Part of #840.
A first-class SDK update mechanism wrapping native Deno.autoUpdate() (docs: runtime/desktop/auto_update):
Design source: PR #822 (rfc.md) + run .llm/runs/rfc-single-deployment--orchestrator/.
Option-A execution rescope (owner-ratified 2026-07-18)
Upstream Deno 2.9.3 deletes op_desktop_verify_ed25519 at bootstrap (keep-list omission in denoland/deno#33441 — bug filed as denoland/deno#36150), so the auto-update apply/rollback execution proof cannot run on any platform until a fixed Deno release ships. That execution proof is re-scoped to successor #859 (0.0.1-beta.12). Everything else shipped and was proven in the beta.11 wave; gate boxes below annotated accordingly.
Part of #840.
A first-class SDK update mechanism wrapping native
Deno.autoUpdate()(docs: runtime/desktop/auto_update):Typed options/callbacks (
onUpdateReady/onRollback), per-arch URL wiring (Deno.build.os + arch), check-on-launch + interval policies, release-channel config; Ed25519publicKeypinning wired from app config.Isolates upstream API churn: the desktop APIs are moving under a
Deno.desktopnamespace (open PR feat(desktop): move desktop runtime APIs under Deno.desktop namespace denoland/deno#35939) — apps consume OUR seam, not the moving global.Windows honesty built in: detect the staged-but-not-applied state and surface a manual-update UX path (link to the new installer); track upstream apply support (deno desktop: follow-ups (test coverage, CJS analyzer heuristic, platform gaps) denoland/deno#35269) so the wrapper flips to full auto when it lands.
Rollback telemetry:
onRollbackreported through NetScript telemetry so broken releases are visible.Server side: the feat(deploy): single-artifact packaging + release server + snapshot updater (substrate) #456 release server serves the native
latest.json/patch layout this consumes.gate: wrapper unit tests incl. no-op under
deno run(Deno.desktopVersion === null) and staged-Windows pathgate:
e2e apply/rollback proof on macOS/Linux via test(deploy): single-artifact deploy-e2e — install → update → rollback (Windows + Linux) #457→ execution proof re-scoped to test(deploy): native auto-update apply/rollback execution proof — pending upstream denoland/deno#36150 #859 (upstream desktop:op_desktop_verify_ed25519missing fromNOT_IMPORTED_OPS— packaged apps cannot verify auto-update manifests (op_desktop_verify_ed25519 is not a function) denoland/deno#36150); jsr rubric on the SDK surface PROVEN (IMPL-EVAL, PR feat(sdk): add typed desktop auto-update seam #849)Design source: PR #822 (
rfc.md) + run.llm/runs/rfc-single-deployment--orchestrator/.Option-A execution rescope (owner-ratified 2026-07-18)
Upstream Deno 2.9.3 deletes
op_desktop_verify_ed25519at bootstrap (keep-list omission in denoland/deno#33441 — bug filed as denoland/deno#36150), so the auto-update apply/rollback execution proof cannot run on any platform until a fixed Deno release ships. That execution proof is re-scoped to successor #859 (0.0.1-beta.12). Everything else shipped and was proven in the beta.11 wave; gate boxes below annotated accordingly.