@omega.js/desktop 0.1.0

package/dist/test/suites/build/derive-signing-env.test.js

@@ -0,0 +1,122 @@
+// derive-signing-env tests — the .env stamp the manager's disperse service used
+// to write is derived at build time instead
+// ([#678](https://github.com/Omega-JS-Stack/omega/issues/678)).
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const jetpack = require('fs-jetpack');
+
+const deriveSigningEnv = require('../../../utils/derive-signing-env.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+function stageTarget(files) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-derive-'));
+  for (const file of files) {
+    jetpack.write(path.join(tmp, 'config', 'certs', file), 'artifact');
+  }
+  return tmp;
+}
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'derive-signing-env',
+  tests: [
+    {
+      name: 'unset + the file is delivered → the target-relative path is set',
+      run: (ctx) => {
+        const tmp = stageTarget(['developer-id-application.p12', 'AuthKey_ABCDE12345.p8']);
+
+        try {
+          const env = { APPLE_API_KEY_ID: 'ABCDE12345' };
+          const derived = deriveSigningEnv({ env, projectDir: tmp });
+
+          ctx.expect(env.CSC_LINK).toBe('config/certs/developer-id-application.p12');
+          ctx.expect(env.APPLE_API_KEY).toBe('config/certs/AuthKey_ABCDE12345.p8');
+          ctx.expect(derived.map((entry) => entry.key).sort()).toEqual(['APPLE_API_KEY', 'CSC_LINK']);
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'already set → never overridden (an explicit answer wins)',
+      run: (ctx) => {
+        const tmp = stageTarget(['developer-id-application.p12', 'AuthKey_ABCDE12345.p8']);
+
+        try {
+          const env = {
+            APPLE_API_KEY_ID: 'ABCDE12345',
+            CSC_LINK: '/keychain/mine.p12',
+            APPLE_API_KEY: '/secrets/AuthKey.p8',
+          };
+          const derived = deriveSigningEnv({ env, projectDir: tmp });
+
+          ctx.expect(env.CSC_LINK).toBe('/keychain/mine.p12');
+          ctx.expect(env.APPLE_API_KEY).toBe('/secrets/AuthKey.p8');
+          ctx.expect(derived).toEqual([]);
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'the file is absent → the key stays unset (electron-builder skips/auto-discovers)',
+      run: (ctx) => {
+        const tmp = stageTarget([]);
+
+        try {
+          const env = { APPLE_API_KEY_ID: 'ABCDE12345' };
+          const derived = deriveSigningEnv({ env, projectDir: tmp });
+
+          ctx.expect('CSC_LINK' in env).toBe(false);
+          ctx.expect('APPLE_API_KEY' in env).toBe(false);
+          ctx.expect(derived).toEqual([]);
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'no APPLE_API_KEY_ID → no notarization path to derive',
+      run: (ctx) => {
+        const tmp = stageTarget(['AuthKey_ABCDE12345.p8']);
+
+        try {
+          const env = {};
+          deriveSigningEnv({ env, projectDir: tmp });
+
+          ctx.expect('APPLE_API_KEY' in env).toBe(false);
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // The gulp boot is too heavy to require here (it pulls in Manager, gulp and
+      // every task), so the call site is checked statically: the option name has
+      // to be the one the deriver reads, and the value it passes has to be a
+      // binding main.js actually declares. Shipped bound to an undeclared
+      // `projectDir` once, which is a ReferenceError on every desktop build.
+      name: 'the gulp main call site passes a declared binding as projectDir',
+      run: (ctx) => {
+        const source = fs.readFileSync(path.join(__dirname, '..', '..', '..', 'gulp', 'main.js'), 'utf8');
+        const call = source.match(/require\('\.\.\/utils\/derive-signing-env\.js'\)\(\{([^}]*)\}\)/);
+        ctx.expect(call).toBeTruthy();
+
+        const options = {};
+        for (const part of call[1].split(',')) {
+          const [name, value] = part.split(':').map((piece) => piece.trim());
+          options[name] = value === undefined ? name : value;
+        }
+
+        ctx.expect(Object.keys(options).sort()).toEqual(['env', 'projectDir']);
+
+        const binding = options.projectDir;
+        const declared = new RegExp(`\\b(?:const|let|var)\\s+${binding}\\s*=`).test(source);
+        ctx.expect(declared).toBe(true);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/electron-node-version.test.js

@@ -0,0 +1,49 @@
+// Build-layer tests for src/utils/electron-node-version.js — resolves the Node.js major
+// version Electron's bundled runtime ships with by querying the electron releases feed.
+//
+// Network-dependent: skipped if OMEGA_TEST_OFFLINE=true.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'electron-node-version — resolve bundled Node from electron version',
+  tests: [
+    {
+      name: 'module exports the expected surface',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'utils', 'electron-node-version.js'));
+        ctx.expect(typeof mod.resolveNodeMajorForElectron).toBe('function');
+        ctx.expect(typeof mod.fetchReleases).toBe('function');
+      },
+    },
+    {
+      name: 'resolveNodeMajorForElectron(null) returns null',
+      run: async (ctx) => {
+        const { resolveNodeMajorForElectron } = require(path.join(__dirname, '..', '..', '..', 'utils', 'electron-node-version.js'));
+        const result = await resolveNodeMajorForElectron(null);
+        ctx.expect(result).toBe(null);
+      },
+    },
+    {
+      name: 'resolveNodeMajorForElectron("^41.0.0") returns 24 (real lookup)',
+      run: async (ctx) => {
+        if (process.env.OMEGA_TEST_OFFLINE === 'true') ctx.skip('offline mode');
+        const { resolveNodeMajorForElectron } = require(path.join(__dirname, '..', '..', '..', 'utils', 'electron-node-version.js'));
+        const result = await resolveNodeMajorForElectron('^41.0.0');
+        ctx.expect(String(result)).toBe('24');
+      },
+    },
+    {
+      name: 'resolveNodeMajorForElectron("^999.0.0") returns null (no match)',
+      run: async (ctx) => {
+        if (process.env.OMEGA_TEST_OFFLINE === 'true') ctx.skip('offline mode');
+        const { resolveNodeMajorForElectron } = require(path.join(__dirname, '..', '..', '..', 'utils', 'electron-node-version.js'));
+        const result = await resolveNodeMajorForElectron('^999.0.0');
+        ctx.expect(result).toBe(null);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/electron-targets.test.js

@@ -0,0 +1,92 @@
+// The syntax floor the three bundles compile to, read from the PINNED Electron
+// binary ([#737](https://github.com/Omega-JS-Stack/omega/issues/737)).
+//
+// The interesting half is the FAILURE: a CI job with ELECTRON_SKIP_BINARY_DOWNLOAD
+// has an electron package and no executable, and a build there must still build.
+// So an unrunnable binary answers nulls and says why — it never invents a
+// version, and it never throws the build away.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const electronTargets = require(path.join(__dirname, '..', '..', '..', 'utils', 'electron-targets.js'));
+
+// A path that cannot be a binary, unique per case so the module-level memo of a
+// previous case is never the thing under test.
+function bogusBinary(name) {
+  return path.join(__dirname, '..', '..', '..', '..', '.temp', `no-such-electron-${name}-${process.pid}`);
+}
+
+// A logger that also records its own `this`: the devkit Logger reads its
+// `[@omega.js/<package>:<module>]` tag off `this`, so a warn called as a
+// detached function prints `[undefined:undefined]`.
+function collectWarnings() {
+  const lines = [];
+  const receivers = [];
+  const logger = {
+    warn(line) {
+      receivers.push(this);
+      lines.push(line);
+    },
+  };
+  return { logger, lines, receivers };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'electron-targets — the syntax floor comes from the pinned Electron, or from nothing',
+  timeout: 60000,
+  tests: [
+    {
+      name: 'the installed Electron answers a real node and chrome target',
+      run: (ctx) => {
+        const binary = require(require.resolve('electron', { paths: [path.join(__dirname, '..', '..', '..', '..')] }));
+        const targets = electronTargets(binary);
+
+        ctx.expect(/^node\d+\.\d+\.\d+$/.test(targets.node)).toBe(true);
+        ctx.expect(/^chrome\d+$/.test(targets.chrome)).toBe(true);
+        ctx.expect(/^\d+\./.test(targets.electron)).toBe(true);
+      },
+    },
+
+    {
+      name: 'a binary that cannot be run answers nulls and warns once — the build keeps going with no floor',
+      run: (ctx) => {
+        const binary = bogusBinary('warns');
+        const { logger, lines, receivers } = collectWarnings();
+
+        ctx.expect(electronTargets(binary, { logger })).toEqual({ node: null, chrome: null, electron: null });
+        ctx.expect(lines.length).toBe(1);
+        ctx.expect(lines[0]).toContain(binary);
+        ctx.expect(lines[0]).toContain('no syntax floor');
+        // The warn is called ON the logger, so a real Logger keeps its tag.
+        ctx.expect(receivers[0]).toBe(logger);
+      },
+    },
+
+    {
+      name: 'the answer is memoized per binary — one probe (and one warn) per build, not one per bundle',
+      run: (ctx) => {
+        const binary = bogusBinary('memo');
+        const first = collectWarnings();
+        const second = collectWarnings();
+
+        const a = electronTargets(binary, { logger: first.logger });
+        const b = electronTargets(binary, { logger: second.logger });
+
+        ctx.expect(first.lines.length).toBe(1);
+        // The second call never reached the probe, so it never warned either.
+        ctx.expect(second.lines.length).toBe(0);
+        ctx.expect(b).toBe(a);
+      },
+    },
+
+    {
+      name: 'a failed probe with no logger is silent, not a crash',
+      run: (ctx) => {
+        ctx.expect(electronTargets(bogusBinary('silent'))).toEqual({ node: null, chrome: null, electron: null });
+      },
+    },
+  ],
+});

package/dist/test/suites/build/ensure-target.test.js

@@ -0,0 +1,131 @@
+// ensure-target + deploy-precheck — the two halves `omega setup` used to be
+// ([#675](https://github.com/Omega-JS-Stack/omega/issues/675)): the local half
+// runs on every verb and is idempotent, the network half is a deploy precheck
+// with one opt-out flag.
+//
+// The fixture is a real consumer manifest that already satisfies the peer
+// dependencies, so nothing installs — a satisfied target installing nothing is
+// exactly what makes ensureTarget safe on every verb.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const jetpack = require('fs-jetpack');
+
+const SRC = path.join(__dirname, '..', '..', '..');
+const Manager = require(path.join(SRC, 'build.js'));
+const { ensureTarget } = require(path.join(SRC, 'commands', 'lib', 'ensure-target.js'));
+const { deployPrecheck } = require(path.join(SRC, 'commands', 'lib', 'deploy-precheck.js'));
+const cli = require(path.join(SRC, 'cli.js'));
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const package = Manager.getPackage('main');
+
+// A consumer whose peer deps are already satisfied — the steady state.
+function stageConsumer() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-ensure-'));
+  const devDependencies = { [package.name]: `^${package.version}` };
+  for (const [name, ver] of Object.entries(package.peerDependencies || {})) {
+    devDependencies[name] = ver;
+  }
+  jetpack.write(path.join(tmp, 'package.json'), `${JSON.stringify({ name: 'staged-app', version: '1.0.0', devDependencies }, null, 2)}\n`);
+  return tmp;
+}
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'ensure-target — the local half every verb runs (#675)',
+  tests: [
+    {
+      name: 'writes on a fresh target, no-op on the rerun',
+      run: async (ctx) => {
+        const tmp = stageConsumer();
+
+        try {
+          const first = await ensureTarget({ projectDir: tmp });
+
+          ctx.expect(first.written.length > 0).toBe(true);
+          ctx.expect(first.changed.some((line) => line.startsWith('package.json'))).toBe(true);
+          ctx.expect(jetpack.exists(path.join(tmp, '.nvmrc'))).toBeTruthy();
+          // No `.env` scaffolds ([#678](https://github.com/Omega-JS-Stack/omega/issues/678)):
+          // a target .env is a human-only override; keys live in the brand root .env.
+          ctx.expect(jetpack.exists(path.join(tmp, '.env'))).toBe(false);
+
+          const manifest = jetpack.read(path.join(tmp, 'package.json'), 'json');
+          ctx.expect(manifest.main).toBe('dist/main.bundle.js');
+          ctx.expect(manifest.private).toBe(true);
+          // The synced scripts never mention the retired command
+          ctx.expect(JSON.stringify(manifest.scripts).includes('omega setup')).toBe(false);
+
+          // The rerun adds nothing and syncs nothing.
+          const second = await ensureTarget({ projectDir: tmp });
+          ctx.expect(second).toEqual({ written: [], merged: [], changed: [] });
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'refuses a workspace root, loudly, without writing a single file (#699)',
+      run: async (ctx) => {
+        // The accident: `omega deploy` at a workspace root scaffolded a whole
+        // desktop target into it — gulpfile, src/, hooks/, workflows, rewritten
+        // root scripts — before failing anyway.
+        const tmp = stageConsumer();
+        const manifestPath = path.join(tmp, 'package.json');
+        const manifest = jetpack.read(manifestPath, 'json');
+        manifest.workspaces = ['packages/*'];
+        jetpack.write(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+        const before = jetpack.read(manifestPath);
+
+        try {
+          let refusal = null;
+          try {
+            await ensureTarget({ projectDir: tmp });
+          } catch (e) {
+            refusal = e;
+          }
+
+          ctx.expect(refusal).toBeTruthy();
+          ctx.expect(refusal.message).toMatch(/refusing to scaffold into/);
+          ctx.expect(refusal.message).toMatch(/declares "workspaces"/);
+          ctx.expect(refusal.message.includes(tmp)).toBe(true);
+
+          // Nothing scaffolded, and the manifest is byte-identical.
+          ctx.expect(jetpack.list(tmp)).toEqual(['package.json']);
+          ctx.expect(jetpack.read(manifestPath)).toBe(before);
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'deploy precheck: --no-secrets skips every step, bare deploy runs them in order',
+      run: async (ctx) => {
+        const quiet = { log() {}, warn() {}, error() {} };
+        const ran = [];
+        const steps = ['framework-freshness', 'validate-certs', 'provision-repos', 'push-secrets']
+          .map((name) => ({ name, run: () => { ran.push(name); } }));
+
+        const skipped = await deployPrecheck({ projectDir: '/tmp/x', options: { secrets: false }, logger: quiet, steps });
+        ctx.expect(skipped).toEqual({ skipped: 'opt-out' });
+        ctx.expect(ran).toEqual([]);
+
+        const result = await deployPrecheck({ projectDir: '/tmp/x', options: {}, logger: quiet, steps });
+        ctx.expect(ran).toEqual(['framework-freshness', 'validate-certs', 'provision-repos', 'push-secrets']);
+        ctx.expect(result.ran).toEqual(ran);
+      },
+    },
+    {
+      name: 'cli: no `setup` command, and a bare invocation resolves to help',
+      run: (ctx) => {
+        const { commandsDir, aliases, defaultCommand } = cli.config;
+
+        ctx.expect(defaultCommand).toBe('help');
+        ctx.expect('setup' in aliases).toBe(false);
+        ctx.expect(jetpack.exists(path.join(commandsDir, 'setup.js'))).toBe(false);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/entitlements.test.js

@@ -0,0 +1,107 @@
+// Build-layer tests for lib/sign-helpers/entitlements.js — defaults merge + plist render.
+
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'entitlements — mac plist generation',
+  tests: [
+    {
+      name: 'module exposes DEFAULT_MAC_ENTITLEMENTS + helpers',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        ctx.expect(typeof mod.DEFAULT_MAC_ENTITLEMENTS).toBe('object');
+        ctx.expect(typeof mod.mergeMacEntitlements).toBe('function');
+        ctx.expect(typeof mod.renderPlist).toBe('function');
+        ctx.expect(typeof mod.writeMacEntitlements).toBe('function');
+      },
+    },
+    {
+      name: 'defaults include the canonical hardened-runtime keys',
+      run: (ctx) => {
+        const { DEFAULT_MAC_ENTITLEMENTS } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        ctx.expect(DEFAULT_MAC_ENTITLEMENTS['com.apple.security.cs.allow-jit']).toBe(true);
+        ctx.expect(DEFAULT_MAC_ENTITLEMENTS['com.apple.security.cs.disable-library-validation']).toBe(true);
+        ctx.expect(DEFAULT_MAC_ENTITLEMENTS['com.apple.security.network.client']).toBe(true);
+      },
+    },
+    {
+      name: 'mergeMacEntitlements: empty/missing overrides → defaults verbatim',
+      run: (ctx) => {
+        const { mergeMacEntitlements, DEFAULT_MAC_ENTITLEMENTS } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        ctx.expect(mergeMacEntitlements()).toEqual(DEFAULT_MAC_ENTITLEMENTS);
+        ctx.expect(mergeMacEntitlements({})).toEqual(DEFAULT_MAC_ENTITLEMENTS);
+        ctx.expect(mergeMacEntitlements(null)).toEqual(DEFAULT_MAC_ENTITLEMENTS);
+      },
+    },
+    {
+      name: 'mergeMacEntitlements: consumer override wins over default',
+      run: (ctx) => {
+        const { mergeMacEntitlements } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        const merged = mergeMacEntitlements({
+          'com.apple.security.cs.allow-jit': false,
+        });
+        ctx.expect(merged['com.apple.security.cs.allow-jit']).toBe(false);
+        ctx.expect(merged['com.apple.security.network.client']).toBe(true);   // default preserved
+      },
+    },
+    {
+      name: 'mergeMacEntitlements: new key (not in defaults) added',
+      run: (ctx) => {
+        const { mergeMacEntitlements } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        const merged = mergeMacEntitlements({
+          'com.apple.security.device.camera': true,
+        });
+        ctx.expect(merged['com.apple.security.device.camera']).toBe(true);
+      },
+    },
+    {
+      name: 'mergeMacEntitlements: null/undefined value removes a default',
+      run: (ctx) => {
+        const { mergeMacEntitlements } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        const merged = mergeMacEntitlements({
+          'com.apple.security.network.server': null,
+        });
+        ctx.expect('com.apple.security.network.server' in merged).toBe(false);
+      },
+    },
+    {
+      name: 'renderPlist: outputs valid XML with declared DOCTYPE + dict',
+      run: (ctx) => {
+        const { renderPlist } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        const xml = renderPlist({
+          'com.apple.security.cs.allow-jit': true,
+          'com.apple.security.network.server': false,
+        });
+        ctx.expect(xml).toContain('<?xml version="1.0" encoding="UTF-8"?>');
+        ctx.expect(xml).toContain('<!DOCTYPE plist');
+        ctx.expect(xml).toContain('<plist version="1.0">');
+        ctx.expect(xml).toContain('<key>com.apple.security.cs.allow-jit</key>');
+        ctx.expect(xml).toContain('<true/>');
+        ctx.expect(xml).toContain('<key>com.apple.security.network.server</key>');
+        ctx.expect(xml).toContain('<false/>');
+        ctx.expect(xml).toMatch(/<\/plist>\s*$/);
+      },
+    },
+    {
+      name: 'writeMacEntitlements: writes to dist/config/entitlements.mac.plist',
+      run: (ctx) => {
+        const { writeMacEntitlements } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'entitlements.js'));
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-entitlements-'));
+        try {
+          const written = writeMacEntitlements(tmp, { 'com.apple.security.cs.allow-jit': false });
+          ctx.expect(written).toBe(path.join(tmp, 'config', 'entitlements.mac.plist'));
+          const xml = fs.readFileSync(written, 'utf8');
+          ctx.expect(xml).toContain('<key>com.apple.security.cs.allow-jit</key>');
+          ctx.expect(xml).toContain('<false/>');
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/env-delivery.test.js

@@ -0,0 +1,166 @@
+// The env schema is the ONE declaration of how a key reaches the desktop app
+// ([#627](https://github.com/Omega-JS-Stack/omega/issues/627)): the build
+// workflow's env block, the bundle task's bake, and `omega push-secrets` all read
+// `delivery: { desktop: … }` and nothing else. Each used to carry its own
+// hand-kept list — the workflow's was 21 lines a human maintained across four
+// job/step blocks, and a key added to one never reached the others.
+//
+// Offline by construction: ensureTarget scaffolds into a temp consumer whose
+// peer deps are already satisfied (nothing installs), and the composed env
+// comes from files in a temp brand.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const jetpack = require('fs-jetpack');
+
+const { publishSecretKeys, bakeKeys, renderSecretsBlock, WORKFLOW_OWNED_KEYS } = require('../../../vendor/config/env-delivery.js');
+
+const SRC = path.join(__dirname, '..', '..', '..');
+const Manager = require(path.join(SRC, 'build.js'));
+const { ensureTarget } = require(path.join(SRC, 'commands', 'lib', 'ensure-target.js'));
+const bundleTask = require(path.join(SRC, 'gulp', 'tasks', 'bundle.js'));
+const pushSecrets = require(path.join(SRC, 'commands', 'push-secrets.js'));
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const package = Manager.getPackage('main');
+
+/** A consumer whose peer deps are already satisfied — the steady state. */
+function stageConsumer() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-env-delivery-'));
+  const devDependencies = { [package.name]: `^${package.version}` };
+  for (const [name, ver] of Object.entries(package.peerDependencies || {})) {
+    devDependencies[name] = ver;
+  }
+  jetpack.write(path.join(tmp, 'package.json'), `${JSON.stringify({ name: 'staged-app', version: '1.0.0', devDependencies }, null, 2)}\n`);
+  return tmp;
+}
+
+/** A brand root with a targets/desktop target under it. */
+function tmpBrand(brandEnv) {
+  const brand = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-brand-'));
+  jetpack.write(path.join(brand, 'config', 'omega.json5'), '{ brand: { id: "b" } }');
+  if (brandEnv !== undefined) fs.writeFileSync(path.join(brand, '.env'), brandEnv);
+
+  const target = path.join(brand, 'targets', 'desktop');
+  fs.mkdirSync(target, { recursive: true });
+
+  return { brand, target };
+}
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'env delivery (#627) — the workflow block, the bake list, and push-secrets from ONE schema',
+  tests: [
+    {
+      name: 'the build workflow renders the schema block — every CI key, no hand list, no token left',
+      run: async (ctx) => {
+        const tmp = stageConsumer();
+
+        try {
+          await ensureTarget({ projectDir: tmp });
+          const workflow = jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml'));
+
+          ctx.expect(workflow.includes('{{ githubSecrets }}')).toBe(false);
+          ctx.expect(workflow).toContain(`  ${renderSecretsBlock('desktop', { indent: '  ' })}\n`);
+
+          for (const key of publishSecretKeys('desktop').filter((k) => !WORKFLOW_OWNED_KEYS.includes(k))) {
+            // Once each: the workflow-level env is the ONE place a secret is
+            // named, so a job or step never restates one.
+            ctx.expect(workflow.split(`${key}: \${{ secrets.${key} }}`).length - 1).toBe(1);
+          }
+
+          // The two DELIBERATE step-level overrides survive: the mac signing
+          // assets are decoded to files, so those two names are paths there,
+          // not the base64 secrets the workflow env carries.
+          ctx.expect(workflow).toContain('CSC_LINK:         config/certs/dev-id.p12');
+          ctx.expect(workflow).toContain('APPLE_API_KEY:    config/certs/AuthKey.p8');
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'the bundle bake is exactly the schema\'s bake list, valued from the build env',
+      run: (ctx) => {
+        ctx.expect(bundleTask.BAKED_KEYS).toEqual(bakeKeys('desktop'));
+        ctx.expect(bundleTask.BAKED_KEYS).toEqual(['GOOGLE_ANALYTICS_SECRET']);
+
+        // A key with a value is replaced in the bundle; an unset one leaves the
+        // `process.env` reference intact, so local dev still reads it live.
+        ctx.expect(bundleTask.bakeDefinitions({ GOOGLE_ANALYTICS_SECRET: 'fixture-mp-secret' }))
+          .toEqual({ 'process.env.GOOGLE_ANALYTICS_SECRET': '"fixture-mp-secret"' });
+        ctx.expect(bundleTask.bakeDefinitions({})).toEqual({});
+
+        // A key the schema does NOT bake never reaches a shipped artifact.
+        ctx.expect(bundleTask.bakeDefinitions({ CSC_KEY_PASSWORD: 'nope' })).toEqual({});
+      },
+    },
+    {
+      name: 'the bake REFUSES a configured stream with no secret in build mode, warns in development (#626)',
+      run: (ctx) => {
+        // A packaged app ships no `.env` and a CI runner has none either, so a
+        // GA4 stream id with no Measurement Protocol secret used to bundle no
+        // replacement at all and ship an app that sent no events, silently.
+        const configured = { analytics: { providers: { google: { id: 'G-FIXTURE' } } } };
+        const quiet = { log() {}, warn() {}, error() {} };
+        let thrown = null;
+        try {
+          bundleTask.bakeDefinitions({}, { config: configured, mode: { build: true }, logger: quiet });
+        } catch (e) {
+          thrown = e;
+        }
+
+        ctx.expect(thrown === null).toBe(false);
+        // The BRAND-level key a human sets, and the config path that owes it.
+        ctx.expect(thrown.message).toContain('GOOGLE_ANALYTICS_SECRET_DESKTOP');
+        ctx.expect(thrown.message).toContain('analytics.providers.google.id');
+
+        // A publish run is a build for this purpose.
+        let onPublish = null;
+        try {
+          bundleTask.bakeDefinitions({}, { config: configured, mode: { publish: true }, logger: quiet });
+        } catch (e) {
+          onPublish = e;
+        }
+        ctx.expect(onPublish === null).toBe(false);
+
+        // Development warns and keeps going — a half-configured brand is a
+        // normal step on the way to a configured one.
+        const said = [];
+        const loud = { log() {}, warn: (m) => said.push(m), error() {} };
+        ctx.expect(bundleTask.bakeDefinitions({}, { config: configured, mode: { build: false, publish: false }, logger: loud })).toEqual({});
+        ctx.expect(said.join('\n')).toContain('GOOGLE_ANALYTICS_SECRET_DESKTOP');
+
+        // The secret under its DELIVERED name settles the rule and bakes.
+        ctx.expect(bundleTask.bakeDefinitions({ GOOGLE_ANALYTICS_SECRET: 'shh' }, { config: configured, mode: { build: true }, logger: quiet }))
+          .toEqual({ 'process.env.GOOGLE_ANALYTICS_SECRET': '"shh"' });
+
+        // No stream configured, nothing owed.
+        ctx.expect(bundleTask.bakeDefinitions({}, { config: {}, mode: { build: true }, logger: quiet })).toEqual({});
+      },
+    },
+    {
+      name: 'push-secrets pushes the schema DELIVERY set — a key CI never reads stays home',
+      run: (ctx) => {
+        const { brand, target } = tmpBrand([
+          'GH_TOKEN=brand-token',
+          'APPLE_TEAM_ID=BRANDTEAM',
+          'GOOGLE_ANALYTICS_SECRET_DESKTOP=desktop-stream',
+          'OMEGA_ADMIN_KEY=backend-only',
+          'MY_CUSTOM_THING=custom',
+          '',
+        ].join('\n'));
+
+        try {
+          const keys = Object.keys(pushSecrets.collectEnvSecrets(target));
+          ctx.expect(keys.sort()).toEqual(['APPLE_TEAM_ID', 'GH_TOKEN', 'GOOGLE_ANALYTICS_SECRET']);
+          ctx.expect(keys.every((key) => publishSecretKeys('desktop').includes(key))).toBe(true);
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});