# TrueGrowth Desktop Auto Updates

## Channel

Stable desktop updates are served from:

```text
https://truegrowth.benchu.cloud/desktop/stable/
```

The 1Panel static directory should expose these files directly:

- `latest.yml`
- `latest-mac.yml`
- `releases.json`
- `TrueGrowth-<version>-<arch>.dmg`
- `TrueGrowth-<version>-<arch>-mac.zip`
- `TrueGrowth-<version>-x64-Setup.exe`
- optional portable installers and `.blockmap` files

## Build

```bash
pnpm desktop:build
```

For platform-specific builds:

```bash
pnpm desktop:build:mac
pnpm desktop:build:win
```

The build writes artifacts to `dist/desktop/release` and generates `releases.json`
with sizes, sha256 hashes, and upload guidance.

## 1Panel / Nginx Cache

Set metadata files to no-store:

```nginx
location ~* ^/desktop/stable/(latest\.yml|latest-mac\.yml|releases\.json)$ {
  add_header Cache-Control "no-store, no-cache, must-revalidate";
}
```

Installers, zip packages, and blockmaps can use long-lived immutable cache:

```nginx
location ~* ^/desktop/stable/.*\.(dmg|zip|exe|blockmap)$ {
  add_header Cache-Control "public, max-age=31536000, immutable";
}
```

## Production Gate

Customer auto-update packages must be signed before release:

- macOS: Developer ID signed and notarized.
- Windows: Authenticode signed.

Unsigned packages are only for internal update-flow tests.