Part of #327
Handle: #E6 · Milestone: 0.0.1-beta.8 · Depends on: #E2 (shell) + #E4 (single-process artifact to package). Blocks: #E7, #E8.
Scope — 1-click packaging + release/update server
deno desktop cross-compile (--target/--all-targets, no Rust toolchain, SHA-256-verified prebuilt targets; --compress xz|zstd; --no-check; explicit -o); release server serving latest.json + bsdiff deltas + Ed25519-signed manifests; Windows manual-apply fallback (relaunch-installer indirection — Tauri/Electron pattern) for the stages-not-applies gap; local structural type layer over Deno.BrowserWindow/Tray/autoUpdate/desktopVersion.
Acceptance
- Reproducible signed binary per target;
Deno.autoUpdate() stages+applies on macOS/Linux and stages+manual-applies on Windows; manifests signature-verified before staging; desktop-globals layer is lint-clean and a no-op in the web build.
Design source: design/E-desktop/epic-and-issues.md (#E6).
RFC #820 amendment (owner-ratified 2026-07-17 — PR #822)
Re-scoped as the beta.11 single-artifact SUBSTRATE (graph extension → SD-4 #834): packaging via #452's hook + the .NET Aspire packaging integration #825 (MSI); release server (Ed25519-signed manifests, monotonic sequence high-water); the FULL snapshot updater — stable installer-managed bootstrap + release-resident worker, checksummed append-only journal, real Windows apply (release-dir swap while stopped), sustained-health confirm, rollback, install-time pinned trust key — plus minimal first-run provisioning. Deno.autoUpdate is never the update authority (RFC L0.7).
Deps: #452, #454, #825. Gates: #457 e2e; fault set (torn-journal replay, crash-mid-swap, cold reboot without current, wrong-key/tamper/replay refusals); e2e-cli-prod.
Correction (owner-confirmed 2026-07-17)
Dependency fix: the hard #454 dependency is dropped — the substrate needs only #452's
packaging hook + #825. A window-only (or single-service) app is a sufficient "single artifact".
Beta.11 product story (thin-client desktop): this substrate + #457 + #825 already cover a
real deployment shape — apps shipping their desktop window to consumer machines while hosting
their services in the vendor's cloud (the POC's proven option-(b) topology): the packaged
window is installed and updated via the snapshot transaction, and services__* discovery
points at remote URLs instead of loopback. No local graph, no PM dependency. Local in-process
composition (#454) and the supervised local graph (#830) layer on later without changing this
substrate.
Option-A re-scope (owner-ratified 2026-07-17 — native-first thin-client)
Native-first: packaging via deno desktop's own formats (Windows MSI, macOS .app/.dmg, Linux AppImage/.deb/.rpm; --compress where useful) — the snapshot-updater machinery (bootstrap/journal/release-dir transaction) moves to the full-stack tier (#834 + #825, beta.14). This issue now delivers: (1) packaging pipeline over the native formats via #452's hook; (2) the release server serving the NATIVE latest.json + bsdiff patches with the Ed25519 signed envelope (the beta.14 graph manifest is a designed superset — one lineage); (3) auto-update wiring through the SDK wrapper #841. Windows posture: native apply unsupported upstream (denoland/deno#35269) → documented manual-update fallback + staged-detection UX in v1. Now part of the Desktop Frontend epic #840. Deps: #452, #841. signtool/notarization remain external CI steps in v1 (D4 posture).
Option-A execution rescope (owner-ratified 2026-07-18)
Upstream Deno 2.9.3 deletes op_desktop_verify_ed25519 at bootstrap (keep-list omission in denoland/deno#33441 — bug filed as denoland/deno#36150), so the auto-update apply/rollback execution proof cannot run on any platform until a fixed Deno release ships. That execution proof is re-scoped to successor #859 (0.0.1-beta.12). Everything else shipped and was proven in the beta.11 wave; gate boxes below annotated accordingly.
Part of #327
Handle: #E6 · Milestone:
0.0.1-beta.8· Depends on: #E2 (shell) + #E4 (single-process artifact to package). Blocks: #E7, #E8.Scope — 1-click packaging + release/update server
deno desktopcross-compile (--target/--all-targets, no Rust toolchain, SHA-256-verified prebuilt targets;--compress xz|zstd;--no-check; explicit-o); release server servinglatest.json+ bsdiff deltas + Ed25519-signed manifests; Windows manual-apply fallback (relaunch-installer indirection — Tauri/Electron pattern) for the stages-not-applies gap; local structural type layer overDeno.BrowserWindow/Tray/autoUpdate/desktopVersion.Acceptance
Deno.autoUpdate()stages+applies on macOS/Linux and stages+manual-applies on Windows; manifests signature-verified before staging; desktop-globals layer is lint-clean and a no-op in the web build.Design source:
design/E-desktop/epic-and-issues.md(#E6).RFC #820 amendment (owner-ratified 2026-07-17 — PR #822)
Re-scoped as the beta.11 single-artifact SUBSTRATE (graph extension → SD-4 #834): packaging via #452's hook + the .NET Aspire packaging integration #825 (MSI); release server (Ed25519-signed manifests, monotonic sequence high-water); the FULL snapshot updater — stable installer-managed bootstrap + release-resident worker, checksummed append-only journal, real Windows apply (release-dir swap while stopped), sustained-health confirm, rollback, install-time pinned trust key — plus minimal first-run provisioning.
Deno.autoUpdateis never the update authority (RFC L0.7).Deps: #452, #454, #825. Gates: #457 e2e; fault set (torn-journal replay, crash-mid-swap, cold reboot without
current, wrong-key/tamper/replay refusals);e2e-cli-prod.Correction (owner-confirmed 2026-07-17)
Dependency fix: the hard #454 dependency is dropped — the substrate needs only #452's
packaging hook + #825. A window-only (or single-service) app is a sufficient "single artifact".
Beta.11 product story (thin-client desktop): this substrate + #457 + #825 already cover a
real deployment shape — apps shipping their desktop window to consumer machines while hosting
their services in the vendor's cloud (the POC's proven option-(b) topology): the packaged
window is installed and updated via the snapshot transaction, and
services__*discoverypoints at remote URLs instead of loopback. No local graph, no PM dependency. Local in-process
composition (#454) and the supervised local graph (#830) layer on later without changing this
substrate.
Option-A re-scope (owner-ratified 2026-07-17 — native-first thin-client)
Native-first: packaging via
deno desktop's own formats (Windows MSI, macOS .app/.dmg, Linux AppImage/.deb/.rpm;--compresswhere useful) — the snapshot-updater machinery (bootstrap/journal/release-dir transaction) moves to the full-stack tier (#834 + #825, beta.14). This issue now delivers: (1) packaging pipeline over the native formats via #452's hook; (2) the release server serving the NATIVElatest.json+ bsdiff patches with the Ed25519 signed envelope (the beta.14 graph manifest is a designed superset — one lineage); (3) auto-update wiring through the SDK wrapper #841. Windows posture: native apply unsupported upstream (denoland/deno#35269) → documented manual-update fallback + staged-detection UX in v1. Now part of the Desktop Frontend epic #840. Deps: #452, #841.signtool/notarization remain external CI steps in v1 (D4 posture).Option-A execution rescope (owner-ratified 2026-07-18)
Upstream Deno 2.9.3 deletes
op_desktop_verify_ed25519at bootstrap (keep-list omission in denoland/deno#33441 — bug filed as denoland/deno#36150), so the auto-update apply/rollback execution proof cannot run on any platform until a fixed Deno release ships. That execution proof is re-scoped to successor #859 (0.0.1-beta.12). Everything else shipped and was proven in the beta.11 wave; gate boxes below annotated accordingly.