feat: add manifest delta updates, channel discovery, and rolledBack event

[robingenz]

What

Closes the v1 parity gaps ahead of the Capacitor Electron adapter (see the cross-repo Live Update Electron plan):

• fetchChannels(): GET /v1/apps/{appId}/channels with limit/offset/query; HTTP 401 maps to new ErrorCode.ChannelDiscoveryNotEnabled. Wired through engine, IPC, preload, and renderer.
• Injectable pluginVersion + defaultBundlePath on LiveUpdateEngineConfig (defaults unchanged: engine version, runtime: 'electron') — the Capacitor adapter will inject runtime: 'capacitor' and its plugin package version.
• rolledBack event exposed publicly: added to IPC_EVENTS and the addListener overloads (was emitted internally but not subscribable from renderers).

Tests

• 122 unit tests passing (new manifest.test.ts, engine manifest/channels/config suites, api-client channels + pluginVersion).
• Packaged-app e2e: 6/6 passing locally, including the new manifest-delta-over-default-bundle test and the kill-during-boot rollback drill.
• tsc --noEmit, ESLint, Prettier clean.

Related PRs

• https://github.com/capawesome-team/cloud-api-worker/pull/695 — backend: Electron platform support for live updates (runtime combos, version constraints, artifact gating)

• feat: plugin lifecycle, watchdog opt-out, and splash screen capacitor-electron#6 — platform: watchdog opt-out + async plugin initialize() hook

• https://github.com/feat(live-update): add Electron platform support capacitor-plugins#921 — plugin: Electron platform implementation (the Capacitor adapter)

• https://github.com/feat: add Electron app version constraint flags for live update bundles cli#185 — CLI: Electron version-constraint upload flags

🤖 Generated with Claude Code

---

Scope change (2026-07-17): manifest (delta) update support was removed again before release — delta is a mobile optimization (download speed/traffic on cellular) with negligible desktop value and it was the highest-maintenance path in the engine. v1 is zip-only; the server gates platform 2 to zip artifacts (cloud-api-worker#695). All general hardening that emerged from the delta reviews stays (empty-header rejection, activation re-verification, Windows file-lock retries, write-queue fix). The implementation remains in git history.

[Copilot]

Pull request overview

This PR closes several “v1 parity” gaps in the Electron Live Update SDK by adding manifest-based delta bundle downloads, a channel discovery API, additional configurability for plugin/runtime metadata, and exposing a previously-internal rollback event to renderer consumers.

Changes:

• Add manifest (delta) artifact support: download + diff-by-checksum, copy unchanged files, bounded parallel file downloads, per-file verification, and atomic install.
• Add fetchChannels() (and new ChannelDiscoveryNotEnabled error mapping) wired through engine → IPC → preload/renderer.
• Add injectable pluginVersion / defaultBundlePath, and expose the rolledBack event publicly (IPC + renderer typings), plus docs/tests/e2e updates.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/manifest.test.ts	New unit tests for manifest parsing and safe path resolution.
tests/helpers.ts	Adds sha256Hex() helper for manifest-related tests.
tests/engine.test.ts	Adds engine tests for manifest delta behavior, channel discovery, and pluginVersion/runtime injection.
tests/api-client.test.ts	Adds API client tests for /channels and updates to pluginVersion parameter usage.
src/shared/ipc.ts	Extends IPC contract to include fetchChannels and rolledBack.
src/renderer/index.ts	Adds renderer client method fetchChannels() and rolledBack listener overload.
src/main/live-update.ts	Wires fetchChannels() through main implementation + IPC dispatch; forwards rolledBack event.
src/engine/manifest.ts	New manifest parsing + secure href-to-path resolution (anti path traversal).
src/engine/errors.ts	Adds ErrorCode.ChannelDiscoveryNotEnabled.
src/engine/engine.ts	Implements manifest delta download/install flow; adds fetchChannels() and pluginVersion/defaultBundlePath support.
src/engine/download.ts	Adds AbortSignal support and helper to append href to manifest bundle URLs.
src/engine/definitions.ts	Adds channel types + fetchChannels() API types; updates docs for manifest artifact and rolledBack.
src/engine/api-client.ts	Adds /channels API call and switches latest-bundle request param from sdkVersion to pluginVersion.
README.md	Updates feature list, parity table, API list, and events docs for new functionality.
example/scripts/mock-server.mjs	Extends mock server to serve channels and manifest bundles end-to-end.
e2e/app.spec.ts	Adds e2e coverage for syncing a manifest delta bundle over the built-in bundle.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 5 comments.