create-vidra-app 0.3.1 → 0.4.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 // src/commands/build.ts
-import path5 from "path";
-import fs4 from "fs-extra";
+import path12 from "path";
+import fs11 from "fs-extra";
 import { execSync as execSync3 } from "child_process";
 
 // src/utils.ts
@@ -90,9 +90,9 @@ var fixLine = (cmd, label = "fix:") => `      ${amber(label)} ${lime(cmd)}`;
 var planBadge = (text = "PLAN ONLY \xB7 BEING BUILT") => amber(`[ ${text} ]`);
 
 // src/exec.ts
-var toText = (value2) => {
-  if (value2 == null) return "";
-  return Buffer.isBuffer(value2) ? value2.toString() : value2;
+var toText = (value3) => {
+  if (value3 == null) return "";
+  return Buffer.isBuffer(value3) ? value3.toString() : value3;
 };
 var formatProcessError = (error) => {
   const err = error;
@@ -111,145 +111,323 @@ var formatBuildError = (error) => {
   return picked.join("\n").trim();
 };
 
-// src/project.ts
-import path from "path";
+// src/version.ts
 import fs from "fs-extra";
-var detectPlatform = () => {
-  switch (process.platform) {
-    case "darwin":
-      return "macos";
-    case "win32":
-      return "windows";
-    case "linux":
-      return "linux";
-    default:
-      return "macos";
-  }
+import path from "path";
+var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?(?:\+[0-9A-Za-z-.]+)?$/;
+var VersionError = class extends Error {
 };
-var detectProject = (cwd) => {
-  let dir = cwd;
-  while (true) {
-    const uiDir = path.join(dir, "ui");
-    const srcDir = path.join(dir, "src");
-    const pkgJson = path.join(dir, "package.json");
-    if (fs.existsSync(pkgJson) && fs.existsSync(uiDir) && fs.existsSync(srcDir)) {
-      const csproj = findHostCsproj(srcDir);
-      if (csproj) {
-        const projectName = path.basename(csproj.dir).replace(/\.Host$/, "");
-        const displayVersion = readCsprojVersion(csproj.path);
-        return {
-          root: dir,
-          hostDir: csproj.dir,
-          csprojPath: csproj.path,
-          projectName,
-          displayVersion,
-          uiDir
-        };
-      }
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+var buildNumberFor = (major, minor, patch) => major * 1e4 + minor * 100 + patch;
+var SEGMENT_CEILING = 100;
+var parseAppVersion = (raw, source) => {
+  const match = SEMVER.exec(raw.trim());
+  if (!match) {
+    throw new VersionError(
+      `${source}: "${raw}" is not a valid version \u2014 expected semver like 1.2.3`
+    );
   }
-  console.error(
-    row({
-      glyph: "error",
-      detail: dim(
-        "Could not detect Vidra project. Run this command from your project root."
-      )
-    })
-  );
-  console.error(
-    footer(dim("expected: package.json, ui/, src/<Name>.Host/<Name>.Host.csproj"))
-  );
-  process.exit(1);
+  const [, major, minor, patch] = match.map((v) => v);
+  const [maj, min, pat] = [Number(major), Number(minor), Number(patch)];
+  const override = process.env.VIDRA_BUILD_NUMBER;
+  if (override !== void 0 && !/^\d+$/.test(override)) {
+    throw new VersionError(
+      `VIDRA_BUILD_NUMBER: "${override}" is not a positive integer`
+    );
+  }
+  if (override === void 0 && (min >= SEGMENT_CEILING || pat >= SEGMENT_CEILING)) {
+    throw new VersionError(
+      `${source}: "${raw}" \u2014 minor and patch must stay below ${SEGMENT_CEILING} so the build number keeps increasing; set VIDRA_BUILD_NUMBER to override`
+    );
+  }
+  return {
+    semver: raw.trim(),
+    display: `${maj}.${min}.${pat}`,
+    build: override !== void 0 ? Number(override) : buildNumberFor(maj, min, pat)
+  };
 };
-var findHostCsproj = (srcDir) => {
-  if (!fs.existsSync(srcDir)) return null;
-  for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {
-    if (entry.isDirectory() && entry.name.endsWith(".Host")) {
-      const csprojPath = path.join(
-        srcDir,
-        entry.name,
-        `${entry.name}.csproj`
-      );
-      if (fs.existsSync(csprojPath)) {
-        return { dir: path.join(srcDir, entry.name), path: csprojPath };
-      }
+var resolveAppVersion = (projectRoot, csprojPath) => {
+  const pkgPath = path.join(projectRoot, "package.json");
+  if (fs.existsSync(pkgPath)) {
+    const pkg = fs.readJsonSync(pkgPath, { throws: false });
+    if (pkg?.version) {
+      return { ...parseAppVersion(pkg.version, "package.json"), source: "package.json" };
     }
   }
-  return null;
+  const csproj = fs.readFileSync(csprojPath, "utf-8");
+  const fromCsproj = csproj.match(
+    /<ApplicationDisplayVersion>([^<]+)<\/ApplicationDisplayVersion>/
+  )?.[1];
+  if (!fromCsproj) {
+    throw new VersionError(
+      `no version found \u2014 add a "version" to the app's package.json (npm version patch)`
+    );
+  }
+  return { ...parseAppVersion(fromCsproj, "csproj"), source: "csproj" };
 };
-var readCsprojVersion = (csprojPath) => {
-  const content = fs.readFileSync(csprojPath, "utf-8");
-  const match = content.match(
-    /<ApplicationDisplayVersion>(.*?)<\/ApplicationDisplayVersion>/
-  );
-  return match?.[1] ?? "0.1.0";
+var versionPublishArgs = (version) => [
+  `-p:ApplicationDisplayVersion=${version.display}`,
+  `-p:ApplicationVersion=${version.build}`
+];
+var resolveAppVersionOrDefault = (projectRoot, csprojPath, fallback = "0.1.0") => {
+  try {
+    return resolveAppVersion(projectRoot, csprojPath).semver;
+  } catch {
+    return fallback;
+  }
 };
 
-// src/targets/macos.ts
+// src/update-config.ts
 import path2 from "path";
 import fs2 from "fs-extra";
-import { execSync as execSync2 } from "child_process";
-import os from "os";
-var macosTarget = {
-  name: "macos",
-  framework: "net10.0-maccatalyst",
-  extraPublishArgs: "-p:CreatePackage=false",
-  findBundle(publishDir, _projectName) {
-    if (!fs2.existsSync(publishDir)) return null;
-    for (const entry of fs2.readdirSync(publishDir, { withFileTypes: true })) {
-      if (entry.name.endsWith(".app") && entry.isDirectory()) {
-        return path2.join(publishDir, entry.name);
-      }
-    }
+var UPDATE_CONFIG_FILE = "vidra-updates.json";
+var readUpdateConfig = (projectRoot) => {
+  const pkgPath = path2.join(projectRoot, "package.json");
+  if (!fs2.existsSync(pkgPath)) return null;
+  let pkg;
+  try {
+    pkg = fs2.readJsonSync(pkgPath);
+  } catch {
     return null;
-  },
-  async package(appPath, outputDir, meta) {
-    const dmgName = `${meta.projectName}-${meta.displayVersion}-macos.dmg`;
-    const dmgPath = path2.join(outputDir, dmgName);
-    const volName = meta.projectName;
-    const staging = fs2.mkdtempSync(path2.join(os.tmpdir(), "vidra-dmg-"));
-    try {
-      fs2.copySync(appPath, path2.join(staging, path2.basename(appPath)));
-      fs2.symlinkSync("/Applications", path2.join(staging, "Applications"));
-      if (fs2.existsSync(dmgPath)) {
-        fs2.removeSync(dmgPath);
-      }
-      execSync2(
-        `hdiutil create -volname "${volName}" -srcfolder "${staging}" -ov -format UDZO "${dmgPath}"`,
-        { stdio: "pipe" }
-      );
-    } finally {
-      fs2.removeSync(staging);
+  }
+  const updates = pkg?.vidra?.updates;
+  if (!updates || typeof updates !== "object") return null;
+  const raw = updates;
+  const config = {};
+  if (typeof raw.feedUrl === "string" && raw.feedUrl.trim().length > 0) {
+    config.feedUrl = raw.feedUrl.trim();
+  }
+  if (typeof raw.channel === "string" && raw.channel.trim().length > 0) {
+    config.channel = raw.channel.trim();
+  }
+  if (typeof raw.enabled === "boolean") {
+    config.enabled = raw.enabled;
+  }
+  const keys = [
+    ...typeof raw.publicKey === "string" ? [raw.publicKey] : [],
+    ...Array.isArray(raw.publicKeys) ? raw.publicKeys : []
+  ].filter((key) => typeof key === "string" && key.trim().length > 0);
+  if (keys.length > 0) {
+    config.publicKeys = keys.map((key) => key.trim());
+  }
+  const native = readNativeConfig(raw.native);
+  if (native) {
+    config.native = native;
+  }
+  return Object.keys(config).length > 0 ? config : null;
+};
+var readNativeConfig = (raw) => {
+  if (!raw || typeof raw !== "object") return null;
+  const source = raw;
+  const native = {};
+  const text = (key) => {
+    const value3 = source[key];
+    if (typeof value3 === "string" && value3.trim().length > 0) {
+      native[key] = value3.trim();
     }
-    return dmgPath;
+  };
+  text("feedUrl");
+  text("channel");
+  text("packId");
+  if (typeof source.enabled === "boolean") native.enabled = source.enabled;
+  return Object.keys(native).length > 0 ? native : null;
+};
+var stampUpdateConfig = (hostDir, config) => {
+  const target = path2.join(hostDir, "Resources", "Raw", UPDATE_CONFIG_FILE);
+  if (!config) {
+    fs2.removeSync(target);
+    return null;
   }
+  fs2.ensureDirSync(path2.dirname(target));
+  fs2.writeFileSync(target, `${JSON.stringify(config, null, 2)}
+`);
+  return target;
 };
 
-// src/signing.ts
+// src/native-update.ts
+import path6 from "path";
+import os2 from "os";
+import fs6 from "fs-extra";
+import { execFileSync as execFileSync4 } from "child_process";
+
+// src/velopack.ts
 import path3 from "path";
+import os from "os";
+import fs3 from "fs-extra";
 import { execFileSync } from "child_process";
+var ALREADY_RELEASED = /There is a release in channel .*? which is equal or greater to the current version/i;
+var packArgs = (options) => {
+  const args = [
+    "pack",
+    "--packId",
+    options.packId,
+    "--packVersion",
+    options.packVersion,
+    "--packDir",
+    options.packDir,
+    "--mainExe",
+    options.mainExe,
+    "--outputDir",
+    options.outputDir
+  ];
+  if (options.packTitle) args.push("--packTitle", options.packTitle);
+  if (options.channel) args.push("--channel", options.channel);
+  if (options.signAppIdentity) args.push("--signAppIdentity", options.signAppIdentity);
+  if (options.signEntitlements) args.push("--signEntitlements", options.signEntitlements);
+  if (options.keychain) args.push("--keychain", options.keychain);
+  if (options.signParams) args.push("--signParams", options.signParams);
+  return args;
+};
+var downloadArgs = (options) => {
+  const args = ["download", "http", "--url", options.feedUrl, "--outputDir", options.outputDir];
+  if (options.channel) args.push("--channel", options.channel);
+  return args;
+};
+var resolveVpk = () => {
+  const exe = process.platform === "win32" ? "vpk.exe" : "vpk";
+  const onPath = which(exe);
+  if (onPath) return onPath;
+  const home = process.env.DOTNET_CLI_HOME?.trim() || os.homedir();
+  const candidate = path3.join(home, ".dotnet", "tools", exe);
+  return fs3.existsSync(candidate) ? candidate : null;
+};
+var parseVpkVersion = (helpOutput) => helpOutput.match(/Velopack CLI\s+([\d][\w.+-]*)/i)?.[1] ?? null;
+var vpkVersion = (vpk) => {
+  try {
+    const output = execFileSync(vpk, ["--help"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return parseVpkVersion(output ?? "");
+  } catch (error) {
+    return parseVpkVersion(combinedOutput(error));
+  }
+};
+var isVersionAlreadyReleased = (output) => ALREADY_RELEASED.test(output);
+var runVpk = (vpk, args, options = {}) => {
+  try {
+    const output = execFileSync(vpk, args, {
+      cwd: options.cwd,
+      encoding: "utf-8",
+      // Never `shell: true`. See the header.
+      stdio: options.verbose ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        // git-bash's argument mangling again: it rewrites anything starting
+        // with `/`, and Velopack's Windows signing arguments all do.
+        MSYS2_ARG_CONV_EXCL: "*"
+      }
+    });
+    return { ok: true, output: output ?? "", alreadyReleased: false };
+  } catch (error) {
+    const output = combinedOutput(error);
+    return { ok: false, output, alreadyReleased: isVersionAlreadyReleased(output) };
+  }
+};
+var findMacMainExe = (appBundle) => {
+  const macos = path3.join(appBundle, "Contents", "MacOS");
+  if (!fs3.existsSync(macos)) return null;
+  const declaredByPlist = readBundleExecutable(appBundle);
+  if (declaredByPlist && fs3.existsSync(path3.join(macos, declaredByPlist))) return declaredByPlist;
+  const declared = readMainExeFromSpec(appBundle);
+  if (declared && fs3.existsSync(path3.join(macos, declared))) return declared;
+  const candidates = fs3.readdirSync(macos, { withFileTypes: true }).filter((e) => e.isFile() && !e.name.startsWith(".") && e.name !== "UpdateMac" && e.name !== "sq.version").map((e) => e.name);
+  return candidates[0] ?? null;
+};
+var readBundleExecutable = (appBundle) => {
+  const plist = path3.join(appBundle, "Contents", "Info.plist");
+  if (!fs3.existsSync(plist)) return null;
+  const match = /<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/.exec(
+    fs3.readFileSync(plist, "utf-8")
+  );
+  return match?.[1].trim() || null;
+};
+var readMainExeFromSpec = (appBundle) => {
+  for (const dir of ["MacOS", "Resources"]) {
+    const file = path3.join(appBundle, "Contents", dir, "sq.version");
+    if (!fs3.existsSync(file)) continue;
+    const match = /<mainExe>([^<]+)<\/mainExe>/.exec(fs3.readFileSync(file, "utf-8"));
+    if (match) return match[1].trim();
+  }
+  return null;
+};
+var findVpkOutputs = (outputDir) => {
+  const files = fs3.existsSync(outputDir) ? fs3.readdirSync(outputDir) : [];
+  const find = (suffix) => {
+    const match = files.find((f) => f.toLowerCase().endsWith(suffix.toLowerCase()));
+    return match ? path3.join(outputDir, match) : null;
+  };
+  return {
+    portableZip: find("Portable.zip"),
+    setupExe: find("Setup.exe"),
+    setupPkg: find("Setup.pkg")
+  };
+};
+var combinedOutput = (error) => {
+  const err = error;
+  const text = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
+  const combined = [text(err.stdout), text(err.stderr)].map((s) => s.trim()).filter(Boolean).join("\n").trim();
+  return combined || err.message || String(error);
+};
+var which = (exe) => {
+  const probe = process.platform === "win32" ? "where" : "which";
+  try {
+    const output = execFileSync(probe, [exe], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const first = output.split(/\r?\n/).map((l) => l.trim()).find(Boolean);
+    return first ?? null;
+  } catch {
+    return null;
+  }
+};
+
+// src/signing.ts
+import path4 from "path";
+import fs4 from "fs-extra";
+import { execFileSync as execFileSync2, spawnSync } from "child_process";
+var DEVELOPER_ID_PREFIX = "Developer ID Application:";
+var APPLE_DEVELOPMENT_PREFIX = "Apple Development:";
 var signMacAppBundleIfPossible = (appBundle, options) => {
   if (process.platform !== "darwin") return;
-  const identity = resolveMacCodeSigningIdentity();
+  const purpose = options.purpose ?? "development";
+  const { identity, expiredSkipped } = selectMacIdentity(purpose);
+  warnAboutExpiredIdentities(expiredSkipped, options);
   const signWith = identity ?? "-";
-  const label = path3.basename(appBundle);
+  const label = path4.basename(appBundle);
+  const entitlements = options.entitlements && fs4.existsSync(options.entitlements) ? options.entitlements : null;
+  const hardened = purpose === "distribution" && entitlements !== null;
+  if (purpose === "distribution") {
+    warnAboutDistributionIdentity(identity, options);
+    if (!entitlements) {
+      options.warn(
+        row({
+          glyph: "manual",
+          label: "codesign",
+          labelWidth: STEP_LABEL_WIDTH,
+          detail: dim(
+            "no Entitlements.plist found \u2014 signing without the hardened runtime (cannot be notarized)"
+          )
+        })
+      );
+    }
+  }
   try {
-    execFileSync(
-      "codesign",
-      ["--force", "--deep", "--sign", signWith, appBundle],
-      {
-        stdio: options.verbose ? "inherit" : "pipe"
-      }
-    );
+    for (const nested of findNestedMachOPayloads(appBundle)) {
+      runCodesign(nested, signWith, { hardened, entitlements: null }, options);
+    }
+    runCodesign(appBundle, signWith, { hardened, entitlements }, options);
+    const detail = [
+      value(label),
+      dim(identity ? `with ${identity}` : "ad-hoc (-)"),
+      hardened ? dim("\xB7 hardened runtime") : ""
+    ].filter(Boolean).join(" ");
     options.log(
       row({
         glyph: "done",
         label: "codesign",
         labelWidth: STEP_LABEL_WIDTH,
-        detail: identity ? `${value(label)} ${dim(`with ${identity}`)}` : `${value(label)} ${dim("ad-hoc (-)")}`
+        detail
       })
     );
   } catch (error) {
@@ -271,768 +449,2761 @@ var signMacAppBundleIfPossible = (appBundle, options) => {
     options.warn(dim(formatExecError(error)));
   }
 };
-var resolveMacCodeSigningIdentity = () => {
-  const override = process.env.VIDRA_MACOS_CODESIGN_KEY?.trim();
-  if (override) {
-    return override;
+var signMacDmgIfPossible = (dmgPath, options) => {
+  if (process.platform !== "darwin") return;
+  const purpose = options.purpose ?? "distribution";
+  const { identity, expiredSkipped } = selectMacIdentity(purpose);
+  warnAboutExpiredIdentities(expiredSkipped, options);
+  if (!identity) {
+    options.warn(
+      row({
+        glyph: "skip",
+        label: "codesign dmg",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("no Developer ID identity \u2014 leaving the disk image unsigned")
+      })
+    );
+    return;
   }
   try {
-    const output = execFileSync(
-      "security",
-      ["find-identity", "-v", "-p", "codesigning"],
-      {
-        stdio: ["ignore", "pipe", "pipe"],
-        encoding: "utf8"
-      }
+    execFileSync2("codesign", ["--force", "--timestamp", "--sign", identity, dmgPath], {
+      stdio: options.verbose ? "inherit" : "pipe"
+    });
+    options.log(
+      row({
+        glyph: "done",
+        label: "codesign dmg",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: `${value(path4.basename(dmgPath))} ${dim(`with ${identity}`)}`
+      })
     );
-    const identities = output.split(/\r?\n/).map((line) => line.match(/"([^"]+)"/)?.[1] ?? null).filter((value2) => value2 !== null);
-    return identities.find((identity) => identity.startsWith("Apple Development:")) ?? identities.find((identity) => identity.startsWith("Developer ID Application:")) ?? null;
-  } catch {
-    return null;
+  } catch (error) {
+    options.warn(
+      row({
+        glyph: "manual",
+        label: "codesign dmg",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("could not sign the disk image")
+      })
+    );
+    options.warn(dim(formatExecError(error)));
   }
 };
-var formatExecError = (error) => {
-  const err = error;
-  if (Buffer.isBuffer(err.stderr)) {
-    return err.stderr.toString();
-  }
-  if (typeof err.stderr === "string") {
-    return err.stderr;
+var verifyMacSignature = (target) => {
+  try {
+    const output = execFileSync2(
+      "codesign",
+      ["--verify", "--strict", "--verbose=2", target],
+      { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
+    );
+    return { ok: true, output: output ?? "" };
+  } catch (error) {
+    return { ok: false, output: formatExecError(error) };
   }
-  return err.message ?? String(error);
 };
-
-// src/targets/windows.ts
-import path4 from "path";
-import os2 from "os";
-import fs3 from "fs-extra";
-import { execFileSync as execFileSync2 } from "child_process";
-var windowsTarget = {
-  name: "windows",
-  framework: "net10.0-windows10.0.19041.0",
-  // `RuntimeIdentifierOverride` (rather than `-r`/`RuntimeIdentifier`) is the
-  // MAUI-recommended way to set the Windows RID — it sidesteps WindowsAppSDK
-  // issue #3337, which otherwise pulls in the wrong packaging assets.
-  extraPublishArgs: "-p:WindowsPackageType=None -p:SelfContained=true -p:WindowsAppSDKSelfContained=true -p:RuntimeIdentifierOverride=win-x64",
-  findBundle(publishDir, _projectName) {
-    const preferred = path4.join(publishDir, "win-x64", "publish");
-    if (dirContainsExe(preferred)) return preferred;
-    return findDirWithExe(publishDir);
-  },
-  async package(publishOutputDir, outputDir, meta) {
-    const outName = `${meta.projectName}-${meta.displayVersion}-windows.zip`;
-    const outPath = path4.join(outputDir, outName);
-    if (fs3.existsSync(outPath)) fs3.removeSync(outPath);
-    const staging = fs3.mkdtempSync(path4.join(os2.tmpdir(), "vidra-zip-"));
-    const stagedApp = path4.join(staging, meta.projectName);
-    try {
-      fs3.copySync(publishOutputDir, stagedApp);
-      execFileSync2(
-        "powershell",
-        [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Compress-Archive -Path "${stagedApp}" -DestinationPath "${outPath}" -Force`
-        ],
-        { stdio: "pipe" }
-      );
-    } finally {
-      fs3.removeSync(staging);
-    }
-    return outPath;
+var assessGatekeeper = (target) => {
+  const type = target.endsWith(".dmg") ? "open" : "execute";
+  const args = ["--assess", "--type", type, "--verbose=2"];
+  if (type === "open") args.push("--context", "context:primary-signature");
+  args.push(target);
+  try {
+    const output = execFileSync2("spctl", args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8"
+    });
+    return { ok: true, output: output ?? "" };
+  } catch (error) {
+    return { ok: false, output: formatExecError(error) };
   }
 };
-var dirContainsExe = (dir) => fs3.existsSync(dir) && fs3.readdirSync(dir, { withFileTypes: true }).some((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe"));
-var findDirWithExe = (root) => {
-  if (!fs3.existsSync(root)) return null;
-  let fallback = null;
-  const walk = (dir) => {
-    if (dirContainsExe(dir)) {
-      if (path4.basename(dir) === "publish") return dir;
-      fallback ??= dir;
-    }
-    for (const e of fs3.readdirSync(dir, { withFileTypes: true })) {
-      if (e.isDirectory()) {
-        const found = walk(path4.join(dir, e.name));
-        if (found) return found;
-      }
-    }
-    return null;
+var REQUIRED_MAC_ENTITLEMENTS = [
+  "com.apple.security.cs.allow-jit",
+  "com.apple.security.cs.allow-unsigned-executable-memory",
+  "com.apple.security.cs.disable-library-validation"
+];
+var inspectMacHardening = (target) => {
+  const flags = runCodesignRead(["-d", "--verbose=2", target]);
+  const entitlementsXml = runCodesignRead(["-d", "--entitlements", "-", "--xml", target]) || runCodesignRead(["-d", "--entitlements", "-", target]);
+  const hardened = /CodeDirectory[^\n]*flags=[^\n]*runtime/.test(flags);
+  const entitlements = [...entitlementsXml.matchAll(/<key>([^<]+)<\/key>/g)].map(
+    (m) => m[1]
+  );
+  const missing = REQUIRED_MAC_ENTITLEMENTS.filter(
+    (key) => !entitlementsXml.includes(key)
+  );
+  return {
+    hardened,
+    entitlements,
+    missing,
+    ok: hardened && missing.length === 0,
+    output: `${flags}
+${entitlementsXml}`
   };
-  return walk(root) ?? fallback;
 };
-
-// src/doctor.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import prompts from "prompts";
-var DOTNET = process.platform === "win32" ? "dotnet.exe" : "dotnet";
-var MAUI_DOCS = "https://learn.microsoft.com/dotnet/maui/get-started/installation";
-var INSTALL_NET_10_FIX = "Install the .NET 10 SDK \u2014 https://dotnet.microsoft.com/download";
-var bufToStr = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
-var run = (cmd, args) => {
+var runCodesignRead = (args) => {
+  const result = spawnSync("codesign", args, { encoding: "utf8" });
+  return `${result.stdout ?? ""}${result.stderr ?? ""}`;
+};
+var selectMacIdentity = (purpose = "development") => {
+  const override = process.env.VIDRA_MACOS_CODESIGN_KEY?.trim();
+  if (override) return { identity: override, expiredSkipped: [] };
+  const all = listCodeSigningIdentities();
+  const expired = new Set(listExpiredCodeSigningIdentities(all));
+  const usable = all.filter((id) => !expired.has(id));
+  const pick = (list) => (purpose === "distribution" ? list.find((id) => id.startsWith(DEVELOPER_ID_PREFIX)) ?? list.find((id) => id.startsWith(APPLE_DEVELOPMENT_PREFIX)) : list.find((id) => id.startsWith(APPLE_DEVELOPMENT_PREFIX)) ?? list.find((id) => id.startsWith(DEVELOPER_ID_PREFIX))) ?? null;
+  return {
+    identity: pick(usable),
+    // Only worth mentioning an expired certificate if it would otherwise have
+    // been the one we chose.
+    expiredSkipped: pick([...expired]) ? [pick([...expired])] : []
+  };
+};
+var resolveMacCodeSigningIdentity = (purpose = "development") => selectMacIdentity(purpose).identity;
+var listCodeSigningIdentities = () => runFindIdentity(["find-identity", "-p", "codesigning"]);
+var listValidCodeSigningIdentities = () => runFindIdentity(["find-identity", "-v", "-p", "codesigning"]);
+var runFindIdentity = (args) => {
   try {
-    const stdout = execFileSync3(cmd, args, {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
+    const output = execFileSync2("security", args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8"
     });
-    return { found: true, ok: true, stdout: stdout ?? "", stderr: "" };
-  } catch (e) {
-    const err = e;
-    return {
-      found: err.code !== "ENOENT",
-      ok: false,
-      stdout: bufToStr(err.stdout),
-      stderr: bufToStr(err.stderr)
-    };
+    return output.split(/\r?\n/).map((line) => line.match(/"([^"]+)"/)?.[1] ?? null).filter((v) => v !== null);
+  } catch {
+    return [];
   }
 };
-var splitLines = (text) => text.split(/\r?\n/);
-var matchesAny = (text, patterns) => patterns.some((pattern) => pattern.test(text));
-var NET_10_VERSION = /^10\./;
-var WORKLOAD_SET_VERSION_LINE = /Workload version:\s*([\w.-]+)/i;
-var MAUI_WORKLOAD = /\bmaui\b/i;
-var COMMAND_LINE_TOOLS_PATH = /CommandLineTools/i;
-var hasNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).some((line) => NET_10_VERSION.test(line.trim()));
-var newestNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).map((line) => line.trim().split(/\s+/)[0]).filter((version) => NET_10_VERSION.test(version)).sort(
-  (a, b) => a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" })
-).pop();
-var outputMentionsMaui = (workloadListOutput) => MAUI_WORKLOAD.test(workloadListOutput);
-var workloadSetVersion = (workloadListOutput) => workloadListOutput.match(WORKLOAD_SET_VERSION_LINE)?.[1];
-var MIN_MACCATALYST_WATCH_WORKLOAD_SET = [10, 0, 203];
-var MIN_MACCATALYST_WATCH_SDK = [10, 0, 300];
-var meetsMinimumVersion = (version, minimum) => {
-  const segments = version.split(".").map((s) => Number.parseInt(s, 10));
-  if (segments.slice(0, minimum.length).some(Number.isNaN)) return false;
-  for (let i = 0; i < minimum.length; i++) {
-    const segment = segments[i] ?? 0;
-    if (segment !== minimum[i]) return segment > minimum[i];
-  }
-  return true;
-};
-var workloadSetSupportsCSharpHotReload = (version) => meetsMinimumVersion(version, MIN_MACCATALYST_WATCH_WORKLOAD_SET);
-var sdkSupportsCSharpHotReload = (version) => meetsMinimumVersion(version, MIN_MACCATALYST_WATCH_SDK);
-var macCatalystHotReloadBlocker = () => {
-  const sdkRes = run(DOTNET, ["--version"]);
-  if (!sdkRes.found) return null;
-  const sdkVersion = sdkRes.stdout.trim();
-  if (sdkVersion && !sdkSupportsCSharpHotReload(sdkVersion)) {
-    return {
-      reason: `C# hot reload needs the .NET SDK 10.0.300+ \u2014 found ${sdkVersion}`,
-      fix: INSTALL_NET_10_FIX
-    };
-  }
-  const res = run(DOTNET, ["workload", "list"]);
-  if (!res.found) return null;
-  const version = workloadSetVersion(res.stdout);
-  if (!version || workloadSetSupportsCSharpHotReload(version)) return null;
-  return {
-    reason: `C# hot reload needs workload set 10.0.203+ \u2014 found ${version}`,
-    fix: "dotnet workload update"
-  };
+var listExpiredCodeSigningIdentities = (identities = listCodeSigningIdentities()) => {
+  const chainValid = new Set(listValidCodeSigningIdentities());
+  return identities.filter((id) => {
+    if (chainValid.has(id)) return false;
+    const notAfter = certificateNotAfter(id);
+    return notAfter !== null && notAfter.getTime() < Date.now();
+  });
 };
-var MISSING_WORKLOAD_SIGNATURES = [
-  /NETSDK1147/i,
-  /workloads?\s+must\s+be\s+installed/i,
-  /maui-maccatalyst/i,
-  /maui-windows/i,
-  /to\s+install\s+the\s+.*workload/i
-];
-var MISSING_XCODE_SIGNATURES = [
-  /valid\s+Xcode\s+installation\s+was\s+not\s+found/i,
-  /could\s+not\s+find\s+a\s+valid\s+Xcode\s+app\s+bundle/i,
-  /macios-missing-xcode/i
-];
-var OUTDATED_XCODE_SIGNATURES = [
-  /error\s+MT0180/i,
-  /requires\s+the\s+MacCatalyst\s+\S+\s+SDK\s+\(shipped\s+with\s+Xcode/i
-];
-var looksLikeMissingWorkload = (output) => matchesAny(output, MISSING_WORKLOAD_SIGNATURES);
-var looksLikeMissingXcode = (output) => matchesAny(output, MISSING_XCODE_SIGNATURES);
-var looksLikeXcodeTooOld = (output) => matchesAny(output, OUTDATED_XCODE_SIGNATURES);
-var checkDotnetSdk = () => {
-  const name = ".NET SDK";
-  const res = run(DOTNET, ["--list-sdks"]);
-  if (!res.found) {
-    return {
-      name,
-      status: "missing",
-      detail: "`dotnet` was not found on your PATH",
-      fix: INSTALL_NET_10_FIX
-    };
+var certificateNotAfter = (identity) => {
+  const pem = spawnSync("security", ["find-certificate", "-c", identity, "-p"], {
+    encoding: "utf8"
+  });
+  if (pem.status !== 0 || !pem.stdout) return null;
+  const parsed = spawnSync("openssl", ["x509", "-noout", "-enddate"], {
+    input: pem.stdout,
+    encoding: "utf8"
+  });
+  const raw = parsed.stdout?.match(/notAfter=(.+)/)?.[1]?.trim();
+  if (!raw) return null;
+  const date = new Date(raw);
+  return Number.isNaN(date.getTime()) ? null : date;
+};
+var hasDeveloperIdIdentity = () => {
+  const all = listCodeSigningIdentities();
+  const expired = new Set(listExpiredCodeSigningIdentities(all));
+  return all.some((id) => id.startsWith(DEVELOPER_ID_PREFIX) && !expired.has(id));
+};
+var warnAboutExpiredIdentities = (expired, options) => {
+  for (const identity of expired) {
+    options.warn(
+      row({
+        glyph: "manual",
+        label: "codesign",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(`skipping expired certificate: ${identity}`)
+      })
+    );
   }
-  if (!res.ok && !res.stdout) {
-    return { name, status: "unknown", detail: "could not run `dotnet --list-sdks`" };
+};
+var warnAboutDistributionIdentity = (identity, options) => {
+  if (identity === null) {
+    options.warn(
+      row({
+        glyph: "manual",
+        label: "codesign",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(
+          "no signing identity \u2014 the app will be ad-hoc signed and Gatekeeper will block it on other Macs"
+        )
+      })
+    );
+    return;
   }
-  if (hasNet10Sdk(res.stdout)) {
-    const newest = newestNet10Sdk(res.stdout);
-    return { name, status: "ok", detail: newest ? `found ${newest}` : "found 10.x" };
+  if (!identity.startsWith(DEVELOPER_ID_PREFIX) && !process.env.VIDRA_MACOS_CODESIGN_KEY) {
+    options.warn(
+      row({
+        glyph: "manual",
+        label: "codesign",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(
+          `using ${identity} \u2014 development certificates cannot be notarized; a "Developer ID Application" certificate is required to distribute`
+        )
+      })
+    );
   }
-  return {
-    name,
-    status: "missing",
-    detail: "no 10.x SDK installed",
-    fix: INSTALL_NET_10_FIX
+};
+var runCodesign = (target, identity, opts, options) => {
+  const args = ["--force", "--timestamp", "--sign", identity];
+  if (opts.hardened) args.push("--options", "runtime");
+  if (opts.entitlements) args.push("--entitlements", opts.entitlements);
+  args.push(target);
+  execFileSync2("codesign", args, {
+    stdio: options.verbose ? "inherit" : "pipe"
+  });
+};
+var findNestedMachOPayloads = (appBundle) => {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs4.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path4.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name.endsWith(".framework")) {
+          found.push(full);
+          continue;
+        }
+        walk(full);
+      } else if (entry.isFile() && /\.(dylib|so)$/.test(entry.name)) {
+        found.push(full);
+      }
+    }
   };
+  walk(appBundle);
+  return found.sort((a, b) => b.split(path4.sep).length - a.split(path4.sep).length);
 };
-var checkMauiWorkload = (workloadList) => {
-  const name = ".NET MAUI workload";
-  if (!workloadList) {
-    return { name, status: "unknown", detail: "requires the .NET SDK first" };
+var formatExecError = (error) => {
+  const err = error;
+  const stderr = Buffer.isBuffer(err.stderr) ? err.stderr.toString() : err.stderr;
+  if (stderr) return stderr;
+  const stdout = Buffer.isBuffer(err.stdout) ? err.stdout.toString() : err.stdout;
+  if (stdout) return stdout;
+  return err.message ?? String(error);
+};
+
+// src/windows-signing.ts
+import path5 from "path";
+import fs5 from "fs-extra";
+import { execFileSync as execFileSync3 } from "child_process";
+var DEFAULT_TIMESTAMP_URL = "http://timestamp.digicert.com";
+var resolveWindowsSigningConfig = () => {
+  const thumbprint = process.env.VIDRA_WINDOWS_CERT_THUMBPRINT?.trim();
+  if (thumbprint) return { mode: "thumbprint", thumbprint };
+  const pfxPath = process.env.VIDRA_WINDOWS_CERT_PATH?.trim();
+  if (pfxPath) {
+    const password = process.env.VIDRA_WINDOWS_CERT_PASSWORD?.trim() ?? null;
+    return { mode: "pfx", pfxPath, password };
   }
-  if (!workloadList.found) {
-    return { name, status: "unknown", detail: "could not query workloads" };
+  return null;
+};
+var timestampUrl = () => process.env.VIDRA_WINDOWS_TIMESTAMP_URL?.trim() || DEFAULT_TIMESTAMP_URL;
+var buildSignToolArgs = (config, targets) => {
+  const args = ["sign", "/fd", "SHA256", "/tr", timestampUrl(), "/td", "SHA256"];
+  if (config.mode === "pfx") {
+    args.push("/f", config.pfxPath);
+    if (config.password) args.push("/p", config.password);
+  } else {
+    args.push("/sha1", config.thumbprint);
   }
-  if (outputMentionsMaui(workloadList.stdout)) {
-    return { name, status: "ok", detail: "installed" };
+  return [...args, ...targets];
+};
+var signWindowsBinariesIfPossible = (targets, options) => {
+  if (process.platform !== "win32") return false;
+  if (targets.length === 0) return false;
+  const config = resolveWindowsSigningConfig();
+  if (!config) {
+    options.log(
+      row({
+        glyph: "skip",
+        label: "authenticode",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(
+          "no certificate configured \u2014 shipping unsigned (SmartScreen will warn)"
+        )
+      })
+    );
+    return false;
+  }
+  const signtool = resolveSignTool();
+  if (!signtool) {
+    options.warn(
+      row({
+        glyph: "manual",
+        label: "authenticode",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("signtool.exe not found \u2014 install the Windows SDK")
+      })
+    );
+    return false;
+  }
+  try {
+    execFileSync3(signtool, buildSignToolArgs(config, targets), {
+      stdio: options.verbose ? "inherit" : "pipe"
+    });
+    options.log(
+      row({
+        glyph: "done",
+        label: "authenticode",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: `${value(`${targets.length} file(s)`)} ${dim(`timestamped via ${timestampUrl()}`)}`
+      })
+    );
+    return true;
+  } catch (error) {
+    options.warn(
+      row({
+        glyph: "manual",
+        label: "authenticode",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("signing failed; shipping unsigned")
+      })
+    );
+    options.warn(dim(formatExecError(error)));
+    return false;
   }
-  return {
-    name,
-    status: "missing",
-    detail: "not installed",
-    fix: "dotnet workload install maui"
-  };
 };
-var checkCSharpHotReload = (workloadList) => {
-  const name = "C# hot reload";
-  if (!workloadList) {
-    return { name, status: "unknown", detail: "requires the .NET SDK first" };
+var verifyWindowsSignature = (target) => {
+  const signtool = resolveSignTool();
+  if (!signtool) {
+    return { ok: false, untrustedRoot: false, output: "signtool.exe not found" };
   }
-  if (process.platform !== "darwin") {
-    return { name, status: "ok", detail: "dotnet watch supported" };
+  try {
+    const output = execFileSync3(signtool, ["verify", "/pa", "/v", target], {
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8"
+    });
+    return { ok: true, untrustedRoot: false, output: output ?? "" };
+  } catch (error) {
+    const output = formatExecError(error);
+    const flat = output.replace(/\s+/g, " ");
+    const untrustedRoot = /0x800B0109/i.test(flat) || /terminated in a root certificate which is not trusted/i.test(flat);
+    return { ok: untrustedRoot, untrustedRoot, output };
   }
-  const sdkVersion = run(DOTNET, ["--version"]).stdout.trim();
-  if (sdkVersion && !sdkSupportsCSharpHotReload(sdkVersion)) {
-    return {
-      name,
-      status: "unknown",
-      detail: `SDK ${sdkVersion} \u2014 its dotnet-watch crashes Mac Catalyst apps on launch (needs 10.0.300+) \u2014 vidra dev falls back to a classic launch`,
-      fix: INSTALL_NET_10_FIX
-    };
+};
+var resolveSignTool = () => {
+  const override = process.env.VIDRA_SIGNTOOL_PATH?.trim();
+  if (override) return fs5.existsSync(override) ? override : null;
+  try {
+    execFileSync3("signtool", ["/?"], { stdio: "ignore" });
+    return "signtool";
+  } catch {
   }
-  const version = workloadSetVersion(workloadList.stdout);
-  if (!version) {
-    return {
-      name,
-      status: "unknown",
-      detail: "could not read the workload set version"
-    };
+  const roots = [
+    process.env["ProgramFiles(x86)"],
+    process.env.ProgramFiles
+  ].filter((r) => !!r);
+  for (const root of roots) {
+    const binDir = path5.join(root, "Windows Kits", "10", "bin");
+    if (!fs5.existsSync(binDir)) continue;
+    const versions = fs5.readdirSync(binDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort().reverse();
+    for (const version of versions) {
+      for (const arch of ["x64", "x86"]) {
+        const candidate = path5.join(binDir, version, arch, "signtool.exe");
+        if (fs5.existsSync(candidate)) return candidate;
+      }
+    }
   }
-  if (workloadSetSupportsCSharpHotReload(version)) {
-    return { name, status: "ok", detail: `workload set ${version}` };
+  return null;
+};
+var findPrimaryExecutable = (publishDir, projectName) => {
+  if (!fs5.existsSync(publishDir)) return null;
+  const exes = fs5.readdirSync(publishDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe")).map((e) => e.name);
+  const preferred = exes.find((n) => n.toLowerCase() === `${projectName}.host.exe`.toLowerCase()) ?? exes.find((n) => n.toLowerCase().startsWith(projectName.toLowerCase()));
+  const chosen = preferred ?? exes[0];
+  return chosen ? path5.join(publishDir, chosen) : null;
+};
+
+// src/native-update.ts
+var RELEASE_DIR = path6.join("dist", "release");
+var entitlementsCopyName = (packId) => `${packId}.entitlements`;
+var NativeUpdateConfigError = class extends Error {
+};
+var resolveNativeUpdateSettings = (opts) => {
+  const config = opts.config ?? {};
+  if (config.enabled === false) {
+    throw new NativeUpdateConfigError(
+      "vidra.updates.native.enabled is false: remove --native-update, or set it to true"
+    );
+  }
+  const packId = config.packId ?? readApplicationId(opts.csprojPath) ?? opts.projectName;
+  const packTitle = readApplicationTitle(opts.csprojPath) ?? opts.projectName;
+  if (!config.feedUrl) {
+    return { packId, packTitle, packVersion: opts.version, feedUrl: null, channel: config.channel ?? null };
   }
   return {
-    name,
-    status: "unknown",
-    detail: `workload set ${version} predates Mac Catalyst dotnet-watch support (needs 10.0.203+) \u2014 vidra dev falls back to a classic launch`,
-    fix: "dotnet workload update"
+    packId,
+    packTitle,
+    packVersion: opts.version,
+    feedUrl: config.feedUrl,
+    channel: config.channel ?? null
   };
 };
-var checkXcode = () => {
-  const name = "Xcode";
-  const res = run("xcode-select", ["-p"]);
-  if (!res.found || !res.ok) {
-    return {
-      name,
-      status: "missing",
-      detail: "not found",
-      fix: "Install Xcode from the App Store"
-    };
+var readApplicationId = (csprojPath) => readCsprojProperty(csprojPath, "ApplicationId");
+var readApplicationTitle = (csprojPath) => readCsprojProperty(csprojPath, "ApplicationTitle");
+var readCsprojProperty = (csprojPath, name) => {
+  if (!fs6.existsSync(csprojPath)) return null;
+  const xml = fs6.readFileSync(csprojPath, "utf-8");
+  return new RegExp(`<${name}>([^<]+)</${name}>`).exec(xml)?.[1]?.trim() || null;
+};
+var windowsSignParams = () => {
+  const config = resolveWindowsSigningConfig();
+  if (!config) return null;
+  const parts = ["/fd", "SHA256", "/tr", timestampUrl(), "/td", "SHA256"];
+  if (config.mode === "pfx") {
+    parts.push("/f", config.pfxPath);
+    if (config.password) parts.push("/p", config.password);
+  } else {
+    parts.push("/sha1", config.thumbprint);
   }
-  const devDir = res.stdout.trim();
-  if (COMMAND_LINE_TOOLS_PATH.test(devDir)) {
-    return {
-      name,
-      status: "missing",
-      detail: "only Command Line Tools detected (Mac Catalyst needs full Xcode)",
-      fix: "Install Xcode, then: sudo xcode-select -s /Applications/Xcode.app"
-    };
+  return parts.join(" ");
+};
+var NativeUpdateError = class extends Error {
+  constructor(message, detail = "") {
+    super(message);
+    this.detail = detail;
   }
-  return { name, status: "ok", detail: devDir };
+  detail;
 };
-var isMauiWorkloadInstalled = () => outputMentionsMaui(run(DOTNET, ["workload", "list"]).stdout);
-var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
-var collectRequirements = (opts = {}) => {
-  const dotnet = checkDotnetSdk();
-  const workloadList = dotnet.status === "ok" ? run(DOTNET, ["workload", "list"]) : null;
-  const reqs = [
-    dotnet,
-    checkMauiWorkload(workloadList),
-    checkCSharpHotReload(workloadList)
-  ];
-  if (opts.includeXcode ?? process.platform === "darwin") {
-    reqs.push(checkXcode());
+var runNativeUpdate = (opts) => {
+  const vpk = resolveVpk();
+  if (!vpk) {
+    throw new NativeUpdateError(
+      "vpk is not installed",
+      "dotnet tool install -g vpk"
+    );
   }
-  return reqs;
+  const releaseDir = path6.join(opts.projectRoot, RELEASE_DIR);
+  fs6.ensureDirSync(releaseDir);
+  const merged = mergeFromLiveFeed(vpk, opts.settings, releaseDir, opts.io);
+  const mainExe = opts.target === "macos" ? findMacMainExe(opts.packDir) : findWindowsMainExe(opts.packDir);
+  if (!mainExe) {
+    throw new NativeUpdateError(
+      `could not find the app executable inside ${opts.packDir}`
+    );
+  }
+  const args = packArgs({
+    packId: opts.settings.packId,
+    packVersion: opts.settings.packVersion,
+    packTitle: opts.settings.packTitle,
+    packDir: opts.packDir,
+    mainExe,
+    outputDir: releaseDir,
+    channel: opts.settings.channel,
+    ...opts.target === "macos" ? {
+      // Velopack has to own signing: it adds files to a sealed bundle
+      // *after* the build signed it, which breaks the seal. Handing it the
+      // same identity and entitlements puts the packed bundle back on the
+      // baseline's row: Developer ID authority, hardened runtime, all
+      // three JIT entitlements, strict and deep verification passing.
+      signAppIdentity: resolveMacCodeSigningIdentity("distribution"),
+      signEntitlements: opts.entitlements ? copyEntitlementsForVpk(opts.entitlements, opts.settings.packId) : null,
+      keychain: process.env.VIDRA_MACOS_KEYCHAIN?.trim() || null
+    } : { signParams: windowsSignParams() }
+  });
+  const result = runVpk(vpk, args, { cwd: opts.projectRoot, verbose: opts.io.verbose });
+  if (!result.ok) {
+    if (result.alreadyReleased) {
+      throw new NativeUpdateError(
+        `${opts.settings.packVersion} is already in the feed, nothing was written`,
+        "bump the version in package.json (npm version patch), or drop --native-update to rebuild the installer only"
+      );
+    }
+    throw new NativeUpdateError("vpk pack failed", result.output);
+  }
+  return { releaseDir, outputs: findVpkOutputs(releaseDir), merged };
 };
-var STATUS_GLYPH = {
-  ok: "done",
-  missing: "error",
-  unknown: "manual"
+var mergeFromLiveFeed = (vpk, settings, releaseDir, io) => {
+  if (!settings.feedUrl) return "no-feed";
+  const result = runVpk(
+    vpk,
+    downloadArgs({
+      feedUrl: settings.feedUrl,
+      outputDir: releaseDir,
+      channel: settings.channel
+    }),
+    { verbose: io.verbose }
+  );
+  if (result.ok) return "merged";
+  io.warn(lastLines(result.output, 4));
+  return "empty-feed";
+};
+var copyEntitlementsForVpk = (entitlements, packId) => {
+  const dir = fs6.mkdtempSync(path6.join(os2.tmpdir(), "vidra-vpk-"));
+  const target = path6.join(dir, entitlementsCopyName(packId));
+  fs6.copySync(entitlements, target);
+  return target;
+};
+var findWindowsMainExe = (publishDir) => {
+  const entries = fs6.readdirSync(publishDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe")).map((e) => e.name);
+  return entries.find((e) => e.endsWith(".Host.exe")) ?? entries.find((e) => e !== "createdump.exe") ?? null;
+};
+var extractPackedApp = (portableZip) => {
+  const staging = fs6.mkdtempSync(path6.join(os2.tmpdir(), "vidra-packed-"));
+  execFileSync4("ditto", ["-x", "-k", portableZip, staging], { stdio: "pipe" });
+  const found = findAppBundle(staging);
+  if (!found) {
+    throw new NativeUpdateError(`no .app inside ${path6.basename(portableZip)}`);
+  }
+  return found;
+};
+var findAppBundle = (root, depth = 0) => {
+  if (depth > 2 || !fs6.existsSync(root)) return null;
+  for (const entry of fs6.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const full = path6.join(root, entry.name);
+    if (entry.name.endsWith(".app")) return full;
+    const nested = findAppBundle(full, depth + 1);
+    if (nested) return nested;
+  }
+  return null;
+};
+var lastLines = (text, count) => text.trim().split(/\r?\n/).slice(-count).join("\n");
+
+// src/project.ts
+import path7 from "path";
+import fs7 from "fs-extra";
+var detectPlatform = () => {
+  switch (process.platform) {
+    case "darwin":
+      return "macos";
+    case "win32":
+      return "windows";
+    case "linux":
+      return "linux";
+    default:
+      return "macos";
+  }
+};
+var detectProject = (cwd) => {
+  const project = tryDetectProject(cwd);
+  if (project) return project;
+  console.error(
+    row({
+      glyph: "error",
+      detail: dim(
+        "Could not detect Vidra project. Run this command from your project root."
+      )
+    })
+  );
+  console.error(
+    footer(dim("expected: package.json, ui/, src/<Name>.Host/<Name>.Host.csproj"))
+  );
+  process.exit(1);
+};
+var tryDetectProject = (cwd) => {
+  let dir = cwd;
+  while (true) {
+    const uiDir = path7.join(dir, "ui");
+    const srcDir = path7.join(dir, "src");
+    const pkgJson = path7.join(dir, "package.json");
+    if (fs7.existsSync(pkgJson) && fs7.existsSync(uiDir) && fs7.existsSync(srcDir)) {
+      const csproj = findHostCsproj(srcDir);
+      if (csproj) {
+        const projectName = path7.basename(csproj.dir).replace(/\.Host$/, "");
+        const displayVersion = resolveAppVersionOrDefault(dir, csproj.path);
+        return {
+          root: dir,
+          hostDir: csproj.dir,
+          csprojPath: csproj.path,
+          projectName,
+          displayVersion,
+          uiDir
+        };
+      }
+    }
+    const parent = path7.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+};
+var findHostCsproj = (srcDir) => {
+  if (!fs7.existsSync(srcDir)) return null;
+  for (const entry of fs7.readdirSync(srcDir, { withFileTypes: true })) {
+    if (entry.isDirectory() && entry.name.endsWith(".Host")) {
+      const csprojPath = path7.join(
+        srcDir,
+        entry.name,
+        `${entry.name}.csproj`
+      );
+      if (fs7.existsSync(csprojPath)) {
+        return { dir: path7.join(srcDir, entry.name), path: csprojPath };
+      }
+    }
+  }
+  return null;
+};
+
+// src/targets/macos.ts
+import path8 from "path";
+import fs8 from "fs-extra";
+import { execSync as execSync2 } from "child_process";
+import os3 from "os";
+var macosTarget = {
+  name: "macos",
+  framework: "net10.0-maccatalyst",
+  extraPublishArgs: "-p:CreatePackage=false",
+  findBundle(publishDir, _projectName) {
+    if (!fs8.existsSync(publishDir)) return null;
+    for (const entry of fs8.readdirSync(publishDir, { withFileTypes: true })) {
+      if (entry.name.endsWith(".app") && entry.isDirectory()) {
+        return path8.join(publishDir, entry.name);
+      }
+    }
+    return null;
+  },
+  async package(appPath, outputDir, meta) {
+    const dmgName = `${meta.projectName}-${meta.displayVersion}-macos.dmg`;
+    const dmgPath = path8.join(outputDir, dmgName);
+    const volName = meta.projectName;
+    const staging = fs8.mkdtempSync(path8.join(os3.tmpdir(), "vidra-dmg-"));
+    try {
+      fs8.copySync(appPath, path8.join(staging, path8.basename(appPath)));
+      fs8.symlinkSync("/Applications", path8.join(staging, "Applications"));
+      if (fs8.existsSync(dmgPath)) {
+        fs8.removeSync(dmgPath);
+      }
+      execSync2(
+        `hdiutil create -volname "${volName}" -srcfolder "${staging}" -ov -format UDZO "${dmgPath}"`,
+        { stdio: "pipe" }
+      );
+    } finally {
+      fs8.removeSync(staging);
+    }
+    return dmgPath;
+  }
+};
+
+// src/notarize.ts
+import path9 from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+var resolveNotaryCredentials = () => {
+  const profile = process.env.VIDRA_NOTARY_PROFILE?.trim();
+  if (profile) return { mode: "profile", profile };
+  const appleId = process.env.VIDRA_APPLE_ID?.trim();
+  const teamId = process.env.VIDRA_TEAM_ID?.trim();
+  const password = process.env.VIDRA_APP_PASSWORD?.trim();
+  if (appleId && teamId && password) {
+    return { mode: "apple-id", appleId, teamId, password };
+  }
+  return null;
+};
+var notaryCredentialArgs = (creds) => creds.mode === "profile" ? ["--keychain-profile", creds.profile] : [
+  "--apple-id",
+  creds.appleId,
+  "--team-id",
+  creds.teamId,
+  "--password",
+  creds.password
+];
+var notarizeAndStaple = (artifactPath, options) => {
+  if (process.platform !== "darwin") {
+    return { status: "skipped", reason: "not macOS" };
+  }
+  const creds = resolveNotaryCredentials();
+  if (!creds) {
+    return {
+      status: "skipped",
+      reason: "no notary credentials (set VIDRA_NOTARY_PROFILE, or VIDRA_APPLE_ID + VIDRA_TEAM_ID + VIDRA_APP_PASSWORD)"
+    };
+  }
+  const label = path9.basename(artifactPath);
+  let submitOutput;
+  try {
+    submitOutput = execFileSync5(
+      "xcrun",
+      ["notarytool", "submit", artifactPath, ...notaryCredentialArgs(creds), "--wait"],
+      { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
+    );
+  } catch (error) {
+    const output = formatExecError(error);
+    reportNotaryFailure(output, creds, options);
+    return { status: "failed", reason: output };
+  }
+  if (options.verbose) options.log(dim(submitOutput.trim()));
+  if (!/status:\s*Accepted/i.test(submitOutput)) {
+    reportNotaryFailure(submitOutput, creds, options);
+    return { status: "failed", reason: "notary service did not accept the submission" };
+  }
+  try {
+    execFileSync5("xcrun", ["stapler", "staple", artifactPath], {
+      stdio: options.verbose ? "inherit" : "pipe"
+    });
+  } catch (error) {
+    const output = formatExecError(error);
+    options.warn(
+      row({
+        glyph: "error",
+        label: "staple",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("notarized, but the ticket could not be stapled")
+      })
+    );
+    options.warn(dim(output));
+    return { status: "failed", reason: output };
+  }
+  options.log(
+    row({
+      glyph: "done",
+      label: "notarize",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(label)} ${dim("accepted \xB7 ticket stapled")}`
+    })
+  );
+  return { status: "ok" };
+};
+var reportNotaryFailure = (output, creds, options) => {
+  options.warn(
+    row({
+      glyph: "error",
+      label: "notarize",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: dim("the notary service rejected this build")
+    })
+  );
+  options.warn(dim(output.trim()));
+  const submissionId = parseSubmissionId(output);
+  if (!submissionId) return;
+  try {
+    const log = execFileSync5(
+      "xcrun",
+      ["notarytool", "log", submissionId, ...notaryCredentialArgs(creds)],
+      { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
+    );
+    options.warn(footer(dim("notary log:")));
+    options.warn(dim(log.trim()));
+  } catch {
+    options.warn(
+      footer(
+        dim(`fetch the details with: xcrun notarytool log ${submissionId} ...`)
+      )
+    );
+  }
+};
+var parseSubmissionId = (output) => output.match(/\bid:\s*([0-9a-f-]{36})/i)?.[1] ?? null;
+
+// src/targets/windows.ts
+import path10 from "path";
+import os4 from "os";
+import fs9 from "fs-extra";
+import { execFileSync as execFileSync6 } from "child_process";
+var windowsTarget = {
+  name: "windows",
+  framework: "net10.0-windows10.0.19041.0",
+  // `RuntimeIdentifierOverride` (rather than `-r`/`RuntimeIdentifier`) is the
+  // MAUI-recommended way to set the Windows RID — it sidesteps WindowsAppSDK
+  // issue #3337, which otherwise pulls in the wrong packaging assets.
+  extraPublishArgs: "-p:WindowsPackageType=None -p:SelfContained=true -p:WindowsAppSDKSelfContained=true -p:RuntimeIdentifierOverride=win-x64",
+  findBundle(publishDir, _projectName) {
+    const preferred = path10.join(publishDir, "win-x64", "publish");
+    if (dirContainsExe(preferred)) return preferred;
+    return findDirWithExe(publishDir);
+  },
+  async package(publishOutputDir, outputDir, meta) {
+    const outName = `${meta.projectName}-${meta.displayVersion}-windows.zip`;
+    const outPath = path10.join(outputDir, outName);
+    if (fs9.existsSync(outPath)) fs9.removeSync(outPath);
+    const staging = fs9.mkdtempSync(path10.join(os4.tmpdir(), "vidra-zip-"));
+    const stagedApp = path10.join(staging, meta.projectName);
+    try {
+      fs9.copySync(publishOutputDir, stagedApp);
+      execFileSync6(
+        "powershell",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Compress-Archive -Path "${stagedApp}" -DestinationPath "${outPath}" -Force`
+        ],
+        { stdio: "pipe" }
+      );
+    } finally {
+      fs9.removeSync(staging);
+    }
+    return outPath;
+  }
+};
+var dirContainsExe = (dir) => fs9.existsSync(dir) && fs9.readdirSync(dir, { withFileTypes: true }).some((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe"));
+var findDirWithExe = (root) => {
+  if (!fs9.existsSync(root)) return null;
+  let fallback = null;
+  const walk = (dir) => {
+    if (dirContainsExe(dir)) {
+      if (path10.basename(dir) === "publish") return dir;
+      fallback ??= dir;
+    }
+    for (const e of fs9.readdirSync(dir, { withFileTypes: true })) {
+      if (e.isDirectory()) {
+        const found = walk(path10.join(dir, e.name));
+        if (found) return found;
+      }
+    }
+    return null;
+  };
+  return walk(root) ?? fallback;
+};
+
+// src/doctor.ts
+import { execFileSync as execFileSync7 } from "child_process";
+import fs10 from "fs";
+import path11 from "path";
+import prompts from "prompts";
+var DOTNET = process.platform === "win32" ? "dotnet.exe" : "dotnet";
+var MAUI_DOCS = "https://learn.microsoft.com/dotnet/maui/get-started/installation";
+var INSTALL_NET_10_FIX = "Install the .NET 10 SDK \u2014 https://dotnet.microsoft.com/download";
+var bufToStr = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
+var run = (cmd, args) => {
+  try {
+    const stdout = execFileSync7(cmd, args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { found: true, ok: true, stdout: stdout ?? "", stderr: "" };
+  } catch (e) {
+    const err = e;
+    return {
+      found: err.code !== "ENOENT",
+      ok: false,
+      stdout: bufToStr(err.stdout),
+      stderr: bufToStr(err.stderr)
+    };
+  }
+};
+var splitLines = (text) => text.split(/\r?\n/);
+var matchesAny = (text, patterns) => patterns.some((pattern) => pattern.test(text));
+var NET_10_VERSION = /^10\./;
+var MAUI_WORKLOAD = /\bmaui\b/i;
+var COMMAND_LINE_TOOLS_PATH = /CommandLineTools/i;
+var hasNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).some((line) => NET_10_VERSION.test(line.trim()));
+var newestNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).map((line) => line.trim().split(/\s+/)[0]).filter((version) => NET_10_VERSION.test(version)).sort(
+  (a, b) => a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" })
+).pop();
+var outputMentionsMaui = (workloadListOutput) => MAUI_WORKLOAD.test(workloadListOutput);
+var MISSING_WORKLOAD_SIGNATURES = [
+  /NETSDK1147/i,
+  /workloads?\s+must\s+be\s+installed/i,
+  /maui-maccatalyst/i,
+  /maui-windows/i,
+  /to\s+install\s+the\s+.*workload/i
+];
+var MISSING_XCODE_SIGNATURES = [
+  /valid\s+Xcode\s+installation\s+was\s+not\s+found/i,
+  /could\s+not\s+find\s+a\s+valid\s+Xcode\s+app\s+bundle/i,
+  /macios-missing-xcode/i
+];
+var OUTDATED_XCODE_SIGNATURES = [
+  /error\s+MT0180/i,
+  /requires\s+the\s+MacCatalyst\s+\S+\s+SDK\s+\(shipped\s+with\s+Xcode/i
+];
+var looksLikeMissingWorkload = (output) => matchesAny(output, MISSING_WORKLOAD_SIGNATURES);
+var looksLikeMissingXcode = (output) => matchesAny(output, MISSING_XCODE_SIGNATURES);
+var looksLikeXcodeTooOld = (output) => matchesAny(output, OUTDATED_XCODE_SIGNATURES);
+var checkDotnetSdk = () => {
+  const name = ".NET SDK";
+  const res = run(DOTNET, ["--list-sdks"]);
+  if (!res.found) {
+    return {
+      name,
+      status: "missing",
+      detail: "`dotnet` was not found on your PATH",
+      fix: INSTALL_NET_10_FIX
+    };
+  }
+  if (!res.ok && !res.stdout) {
+    return { name, status: "unknown", detail: "could not run `dotnet --list-sdks`" };
+  }
+  if (hasNet10Sdk(res.stdout)) {
+    const newest = newestNet10Sdk(res.stdout);
+    return { name, status: "ok", detail: newest ? `found ${newest}` : "found 10.x" };
+  }
+  return {
+    name,
+    status: "missing",
+    detail: "no 10.x SDK installed",
+    fix: INSTALL_NET_10_FIX
+  };
+};
+var checkMauiWorkload = (workloadList) => {
+  const name = ".NET MAUI workload";
+  if (!workloadList) {
+    return { name, status: "unknown", detail: "requires the .NET SDK first" };
+  }
+  if (!workloadList.found) {
+    return { name, status: "unknown", detail: "could not query workloads" };
+  }
+  if (outputMentionsMaui(workloadList.stdout)) {
+    return { name, status: "ok", detail: "installed" };
+  }
+  return {
+    name,
+    status: "missing",
+    detail: "not installed",
+    fix: "dotnet workload install maui"
+  };
+};
+var FIRST_FIXED_MACCATALYST_PACK = [26, 2, 10233];
+var MACCATALYST_PACK_DIR = /^Microsoft\.MacCatalyst\.Sdk\.net\d+\.\d+_\d+\.\d+$/;
+var compareVersions = (a, b) => {
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const diff = (a[i] ?? 0) - (b[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+};
+var versionSegments = (version) => {
+  const segments = version.split(".").map((s) => Number.parseInt(s, 10));
+  return segments.length && !segments.some(Number.isNaN) ? segments : null;
+};
+var newestPackVersion = (versions) => {
+  let best;
+  for (const raw of versions) {
+    const segments = versionSegments(raw);
+    if (!segments) continue;
+    if (!best || compareVersions(segments, best.segments) > 0) {
+      best = { raw, segments };
+    }
+  }
+  return best?.raw;
+};
+var macCatalystPackIsStale = (version) => {
+  const segments = versionSegments(version);
+  return segments ? compareVersions(segments, FIRST_FIXED_MACCATALYST_PACK) < 0 : false;
+};
+var dotnetPacksDir = () => {
+  if (process.env.DOTNET_ROOT) {
+    return path11.join(process.env.DOTNET_ROOT, "packs");
+  }
+  const res = run(DOTNET, ["--list-sdks"]);
+  if (!res.found) return void 0;
+  const sdkDir = res.stdout.trim().split("\n").pop()?.match(/\[(.+)\]\s*$/)?.[1];
+  return sdkDir ? path11.join(path11.dirname(sdkDir), "packs") : void 0;
+};
+var installedMacCatalystPackVersion = () => {
+  const packs = dotnetPacksDir();
+  if (!packs) return void 0;
+  try {
+    const versions = fs10.readdirSync(packs, { withFileTypes: true }).filter((e) => e.isDirectory() && MACCATALYST_PACK_DIR.test(e.name)).flatMap((e) => {
+      try {
+        return fs10.readdirSync(path11.join(packs, e.name), { withFileTypes: true }).filter((v) => v.isDirectory()).map((v) => v.name);
+      } catch {
+        return [];
+      }
+    });
+    return newestPackVersion(versions);
+  } catch {
+    return void 0;
+  }
+};
+var checkCSharpDevLoop = (workloadList) => {
+  const name = "C# dev loop";
+  if (!workloadList) {
+    return { name, status: "unknown", detail: "requires the .NET SDK first" };
+  }
+  if (process.platform !== "darwin") {
+    return {
+      name,
+      status: "ok",
+      detail: "dotnet watch applies C# edits to the running app"
+    };
+  }
+  const pack = installedMacCatalystPackVersion();
+  if (pack && macCatalystPackIsStale(pack)) {
+    return {
+      name,
+      status: "unknown",
+      detail: `Mac Catalyst pack ${pack} cannot launch the app under dotnet watch \u2014 vidra dev falls back to a classic launch (fixed in 26.2.10233+)`,
+      fix: "dotnet workload update"
+    };
+  }
+  const packNote = pack ? ` (Mac Catalyst pack ${pack})` : "";
+  return {
+    name,
+    status: "ok",
+    detail: `dotnet watch applies C# edits to the running app${packNote} \u2014 vidra dev rebuilds and relaunches if the agent drops mid-session`
+  };
+};
+var checkXcode = () => {
+  const name = "Xcode";
+  const res = run("xcode-select", ["-p"]);
+  if (!res.found || !res.ok) {
+    return {
+      name,
+      status: "missing",
+      detail: "not found",
+      fix: "Install Xcode from the App Store"
+    };
+  }
+  const devDir = res.stdout.trim();
+  if (COMMAND_LINE_TOOLS_PATH.test(devDir)) {
+    return {
+      name,
+      status: "missing",
+      detail: "only Command Line Tools detected (Mac Catalyst needs full Xcode)",
+      fix: "Install Xcode, then: sudo xcode-select -s /Applications/Xcode.app"
+    };
+  }
+  return { name, status: "ok", detail: devDir };
+};
+var isMauiWorkloadInstalled = () => outputMentionsMaui(run(DOTNET, ["workload", "list"]).stdout);
+var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+var checkMacSigningIdentity = () => {
+  const all = listCodeSigningIdentities();
+  const expired = new Set(listExpiredCodeSigningIdentities(all));
+  const identities = all.filter((id) => !expired.has(id));
+  if (identities.some((id) => id.startsWith("Developer ID Application:"))) {
+    return {
+      name: "macOS signing (distribution)",
+      status: "ok",
+      detail: "Developer ID Application certificate found"
+    };
+  }
+  const expiredDeveloperId = [...expired].find(
+    (id) => id.startsWith("Developer ID Application:")
+  );
+  if (expiredDeveloperId) {
+    return {
+      name: "macOS signing (distribution)",
+      status: "unknown",
+      detail: `Developer ID certificate expired \u2014 ${expiredDeveloperId}`,
+      fix: "Renew it in the Apple Developer portal, then re-download and install it"
+    };
+  }
+  if (identities.some((id) => id.startsWith("Apple Development:"))) {
+    return {
+      name: "macOS signing (distribution)",
+      status: "unknown",
+      detail: "only a development certificate found \u2014 fine for `vidra dev`, cannot be notarized",
+      fix: "Create a Developer ID Application certificate (requires the Apple Developer Program)"
+    };
+  }
+  return {
+    name: "macOS signing (distribution)",
+    status: "unknown",
+    detail: "no code-signing identity \u2014 builds will be ad-hoc signed",
+    fix: "Create a Developer ID Application certificate, or set VIDRA_MACOS_CODESIGN_KEY"
+  };
+};
+var checkNotarization = () => {
+  const creds = resolveNotaryCredentials();
+  if (creds) {
+    return {
+      name: "macOS notarization",
+      status: "ok",
+      detail: creds.mode === "profile" ? `keychain profile "${creds.profile}"` : `Apple ID ${creds.appleId} (team ${creds.teamId})`
+    };
+  }
+  return {
+    name: "macOS notarization",
+    status: "unknown",
+    detail: "no credentials \u2014 `vidra build` will skip notarization",
+    fix: "xcrun notarytool store-credentials, then set VIDRA_NOTARY_PROFILE"
+  };
+};
+var checkWindowsSigning = () => {
+  const config = resolveWindowsSigningConfig();
+  if (config) {
+    return {
+      name: "Windows signing",
+      status: "ok",
+      detail: config.mode === "pfx" ? `certificate file ${config.pfxPath}` : `store certificate ${config.thumbprint}`
+    };
+  }
+  return {
+    name: "Windows signing",
+    status: "unknown",
+    detail: "no certificate \u2014 builds ship unsigned and SmartScreen will warn",
+    fix: "Set VIDRA_WINDOWS_CERT_PATH (+ VIDRA_WINDOWS_CERT_PASSWORD) or VIDRA_WINDOWS_CERT_THUMBPRINT"
+  };
+};
+var checkWebView2Runtime = () => {
+  const key = "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}";
+  const result = run("reg", ["query", key, "/v", "pv"]);
+  const version = result.stdout.match(/pv\s+REG_SZ\s+([\d.]+)/)?.[1];
+  if (result.ok && version && version !== "0.0.0.0") {
+    return {
+      name: "WebView2 runtime",
+      status: "ok",
+      detail: `found ${version}`
+    };
+  }
+  return {
+    name: "WebView2 runtime",
+    status: "unknown",
+    detail: "not detected \u2014 Vidra apps need it to render on this machine",
+    fix: "https://developer.microsoft.com/microsoft-edge/webview2/"
+  };
+};
+var checkVelopack = (required) => {
+  const vpk = resolveVpk();
+  if (vpk) {
+    const version = vpkVersion(vpk);
+    return {
+      name: "Velopack (vpk)",
+      status: "ok",
+      detail: version ? `${version} at ${vpk}` : vpk
+    };
+  }
+  return {
+    name: "Velopack (vpk)",
+    status: required ? "missing" : "unknown",
+    detail: required ? "vidra.updates.native is configured but vpk is not installed, so `vidra build --native-update` cannot run" : "not installed, and only needed for `vidra build --native-update`",
+    fix: "dotnet tool install -g vpk"
+  };
+};
+var diagnoseUpdateConfiguration = (input) => {
+  const { config } = input;
+  const mauiProgram = input.mauiProgram === null ? null : stripComments(input.mauiProgram);
+  const usesUpdates = mauiProgram?.includes(".UseVidraUpdates(") ?? false;
+  const usesNative = mauiProgram?.includes(".UseVidraNativeUpdates(") ?? false;
+  const found = [];
+  if (config && !usesUpdates && mauiProgram !== null) {
+    found.push({
+      name: "OTA updates wired up",
+      status: "missing",
+      detail: "package.json configures vidra.updates, but MauiProgram never calls .UseVidraUpdates()",
+      fix: "add .UseVidraUpdates() after .UseVidra() in MauiProgram.cs"
+    });
+  }
+  if (!config && usesUpdates) {
+    found.push({
+      name: "OTA updates configured",
+      status: "missing",
+      detail: ".UseVidraUpdates() is called, but package.json has no vidra.updates block, nothing is ever checked",
+      fix: 'add "vidra": { "updates": { "feedUrl": "https://..." } } to package.json'
+    });
+  }
+  if (input.publishedUnsigned && (config?.publicKeys?.length ?? 0) > 0) {
+    found.push({
+      name: "Feed signature",
+      status: "missing",
+      detail: "publicKeys are configured, so signatures are mandatory, but the published bundles.json has no .sig beside it",
+      fix: "republish with `vidra bundle --sign <key.pem>`"
+    });
+  }
+  if (config?.native) {
+    if (!usesNative && mauiProgram !== null) {
+      found.push({
+        name: "Native updates wired up",
+        status: "missing",
+        detail: "vidra.updates.native is configured, but MauiProgram never calls .UseVidraNativeUpdates()",
+        fix: "add .UseVidraNativeUpdates() after .UseVidra(), and reference Vidra.Updates.Native"
+      });
+    }
+    if (!config.native.feedUrl) {
+      found.push({
+        name: "Native feed",
+        status: "missing",
+        detail: "vidra.updates.native has no feedUrl: releases can be packed, and no installed app will ever find them",
+        fix: 'set "vidra": { "updates": { "native": { "feedUrl": "https://.../" } } }'
+      });
+    }
+  }
+  return found;
+};
+var stripComments = (source) => source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "");
+var inspectUpdateConfiguration = () => {
+  const project = tryDetectProject(process.cwd());
+  if (!project) return [];
+  const config = readUpdateConfig(project.root);
+  const mauiProgram = readIfPresent(path11.join(project.hostDir, "MauiProgram.cs"));
+  const live = mauiProgram === null ? "" : stripComments(mauiProgram);
+  if (!config && !live.includes("Updates(")) {
+    return [];
+  }
+  const bundles = path11.join(project.root, "dist", "bundles.json");
+  const publishedUnsigned = fs10.existsSync(bundles) && !fs10.existsSync(`${bundles}.sig`);
+  return [
+    ...config?.native || resolveVpk() ? [checkVelopack(!!config?.native)] : [],
+    ...diagnoseUpdateConfiguration({ config, mauiProgram, publishedUnsigned })
+  ];
+};
+var readIfPresent = (file) => {
+  try {
+    return fs10.readFileSync(file, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var collectRequirements = (opts = {}) => {
+  const dotnet = checkDotnetSdk();
+  const workloadList = dotnet.status === "ok" ? run(DOTNET, ["workload", "list"]) : null;
+  const reqs = [
+    dotnet,
+    checkMauiWorkload(workloadList),
+    checkCSharpDevLoop(workloadList)
+  ];
+  if (opts.includeXcode ?? process.platform === "darwin") {
+    reqs.push(checkXcode());
+  }
+  if (process.platform === "darwin") {
+    reqs.push(checkMacSigningIdentity(), checkNotarization());
+  }
+  if (process.platform === "win32") {
+    reqs.push(checkWindowsSigning(), checkWebView2Runtime());
+  }
+  const updateIssues = inspectUpdateConfiguration();
+  if (updateIssues.length > 0) {
+    reqs.push(...updateIssues);
+  }
+  return reqs;
+};
+var STATUS_GLYPH = {
+  ok: "done",
+  missing: "error",
+  unknown: "manual"
+};
+var printRequirements = (reqs) => {
+  const labelWidth = Math.max(0, ...reqs.map((r) => r.name.length)) + 2;
+  for (const r of reqs) {
+    console.log(
+      row({
+        glyph: STATUS_GLYPH[r.status],
+        label: r.name,
+        labelWidth,
+        detail: r.detail ? dim(r.detail) : void 0
+      })
+    );
+    if (r.status !== "ok" && r.fix) {
+      console.log(fixLine(r.fix));
+    }
+  }
+};
+var runDoctor = async () => {
+  console.log();
+  console.log(`  ${lime("vidra")} ${value("doctor")}`);
+  console.log();
+  console.log(footer(dim("checking your environment\u2026")));
+  console.log();
+  const reqs = collectRequirements();
+  printRequirements(reqs);
+  console.log();
+  const missing = reqs.filter((r) => r.status === "missing");
+  if (missing.length === 0) {
+    console.log(
+      footer(
+        `${dim("all checks passed \u2014 you're ready to run")} ${lime(
+          "npm run dev"
+        )}${dim(".")}`
+      )
+    );
+    console.log();
+    return 0;
+  }
+  const n = missing.length;
+  console.log(
+    footer(
+      `${dim(
+        `${n} issue${n === 1 ? "" : "s"} found. apply the ${n === 1 ? "fix" : "fixes"} above, then re-run`
+      )} ${lime("npm run doctor")}${dim(".")}`
+    )
+  );
+  console.log();
+  return 1;
+};
+var installWorkload = (csprojPath) => {
+  const args = csprojPath ? ["workload", "restore", csprojPath] : ["workload", "install", "maui"];
+  console.log();
+  console.log(
+    row({
+      glyph: "active",
+      detail: `${dim("running")} ${value(`${DOTNET} ${args.join(" ")}`)}`
+    })
+  );
+  console.log(
+    footer(
+      dim("this can download several hundred MB and take a few minutes.")
+    )
+  );
+  console.log();
+  try {
+    execFileSync7(DOTNET, args, { stdio: "inherit" });
+    return true;
+  } catch {
+    console.error();
+    console.error(row({ glyph: "error", label: "workload install failed" }));
+    console.error(
+      footer(
+        dim(
+          "if this is a permissions error, your SDK is in a system location and needs elevation:"
+        )
+      )
+    );
+    console.error(fixLine("sudo dotnet workload install maui"));
+    console.error();
+    return false;
+  }
+};
+var ensureMauiWorkload = async (opts = {}) => {
+  const dotnet = checkDotnetSdk();
+  if (dotnet.status === "missing") {
+    console.log();
+    console.log(
+      row({
+        glyph: "error",
+        label: dotnet.name,
+        detail: dotnet.detail ? dim(dotnet.detail) : void 0
+      })
+    );
+    if (dotnet.fix) {
+      console.log(fixLine(dotnet.fix));
+    }
+    return false;
+  }
+  if (dotnet.status === "unknown") return true;
+  if (isMauiWorkloadInstalled()) return true;
+  console.log();
+  console.log(
+    row({
+      glyph: "error",
+      label: ".NET MAUI workload",
+      detail: dim("required but not installed")
+    })
+  );
+  const interactive = opts.interactive ?? isInteractive();
+  if (interactive) {
+    let install = false;
+    try {
+      const res = await prompts({
+        type: "confirm",
+        name: "install",
+        message: "Install the .NET MAUI workload now?",
+        initial: true
+      });
+      install = Boolean(res.install);
+    } catch {
+      install = false;
+    }
+    if (install) {
+      if (installWorkload(opts.csprojPath) && isMauiWorkloadInstalled()) {
+        console.log(
+          row({
+            glyph: "done",
+            label: ".NET MAUI workload",
+            detail: dim("installed")
+          })
+        );
+        return true;
+      }
+      return false;
+    }
+  }
+  console.log(fixLine("dotnet workload install maui", "run:"));
+  console.log(fixLine(MAUI_DOCS, "docs:"));
+  return false;
+};
+var printWorkloadHint = () => {
+  console.error();
+  console.error(
+    row({ glyph: "manual", label: "this looks like a missing .NET MAUI workload." })
+  );
+  console.error(fixLine("dotnet workload install maui"));
+  console.error(fixLine("vidra doctor", "check:"));
+  console.error();
+};
+var printXcodeTooOldHint = () => {
+  console.error();
+  console.error(
+    row({
+      glyph: "manual",
+      label: "your Xcode is older than the SDK this MAUI workload set expects."
+    })
+  );
+  console.error(
+    `      ${dim("\u2022")} ${dim("update Xcode (App Store), then")} ${lime("sudo xcodebuild -runFirstLaunch")}`
+  );
+  console.error(
+    `      ${dim("\u2022")} ${dim("or pin the workloads to your Xcode's era:")} ${lime("dotnet workload update --version <set>")}`
+  );
+  console.error(fixLine("vidra doctor", "check:"));
+  console.error();
+};
+var printXcodeHint = () => {
+  console.error();
+  console.error(
+    row({
+      glyph: "manual",
+      label: "Mac Catalyst needs the full Xcode app, not just the Command Line Tools."
+    })
+  );
+  console.error(`      ${dim("1.")} ${value("install Xcode from the App Store")}`);
+  console.error(
+    `      ${dim("2.")} ${lime(
+      "sudo xcode-select -s /Applications/Xcode.app/Contents/Developer"
+    )}`
+  );
+  console.error(`      ${dim("3.")} ${lime("sudo xcodebuild -runFirstLaunch")}`);
+  console.error(fixLine("vidra doctor", "check:"));
+  console.error();
+};
+
+// src/commands/build.ts
+var TARGETS = {
+  macos: macosTarget,
+  windows: windowsTarget
+};
+var packageLabel = (target) => target.name === "macos" ? "package DMG" : "package ZIP";
+var artifactName = (project, target) => `${project.projectName}-${project.displayVersion}-${target.name}.${target.name === "macos" ? "dmg" : "zip"}`;
+var buildCommand = async (argv) => {
+  const args = parseArgs(["_", "_", ...argv]);
+  const verbose = !!args["verbose"];
+  const plan = !!args["plan"] || !!args["dry-run"];
+  const nativeUpdate = !!args["native-update"];
+  const targetName = args["target"] || detectPlatform();
+  const target = TARGETS[targetName];
+  if (!target) {
+    const supported = Object.keys(TARGETS).join(", ");
+    console.error();
+    console.error(
+      row({
+        glyph: "error",
+        detail: dim(`unsupported target: ${targetName} \u2014 supported: ${supported}`)
+      })
+    );
+    process.exit(1);
+  }
+  const project = detectProject(process.cwd());
+  console.log();
+  console.log(
+    header("build", `${target.name} \xB7 Release${plan ? " \xB7 plan" : ""}`)
+  );
+  console.log(kv("project", project.projectName));
+  console.log(kv("target", target.framework));
+  console.log();
+  const updateConfig = readUpdateConfig(project.root);
+  let nativeSettings = null;
+  if (nativeUpdate) {
+    try {
+      nativeSettings = resolveNativeUpdateSettings({
+        config: updateConfig?.native,
+        csprojPath: project.csprojPath,
+        projectName: project.projectName,
+        version: project.displayVersion
+      });
+    } catch (error) {
+      if (!(error instanceof NativeUpdateConfigError)) throw error;
+      console.error();
+      console.error(row({ glyph: "error", label: "native update", labelWidth: STEP_LABEL_WIDTH, detail: dim(error.message) }));
+      console.error();
+      process.exit(1);
+    }
+  }
+  if (plan) {
+    printBuildPlan(project, target, nativeSettings);
+    console.log();
+    console.log(
+      footer(`${dim("nothing has run. re-run without")} ${lime("--plan")} ${dim("to apply.")}`)
+    );
+    console.log();
+    return;
+  }
+  if (!await ensureMauiWorkload({ csprojPath: project.csprojPath })) {
+    process.exit(1);
+  }
+  stepBuildUi(project, verbose);
+  stepCopyAssets(project);
+  stepStampUpdateConfig(project, updateConfig);
+  const publishDir = stepDotnetPublish(project, target, verbose);
+  const bundlePath = target.findBundle(publishDir, project.projectName);
+  if (!bundlePath) {
+    console.error(
+      row({
+        glyph: "error",
+        detail: dim(`could not find build artifact in ${publishDir}`)
+      })
+    );
+    process.exit(1);
+  }
+  const io = { verbose, log: console.log, warn: console.warn };
+  const entitlements = target.name === "macos" ? entitlementsPath(project) : null;
+  if (target.name === "macos") {
+    signMacAppBundleIfPossible(bundlePath, {
+      ...io,
+      purpose: "distribution",
+      entitlements
+    });
+    reportMacVerification(bundlePath, entitlements);
+  }
+  let signedWindowsExe = null;
+  if (target.name === "windows") {
+    signedWindowsExe = findPrimaryExecutable(bundlePath, project.projectName);
+    if (signedWindowsExe && signWindowsBinariesIfPossible([signedWindowsExe], io)) {
+      const verified = verifyWindowsSignature(signedWindowsExe);
+      console.log(
+        row({
+          glyph: verified.ok ? "done" : "manual",
+          label: "verify sig",
+          labelWidth: STEP_LABEL_WIDTH,
+          detail: verified.untrustedRoot ? dim("signature intact; chain not trusted (expected for a self-signed certificate)") : verified.ok ? dim("authenticode signature verified and trusted") : dim("signature did not verify \u2014 see signtool output")
+        })
+      );
+    }
+  }
+  const packed = nativeSettings ? stepNativeUpdate(project, target, bundlePath, entitlements, nativeSettings, io) : null;
+  const outputPath = packed && target.name === "windows" ? stepPublishVelopackWindowsArtifacts(project, target, packed) : await stepPackage(
+    project,
+    target,
+    packed ? extractPackedApp(packed.outputs.portableZip) : bundlePath
+  );
+  if (target.name === "macos") {
+    signMacDmgIfPossible(outputPath, io);
+    const notarized = notarizeAndStaple(outputPath, io);
+    if (notarized.status === "skipped") {
+      console.log(
+        row({
+          glyph: "skip",
+          label: "notarize",
+          labelWidth: STEP_LABEL_WIDTH,
+          detail: dim(notarized.reason)
+        })
+      );
+    } else if (notarized.status === "failed") {
+      process.exit(1);
+    }
+    reportGatekeeper(outputPath);
+  }
+  console.log();
+  console.log(
+    footer(
+      `${dim("done \u2014")} ${value(path12.relative(project.root, outputPath))}`
+    )
+  );
+  console.log();
+};
+var entitlementsPath = (project) => {
+  const candidate = path12.join(project.hostDir, "Entitlements.plist");
+  return fs11.existsSync(candidate) ? candidate : null;
+};
+var reportMacVerification = (bundlePath, entitlements) => {
+  const verified = verifyMacSignature(bundlePath);
+  console.log(
+    row({
+      glyph: verified.ok ? "done" : "error",
+      label: "verify sig",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: verified.ok ? dim("codesign --verify --strict passed") : dim("codesign --verify --strict FAILED")
+    })
+  );
+  if (!verified.ok) console.error(dim(verified.output));
+  if (!entitlements) return;
+  const hardening = inspectMacHardening(bundlePath);
+  console.log(
+    row({
+      glyph: hardening.ok ? "done" : "error",
+      label: "hardening",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: hardening.ok ? dim("hardened runtime + JIT entitlements embedded") : dim(
+        !hardening.hardened ? "hardened runtime NOT enabled \u2014 this cannot be notarized" : `missing entitlements: ${hardening.missing.join(", ")} \u2014 the app will be killed at launch`
+      )
+    })
+  );
+  if (!hardening.ok) console.error(dim(hardening.output.trim()));
+};
+var reportGatekeeper = (artifactPath) => {
+  const assessment = assessGatekeeper(artifactPath);
+  if (assessment.ok) {
+    console.log(
+      row({
+        glyph: "done",
+        label: "gatekeeper",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("spctl accepted \u2014 this will open on other Macs")
+      })
+    );
+    return;
+  }
+  const missing = !hasDeveloperIdIdentity() ? "needs a Developer ID Application certificate" : !resolveNotaryCredentials() ? "needs notarization (set VIDRA_NOTARY_PROFILE or VIDRA_APPLE_ID/VIDRA_TEAM_ID/VIDRA_APP_PASSWORD)" : "see the spctl output above";
+  console.log(
+    row({
+      glyph: "manual",
+      label: "gatekeeper",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: dim(`spctl rejected \u2014 ${missing}`)
+    })
+  );
+};
+var printBuildPlan = (project, target, nativeSettings) => {
+  console.log(
+    row({
+      glyph: "done",
+      label: "build UI",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("vite \u2192")} ${value("ui/dist")}`
+    })
+  );
+  console.log(
+    row({
+      glyph: "done",
+      label: "copy assets",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("\u2192")} ${value("Resources/Raw/wwwroot")}`
+    })
+  );
+  console.log(
+    row({
+      glyph: "done",
+      label: "publish .NET",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("Release \xB7")} ${value(target.framework)}`
+    })
+  );
+  if (nativeSettings) {
+    const vpk = resolveVpk();
+    console.log(
+      row({
+        glyph: vpk ? "done" : "error",
+        label: "vpk pack",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: vpk ? `${value(`${nativeSettings.packId} ${nativeSettings.packVersion}`)} ${dim(`\u2192 ${RELEASE_DIR}`)}` : dim("vpk is not installed \u2014 dotnet tool install -g vpk")
+      })
+    );
+    console.log(
+      row({
+        glyph: nativeSettings.feedUrl ? "active" : "manual",
+        label: "merge feed",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: nativeSettings.feedUrl ? `${dim("vpk download \u2190")} ${value(nativeSettings.feedUrl)}` : dim("no vidra.updates.native.feedUrl \u2014 the release is packed, and no app will find it")
+      })
+    );
+  }
+  if (target.name === "macos") {
+    const developerId = hasDeveloperIdIdentity();
+    console.log(
+      row({
+        glyph: "done",
+        label: "codesign .app",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(
+          developerId ? "Developer ID Application \xB7 hardened runtime" : "no Developer ID found \u2014 will fall back to development/ad-hoc"
+        )
+      })
+    );
+    console.log(
+      row({
+        glyph: "active",
+        label: "package DMG",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: `${dim("hdiutil UDZO \u2192")} ${value(artifactName(project, target))}`
+      })
+    );
+    console.log(
+      row({
+        glyph: developerId ? "done" : "skip",
+        label: "codesign dmg",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(
+          developerId ? "sign the disk image" : "skipped without a Developer ID"
+        )
+      })
+    );
+    const creds = resolveNotaryCredentials();
+    console.log(
+      row({
+        glyph: creds ? "active" : "plan",
+        label: "notarize",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: creds ? dim("notarytool submit --wait, then staple") : `${planBadge()} ${dim("no credentials configured")}`
+      })
+    );
+    console.log(
+      row({
+        glyph: "active",
+        label: "gatekeeper",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("spctl --assess")
+      })
+    );
+  } else {
+    const winCert = resolveWindowsSigningConfig();
+    console.log(
+      row({
+        glyph: winCert ? "done" : "skip",
+        label: "authenticode",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(
+          winCert ? `sign the .exe (${winCert.mode})` : "no certificate configured \u2014 will ship unsigned"
+        )
+      })
+    );
+    console.log(
+      row({
+        glyph: "active",
+        label: "package ZIP",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: nativeSettings ? `${dim("vpk's portable zip \u2192")} ${value(artifactName(project, target))}` : `${dim("self-contained \u2192")} ${value(artifactName(project, target))}`
+      })
+    );
+    if (nativeSettings) {
+      console.log(
+        row({
+          glyph: "active",
+          label: "installer",
+          labelWidth: STEP_LABEL_WIDTH,
+          detail: `${dim("\u2192")} ${value(`${project.projectName}-${project.displayVersion}-Setup.exe`)}`
+        })
+      );
+    }
+  }
+};
+var stepBuildUi = (project, verbose) => {
+  const start = Date.now();
+  try {
+    execSync3("npm run build", {
+      cwd: project.uiDir,
+      stdio: verbose ? "inherit" : "pipe"
+    });
+  } catch (e) {
+    console.error(
+      row({
+        glyph: "error",
+        label: "build UI",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("vite build failed")
+      })
+    );
+    console.error(dim(formatBuildError(e)));
+    process.exit(1);
+  }
+  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
+  console.log(
+    row({
+      glyph: "done",
+      label: "build UI",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("vite \u2192")} ${value("ui/dist")} ${dim(`(${elapsed}s)`)}`
+    })
+  );
+};
+var stepCopyAssets = (project) => {
+  const viteDist = path12.join(project.uiDir, "dist");
+  if (!fs11.existsSync(viteDist)) {
+    console.error(
+      row({
+        glyph: "error",
+        label: "copy assets",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("ui/dist not found \u2014 vite build may have failed")
+      })
+    );
+    process.exit(1);
+  }
+  const wwwroot = path12.join(project.hostDir, "Resources", "Raw", "wwwroot");
+  fs11.removeSync(wwwroot);
+  fs11.copySync(viteDist, wwwroot);
+  const fileCount = countFiles(wwwroot);
+  console.log(
+    row({
+      glyph: "done",
+      label: "copy assets",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("\u2192")} ${value("Resources/Raw/wwwroot")} ${dim(`(${fileCount} files)`)}`
+    })
+  );
+};
+var stepStampUpdateConfig = (project, config) => {
+  stampUpdateConfig(project.hostDir, config);
+  if (!config) {
+    return;
+  }
+  console.log(
+    row({
+      glyph: "done",
+      label: "stamp updates",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("\u2192")} ${value(`Resources/Raw/${UPDATE_CONFIG_FILE}`)} ${dim(
+        config.enabled === false ? "(disabled)" : `(${config.feedUrl ?? "no feed"})`
+      )}`
+    })
+  );
+};
+var countFiles = (dir) => {
+  let count = 0;
+  for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      count += countFiles(path12.join(dir, entry.name));
+    } else {
+      count++;
+    }
+  }
+  return count;
+};
+var stepDotnetPublish = (project, target, verbose) => {
+  const start = Date.now();
+  const extraArgs = target.extraPublishArgs ?? "-p:CreatePackage=false";
+  const version = resolveAppVersion(project.root, project.csprojPath);
+  const versionArgs = versionPublishArgs(version).join(" ");
+  try {
+    execSync3(
+      `dotnet publish "${project.csprojPath}" -c Release -f ${target.framework} ${extraArgs} ${versionArgs}`,
+      {
+        cwd: project.root,
+        stdio: verbose ? "inherit" : "pipe"
+      }
+    );
+  } catch (e) {
+    const output = formatBuildError(e);
+    console.error(
+      row({
+        glyph: "error",
+        label: "publish .NET",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("dotnet publish failed")
+      })
+    );
+    console.error(dim(output));
+    if (looksLikeMissingWorkload(output)) printWorkloadHint();
+    else if (looksLikeMissingXcode(output)) printXcodeHint();
+    if (!verbose) {
+      console.error(footer(dim("re-run with --verbose for the full build log.")));
+    }
+    process.exit(1);
+  }
+  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
+  console.log(
+    row({
+      glyph: "done",
+      label: "publish .NET",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("Release \xB7")} ${value(target.framework)} ${dim(`(${elapsed}s)`)}`
+    })
+  );
+  return path12.join(project.hostDir, "bin", "Release", target.framework);
 };
-var printRequirements = (reqs) => {
-  const labelWidth = Math.max(0, ...reqs.map((r) => r.name.length)) + 2;
-  for (const r of reqs) {
-    console.log(
+var stepNativeUpdate = (project, target, packDir, entitlements, settings, io) => {
+  const start = Date.now();
+  let outcome;
+  try {
+    outcome = runNativeUpdate({
+      projectRoot: project.root,
+      settings,
+      packDir,
+      target: target.name,
+      entitlements,
+      io
+    });
+  } catch (error) {
+    if (!(error instanceof NativeUpdateError)) throw error;
+    console.error(
       row({
-        glyph: STATUS_GLYPH[r.status],
-        label: r.name,
-        labelWidth,
-        detail: r.detail ? dim(r.detail) : void 0
+        glyph: "error",
+        label: "native update",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(error.message)
       })
     );
-    if (r.status !== "ok" && r.fix) {
-      console.log(fixLine(r.fix));
-    }
+    if (error.detail) console.error(footer(dim(error.detail)));
+    process.exit(1);
   }
-};
-var runDoctor = async () => {
-  console.log();
-  console.log(`  ${lime("vidra")} ${value("doctor")}`);
-  console.log();
-  console.log(footer(dim("checking your environment\u2026")));
-  console.log();
-  const reqs = collectRequirements();
-  printRequirements(reqs);
-  console.log();
-  const missing = reqs.filter((r) => r.status === "missing");
-  if (missing.length === 0) {
+  if (outcome.merged === "no-feed") {
     console.log(
-      footer(
-        `${dim("all checks passed \u2014 you're ready to run")} ${lime(
-          "npm run dev"
-        )}${dim(".")}`
-      )
+      row({
+        glyph: "manual",
+        label: "merge feed",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("no vidra.updates.native.feedUrl: this release is packed but the app will never check for it")
+      })
+    );
+  } else if (outcome.merged === "empty-feed") {
+    console.log(
+      row({
+        glyph: "manual",
+        label: "merge feed",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("nothing downloaded: first release, or the feed is unreachable (see the warning above)")
+      })
+    );
+  } else {
+    console.log(
+      row({
+        glyph: "done",
+        label: "merge feed",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: `${dim("vpk download \u2192")} ${value(RELEASE_DIR)}`
+      })
     );
-    console.log();
-    return 0;
   }
-  const n = missing.length;
+  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
   console.log(
-    footer(
-      `${dim(
-        `${n} issue${n === 1 ? "" : "s"} found. apply the ${n === 1 ? "fix" : "fixes"} above, then re-run`
-      )} ${lime("npm run doctor")}${dim(".")}`
-    )
+    row({
+      glyph: "done",
+      label: "vpk pack",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(`${settings.packId} ${settings.packVersion}`)} ${dim(
+        `\u2192 ${RELEASE_DIR} (${elapsed}s)`
+      )}`
+    })
   );
-  console.log();
-  return 1;
+  if (!outcome.outputs.portableZip) {
+    console.error(
+      row({
+        glyph: "error",
+        label: "vpk pack",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim(`vpk wrote no portable archive to ${RELEASE_DIR}`)
+      })
+    );
+    process.exit(1);
+  }
+  return outcome;
 };
-var installWorkload = (csprojPath) => {
-  const args = csprojPath ? ["workload", "restore", csprojPath] : ["workload", "install", "maui"];
-  console.log();
+var stepPublishVelopackWindowsArtifacts = (project, target, packed) => {
+  const outputDir = path12.join(project.root, "dist");
+  fs11.ensureDirSync(outputDir);
+  const zipPath = path12.join(outputDir, artifactName(project, target));
+  fs11.copySync(packed.outputs.portableZip, zipPath, { overwrite: true });
   console.log(
     row({
-      glyph: "active",
-      detail: `${dim("running")} ${value(`${DOTNET} ${args.join(" ")}`)}`
+      glyph: "done",
+      label: packageLabel(target),
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(path12.basename(zipPath))} ${dim(
+        `(${(fs11.statSync(zipPath).size / (1024 * 1024)).toFixed(1)} MB, from vpk)`
+      )}`
     })
   );
-  console.log(
-    footer(
-      dim("this can download several hundred MB and take a few minutes.")
-    )
-  );
-  console.log();
-  try {
-    execFileSync3(DOTNET, args, { stdio: "inherit" });
-    return true;
-  } catch {
-    console.error();
-    console.error(row({ glyph: "error", label: "workload install failed" }));
-    console.error(
-      footer(
-        dim(
-          "if this is a permissions error, your SDK is in a system location and needs elevation:"
-        )
-      )
+  if (packed.outputs.setupExe) {
+    const setupName = `${project.projectName}-${project.displayVersion}-Setup.exe`;
+    const setupPath = path12.join(outputDir, setupName);
+    fs11.copySync(packed.outputs.setupExe, setupPath, { overwrite: true });
+    console.log(
+      row({
+        glyph: "done",
+        label: "installer",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: `${value(setupName)} ${dim("the recommended download; updates apply in place")}`
+      })
     );
-    console.error(fixLine("sudo dotnet workload install maui"));
-    console.error();
-    return false;
   }
+  return zipPath;
 };
-var ensureMauiWorkload = async (opts = {}) => {
-  const dotnet = checkDotnetSdk();
-  if (dotnet.status === "missing") {
-    console.log();
-    console.log(
+var stepPackage = async (project, target, bundlePath) => {
+  const outputDir = path12.join(project.root, "dist");
+  fs11.ensureDirSync(outputDir);
+  const start = Date.now();
+  let outputPath;
+  try {
+    outputPath = await target.package(bundlePath, outputDir, {
+      projectName: project.projectName,
+      displayVersion: project.displayVersion
+    });
+  } catch (e) {
+    console.error(
       row({
         glyph: "error",
-        label: dotnet.name,
-        detail: dotnet.detail ? dim(dotnet.detail) : void 0
+        label: packageLabel(target),
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("packaging failed")
       })
     );
-    if (dotnet.fix) {
-      console.log(fixLine(dotnet.fix));
-    }
-    return false;
+    console.error(dim(formatProcessError(e)));
+    process.exit(1);
   }
-  if (dotnet.status === "unknown") return true;
-  if (isMauiWorkloadInstalled()) return true;
-  console.log();
+  const pkgTime = ((Date.now() - start) / 1e3).toFixed(1);
+  const sizeMB = (fs11.statSync(outputPath).size / (1024 * 1024)).toFixed(1);
   console.log(
     row({
-      glyph: "error",
-      label: ".NET MAUI workload",
-      detail: dim("required but not installed")
+      glyph: "done",
+      label: packageLabel(target),
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(path12.basename(outputPath))} ${dim(`(${sizeMB} MB, ${pkgTime}s)`)}`
     })
   );
-  const interactive = opts.interactive ?? isInteractive();
-  if (interactive) {
-    let install = false;
-    try {
-      const res = await prompts({
-        type: "confirm",
-        name: "install",
-        message: "Install the .NET MAUI workload now?",
-        initial: true
-      });
-      install = Boolean(res.install);
-    } catch {
-      install = false;
-    }
-    if (install) {
-      if (installWorkload(opts.csprojPath) && isMauiWorkloadInstalled()) {
-        console.log(
-          row({
-            glyph: "done",
-            label: ".NET MAUI workload",
-            detail: dim("installed")
-          })
-        );
-        return true;
-      }
-      return false;
+  return outputPath;
+};
+
+// src/commands/bundle.ts
+import path15 from "path";
+import crypto2 from "crypto";
+import fs14 from "fs-extra";
+import { execSync as execSync4 } from "child_process";
+
+// src/zip.ts
+import fs12 from "fs";
+import path13 from "path";
+import zlib from "zlib";
+var LOCAL_HEADER = 67324752;
+var CENTRAL_HEADER = 33639248;
+var END_OF_CENTRAL_DIRECTORY = 101010256;
+var DEFLATE = 8;
+var DOS_DATE = 33;
+var DOS_TIME = 0;
+var crcTable = (() => {
+  const table = new Uint32Array(256);
+  for (let i = 0; i < 256; i++) {
+    let c = i;
+    for (let bit = 0; bit < 8; bit++) {
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
     }
+    table[i] = c >>> 0;
   }
-  console.log(fixLine("dotnet workload install maui", "run:"));
-  console.log(fixLine(MAUI_DOCS, "docs:"));
-  return false;
-};
-var printWorkloadHint = () => {
-  console.error();
-  console.error(
-    row({ glyph: "manual", label: "this looks like a missing .NET MAUI workload." })
-  );
-  console.error(fixLine("dotnet workload install maui"));
-  console.error(fixLine("vidra doctor", "check:"));
-  console.error();
+  return table;
+})();
+var crc32 = (data) => {
+  let c = 4294967295;
+  for (const byte of data) {
+    c = crcTable[(c ^ byte) & 255] ^ c >>> 8;
+  }
+  return (c ^ 4294967295) >>> 0;
 };
-var printXcodeTooOldHint = () => {
-  console.error();
-  console.error(
-    row({
-      glyph: "manual",
-      label: "your Xcode is older than the SDK this MAUI workload set expects."
-    })
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("update Xcode (App Store), then")} ${lime("sudo xcodebuild -runFirstLaunch")}`
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("or pin the workloads to your Xcode's era:")} ${lime("dotnet workload update --version <set>")}`
-  );
-  console.error(fixLine("vidra doctor", "check:"));
-  console.error();
+var createZip = (entries) => {
+  const sorted = [...entries].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const locals = [];
+  const centrals = [];
+  let offset = 0;
+  for (const entry of sorted) {
+    const name = Buffer.from(entry.name.replace(/\\/g, "/"), "utf8");
+    const deflated = zlib.deflateRawSync(entry.content, { level: 9 });
+    const checksum = crc32(entry.content);
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(LOCAL_HEADER, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(DEFLATE, 8);
+    local.writeUInt16LE(DOS_TIME, 10);
+    local.writeUInt16LE(DOS_DATE, 12);
+    local.writeUInt32LE(checksum, 14);
+    local.writeUInt32LE(deflated.length, 18);
+    local.writeUInt32LE(entry.content.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28);
+    locals.push(local, name, deflated);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(CENTRAL_HEADER, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(DEFLATE, 10);
+    central.writeUInt16LE(DOS_TIME, 12);
+    central.writeUInt16LE(DOS_DATE, 14);
+    central.writeUInt32LE(checksum, 16);
+    central.writeUInt32LE(deflated.length, 20);
+    central.writeUInt32LE(entry.content.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(0, 36);
+    central.writeUInt32LE(33188 << 16 >>> 0, 38);
+    central.writeUInt32LE(offset, 42);
+    centrals.push(central, name);
+    offset += local.length + name.length + deflated.length;
+  }
+  const centralDirectory = Buffer.concat(centrals);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(END_OF_CENTRAL_DIRECTORY, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(sorted.length, 8);
+  end.writeUInt16LE(sorted.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  end.writeUInt16LE(0, 20);
+  return Buffer.concat([...locals, centralDirectory, end]);
 };
-var printXcodeHint = () => {
-  console.error();
-  console.error(
-    row({
-      glyph: "manual",
-      label: "Mac Catalyst needs the full Xcode app, not just the Command Line Tools."
-    })
-  );
-  console.error(`      ${dim("1.")} ${value("install Xcode from the App Store")}`);
-  console.error(
-    `      ${dim("2.")} ${lime(
-      "sudo xcode-select -s /Applications/Xcode.app/Contents/Developer"
-    )}`
-  );
-  console.error(`      ${dim("3.")} ${lime("sudo xcodebuild -runFirstLaunch")}`);
-  console.error(fixLine("vidra doctor", "check:"));
-  console.error();
+var readDirectoryEntries = (root) => {
+  const entries = [];
+  const walk = (dir, prefix) => {
+    for (const item of fs12.readdirSync(dir, { withFileTypes: true }).sort(
+      (a, b) => a.name < b.name ? -1 : 1
+    )) {
+      const full = path13.join(dir, item.name);
+      const name = prefix ? `${prefix}/${item.name}` : item.name;
+      if (item.isDirectory()) {
+        walk(full, name);
+      } else if (item.isFile()) {
+        entries.push({ name, content: fs12.readFileSync(full) });
+      }
+    }
+  };
+  walk(root, "");
+  return entries;
 };
 
-// src/commands/build.ts
-var TARGETS = {
-  macos: macosTarget,
-  windows: windowsTarget
+// src/manifest-signing.ts
+import crypto from "crypto";
+import fs13 from "fs";
+import path14 from "path";
+var SIGNATURE_ALGORITHM = "ecdsa-p256-sha256";
+var SIGNATURE_FILE = "bundles.json.sig";
+var generateKeyPair = () => {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
+    namedCurve: "prime256v1"
+  });
+  const spki = publicKey.export({ format: "der", type: "spki" });
+  return {
+    privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
+    publicKey: spki.toString("base64"),
+    keyId: keyIdOf(spki)
+  };
 };
-var packageLabel = (target) => target.name === "macos" ? "package DMG" : "package ZIP";
-var artifactName = (project, target) => `${project.projectName}-${project.displayVersion}-${target.name}.${target.name === "macos" ? "dmg" : "zip"}`;
-var buildCommand = async (argv) => {
-  const args = parseArgs(["_", "_", ...argv]);
-  const verbose = !!args["verbose"];
-  const plan = !!args["plan"] || !!args["dry-run"];
-  const targetName = args["target"] || detectPlatform();
-  const target = TARGETS[targetName];
-  if (!target) {
-    const supported = Object.keys(TARGETS).join(", ");
-    console.error();
-    console.error(
-      row({
-        glyph: "error",
-        detail: dim(`unsupported target: ${targetName} \u2014 supported: ${supported}`)
-      })
+var keyIdOf = (spki) => crypto.createHash("sha256").update(spki).digest("hex").slice(0, 8);
+var publicKeyFor = (privateKeyPem) => {
+  const privateKey = crypto.createPrivateKey(privateKeyPem);
+  const spki = crypto.createPublicKey(privateKey).export({
+    format: "der",
+    type: "spki"
+  });
+  return { publicKey: spki.toString("base64"), keyId: keyIdOf(spki) };
+};
+var signManifest = (manifestBytes, privateKeyPem) => {
+  const privateKey = crypto.createPrivateKey(privateKeyPem);
+  if (privateKey.asymmetricKeyType !== "ec") {
+    throw new Error(
+      `the signing key is ${privateKey.asymmetricKeyType ?? "of an unknown type"}; vidra signs with an ECDSA P-256 key \u2014 make one with \`vidra keygen\``
+    );
+  }
+  const curve = privateKey.asymmetricKeyDetails?.namedCurve;
+  if (curve && curve !== "prime256v1") {
+    throw new Error(`the signing key uses curve ${curve}; vidra signs with P-256 (prime256v1)`);
+  }
+  const signature = crypto.sign("sha256", manifestBytes, privateKey);
+  const { keyId } = publicKeyFor(privateKeyPem);
+  return {
+    algorithm: SIGNATURE_ALGORITHM,
+    keyId,
+    signature: signature.toString("base64")
+  };
+};
+var verifyManifest = (manifestBytes, document, publicKeyBase64) => {
+  if (document.algorithm !== SIGNATURE_ALGORITHM) return false;
+  try {
+    const publicKey = crypto.createPublicKey({
+      key: Buffer.from(publicKeyBase64, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return crypto.verify(
+      "sha256",
+      manifestBytes,
+      publicKey,
+      Buffer.from(document.signature, "base64")
     );
-    process.exit(1);
+  } catch {
+    return false;
   }
-  const project = detectProject(process.cwd());
-  console.log();
-  console.log(
-    header("build", `${target.name} \xB7 Release${plan ? " \xB7 plan" : ""}`)
-  );
-  console.log(kv("project", project.projectName));
-  console.log(kv("target", target.framework));
-  console.log();
-  if (plan) {
-    printBuildPlan(project, target);
-    console.log();
-    console.log(
-      footer(`${dim("nothing has run. re-run without")} ${lime("--plan")} ${dim("to apply.")}`)
-    );
-    console.log();
-    return;
+};
+var resolveSigningKey = (keyPath) => {
+  if (keyPath) {
+    if (!fs13.existsSync(keyPath)) {
+      throw new Error(`no signing key at ${keyPath}`);
+    }
+    return fs13.readFileSync(keyPath, "utf8");
   }
-  if (!await ensureMauiWorkload({ csprojPath: project.csprojPath })) {
-    process.exit(1);
+  const fromEnvironment = process.env.VIDRA_UPDATE_SIGNING_KEY;
+  if (fromEnvironment && fromEnvironment.includes("PRIVATE KEY")) {
+    return fromEnvironment;
   }
-  stepBuildUi(project, verbose);
-  stepCopyAssets(project);
-  const publishDir = stepDotnetPublish(project, target, verbose);
-  const bundlePath = target.findBundle(publishDir, project.projectName);
-  if (!bundlePath) {
+  return null;
+};
+var writeSignature = (outDir, document) => {
+  const target = path14.join(outDir, SIGNATURE_FILE);
+  fs13.writeFileSync(target, `${JSON.stringify(document, null, 2)}
+`);
+  return target;
+};
+
+// src/commands/bundle.ts
+var SCHEMA = 1;
+var parseBundleOptions = (argv) => {
+  const args = parseArgs(["_", "_", ...argv]);
+  return {
+    out: typeof args.out === "string" ? args.out : "dist",
+    channel: typeof args.channel === "string" ? args.channel : void 0,
+    skipBuild: !!args["skip-build"],
+    sign: typeof args.sign === "string" ? args.sign : void 0,
+    mergeFrom: typeof args["merge-from"] === "string" ? args["merge-from"] : void 0
+  };
+};
+var bundleCommand = async (argv) => {
+  const options = parseBundleOptions(argv);
+  const project = detectProject(process.cwd());
+  const outDir = path15.resolve(project.root, options.out);
+  const channel = options.channel;
+  console.log(header("bundle", `${project.projectName} ${project.displayVersion}`));
+  if (!options.skipBuild) {
+    stepBuildUi2(project);
+  }
+  const dist = path15.join(project.uiDir, "dist");
+  if (!fs14.existsSync(path15.join(dist, "index.html"))) {
     console.error(
       row({
         glyph: "error",
-        detail: dim(`could not find build artifact in ${publishDir}`)
+        label: "read ui/dist",
+        labelWidth: STEP_LABEL_WIDTH,
+        detail: dim("no index.html \u2014 run the UI build first, or drop --skip-build")
       })
     );
     process.exit(1);
   }
-  if (target.name === "macos") {
-    signMacAppBundleIfPossible(bundlePath, {
-      verbose,
-      log: console.log,
-      warn: console.warn
-    });
-  }
-  const outputPath = await stepPackage(project, target, bundlePath);
-  console.log();
-  console.log(
-    footer(
-      `${dim("done \u2014")} ${value(path5.relative(project.root, outputPath))}`
-    )
-  );
-  console.log();
-};
-var printBuildPlan = (project, target) => {
+  const fingerprints = readFingerprints(project);
+  const entries = readDirectoryEntries(dist);
+  const archive = createZip(entries);
+  const sha256 = crypto2.createHash("sha256").update(archive).digest("hex");
+  const name = `bundle-${project.displayVersion}-${sha256.slice(0, 8)}.zip`;
+  fs14.ensureDirSync(outDir);
+  fs14.writeFileSync(path15.join(outDir, name), archive);
   console.log(
     row({
       glyph: "done",
-      label: "build UI",
+      label: "pack bundle",
       labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("vite \u2192")} ${value("ui/dist")}`
+      detail: `${value(name)} ${dim(`(${entries.length} files, ${formatBytes(archive.length)})`)}`
     })
   );
+  const entry = {
+    version: project.displayVersion,
+    url: name,
+    sha256,
+    size: archive.length,
+    coreFingerprint: fingerprints.core,
+    appFingerprint: fingerprints.app,
+    ...channel ? { channel } : {}
+  };
+  const manifestPath = path15.join(outDir, "bundles.json");
+  const base = await loadBaseManifest(options, outDir, signingKeyFor(options));
+  const manifest = mergeManifest(base, entry);
+  const manifestBytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}
+`);
+  fs14.writeFileSync(manifestPath, manifestBytes);
   console.log(
     row({
       glyph: "done",
-      label: "copy assets",
+      label: "write feed",
       labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("\u2192")} ${value("Resources/Raw/wwwroot")}`
+      detail: `${value("bundles.json")} ${dim(`(${manifest.bundles.length} entries)`)}`
     })
   );
+  stepSignManifest(project, outDir, manifestBytes, options.sign);
   console.log(
     row({
-      glyph: "done",
-      label: "publish .NET",
+      glyph: "plan",
+      label: "compatible",
       labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("Release \xB7")} ${value(target.framework)}`
+      detail: `${dim("core")} ${value(fingerprints.core.slice(0, 12))} ${dim("app")} ${value(fingerprints.app.slice(0, 12))}`
     })
   );
-  if (target.name === "macos") {
+  console.log(
+    footer(
+      dim(
+        `upload ${value(path15.relative(project.root, outDir) || "dist")}/ to your feed host \u2014 every file, and bundles.json last`
+      )
+    )
+  );
+};
+var loadBaseManifest = async (options, outDir, privateKeyPem) => {
+  if (!options.mergeFrom) {
+    return readManifest(path15.join(outDir, "bundles.json"));
+  }
+  let fetched;
+  try {
+    fetched = await fetchFeed(options.mergeFrom);
+  } catch (error) {
+    return fail("merge feed", `could not read ${options.mergeFrom}: ${error.message}`);
+  }
+  if (!fetched) {
     console.log(
       row({
-        glyph: "done",
-        label: "codesign .app",
+        glyph: "plan",
+        label: "merge feed",
         labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("Apple Development, or ad-hoc (-)")
+        detail: dim(`no index at ${options.mergeFrom} yet \u2014 publishing the first one`)
       })
     );
+    return { schema: SCHEMA, bundles: [] };
+  }
+  if (privateKeyPem) {
+    const { publicKey } = publicKeyFor(privateKeyPem);
+    const ok = fetched.signature !== null && verifyManifest(Buffer.from(fetched.manifest), safeParse(fetched.signature), publicKey);
+    if (!ok) {
+      fail(
+        "merge feed",
+        `the index at ${options.mergeFrom} is not signed by your key \u2014 refusing to merge and re-sign it, which would publish someone else's entries under your signature`
+      );
+    }
+  }
+  const base = parseManifest(fetched.manifest);
+  console.log(
+    row({
+      glyph: "done",
+      label: "merge feed",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(options.mergeFrom)} ${dim(`(${base.bundles.length} existing entries)`)}`
+    })
+  );
+  return base;
+};
+var fetchFeed = async (source) => {
+  if (/^https?:\/\//i.test(source)) {
+    const response = await fetch(source);
+    if (response.status === 404) return null;
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const manifest = await response.text();
+    const signatureResponse = await fetch(`${source}.sig`);
+    return {
+      manifest,
+      signature: signatureResponse.ok ? await signatureResponse.text() : null
+    };
+  }
+  const manifestPath = fs14.existsSync(source) && fs14.statSync(source).isDirectory() ? path15.join(source, "bundles.json") : source;
+  if (!fs14.existsSync(manifestPath)) return null;
+  const signaturePath = `${manifestPath}.sig`;
+  return {
+    manifest: fs14.readFileSync(manifestPath, "utf8"),
+    signature: fs14.existsSync(signaturePath) ? fs14.readFileSync(signaturePath, "utf8") : null
+  };
+};
+var safeParse = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { algorithm: "", keyId: "", signature: "" };
+  }
+};
+var signingKeyFor = (options) => {
+  try {
+    return resolveSigningKey(options.sign);
+  } catch {
+    return null;
+  }
+};
+var stepSignManifest = (project, outDir, manifestBytes, keyPath) => {
+  const configuredKeys = readUpdateConfig(project.root)?.publicKeys ?? [];
+  let privateKeyPem = null;
+  try {
+    privateKeyPem = resolveSigningKey(keyPath);
+  } catch (error) {
+    fail("sign feed", error.message);
+  }
+  if (!privateKeyPem) {
+    if (configuredKeys.length > 0) {
+      fail(
+        "sign feed",
+        "this app trusts a signing key, so an unsigned feed would be refused by every installed copy \u2014 pass --sign <key.pem> or set VIDRA_UPDATE_SIGNING_KEY"
+      );
+    }
+    fs14.removeSync(path15.join(outDir, "bundles.json.sig"));
     console.log(
       row({
-        glyph: "plan",
-        label: "notarize",
+        glyph: "manual",
+        label: "sign feed",
         labelWidth: STEP_LABEL_WIDTH,
-        detail: planBadge()
+        detail: amber(
+          "unsigned \u2014 anyone who can write to your feed host can run code in your app"
+        )
       })
     );
-    console.log(
+    return;
+  }
+  let document;
+  let publicKey;
+  try {
+    document = signManifest(manifestBytes, privateKeyPem);
+    publicKey = publicKeyFor(privateKeyPem).publicKey;
+  } catch (error) {
+    return fail("sign feed", error.message);
+  }
+  writeSignature(outDir, document);
+  if (configuredKeys.length > 0 && !configuredKeys.includes(publicKey)) {
+    fail(
+      "sign feed",
+      `signed with key ${document.keyId}, which is not among the ${configuredKeys.length} key(s) in package.json \u2014 installed apps would reject this feed`
+    );
+  }
+  console.log(
+    row({
+      glyph: "done",
+      label: "sign feed",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value("bundles.json.sig")} ${dim(`(key ${document.keyId})`)}`
+    })
+  );
+};
+var stepBuildUi2 = (project) => {
+  try {
+    execSync4("npm run build", { cwd: project.uiDir, stdio: "pipe" });
+  } catch {
+    console.error(
       row({
-        glyph: "active",
-        label: "package DMG",
+        glyph: "error",
+        label: "build UI",
         labelWidth: STEP_LABEL_WIDTH,
-        detail: `${dim("hdiutil UDZO \u2192")} ${value(artifactName(project, target))}`
+        detail: dim("vite build failed")
       })
     );
-  } else {
-    console.log(
+    process.exit(1);
+  }
+  console.log(
+    row({
+      glyph: "done",
+      label: "build UI",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${dim("vite \u2192")} ${value("ui/dist")}`
+    })
+  );
+};
+var readFingerprints = (project) => {
+  const appManifest = path15.join(project.uiDir, "src", "generated", "manifest.json");
+  const app = readFingerprintFile(appManifest);
+  if (!app) {
+    fail(
+      "read fingerprints",
+      `no app contract fingerprint in ${path15.relative(project.root, appManifest)} \u2014 build the host once to generate it`
+    );
+  }
+  const sdkManifest = path15.join(
+    project.uiDir,
+    "node_modules",
+    "@vidra-dev",
+    "sdk",
+    "dist",
+    "manifest.json"
+  );
+  const core = readFingerprintFile(sdkManifest);
+  if (!core) {
+    fail(
+      "read fingerprints",
+      "no core contract fingerprint from @vidra-dev/sdk \u2014 run npm install in ui/, and make sure the SDK is 0.4.0 or newer"
+    );
+  }
+  return { core, app };
+};
+var readFingerprintFile = (file) => {
+  if (!fs14.existsSync(file)) return null;
+  try {
+    const parsed = fs14.readJsonSync(file);
+    return typeof parsed.fingerprint === "string" && parsed.fingerprint.length > 0 ? parsed.fingerprint : null;
+  } catch {
+    return null;
+  }
+};
+var readManifest = (file) => {
+  if (!fs14.existsSync(file)) return { schema: SCHEMA, bundles: [] };
+  return parseManifest(fs14.readFileSync(file, "utf8"));
+};
+var parseManifest = (text) => {
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed.schema !== SCHEMA || !Array.isArray(parsed.bundles)) {
+      return { schema: SCHEMA, bundles: [] };
+    }
+    return { schema: SCHEMA, bundles: parsed.bundles };
+  } catch {
+    return { schema: SCHEMA, bundles: [] };
+  }
+};
+var mergeManifest = (manifest, entry) => {
+  const supersedes = (existing) => existing.version === entry.version && (existing.channel ?? null) === (entry.channel ?? null) && existing.coreFingerprint === entry.coreFingerprint && existing.appFingerprint === entry.appFingerprint;
+  return {
+    schema: SCHEMA,
+    bundles: [...manifest.bundles.filter((e) => !supersedes(e)), entry]
+  };
+};
+var formatBytes = (bytes) => bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} KB` : `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+var fail = (label, detail) => {
+  console.error(row({ glyph: "error", label, labelWidth: STEP_LABEL_WIDTH, detail: dim(detail) }));
+  process.exit(1);
+};
+
+// src/commands/keygen.ts
+import fs15 from "fs";
+import path16 from "path";
+var keygenCommand = async (argv) => {
+  const args = parseArgs(["_", "_", ...argv]);
+  const out = path16.resolve(
+    typeof args.out === "string" ? args.out : "vidra-signing-key.pem"
+  );
+  const force = !!args.force;
+  console.log(header("keygen", "update signing key"));
+  if (fs15.existsSync(out) && !force) {
+    console.error(
       row({
-        glyph: "active",
-        label: "package ZIP",
+        glyph: "error",
+        label: "write key",
         labelWidth: STEP_LABEL_WIDTH,
-        detail: `${dim("self-contained \u2192")} ${value(artifactName(project, target))}`
+        detail: dim(
+          `${path16.basename(out)} already exists \u2014 apps trusting it could not install updates signed by a new key. Pass --force only if you mean to replace it.`
+        )
       })
     );
+    process.exit(1);
+  }
+  const { privateKeyPem, publicKey, keyId } = generateKeyPair();
+  fs15.writeFileSync(out, privateKeyPem, { mode: 384 });
+  try {
+    fs15.chmodSync(out, 384);
+  } catch {
+  }
+  console.log(
+    row({
+      glyph: "done",
+      label: "private key",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(path16.relative(process.cwd(), out) || out)} ${dim(`(key ${keyId})`)}`
+    })
+  );
+  const publicKeyPath = `${out}.pub`;
+  fs15.writeFileSync(publicKeyPath, `${publicKey}
+`);
+  console.log(
+    row({
+      glyph: "done",
+      label: "public key",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: `${value(path16.relative(process.cwd(), publicKeyPath) || publicKeyPath)} ${dim("\u2014 add it to your app's package.json:")}`
+    })
+  );
+  console.log();
+  console.log(
+    value(
+      JSON.stringify({ vidra: { updates: { publicKeys: [publicKey] } } }, null, 2).split("\n").map((line) => `    ${line}`).join("\n")
+    )
+  );
+  console.log();
+  console.log(
+    row({
+      glyph: "manual",
+      label: "keep it safe",
+      labelWidth: STEP_LABEL_WIDTH,
+      detail: amber(
+        "this key is the authority to run code in every installed copy of your app"
+      )
+    })
+  );
+  console.log(
+    footer(
+      dim(
+        `never commit it \xB7 back it up \xB7 in CI pass it as ${value("VIDRA_UPDATE_SIGNING_KEY")} and sign with ${value("vidra bundle --sign")}`
+      )
+    )
+  );
+};
+
+// src/commands/verify.ts
+import path18 from "path";
+import fs17 from "fs-extra";
+
+// src/artifacts.ts
+import path17 from "path";
+import os5 from "os";
+import fs16 from "fs-extra";
+import { execFileSync as execFileSync8 } from "child_process";
+var findAppBundle2 = (dir) => {
+  if (!fs16.existsSync(dir)) return null;
+  for (const entry of fs16.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.endsWith(".app") && entry.isDirectory()) {
+      return path17.join(dir, entry.name);
+    }
   }
+  return null;
 };
-var stepBuildUi = (project, verbose) => {
-  const start = Date.now();
+var findWindowsExecutable = (dir, projectName) => {
+  if (!fs16.existsSync(dir)) return null;
+  const exes = fs16.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe")).map((e) => e.name);
+  const wanted = projectName?.toLowerCase();
+  const preferred = wanted && exes.find((n) => n.toLowerCase() === `${wanted}.host.exe`) || wanted && exes.find((n) => n.toLowerCase().startsWith(wanted)) || exes.find((n) => n.toLowerCase().endsWith(".host.exe")) || exes.find((n) => n.toLowerCase() !== "createdump.exe");
+  return preferred ? path17.join(dir, preferred) : null;
+};
+var findWindowsExecutableRecursive = (root, projectName) => {
+  const direct = findWindowsExecutable(root, projectName);
+  if (direct) return direct;
+  if (!fs16.existsSync(root)) return null;
+  for (const entry of fs16.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const found = findWindowsExecutableRecursive(path17.join(root, entry.name), projectName);
+    if (found) return found;
+  }
+  return null;
+};
+var extractArchive = (zipPath) => {
+  const dir = fs16.mkdtempSync(path17.join(os5.tmpdir(), "vidra-zip-"));
   try {
-    execSync3("npm run build", {
-      cwd: project.uiDir,
-      stdio: verbose ? "inherit" : "pipe"
-    });
-  } catch (e) {
+    if (process.platform === "win32") {
+      execFileSync8(
+        "powershell",
+        [
+          "-NoProfile",
+          "-Command",
+          `Expand-Archive -Path "${zipPath}" -DestinationPath "${dir}" -Force`
+        ],
+        { stdio: "pipe" }
+      );
+    } else {
+      execFileSync8("unzip", ["-q", "-o", zipPath, "-d", dir], { stdio: "pipe" });
+    }
+  } catch (error) {
+    fs16.removeSync(dir);
+    throw error;
+  }
+  return { dir, release: () => fs16.removeSync(dir) };
+};
+var mountDiskImage = (dmgPath) => {
+  const mountPoint = fs16.mkdtempSync(path17.join(os5.tmpdir(), "vidra-dmg-mount-"));
+  execFileSync8(
+    "hdiutil",
+    ["attach", dmgPath, "-mountpoint", mountPoint, "-nobrowse", "-quiet"],
+    { stdio: "pipe" }
+  );
+  return {
+    mountPoint,
+    release: () => {
+      try {
+        execFileSync8("hdiutil", ["detach", mountPoint, "-quiet"], { stdio: "pipe" });
+      } catch {
+      }
+      fs16.removeSync(mountPoint);
+    }
+  };
+};
+
+// src/commands/verify.ts
+var verifyCommand = async (argv) => {
+  const args = parseArgs(["_", "_", ...argv]);
+  const explicit = args._[0];
+  const artifact = explicit ?? discoverArtifact();
+  if (!artifact) {
+    console.error();
     console.error(
       row({
         glyph: "error",
-        label: "build UI",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("vite build failed")
+        detail: dim("no artifact given and none found in dist/ \u2014 pass a path")
       })
     );
-    console.error(dim(formatBuildError(e)));
     process.exit(1);
   }
-  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-  console.log(
-    row({
-      glyph: "done",
-      label: "build UI",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("vite \u2192")} ${value("ui/dist")} ${dim(`(${elapsed}s)`)}`
-    })
-  );
-};
-var stepCopyAssets = (project) => {
-  const viteDist = path5.join(project.uiDir, "dist");
-  if (!fs4.existsSync(viteDist)) {
-    console.error(
-      row({
-        glyph: "error",
-        label: "copy assets",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("ui/dist not found \u2014 vite build may have failed")
-      })
+  if (!fs17.existsSync(artifact)) {
+    console.error();
+    console.error(row({ glyph: "error", detail: dim(`not found: ${artifact}`) }));
+    process.exit(1);
+  }
+  console.log();
+  console.log(header("verify", path18.basename(artifact)));
+  console.log(kv("artifact", artifact));
+  console.log();
+  const failures = artifactKind(artifact) === "macos" ? verifyMacArtifact(artifact) : verifyWindowsArtifact(artifact);
+  console.log();
+  if (failures.length > 0) {
+    console.log(
+      footer(dim(`${failures.length} check(s) failed: ${failures.join(", ")}`))
     );
+    console.log();
     process.exit(1);
   }
-  const wwwroot = path5.join(project.hostDir, "Resources", "Raw", "wwwroot");
-  fs4.removeSync(wwwroot);
-  fs4.copySync(viteDist, wwwroot);
-  const fileCount = countFiles(wwwroot);
-  console.log(
-    row({
-      glyph: "done",
-      label: "copy assets",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("\u2192")} ${value("Resources/Raw/wwwroot")} ${dim(`(${fileCount} files)`)}`
-    })
-  );
+  console.log(footer(dim("all checks passed")));
+  console.log();
 };
-var countFiles = (dir) => {
-  let count = 0;
-  for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.isDirectory()) {
-      count += countFiles(path5.join(dir, entry.name));
-    } else {
-      count++;
+var artifactKind = (artifact) => {
+  if (artifact.endsWith(".dmg") || artifact.endsWith(".app")) return "macos";
+  return "windows";
+};
+var verifyMacArtifact = (artifact) => {
+  const failures = [];
+  let appBundle = artifact;
+  let mounted = null;
+  if (artifact.endsWith(".dmg")) {
+    const dmgSig = verifyMacSignature(artifact);
+    report(dmgSig.ok, "dmg signature", dmgSig.ok ? "signed" : "not signed", dmgSig.output);
+    if (!dmgSig.ok) failures.push("dmg signature");
+    const image = mountDiskImage(artifact);
+    mounted = image;
+    const inner = findAppBundle2(image.mountPoint);
+    if (!inner) {
+      image.release();
+      report(false, "app bundle", "no .app inside the disk image");
+      return [...failures, "app bundle"];
     }
+    appBundle = inner;
   }
-  return count;
-};
-var stepDotnetPublish = (project, target, verbose) => {
-  const start = Date.now();
-  const extraArgs = target.extraPublishArgs ?? "-p:CreatePackage=false";
   try {
-    execSync3(
-      `dotnet publish "${project.csprojPath}" -c Release -f ${target.framework} ${extraArgs}`,
-      {
-        cwd: project.root,
-        stdio: verbose ? "inherit" : "pipe"
-      }
+    const sig = verifyMacSignature(appBundle);
+    report(sig.ok, "signature", sig.ok ? "codesign --verify --strict passed" : "FAILED", sig.output);
+    if (!sig.ok) failures.push("signature");
+    const hardening = inspectMacHardening(appBundle);
+    report(
+      hardening.hardened,
+      "hardened runtime",
+      hardening.hardened ? "enabled" : "NOT enabled \u2014 cannot be notarized"
     );
-  } catch (e) {
-    const output = formatBuildError(e);
-    console.error(
+    if (!hardening.hardened) failures.push("hardened runtime");
+    const entitlementsOk = hardening.missing.length === 0;
+    report(
+      entitlementsOk,
+      "entitlements",
+      entitlementsOk ? `${REQUIRED_MAC_ENTITLEMENTS.length} required present` : `missing: ${hardening.missing.join(", ")} \u2014 the .NET JIT will be killed at launch`
+    );
+    if (!entitlementsOk) failures.push("entitlements");
+    const assessment = assessGatekeeper(artifact);
+    console.log(
       row({
-        glyph: "error",
-        label: "publish .NET",
+        glyph: assessment.ok ? "done" : "manual",
+        label: "gatekeeper",
         labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("dotnet publish failed")
+        detail: dim(
+          assessment.ok ? "spctl accepted \u2014 this opens on other Macs" : "spctl rejected \u2014 needs Developer ID + notarization (expected otherwise)"
+        )
       })
     );
-    console.error(dim(output));
-    if (looksLikeMissingWorkload(output)) printWorkloadHint();
-    else if (looksLikeMissingXcode(output)) printXcodeHint();
-    if (!verbose) {
-      console.error(footer(dim("re-run with --verbose for the full build log.")));
-    }
-    process.exit(1);
+  } finally {
+    mounted?.release();
   }
-  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-  console.log(
-    row({
-      glyph: "done",
-      label: "publish .NET",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("Release \xB7")} ${value(target.framework)} ${dim(`(${elapsed}s)`)}`
-    })
-  );
-  return path5.join(project.hostDir, "bin", "Release", target.framework);
+  return failures;
 };
-var stepPackage = async (project, target, bundlePath) => {
-  const outputDir = path5.join(project.root, "dist");
-  fs4.ensureDirSync(outputDir);
-  const start = Date.now();
-  let outputPath;
+var verifyWindowsArtifact = (artifact) => {
+  const failures = [];
+  let extracted = null;
+  let searchRoot = artifact;
+  if (artifact.endsWith(".zip")) {
+    try {
+      const archive = extractArchive(artifact);
+      extracted = archive;
+      searchRoot = archive.dir;
+    } catch (error) {
+      report(false, "archive", `could not open ${path18.basename(artifact)}`, String(error));
+      return ["archive"];
+    }
+  }
   try {
-    outputPath = await target.package(bundlePath, outputDir, {
-      projectName: project.projectName,
-      displayVersion: project.displayVersion
-    });
-  } catch (e) {
-    console.error(
-      row({
-        glyph: "error",
-        label: packageLabel(target),
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("packaging failed")
-      })
+    const exe = artifact.endsWith(".exe") ? artifact : findWindowsExecutableRecursive(searchRoot);
+    if (!exe) {
+      report(false, "executable", `no .exe found under ${artifact}`);
+      return ["executable"];
+    }
+    console.log(kv("executable", path18.basename(exe)));
+    const sig = verifyWindowsSignature(exe);
+    report(
+      sig.ok,
+      "authenticode",
+      sig.untrustedRoot ? "signed and intact; chain not trusted (expected for a self-signed certificate)" : sig.ok ? "signature verified and trusted" : "not signed or not verifiable",
+      sig.output
     );
-    console.error(dim(formatProcessError(e)));
-    process.exit(1);
+    if (!sig.ok) failures.push("authenticode");
+  } finally {
+    extracted?.release();
   }
-  const pkgTime = ((Date.now() - start) / 1e3).toFixed(1);
-  const sizeMB = (fs4.statSync(outputPath).size / (1024 * 1024)).toFixed(1);
+  return failures;
+};
+var report = (ok, label, detail, output) => {
   console.log(
     row({
-      glyph: "done",
-      label: packageLabel(target),
+      glyph: ok ? "done" : "error",
+      label,
       labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(path5.basename(outputPath))} ${dim(`(${sizeMB} MB, ${pkgTime}s)`)}`
+      detail: dim(detail)
     })
   );
-  return outputPath;
+  if (!ok && output) console.error(dim(output.trim()));
+};
+var discoverArtifact = () => {
+  const project = detectProject(process.cwd());
+  const dist = path18.join(project.root, "dist");
+  if (!fs17.existsSync(dist)) return null;
+  const wanted = detectPlatform() === "windows" ? ".zip" : ".dmg";
+  const candidates = fs17.readdirSync(dist).filter((f) => f.endsWith(wanted)).map((f) => path18.join(dist, f)).sort((a, b) => fs17.statSync(b).mtimeMs - fs17.statSync(a).mtimeMs);
+  return candidates[0] ?? null;
 };
 
 // src/commands/dev.ts
-import path6 from "path";
-import fs5 from "fs-extra";
-import { execFileSync as execFileSync4, spawn as spawn2 } from "child_process";
+import path19 from "path";
+import fs18 from "fs-extra";
+import { execFileSync as execFileSync9, spawn as spawn2 } from "child_process";
 import { request } from "http";
 
 // src/dev-port.ts
@@ -1092,11 +3263,11 @@ var selectDevServerUrl = async (configuredUrl, options = {}) => {
     name: "port",
     message: `Port ${port} is already in use. Choose another port:`,
     initial: suggestedPort,
-    validate: async (value2) => {
-      if (!isValidPort(value2)) {
+    validate: async (value3) => {
+      if (!isValidPort(value3)) {
         return `Enter a port between ${MIN_PORT} and ${MAX_PORT}`;
       }
-      return await probe(value2, url.hostname) || `Port ${value2} is already in use`;
+      return await probe(value3, url.hostname) || `Port ${value3} is already in use`;
     }
   });
   const selectedPort = result.port;
@@ -1116,6 +3287,7 @@ var POLL_TIMEOUT_MS = 3e4;
 var NPM_COMMAND = process.platform === "win32" ? "npm.cmd" : "npm";
 var DOTNET_COMMAND = process.platform === "win32" ? "dotnet.exe" : "dotnet";
 var WATCH_OUTPUT_TAIL_CHARS = 8192;
+var HOST_TERMINATION_TIMEOUT_MS = 5e3;
 var TARGETS2 = {
   macos: {
     name: "macos",
@@ -1132,7 +3304,7 @@ var startSession = async (argv, opts) => {
   const args = parseArgs(["_", "_", ...argv]);
   const targetName = args["target"] || detectPlatform();
   const verbose = !!args["verbose"];
-  let hotReload = opts.hotReloadDefault && !args["no-hot-reload"];
+  const hotReload = opts.hotReloadDefault && !args["no-hot-reload"];
   let viteUrl = process.env.VIDRA_DEV_URL || "http://localhost:5173";
   const target = TARGETS2[targetName];
   if (!target) {
@@ -1150,20 +3322,6 @@ var startSession = async (argv, opts) => {
   if (!await ensureMauiWorkload({ csprojPath: project.csprojPath })) {
     process.exit(1);
   }
-  if (hotReload && target.name === "macos") {
-    const blocker = macCatalystHotReloadBlocker();
-    if (blocker) {
-      hotReload = false;
-      console.log();
-      console.log(
-        row({
-          glyph: "manual",
-          detail: `${dim(blocker.reason + "; using a classic launch")}`
-        })
-      );
-      console.log(fixLine(blocker.fix));
-    }
-  }
   if (opts.vite) {
     viteUrl = await selectDevServerUrl(viteUrl);
   }
@@ -1173,6 +3331,8 @@ var startSession = async (argv, opts) => {
   });
   await session.run();
 };
+var watchStrategyFor = (_targetName) => "delta";
+var DELTA_CHANNEL_DEAD_WARNING = "further changes won't be applied to this process";
 var buildDotnetWatchArgs = (opts) => [
   "watch",
   "--project",
@@ -1181,21 +3341,23 @@ var buildDotnetWatchArgs = (opts) => [
   // paired with DOTNET_WATCH_RESTART_ON_RUDE_EDIT for older SDKs.
   "--non-interactive",
   ...opts.verbose ? ["--verbose"] : [],
-  "run",
+  opts.strategy === "rebuild" ? "build" : "run",
   "-f",
   opts.framework,
   "-c",
   opts.buildConfig,
-  // Launch the Mac Catalyst app by exec'ing the binary rather than `open -a`,
-  // so the environment (VIDRA_DEV_URL, DOTNET_STARTUP_HOOKS) propagates and
-  // stdout streams back. Ignored by targets that don't define the property.
-  ...opts.targetName === "macos" ? ["--property:RunWithOpen=false"] : []
+  ...opts.strategy === "delta" && opts.framework.includes("maccatalyst") ? ["--property:RunWithOpen=false"] : []
 ];
 var dotnetWatchEnv = (devUrl) => ({
   VIDRA_DEV_URL: devUrl,
   DOTNET_WATCH_RESTART_ON_RUDE_EDIT: "1",
   DOTNET_WATCH_SUPPRESS_EMOJIS: "1",
-  DOTNET_WATCH_SUPPRESS_LAUNCH_BROWSER: "1"
+  DOTNET_WATCH_SUPPRESS_LAUNCH_BROWSER: "1",
+  // The session reads the loop's state out of watch and MSBuild output
+  // ("Build succeeded.", "Waiting for a file to change"), so the child must
+  // speak the language those patterns are written in. Without this a localized
+  // SDK silently breaks the dev loop for everyone whose machine isn't English.
+  DOTNET_CLI_UI_LANGUAGE: "en"
 });
 var buildViteArgs = (devUrl) => [
   "run",
@@ -1207,14 +3369,40 @@ var buildViteArgs = (devUrl) => [
 ];
 var HOST_READY_SENTINEL = "[vidra] host ready";
 var classifyWatchLine = (line) => {
+  if (line.toLowerCase().includes(DELTA_CHANNEL_DEAD_WARNING)) {
+    return "deltaChannelDead";
+  }
   if (/waiting for a file to change/i.test(line)) return "appWaiting";
   if (/fix the error to continue/i.test(line)) return "buildBlocked";
   if (line.includes(HOST_READY_SENTINEL)) return "appStarted";
+  if (/^\s*build succeeded\b/i.test(line)) return "buildSucceeded";
+  if (/^\s*build failed\b/i.test(line)) return "buildFailed";
   if (/\bwatch\b/i.test(line) && /\b(?:started|launched)\b/i.test(line)) {
     return "appStarted";
   }
   return null;
 };
+var watchReaction = (event, ctx) => {
+  if (event === "appStarted") {
+    return ctx.hostLaunched ? "none" : "markHostReady";
+  }
+  if (event === "deltaChannelDead") {
+    return ctx.strategy === "delta" ? "switchToRebuild" : "none";
+  }
+  if (ctx.strategy === "rebuild") {
+    if (event === "buildSucceeded") return "launchHost";
+    if (event === "buildFailed") return "reportBuildFailed";
+    if (event === "appWaiting" || event === "buildBlocked") {
+      return ctx.everBuilt || ctx.buildOutcome !== null ? "none" : "reportEarlyExit";
+    }
+    return "none";
+  }
+  if (event === "appWaiting" || event === "buildBlocked") {
+    if (ctx.hostLaunched) return "reportAppIdle";
+    return ctx.buildOutcome === "failed" ? "reportBuildFailed" : "reportEarlyExit";
+  }
+  return "none";
+};
 var DevSession = class {
   constructor(project, target, viteUrl, verbose, options) {
     this.project = project;
@@ -1223,6 +3411,7 @@ var DevSession = class {
     this.verbose = verbose;
     this.vite = options.vite;
     this.hotReload = options.hotReload;
+    this.strategy = watchStrategyFor(target.name);
   }
   project;
   target;
@@ -1232,6 +3421,9 @@ var DevSession = class {
   buildConfig = process.env.VIDRA_BUILD_CONFIG || "Debug";
   vite;
   hotReload;
+  // Not readonly: a session that watches its delta channel die moves itself to
+  // the rebuild loop (see WatchStrategy).
+  strategy;
   shuttingDown = false;
   // Watch-mode state: `watchChild` is the `dotnet watch` process (a process
   // group leader on unix, so shutdown can signal it and the app it launched
@@ -1239,11 +3431,34 @@ var DevSession = class {
   watchChild;
   watchReady = false;
   watchOutputTail = "";
+  buildOutcome = null;
+  everBuilt = false;
+  // `"rebuild"` state: the app process we own, and a guard so that overlapping
+  // build cycles (save twice in a row) can't spawn two hosts at once.
+  hostChild;
+  relaunching = false;
+  relaunchPending = false;
+  fellBackToClassic = false;
   endSession = () => {
   };
   sessionDone = new Promise((resolve) => {
     this.endSession = resolve;
   });
+  /** How C# edits reach the app, in words the user can trust. */
+  get csharpLoopLabel() {
+    return this.strategy === "rebuild" ? "C# rebuild + relaunch" : "C# hot reload active";
+  }
+  /**
+   * The banner word for the loop as a whole. UI edits always hot reload; the
+   * banner only stops saying so when the C# half of the loop cannot.
+   */
+  get loopHeadline() {
+    return this.hotReload && this.strategy === "rebuild" ? "reload on save active" : "hot reload active";
+  }
+  /** The same, phrased for the footer's "watching …" line. */
+  get csharpLoopSuffix() {
+    return this.strategy === "rebuild" ? "C# rebuild + relaunch on save" : "hot reload on save";
+  }
   async run() {
     this.installSignalHandlers();
     console.log();
@@ -1272,20 +3487,20 @@ var DevSession = class {
       );
     }
     this.launchHost();
-    const hostDirLabel = `src/${path6.basename(this.project.hostDir)}`;
+    const hostDirLabel = `src/${path19.basename(this.project.hostDir)}`;
     if (this.vite) {
       console.log(
         taggedRow(
           "active",
           null,
-          this.hotReload ? `${lime("hot reload active")} ${dim(`\u2014 edit ui/src or ${hostDirLabel} and save`)}` : `${lime("hot reload active")} ${dim("\u2014 edit ui/src and save")}`
+          this.hotReload ? `${lime(this.loopHeadline)} ${dim(`\u2014 edit ui/src or ${hostDirLabel} and save`)}` : `${lime(this.loopHeadline)} ${dim("\u2014 edit ui/src and save")}`
         )
       );
       console.log();
       console.log(
         footer(
           this.hotReload ? `${dim("watching")} ${value("ui/")} ${dim("\xB7")} ${value(`${hostDirLabel}/`)} ${dim(
-            "\xB7 hot reload on save \xB7 ctrl-c to stop"
+            `\xB7 ${this.csharpLoopSuffix} \xB7 ctrl-c to stop`
           )}` : `${dim("watching")} ${value("ui/")} ${dim(
             "\xB7 hot reload on save \xB7 ctrl-c to stop"
           )}`
@@ -1340,7 +3555,7 @@ var DevSession = class {
         framework: this.target.framework,
         buildConfig: this.buildConfig,
         verbose: this.verbose,
-        targetName: this.target.name
+        strategy: this.strategy
       }),
       {
         cwd: this.project.root,
@@ -1361,6 +3576,7 @@ var DevSession = class {
     scanStream(watch.stderr, (line) => this.onWatchLine(line));
     watch.on("exit", (code, signal) => {
       if (this.shuttingDown) return;
+      if (this.watchChild !== watch) return;
       if (this.watchReady) {
         const failed = code !== null && code !== 0 || signal !== null;
         if (failed) {
@@ -1395,58 +3611,191 @@ var DevSession = class {
       -WATCH_OUTPUT_TAIL_CHARS
     );
     const event = classifyWatchLine(line);
-    if (event === "appStarted" && !this.watchReady) {
-      this.watchReady = true;
-      console.log(
-        taggedRow(
-          "done",
-          "host",
-          `${dim("launched")} ${value(this.project.projectName)} ${dim("\u2014 C# hot reload active")}`
-        )
-      );
-      return;
+    if (event === "buildSucceeded" || event === "buildFailed") {
+      this.buildOutcome = event === "buildSucceeded" ? "succeeded" : "failed";
+      this.everBuilt = true;
     }
-    if (event !== "appWaiting" && event !== "buildBlocked" || this.shuttingDown) {
-      return;
-    }
-    if (this.watchReady) {
-      console.log(
-        taggedRow(
-          "manual",
-          "host",
-          dim("app not running \u2014 save a C# file to relaunch, or ctrl-c to stop")
-        )
-      );
-      return;
+    if (this.shuttingDown) return;
+    const reaction = watchReaction(event, {
+      strategy: this.strategy,
+      hostLaunched: this.watchReady,
+      buildOutcome: this.buildOutcome,
+      everBuilt: this.everBuilt
+    });
+    if (event === "appWaiting" || event === "buildBlocked") {
+      this.buildOutcome = null;
     }
-    if (!/Build FAILED/i.test(this.watchOutputTail)) {
-      console.log(
-        taggedRow(
-          "manual",
-          "host",
-          dim(
-            "app exited before it was ready \u2014 save a C# file to relaunch, or ctrl-c to stop"
+    switch (reaction) {
+      case "markHostReady":
+        this.announceHostLaunched(line.includes(HOST_READY_SENTINEL));
+        return;
+      case "launchHost":
+        void this.launchOrRelaunchHost();
+        return;
+      case "switchToRebuild":
+        void this.switchToRebuildLoop();
+        return;
+      case "reportAppIdle":
+        console.log(
+          taggedRow(
+            "manual",
+            "host",
+            dim("app not running \u2014 save a C# file to relaunch, or ctrl-c to stop")
           )
-        )
-      );
+        );
+        return;
+      case "reportEarlyExit":
+        console.log(
+          taggedRow(
+            "manual",
+            "host",
+            dim(
+              "app exited before it was ready \u2014 save a C# file to relaunch, or ctrl-c to stop"
+            )
+          )
+        );
+        return;
+      case "reportBuildFailed":
+        if (!this.watchReady) {
+          if (looksLikeMissingWorkload(this.watchOutputTail)) printWorkloadHint();
+          else if (looksLikeXcodeTooOld(this.watchOutputTail)) printXcodeTooOldHint();
+          else if (looksLikeMissingXcode(this.watchOutputTail)) printXcodeHint();
+        }
+        console.log(
+          taggedRow(
+            "manual",
+            "host",
+            dim("build failed \u2014 fix the error and save to retry, or ctrl-c to stop")
+          )
+        );
+        return;
+      case "none":
+        return;
+    }
+  }
+  /**
+   * A host we spawned ourselves reached VidraPage. Reported per launch, not
+   * per session: under the "rebuild" loop each save produces a new one, and
+   * "the app is back up" is the thing the developer is waiting to see.
+   */
+  onHostReady() {
+    if (this.shuttingDown) return;
+    this.watchReady = true;
+    const loop = this.hotReload ? ` ${dim(`\xB7 ${this.csharpLoopSuffix}`)}` : "";
+    console.log(
+      taggedRow(
+        "done",
+        "host",
+        `${dim("host ready \u2014")} ${value(this.project.projectName)}${loop}`
+      )
+    );
+  }
+  /**
+   * The app the watcher launched is up. Says "host ready" when the app told us
+   * so itself (the VidraPage sentinel) and "launched" when all we have is the
+   * watcher's own start message, which only means a process was spawned. Both
+   * paths through the session — this one and {@link onHostReady} — report
+   * readiness in the same words, so "the app is up" is one thing to look for
+   * rather than two.
+   */
+  announceHostLaunched(sawSentinel) {
+    if (this.watchReady) return;
+    this.watchReady = true;
+    const loop = dim(`\xB7 ${this.csharpLoopSuffix}`);
+    console.log(
+      taggedRow(
+        "done",
+        "host",
+        sawSentinel ? `${dim("host ready \u2014")} ${value(this.project.projectName)} ${loop}` : `${dim("launched")} ${value(this.project.projectName)} ${dim(`\u2014 ${this.csharpLoopLabel}`)}`
+      )
+    );
+  }
+  /**
+   * "rebuild" strategy: a build just succeeded, so replace the running app with
+   * the one that was built. Serialized, because a burst of saves produces a
+   * burst of successful builds and two hosts must never run at once — the
+   * last request wins.
+   */
+  async launchOrRelaunchHost() {
+    if (this.shuttingDown) return;
+    if (this.relaunching) {
+      this.relaunchPending = true;
       return;
     }
-    if (looksLikeMissingWorkload(this.watchOutputTail)) printWorkloadHint();
-    else if (looksLikeXcodeTooOld(this.watchOutputTail)) printXcodeTooOldHint();
-    else if (looksLikeMissingXcode(this.watchOutputTail)) printXcodeHint();
+    this.relaunching = true;
+    try {
+      do {
+        this.relaunchPending = false;
+        const previous = this.hostChild;
+        if (previous) {
+          this.hostChild = void 0;
+          console.log(taggedRow("active", "host", dim("relaunching\u2026")));
+          killChild(previous);
+          await waitForExit(previous, HOST_TERMINATION_TIMEOUT_MS);
+        }
+        if (this.shuttingDown) return;
+        this.hostChild = this.spawnMacosHost({ fatal: false }) ?? void 0;
+        if (this.hostChild) this.watchReady = true;
+      } while (this.relaunchPending && !this.shuttingDown);
+    } finally {
+      this.relaunching = false;
+    }
+  }
+  /**
+   * The hot reload agent is gone and `dotnet watch` has stopped trying to reach
+   * it. Every later edit would be applied to nothing while the watcher keeps
+   * reporting success, so the session stops asking for deltas and drives the
+   * loop itself: the watcher is restarted as `dotnet watch build`, and each
+   * successful build relaunches the app.
+   *
+   * Restarting the watcher also takes the app down with it (it leads the
+   * process group), which is what makes the first rebuild land on a clean
+   * process instead of one whose agent has already given up.
+   */
+  async switchToRebuildLoop() {
+    if (this.shuttingDown || this.strategy !== "delta") return;
+    this.strategy = "rebuild";
+    console.log();
     console.log(
       taggedRow(
         "manual",
         "host",
-        dim("build failed \u2014 fix the error and save to retry, or ctrl-c to stop")
+        dim(
+          "the hot reload agent dropped out \u2014 dotnet watch would keep reporting edits as applied"
+        )
+      )
+    );
+    console.log(
+      taggedRow(
+        "active",
+        "host",
+        dim("switching this session to rebuild + relaunch on save\u2026")
       )
     );
+    console.log(
+      footer(
+        dim(
+          "a known Mac Catalyst flake (dotnet/sdk#55488) \u2014 restarting vidra dev often gets deltas back"
+        )
+      )
+    );
+    console.log();
+    const previous = this.watchChild;
+    this.watchChild = void 0;
+    if (previous) {
+      killChild(previous, { processGroup: true });
+      await waitForExit(previous, HOST_TERMINATION_TIMEOUT_MS);
+    }
+    if (this.shuttingDown) return;
+    this.buildOutcome = null;
+    this.everBuilt = false;
+    this.launchHostWithWatch();
   }
   /**
-   * `dotnet watch` exited before the app ever started — typically an SDK or
-   * MAUI workload set that predates `dotnet run`/`dotnet watch` support for
-   * this target. Explain why, then launch the host the classic way (one
-   * build + direct spawn) so the dev session still works, minus C# hot reload.
+   * `dotnet watch` exited before the app ever started — an incomplete SDK or
+   * MAUI workload install, usually. Explain why, then launch the host the
+   * classic way (one build + direct spawn) so the dev session still works,
+   * minus anything that reacts to a C# edit.
    */
   fallBackToClassicLaunch(code, signal) {
     console.log();
@@ -1454,11 +3803,12 @@ var DevSession = class {
       taggedRow(
         "manual",
         "host",
-        `${dim("C# hot reload unavailable \u2014 dotnet watch exited with")} ${value(
+        `${dim("the C# watch loop is unavailable \u2014 dotnet watch exited with")} ${value(
           signal ? `signal ${signal}` : `code ${code ?? "unknown"}`
         )}`
       )
     );
+    this.fellBackToClassic = true;
     if (looksLikeMissingWorkload(this.watchOutputTail)) {
       printWorkloadHint();
     } else if (looksLikeXcodeTooOld(this.watchOutputTail)) {
@@ -1468,9 +3818,7 @@ var DevSession = class {
     } else {
       console.log(
         footer(
-          dim(
-            "C# hot reload needs the .NET 10.0.203+ workload set (Mac Catalyst dotnet-watch support) \u2014 try:"
-          )
+          dim("nothing in the output explains it \u2014 an incomplete toolchain is the usual cause:")
         )
       );
       console.log(fixLine("dotnet workload update"));
@@ -1506,7 +3854,7 @@ var DevSession = class {
       )
     );
     try {
-      execFileSync4(
+      execFileSync9(
         DOTNET_COMMAND,
         [
           "build",
@@ -1535,22 +3883,37 @@ var DevSession = class {
   }
   launchMacosHost() {
     this.buildHostSync();
+    const host = this.spawnMacosHost({ fatal: true });
+    if (!host) process.exit(1);
+    return host;
+  }
+  /**
+   * Locate the built `.app`, sign it if we can, and spawn its executable.
+   *
+   * Split out from {@link launchMacosHost} because the watch loop reaches this
+   * point with the build already done — and, unlike a one-shot launch, must
+   * survive a bad outcome: under `"rebuild"` the session stays alive so the
+   * next save can put things right, hence `fatal: false` returning null rather
+   * than exiting the process.
+   */
+  spawnMacosHost(opts) {
+    const outputDir = path19.join(
+      this.project.hostDir,
+      "bin",
+      this.buildConfig,
+      this.target.framework
+    );
+    const fail2 = (detail) => {
+      console.error(row({ glyph: "error", detail: dim(detail) }));
+      if (opts.fatal) process.exit(1);
+      return null;
+    };
     const appBundle = findMacAppBundle(
       this.project.hostDir,
       this.target.framework,
       this.buildConfig
     );
-    if (!appBundle) {
-      console.error(
-        row({
-          glyph: "error",
-          detail: dim(
-            `could not find .app bundle in ${path6.join(this.project.hostDir, "bin", this.buildConfig, this.target.framework)}`
-          )
-        })
-      );
-      process.exit(1);
-    }
+    if (!appBundle) return fail2(`could not find .app bundle in ${outputDir}`);
     signMacAppBundleIfPossible(appBundle, {
       verbose: this.verbose,
       log: console.log,
@@ -1558,23 +3921,17 @@ var DevSession = class {
     });
     const binary = findMacExecutable(appBundle);
     if (!binary) {
-      console.error(
-        row({
-          glyph: "error",
-          detail: dim(`could not find the app executable in ${appBundle}`)
-        })
-      );
-      process.exit(1);
+      return fail2(`could not find the app executable in ${appBundle}`);
     }
     console.log(
-      taggedRow("done", "host", `${dim("launched")} ${value(path6.basename(appBundle))}`)
+      taggedRow("active", "host", `${dim("launching")} ${value(path19.basename(appBundle))}${dim("\u2026")}`)
     );
     const host = spawn2(binary, [], {
       cwd: this.project.root,
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, VIDRA_DEV_URL: this.viteUrl }
     });
-    return this.registerChild(host, "host", path6.basename(binary));
+    return this.registerChild(host, "host", path19.basename(binary));
   }
   // Build first, then spawn the produced .exe directly. A single
   // `dotnet build -t:Run` on an unpackaged MAUI Windows app
@@ -1586,7 +3943,7 @@ var DevSession = class {
   // See dotnet/maui#13942 and dotnet/maui#5975.
   launchWindowsHost() {
     this.buildHostSync();
-    const exe = findWindowsExecutable(
+    const exe = findWindowsExecutable2(
       this.project.hostDir,
       this.project.csprojPath,
       this.target.framework,
@@ -1597,28 +3954,36 @@ var DevSession = class {
         row({
           glyph: "error",
           detail: dim(
-            `could not find the host .exe under ${path6.join(this.project.hostDir, "bin", this.buildConfig, this.target.framework)}`
+            `could not find the host .exe under ${path19.join(this.project.hostDir, "bin", this.buildConfig, this.target.framework)}`
           )
         })
       );
       process.exit(1);
     }
     console.log(
-      taggedRow("done", "host", `${dim("launched")} ${value(path6.basename(exe))}`)
+      taggedRow("active", "host", `${dim("launching")} ${value(path19.basename(exe))}${dim("\u2026")}`)
     );
     const host = spawn2(exe, [], {
-      cwd: path6.dirname(exe),
+      cwd: path19.dirname(exe),
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, VIDRA_DEV_URL: this.viteUrl }
     });
-    return this.registerChild(host, "host", path6.basename(exe));
+    return this.registerChild(host, "host", path19.basename(exe));
   }
   registerChild(child, tag2, label) {
     this.children.push(child);
     const include = tag2 === "host" ? (line) => !line.includes(HOST_READY_SENTINEL) : void 0;
     prefixStream(child.stdout, tag2, include);
     prefixStream(child.stderr, tag2, include);
+    if (tag2 === "host") {
+      const onLine = (line) => {
+        if (line.includes(HOST_READY_SENTINEL)) this.onHostReady();
+      };
+      scanStream(child.stdout, onLine);
+      scanStream(child.stderr, onLine);
+    }
     child.on("exit", (code, signal) => {
+      this.forgetChild(child);
       if (this.shuttingDown) return;
       if (tag2 === "ui") {
         const exitCode = code ?? 1;
@@ -1628,6 +3993,18 @@ var DevSession = class {
         this.shutdown(exitCode);
         return;
       }
+      if (this.ownsHostProcess) {
+        if (child !== this.hostChild) return;
+        this.hostChild = void 0;
+        console.log(
+          taggedRow(
+            "manual",
+            "host",
+            dim("app not running \u2014 save a C# file to relaunch, or ctrl-c to stop")
+          )
+        );
+        return;
+      }
       const failed = code !== null && code !== 0 || signal !== null;
       if (failed) {
         console.error(
@@ -1656,10 +4033,23 @@ var DevSession = class {
     });
     return child;
   }
+  /**
+   * True while the "rebuild" loop is driving the app rather than the watcher.
+   * Goes false once we fall back to a classic launch: there is no watcher left
+   * to relaunch anything, so a host exit ends the session as it always did.
+   */
+  get ownsHostProcess() {
+    return this.hotReload && this.strategy === "rebuild" && !this.fellBackToClassic;
+  }
+  /** Drop an exited child so a long session's relaunches don't accumulate. */
+  forgetChild(child) {
+    const index = this.children.indexOf(child);
+    if (index !== -1) this.children.splice(index, 1);
+  }
   shutdown(exitCode) {
     if (this.shuttingDown) return;
     this.shuttingDown = true;
-    for (const child of this.children) {
+    for (const child of [...this.children]) {
       killChild(child, { processGroup: child === this.watchChild });
     }
     this.endSession();
@@ -1738,13 +4128,13 @@ var waitForServer = (url, timeoutMs) => {
   });
 };
 var findMacAppBundle = (hostDir, framework, buildConfig) => {
-  const outputDir = path6.join(hostDir, "bin", buildConfig, framework);
+  const outputDir = path19.join(hostDir, "bin", buildConfig, framework);
   return findAppBundleRecursive(outputDir);
 };
 var findAppBundleRecursive = (dir) => {
-  if (!fs5.existsSync(dir)) return null;
-  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path6.join(dir, entry.name);
+  if (!fs18.existsSync(dir)) return null;
+  for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path19.join(dir, entry.name);
     if (entry.isDirectory() && entry.name.endsWith(".app")) {
       return fullPath;
     }
@@ -1756,45 +4146,59 @@ var findAppBundleRecursive = (dir) => {
   return null;
 };
 var findMacExecutable = (appBundle) => {
-  const macOsDir = path6.join(appBundle, "Contents", "MacOS");
-  if (!fs5.existsSync(macOsDir)) return null;
-  for (const entry of fs5.readdirSync(macOsDir, { withFileTypes: true })) {
+  const macOsDir = path19.join(appBundle, "Contents", "MacOS");
+  if (!fs18.existsSync(macOsDir)) return null;
+  for (const entry of fs18.readdirSync(macOsDir, { withFileTypes: true })) {
     if (entry.isFile()) {
-      return path6.join(macOsDir, entry.name);
+      return path19.join(macOsDir, entry.name);
     }
   }
   return null;
 };
-var findWindowsExecutable = (hostDir, csprojPath, framework, buildConfig) => {
-  const outputDir = path6.join(hostDir, "bin", buildConfig, framework);
-  if (!fs5.existsSync(outputDir)) return null;
-  const exeName = `${path6.basename(csprojPath, ".csproj")}.exe`.toLowerCase();
+var findWindowsExecutable2 = (hostDir, csprojPath, framework, buildConfig) => {
+  const outputDir = path19.join(hostDir, "bin", buildConfig, framework);
+  if (!fs18.existsSync(outputDir)) return null;
+  const exeName = `${path19.basename(csprojPath, ".csproj")}.exe`.toLowerCase();
   return findFileRecursive(outputDir, (name) => name.toLowerCase() === exeName) ?? findFileRecursive(
     outputDir,
     (name) => name.toLowerCase().endsWith(".host.exe")
   ) ?? findFileRecursive(outputDir, (name) => name.toLowerCase().endsWith(".exe"));
 };
 var findFileRecursive = (dir, match) => {
-  if (!fs5.existsSync(dir)) return null;
-  const entries = fs5.readdirSync(dir, { withFileTypes: true });
+  if (!fs18.existsSync(dir)) return null;
+  const entries = fs18.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && match(entry.name)) {
-      return path6.join(dir, entry.name);
+      return path19.join(dir, entry.name);
     }
   }
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      const found = findFileRecursive(path6.join(dir, entry.name), match);
+      const found = findFileRecursive(path19.join(dir, entry.name), match);
       if (found) return found;
     }
   }
   return null;
 };
+var waitForExit = (child, timeoutMs) => new Promise((resolve) => {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    resolve();
+    return;
+  }
+  const timer = setTimeout(() => {
+    child.kill("SIGKILL");
+    resolve();
+  }, timeoutMs);
+  child.once("exit", () => {
+    clearTimeout(timer);
+    resolve();
+  });
+});
 var killChild = (child, opts = {}) => {
   if (!child.pid || child.exitCode !== null) return;
   if (process.platform === "win32") {
     try {
-      execFileSync4("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
+      execFileSync9("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
         stdio: "ignore"
       });
     } catch {
@@ -1846,9 +4250,12 @@ var printHelp = () => {
     ${lime("vidra")} ${dim("<command> [options]")}
 
   ${dim("commands")}
-${cmd("dev", "start vite + the native host (UI + C# hot reload)")}
+${cmd("dev", "start vite + the native host (UI + C# reload on save)")}
 ${cmd("run", "launch the native host only")}
 ${cmd("build", "build & package for distribution")}
+${cmd("bundle", "pack ui/dist as an OTA bundle + update its feed")}
+${cmd("keygen", "create the key that signs your update feed")}
+${cmd("verify", "check a built artifact is actually shippable")}
 ${cmd("doctor", "check your environment")}
 ${cmd("help", "show this message")}
 
@@ -1857,6 +4264,12 @@ ${ex("dev --target windows", "run the windows host")}
 ${ex("dev --no-hot-reload", "skip dotnet watch, classic launch")}
 ${ex("build --plan", "preview the build, run nothing")}
 ${ex("build --target macos", "build & package a macOS DMG")}
+${ex("bundle", "pack an OTA bundle into dist/")}
+${ex("bundle --channel beta", "publish it on the beta channel")}
+${ex("bundle --sign key.pem", "publish a signed feed")}
+${ex("bundle --merge-from URL", "add to the feed you already publish")}
+${ex("keygen", "create an update signing key")}
+${ex("verify", "check the newest artifact in dist/")}
 ${ex("doctor", "verify .NET SDK + MAUI workload")}
 `);
 };
@@ -1873,6 +4286,15 @@ var main = async () => {
     case "build":
       await buildCommand(args.slice(1));
       break;
+    case "bundle":
+      await bundleCommand(args.slice(1));
+      break;
+    case "keygen":
+      await keygenCommand(args.slice(1));
+      break;
+    case "verify":
+      await verifyCommand(args.slice(1));
+      break;
     case "doctor":
       process.exit(await runDoctor());
       break;