@omega.js/desktop 0.1.0

package/dist/test/suites/build/env-watch.test.js

@@ -0,0 +1,86 @@
+// The dev lane treats the whole `.env` chain as a watch input
+// ([#681](https://github.com/Omega-JS-Stack/omega/issues/681)).
+//
+// The backend's stage watch already did — an edit to the brand root's .env
+// re-stages and the running emulator sees it — while desktop's gulp read the
+// cascade once at boot and never noticed an edit. This pins the PATH
+// RESOLUTION the `serve` task wires up (the same level the backend's
+// stage-watch test pins): every layer of the chain, and each layer's
+// `.env.<environment>` overlay (#586).
+//
+// Offline by construction: temp dirs and path resolution only, and the watcher
+// is closed before the case returns.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const jetpack = require('fs-jetpack');
+
+const SRC = path.join(__dirname, '..', '..', '..');
+const serveTask = require(path.join(SRC, 'gulp', 'tasks', 'serve.js'));
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+// A desktop target inside a brand monorepo, with a company root above it:
+// <root>/company/.env, <root>/brand/.env, <root>/brand/targets/desktop/.
+function seedBrand() {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-env-watch-')));
+  const companyRoot = path.join(root, 'company');
+  const brandRoot = path.join(root, 'brand');
+  const targetDir = path.join(brandRoot, 'targets', 'desktop');
+
+  jetpack.write(path.join(companyRoot, '.env'), '');
+  jetpack.write(path.join(brandRoot, '.omega', 'company.json'), JSON.stringify({ root: companyRoot }));
+  jetpack.write(path.join(brandRoot, 'config', 'omega.json5'), '{ brand: { id: "fixture" }, targets: { desktop: {} } }');
+  jetpack.dir(targetDir);
+
+  return { root, companyRoot, brandRoot, targetDir };
+}
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'env-watch (#681) — the dev lane watches every layer of the .env chain',
+  tests: [
+    {
+      name: 'the serve watcher lists company, brand and target — overlays included',
+      run: (ctx) => {
+        const { root, companyRoot, brandRoot, targetDir } = seedBrand();
+        const watcher = serveTask.watchEnvSources(targetDir, { environment: 'development' });
+
+        try {
+          ctx.expect(watcher.inputs.map((input) => input.path)).toEqual([
+            path.join(companyRoot, '.env'),
+            path.join(companyRoot, '.env.development'),
+            path.join(brandRoot, '.env'),
+            path.join(brandRoot, '.env.development'),
+            path.join(targetDir, '.env'),
+            path.join(targetDir, '.env.development'),
+          ]);
+          ctx.expect(watcher.inputs.map((input) => input.layer)).toEqual([
+            'company', 'company', 'brand', 'brand', 'target', 'target',
+          ]);
+        } finally {
+          watcher.close();
+          fs.rmSync(root, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'a standalone target watches only its own .env layer',
+      run: (ctx) => {
+        const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-env-watch-solo-')));
+        const watcher = serveTask.watchEnvSources(root, { environment: 'development' });
+
+        try {
+          ctx.expect(watcher.inputs.map((input) => input.path)).toEqual([
+            path.join(root, '.env'),
+            path.join(root, '.env.development'),
+          ]);
+        } finally {
+          watcher.close();
+          fs.rmSync(root, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/exports.test.js

@@ -0,0 +1,63 @@
+// Verifies all package.json `exports` resolve to valid module files.
+
+const path = require('path');
+const fs = require('fs');
+
+const Manager = require('../../../build.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+const pkg = Manager.getPackage('main');
+const root = Manager.getRootPath('main');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'Package exports',
+  tests: [
+    {
+      name: 'all exported subpaths resolve to existing files',
+      run: (ctx) => {
+        const entries = Object.entries(pkg.exports);
+        ctx.expect(entries.length).toBeGreaterThan(0);
+
+        for (const [subpath, target] of entries) {
+          const filePath = path.join(root, target);
+          if (!fs.existsSync(filePath)) {
+            throw new Error(`Export "${subpath}" → ${target} does not exist on disk.`);
+          }
+        }
+      },
+    },
+    {
+      name: 'main / renderer / preload / build all loadable',
+      run: (ctx) => {
+        const fromDist = (subpath) => path.join(root, 'dist', subpath);
+        ctx.expect(typeof require(fromDist('main.js'))).toBe('function');
+        ctx.expect(typeof require(fromDist('renderer.js'))).toBe('function');
+        ctx.expect(typeof require(fromDist('preload.js'))).toBe('function');
+        ctx.expect(typeof require(fromDist('build.js'))).toBe('function');
+      },
+    },
+    {
+      name: 'every lib module exports a singleton or constructor',
+      run: (ctx) => {
+        const libDir = path.join(root, 'dist', 'lib');
+        // Skip leading-underscore files — they're internal utilities (mixins, helpers)
+        // shared between libs, not Electron-feature singletons.
+        const files = fs.readdirSync(libDir).filter((f) => f.endsWith('.js') && !f.startsWith('_'));
+        ctx.expect(files.length).toBeGreaterThan(0);
+
+        for (const file of files) {
+          const mod = require(path.join(libDir, file));
+          if (mod === null || mod === undefined) {
+            throw new Error(`lib/${file} exports null/undefined`);
+          }
+          // Loggers are constructors; everything else is a singleton object with initialize()
+          const isLogger = file.startsWith('logger');
+          if (!isLogger && typeof mod.initialize !== 'function') {
+            throw new Error(`lib/${file} singleton missing initialize() method`);
+          }
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/finalize-release.test.js

@@ -0,0 +1,152 @@
+// finalize-release's release lookup and asset replacement
+// ([#810](https://github.com/Omega-JS-Stack/omega/issues/810)).
+//
+// `repos.getReleaseByTag` cannot see a DRAFT: a draft carries no tag ref, so the
+// lookup 404'd on every draft electron-builder had just created and each run made
+// ANOTHER draft for the same version (two v0.0.1 drafts on the playground's
+// releases repo, ids 384501732 and 384558163). The lookup lists instead, drafts
+// included, and both call sites (the signed-Windows upload and the `--publish`
+// flip) read through the one helper.
+//
+// The ids here are hard-coded on purpose: an expectation computed from the
+// fixture would pass against any ordering rule at all.
+
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const { findRelease } = require('../../../commands/finalize-release.js');
+
+// The releases repo as GitHub returns it: drafts and published releases across
+// several tags, in the API's own order (newest created first is NOT guaranteed).
+const RELEASES = [
+  { id: 384000001, tag_name: 'v0.0.2', draft: false, created_at: '2026-09-06T10:00:00Z' },
+  { id: 384501732, tag_name: 'v0.0.1', draft: true,  created_at: '2026-09-07T23:54:00Z' },
+  { id: 383900007, tag_name: 'v0.0.1', draft: false, created_at: '2026-09-05T08:00:00Z' },
+  { id: 384558163, tag_name: 'v0.0.1', draft: true,  created_at: '2026-09-08T01:31:00Z' },
+];
+
+// A fake octokit whose paginate answers with the fixture above.
+function stubOctokit() {
+  return {
+    paginate: async () => RELEASES,
+    rest: { repos: { listReleases: () => {} } },
+  };
+}
+
+// Helper: stage a brand monorepo with one desktop target, so the seed-mode walk
+// (config/omega.json5 at the root, the target under targets/) sees a real brand.
+// Returns { brandRoot, targetDir }.
+function stageBrand(config) {
+  const brandRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-finalize-'));
+  const targetDir = path.join(brandRoot, 'targets', 'desktop');
+  fs.mkdirSync(path.join(brandRoot, 'config'), { recursive: true });
+  fs.mkdirSync(targetDir, { recursive: true });
+  fs.writeFileSync(path.join(brandRoot, 'config', 'omega.json5'), JSON.stringify(config));
+  return { brandRoot, targetDir };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'finalize-release (#810): the release lookup sees drafts, and same-name assets are replaced',
+  tests: [
+    {
+      name: 'findRelease: the NEWEST draft with the matching tag wins over an older draft and a published one',
+      run: async (ctx) => {
+        const release = await findRelease({
+          octokit: stubOctokit(), owner: 'Omega-JS-Stack', repo: 'omega-playground-releases', tag: 'v0.0.1',
+        });
+
+        ctx.expect(release.id).toBe(384558163);
+      },
+    },
+    {
+      name: 'findRelease: a tag with only a PUBLISHED release resolves to it',
+      run: async (ctx) => {
+        const release = await findRelease({
+          octokit: stubOctokit(), owner: 'Omega-JS-Stack', repo: 'omega-playground-releases', tag: 'v0.0.2',
+        });
+
+        ctx.expect(release.id).toBe(384000001);
+      },
+    },
+    {
+      name: 'findRelease: no release for the tag is null, not a throw (the upload step creates the draft)',
+      run: async (ctx) => {
+        const release = await findRelease({
+          octokit: stubOctokit(), owner: 'Omega-JS-Stack', repo: 'omega-playground-releases', tag: 'v9.9.9',
+        });
+
+        ctx.expect(release).toBe(null);
+      },
+    },
+    {
+      name: 'upload: every colliding asset, installer and feed alike, is deleted BEFORE its re-upload',
+      run: async (ctx) => {
+        const finalizeRelease = require(path.join(__dirname, '..', '..', '..', 'commands', 'finalize-release.js'));
+        const { brandRoot, targetDir } = stageBrand({
+          brand: { id: 'acme' },
+          repo: { providers: { github: { org: 'Acme-Org' } } },
+          targets: { desktop: { releases: {} } },
+        });
+        fs.writeFileSync(path.join(targetDir, 'package.json'), JSON.stringify({ name: 'acme-desktop', version: '1.2.3' }));
+
+        // The installer AND the auto-updater feed: the metadata loop uploads the
+        // yml separately, so a fixture holding only the exe never reaches it.
+        const signedDir = path.join(targetDir, 'signed');
+        fs.mkdirSync(signedDir, { recursive: true });
+        fs.writeFileSync(path.join(signedDir, 'Acme-Setup-1.2.3.exe'), 'signed-installer-bytes');
+        fs.writeFileSync(path.join(signedDir, 'latest.yml'), 'version: 1.2.3\n');
+
+        // ONE ordered log of both calls: a delete landing AFTER its upload would
+        // remove the asset the run had just written, so the SEQUENCE is what is
+        // under test, not the presence of a delete.
+        const calls    = [];
+        const uploadTo = [];
+        const created  = [];
+        const octokit = {
+          paginate: async () => [
+            { id: 384558163, tag_name: 'v1.2.3', draft: true, created_at: '2026-09-08T01:31:00Z' },
+          ],
+          rest: {
+            repos: {
+              listReleases: () => {},
+              createRelease: async (args) => { created.push(args.tag_name); return { data: { id: 1 } }; },
+              listReleaseAssets: async () => ({ data: [
+                { id: 990001, name: 'Acme-Setup-1.2.3.exe' },
+                { id: 990002, name: 'latest.yml' },
+              ] }),
+              deleteReleaseAsset: async (args) => calls.push(`delete:${args.asset_id}`),
+              uploadReleaseAsset: async (args) => { calls.push(`upload:${args.name}`); uploadTo.push(args.release_id); },
+            },
+          },
+        };
+
+        const cwd = process.cwd();
+        const token = process.env.GH_TOKEN;
+        process.env.GH_TOKEN = 'ghp_test_fake_token_for_unit_test';
+        process.chdir(targetDir);
+        try {
+          await finalizeRelease({ signedDir: 'signed', octokit });
+        } finally {
+          process.chdir(cwd);
+          if (token !== undefined) process.env.GH_TOKEN = token; else delete process.env.GH_TOKEN;
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+
+        // The draft was found, so nothing new was created, each colliding asset
+        // went before the upload that replaced it, and both landed on that draft.
+        ctx.expect(created).toEqual([]);
+        ctx.expect(calls).toEqual([
+          'delete:990001',
+          'upload:Acme-Setup-1.2.3.exe',
+          'delete:990002',
+          'upload:latest.yml',
+        ]);
+        ctx.expect(uploadTo).toEqual([384558163, 384558163]);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/format-fetch-error.test.js

@@ -0,0 +1,85 @@
+// format-fetch-error tests — one-line, truncated, humanized fetch-failure messages.
+// Guards against the "wonderful-fetch puts an entire HTML 404 page in e.message"
+// log-spam case (remote-config / remote-scripts brand-site fetches).
+
+const formatFetchError = require('../../../utils/format-fetch-error.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'format-fetch-error',
+  tests: [
+    {
+      name: 'passes short plain messages through unchanged',
+      run: (ctx) => {
+        ctx.expect(formatFetchError(new Error('Request timed out'))).toBe('Request timed out');
+        ctx.expect(formatFetchError(new Error('Response is not JSON: SyntaxError: Unexpected token <'))).toBe('Response is not JSON: SyntaxError: Unexpected token <');
+      },
+    },
+    {
+      name: 'replaces an HTML error-page body with a short description',
+      run: (ctx) => {
+        const e = new Error('<!doctype html><html aria-busy="true" data-loader="default"><head><title>404</title></head><body>Page not found</body></html>');
+        e.status = 404;
+        const out = formatFetchError(e);
+        ctx.expect(out).toBe('HTTP 404: response was an HTML page, not the expected resource');
+        ctx.expect(out).not.toContain('<');
+      },
+    },
+    {
+      name: 'detects HTML bodies case-insensitively and without a doctype',
+      run: (ctx) => {
+        ctx.expect(formatFetchError(new Error('<HTML lang="en"><body>x</body></HTML>'))).toBe('response was an HTML page, not the expected resource');
+        ctx.expect(formatFetchError(new Error('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"><html></html>'))).toBe('response was an HTML page, not the expected resource');
+        ctx.expect(formatFetchError(new Error('  \n <!doctype html><html></html>'))).toBe('response was an HTML page, not the expected resource');
+      },
+    },
+    {
+      name: 'does not flag non-HTML messages that merely contain markup',
+      run: (ctx) => {
+        ctx.expect(formatFetchError(new Error('expected <json> but parse failed'))).toBe('expected <json> but parse failed');
+      },
+    },
+    {
+      name: 'prefixes HTTP status when error.status is present',
+      run: (ctx) => {
+        const e = new Error('Not Found');
+        e.status = 404;
+        ctx.expect(formatFetchError(e)).toBe('HTTP 404: Not Found');
+      },
+    },
+    {
+      name: 'truncates long non-HTML messages at the cap',
+      run: (ctx) => {
+        const out = formatFetchError(new Error('x'.repeat(500)));
+        ctx.expect(out).toContain('[truncated]');
+        ctx.expect(out).toContain('x'.repeat(200));
+        ctx.expect(out).not.toContain('x'.repeat(201));
+        ctx.expect(out.length).toBeLessThan(250);
+      },
+    },
+    {
+      name: 'collapses multi-line messages to one line',
+      run: (ctx) => {
+        const out = formatFetchError(new Error('line one\n   line two\t\tend'));
+        ctx.expect(out).toBe('line one line two end');
+        ctx.expect(out).not.toContain('\n');
+      },
+    },
+    {
+      name: 'handles null/undefined/string inputs without throwing',
+      run: (ctx) => {
+        ctx.expect(formatFetchError(null)).toBe('Unknown error');
+        ctx.expect(formatFetchError(undefined)).toBe('Unknown error');
+        ctx.expect(formatFetchError('plain string failure')).toBe('plain string failure');
+      },
+    },
+    {
+      name: 'respects a custom maxLength',
+      run: (ctx) => {
+        ctx.expect(formatFetchError(new Error('abcdefghij'), 5)).toBe('abcde… [truncated]');
+      },
+    },
+  ],
+});

package/dist/test/suites/build/framework-deps.test.js

@@ -0,0 +1,173 @@
+// Framework-provided dependencies (#87), desktop half: a CONSUMER module requires any
+// library @omega.js/desktop declares by BARE specifier and it resolves from the
+// FRAMEWORK's own installation — the framework's copy wins even when the consumer
+// installed its own. The mechanism is the resolve hook @omega.js/devkit's bundle
+// wrapper composes from the framework's declared dependency set (#737, replacing
+// the ordered `resolve.modules` webpack used), so these tests build a real consumer
+// entry through the wrapper and read the resolved paths back out of the metafile.
+//
+// Both consumer layers live in a temp dir OUTSIDE this monorepo and carry their own
+// node_modules — the same layouts npm produces for a real brand: shared/hoisted copies
+// in the consumer's node_modules, and a framework-private nested copy exactly when the
+// consumer declares a conflicting version.
+
+const fs   = require('fs');
+const os   = require('os');
+const path = require('path');
+
+const FRAMEWORK_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+const { bundle } = require('../../../vendor/devkit/bundle.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+// Framework-declared deps sampled by the first test: two bare CJS packages plus a
+// subpath import, all of them real `dependencies` of @omega.js/desktop.
+const SAMPLE = ['fs-jetpack', 'js-yaml', 'lodash/merge'];
+
+function write(file, contents) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, contents);
+}
+
+function writePackage(dir, name, version, extra) {
+  write(path.join(dir, 'package.json'), JSON.stringify({ name, version, main: 'index.js', ...extra }));
+}
+
+function packageName(spec) {
+  return spec.startsWith('@') ? spec.split('/').slice(0, 2).join('/') : spec.split('/')[0];
+}
+
+// The installed COPY a specifier resolves to from `fromRoot` — the package directory,
+// not the entry file: which FILE inside it a bundle lands on is chosen by the target's
+// export conditions (a web build takes the browser entry where node's require takes the
+// CJS one), while the contract here is about which copy.
+function packageDirFor(spec, fromRoot) {
+  const name   = packageName(spec);
+  const marker = `${path.sep}node_modules${path.sep}${name}${path.sep}`;
+  const entry  = require.resolve(spec, { paths: [fromRoot] });
+  return entry.slice(0, entry.indexOf(marker) + marker.length - 1);
+}
+
+// Build `src/entry.js` the way the desktop lane builds its main bundle, and return
+// every input path the bundle pulled in (absolute, real).
+async function compile({ projectRoot, frameworkRoot }) {
+  const result = await bundle({
+    frameworkRoot,
+    entries: [path.join(projectRoot, 'src', 'entry.js')],
+    outfile: path.join(projectRoot, 'dist', 'entry.bundle.js'),
+    platform: 'node',
+    format: 'cjs',
+    dev: true,
+  });
+
+  return Object.keys(result.metafile.inputs).map((input) => path.resolve(input));
+}
+
+// Whether the bundle pulled a file out of exactly this package directory.
+function bundledFrom(inputs, dir) {
+  return inputs.some((input) => input.startsWith(dir + path.sep));
+}
+
+// A real consumer install: the framework's deps hoisted into the consumer's own
+// node_modules (symlinked to the real installed copies), no nested copies anywhere.
+function stageHoistedConsumer(specs) {
+  // realpath: macOS' /var is a symlink to /private/var, and the resolved module
+  // paths a bundler reports are real paths.
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'omega-desktop-framework-deps-')));
+  writePackage(root, 'consumer-app', '1.0.0');
+
+  specs.forEach((spec) => {
+    const link = path.join(root, 'node_modules', packageName(spec));
+    fs.mkdirSync(path.dirname(link), { recursive: true });
+    if (!fs.existsSync(link)) fs.symlinkSync(packageDirFor(spec, FRAMEWORK_ROOT), link, 'dir');
+  });
+
+  write(path.join(root, 'src', 'entry.js'), specs.map((s) => `require(${JSON.stringify(s)});`).join('\n'));
+  return root;
+}
+
+// A real consumer install with a CONFLICT: the consumer declares its own version of
+// `dupe-pkg`, so npm keeps that copy hoisted and nests the framework's version under
+// the framework package. `shared-pkg` has no conflict — one hoisted copy for both.
+function stageConflictInstall() {
+  const root      = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'omega-desktop-framework-deps-dupe-')));
+  const consumerNm = path.join(root, 'node_modules');
+  const frameworkRoot = path.join(consumerNm, '@omega.js', 'desktop');
+
+  writePackage(root, 'consumer-app', '1.0.0', { dependencies: { 'dupe-pkg': '^1.0.0' } });
+
+  writePackage(path.join(consumerNm, 'dupe-pkg'), 'dupe-pkg', '1.0.0');
+  write(path.join(consumerNm, 'dupe-pkg', 'index.js'), 'module.exports = "CONSUMER_COPY";');
+  write(path.join(consumerNm, 'dupe-pkg', 'sub.js'), 'module.exports = "CONSUMER_SUBPATH";');
+
+  writePackage(path.join(consumerNm, 'shared-pkg'), 'shared-pkg', '1.0.0');
+  write(path.join(consumerNm, 'shared-pkg', 'index.js'), 'module.exports = "SHARED_COPY";');
+
+  // The fixture framework must resolve esbuild the way the real one does — it
+  // has no node_modules of its own, so the monorepo's hoisted copy is what a
+  // walk up from a temp dir must find. Staging it under the CONSUMER's
+  // node_modules is that walk.
+  fs.symlinkSync(packageDirFor('esbuild', FRAMEWORK_ROOT), path.join(consumerNm, 'esbuild'), 'dir');
+
+  writePackage(frameworkRoot, '@omega.js/desktop', '1.0.0', {
+    dependencies: { 'dupe-pkg': '^2.0.0', 'shared-pkg': '^1.0.0' },
+  });
+  const nested = path.join(frameworkRoot, 'node_modules', 'dupe-pkg');
+  writePackage(nested, 'dupe-pkg', '2.0.0');
+  write(path.join(nested, 'index.js'), 'module.exports = "FRAMEWORK_COPY";');
+  write(path.join(nested, 'sub.js'), 'module.exports = "FRAMEWORK_SUBPATH";');
+
+  write(path.join(root, 'src', 'entry.js'), [
+    "require('dupe-pkg');",
+    "require('dupe-pkg/sub');",
+    "require('shared-pkg');",
+  ].join('\n'));
+
+  return { root, frameworkRoot };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'framework-deps — a consumer bundle resolves framework-declared deps from the framework',
+  timeout: 60000,
+  tests: [
+    {
+      name: 'bare specifiers (and subpaths) of framework-declared deps resolve from the framework installation',
+      run: async (ctx) => {
+        const projectRoot = stageHoistedConsumer(SAMPLE);
+        try {
+          const inputs = await compile({ projectRoot, frameworkRoot: FRAMEWORK_ROOT });
+          SAMPLE.forEach((spec) => {
+            ctx.expect(bundledFrom(inputs, packageDirFor(spec, FRAMEWORK_ROOT))).toBe(true);
+          });
+        } finally {
+          fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+      },
+    },
+
+    {
+      name: "the framework's copy wins over a consumer-declared duplicate, subpaths included",
+      run: async (ctx) => {
+        const { root, frameworkRoot } = stageConflictInstall();
+        try {
+          const inputs = await compile({ projectRoot: root, frameworkRoot });
+          const built = fs.readFileSync(path.join(root, 'dist', 'entry.bundle.js'), 'utf8');
+
+          // Both the bare specifier and the subpath land on the framework's nested copy…
+          ctx.expect(built).toContain('FRAMEWORK_COPY');
+          ctx.expect(built).toContain('FRAMEWORK_SUBPATH');
+          ctx.expect(built.includes('CONSUMER_COPY')).toBe(false);
+          ctx.expect(built.includes('CONSUMER_SUBPATH')).toBe(false);
+          ctx.expect(bundledFrom(inputs, path.join(frameworkRoot, 'node_modules', 'dupe-pkg'))).toBe(true);
+
+          // …while a dep with no conflict keeps resolving to the single hoisted copy,
+          // shared by the framework and the consumer alike.
+          ctx.expect(bundledFrom(inputs, path.join(root, 'node_modules', 'shared-pkg'))).toBe(true);
+        } finally {
+          fs.rmSync(root, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});