@dennisrongo/skills 0.1.2 → 0.2.0

package/skills/tauri-2-app/references/templates/macos-plist.md

@@ -0,0 +1,89 @@
+# macOS `Info.plist` and `entitlements.plist`
+
+Both files live at `src-tauri/Info.plist` and `src-tauri/entitlements.plist` and are referenced from `tauri.conf.json` `bundle.macOS`.
+
+## `Info.plist`
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleIdentifier</key>
+    <string>{{bundle.identifier}}</string>
+
+    <!-- Usage descriptions: REQUIRED for every OS permission the app requests. -->
+    <!-- Without these, the permission prompt never shows and the call returns "denied". -->
+
+    <!-- Microphone — required if the app uses cpal / AVFoundation audio input. -->
+    <!-- <key>NSMicrophoneUsageDescription</key>
+    <string>{{ProductName}} needs the microphone to record voice input.</string> -->
+
+    <!-- Accessibility — required if the app sends synthetic keystrokes / reads UI. -->
+    <!-- <key>NSAccessibilityUsageDescription</key>
+    <string>{{ProductName}} needs Accessibility access to insert text into other apps.</string> -->
+
+    <!-- AppleEvents — required if the app sends AppleScript to other apps. -->
+    <!-- <key>NSAppleEventsUsageDescription</key>
+    <string>{{ProductName}} needs AppleEvents to control other applications.</string> -->
+
+    <!-- Camera, Location, Contacts, Calendar, Photos, etc. — add as needed. -->
+</dict>
+</plist>
+```
+
+**Uncomment only the permissions the app actually uses.** Apple's notarization process flags apps that request permissions they don't exercise.
+
+## `entitlements.plist`
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Start with an EMPTY dict and add entitlements only when needed. -->
+    <!-- Each entitlement weakens the hardened runtime; the goal is minimum. -->
+
+    <!-- Audio input — required for microphone capture under sandbox/hardened runtime. -->
+    <!-- <key>com.apple.security.device.audio-input</key>
+    <true/> -->
+
+    <!-- AppleEvents — only if Info.plist also has NSAppleEventsUsageDescription. -->
+    <!-- <key>com.apple.security.automation.apple-events</key>
+    <true/> -->
+
+    <!-- JIT — only if the app embeds a JIT VM (rare; e.g. some ML runtimes). -->
+    <!-- <key>com.apple.security.cs.allow-jit</key>
+    <true/> -->
+
+    <!-- Unsigned executable memory — needed by some unsigned native libraries. -->
+    <!-- AVOID if possible; it weakens code-signing protections. -->
+    <!-- <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/> -->
+</dict>
+</plist>
+```
+
+## How to know which entitlements you need
+
+Don't guess. Build the app, run it, and watch Console.app for messages like:
+
+```
+{{ProductName}} (12345) deny(1) device-microphone
+```
+
+That tells you the missing entitlement — in this case, `com.apple.security.device.audio-input`. Add it, rebuild, retest.
+
+For network entitlements (`com.apple.security.network.client`, `com.apple.security.network.server`), only enable if running under the App Store sandbox. The hardened runtime by itself does not block network access.
+
+## Why minimal entitlements matter
+
+- **Notarization**: Apple's notarization service reviews entitlement lists. Over-broad entitlements (`com.apple.security.cs.disable-library-validation`, `com.apple.security.cs.allow-dyld-environment-variables`) may delay or block notarization.
+- **App Store**: stricter still. Only specific entitlements are allowed for App Store apps.
+- **Security audit surface**: if a CVE is found in a framework you don't use, an unused entitlement does not save you; if you weren't using `com.apple.security.cs.allow-jit`, you're not affected by JIT-related issues. Tight entitlements = tight blast radius.
+
+## Why minimal usage descriptions matter
+
+- Listing `NSCameraUsageDescription` when the app never accesses the camera misleads users about what the app does, and macOS may still prompt for the permission inappropriately.
+- App Store reviewers reject apps that request permissions they don't use.
+- The strings appear in System Settings → Privacy → Microphone (etc.). Make them descriptive ("X needs the microphone to transcribe voice notes" is better than "X needs microphone access").

package/skills/tauri-2-app/references/templates/main-rs.md

@@ -0,0 +1,21 @@
+# `src-tauri/src/main.rs`
+
+The tiny shim that calls into `lib.rs`. Keep it short — all logic lives in `lib.rs`.
+
+```rust
+// Prevents additional console window on Windows in release. DO NOT REMOVE.
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+#[cfg(target_os = "macos")]
+embed_plist::embed_info_plist!("../Info.plist");
+
+fn main() {
+    {{app_name}}_lib::run()
+}
+```
+
+## Why
+
+- `#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]` — Without this attribute, Windows release builds open a console window behind the Tauri window. Debug builds keep their console for `println!`.
+- `embed_plist::embed_info_plist!` — Ensures macOS standalone binaries (run directly, not through the `.app` bundle) still carry the plist. Gated to macOS via `#[cfg(target_os = "macos")]`.
+- `{{app_name}}_lib::run()` — The `_lib` suffix on the crate name avoids a Windows linker conflict between the bin and lib targets. The actual function is defined in `lib.rs`.

package/skills/tauri-2-app/references/templates/platform-traits.md

@@ -0,0 +1,217 @@
+# `src-tauri/src/platform/` — Trait-based platform abstractions
+
+Pattern: define traits in `platform/traits.rs`, implement per-OS in `macos.rs|windows.rs|linux.rs` gated with `#[cfg(target_os = "...")]`, expose `Send + Sync` wrappers via `wrappers.rs` for Tauri State. Commands receive `State<'_, PlatformXxx>` — they never see `cfg!`.
+
+## `platform/traits.rs`
+
+```rust
+//! Platform trait contracts. Implementations live in `macos.rs`, `windows.rs`,
+//! `linux.rs` and are gated with `#[cfg(target_os = "...")]`.
+
+use std::path::Path;
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+pub struct PermissionStatus {
+    pub is_macos: bool,
+    pub accessibility: bool,
+    pub microphone: bool,
+    pub notification: bool,
+    pub all_granted: bool,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum PlatformError {
+    #[error("command execution error: {0}")]
+    CommandError(String),
+    #[error("unsupported on this platform")]
+    Unsupported,
+}
+
+/// Check OS-level permissions (mic, accessibility, notifications).
+pub trait PermissionChecker: Send + Sync {
+    fn check_accessibility(&self) -> bool;
+    fn check_microphone(&self) -> bool;
+    fn check_notification(&self) -> bool;
+    fn get_status(&self) -> PermissionStatus;
+    fn open_system_settings(&self, permission_type: &str) -> Result<(), String>;
+}
+
+/// Open files/folders in OS-default apps.
+pub trait FileOpener: Send + Sync {
+    fn open_in_default_app(&self, path: &Path) -> Result<(), String>;
+    fn open_in_file_manager(&self, path: &Path) -> Result<(), String>;
+    fn open_in_text_editor(&self, path: &Path) -> Result<(), String>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn permission_status_round_trips() {
+        let s = PermissionStatus {
+            is_macos: true, accessibility: true, microphone: false,
+            notification: true, all_granted: false,
+        };
+        let json = serde_json::to_string(&s).unwrap();
+        let back: PermissionStatus = serde_json::from_str(&json).unwrap();
+        assert_eq!(s.microphone, back.microphone);
+    }
+}
+```
+
+## `platform/macos.rs` (sketch)
+
+```rust
+#![cfg(target_os = "macos")]
+
+use std::path::Path;
+use std::process::Command;
+use crate::platform::traits::{FileOpener, PermissionChecker, PermissionStatus};
+
+pub struct MacOsPlatform;
+
+impl PermissionChecker for MacOsPlatform {
+    fn check_accessibility(&self) -> bool {
+        // Use AXIsProcessTrusted via security-framework or objc bindings.
+        // For brevity, this stub assumes a helper exists.
+        unimplemented!("call AXIsProcessTrusted")
+    }
+    fn check_microphone(&self) -> bool {
+        unimplemented!("call AVCaptureDevice.authorizationStatus")
+    }
+    fn check_notification(&self) -> bool { true }
+    fn get_status(&self) -> PermissionStatus {
+        PermissionStatus {
+            is_macos: true,
+            accessibility: self.check_accessibility(),
+            microphone: self.check_microphone(),
+            notification: self.check_notification(),
+            all_granted: false, // compute from above
+        }
+    }
+    fn open_system_settings(&self, kind: &str) -> Result<(), String> {
+        let url = match kind {
+            "accessibility" => "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility",
+            "microphone" => "x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone",
+            _ => return Err(format!("unknown permission: {}", kind)),
+        };
+        Command::new("open").arg(url).spawn()
+            .map(|_| ()).map_err(|e| e.to_string())
+    }
+}
+
+impl FileOpener for MacOsPlatform {
+    fn open_in_default_app(&self, path: &Path) -> Result<(), String> {
+        Command::new("open").arg(path).spawn().map(|_| ()).map_err(|e| e.to_string())
+    }
+    fn open_in_file_manager(&self, path: &Path) -> Result<(), String> {
+        Command::new("open").arg("-R").arg(path).spawn().map(|_| ()).map_err(|e| e.to_string())
+    }
+    fn open_in_text_editor(&self, path: &Path) -> Result<(), String> {
+        Command::new("open").arg("-t").arg(path).spawn().map(|_| ()).map_err(|e| e.to_string())
+    }
+}
+```
+
+`platform/windows.rs` and `platform/linux.rs` follow the same shape with `Command::new("explorer")` / `Command::new("xdg-open")` etc.
+
+## `platform/wrappers.rs`
+
+Wrappers exist so Tauri's `State<T>` (which requires `T: Send + Sync`) can hold the platform impl regardless of OS.
+
+```rust
+use crate::platform::traits::{FileOpener, PermissionChecker, PermissionStatus};
+use std::path::Path;
+
+pub struct PlatformPermissionChecker {
+    #[cfg(target_os = "macos")] inner: super::MacOsPlatform,
+    #[cfg(target_os = "windows")] inner: super::WindowsPlatform,
+    #[cfg(target_os = "linux")] inner: super::LinuxPlatform,
+}
+
+impl PlatformPermissionChecker {
+    pub fn new() -> Self {
+        Self {
+            #[cfg(target_os = "macos")] inner: super::MacOsPlatform,
+            #[cfg(target_os = "windows")] inner: super::WindowsPlatform,
+            #[cfg(target_os = "linux")] inner: super::LinuxPlatform,
+        }
+    }
+}
+
+impl PermissionChecker for PlatformPermissionChecker {
+    fn check_accessibility(&self) -> bool { self.inner.check_accessibility() }
+    fn check_microphone(&self) -> bool { self.inner.check_microphone() }
+    fn check_notification(&self) -> bool { self.inner.check_notification() }
+    fn get_status(&self) -> PermissionStatus { self.inner.get_status() }
+    fn open_system_settings(&self, k: &str) -> Result<(), String> {
+        self.inner.open_system_settings(k)
+    }
+}
+
+pub struct PlatformFileOpener { /* same shape */ }
+// ... impl FileOpener for PlatformFileOpener ...
+```
+
+## `platform/mod.rs`
+
+```rust
+pub mod traits;
+pub mod wrappers;
+
+#[cfg(target_os = "macos")] mod macos;
+#[cfg(target_os = "windows")] mod windows;
+#[cfg(target_os = "linux")] mod linux;
+
+#[cfg(target_os = "macos")] pub use macos::MacOsPlatform;
+#[cfg(target_os = "windows")] pub use windows::WindowsPlatform;
+#[cfg(target_os = "linux")] pub use linux::LinuxPlatform;
+
+pub use traits::{PermissionChecker, PermissionStatus, FileOpener};
+pub use wrappers::{PlatformPermissionChecker, PlatformFileOpener};
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn wrappers_are_send_sync() {
+        fn assert_send_sync<T: Send + Sync>() {}
+        assert_send_sync::<PlatformPermissionChecker>();
+        assert_send_sync::<PlatformFileOpener>();
+    }
+}
+```
+
+## Usage in `lib.rs`
+
+```rust
+.setup(|app| {
+    app.manage(PlatformPermissionChecker::new());
+    app.manage(PlatformFileOpener::new());
+    Ok(())
+})
+```
+
+## Usage in commands
+
+```rust
+#[tauri::command]
+pub fn open_in_finder(
+    opener: tauri::State<'_, PlatformFileOpener>,
+    path: String,
+) -> Result<(), String> {
+    use crate::platform::FileOpener;
+    opener.open_in_file_manager(std::path::Path::new(&path))
+}
+```
+
+The command is **portable** — no `cfg!` checks, no `#[cfg(target_os = "...")]` attributes, no platform-specific imports.
+
+## Why this is worth the structural overhead
+
+- **Adding a fourth OS** (BSD, mobile) is one new `platform/<os>.rs` file plus a `#[cfg]` arm in the wrapper. Commands don't change.
+- **Mocking in tests** is trivial — define a `MockPermissionChecker` that implements `PermissionChecker`, register it in the test setup via `app.manage(...)`.
+- **Audit surface** — all OS-specific code is in `platform/<os>.rs`. A security review of "what does the macOS build do differently?" reads one file.
+- **Build times** — Cargo skips compiling `platform/windows.rs` on macOS targets entirely (the `#[cfg]` gate). No wasted work.

package/skills/tauri-2-app/references/templates/storage-mod.md

@@ -0,0 +1,172 @@
+# `src-tauri/src/storage/mod.rs`
+
+Shared JSON-on-disk utilities used by `settings/`, `history/`, `error_log/`, and any other module that persists structured data. **Every persistent feature uses these primitives** — never raw `std::fs` against `app_data_dir`.
+
+```rust
+//! Shared storage utilities: paths, JSON I/O, IDs, timestamps, pruning.
+
+use std::fs;
+use std::path::PathBuf;
+use chrono::Utc;
+use serde::{de::DeserializeOwned, Serialize};
+use tauri::{AppHandle, Manager};
+
+/// Resolve and create the app data directory.
+pub fn get_app_data_dir(app: &AppHandle) -> Result<PathBuf, String> {
+    let dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("Failed to get app data directory: {}", e))?;
+    fs::create_dir_all(&dir)
+        .map_err(|e| format!("Failed to create app data directory: {}", e))?;
+    Ok(dir)
+}
+
+/// Resolve a path inside the app data directory.
+pub fn get_storage_path(app: &AppHandle, filename: &str) -> Result<PathBuf, String> {
+    Ok(get_app_data_dir(app)?.join(filename))
+}
+
+/// Load a `Vec<T>` from a JSON file. Returns empty on missing / invalid file
+/// (logged at info / error level).
+pub fn load_json<T: DeserializeOwned>(app: &AppHandle, filename: &str) -> Vec<T> {
+    let path = match get_storage_path(app, filename) {
+        Ok(p) => p,
+        Err(e) => {
+            tracing::error!("Storage path error for {}: {}", filename, e);
+            return Vec::new();
+        }
+    };
+
+    if !path.exists() {
+        tracing::info!("Storage file {} not found, starting empty", filename);
+        return Vec::new();
+    }
+
+    let content = match fs::read_to_string(&path) {
+        Ok(c) => c,
+        Err(e) => {
+            tracing::error!("Failed to read {}: {}", filename, e);
+            return Vec::new();
+        }
+    };
+
+    match serde_json::from_str::<Vec<T>>(&content) {
+        Ok(entries) => {
+            tracing::info!("Loaded {} entries from {}", entries.len(), filename);
+            entries
+        }
+        Err(e) => {
+            tracing::error!("Failed to parse JSON for {}: {}", filename, e);
+            Vec::new()
+        }
+    }
+}
+
+/// Save a slice as pretty-printed JSON to `filename` inside the app data dir.
+pub fn save_json<T: Serialize>(
+    app: &AppHandle,
+    filename: &str,
+    entries: &[T],
+) -> Result<(), String> {
+    let path = get_storage_path(app, filename)?;
+    let json = serde_json::to_string_pretty(entries)
+        .map_err(|e| format!("Failed to serialize: {}", e))?;
+    fs::write(&path, json).map_err(|e| format!("Failed to write {}: {}", filename, e))?;
+    tracing::info!("Saved {} entries to {}", entries.len(), path.display());
+    Ok(())
+}
+
+/// Generate a unique ID from nanoseconds since epoch.
+pub fn generate_id() -> String {
+    format!("{:x}", Utc::now().timestamp_nanos_opt().unwrap_or(0))
+}
+
+/// Generate a unique ID with a prefix.
+pub fn generate_id_with_prefix(prefix: &str) -> String {
+    format!("{}{:x}", prefix, Utc::now().timestamp_nanos_opt().unwrap_or(0))
+}
+
+/// Current ISO 8601 timestamp (UTC).
+pub fn get_timestamp() -> String {
+    Utc::now().to_rfc3339()
+}
+
+/// Parse an RFC 3339 timestamp to seconds since epoch.
+pub fn parse_timestamp_to_seconds(s: &str) -> Option<u64> {
+    chrono::DateTime::parse_from_rfc3339(s)
+        .ok()
+        .map(|dt| dt.timestamp() as u64)
+}
+
+/// Trait for entries that carry a timestamp string.
+pub trait Timestamped {
+    fn timestamp(&self) -> &str;
+}
+
+/// Drop entries older than `days_to_keep` days. Unparseable timestamps are kept.
+pub fn prune_entries_by_age<T: Timestamped>(entries: Vec<T>, days_to_keep: u64) -> Vec<T> {
+    let cutoff = Utc::now().timestamp() as u64 - (days_to_keep * 24 * 3600);
+    entries
+        .into_iter()
+        .filter(|e| match parse_timestamp_to_seconds(e.timestamp()) {
+            Some(s) => s > cutoff,
+            None => {
+                tracing::warn!("Unparseable timestamp '{}', keeping entry", e.timestamp());
+                true
+            }
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ids_are_unique_within_a_nanosecond_resolution() {
+        let a = generate_id();
+        std::thread::sleep(std::time::Duration::from_nanos(1));
+        let b = generate_id();
+        assert_ne!(a, b);
+    }
+
+    #[test]
+    fn timestamp_is_rfc3339() {
+        let ts = get_timestamp();
+        assert!(chrono::DateTime::parse_from_rfc3339(&ts).is_ok());
+    }
+
+    #[test]
+    fn prune_drops_old_entries() {
+        struct E(String);
+        impl Timestamped for E {
+            fn timestamp(&self) -> &str { &self.0 }
+        }
+        let now = Utc::now();
+        let old = now - chrono::Duration::days(10);
+        let new = now - chrono::Duration::days(1);
+        let entries = vec![
+            E(old.to_rfc3339()),
+            E(new.to_rfc3339()),
+        ];
+        let kept = prune_entries_by_age(entries, 5);
+        assert_eq!(kept.len(), 1);
+    }
+}
+```
+
+## Why use `chrono`
+
+The "hand-rolled date math" pattern (`seconds_since_epoch / 86400`, manual leap-year tables, manual month-length tables) is a classic anti-pattern. It looks small but every special case is a future bug — DST, leap seconds, century leap years, year-2038 on 32-bit platforms. `chrono` is ~200KB compressed, well-tested, and used everywhere. Skip the temptation to "save a dep".
+
+## Error handling philosophy
+
+`load_json` returns `Vec<T>` rather than `Result<Vec<T>, _>`. Reasoning:
+- Missing files are normal (first run).
+- Parse errors are rare but should not crash the app — log and start fresh.
+- Callers always want to keep going with an empty list rather than abort.
+
+`save_json` returns `Result<_, String>` because a failed save is a real user-visible problem the UI should surface.
+
+If a domain genuinely needs `Result<Vec<T>, _>` semantics on load (e.g. settings that can't safely default), wrap this primitive in a domain-specific function that does the strictness check.

package/skills/tauri-2-app/references/templates/tauri-conf.md

@@ -0,0 +1,136 @@
+# `src-tauri/tauri.conf.json`
+
+```json
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "{{ProductName}}",
+  "version": "0.1.0",
+  "identifier": "{{bundle.identifier}}",
+  "build": {
+    "beforeDevCommand": "npm run dev",
+    "devUrl": "http://localhost:5173",
+    "beforeBuildCommand": "npm run build",
+    "frontendDist": "../dist"
+  },
+  "app": {
+    "security": {
+      "csp": null
+    },
+    "windows": [
+      {
+        "label": "main",
+        "title": "{{ProductName}}",
+        "width": 1000,
+        "height": 700,
+        "minWidth": 600,
+        "minHeight": 400,
+        "center": true,
+        "visible": true,
+        "dragDropEnabled": true
+      }
+    ]
+  },
+  "bundle": {
+    "active": true,
+    "targets": "all",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ],
+    "macOS": {
+      "infoPlist": "./Info.plist",
+      "entitlements": "./entitlements.plist",
+      "minimumSystemVersion": "10.15",
+      "hardenedRuntime": true
+    },
+    "windows": {
+      "nsis": {
+        "displayLanguageSelector": false,
+        "installMode": "perMachine",
+        "compression": "lzma"
+      },
+      "webviewInstallMode": {
+        "type": "embedBootstrapper"
+      }
+    }
+  }
+}
+```
+
+## When the updater is enabled
+
+Add (only if the user has generated a signing key with `npx tauri signer generate` AND has a manifest URL):
+
+```json
+"bundle": {
+  // ... other fields
+  "createUpdaterArtifacts": true
+},
+"plugins": {
+  "updater": {
+    "active": true,
+    "endpoints": ["{{updater_manifest_url}}"],
+    "dialog": false,
+    "pubkey": "{{tauri_signing_pubkey}}"
+  }
+}
+```
+
+**Never** invent an `endpoints` URL or a `pubkey`. Both come from the user. The pubkey is a base64-encoded minisign public key produced by `tauri signer generate`. The endpoint is a JSON manifest the user controls (typical shape below).
+
+## Updater manifest shape (the URL points at this)
+
+```json
+{
+  "version": "1.0.0",
+  "notes": "Initial release",
+  "pub_date": "2026-01-15T10:30:00Z",
+  "platforms": {
+    "windows-x86_64": {
+      "signature": "{{full base64 contents of .sig file}}",
+      "url": "{{cdn-url}}/{{ProductName}}_1.0.0_x64-setup.exe"
+    },
+    "darwin-aarch64": {
+      "signature": "{{full base64 contents of .sig file}}",
+      "url": "{{cdn-url}}/{{ProductName}}_1.0.0_aarch64.dmg"
+    }
+  }
+}
+```
+
+## Why these defaults
+
+- **`identifier`** is reverse-DNS (e.g. `com.example.myapp`) and **cannot change** after release — it's the OS-level identity for keychain entries, settings paths, notification permissions, and update channels. Always ask the user.
+- **`csp: null`** is the Tauri default and works for many apps. If the WebView loads remote content, set an explicit CSP whitelisting `tauri://localhost` plus any trusted origins.
+- **`windows[].devtools` is omitted** — Tauri's default is off in release. Adding `"devtools": true` ships an inspect-element surface to every user.
+- **`bundle.targets: "all"`** lets `tauri build` pick the right installer format for the host OS (DMG on macOS, NSIS on Windows, AppImage/deb on Linux).
+- **`macOS.hardenedRuntime: true`** is required for notarization. Pair with a minimal `entitlements.plist` listing **only** what the app uses.
+- **`nsis.installMode: "perMachine"`** installs for all users on Windows. Use `"currentUser"` for per-user installs (no admin prompt, but registry keys live under `HKCU`).
+- **`webviewInstallMode: "embedBootstrapper"`** ships the WebView2 bootstrapper inside the installer so users on stripped Windows builds without WebView2 can still install.
+
+## Local config overlay
+
+Tauri supports loading additional config files. Useful for local development with the updater disabled:
+
+```bash
+# src-tauri/tauri.local-no-updater.conf.json
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "plugins": {
+    "updater": {
+      "active": false
+    }
+  }
+}
+```
+
+Then build with:
+
+```bash
+npx @tauri-apps/cli build --config tauri.local-no-updater.conf.json
+```
+
+This avoids needing signing keys on every developer's machine.