create-vidra-app 0.3.1 → 0.5.0

package/README.md

@@ -1,53 +1,46 @@
 # create-vidra-app
 
-Scaffold a new [Vidra](https://vidra.build) application — a
-**React UI + .NET MAUI native host**, shipped from a single codebase.
+Scaffold a [Vidra](https://vidra.build) desktop app with a web UI and a
+C#/.NET native host.
 
-> **Alpha.** APIs and templates may change between 0.x releases.
+> **Alpha:** APIs and templates may change between 0.x releases.
 
-## Usage
+## Create an app
 
 ```bash
 npm create vidra-app@latest
 # or
 npx create-vidra-app my-app
-```
-
-You'll be prompted for a project name and an app ID (reverse-domain). Then:
 
-```bash
 cd my-app
-npm run dev   # starts Vite + the native host together
+npm run dev
 ```
 
-Scaffolded apps get the `vidra` CLI as a local dev dependency — there's no
-global `vidra` to install. Run it from inside your project via the npm scripts
-or `npx`:
+The generated project depends on [`vidra-cli`](https://www.npmjs.com/package/vidra-cli),
+which provides the `vidra` command. This package is only needed to create the
+app; nothing depends on it afterwards. Use the provided npm scripts or run
+`vidra` through `npx`; no global install is required.
 
-```bash
-npm run dev                     # start Vite + native host
-npm run build                   # build + package for distribution
-npm run doctor                  # check your .NET / MAUI / Xcode setup
-npx vidra dev --target windows  # run a specific desktop target
-npx vidra build --target macos  # build + package a macOS .dmg
-```
-
-## Prerequisites
+## Requirements
 
 - .NET 10 SDK
-- The .NET MAUI workload: `dotnet workload install maui`
-- Node.js 18+
-- macOS targets require Xcode; Windows targets must be built on Windows
+- .NET MAUI workload: `dotnet workload install maui`
+- Node.js 22 or newer
+- Xcode for macOS builds
+
+Windows targets must be built on Windows.
 
-If the MAUI workload is missing, `create-vidra-app` will detect it after
-scaffolding and offer to install it for you. You can re-check at any time with
-`npm run doctor`. 
+## Common commands
 
-## Links
+```bash
+npm run dev
+npm run build
+npm run doctor
+npx vidra --help
+```
 
-- Website: [vidra.build](https://vidra.build)
-- GitHub: [rzamfiriu/vidra](https://github.com/rzamfiriu/vidra)
-- npm: [create-vidra-app](https://www.npmjs.com/package/create-vidra-app)
+See the [getting started guide](https://vidra.build/docs/getting-started/) for
+project structure, development, and build options.
 
 ## License
 

package/dist/index.js

@@ -5,7 +5,7 @@ import path2 from "path";
 import { randomUUID } from "crypto";
 import { fileURLToPath } from "url";
 
-// src/utils.ts
+// ../shared/src/utils.ts
 var toPascalCase = (str) => {
   return str.replace(
     /[-_]+(.)?/g,
@@ -42,11 +42,13 @@ var parseArgs = (argv) => {
   }
   return args;
 };
+var splitLines = (text) => text.split(/\r?\n/);
+var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
 
-// src/exec.ts
-import { execSync, spawn } from "child_process";
+// ../shared/src/exec.ts
+import { execFileSync, execSync, spawn } from "child_process";
 
-// src/theme.ts
+// ../shared/src/theme.ts
 import chalk from "chalk";
 var lime = chalk.hex("#c8f751");
 var value = chalk.hex("#e8e8ec");
@@ -88,11 +90,28 @@ var row = (opts) => {
 var footer = (content) => `  ${content}`;
 var fixLine = (cmd, label = "fix:") => `      ${amber(label)} ${lime(cmd)}`;
 
-// src/exec.ts
+// ../shared/src/exec.ts
 var toText = (value2) => {
   if (value2 == null) return "";
   return Buffer.isBuffer(value2) ? value2.toString() : value2;
 };
+var run = (cmd, args) => {
+  try {
+    const stdout = execFileSync(cmd, args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { found: true, ok: true, stdout: stdout ?? "", stderr: "" };
+  } catch (e) {
+    const err = e;
+    return {
+      found: err.code !== "ENOENT",
+      ok: false,
+      stdout: toText(err.stdout),
+      stderr: toText(err.stderr)
+    };
+  }
+};
 var formatProcessError = (error) => {
   const err = error;
   const combined = [toText(err.stderr), toText(err.stdout)].map((s) => s.trim()).filter((s) => s.length > 0).join("\n").trim();
@@ -169,31 +188,12 @@ var applyReplacements = (str, replacements) => {
   return str;
 };
 
-// src/doctor.ts
-import { execFileSync } from "child_process";
+// ../shared/src/dotnet-toolchain.ts
+import { execFileSync as execFileSync2 } from "child_process";
 import prompts from "prompts";
 var DOTNET = process.platform === "win32" ? "dotnet.exe" : "dotnet";
 var MAUI_DOCS = "https://learn.microsoft.com/dotnet/maui/get-started/installation";
 var INSTALL_NET_10_FIX = "Install the .NET 10 SDK \u2014 https://dotnet.microsoft.com/download";
-var bufToStr = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
-var run = (cmd, args) => {
-  try {
-    const stdout = execFileSync(cmd, args, {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    return { found: true, ok: true, stdout: stdout ?? "", stderr: "" };
-  } catch (e) {
-    const err = e;
-    return {
-      found: err.code !== "ENOENT",
-      ok: false,
-      stdout: bufToStr(err.stdout),
-      stderr: bufToStr(err.stderr)
-    };
-  }
-};
-var splitLines = (text) => text.split(/\r?\n/);
 var NET_10_VERSION = /^10\./;
 var MAUI_WORKLOAD = /\bmaui\b/i;
 var hasNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).some((line) => NET_10_VERSION.test(line.trim()));
@@ -227,7 +227,6 @@ var checkDotnetSdk = () => {
   };
 };
 var isMauiWorkloadInstalled = () => outputMentionsMaui(run(DOTNET, ["workload", "list"]).stdout);
-var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
 var installWorkload = (csprojPath) => {
   const args = csprojPath ? ["workload", "restore", csprojPath] : ["workload", "install", "maui"];
   console.log();
@@ -244,7 +243,7 @@ var installWorkload = (csprojPath) => {
   );
   console.log();
   try {
-    execFileSync(DOTNET, args, { stdio: "inherit" });
+    execFileSync2(DOTNET, args, { stdio: "inherit" });
     return true;
   } catch {
     console.error();
@@ -327,10 +326,12 @@ var CLI_ROOT = path2.resolve(__dirname, "..");
 var TEMPLATES_DIR = path2.join(CLI_ROOT, "templates");
 var VIDRA_REPO_ROOT = path2.resolve(CLI_ROOT, "..", "..", "..");
 var LOCAL_FEED_DIR = path2.join(VIDRA_REPO_ROOT, "dist", "packages");
-var LOCAL_CLI_DIR = CLI_ROOT;
+var LOCAL_CLI_DIR = path2.join(VIDRA_REPO_ROOT, "src", "cli", "vidra-cli");
 var LOCAL_SDK_DIR = path2.join(VIDRA_REPO_ROOT, "src", "sdk", "vidra-js");
-var VIDRA_VERSION = "0.3.1";
-var SDK_VERSION = "0.2.0";
+var VIDRA_VERSION = JSON.parse(
+  fs2.readFileSync(path2.join(CLI_ROOT, "package.json"), "utf-8")
+).version;
+var SDK_VERSION = VIDRA_VERSION;
 var main = async () => {
   console.log();
   console.log(`  create-${lime("vidra")}-app`);
@@ -438,7 +439,7 @@ var main = async () => {
   }
   if (isMonorepo) {
     console.log(note("npm", `${dim("@vidra-dev/sdk \u2192")} ${value(LOCAL_SDK_DIR)}`));
-    console.log(note("npm", `${dim("create-vidra-app \u2192")} ${value(LOCAL_CLI_DIR)}`));
+    console.log(note("npm", `${dim("vidra-cli \u2192")} ${value(LOCAL_CLI_DIR)}`));
   }
   console.log();
   if (!npmOk) {

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "create-vidra-app",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Scaffold a new Vidra application (React + .NET MAUI)",
   "type": "module",
   "bin": {
-    "create-vidra-app": "./bin/create-vidra-app.mjs",
-    "vidra": "./bin/vidra.mjs"
+    "create-vidra-app": "bin/create-vidra-app.mjs"
   },
   "files": [
     "bin/",
@@ -15,6 +14,7 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "prepublishOnly": "npm run build"
@@ -33,8 +33,7 @@
     "desktop",
     "electron-alternative",
     "tauri-alternative",
-    "scaffold",
-    "cli"
+    "scaffold"
   ],
   "repository": {
     "type": "git",
@@ -47,19 +46,23 @@
   },
   "license": "MIT",
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
   },
   "dependencies": {
-    "chalk": "^5.4.1",
+    "chalk": "^6.0.0",
     "fs-extra": "^11.2.0",
     "prompts": "^2.4.2"
   },
   "devDependencies": {
+    "@vidra-dev/cli-shared": "*",
     "@types/fs-extra": "^11.0.4",
-    "@types/node": "^22.9.0",
+    "@types/node": "^22.20.0",
     "@types/prompts": "^2.4.9",
     "tsup": "^8.5.1",
-    "typescript": "^6.0.2",
-    "vitest": "^2.1.4"
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10"
   }
 }

package/templates/react-vite/README.md

@@ -1,90 +1,45 @@
 # {{appTitle}}
 
-A cross-platform application built with [Vidra](https://vidra.build) — React UI + .NET MAUI native host.
+A desktop application built with [Vidra](https://vidra.build): a React UI and a
+C#/.NET native host.
 
-## Getting Started
-
-### Prerequisites
+## Requirements
 
 - [.NET 10 SDK](https://dotnet.microsoft.com/download)
-- The .NET MAUI workload: `dotnet workload install maui`
-- [Node.js](https://nodejs.org/) 18+
-- macOS targets require Xcode; Windows targets must be built on Windows
-
-Not sure if you're set up? Run:
-
-```bash
-npm run doctor
-```
+- .NET MAUI workload: `dotnet workload install maui`
+- [Node.js](https://nodejs.org/) 22 or newer
+- Xcode for macOS builds
 
-It checks your .NET SDK, the MAUI workload, and (on macOS) Xcode, and prints the
-exact command to fix anything that's missing.
+Windows targets must be built on Windows.
 
-> The `vidra` CLI ships as a local dev dependency of this project, so run it
-> through npm (`npm run dev`, `npm run doctor`) or with `npx vidra <command>` —
-> there is no global `vidra` command to install.
-
-### Development
+## Development
 
 ```bash
+npm run doctor
 npm run dev
 ```
 
-This starts the Vite dev server and launches the native host for the current OS
-under `dotnet watch`. Both sides of the app hot reload:
-
-- **UI**: edit anything in `ui/src` — Vite HMR updates the WebView instantly.
-- **C#**: edit the host (for example `OnTickAsync` in `MainPage.cs`) — supported
-  edits apply to the running app in seconds, and the UI flashes a
-  "C# reloaded" badge. Edits hot reload can't express (new fields, changed
-  signatures, …) trigger an automatic rebuild and relaunch.
-
-C# hot reload needs a recent toolchain (on macOS, the .NET 10.0.203+ workload
-set — run `npm run doctor` to check). When unavailable, `vidra dev` falls back
-to a one-shot build and launch. To skip `dotnet watch` explicitly:
-
-```bash
-npx vidra dev --no-hot-reload
-```
-
-To target a specific desktop platform explicitly:
-
-```bash
-npx vidra dev --target macos
-npx vidra dev --target windows
-```
-
-If you want to run the pieces separately:
+`npm run dev` starts Vite and the native host together. Changes to the web UI
+reload through Vite; supported C# changes reload through the .NET development
+loop.
 
-```bash
-npm run dev:ui
-npm run dev:host:macos
-npm run dev:host:windows
-```
-
-### Production Build
+## Build
 
 ```bash
 npm run build
 ```
 
-## Project Structure
+The `vidra` CLI is a local project dependency. Run `npx vidra --help` to see
+target, packaging, and update options.
 
-```
+## Project structure
+
+```text
 {{projectNameKebab}}/
 ├── src/
-│   └── {{projectName}}.Host/     # .NET MAUI native host
-│       ├── MauiProgram.cs         # App configuration + Vidra setup
-│       ├── MainPage.cs            # Main page (extends VidraPage)
-│       └── Platforms/             # Platform-specific code
-└── ui/                            # React frontend
-    ├── src/
-    │   ├── App.tsx                # Main React component
-    │   └── main.tsx               # Entry point
-    ├── vite.config.ts
-    └── package.json
+│   └── {{projectName}}.Host/  # .NET MAUI host and C# contracts
+└── ui/                        # React application and generated TypeScript
 ```
 
----
-
-Built with [Vidra](https://vidra.build) — a C#/.NET native core with a web UI.
+Read the [Vidra documentation](https://vidra.build/docs/) for bridge guides,
+capabilities, distribution, and updates.

package/templates/react-vite/_gitignore

@@ -1,6 +1,8 @@
 # Build artifacts
 dist/
 src/*/Resources/Raw/wwwroot/
+src/*/Resources/Raw/vidra-bridge-policy.json
+ui/src/generated/vidra-access-policy.ts
 *.tsbuildinfo
 
 # .NET
@@ -14,3 +16,7 @@ node_modules/
 .vs/
 .vscode/
 *.user
+
+# Update signing keys — whoever holds one can run code in every installed copy
+*-signing-key.pem
+vidra-signing-key.pem

package/templates/react-vite/package.json

@@ -1,5 +1,6 @@
 {
   "name": "{{projectNameKebab}}",
+  "version": "0.1.0",
   "private": true,
   "scripts": {
     "build": "vidra build",
@@ -10,6 +11,7 @@
     "doctor": "vidra doctor"
   },
   "devDependencies": {
-    "create-vidra-app": "{{cliVersion}}"
+    "@vidra-dev/sdk": "{{sdkVersion}}",
+    "vidra-cli": "{{cliVersion}}"
   }
 }

package/templates/react-vite/src/{{projectName}}.Host/Entitlements.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
+    <key>com.apple.security.app-sandbox</key>
+    <false/>
+</dict>
+</plist>

package/templates/react-vite/src/{{projectName}}.Host/MainPage.cs

@@ -23,11 +23,22 @@ public class MainPage : VidraPage
         try
         {
             var count = await Bridge.Js().Counter.IncrementAsync();
-            System.Diagnostics.Debug.WriteLine($"[MainPage] Counter is now {count}");
+            Console.WriteLine($"[MainPage] Counter is now {count}");
         }
         catch (Exception ex)
         {
-            System.Diagnostics.Debug.WriteLine($"[MainPage] Counter increment failed: {ex.Message}");
+            // Console, which is what Vidra.Hosting itself logs through, and the
+            // only one of the three that a Release build actually emits.
+            // Debug.WriteLine is compiled out of Release entirely, and Release is
+            // exactly the build where someone is looking at a counter stuck at
+            // zero. Trace.TraceError survives the compile but goes to
+            // DefaultTraceListener, which writes nothing unless a debugger is
+            // attached, and this template registers no listener.
+            //
+            // The whole exception, not ex.Message: the bridge's answer to "why"
+            // is the error code on it, and JS_HANDLER_NOT_FOUND, JS_HANDLER_ERROR
+            // and JS_RESPONSE_INVALID are three different problems.
+            Console.Error.WriteLine($"[MainPage] Counter increment failed: {ex}");
         }
     }
 }

package/templates/react-vite/src/{{projectName}}.Host/MauiProgram.cs

@@ -9,9 +9,32 @@ public static class MauiProgram
     {
         var builder = MauiApp.CreateBuilder();
 
+        // Updates are wired up and doing nothing, which is the intended state
+        // until this app has a feed to check. The switch is already in
+        // vidra.config.ts, empty — filling it in is the whole opt-in:
+        //
+        //   updates: { feed: "https://updates.example.com/notes/" }
+        //
+        // Type a URL there, or run `npx vidra updates init --feed <url>`, then
+        // publish with `npx vidra build` (both tiers) or `npx vidra build --web`
+        // (just the UI, no compile).
+        //
+        // One directory serves both tiers. To split them across two hosts:
+        //
+        //   "feed": { "web": "https://cdn/notes/", "app": "https://dl/notes/" }
+        //
+        // Web bundle: your `ui/` build, applied on the next launch, no reinstall.
+        // A bundle only installs when its contract fingerprints match this build,
+        // so JS can never call a bridge the installed binary lacks.
+        //
+        // Whole app: native code included, via Velopack. Its other half is the
+        // `VelopackApp` line in Platforms/*/Program.cs, which has to run before
+        // the UI framework starts.
         builder
             .UseMauiApp<App>()
             .UseVidra()
+            .UseVidraUpdates()
+            .UseVidraNativeUpdates()
             .ConfigureFonts(fonts =>
             {
                 fonts.AddFont("OpenSans-Regular.ttf", "OpenSansRegular");

package/templates/react-vite/src/{{projectName}}.Host/Platforms/MacCatalyst/Program.cs

@@ -1,3 +1,22 @@
+// The app's entry point on Mac Catalyst.
+//
+// A native updater has to run before UIKit does: on install, update and
+// uninstall Velopack re-launches the app with a `--veloapp-*` argument and
+// expects it to do that work and exit without ever showing a window. `vpk pack`
+// also inspects the assembly statically and warns when
+// `VelopackApp.Build()...Run()` is anywhere other than the entry point.
+//
+// It is live from the first scaffold and does nothing at all until this app is
+// installed from a Velopack release — which it is not, until `vidra.config.ts`
+// names an updates feed and `vidra build` packs
+// a release into it. Filling in that URL is the whole opt-in.
+//
+// `UseVidraLocator()` is the Mac Catalyst part. Velopack's client picks its
+// locator from `RuntimeInformation.IsOSPlatform`, which answers false for OSX
+// here, so without it, `Run()` throws before any update logic executes.
+
+using Velopack;
+using Vidra.Hosting;
 using UIKit;
 
 namespace {{projectName}};
@@ -6,6 +25,8 @@ public static class Program
 {
     static void Main(string[] args)
     {
+        VelopackApp.Build().UseVidraLocator().Run();
+
         UIApplication.Main(args, null, typeof(AppDelegate));
     }
 }

package/templates/react-vite/src/{{projectName}}.Host/Platforms/Windows/Program.cs

@@ -0,0 +1,41 @@
+// The app's real entry point on Windows.
+//
+// MAUI generates one of these for you. This app takes it over, via
+// `<DefineConstants>` in the csproj setting DISABLE_XAML_GENERATED_MAIN, for
+// one reason: a native updater has to run *first*, before any UI framework
+// starts.
+//
+// On install, update and uninstall, Velopack re-launches the app with a
+// `--veloapp-*` argument and expects it to do that work and exit without ever
+// showing a window. `VelopackApp.Build()...Run()` is what handles those launches,
+// and `vpk pack` statically inspects the assembly and warns when it finds the
+// call anywhere other than the entry point.
+//
+// It is live from the first scaffold and does nothing at all until this app is
+// installed from a Velopack release — which it is not, until `vidra.config.ts`
+// names an updates feed and `vidra build` packs
+// a release into it. Filling in that URL is the whole opt-in.
+
+using Velopack;
+using Vidra.Hosting;
+
+namespace {{projectName}}.WinUI;
+
+public static class Program
+{
+    [STAThread]
+    static void Main(string[] args)
+    {
+        VelopackApp.Build().UseVidraLocator().Run();
+
+        WinRT.ComWrappersSupport.InitializeComWrappers();
+
+        Microsoft.UI.Xaml.Application.Start(p =>
+        {
+            var context = new Microsoft.UI.Dispatching.DispatcherQueueSynchronizationContext(
+                Microsoft.UI.Dispatching.DispatcherQueue.GetForCurrentThread());
+            System.Threading.SynchronizationContext.SetSynchronizationContext(context);
+            _ = new App();
+        });
+    }
+}

package/templates/react-vite/src/{{projectName}}.Host/{{projectName}}.Host.csproj

@@ -1,6 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
+    <!-- Pinned, not inferred: a Release Catalyst publish is universal
+         (maccatalyst-x64 + maccatalyst-arm64) while a Debug build takes
+         the host RID alone, and both share one obj/. Whichever restored
+         last owns project.assets.json, so a publish that no-ops its
+         restore can read an assets file with no x64 target and fail with
+         NETSDK1047. Naming the set here makes every restore write both. -->
+    <RuntimeIdentifiers Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">maccatalyst-x64;maccatalyst-arm64</RuntimeIdentifiers>
     <TargetFrameworks Condition="$([MSBuild]::IsOSPlatform('osx'))">net10.0-maccatalyst</TargetFrameworks>
     <TargetFrameworks Condition="$([MSBuild]::IsOSPlatform('windows'))">net10.0-windows10.0.19041.0</TargetFrameworks>
     <ValidateXcodeVersion>false</ValidateXcodeVersion>
@@ -18,6 +25,28 @@
     <ApplicationVersion>1</ApplicationVersion>
     <ApplicationDisplayVersion>0.1.0</ApplicationDisplayVersion>
     <EnableCodeSigning Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">true</EnableCodeSigning>
+    <!--
+      Entitlements for the hardened runtime, which notarization requires and
+      which would otherwise kill .NET's JIT. `vidra build` re-signs the bundle
+      with this same file, so pointing MAUI at it keeps both passes consistent.
+
+      What Entitlements.plist grants (it carries no comments of its own — the
+      MacCatalyst SDK's plist parser rejects XML comments inside <dict>):
+        allow-jit + allow-unsigned-executable-memory  .NET compiles to
+                                                      writable-then-executable memory
+        disable-library-validation                    the runtime loads dylibs
+                                                      signed by another team
+        network.client                                the WebView reaches the
+                                                      Vite dev server
+        files.user-selected.read-write                filePicker hands back paths
+                                                      the app then reads
+        app-sandbox = false                           Vidra's filesystem module
+                                                      exposes unrestricted paths;
+                                                      Developer ID (unlike the App
+                                                      Store) does not require the
+                                                      sandbox
+    -->
+    <CodesignEntitlements Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">Entitlements.plist</CodesignEntitlements>
 
     <SupportedOSPlatformVersion Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">15.0</SupportedOSPlatformVersion>
     <SupportedOSPlatformVersion Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'windows'">10.0.17763.0</SupportedOSPlatformVersion>
@@ -31,6 +60,21 @@
     -->
     <WindowsPackageType Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'windows'">None</WindowsPackageType>
 
+    <!--
+      This app owns its Windows entry point (Platforms/Windows/Program.cs)
+      instead of the one the XAML compiler generates.
+
+      A native updater has to run before any UI framework starts: on install,
+      update and uninstall Velopack re-launches the app with a `veloapp`
+      argument and expects it to do that work and exit without ever showing a
+      window, and `vpk pack` inspects the assembly and warns when it finds the
+      call outside the entry point. Entry-point shape is the one thing a package
+      reference cannot retrofit, so every Vidra app ships with it, live, from the
+      first scaffold. Mac Catalyst already has a real `Main`, so it needs no
+      equivalent switch.
+    -->
+    <DefineConstants Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'windows'">$(DefineConstants);DISABLE_XAML_GENERATED_MAIN</DefineConstants>
+
     <!--
       Skip the MacCatalyst managed linker in Debug. The linker's Setup step
       validates the MacCatalyst SDK headers against the maui workload version,
@@ -51,8 +95,16 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Maui.Controls" Version="$(MauiVersion)" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="9.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="10.0.10" />
     <PackageReference Include="Vidra.Hosting.Maui" Version="{{vidraVersion}}" />
+    <!--
+      Whole-app updates, via Velopack. Referenced from the first scaffold and
+      inert until vidra.config.ts names a native feed: ~280 KB of managed code
+      against a self-contained .NET + MAUI app, which is the price of never
+      having to retrofit an entry point, a package reference and a builder call
+      into an app that has already shipped.
+    -->
+    <PackageReference Include="Vidra.Updates.Native" Version="{{vidraVersion}}" />
   </ItemGroup>
 
 </Project>

package/templates/react-vite/ui/package.json

@@ -16,8 +16,8 @@
   "devDependencies": {
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "@vitejs/plugin-react": "^4.4.0",
-    "typescript": "^5.7.0",
-    "vite": "^6.0.0"
+    "@vitejs/plugin-react": "^6.0.5",
+    "typescript": "^7.0.2",
+    "vite": "^8.2.1"
   }
 }