@omega.js/desktop 0.1.0

package/dist/test/suites/build/push-secrets.test.js

@@ -0,0 +1,226 @@
+// Build-layer tests for commands/push-secrets.js — the composed source, desktop's
+// file → base64 value seam, and the publish itself.
+//
+// Offline by construction ([#682](https://github.com/Omega-JS-Stack/omega/issues/682)):
+// the brand and target are temp dirs and the `gh`/`git` boundaries are injected,
+// so the suite proves the real send shape without a repo, a credential or a
+// network. What the shared publisher owns (the five loud skips, the declared-repo
+// guard) is pinned once in @omega.js/devkit's target-secrets suite.
+
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+
+const pushSecrets = require(path.join(__dirname, '..', '..', '..', 'commands', 'push-secrets.js'));
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const quiet = { log() {}, warn() {}, error() {} };
+
+// A brand root (config/omega.json5) with a targets/desktop target under it.
+function tmpBrand({ brandEnv, targetEnv, repo } = {}) {
+  const brand = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-brand-'));
+  fs.mkdirSync(path.join(brand, 'config'), { recursive: true });
+  fs.writeFileSync(path.join(brand, 'config', 'omega.json5'), [
+    '{',
+    '  brand: { id: "b" },',
+    ...(repo ? [`  repo: { providers: { github: { repo: '${repo}' } } },`] : []),
+    '}',
+  ].join('\n'));
+  if (brandEnv !== undefined) fs.writeFileSync(path.join(brand, '.env'), brandEnv);
+
+  const target = path.join(brand, 'targets', 'desktop');
+  fs.mkdirSync(target, { recursive: true });
+  if (targetEnv !== undefined) fs.writeFileSync(path.join(target, '.env'), targetEnv);
+
+  return { brand, target };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'push-secrets — composed env source + value resolution',
+  tests: [
+    {
+      name: 'publishEnvSecrets: the schema set over the gh boundary, file-path secrets base64\'d, values on stdin',
+      run: (ctx) => {
+        const { brand, target } = tmpBrand({
+          repo: 'acme/app',
+          brandEnv: [
+            'GH_TOKEN=brand-token',
+            'APPLE_TEAM_ID=BRANDTEAM',
+            'CSC_LINK=config/certs/dev-id.p12',
+            'MY_CUSTOM_THING=custom',
+            '',
+          ].join('\n'),
+        });
+        // A brand-level certificate: named by a path the target root does not
+        // hold, resolved from the brand root.
+        const cert = path.join(brand, 'config', 'certs', 'dev-id.p12');
+        fs.mkdirSync(path.dirname(cert), { recursive: true });
+        fs.writeFileSync(cert, Buffer.from('FAKE-CERT-BYTES'));
+
+        const gh = [];
+        try {
+          const result = pushSecrets.publishEnvSecrets({
+            targetDir: target,
+            logger: quiet,
+            env: {},
+            gitExecFn: () => 'git@github.com:acme/app.git\n',
+            execFn: (file, args, options) => { gh.push({ file, args, input: options.input }); return ''; },
+          });
+
+          ctx.expect(result.published).toEqual(['APPLE_TEAM_ID', 'CSC_LINK', 'GH_TOKEN']);
+          ctx.expect(gh.map((c) => c.args.join(' '))).toEqual([
+            'auth status',
+            'secret set APPLE_TEAM_ID --repo acme/app',
+            'secret set CSC_LINK --repo acme/app',
+            'secret set GH_TOKEN --repo acme/app',
+          ]);
+          // The CERTIFICATE travels, never this laptop's path to it — and every
+          // value goes on stdin, never in argv.
+          ctx.expect(gh.slice(1).map((c) => c.input)).toEqual([
+            'BRANDTEAM',
+            Buffer.from('FAKE-CERT-BYTES').toString('base64'),
+            'brand-token',
+          ]);
+          ctx.expect(gh.every((c) => c.file === 'gh')).toBe(true);
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'publishEnvSecrets: a checkout that is not the brand\'s DECLARED repo skips loudly, never touching gh',
+      run: (ctx) => {
+        // The declared repo is the only proof of where these certificates
+        // belong — an inferred remote is a fork, a template clone or a vendored
+        // target away from arming a stranger's Actions. Desktop pushes the most
+        // dangerous payload of the three binds.
+        const { brand, target } = tmpBrand({ repo: 'acme/app', brandEnv: 'GH_TOKEN=brand-token\n' });
+        const undeclared = tmpBrand({ brandEnv: 'GH_TOKEN=brand-token\n' });
+        const said = [];
+        const loud = { log: (m) => said.push(m), warn: (m) => said.push(m), error: (m) => said.push(m) };
+        const noGh = () => { throw new Error('gh must not run'); };
+
+        try {
+          ctx.expect(pushSecrets.publishEnvSecrets({
+            targetDir: target,
+            logger: loud,
+            env: {},
+            execFn: noGh,
+            gitExecFn: () => 'git@github.com:Omega-JS-Stack/omega.git\n',
+          })).toEqual({ skipped: 'repo-mismatch' });
+
+          ctx.expect(pushSecrets.publishEnvSecrets({
+            targetDir: undeclared.target,
+            logger: loud,
+            env: {},
+            execFn: noGh,
+            gitExecFn: () => 'git@github.com:acme/app.git\n',
+          })).toEqual({ skipped: 'no-declared-repo' });
+
+          const heard = said.join('\n');
+          ctx.expect(heard).toContain("this brand's repo is acme/app");
+          ctx.expect(heard).toContain('names no GitHub repo in config');
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+          fs.rmSync(undeclared.brand, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'collectEnvSecrets: the brand-root .env supplies the target — no target .env exists (#678)',
+      run: (ctx) => {
+        const { brand, target } = tmpBrand({
+          brandEnv: [
+            'GH_TOKEN=brand-token',
+            'APPLE_TEAM_ID=BRANDTEAM',
+            'STRIPE_SECRET_KEY=sk_live_backend_only',
+            'GOOGLE_ANALYTICS_SECRET_DESKTOP=desktop-stream',
+            'MY_CUSTOM_THING=custom',
+            'OMEGA_FONTAWESOME_ROOT=/Users/dev/.omega/fontawesome',
+            '',
+          ].join('\n'),
+        });
+
+        try {
+          ctx.expect(fs.existsSync(path.join(target, '.env'))).toBe(false);
+
+          ctx.expect(pushSecrets.collectEnvSecrets(target)).toEqual({
+            APPLE_TEAM_ID: 'BRANDTEAM',
+            GH_TOKEN: 'brand-token',
+            GOOGLE_ANALYTICS_SECRET: 'desktop-stream',
+          });
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'collectEnvSecrets: a target .env overrides the brand root per key (#678)',
+      run: (ctx) => {
+        const { brand, target } = tmpBrand({
+          brandEnv: 'GH_TOKEN=brand-token\nAPPLE_TEAM_ID=BRANDTEAM\n',
+          targetEnv: 'APPLE_TEAM_ID=TARGETTEAM\nCSC_KEY_PASSWORD=target-pass\n',
+        });
+
+        try {
+          ctx.expect(pushSecrets.collectEnvSecrets(target)).toEqual({
+            APPLE_TEAM_ID: 'TARGETTEAM',
+            CSC_KEY_PASSWORD: 'target-pass',
+            GH_TOKEN: 'brand-token',
+          });
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'collectEnvSecrets: --only narrows the composed set',
+      run: (ctx) => {
+        const { brand, target } = tmpBrand({ brandEnv: 'GH_TOKEN=brand-token\nAPPLE_TEAM_ID=BRANDTEAM\n' });
+
+        try {
+          ctx.expect(pushSecrets.collectEnvSecrets(target, { only: 'GH_TOKEN' })).toEqual({ GH_TOKEN: 'brand-token' });
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'fileValueResolver: a plain string travels as itself, a path that names no file too',
+      run: (ctx) => {
+        const resolve = pushSecrets.fileValueResolver({ targetDir: '/tmp' });
+
+        ctx.expect(resolve('plain-string-value', 'CSC_KEY_PASSWORD')).toBe('plain-string-value');
+        // Path-shaped but nowhere on disk: it is a string, not a certificate.
+        ctx.expect(resolve('config/certs/does-not-exist.p12', 'CSC_LINK')).toBe('config/certs/does-not-exist.p12');
+      },
+    },
+    {
+      name: 'fileValueResolver: an existing file travels as base64 — absolute, target-relative, or brand-relative',
+      run: (ctx) => {
+        const { brand, target } = tmpBrand();
+
+        const absolute = path.join(brand, 'cert.p12');
+        fs.writeFileSync(absolute, Buffer.from('ABS'));
+        fs.mkdirSync(path.join(target, 'config', 'certs'), { recursive: true });
+        fs.writeFileSync(path.join(target, 'config', 'certs', 'target.pem'), Buffer.from('TARGET'));
+        fs.mkdirSync(path.join(brand, '.omega', 'secrets'), { recursive: true });
+        fs.writeFileSync(path.join(brand, '.omega', 'secrets', 'brand-cert.p8'), Buffer.from('BRAND'));
+
+        try {
+          const resolve = pushSecrets.fileValueResolver({ targetDir: target });
+
+          ctx.expect(resolve(absolute, 'CSC_LINK')).toBe(Buffer.from('ABS').toString('base64'));
+          ctx.expect(resolve('config/certs/target.pem', 'CSC_LINK')).toBe(Buffer.from('TARGET').toString('base64'));
+          // Brand-level material: the path is relative to the BRAND root, which
+          // the target root does not hold.
+          ctx.expect(resolve('.omega/secrets/brand-cert.p8', 'APPLE_API_KEY')).toBe(Buffer.from('BRAND').toString('base64'));
+        } finally {
+          fs.rmSync(brand, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/release-pipeline.test.js

@@ -0,0 +1,365 @@
+// Build-layer tests for the release pipeline modules.
+// We don't actually run electron-builder or signtool — those are external tools.
+// We verify the modules load cleanly, export the right shape, and dispatch correctly.
+
+const path    = require('path');
+const fs      = require('fs');
+const os      = require('os');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+// Helper: stage a consumer dir with config/omega.json5 containing the given
+// platforms.win.signing.strategy (under targets.desktop in the raw file). Returns the
+// abs path to the temp dir; caller is responsible for chdir'ing into it and cleaning up.
+function stageStrategyConfig({ strategy, cloudProvider }) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-sign-'));
+  fs.mkdirSync(path.join(tmp, 'config'), { recursive: true });
+  const signing = { strategy };
+  if (cloudProvider) signing.cloud = { provider: cloudProvider };
+  fs.writeFileSync(
+    path.join(tmp, 'config', 'omega.json5'),
+    JSON.stringify({ targets: { desktop: { platforms: { win: { signing } } } } }),
+  );
+  return tmp;
+}
+
+// Helper: stage a brand monorepo with one desktop target, so the seed-mode walk
+// (config/omega.json5 at the root, the target under targets/) sees a real brand.
+// Returns { brandRoot, targetDir }.
+function stageBrand(config) {
+  const brandRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-brand-'));
+  const targetDir = path.join(brandRoot, 'targets', 'desktop');
+  fs.mkdirSync(path.join(brandRoot, 'config'), { recursive: true });
+  fs.mkdirSync(targetDir, { recursive: true });
+  fs.writeFileSync(path.join(brandRoot, 'config', 'omega.json5'), JSON.stringify(config));
+  return { brandRoot, targetDir };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'release pipeline — package / release / sign-windows / notarize hook',
+  tests: [
+    {
+      name: 'release: the dispatch address is the CONFIG\'s brand repo and the COMPOSED workflow name (#799)',
+      run: (ctx) => {
+        const { dispatchTarget } = require(path.join(__dirname, '..', '..', '..', 'commands', 'release.js'));
+        const { brandRoot, targetDir } = stageBrand({ brand: { id: 'acme' }, repo: { providers: { github: { org: 'Acme-Org' } } } });
+
+        try {
+          // A target nested in a brand (and the brand nested in another repo, as
+          // the playground is here) dispatches on the repo its CONFIG names: the
+          // enclosing git remote is somebody else's repo entirely.
+          // The name is the derived `<brand.id>-omega` default (#809): the config
+          // declares an org and no repo of its own.
+          ctx.expect(dispatchTarget({
+            projectRoot: targetDir,
+            config: { brand: { id: 'acme' }, repo: { providers: { github: { org: 'Acme-Org' } } } },
+          })).toEqual({ owner: 'Acme-Org', repo: 'acme-omega', workflow: 'desktop-build.yml' });
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'release: a STANDALONE target dispatches the plain build.yml, and an unaddressable repo throws',
+      run: (ctx) => {
+        const { dispatchTarget } = require(path.join(__dirname, '..', '..', '..', 'commands', 'release.js'));
+        const standalone = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-standalone-'));
+
+        try {
+          const config = { brand: { id: 'acme' }, repo: { providers: { github: { org: 'Acme-Org', repo: 'itw-creative-works/acme-app' } } } };
+          ctx.expect(dispatchTarget({ projectRoot: standalone, config })).toEqual({
+            owner: 'itw-creative-works', repo: 'acme-app', workflow: 'build.yml',
+          });
+
+          // Half an address addresses nothing: fail loudly instead of POSTing to
+          // `undefined/acme`.
+          ctx.expect(() => dispatchTarget({ projectRoot: standalone, config: { brand: { id: 'acme' } } }))
+            .toThrow(/brand repo/);
+        } finally {
+          fs.rmSync(standalone, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'deploy-precheck: provisions <owner>/<brand.id>-releases from config, never a discovered owner (#799)',
+      run: async (ctx) => {
+        const { provisionReleaseRepos } = require(path.join(__dirname, '..', '..', '..', 'commands', 'lib', 'deploy-precheck.js'));
+        const created = [];
+        const octokit = {
+          rest: {
+            repos: {
+              get: async () => { const error = new Error('Not Found'); error.status = 404; throw error; },
+              createInOrg: async (args) => created.push(`${args.org}/${args.name}`),
+              createForAuthenticatedUser: async (args) => created.push(`me/${args.name}`),
+            },
+            users: { getAuthenticated: async () => ({ data: { login: 'somebody-else' } }) },
+          },
+        };
+        const lines = [];
+
+        await provisionReleaseRepos({
+          log: (line) => lines.push(line),
+          warn: (line) => lines.push(line),
+          octokit,
+          config: { brand: { id: 'omega-playground' }, repo: { providers: { github: { org: 'Omega-JS-Stack' } } }, releases: {} },
+        });
+
+        ctx.expect(created).toEqual(['Omega-JS-Stack/omega-playground-releases']);
+        ctx.expect(lines.join('\n')).toContain('Omega-JS-Stack/omega-playground-releases');
+      },
+    },
+    {
+      name: 'finalize-release: --publish flips the release in the config\'s releases repo (#799)',
+      run: async (ctx) => {
+        const finalizeRelease = require(path.join(__dirname, '..', '..', '..', 'commands', 'finalize-release.js'));
+        const { brandRoot, targetDir } = stageBrand({
+          brand: { id: 'acme' },
+          repo: { providers: { github: { org: 'Acme-Org' } } },
+          targets: { desktop: { releases: {} } },
+        });
+        fs.writeFileSync(path.join(targetDir, 'package.json'), JSON.stringify({ name: 'acme-desktop', version: '1.2.3' }));
+
+        const asked = [];
+        const flipped = [];
+        const octokit = {
+          // The release is found by LISTING, drafts included (#810).
+          paginate: async (route, args) => {
+            asked.push(`${args.owner}/${args.repo}`);
+            return [{ id: 7, tag_name: 'v1.2.3', draft: true, prerelease: false, created_at: '2026-09-08T01:31:00Z' }];
+          },
+          rest: {
+            repos: {
+              listReleases: () => {},
+              updateRelease: async (args) => { flipped.push(args.release_id); return { data: {} }; },
+              listReleaseAssets: async () => ({ data: [{ name: 'latest.yml' }, { name: 'latest-mac.yml' }, { name: 'latest-linux.yml' }] }),
+            },
+          },
+        };
+
+        const cwd = process.cwd();
+        const token = process.env.GH_TOKEN;
+        process.env.GH_TOKEN = 'ghp_test_fake_token_for_unit_test';
+        process.chdir(targetDir);
+        try {
+          await finalizeRelease({ publish: true, octokit });
+        } finally {
+          process.chdir(cwd);
+          if (token !== undefined) process.env.GH_TOKEN = token; else delete process.env.GH_TOKEN;
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+
+        // v<version> in the brand's ONE releases repo: the same address the build
+        // baked into the update feed, and the draft carrying that tag is the one
+        // flipped to published.
+        ctx.expect(asked).toEqual(['Acme-Org/acme-releases']);
+        ctx.expect(flipped).toEqual([7]);
+      },
+    },
+    {
+      name: 'gulp/package.js exports a function',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'package.js'));
+        ctx.expect(typeof mod).toBe('function');
+      },
+    },
+    {
+      name: 'gulp/release.js exports a function',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'release.js'));
+        ctx.expect(typeof mod).toBe('function');
+      },
+    },
+    {
+      name: 'gulp/build-config.js exports a function (already-tested separately, smoke check here)',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        ctx.expect(typeof mod).toBe('function');
+      },
+    },
+    {
+      name: 'commands/sign-windows.js exports an async function',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        ctx.expect(typeof mod).toBe('function');
+      },
+    },
+    {
+      name: 'sign-windows: --smoke on non-Windows throws',
+      run: async (ctx) => {
+        if (process.platform === 'win32') return; // skip on actual Windows
+        const signWindows = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        let threw;
+        try {
+          await signWindows({ smoke: true });
+        } catch (e) { threw = e; }
+        ctx.expect(threw).toBeDefined();
+        ctx.expect(threw.message).toMatch(/Windows-only|WIN_EV_TOKEN_PATH|WIN_CSC_KEY_PASSWORD/);
+      },
+    },
+    {
+      name: 'sign-windows: --target with non-existent file throws',
+      run: async (ctx) => {
+        const signWindows = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        let threw;
+        try {
+          await signWindows({ target: '/nonexistent/binary.exe' });
+        } catch (e) { threw = e; }
+        ctx.expect(threw).toBeDefined();
+        ctx.expect(threw.message).toMatch(/--target file does not exist/);
+      },
+    },
+    {
+      name: 'sign-windows: errors clearly when no input directory exists',
+      run: async (ctx) => {
+        const signWindows = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        let threw;
+        try {
+          await signWindows({ in: '/nonexistent/path/that/does/not/exist' });
+        } catch (e) {
+          threw = e;
+        }
+        ctx.expect(threw).toBeDefined();
+        ctx.expect(threw.message).toMatch(/does not exist/);
+      },
+    },
+    {
+      name: 'sign-windows: cloud strategy with unknown provider throws a clear error',
+      run: async (ctx) => {
+        const signWindows = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        // Stage a consumer dir with strategy='cloud' + a bogus provider in config.
+        const tmp = stageStrategyConfig({ strategy: 'cloud', cloudProvider: 'imaginary-provider-xyz' });
+        fs.writeFileSync(path.join(tmp, 'fake.exe'), 'fake');
+
+        const origCwd = process.cwd();
+        process.chdir(tmp);
+
+        try {
+          let threw;
+          try {
+            await signWindows({ in: tmp, out: path.join(tmp, 'signed') });
+          } catch (e) {
+            threw = e;
+          }
+          ctx.expect(threw).toBeDefined();
+          ctx.expect(threw.message).toMatch(/imaginary-provider-xyz|not yet implemented/);
+        } finally {
+          process.chdir(origCwd);
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'sign-windows: cloud strategy without provider throws',
+      run: async (ctx) => {
+        const signWindows = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        const tmp = stageStrategyConfig({ strategy: 'cloud' });
+        fs.writeFileSync(path.join(tmp, 'fake.exe'), 'fake');
+
+        const origCwd = process.cwd();
+        process.chdir(tmp);
+
+        try {
+          let threw;
+          try {
+            await signWindows({ in: tmp });
+          } catch (e) {
+            threw = e;
+          }
+          ctx.expect(threw).toBeDefined();
+          ctx.expect(threw.message).toMatch(/no provider set/);
+        } finally {
+          process.chdir(origCwd);
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'sign-windows: unknown strategy throws',
+      run: async (ctx) => {
+        const signWindows = require(path.join(__dirname, '..', '..', '..', 'commands', 'sign-windows.js'));
+        const tmp = stageStrategyConfig({ strategy: 'banana' });
+        fs.writeFileSync(path.join(tmp, 'fake.exe'), 'fake');
+
+        const origCwd = process.cwd();
+        process.chdir(tmp);
+
+        try {
+          let threw;
+          try {
+            await signWindows({ in: tmp });
+          } catch (e) {
+            threw = e;
+          }
+          ctx.expect(threw).toBeDefined();
+          ctx.expect(threw.message).toMatch(/Unknown Windows signing strategy/);
+        } finally {
+          process.chdir(origCwd);
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'notarize hook: skipped on non-darwin platforms',
+      run: async (ctx) => {
+        const notarize = require(path.join(__dirname, '..', '..', '..', 'hooks', 'notarize.js'));
+        // Just confirms it returns cleanly without env vars when platform isn't darwin.
+        const result = await notarize({
+          electronPlatformName: 'win32',
+          appOutDir: '/tmp',
+          packager: { appInfo: { productFilename: 'test' } },
+        });
+        ctx.expect(result).toBeUndefined();
+      },
+    },
+    {
+      name: 'notarize hook: invokes consumer hook at hooks/notarize/post (not legacy hooks/notarize.js)',
+      run: (ctx) => {
+        // Source-text guard for the rename. We can't easily exercise the live call
+        // without staging a fake API key + .app bundle, so this asserts the call site
+        // points at the new path. If someone reverts to runConsumerHook('notarize', ...)
+        // this fires.
+        const src = fs.readFileSync(path.join(__dirname, '..', '..', '..', 'hooks', 'notarize.js'), 'utf8');
+        ctx.expect(src).toContain("runConsumerHook('notarize/post'");
+        ctx.expect(src).not.toMatch(/runConsumerHook\(['"]notarize['"]/);
+      },
+    },
+    {
+      name: 'default scaffold ships hooks/notarize/post.js (not legacy hooks/notarize.js)',
+      run: (ctx) => {
+        const defaultsHooks = path.join(__dirname, '..', '..', '..', 'defaults', 'hooks');
+        ctx.expect(fs.existsSync(path.join(defaultsHooks, 'notarize', 'post.js'))).toBe(true);
+        ctx.expect(fs.existsSync(path.join(defaultsHooks, 'notarize.js'))).toBe(false);
+      },
+    },
+    {
+      name: 'notarize hook: warns + returns when API key env vars are missing',
+      run: async (ctx) => {
+        const notarize = require(path.join(__dirname, '..', '..', '..', 'hooks', 'notarize.js'));
+        // Snapshot + clear env.
+        const snapshot = {
+          APPLE_API_KEY:    process.env.APPLE_API_KEY,
+          APPLE_API_KEY_ID: process.env.APPLE_API_KEY_ID,
+          APPLE_API_ISSUER: process.env.APPLE_API_ISSUER,
+        };
+        delete process.env.APPLE_API_KEY;
+        delete process.env.APPLE_API_KEY_ID;
+        delete process.env.APPLE_API_ISSUER;
+
+        try {
+          const result = await notarize({
+            electronPlatformName: 'darwin',
+            appOutDir: '/tmp',
+            packager: { appInfo: { productFilename: 'test' } },
+          });
+          ctx.expect(result).toBeUndefined();
+        } finally {
+          for (const [k, v] of Object.entries(snapshot)) {
+            if (v !== undefined) process.env[k] = v;
+            else delete process.env[k];
+          }
+        }
+      },
+    },
+  ],
+});