Cosmo Docs
Server

Updates Module

Desktop app release management and gradual rollout

The Updates module serves desktop app update information and manages release records. Source: packages/server/src/modules/updates/.

REST Endpoints

All endpoints are prefixed with /api/v1/updates.

MethodPathGuardsDescription
GET/updates/checkNoneCheck for an available update
POST/updatesClerkAuthGuard + @Roles('OWNER', 'ADMIN')Publish a new release
PATCH/updates/:idClerkAuthGuard + @Roles('OWNER', 'ADMIN')Update release settings
GET/updates/releasesClerkAuthGuard + @Roles('OWNER', 'ADMIN')List releases (admin)

Update Check

GET /api/v1/updates/check is the endpoint polled by the desktop UpdateManager.

Query params:

ParamDescription
versionCurrent installed version
platformdarwin / win32 / linux
archx64 / arm64 / universal
channelstable / beta / canary (default: stable)
clientIdStable per-device ID for rollout bucketing

Response when an update is available:

{
  updateAvailable: true;
  currentVersion: string;
  latestVersion: string;
  mandatory?: boolean;
  releaseNotes?: string;
  downloadUrl?: string;
  signature?: string;
  fileSizeBytes?: number;
  sha512?: string;
  channel?: string;
  publishedAt?: string;
}

Response when no update:

{ updateAvailable: false; currentVersion: string }

Rollout Bucketing

The rolloutPercentage field (0–100) controls gradual rollouts. The clientId is hashed deterministically to a number 0–99. If the hash falls within [0, rolloutPercentage), the update is served to that device.

This means:

  • rolloutPercentage: 0 — no devices receive the update
  • rolloutPercentage: 10 — ~10% of devices receive the update
  • rolloutPercentage: 100 — all devices receive the update

Updates Service (services/updates.service.ts)

checkForUpdate(query)

  1. Queries AppRelease for the latest active: true release matching platform, arch, and channel.
  2. Compares the release version against the client's version.
  3. Applies rollout bucket check using clientId.
  4. Returns the update payload or { updateAvailable: false, currentVersion }.

Admin endpoints (repository-direct)

The POST /updates, PATCH /updates/:id, and GET /updates/releases endpoints are admin-only (require ClerkAuthGuard + OWNER/ADMIN role). They call UpdatesRepository directly — there are no publishRelease or updateRelease service methods.

AppRelease Schema

FieldTypeDescription
versionstringSemver (e.g. "2026.4.30")
platformDARWIN | WIN32 | LINUXTarget platform
archX64 | ARM64 | UNIVERSALCPU architecture
channelSTABLE | BETA | CANARYRelease channel
downloadUrlstringDirect download URL
sha512string?SHA-512 of the installer file
fileSizeBytesint?File size in bytes
releaseNotesstring?Markdown release notes
minOsVersionstring?Minimum OS version
signaturestring?Code signature
mandatorybooleanForce update if true
rolloutPercentageint0–100 rollout target
activebooleanWhether this release is served
publishedAtDateTimePublish timestamp