@omega.js/desktop 0.1.0

package/dist/commands/update.js

@@ -0,0 +1,21 @@
+/**
+ * `omega update` — dependency freshness report (npu-outdated semantics):
+ * installed/wanted/latest + patch/minor/major per dep, releases younger than
+ * --min-age days (default 7) QUARANTINED. `--apply` installs the
+ * non-quarantined, non-breaking set (`--major` opts into breaking) through
+ * npu when present. The whole verb is the shared devkit implementation.
+ */
+const Manager = new (require('../build.js'));
+const logger = Manager.logger('update');
+const { runUpdate } = require('../vendor/devkit/update.js');
+
+module.exports = async function (options) {
+  await runUpdate({
+    dir: process.cwd(),
+    apply: options.apply,
+    major: options.major,
+    minAge: options.minAge ?? options['min-age'],
+    forceFresh: options.forceFresh || options['force-fresh'],
+    logger,
+  });
+};

package/dist/commands/validate-certs.js

@@ -0,0 +1,238 @@
+// Validate code-signing prerequisites (certs, profiles, env vars).
+//
+// Runs as an `omega deploy` precheck (non-fatal — warns and continues so the deploy
+// finishes even if certs aren't ready yet) and standalone via `npx omega validate-certs`.
+//
+// Exit codes:
+//   0  all checks passed
+//   1  failures (only when --strict is passed; otherwise we always exit 0 and just warn)
+
+const path = require('path');
+const fs = require('fs');
+const jetpack = require('fs-jetpack');
+const { execute } = require('node-powertools');
+
+const Manager = new (require('../build.js'));
+const logger = Manager.logger('validate-certs');
+
+module.exports = async function (options) {
+  options = options || {};
+  const strict = options.strict === true || (options._ && options._.includes('--strict'));
+
+  logger.log('Validating signing prerequisites...');
+
+  const platform = process.platform;
+  const config = Manager.getConfig();
+  const winStrategy = Manager.getWindowsSignStrategy();
+
+  const issues = [];
+
+  // macOS checks (run on any platform if cert files are present in config/certs/, since
+  // CI builds happen cross-platform — useful to flag bad files even when running on win/linux).
+  await checkMac(issues, config);
+
+  if (platform === 'win32') {
+    checkWindows(issues, winStrategy, config);
+  }
+
+  // Report.
+  if (issues.length === 0) {
+    logger.log(logger.format.green('All signing prerequisites OK.'));
+    return { ok: true };
+  }
+
+  for (const issue of issues) {
+    if (issue.severity === 'error') {
+      logger.error(`✗ ${issue.message}`);
+    } else {
+      logger.warn(`⚠ ${issue.message}`);
+    }
+  }
+
+  if (strict && issues.some((i) => i.severity === 'error')) {
+    throw new Error(`${issues.length} validation issue(s) — see above.`);
+  }
+
+  return { ok: false, issues };
+};
+
+async function checkMac(issues, config) {
+  const projectRoot = process.cwd();
+  const certsDir = path.join(projectRoot, 'config', 'certs');
+  const expectedAppId = config.app?.appId
+                     || `com.itwcw.${config.brand?.id || 'app'}`;
+
+  // 1. Developer ID Application .p12
+  const cscLink = process.env.CSC_LINK;
+  if (cscLink) {
+    const p12Path = path.isAbsolute(cscLink) ? cscLink : path.join(projectRoot, cscLink);
+    if (!jetpack.exists(p12Path)) {
+      issues.push({ severity: 'error', message: `CSC_LINK points to a missing file: ${p12Path}` });
+    } else if (!process.env.CSC_KEY_PASSWORD) {
+      issues.push({ severity: 'warn', message: 'CSC_KEY_PASSWORD not set — signing will fail.' });
+    } else {
+      logger.log(logger.format.green(`✓ Developer ID Application cert at ${path.relative(projectRoot, p12Path)}`));
+    }
+  } else if (jetpack.exists(certsDir)) {
+    // Look for the file even if env not pointed
+    const p12Files = jetpack.find(certsDir, { matching: '*.p12', recursive: false }) || [];
+    if (p12Files.length === 0) {
+      issues.push({ severity: 'warn', message: `No .p12 found in config/certs/ and CSC_LINK not set. (Required for macOS signing.)` });
+    } else {
+      issues.push({ severity: 'warn', message: `Found .p12 in config/certs/ but CSC_LINK env var is not set. Set CSC_LINK=${path.relative(projectRoot, p12Files[0])}` });
+    }
+  } else {
+    issues.push({ severity: 'warn', message: 'No config/certs/ directory and no CSC_LINK env var. Skipping mac cert check.' });
+  }
+
+  // 2. Provisioning profile (optional — only some apps need one)
+  const provisionFiles = jetpack.exists(certsDir)
+    ? (jetpack.find(certsDir, { matching: '*.provisionprofile', recursive: false }) || [])
+    : [];
+  for (const profPath of provisionFiles) {
+    try {
+      const parsed = parseProvision(profPath);
+      const rel = path.relative(projectRoot, profPath);
+
+      if (!parsed.parsed || !parsed.raw) {
+        issues.push({ severity: 'error', message: `${rel}: could not parse plist payload.` });
+        continue;
+      }
+
+      const exp = parsed.parsed.ExpirationDate;
+      if (exp && new Date(exp) < new Date()) {
+        issues.push({ severity: 'error', message: `${rel}: EXPIRED on ${new Date(exp).toISOString()}.` });
+        continue;
+      }
+
+      // Days until expiry — warn if < 30 days
+      if (exp) {
+        const daysLeft = Math.floor((new Date(exp) - new Date()) / (1000 * 60 * 60 * 24));
+        if (daysLeft < 30) {
+          issues.push({ severity: 'warn', message: `${rel}: expires in ${daysLeft} day(s) — renew soon.` });
+        }
+      }
+
+      // App ID match — provisioning profiles embed the app-id-prefix.bundle-id.
+      // Be lenient: just check the bundle id appears anywhere in the raw plist text.
+      if (expectedAppId && !parsed.raw.includes(expectedAppId)) {
+        issues.push({ severity: 'error', message: `${rel}: does not contain expected appId "${expectedAppId}". This profile is for a different app.` });
+        continue;
+      }
+
+      logger.log(logger.format.green(`✓ ${rel} (expires ${exp ? new Date(exp).toISOString().slice(0,10) : 'unknown'})`));
+    } catch (e) {
+      issues.push({ severity: 'error', message: `${path.relative(projectRoot, profPath)}: parse failed: ${e.message}` });
+    }
+  }
+
+  // 3. Notarization API key (.p8)
+  const apiKeyEnv = process.env.APPLE_API_KEY;
+  if (apiKeyEnv) {
+    const p8Path = path.isAbsolute(apiKeyEnv) ? apiKeyEnv : path.join(projectRoot, apiKeyEnv);
+    if (!jetpack.exists(p8Path)) {
+      issues.push({ severity: 'error', message: `APPLE_API_KEY points to a missing file: ${p8Path}` });
+    } else {
+      // Check the filename includes the key id (Apple's filename convention is AuthKey_<KEY_ID>.p8).
+      const keyId = process.env.APPLE_API_KEY_ID;
+      const issuer = process.env.APPLE_API_ISSUER;
+      const filenameKeyId = path.basename(p8Path).match(/AuthKey_([A-Z0-9]+)\.p8$/i)?.[1];
+
+      if (!keyId) {
+        issues.push({ severity: 'warn', message: 'APPLE_API_KEY set but APPLE_API_KEY_ID is missing.' });
+      } else if (filenameKeyId && filenameKeyId !== keyId) {
+        issues.push({ severity: 'warn', message: `APPLE_API_KEY filename suggests key ID "${filenameKeyId}" but APPLE_API_KEY_ID is "${keyId}". Likely a typo.` });
+      }
+
+      if (!issuer) {
+        issues.push({ severity: 'warn', message: 'APPLE_API_KEY set but APPLE_API_ISSUER is missing.' });
+      }
+
+      logger.log(logger.format.green(`✓ Notarization API key at ${path.relative(projectRoot, p8Path)}`));
+    }
+  } else {
+    issues.push({ severity: 'warn', message: 'No APPLE_API_KEY set. Required for notarization (`npm run release`).' });
+  }
+
+  // 4. Apple Team ID format check
+  const teamId = process.env.APPLE_TEAM_ID;
+  if (teamId && !/^[A-Z0-9]{10}$/.test(teamId)) {
+    issues.push({ severity: 'warn', message: `APPLE_TEAM_ID="${teamId}" doesn't match the expected 10-character format.` });
+  }
+
+  // 5. macOS Keychain identity (only when running on macOS — irrelevant on win/linux)
+  if (process.platform === 'darwin') {
+    try {
+      const out = await execute('security find-identity -v -p codesigning', { log: false });
+      const identities = String(out || '');
+      if (!identities.includes('Developer ID Application')) {
+        issues.push({ severity: 'warn', message: 'No "Developer ID Application" identity in macOS Keychain. Import your .p12 via Keychain Access.' });
+      } else {
+        logger.log(logger.format.green('✓ Keychain has Developer ID Application identity.'));
+      }
+    } catch (e) {
+      issues.push({ severity: 'warn', message: `Could not query macOS Keychain: ${e.message}` });
+    }
+  }
+}
+
+function checkWindows(issues, strategy, config) {
+  logger.log(`Checking Windows signing prerequisites (strategy: ${strategy})...`);
+
+  if (strategy === 'self-hosted' || strategy === 'local') {
+    const tokenPath = process.env.WIN_EV_TOKEN_PATH;
+    if (!tokenPath) {
+      issues.push({ severity: 'error', message: 'Set WIN_EV_TOKEN_PATH to the EV token / certificate path.' });
+      return;
+    }
+    if (!process.env.WIN_CSC_KEY_PASSWORD) {
+      issues.push({ severity: 'warn', message: 'WIN_CSC_KEY_PASSWORD not set — signing will fail.' });
+    }
+    logger.log(logger.format.green(`✓ Windows EV token path present (strategy=${strategy}).`));
+    return;
+  }
+
+  if (strategy === 'cloud') {
+    const provider = config.targets?.win?.signing?.cloud?.provider;
+    if (!provider) {
+      issues.push({ severity: 'error', message: 'Cloud signing strategy selected but no provider set (config.targets.win.signing.cloud.provider).' });
+      return;
+    }
+    const required = {
+      azure:    ['AZURE_TENANT_ID', 'AZURE_CLIENT_ID', 'AZURE_CLIENT_SECRET', 'AZURE_TRUSTED_SIGNING_ENDPOINT'],
+      sslcom:   ['SSLCOM_USERNAME', 'SSLCOM_PASSWORD', 'SSLCOM_CREDENTIAL_ID'],
+      digicert: ['DIGICERT_API_KEY', 'DIGICERT_KEYPAIR_ALIAS'],
+    }[provider] || [];
+
+    const missing = required.filter((k) => !process.env[k]);
+    if (missing.length > 0) {
+      issues.push({ severity: 'error', message: `Missing cloud-signing env vars for ${provider}: ${missing.join(', ')}` });
+      return;
+    }
+    logger.log(logger.format.green(`✓ Cloud signing provider "${provider}" configured.`));
+    return;
+  }
+
+  issues.push({ severity: 'error', message: `Unknown Windows signing strategy: ${strategy}` });
+}
+
+// Parse a provisioning profile (a CMS-signed plist). Extract the embedded plist payload.
+function parseProvision(filepath) {
+  const raw = jetpack.read(filepath);
+  if (!raw) return { parsed: null, raw: null };
+
+  const match = raw.match(/<\?xml(.|\n)*?<\/plist>/);
+  if (!match) return { parsed: null, raw: null };
+
+  const xml = match[0];
+  let parsed;
+  try {
+    parsed = require('plist').parse(xml);
+  } catch (e) {
+    return { parsed: null, raw: xml };
+  }
+  return { parsed, raw: xml };
+}
+
+// Exported for tests.
+module.exports.parseProvision = parseProvision;

package/dist/commands/version.js

@@ -0,0 +1,9 @@
+// Libraries
+const Manager = new (require('../build.js'));
+const logger = Manager.logger('version');
+
+const package = Manager.getPackage('main');
+
+module.exports = async function (options) {
+  logger.log(package.version);
+};

package/dist/config/page-template.html

@@ -0,0 +1,35 @@
+<!doctype html>
+<html data-bs-theme="{{ theme.appearance }}">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>{{ page.title }}</title>
+
+    <!-- Main CSS — present on every page (compiled from src/assets/scss/main.scss by gulp/sass). -->
+    <link href="../../assets/css/main.bundle.css?cb={{ cacheBust }}" rel="stylesheet">
+
+    <!-- Per-page CSS — present only on this view (compiled from src/assets/scss/pages/{{ page.name }}.scss). -->
+    <link href="../../assets/css/components/{{ page.name }}.bundle.css?cb={{ cacheBust }}" rel="stylesheet">
+  </head>
+  <body>
+    <!--
+      @omega.js/desktop titlebar — provides the draggable region for the inset native window controls.
+      - Mac: padded left ~70px to clear the inset traffic lights.
+      - Windows: padded right ~140px to clear the native overlay min/max/close buttons.
+      - Linux: hidden entirely (the native window frame supplies the title bar).
+      Platform detection comes from `html[data-platform]` set by @omega.js/client during init —
+      see themes/classy/css/components/_titlebar.scss for the styling.
+    -->
+    <div class="omega-titlebar">
+      <div class="omega-titlebar__drag" aria-hidden="true"></div>
+      <div class="omega-titlebar__title">{{ page.title }}</div>
+    </div>
+
+    <main class="omega-content">
+      {{ content }}
+    </main>
+
+    <!-- Per-page JS — entry bundle for this view (compiled by the `bundle` task's renderer entry). -->
+    <script src="../../assets/js/components/{{ page.name }}.bundle.js?cb={{ cacheBust }}"></script>
+  </body>
+</html>

package/dist/defaults/.github/workflows/build.yml

@@ -0,0 +1,276 @@
+name: Build & Release
+
+# Manual-trigger only — releases are intentional, not a side effect of every commit.
+on:
+  workflow_dispatch:
+    inputs:
+      platforms:
+        description: 'Platforms to build (comma-separated). Examples: all, windows, mac,linux'
+        required: false
+        default: 'all'
+        type: string
+
+env:
+  NODE_VERSION: '{{ versions.node }}'
+  OMEGA_BUILD_MODE: 'true'
+  OMEGA_IS_PUBLISH: 'true'
+  OMEGA_IS_SERVER:  'true'
+  GH_TOKEN: ${{ secrets.GH_TOKEN }}
+  # Every CI-delivered key of the env schema, GENERATED (#627): one
+  # `KEY: ${{ secrets.KEY }}` line per `delivery: { desktop: 'ci' | 'bake' }`
+  # entry (@omega.js/config's env-delivery.js), re-rendered by every verb's
+  # ensureTarget. Signing, notarization, store and analytics credentials all
+  # arrive here, workflow-wide — the jobs and steps below consume them without
+  # restating one. Add a key to the schema, not to this file.
+  {{ githubSecrets }}
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Resolve which platforms to build from the workflow_dispatch `platforms` input.
+  # Outputs a JSON matrix (consumed by the build job) plus per-platform booleans
+  # (consumed by windows-strategy / windows-sign gating). When `platforms` is
+  # omitted (older invocations) the input defaults to 'all'.
+  setup:
+    name: Setup (resolve target platforms)
+    runs-on: ubuntu-latest
+    outputs:
+      matrix:  ${{ steps.resolve.outputs.matrix }}
+      mac:     ${{ steps.resolve.outputs.mac }}
+      windows: ${{ steps.resolve.outputs.windows }}
+      linux:   ${{ steps.resolve.outputs.linux }}
+    steps:
+      - id: resolve
+        run: |
+          input="${{ github.event.inputs.platforms || 'all' }}"
+          input="$(echo "$input" | tr '[:upper:]' '[:lower:]')"
+
+          mac=false; win=false; linux=false
+          if [[ "$input" == *all* ]]; then mac=true; win=true; linux=true; fi
+          if [[ "$input" == *mac* ]] || [[ "$input" == *darwin* ]]; then mac=true; fi
+          if [[ "$input" == *win* ]]; then win=true; fi
+          if [[ "$input" == *linux* ]] || [[ "$input" == *ubuntu* ]]; then linux=true; fi
+
+          entries=()
+          $mac   && entries+=('"macos-latest"')
+          $win   && entries+=('"windows-latest"')
+          $linux && entries+=('"ubuntu-latest"')
+          if [ ${#entries[@]} -eq 0 ]; then
+            echo "Error: '$input' did not match any platform. Use: all | mac | windows | linux | comma-separated combos." >&2
+            exit 1
+          fi
+
+          matrix="[$(IFS=,; echo "${entries[*]}")]"
+          echo "Resolved input='$input' → mac=$mac, win=$win, linux=$linux, matrix=$matrix"
+
+          echo "matrix=$matrix"  >> "$GITHUB_OUTPUT"
+          echo "mac=$mac"        >> "$GITHUB_OUTPUT"
+          echo "windows=$win"    >> "$GITHUB_OUTPUT"
+          echo "linux=$linux"    >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build (${{ matrix.os }})
+    needs: setup
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(needs.setup.outputs.matrix) }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    steps:
+      # The workflow's own token: a checkout never needs the release PAT, and a
+      # bad PAT then fails at the release step with an API error, not here with
+      # git asking for a username.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+
+      - name: Install Socket Firewall
+        run: npm install -g sfw
+
+      # On Windows, force cmd for every shell step in this job — the runner's default
+      # is PowerShell 7 which has its own ExecutionPolicy/wrapping quirks that cause
+      # `npm ci` and similar to exit silently with no captured output. cmd has none
+      # of that. mac/linux use their default bash regardless of this flag (per
+      # actions/runner shell-resolution: `cmd` is win-only and ignored elsewhere).
+      - if: matrix.os == 'windows-latest'
+        shell: cmd
+        run: sfw npm ci
+      - if: matrix.os != 'windows-latest'
+        run: sfw npm ci
+
+      # macOS — decode signing assets from secrets, then sign + notarize + publish.
+      # `npx omega push-secrets` uploads .p12 / .p8 files as base64-encoded secrets;
+      # the workflow decodes them back to disk for electron-builder + notarytool to read.
+      - if: matrix.os == 'macos-latest'
+        run: |
+          mkdir -p config/certs
+          echo "${{ secrets.CSC_LINK }}"      | base64 --decode > config/certs/dev-id.p12
+          echo "${{ secrets.APPLE_API_KEY }}" | base64 --decode > config/certs/AuthKey.p8
+      # The two file-path OVERRIDES of the workflow env: electron-builder and
+      # notarytool read these as paths, and the step above just decoded the
+      # base64 secrets of the same name to disk. Every other credential comes
+      # from the generated env block.
+      - if: matrix.os == 'macos-latest'
+        env:
+          CSC_LINK:         config/certs/dev-id.p12
+          APPLE_API_KEY:    config/certs/AuthKey.p8
+        run: npm run release:local
+
+      # Linux — install snapcraft when (a) the consumer hasn't explicitly disabled snap
+      # in their config (`platforms.linux.snap.enabled !== false`; default is true) AND
+      # (b) SNAPCRAFT_STORE_CREDENTIALS is set as a repo secret. Without the secret we
+      # skip snapcraft install entirely — build-config.js auto-skips the snap target on
+      # the same condition, so the build still produces .deb + .AppImage cleanly with
+      # no snap publish attempt and no failure.
+      - name: Install Snapcraft (Linux, when snap enabled + creds present)
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          # (a) Config check — explicit `enabled: false` opts out; missing/true opts in.
+          # `@omega.js/desktop/config` is the vendored @omega.js/config loader — resolves
+          # config/omega.json5 for the desktop target (brand-monorepo aware).
+          if node -e 'const c = require("@omega.js/desktop/config").loadConfig(process.cwd(), "desktop").config; process.exit(c.platforms?.linux?.snap?.enabled === false ? 1 : 0);'; then
+            CONFIG_OK=1
+          else
+            CONFIG_OK=0
+            echo "platforms.linux.snap.enabled === false — skipping snapcraft install."
+          fi
+          # (b) Credentials check — empty secret means no publish creds available.
+          if [ -n "$SNAPCRAFT_STORE_CREDENTIALS" ]; then
+            CREDS_OK=1
+          else
+            CREDS_OK=0
+            echo "SNAPCRAFT_STORE_CREDENTIALS not set — skipping snapcraft install. Run 'snapcraft export-login -' and add the blob to .env, then 'mgr push-secrets'."
+          fi
+          if [ "$CONFIG_OK" = 1 ] && [ "$CREDS_OK" = 1 ]; then
+            sudo snap install snapcraft --classic
+            echo "Snapcraft installed."
+          fi
+
+      # Linux — no signing
+      - if: matrix.os == 'ubuntu-latest'
+        run: npm run release:local
+
+      # Windows — package (build + electron-builder package) unsigned. We do NOT publish
+      # here. Mac/linux's `npm run release:local` step already created the GH Release via
+      # electron-builder publish; windows-sign uploads signed .exe to that same release.
+      # shell: cmd as above — PowerShell 7's wrapping breaks long-running npm scripts.
+      - if: matrix.os == 'windows-latest'
+        shell: cmd
+        env:
+          OMEGA_SKIP_WIN_SIGN: 'true'
+          # The workflow env carries the mac signing cert (CSC_LINK is the
+          # base64 .p12 the mac job decodes); electron-builder would otherwise
+          # try to sign the Windows build with it. Empty reads as UNSET — the
+          # build's sanitize pass drops it — so this step packages unsigned, as
+          # it always did. windows-sign signs separately.
+          CSC_LINK: ''
+          CSC_KEY_PASSWORD: ''
+        run: npm run package
+
+      - if: matrix.os == 'windows-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-unsigned
+          # Capture installer + auto-updater feed + blockmap so windows-sign can re-upload them all.
+          path: |
+            release/*.exe
+            release/*.yml
+            release/*.blockmap
+
+  # Resolve the signing strategy from config/omega.json5. We do this in a tiny job
+  # (just runs node + the vendored config loader) so downstream jobs can gate on the result.
+  # Single source of truth = the consumer's config file; workflow doesn't duplicate the value.
+  windows-strategy:
+    name: Resolve Windows signing strategy
+    needs: [setup, build]
+    if: needs.setup.outputs.windows == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      strategy: ${{ steps.resolve.outputs.strategy }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+      - run: npm install -g sfw
+      - run: sfw npm ci
+      - id: resolve
+        run: |
+          STRATEGY=$(node -e "const c=require('@omega.js/desktop/config').loadConfig(process.cwd(),'desktop').config;console.log(c.platforms?.win?.signing?.strategy || 'self-hosted');")
+          echo "strategy=$STRATEGY" >> "$GITHUB_OUTPUT"
+          echo "Resolved Windows signing strategy: $STRATEGY"
+
+  windows-sign:
+    name: Sign Windows
+    needs: [setup, build, windows-strategy]
+    # Strategy comes from config platforms.win.signing.strategy (read by windows-strategy job).
+    #   self-hosted (default) — runs on a self-hosted runner with EV USB token attached
+    #   cloud                 — runs on hosted windows-latest, calls cloud signing provider
+    #   local                 — skip this job; sign locally via `npx omega sign-windows`
+    if: needs.setup.outputs.windows == 'true' && needs.windows-strategy.outputs.strategy != 'local'
+    runs-on: ${{ needs.windows-strategy.outputs.strategy == 'cloud' && fromJSON('["windows-latest"]') || fromJSON('["self-hosted","windows","ev-token"]') }}
+    # Use cmd.exe (not PowerShell) on Windows. Self-hosted runners often have PowerShell
+    # ExecutionPolicy set to Restricted, which blocks the Actions-generated wrapper .ps1
+    # scripts that GH spits out for every `run:` step. cmd.exe has no such restriction
+    # and runs the same `npm ci` / `npx ...` commands fine.
+    defaults:
+      run:
+        shell: cmd
+    # Signing credentials — self-hosted EV USB token (WIN_EV_TOKEN_PATH,
+    # WIN_CSC_KEY_PASSWORD, SIGNTOOL_PATH) and the cloud providers (only the set
+    # `platforms.win.signing.cloud.provider` names is consumed) — all arrive
+    # through the workflow's generated env block. Set them in the brand .env and
+    # push with `npx omega push-secrets`.
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      - run: npm install -g sfw
+      - run: sfw npm ci
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-unsigned
+          path: release
+      - run: npx omega sign-windows --in release --out release/signed
+      # Upload the SIGNED Windows assets to the release the mac/linux electron-builder
+      # publish step already created in the brand's public releases repo. The asset
+      # names carry no version, so nothing is mirrored anywhere.
+      - run: npx omega finalize-release --signed-dir release/signed
+
+  finalize:
+    name: Finalize release
+    # Run after every required job. windows-sign is skipped when strategy=local OR when
+    # `inputs.platforms` excludes windows; this job still runs and just won't flip the
+    # release to published in those cases (see step gate below).
+    # `always()` lets a failed or skipped job reach this `if`, which is why the
+    # build's result is named rather than left to the default success gate.
+    needs: [setup, build, windows-sign]
+    if: always() && needs.build.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+      - run: npm install -g sfw
+      - run: sfw npm ci
+      # Flip the releases-repo release from Draft to Published so electron-updater
+      # can read it. Idempotent — safe to run even if already published. ONLY runs
+      # on all-platforms builds: a partial run (e.g. `--platforms windows`) leaves
+      # the release as a draft, so subsequent runs can fill in the missing platform
+      # assets before electron-updater starts seeing the version.
+      - if: needs.setup.outputs.mac == 'true' && needs.setup.outputs.linux == 'true' && needs.setup.outputs.windows == 'true'
+        run: npx omega finalize-release --publish
+      - if: needs.setup.outputs.mac != 'true' || needs.setup.outputs.linux != 'true' || needs.setup.outputs.windows != 'true'
+        run: echo "Partial-platform run (mac=${{ needs.setup.outputs.mac }} linux=${{ needs.setup.outputs.linux }} windows=${{ needs.setup.outputs.windows }}) — leaving release as draft. Run with --platforms all to publish."