craft-native 0.0.87 → 0.0.88

package/dist/index.js

@@ -16,11 +16,11 @@ var __export = (target, all) => {
 var __require = import.meta.require;
 
 // src/index.ts
-import { execFile, spawn as spawn4 } from "child_process";
-import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join3 } from "path";
-import { promisify } from "util";
+import { execFile as execFile2, spawn as spawn4 } from "child_process";
+import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { join as join4 } from "path";
+import { promisify as promisify2 } from "util";
 
 // src/binary-resolver.ts
 import { existsSync } from "fs";
@@ -9753,24 +9753,236 @@ var commonOptimizations = {
 // src/updater/index.ts
 var exports_updater = {};
 __export(exports_updater, {
+  verifyBundleTrust: () => verifyBundleTrust,
   updaterCommand: () => updaterCommand,
+  swapBundle: () => swapBundle,
+  readBundleIdentity: () => readBundleIdentity,
+  isMacOS: () => isMacOS,
   generateUpdateManifest: () => generateUpdateManifest,
+  extractBundleFromZip: () => extractBundleFromZip,
+  extractBundleFromDmg: () => extractBundleFromDmg,
+  extractBundle: () => extractBundle,
+  dittoBundle: () => dittoBundle,
   default: () => updater_default,
+  clearQuarantine: () => clearQuarantine,
+  canReplaceBundle: () => canReplaceBundle,
   DeltaGenerator: () => DeltaGenerator,
   AutoUpdater: () => AutoUpdater
 });
-import { createReadStream, createWriteStream, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, basename as basename2, dirname } from "path";
-import { execFileSync, spawn as spawn3 } from "child_process";
+import { createReadStream, createWriteStream, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmdirSync, rmSync as rmSync3, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3, basename as basename3, dirname as dirname2 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+import { execFileSync as execFileSync2, spawn as spawn3 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { EventEmitter as EventEmitter3 } from "events";
-function findFirstByName(root, namePattern, kind) {
-  const out = execFileSync("find", [root, "-name", namePattern, "-type", kind, "-print0"]);
-  const nullByte = String.fromCharCode(0);
-  const parts = out.toString("utf-8").split(nullByte).filter((s) => s.length > 0);
-  return parts[0] ?? "";
+
+// src/updater/macos-bundle.ts
+import { execFile, execFileSync } from "child_process";
+import { accessSync, constants, existsSync as existsSync3, mkdtempSync as mkdtempSync2, renameSync, rmSync as rmSync2, statSync } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname, join as join2 } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+function isMacOS() {
+  return process.platform === "darwin";
+}
+async function readBundleIdentity(appPath) {
+  const empty = { identifier: null, teamId: null, authority: null };
+  if (!isMacOS())
+    return empty;
+  let report;
+  try {
+    const { stderr, stdout } = await execFileAsync("codesign", ["-dv", "--verbose=4", appPath]);
+    report = `${stderr}
+${stdout}`;
+  } catch (error) {
+    const e = error;
+    report = `${e.stderr ?? ""}
+${e.stdout ?? ""}`;
+    if (!report.trim())
+      return empty;
+  }
+  const field = (name) => {
+    const match = report.match(new RegExp(`^${name}=(.+)$`, "m"));
+    if (!match)
+      return null;
+    const value = match[1].trim();
+    return value === "not set" || value.length === 0 ? null : value;
+  };
+  return {
+    identifier: field("Identifier"),
+    teamId: field("TeamIdentifier"),
+    authority: field("Authority")
+  };
+}
+async function verifyBundleTrust(appPath, policy = {}) {
+  const identity = await readBundleIdentity(appPath);
+  const requireNotarized = policy.requireNotarized ?? true;
+  if (!existsSync3(appPath)) {
+    return { ok: false, identity, gatekeeperSource: null, reason: "unreadable", detail: `No such bundle: ${appPath}` };
+  }
+  try {
+    await execFileAsync("codesign", ["--verify", "--deep", "--strict", "--verbose=2", appPath]);
+  } catch (error) {
+    return {
+      ok: false,
+      identity,
+      gatekeeperSource: null,
+      reason: "codesign-invalid",
+      detail: describe(error)
+    };
+  }
+  let gatekeeperSource = null;
+  if (requireNotarized) {
+    try {
+      const { stderr, stdout } = await execFileAsync("spctl", ["-a", "-t", "exec", "-vv", appPath]);
+      const report = `${stderr}
+${stdout}`;
+      gatekeeperSource = report.match(/^source=(.+)$/m)?.[1]?.trim() ?? null;
+    } catch (error) {
+      return {
+        ok: false,
+        identity,
+        gatekeeperSource: null,
+        reason: "gatekeeper-rejected",
+        detail: describe(error)
+      };
+    }
+  }
+  if (policy.teamId && identity.teamId !== policy.teamId) {
+    return {
+      ok: false,
+      identity,
+      gatekeeperSource,
+      reason: "team-mismatch",
+      detail: `Expected Team ID ${policy.teamId}, bundle is signed by ${identity.teamId ?? "nobody"}`
+    };
+  }
+  return { ok: true, identity, gatekeeperSource };
+}
+async function clearQuarantine(appPath) {
+  if (!isMacOS())
+    return;
+  try {
+    await execFileAsync("xattr", ["-d", "-r", "com.apple.quarantine", appPath]);
+  } catch {}
+}
+async function dittoBundle(source, destination) {
+  await execFileAsync("ditto", [source, destination]);
+}
+function findTopLevelApp(root) {
+  const out = execFileSync("find", [root, "-maxdepth", "2", "-name", "*.app", "-type", "d", "-print0"]);
+  const parts = out.toString("utf-8").split("\x00").filter((s) => s.length > 0);
+  parts.sort((a, b) => a.split("/").length - b.split("/").length);
+  return parts[0] ?? null;
+}
+async function extractBundleFromDmg(dmgPath, stagingDir) {
+  const staging = stagingDir ?? mkdtempSync2(join2(tmpdir2(), "craft-update-"));
+  const mountPoint = mkdtempSync2(join2(tmpdir2(), "craft-mount-"));
+  let mounted = false;
+  try {
+    await execFileAsync("hdiutil", ["attach", dmgPath, "-nobrowse", "-readonly", "-mountpoint", mountPoint]);
+    mounted = true;
+    const source = findTopLevelApp(mountPoint);
+    if (!source)
+      throw new Error(`No .app found in disk image: ${dmgPath}`);
+    const appPath = join2(staging, basename2(source));
+    await dittoBundle(source, appPath);
+    return { appPath, stagingDir: staging };
+  } finally {
+    if (mounted) {
+      try {
+        await execFileAsync("hdiutil", ["detach", mountPoint, "-force"]);
+      } catch {}
+    }
+    try {
+      rmSync2(mountPoint, { recursive: true, force: true });
+    } catch {}
+  }
+}
+async function extractBundleFromZip(zipPath, stagingDir) {
+  const staging = stagingDir ?? mkdtempSync2(join2(tmpdir2(), "craft-update-"));
+  const unpacked = join2(staging, "payload");
+  await execFileAsync("ditto", ["-x", "-k", zipPath, unpacked]);
+  const source = findTopLevelApp(unpacked);
+  if (!source)
+    throw new Error(`No .app found in archive: ${zipPath}`);
+  return { appPath: source, stagingDir: staging };
+}
+async function extractBundle(archivePath, stagingDir) {
+  if (archivePath.endsWith(".dmg"))
+    return extractBundleFromDmg(archivePath, stagingDir);
+  if (archivePath.endsWith(".zip"))
+    return extractBundleFromZip(archivePath, stagingDir);
+  throw new Error(`Cannot extract an app bundle from ${archivePath}`);
+}
+async function swapBundle(stagedPath, installedPath) {
+  if (!existsSync3(stagedPath))
+    throw new Error(`Staged bundle is missing: ${stagedPath}`);
+  const parent = dirname(installedPath);
+  const stamp = `${Date.now()}.${process.pid}`;
+  const incoming = join2(parent, `.${basename2(installedPath)}.${stamp}.incoming`);
+  const retired = join2(parent, `.${basename2(installedPath)}.${stamp}.retired`);
+  try {
+    renameSync(stagedPath, incoming);
+  } catch {
+    await dittoBundle(stagedPath, incoming);
+  }
+  const hadPrevious = existsSync3(installedPath);
+  try {
+    if (hadPrevious)
+      renameSync(installedPath, retired);
+    try {
+      renameSync(incoming, installedPath);
+    } catch (error) {
+      if (hadPrevious) {
+        try {
+          renameSync(retired, installedPath);
+        } catch {}
+      }
+      throw error;
+    }
+  } catch (error) {
+    try {
+      rmSync2(incoming, { recursive: true, force: true });
+    } catch {}
+    throw error;
+  }
+  if (hadPrevious) {
+    try {
+      rmSync2(retired, { recursive: true, force: true });
+      return { previousPath: null };
+    } catch {
+      return { previousPath: retired };
+    }
+  }
+  return { previousPath: null };
+}
+function canReplaceBundle(installedPath) {
+  try {
+    const parent = dirname(installedPath);
+    accessSync(parent, constants.W_OK);
+    if (existsSync3(installedPath))
+      statSync(installedPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function describe(error) {
+  if (error && typeof error === "object") {
+    const e = error;
+    const stderr = e.stderr?.trim();
+    if (stderr)
+      return stderr;
+    if (e.message)
+      return e.message;
+  }
+  return String(error);
 }
 
+// src/updater/index.ts
+var PROGRESS_INTERVAL_MS = 100;
 class AutoUpdater extends EventEmitter3 {
   config;
   updateInfo = null;
@@ -9779,12 +9991,22 @@ class AutoUpdater extends EventEmitter3 {
   cachedEtag = null;
   cachedLastModified = null;
   cachedManifest = null;
+  lastError = null;
   emitError(error) {
+    this.lastError = error instanceof Error ? error : new Error(String(error));
     if (this.listenerCount("error") > 0)
       this.emit("error", error);
     else
       console.error("[Updater]", error);
   }
+  downloadDir() {
+    if (this.config.downloadDir)
+      return this.config.downloadDir;
+    return join3(tmpdir3(), "craft-updates", basename3(this.config.appPath) || "app");
+  }
+  getLastError() {
+    return this.lastError;
+  }
   constructor(config) {
     super();
     const url = config.updateUrl;
@@ -9818,6 +10040,7 @@ class AutoUpdater extends EventEmitter3 {
   }
   async checkForUpdates() {
     this.emit("checking-for-update");
+    this.lastError = null;
     try {
       const platform = this.getPlatform();
       const url = `${this.config.updateUrl}?v=${this.config.currentVersion}&channel=${this.config.channel}&platform=${platform}`;
@@ -9866,20 +10089,21 @@ class AutoUpdater extends EventEmitter3 {
     if (!this.updateInfo) {
       throw new Error("No update available");
     }
+    this.lastError = null;
     const platform = this.getPlatform();
     const platformUpdate = this.updateInfo.platforms[platform];
     if (!platformUpdate) {
       throw new Error(`No update available for platform: ${platform}`);
     }
-    const deltaUpdate = platformUpdate.delta?.find((d) => d.fromVersion === this.config.currentVersion);
+    const deltaUpdate = DeltaGenerator.isSupported() ? platformUpdate.delta?.find((d) => d.fromVersion === this.config.currentVersion) : undefined;
     const _updateSource = deltaUpdate || platformUpdate;
     const url = deltaUpdate?.url || platformUpdate.url;
     const expectedSize = deltaUpdate?.size || platformUpdate.size;
     const expectedHash = deltaUpdate?.sha256 || platformUpdate.sha256;
-    const downloadDir = join2(this.config.appPath, "..", ".craft-updates");
+    const downloadDir = this.downloadDir();
     mkdirSync2(downloadDir, { recursive: true });
-    const fileName = basename2(url);
-    this.downloadPath = join2(downloadDir, fileName);
+    const fileName = basename3(url);
+    this.downloadPath = join3(downloadDir, fileName);
     try {
       const response = await fetch(url);
       if (!response.ok) {
@@ -9894,39 +10118,59 @@ class AutoUpdater extends EventEmitter3 {
       if (!reader) {
         throw new Error("Failed to get response reader");
       }
+      const digest = createHash2("sha256");
+      let lastProgressAt = 0;
       while (true) {
         const { done, value } = await reader.read();
         if (done)
           break;
-        fileStream.write(value);
+        digest.update(value);
+        if (!fileStream.write(value)) {
+          await new Promise((resolve, reject) => {
+            const onDrain = () => {
+              fileStream.off("error", onError);
+              resolve();
+            };
+            const onError = (error) => {
+              fileStream.off("drain", onDrain);
+              reject(error);
+            };
+            fileStream.once("drain", onDrain);
+            fileStream.once("error", onError);
+          });
+        }
         downloaded += value.length;
-        const elapsed = (Date.now() - startTime) / 1000;
-        const speed = downloaded / elapsed;
-        const progress = {
-          phase: "downloading",
-          percent: Math.round(downloaded / total * 100),
-          bytesDownloaded: downloaded,
-          bytesTotal: total,
-          speed
-        };
-        this.emit("download-progress", progress);
+        const now = Date.now();
+        if (now - lastProgressAt >= PROGRESS_INTERVAL_MS || downloaded === total) {
+          lastProgressAt = now;
+          const elapsed = (now - startTime) / 1000;
+          const speed = elapsed > 0 ? downloaded / elapsed : 0;
+          const progress = {
+            phase: "downloading",
+            percent: total > 0 ? Math.round(downloaded / total * 100) : 0,
+            bytesDownloaded: downloaded,
+            bytesTotal: total,
+            speed
+          };
+          this.emit("download-progress", progress);
+        }
       }
       fileStream.end();
       await new Promise((resolve, reject) => {
         fileStream.once("finish", resolve);
         fileStream.once("error", reject);
       });
-      const hash = await this.computeFileHash(this.downloadPath);
+      const hash = digest.digest("hex");
       if (hash !== expectedHash) {
         unlinkSync(this.downloadPath);
         throw new Error("Download verification failed: hash mismatch");
       }
       if (deltaUpdate) {
-        if (!statSync(this.config.appPath).isFile()) {
+        if (!statSync2(this.config.appPath).isFile()) {
           throw new Error("Delta updates require appPath to point to the installed bundle file");
         }
         const patchPath = this.downloadPath;
-        const reconstructedPath = join2(downloadDir, `reconstructed-${basename2(platformUpdate.url)}`);
+        const reconstructedPath = join3(downloadDir, `reconstructed-${basename3(platformUpdate.url)}`);
         await DeltaGenerator.apply(this.config.appPath, patchPath, reconstructedPath);
         const reconstructedHash = await this.computeFileHash(reconstructedPath);
         if (reconstructedHash !== platformUpdate.sha256) {
@@ -9964,7 +10208,7 @@ class AutoUpdater extends EventEmitter3 {
     }
   }
   async installUpdate(restartAfter = true) {
-    if (!this.downloadPath || !existsSync3(this.downloadPath)) {
+    if (!this.downloadPath || !existsSync4(this.downloadPath)) {
       throw new Error("No update downloaded");
     }
     if (this.updateInfo) {
@@ -10008,14 +10252,17 @@ class AutoUpdater extends EventEmitter3 {
           await this.installLinuxUpdate();
           break;
       }
-      if (this.downloadPath && existsSync3(this.downloadPath)) {
+      if (this.downloadPath && existsSync4(this.downloadPath)) {
         unlinkSync(this.downloadPath);
       }
+      try {
+        rmdirSync(this.downloadDir());
+      } catch {}
       progress.phase = "done";
       progress.percent = 100;
       this.emit("download-progress", progress);
       if (restartAfter) {
-        this.restartApp();
+        await this.restartApp();
       }
     } catch (error) {
       progress.phase = "error";
@@ -10026,38 +10273,45 @@ class AutoUpdater extends EventEmitter3 {
   async installMacOSUpdate() {
     const downloadPath = this.downloadPath;
     const appPath = this.config.appPath;
-    if (downloadPath.endsWith(".zip")) {
-      const tempDir2 = join2(dirname(downloadPath), "extracted");
-      mkdirSync2(tempDir2, { recursive: true });
-      execFileSync("unzip", ["-o", downloadPath, "-d", tempDir2]);
-      const extractedApp = findFirstByName(tempDir2, "*.app", "d");
-      if (extractedApp) {
-        const { rmSync: rmSync3, renameSync } = await import("fs");
-        rmSync3(appPath, { recursive: true, force: true });
-        renameSync(extractedApp, appPath);
-      }
-      const { rmSync: rmSync2 } = await import("fs");
-      rmSync2(tempDir2, { recursive: true, force: true });
-    } else if (downloadPath.endsWith(".dmg")) {
-      const mountOutput = execFileSync("hdiutil", ["attach", downloadPath, "-nobrowse"]).toString();
-      const mountPoint = mountOutput.match(/\/Volumes\/[^\n]+/)?.[0];
-      if (mountPoint) {
-        const dmgApp = findFirstByName(mountPoint, "*.app", "d");
-        if (dmgApp) {
-          const { rmSync: rmSync2, cpSync: cpSync2 } = await import("fs");
-          rmSync2(appPath, { recursive: true, force: true });
-          cpSync2(dmgApp, appPath, { recursive: true });
-        }
-        execFileSync("hdiutil", ["detach", mountPoint]);
-      }
-    } else if (downloadPath.endsWith(".pkg")) {
+    if (downloadPath.endsWith(".pkg")) {
+      await this.installMacOSPackage(downloadPath);
+      return;
+    }
+    if (!canReplaceBundle(appPath)) {
+      throw new Error(`Cannot replace ${appPath}: ${dirname2(appPath)} is not writable by this user. ` + "Install the update manually, or move the app somewhere you own.");
+    }
+    const staged = await extractBundle(downloadPath);
+    try {
+      const trust = await this.assertBundleTrusted(staged.appPath);
+      await clearQuarantine(staged.appPath);
+      const { previousPath } = await swapBundle(staged.appPath, appPath);
+      this.emit("update-installed", {
+        path: appPath,
+        version: this.updateInfo?.version,
+        identity: trust.identity,
+        leftoverPath: previousPath
+      });
+    } finally {
       try {
-        execFileSync("pkgutil", ["--check-signature", downloadPath], { stdio: "pipe" });
-      } catch (e) {
-        throw new Error(`Refusing to install ${downloadPath}: pkgutil --check-signature failed. The .pkg is not signed by a trusted Apple certificate chain. Underlying error: ${e.message}`);
-      }
-      execFileSync("sudo", ["installer", "-pkg", downloadPath, "-target", "/"]);
+        rmSync3(staged.stagingDir, { recursive: true, force: true });
+      } catch {}
+    }
+  }
+  async assertBundleTrusted(bundlePath) {
+    const policy = this.config.macos ?? {};
+    const trust = await verifyBundleTrust(bundlePath, policy);
+    if (!trust.ok) {
+      throw new Error(`Refusing to install ${bundlePath}: ${trust.reason} (${trust.detail ?? "no detail"}). ` + "The downloaded bundle is not one macOS will run as this application.");
+    }
+    return trust;
+  }
+  async installMacOSPackage(downloadPath) {
+    try {
+      execFileSync2("pkgutil", ["--check-signature", downloadPath], { stdio: "pipe" });
+    } catch (e) {
+      throw new Error(`Refusing to install ${downloadPath}: pkgutil --check-signature failed. ` + "The .pkg is not signed by a trusted Apple certificate chain. " + `Underlying error: ${e.message}`);
     }
+    execFileSync2("sudo", ["installer", "-pkg", downloadPath, "-target", "/"]);
   }
   async installWindowsUpdate() {
     const downloadPath = this.downloadPath;
@@ -10072,8 +10326,8 @@ class AutoUpdater extends EventEmitter3 {
         stdio: "ignore"
       });
     } else if (downloadPath.endsWith(".zip")) {
-      const appDir = dirname(this.config.appPath);
-      execFileSync("powershell", [
+      const appDir = dirname2(this.config.appPath);
+      execFileSync2("powershell", [
         "-NoProfile",
         "-NonInteractive",
         "-Command",
@@ -10086,28 +10340,29 @@ class AutoUpdater extends EventEmitter3 {
   async installLinuxUpdate() {
     const downloadPath = this.downloadPath;
     if (downloadPath.endsWith(".AppImage")) {
-      execFileSync("chmod", ["+x", downloadPath]);
-      const { renameSync } = await import("fs");
-      renameSync(downloadPath, this.config.appPath);
+      execFileSync2("chmod", ["+x", downloadPath]);
+      const { renameSync: renameSync2 } = await import("fs");
+      renameSync2(downloadPath, this.config.appPath);
     } else if (downloadPath.endsWith(".deb")) {
-      execFileSync("sudo", ["dpkg", "-i", downloadPath]);
+      execFileSync2("sudo", ["dpkg", "-i", downloadPath]);
     } else if (downloadPath.endsWith(".rpm")) {
-      execFileSync("sudo", ["rpm", "-U", downloadPath]);
+      execFileSync2("sudo", ["rpm", "-U", downloadPath]);
     } else if (downloadPath.endsWith(".tar.gz")) {
-      const appDir = dirname(this.config.appPath);
-      execFileSync("tar", ["-xzf", downloadPath, "-C", appDir]);
+      const appDir = dirname2(this.config.appPath);
+      execFileSync2("tar", ["-xzf", downloadPath, "-C", appDir]);
     }
   }
-  restartApp() {
-    const platform = this.getPlatform();
+  async restartApp() {
     const appPath = this.config.appPath;
-    switch (platform) {
+    if (this.config.relaunch) {
+      await this.config.relaunch(appPath);
+      return;
+    }
+    switch (this.getPlatform()) {
       case "darwin":
         spawn3("open", ["-n", appPath], { detached: true, stdio: "ignore" });
         break;
       case "win32":
-        spawn3(appPath, [], { detached: true, stdio: "ignore" });
-        break;
       case "linux":
         spawn3(appPath, [], { detached: true, stdio: "ignore" });
         break;
@@ -10183,18 +10438,32 @@ class AutoUpdater extends EventEmitter3 {
 }
 
 class DeltaGenerator {
+  static supported = null;
+  static isSupported() {
+    if (DeltaGenerator.supported !== null)
+      return DeltaGenerator.supported;
+    DeltaGenerator.supported = ["bspatch", "xdelta3"].some((tool) => {
+      try {
+        execFileSync2("command", ["-v", tool], { stdio: "ignore", shell: true });
+        return true;
+      } catch {
+        return false;
+      }
+    });
+    return DeltaGenerator.supported;
+  }
   static async generate(oldPath, newPath, outputPath) {
     try {
-      execFileSync("bsdiff", [oldPath, newPath, outputPath]);
-      const stats = statSync(outputPath);
+      execFileSync2("bsdiff", [oldPath, newPath, outputPath]);
+      const stats = statSync2(outputPath);
       const hash = await DeltaGenerator.computeHash(outputPath);
       return {
         size: stats.size,
         sha256: hash
       };
     } catch {
-      execFileSync("xdelta3", ["-e", "-s", oldPath, newPath, outputPath]);
-      const stats = statSync(outputPath);
+      execFileSync2("xdelta3", ["-e", "-s", oldPath, newPath, outputPath]);
+      const stats = statSync2(outputPath);
       const hash = await DeltaGenerator.computeHash(outputPath);
       return {
         size: stats.size,
@@ -10204,9 +10473,9 @@ class DeltaGenerator {
   }
   static async apply(basePath, deltaPath, outputPath) {
     try {
-      execFileSync("bspatch", [basePath, outputPath, deltaPath]);
+      execFileSync2("bspatch", [basePath, outputPath, deltaPath]);
     } catch {
-      execFileSync("xdelta3", ["-d", "-s", basePath, deltaPath, outputPath]);
+      execFileSync2("xdelta3", ["-d", "-s", basePath, deltaPath, outputPath]);
     }
   }
   static async computeHash(filePath) {
@@ -10334,11 +10603,11 @@ Examples:
 var updater_default = AutoUpdater;
 
 // src/index.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync2 = promisify2(execFile2);
 var versionMismatchWarned = false;
 function getSdkVersion() {
   try {
-    const pkgPath = join3(import.meta.dir, "..", "package.json");
+    const pkgPath = join4(import.meta.dir, "..", "package.json");
     return JSON.parse(readFileSync3(pkgPath, "utf-8")).version ?? "unknown";
   } catch {
     return "unknown";
@@ -10348,7 +10617,7 @@ async function probeBinaryVersion(craftPath) {
   if (versionMismatchWarned)
     return;
   try {
-    const { stdout } = await execFileAsync(craftPath, ["--version"], { timeout: 2000 });
+    const { stdout } = await execFileAsync2(craftPath, ["--version"], { timeout: 2000 });
     const nativeVersion = parseCraftVersionOutput(stdout);
     const sdkVersion = getSdkVersion();
     if (sdkVersion !== "unknown" && nativeVersion && nativeVersion !== sdkVersion) {
@@ -10565,8 +10834,8 @@ class CraftApp {
         if (safeForArgv) {
           args.push("--sidebar-config", json);
         } else {
-          const dir = mkdtempSync2(join3(tmpdir2(), "craft-sidebar-"));
-          const path = join3(dir, "sidebar-config.json");
+          const dir = mkdtempSync3(join4(tmpdir4(), "craft-sidebar-"));
+          const path = join4(dir, "sidebar-config.json");
           writeFileSync3(path, json, "utf-8");
           args.push("--sidebar-config-file", path);
         }
@@ -10605,6 +10874,7 @@ export {
   watch,
   vueOptimizations,
   verifyPassword,
+  verifyBundleTrust,
   variants,
   uuid,
   exports_updater as updater,
@@ -10623,6 +10893,7 @@ export {
   tahoeStyles,
   tahoeStyle,
   tahoeDemoData,
+  swapBundle,
   svelteOptimizations,
   submenu,
   styles,
@@ -10670,6 +10941,7 @@ export {
   registerShortcut,
   readText,
   readHTML,
+  readBundleIdentity,
   readBinaryFile,
   reactOptimizations,
   randomString,
@@ -10737,9 +11009,13 @@ export {
   foregroundService,
   focusFilters,
   focus,
+  extractBundleFromZip,
+  extractBundleFromDmg,
+  extractBundle,
   exit,
   exec,
   env,
+  dittoBundle,
   dialog,
   device,
   desktopWidgets,
@@ -10770,8 +11046,10 @@ export {
   commonOptimizations,
   cx as clsx,
   clipboard,
+  clearQuarantine,
   checkbox,
   carplay,
+  canReplaceBundle,
   canQuickLook,
   camera,
   buildMenu,