The project file (format 2)

A JSON object with "format": 2, UTF-8, comments and trailing commas allowed, in the folder of the starter. The starter takes, in this order:

1. the .json file /RUNCFG <file> names (a plain file name in the starter's folder);
2. (version 2.3.0 and later) <name>.bootstrapper.json named after the starter EXE, when it exists - demo.bootstrapper.json for demo.exe, as demo.exe.config belongs to demo.exe in .NET;
3. bootstrapper.json.

The starter may be renamed (demo.exe): it reads its folder whatever its name, and the shortcuts ([Starter]) and the entry under Apps name the renamed file: install, update, start without the source, /list and /uninstall behave the same. In version 2.3.0 and later, several renamed starters share one folder, one per profile, each with its own project file and without /RUNCFG in a shortcut:

Each profile needs a product of its own; two project files with the same product key replace each other's installation on a user's PC. The Apps entry removes the product through the starter at the path it was started from; a starter on a share that is no longer reachable cannot remove it from there - start /uninstall from a reachable copy of the starter.

Format 1 and format 2 are formats of this file only. The project file of the build tool of WKL Forms Object Library (access-app.json) is another file with its own format, and the starter never reads it; of a build, the starter reads only the app-manifest.json the build tool writes into each delivery folder (version.from); its own field format is the version of the manifest's schema, not one of the formats of this file. Whether an application goes through format 1 or format 2 is decided by the bootstrapper.json its administrator places next to the starter, not by the application.

{
  "format": 2,
  "product": "Checkout",
  "display": { "name": "Checkout Pro", "publisher": "Contoso", "copyright": [ "(c) 2026 Contoso" ], "logo": "logo.png" },
  "version": { "value": "3.2.1" },
  "source": "\\\\server\\share\\checkout",
  "deliveryKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...",
  "files": [
    { "id": "bin", "source": "bin", "target": "[VersionDir]" },
    { "source": "com\\x86", "target": "[AppDir]\\com", "action": "registerCom", "bitness": "x86" }
  ],
  "registry": [ { "key": "Software\\Contoso\\Checkout", "values": [ { "name": "Home", "data": "[Dir:bin]" } ] } ],
  "shortcuts": [ { "folder": "[Programs]\\Contoso", "name": "Checkout", "target": "[Starter]", "arguments": "[RunConfig]" } ],
  "fileTypes": [ { "extension": ".checkout", "progId": "Contoso.Checkout", "description": "Sales receipt", "command": "\"[Starter]\" [RunConfig] \"%1\"" } ],
  "actions": [ { "when": "beforeInstall", "program": "setup\\vc_redist.x86.exe", "arguments": "/install /quiet /norestart", "successCodes": [ 0, 3010 ] } ],
  "conditions": [ { "kind": "dotnet", "value": "Microsoft.WindowsDesktop.App 10.0", "message": ".NET 10 is missing.", "link": "https://dot.net" } ],
  "start": { "file": "[VersionDir]\\Checkout.exe", "arguments": "/mode kiosk" },
  "keepVersions": 2
}

What the starter installs for the Windows user, what it registers, which conditions it checks, which programs it runs and what it starts - any program or file, an Access application being one case among others. The starter carries it out without administrator rights, as one transaction with rollback, counted and removable under Settings > Apps.

Every target the starter writes to (appDir, versionDir, a files target, a shortcut folder, the INI file) is a placeholder path below a folder of the user; a target outside them, .. in a path, a registry key naming another hive and an unknown placeholder are refused before anything runs (code 11).

Folders of the user - may begin a target. Before 2.3.0 only [LocalAppData], [AppData], [Documents], [Desktop], [Programs] and [Startup] existed.

The libraries and [Downloads], [LocalAppDataLow], [UserPrograms] are read from Windows as known folders; a folder Windows cannot name on that PC stays without a value, and a target below it is refused like an unknown placeholder.

Folders of the computer - resolve wherever a placeholder may stand that is not a target: start (file, arguments, folder, environment), actions, conditions and registry data. They never begin a target: writing there needs administrator rights.

Placeholders of the project:

Files below [VersionDir] belong to their version: placed once, never replaced (a program that writes into its folder keeps its data), removed with the version. Files anywhere else are shared and counted: the same folder used by two products stays until the last one goes; a file changed in a later delivery is replaced.

Each start reads the project, checks the conditions, and installs the delivered version when it is new or incomplete: files, registry values, file types, shortcuts, the INI file, the trusted location (only when start.file is an Access database) and the entry under Apps, then runs the afterInstall actions, all in one transaction. Then it removes versions beyond keepVersions (never the started one or the last working one) and starts start.file. A failure on the way rolls everything back; the codes are those of Error codes of the starter.

When the source cannot be reached (code 12) or its delivery is not trusted (code 51), the installed version starts - the last working one, else the newest - and the update waits for the next start. A diagnosis (/diagnose) reports the source as it is.

delivery.json in the source lists every file of the delivered version with size and SHA-256; delivery.json.sig beside it is its signature with the publisher's delivery key (ECDSA P-256). /publish writes both.

Every copy is checked against the manifest after copying, so a file changed between check and copy is not installed either.

Going back. With deliveryKey, the starter compares the delivered version with the highest version the user ever installed of the product (also after a cleanup or an uninstall), in the order of Versions. A lower version is installed only when withdrawn in delivery.json names that highest version; /publish /withdraw writes it (see How to: Publish a signed delivery). Without deliveryKey a lower version is installed as before.

Not covered. The signature covers the files of files. Programs of actions run directly from the source and are not checked against delivery.json: whoever can write to the source can change them, and they run with the rights of every user who starts the application. A delivery signed earlier stays valid; a starter that installed a higher version refuses it (code 52), but a user who never had a higher version installs it. Protect write access to the source. The trust anchor is the starter's folder with its project file: the delivery key protects a delivery only as long as users cannot change bootstrapper.json, as when the IT installs the starter under Program Files with the MSI. A starter and project file on the share or in the profile can be changed together with the key.

The delivery key is the publisher's own; it costs no code-signing signature. Windows' application control checks Authenticode signatures of programs and libraries only, which the publisher signs with the company certificate as before.

The starter never runs a server's own registration (DllRegisterServer, regsvr32) on a user's computer: it writes the registration from registration.json, which tools\Export-ComRegistration.ps1 captures on the publisher's computer. When two products bring the same server in different releases, the newer stays registered; when it is removed, the remaining one is registered again. See How to: Publish a signed delivery.

A program runs with the user's rights; a setup that needs administrator rights fails with its exit code (code 43). Such prerequisites belong into the initial installation by the IT.

beforeUninstall actions run once per uninstall, whatever once says, before anything is removed. Their placeholders resolve for the version the starter would start last ([VersionDir] is that installed version). A relative program is taken from the source, which may be gone by then (a share no longer reachable, a delivery removed): the program cannot start, the uninstall stops with code 43 and nothing is removed. Point such programs at the installed copy ([VersionDir]\...) instead.

message and link of the condition appear in the diagnostic details.

A file with "format": 1 (an Access application, the starter 1.0) is read as a project: the database of app-manifest.json into [VersionDir] (the folder 1.0 used), the WKL components and ODBC drivers per release and bitness below [WklRoot], the data source of each driver, the checks of the settings as conditions, the database as start target. Format 1 files keep working unchanged; a project of format 2 written by the configurator replaces one when needed. Whether the installer of 2.0 takes a format 1 delivery or it runs the way of 1.0 depends on its components folder: with registration.json next to the DLL (or without components) the installer, otherwise the way of 1.0 - see When 2.0 installs and when 1.0 runs.

A file of format 1:

{
  "format": 1,
  "product": "INSTRA",
  "displayName": "INSTRA Verwaltung",
  "source": "\\\\server\\apps\\INSTRA\\production",
  "components": "components",
  "ini": { "file": "TECCUsr.ini", "values": [ { "section": "Properties", "key": "SRV", "value": "sql01" } ] },
  "branding": { "logo": "logo.png", "company": "Contoso", "preparing": "Die neue Version wird eingerichtet ..." },
  "command": "mandant=2",
  "odbcDrivers": [ "ODBC Driver 18 for SQL Server" ],
  "language": "",
  "colorScheme": "automatic",
  "keepVersions": 2
}

A program that is no Access application, in a folder of its own per version, started with arguments:

{
  "format": 2,
  "product": "Inventory",
  "display": { "name": "Inventory Management", "publisher": "Contoso" },
  "version": { "from": "bin\\Inventory.exe" },
  "source": "\\\\server\\share\\lager",
  "files": [ { "source": "bin", "target": "[VersionDir]" } ],
  "shortcuts": [ { "folder": "[Desktop]", "name": "Inventory", "target": "[Starter]", "arguments": "[RunConfig]" } ],
  "start": { "file": "[VersionDir]\\Inventory.exe", "arguments": "/user \"[Product]\"" }
}

• The installer of the bootstrapper 2.0 - transaction, counting, commands
• How to: Publish a signed delivery
• How to: Create a project from templates
• How to: Start any program with the starter
• How to: Deliver a private .NET runtime
• Error codes of the starter