security.permission_dialog)) return error.PermissionDenied;
+    var reader = try desktop_files.request(payload);
+    const prefix_len = reader.at;
+    const title = try reader.field();
+    const path = try reader.field();
+    try reader.finish();
+    if (title.len > 255 or path.len > desktop_files.max_path_bytes or std.mem.indexOfScalar(u8, path, 0) != null) return error.InvalidRequest;
+    var request: DirectoryPickerRequest = .{ .completion = completion, .prefix = undefined, .prefix_len = @intCast(prefix_len) };
+    @memcpy(request.prefix[0..prefix_len], payload[0..prefix_len]);
+    return try runtime.requestOpenDialog(.{ .title = title, .default_path = path, .allow_directories = true, .allow_multiple = false }, null, .{
+        .context = completion.context,
+        .tag = std.mem.asBytes(&request),
+        .on_result = directoryPickerFinished,
+    });
+}
+
+fn effectsCancelCapability(context: *anyopaque, handle: u64) void {
+    const runtime: *Runtime = @ptrCast(@alignCast(context));
+    runtime.cancelDialog(handle);
+}
+
+fn directoryPickerFinished(context: *anyopaque, runtime: *Runtime, tag: []const u8, result: platform.DialogResult) anyerror!void {
+    _ = .{ context, runtime };
+    const desktop_files = @import("desktop_files.zig");
+    var request: DirectoryPickerRequest = undefined;
+    @memcpy(std.mem.asBytes(&request), tag[0..@sizeOf(DirectoryPickerRequest)]);
+    const prefix = request.prefix[0..request.prefix_len];
+    var output: [64 + 2 + platform.max_dialog_path_bytes]u8 = undefined;
+    if (result.outcome == .failed) {
+        request.completion.complete(true, output[0..try desktop_files.replyHeaderFor(&output, prefix, "DialogFailed")]);
+        return;
+    }
+    // A cancelled picker answers an empty selection, as it always has.
+    const selected = if (result.outcome == .selected and result.count > 0) result.paths else "";
+    const header = try desktop_files.replyHeaderFor(&output, prefix, "");
+    if (selected.len > 65535 or output.len - header < 2 or selected.len > output.len - header - 2) return error.OverBound;
+    std.mem.writeInt(u16, output[header..][0..2], @intCast(selected.len), .little);
+    @memcpy(output[header + 2 ..][0..selected.len], selected);
+    request.completion.complete(true, output[0 .. header + 2 + selected.len]);
+}
+
 fn effectsExecuteCapability(context: *anyopaque, name: []const u8, payload: []const u8, output: []u8) anyerror![]const u8 {
     const runtime: *Runtime = @ptrCast(@alignCast(context));
     const desktop_files = @import("desktop_files.zig");

package/src/tooling/manifest.zig

@@ -212,6 +212,9 @@ pub const Metadata = struct {
         if (self.url_schemes.len > 0) allocator.free(self.url_schemes);
         if (self.updates.feed_url) |value| allocator.free(value);
         if (self.updates.public_key) |value| allocator.free(value);
+        for (self.updates.public_keys) |value| allocator.free(value);
+        if (self.updates.public_keys.len > 0) allocator.free(self.updates.public_keys);
+        if (self.updates.mode) |value| allocator.free(value);
         if (self.dmg.volume_name) |value| allocator.free(value);
         if (self.dmg.background) |value| allocator.free(value);
         for (self.dmg.items) |item| {
@@ -425,11 +428,50 @@ pub const DmgMetadata = struct {
 pub const UpdateMetadata = struct {
     feed_url: ?[]const u8 = null,
     public_key: ?[]const u8 = null,
+    public_keys: []const []const u8 = &.{},
     check_on_start: bool = false,
+    /// `host` or `app`; null leaves the host default.
+    mode: ?[]const u8 = null,
 
     pub fn enabled(self: UpdateMetadata) bool {
         return self.feed_url != null;
     }
+
+    /// Whether `public_key` is set and it and every `public_keys` entry
+    /// decode as base64 Ed25519 public keys.
+    pub fn publicKeysAreValid(self: UpdateMetadata) bool {
+        const primary = self.public_key orelse return false;
+        if (decodeUpdatePublicKey(primary) == null) return false;
+        for (self.public_keys) |key| {
+            if (decodeUpdatePublicKey(key) == null) return false;
+        }
+        return true;
+    }
+
+    /// Whether `public_key` or one of `public_keys` decodes to the same key
+    /// as this base64 public key.
+    pub fn trustsPublicKey(self: UpdateMetadata, public_key: []const u8) bool {
+        const wanted = decodeUpdatePublicKey(public_key) orelse return false;
+        if (self.public_key) |primary| {
+            if (decodeUpdatePublicKey(primary)) |bytes| {
+                if (std.mem.eql(u8, &bytes, &wanted)) return true;
+            }
+        }
+        for (self.public_keys) |key| {
+            if (decodeUpdatePublicKey(key)) |bytes| {
+                if (std.mem.eql(u8, &bytes, &wanted)) return true;
+            }
+        }
+        return false;
+    }
+
+    fn decodeUpdatePublicKey(value: []const u8) ?[32]u8 {
+        var bytes: [32]u8 = undefined;
+        const size = std.base64.standard.Decoder.calcSizeForSlice(value) catch return null;
+        if (size != bytes.len) return null;
+        std.base64.standard.Decoder.decode(&bytes, value) catch return null;
+        return bytes;
+    }
 };
 
 pub const FrontendDevMetadata = struct {
@@ -580,7 +622,9 @@ pub fn validateFile(allocator: std.mem.Allocator, io: std.Io, path: []const u8)
     defer allocator.free(file_associations);
     const url_schemes = parseUrlSchemes(allocator, metadata.url_schemes) catch return .{ .ok = false, .message = "app manifest URL schemes are invalid" };
     defer allocator.free(url_schemes);
-    const updates = convertUpdates(metadata.updates) catch return .{ .ok = false, .message = "app manifest updates are invalid - updates require an HTTPS feed_url and a base64 Ed25519 public_key; check_on_start requires both" };
+    const updates_message = "app manifest updates are invalid - updates require an HTTPS feed_url and a base64 Ed25519 public_key; public_keys adds at most 3 further distinct keys; feed_url may name {target} and {current_version} in its path or query; check_on_start requires both; mode is \"host\" or \"app\"";
+    const updates = convertUpdates(metadata.updates) catch return .{ .ok = false, .message = updates_message };
+    app_manifest.validateUpdates(updates) catch return .{ .ok = false, .message = updates_message };
     // General manifest validation owns only values the app explicitly
     // declared. Archive-time fallbacks (notably display_name as the volume
     // name) are validated when a macOS archive is actually requested, so an
@@ -751,17 +795,20 @@ fn duplicateRawUpdates(allocator: std.mem.Allocator, raw: RawUpdates) !UpdateMet
     return .{
         .feed_url = try duplicateOptionalString(allocator, raw.feed_url),
         .public_key = try duplicateOptionalString(allocator, raw.public_key),
+        .public_keys = try duplicateStringList(allocator, raw.public_keys),
         .check_on_start = raw.check_on_start,
+        .mode = try duplicateOptionalString(allocator, raw.mode),
     };
 }
 
 fn convertUpdates(updates: UpdateMetadata) !app_manifest.UpdateConfig {
-    if (updates.feed_url == null and updates.public_key == null and !updates.check_on_start) return .{};
+    if (updates.feed_url == null and updates.public_key == null and updates.public_keys.len == 0 and !updates.check_on_start and updates.mode == null) return .{};
     const feed_url = updates.feed_url orelse return error.InvalidUpdates;
     const public_key = updates.public_key orelse return error.InvalidUpdates;
     if (!std.mem.startsWith(u8, feed_url, "https://")) return error.InvalidUpdates;
     if (public_key.len == 0) return error.InvalidUpdates;
-    return .{ .feed_url = feed_url, .public_key = public_key, .check_on_start = updates.check_on_start };
+    const mode: app_manifest.UpdateMode = if (updates.mode) |value| std.meta.stringToEnum(app_manifest.UpdateMode, value) orelse return error.InvalidUpdates else .host;
+    return .{ .feed_url = feed_url, .public_key = public_key, .public_keys = updates.public_keys, .check_on_start = updates.check_on_start, .mode = mode };
 }
 
 fn duplicateRawServicePackages(allocator: std.mem.Allocator, packages: []const raw_manifest.RawServicePackage) ![]const ServicePackageMetadata {
@@ -2555,6 +2602,67 @@ test "JSON manifest parser carries native update configuration" {
     try std.testing.expectEqualStrings("https://example.com/native-update.json", metadata.updates.feed_url.?);
 }
 
+test "JSON manifest parser carries per-target feeds and rotated update keys" {
+    const metadata = try parseJsonText(std.testing.allocator,
+        \\{
+        \\  "id": "com.example.updates",
+        \\  "name": "updates",
+        \\  "version": "1.2.3",
+        \\  "updates": {
+        \\    "feed_url": "https://example.com/releases/{target}/native-update.json",
+        \\    "public_key": "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo=",
+        \\    "public_keys": ["11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="],
+        \\    "mode": "app"
+        \\  }
+        \\}
+    );
+    defer metadata.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("https://example.com/releases/{target}/native-update.json", metadata.updates.feed_url.?);
+    try std.testing.expectEqualStrings("app", metadata.updates.mode.?);
+    try std.testing.expectEqual(app_manifest.UpdateMode.app, (try convertUpdates(metadata.updates)).mode);
+    try std.testing.expect(metadata.updates.trustsPublicKey("wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo="));
+    try std.testing.expect(metadata.updates.trustsPublicKey("11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="));
+    try std.testing.expect(!metadata.updates.trustsPublicKey("IBLLkMpg6OXY2vZuInLSIz4EhtVX6MZhQe2JIBd9frc="));
+}
+
+test "manifest validation names the update rules" {
+    var cwd = std.Io.Dir.cwd();
+    const root = ".zig-cache/test-validate-updates";
+    try cwd.deleteTree(std.testing.io, root);
+    defer cwd.deleteTree(std.testing.io, root) catch {};
+    try cwd.createDirPath(std.testing.io, root);
+    try cwd.writeFile(std.testing.io, .{ .sub_path = root ++ "/app.json", .data =
+        \\{
+        \\  "id": "com.example.updates",
+        \\  "name": "updates",
+        \\  "version": "1.2.3",
+        \\  "updates": {
+        \\    "feed_url": "https://example.com/{arch}/native-update.json",
+        \\    "public_key": "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo="
+        \\  }
+        \\}
+    });
+    const result = try validateFile(std.testing.allocator, std.testing.io, root ++ "/app.json");
+    try std.testing.expect(!result.ok);
+    try std.testing.expect(std.mem.indexOf(u8, result.message, "{target} and {current_version}") != null);
+
+    try cwd.writeFile(std.testing.io, .{ .sub_path = root ++ "/app.json", .data =
+        \\{
+        \\  "id": "com.example.updates",
+        \\  "name": "updates",
+        \\  "version": "1.2.3",
+        \\  "updates": {
+        \\    "feed_url": "https://example.com/{target}/native-update.json",
+        \\    "public_key": "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo=",
+        \\    "mode": "automatic"
+        \\  }
+        \\}
+    });
+    const mode_result = try validateFile(std.testing.allocator, std.testing.io, root ++ "/app.json");
+    try std.testing.expect(!mode_result.ok);
+    try std.testing.expect(std.mem.indexOf(u8, mode_result.message, "mode is \"host\" or \"app\"") != null);
+}
+
 test "JSON file validation rejects null with a teaching diagnostic regardless of extension case" {
     var cwd = std.Io.Dir.cwd();
     const root = ".zig-cache/test-validate-json-null";

package/src/tooling/package.zig

@@ -9,6 +9,7 @@ const diagnostics = @import("diagnostics");
 const ios_tool = @import("ios.zig");
 const manifest_tool = @import("manifest.zig");
 const web_engine_tool = @import("web_engine.zig");
+const windows_installer = @import("windows_installer.zig");
 const xcodeproj_tool = @import("xcodeproj.zig");
 
 /// The SDK's default app icon (kept in sync by `zig build generate-icon`):
@@ -86,9 +87,14 @@ pub const PackageOptions = struct {
     /// then staple and validate its ticket. Requires identity signing and a
     /// notarytool Keychain profile in `signing.profile`.
     notarize: bool = false,
-    /// Emit the ZIP consumed by the native updater. macOS only; unlike the
-    /// user-facing DMG, this archive contains exactly the packaged .app.
+    /// Emit the ZIP consumed by the native updater. On macOS it contains
+    /// exactly the packaged .app (unlike the user-facing DMG); on Windows
+    /// it is the install image a setup program carries
+    /// (windows_installer.zig).
     update_archive: bool = false,
+    /// Emit a per-user setup program beside a Windows artifact
+    /// (windows_installer.zig). Windows only.
+    installer: bool = false,
     /// The process environment, when the caller has one (the CLI). The
     /// Android artifact probes it for the SDK/NDK toolchain to assemble
     /// the debug APK; without it the generated project is still complete
@@ -161,6 +167,7 @@ pub const PackageStats = struct {
     web_layer: ?manifest_tool.WebLayer = null,
     archive_path: ?[]const u8 = null,
     update_archive_path: ?[]const u8 = null,
+    installer_path: ?[]const u8 = null,
     /// The Windows subsystem verdict: `console` when the package
     /// wrapped a CONSOLE-subsystem exe (the app will flash a terminal
     /// window behind itself on every launch), `gui` for a GUI-subsystem
@@ -278,13 +285,51 @@ pub fn createPackage(allocator: std.mem.Allocator, io: std.Io, options: PackageO
         stats.notarized = true;
     }
     if (options.update_archive) {
-        if (options.target != .macos) return error.UnsupportedUpdateTarget;
         if (!options.metadata.updates.enabled()) return error.UpdatesNotConfigured;
-        stats.update_archive_path = try createUpdateArchive(allocator, io, options);
+        stats.update_archive_path = switch (options.target) {
+            .macos => try createUpdateArchive(allocator, io, options),
+            .windows => try createWindowsImageFile(allocator, io, options, .update_archive),
+            else => return error.UnsupportedUpdateTarget,
+        };
+    }
+    if (options.installer) {
+        if (options.target != .windows) return error.UnsupportedInstallerTarget;
+        stats.installer_path = try createWindowsImageFile(allocator, io, options, .setup);
     }
     return stats;
 }
 
+/// The per-user setup program or the update archive, beside the artifact
+/// directory, for the architecture of the packaged executable.
+fn createWindowsImageFile(allocator: std.mem.Allocator, io: std.Io, options: PackageOptions, kind: enum { setup, update_archive }) ![]const u8 {
+    const binary_path = options.binary_path orelse {
+        std.debug.print("error: --installer and --update-archive need the app executable; pass --binary\n", .{});
+        return error.MissingBinary;
+    };
+    const arch: windows_installer.Arch = if (try peExecutableIsArm64(io, binary_path)) .aarch64 else .x86_64;
+    const executable = try std.fmt.allocPrint(allocator, "{s}.exe", .{options.metadata.name});
+    defer allocator.free(executable);
+    const file_name = switch (kind) {
+        .setup => try windows_installer.setupFileName(allocator, options.metadata, arch),
+        .update_archive => try windows_installer.updateArchiveFileName(allocator, options.metadata, arch),
+    };
+    defer allocator.free(file_name);
+    const path = try std.fs.path.join(allocator, &.{ std.fs.path.dirname(options.output_path) orelse ".", file_name });
+    errdefer allocator.free(path);
+    const image_options: windows_installer.Options = .{
+        .artifact_dir = options.output_path,
+        .metadata = options.metadata,
+        .executable = executable,
+        .arch = arch,
+        .output_path = path,
+    };
+    switch (kind) {
+        .setup => try windows_installer.createSetup(allocator, io, image_options),
+        .update_archive => try windows_installer.createUpdateArchive(allocator, io, image_options),
+    }
+    return path;
+}
+
 fn metadataHasCapability(metadata: manifest_tool.Metadata, name: []const u8) bool {
     for (metadata.capabilities) |capability| {
         if (std.mem.eql(u8, capability, name)) return true;
@@ -332,6 +377,9 @@ pub fn printDiagnostic(stats: PackageStats) void {
     if (stats.update_archive_path) |archive| {
         std.debug.print("  update archive: {s}\n", .{archive});
     }
+    if (stats.installer_path) |installer| {
+        std.debug.print("  installer: {s}\n", .{installer});
+    }
 }
 
 fn createUpdateArchive(allocator: std.mem.Allocator, io: std.Io, options: PackageOptions) ![]const u8 {
@@ -500,7 +548,7 @@ fn createDesktopArtifact(allocator: std.mem.Allocator, io: std.Io, options: Pack
         try makeExecutable(dir, io, service_subpath);
     }
 
-    const assets_output = try assetOutputPath(allocator, options.output_path, "resources", options);
+    const assets_output = try desktopAssetOutputPath(allocator, options);
     defer allocator.free(assets_output);
     const bundle_stats = try assets_tool.bundle(allocator, io, options.assets_dir, assets_output);
     try writeFile(dir, io, "README.txt", artifactReadme(options.target));
@@ -787,6 +835,20 @@ fn macosAssetOutputPath(allocator: std.mem.Allocator, options: PackageOptions) !
     return std.fs.path.join(allocator, &.{ options.output_path, "Contents/Resources" });
 }
 
+/// Where a Windows or Linux artifact carries the app's assets: the macOS
+/// bundle's layout (macosAssetOutputPath) under resources/. The packaged
+/// runner and Windows host resolve relative asset paths against the
+/// resources/ directory beside the executable's bin/, so a relative path
+/// the app reads ("assets/fonts/mono.ttf") names the same file it names
+/// in a dev run.
+fn desktopAssetOutputPath(allocator: std.mem.Allocator, options: PackageOptions) ![]const u8 {
+    if (options.frontend != null) return assetOutputPath(allocator, options.output_path, "resources", options);
+    if (appRelativeAssetSubpath(options.assets_dir)) |subpath| {
+        return std.fs.path.join(allocator, &.{ options.output_path, "resources", subpath });
+    }
+    return std.fs.path.join(allocator, &.{ options.output_path, "resources" });
+}
+
 /// The asset directory as an app-relative bundle subpath, or null when
 /// it cannot honestly be one (empty, ".", absolute, or escaping the app
 /// root through a ".." segment).
@@ -1465,7 +1527,7 @@ fn elfStringAt(strtab: []const u8, offset: u64) ?[]const u8 {
 /// Whether a PE executable targets arm64, read from the COFF machine
 /// field. Anything unrecognized falls back to x64, the default Windows
 /// build target.
-fn peExecutableIsArm64(io: std.Io, path: []const u8) !bool {
+pub fn peExecutableIsArm64(io: std.Io, path: []const u8) !bool {
     var file = try std.Io.Dir.cwd().openFile(io, path, .{});
     defer file.close(io);
     var read_buffer: [4096]u8 = undefined;
@@ -1798,7 +1860,7 @@ fn appendFmt(allocator: std.mem.Allocator, out: *std.ArrayList(u8), comptime for
     try out.appendSlice(allocator, text);
 }
 
-fn trimExtensionDot(extension: []const u8) []const u8 {
+pub fn trimExtensionDot(extension: []const u8) []const u8 {
     if (extension.len > 0 and extension[0] == '.') return extension[1..];
     return extension;
 }
@@ -2109,7 +2171,7 @@ fn windowsRegistrationScript(allocator: std.mem.Allocator, metadata: manifest_to
     return out.toOwnedSlice(allocator);
 }
 
-fn windowsProgId(allocator: std.mem.Allocator, metadata: manifest_tool.Metadata, association: manifest_tool.FileAssociationMetadata) ![]const u8 {
+pub fn windowsProgId(allocator: std.mem.Allocator, metadata: manifest_tool.Metadata, association: manifest_tool.FileAssociationMetadata) ![]const u8 {
     const app = try windowsIdentifierComponentAlloc(allocator, metadata.id);
     defer allocator.free(app);
     const name = try windowsIdentifierComponentAlloc(allocator, association.name);
@@ -3432,6 +3494,34 @@ test "macOS package mirrors app assets at their app-relative path" {
     try std.testing.expectEqualStrings("mp3-bytes", bundled);
 }
 
+test "windows and linux packages mirror app assets at their app-relative path" {
+    // The packaged runner resolves "assets/music/track.mp3" against the
+    // resources/ directory beside bin/, so the artifact keeps the asset
+    // tree at the relative path a dev run reads.
+    var cwd = std.Io.Dir.cwd();
+    const root = ".zig-cache/test-package-desktop-asset-layout";
+    try cwd.deleteTree(std.testing.io, root);
+    defer cwd.deleteTree(std.testing.io, root) catch {};
+    try cwd.createDirPath(std.testing.io, root ++ "/assets/music");
+    try cwd.writeFile(std.testing.io, .{ .sub_path = root ++ "/assets/music/track.mp3", .data = "mp3-bytes" });
+
+    const metadata: manifest_tool.Metadata = .{ .id = "dev.example.app", .name = "demo", .version = "1.2.3" };
+    inline for (.{ PackageTarget.windows, PackageTarget.linux }) |target| {
+        const output = root ++ "/demo-" ++ @tagName(target);
+        const stats = try createPackage(std.testing.allocator, std.testing.io, .{
+            .metadata = metadata,
+            .target = target,
+            .output_path = output,
+            .assets_dir = root ++ "/assets",
+        });
+        try std.testing.expectEqual(@as(usize, 1), stats.asset_count);
+        const packaged = try readPath(std.testing.allocator, std.testing.io, output ++ "/resources/" ++ root ++ "/assets/music/track.mp3");
+        defer std.testing.allocator.free(packaged);
+        try std.testing.expectEqualStrings("mp3-bytes", packaged);
+        try std.testing.expectError(error.FileNotFound, readPath(std.testing.allocator, std.testing.io, output ++ "/resources/music/track.mp3"));
+    }
+}
+
 test "app-relative asset subpaths accept plain trees and reject escapes" {
     try std.testing.expectEqualStrings("assets", appRelativeAssetSubpath("assets").?);
     try std.testing.expectEqualStrings("data/sounds", appRelativeAssetSubpath("data/sounds").?);

package/src/tooling/raw_manifest.zig

@@ -19,6 +19,11 @@ pub const RawManifest = struct {
     /// startup window is created; the runtime dock-presence command may
     /// still promote or demote the app later.
     dock_visible: bool = true,
+    /// Whether one process per bundle id, user, and login session owns
+    /// the app. A later launch hands its working directory and arguments
+    /// to the owner over the `native-sdk.app.launches` channel source and
+    /// exits before creating windows (Windows today).
+    single_instance: bool = false,
     persist: ?RawPersist = null,
     images: RawImages = .{},
     service_packages: []const RawServicePackage = &.{},
@@ -55,7 +60,9 @@ pub const RawManifest = struct {
 pub const RawUpdates = struct {
     feed_url: ?[]const u8 = null,
     public_key: ?[]const u8 = null,
+    public_keys: []const []const u8 = &.{},
     check_on_start: bool = false,
+    mode: ?[]const u8 = null,
 };
 
 pub const RawImages = struct {

package/src/tooling/root.zig

@@ -21,6 +21,8 @@ pub const android = @import("android.zig");
 pub const xcodeproj = @import("xcodeproj.zig");
 pub const db = @import("db.zig");
 pub const update = @import("update.zig");
+pub const zip_writer = @import("zip_writer.zig");
+pub const windows_installer = @import("windows_installer.zig");
 
 test {
     @import("std").testing.refAllDecls(@This());