@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/build-config.test.js

@@ -70,6 +70,49 @@ module.exports = defineCases({
         }
       },
     },
+    {
+      name: 'baseConfig: files never pack the target\'s scratch and state dirs (#866)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const files = baseConfig({}).files;
+        // The boot runner stages .omega/test-app with symlinks into the target and the
+        // packager followed them (dangling after a folder rename); none of these dirs
+        // is app content anyway.
+        for (const dir of ['.omega', '.claude', '.temp', '.cache', '.gh-runners', 'test']) {
+          ctx.expect(files).toContain(`!${dir}/**`);
+        }
+        // src/ stays: the runtime reads src/integrations/* from the app root.
+        ctx.expect(files.includes('!src/**')).toBe(false);
+      },
+    },
+    {
+      name: 'baseConfig: the DMG is signed with the Developer ID identity (#891)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({ app: { productName: 'Deployment Playground' } });
+
+        // Gatekeeper assesses a downloaded image by its OWN signature
+        // (`--context context:primary-signature`), and electron-builder leaves
+        // the image unsigned unless told: run 34735658588 notarized and stapled
+        // the DMG, then spctl refused it for the missing signature.
+        ctx.expect(out.dmg.sign).toBe(true);
+      },
+    },
+    {
+      name: 'notarizeHooks: the DMG is proved per artifact, BEFORE its upload (#891)',
+      run: (ctx) => {
+        const { notarizeHooks } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const hooks = notarizeHooks();
+
+        // electron-builder awaits `artifactBuildCompleted` before it emits the
+        // `artifactCreated` the publisher uploads on; `afterAllArtifactBuild`
+        // runs after every upload is queued. Run 34738410986 published a signed
+        // and notarized DMG with no staple because the proof ran there.
+        ctx.expect(hooks.afterSign).toContain(path.join('hooks', 'notarize.js'));
+        ctx.expect(hooks.artifactBuildCompleted).toContain(path.join('hooks', 'notarize-artifacts.js'));
+        ctx.expect(hooks.afterAllArtifactBuild).toBeUndefined();
+      },
+    },
     {
       name: 'baseConfig: artifact names carry NO version, from @omega.js/config\'s ONE rule (#620)',
       run: (ctx) => {
@@ -82,19 +125,22 @@ module.exports = defineCases({
         // github.com/<org>/<repo>/releases/latest/download/<asset> a stable
         // direct-download URL — the site derives its buttons from THESE names,
         // so a second spelling here is a dead download button.
-        ctx.expect(out.mac.artifactName).toBe('Deployment-Playground-mac-universal.${ext}');
-        ctx.expect(out.nsis.artifactName).toBe('Deployment-Playground-windows-universal.${ext}');
-        ctx.expect(out.deb.artifactName).toBe(names.linux.debian);
+        // The segment is the FORMAT (#867), the same word the site's
+        // /download/<platform>/<format> link carries.
+        ctx.expect(out.dmg.artifactName).toBe(names.mac.dmg);
+        ctx.expect(out.nsis.artifactName).toBe(names.windows.nsis);
+        ctx.expect(out.deb.artifactName).toBe(names.linux.deb);
         ctx.expect(out.appImage.artifactName).toBe(names.linux.appimage);
+        ctx.expect(out.dmg.artifactName).toBe('Deployment-Playground-mac-dmg.dmg');
+        ctx.expect(out.nsis.artifactName).toBe('Deployment-Playground-windows-nsis.exe');
 
-        // The mac fallback covers the dmg AND the auto-update zip, so the dmg
-        // needs no override of its own.
-        ctx.expect(out.mac.artifactName.replace('${ext}', 'dmg')).toBe(names.mac.universal);
-        ctx.expect(out.nsis.artifactName.replace('${ext}', 'exe')).toBe(names.windows.universal);
-        ctx.expect(out.dmg.artifactName).toBe(undefined);
+        // The mac FALLBACK is the auto-update zip's, the one mac artifact that
+        // is not a declared format: nobody links it, the feed names it.
+        ctx.expect(out.mac.artifactName).toBe('Deployment-Playground-mac.${ext}');
+        ctx.expect(out.mac.artifactName.replace('${ext}', 'zip')).toBe('Deployment-Playground-mac.zip');
 
         // Nothing keeps a ${version} token — every name is stable across releases.
-        for (const template of [out.mac.artifactName, out.nsis.artifactName, out.deb.artifactName, out.appImage.artifactName, out.linux.artifactName]) {
+        for (const template of [out.mac.artifactName, out.dmg.artifactName, out.nsis.artifactName, out.deb.artifactName, out.appImage.artifactName, out.linux.artifactName]) {
           ctx.expect(template.includes('${version}')).toBe(false);
         }
       },
@@ -159,7 +205,7 @@ module.exports = defineCases({
 
         // NSIS merges every arch into ONE installer, so windows is genuinely
         // safe — its multi-arch default is never refused.
-        ctx.expect(baseConfig({ platforms: { win: { arch: ['x64', 'ia32', 'arm64'] } } }, build).win.target[0].arch)
+        ctx.expect(baseConfig({ platforms: { windows: { arch: ['x64', 'ia32', 'arm64'] } } }, build).win.target[0].arch)
           .toEqual(['x64', 'ia32', 'arm64']);
 
         // One linux arch names one deb: an arm64-only brand ships fine.
@@ -280,28 +326,28 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'baseConfig: platforms.win.oneClick: false produces wizard installer',
+      name: 'baseConfig: platforms.windows.oneClick: false produces wizard installer',
       run: (ctx) => {
         const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
-        const out = baseConfig({ platforms: { win: { oneClick: false } } });
+        const out = baseConfig({ platforms: { windows: { oneClick: false } } });
         ctx.expect(out.nsis.oneClick).toBe(false);
         ctx.expect(out.nsis.allowToChangeInstallationDirectory).toBe(true);
       },
     },
     {
-      name: 'baseConfig: snap missing from config — no snap target (default OFF)',
+      name: 'baseConfig: a config that declares no platforms ships every format, snap included (#867)',
       run: (ctx) => {
-        // Behavior contract: callers who never set platforms.linux.snap.enabled should
-        // never get a snap target emitted. The scaffold ships `enabled: true` so new
-        // projects opt in by virtue of the scaffold; this case is for older projects
-        // or programmatic callers that don't supply the field.
+        // Presence is the switch and every format defaults ON, so a caller that
+        // declares nothing gets the framework's whole shipping set. The snap's
+        // second gate is its credentials, which is what keeps a brand that has
+        // not run the Snap ask yet from failing CI.
         const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
         const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
-        process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';   // creds present, but config doesn't enable
+        process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';
         try {
           const out = baseConfig({});
-          ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeUndefined();
-          ctx.expect(out.snap).toBeUndefined();
+          ctx.expect(out.linux.target.map((t) => t.target)).toEqual(['deb', 'AppImage', 'snap']);
+          ctx.expect(out.snap).toBeDefined();
         } finally {
           if (saved === undefined) delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
           else process.env.SNAPCRAFT_STORE_CREDENTIALS = saved;
@@ -309,13 +355,13 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'baseConfig: snap enabled in config but no creds — auto-skipped',
+      name: 'baseConfig: snap declared but no creds, auto-skipped',
       run: (ctx) => {
         const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
         const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
         delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
         try {
-          const out = baseConfig({ platforms: { linux: { snap: { enabled: true } } } });
+          const out = baseConfig({ platforms: { linux: { formats: { snap: {} } } } });
           ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeUndefined();
           ctx.expect(out.snap).toBeUndefined();
         } finally {
@@ -324,13 +370,13 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'baseConfig: snap explicitly disabled — no snap target regardless of creds',
+      name: 'baseConfig: snap dropped with `false`, no snap target regardless of creds',
       run: (ctx) => {
         const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
         const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
         process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';
         try {
-          const out = baseConfig({ platforms: { linux: { snap: { enabled: false } } } });
+          const out = baseConfig({ platforms: { linux: { formats: { snap: false } } } });
           ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeUndefined();
           ctx.expect(out.snap).toBeUndefined();
         } finally {
@@ -340,18 +386,18 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'baseConfig: snap enabled + creds present emits snap target + snap publish block',
+      name: 'baseConfig: snap declared + creds present emits snap target + snap publish block',
       run: (ctx) => {
         const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
         const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
         process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';
         try {
-          const out = baseConfig({ platforms: { linux: { snap: { enabled: true } } } });
+          const out = baseConfig({ platforms: { linux: { formats: { snap: { channels: ['edge'] } } } } });
           ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeDefined();
           ctx.expect(out.snap).toBeDefined();
           ctx.expect(out.snap.confinement).toBe('strict');
           ctx.expect(out.snap.publish.provider).toBe('snapStore');
-          ctx.expect(out.snap.publish.channels).toEqual(['stable']);
+          ctx.expect(out.snap.publish.channels).toEqual(['edge'], 'the format\'s own settings ride inside it');
         } finally {
           if (saved === undefined) delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
           else process.env.SNAPCRAFT_STORE_CREDENTIALS = saved;
@@ -364,9 +410,9 @@ module.exports = defineCases({
         const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
         const out = baseConfig({
           platforms: {
-            mac:   { arch: ['arm64'] },
-            win:   { arch: ['x64'] },
-            linux: { arch: ['arm64'] },
+            mac:     { arch: ['arm64'] },
+            windows: { arch: ['x64'] },
+            linux:   { arch: ['arm64'] },
           },
         });
         ctx.expect(out.mac.target[0].arch).toEqual(['arm64']);
@@ -412,7 +458,7 @@ module.exports = defineCases({
         // framework monorepo, and a feed baked from it would 404 forever.
         ctx.expect(publishConfig({
           brand: { id: 'omega-playground' },
-          repo: { providers: { github: { org: 'Omega-JS-Stack' } } },
+          repo: { provider: 'github', org: 'Omega-JS-Stack' },
           releases: {},
         })).toEqual({
           provider:    'github',
@@ -421,12 +467,19 @@ module.exports = defineCases({
           releaseType: 'release',
         });
 
-        // An explicit block still names its own repo.
+        // #883: `releases` is a presence switch and nothing more. The owner
+        // and repo overrides are retired, so the feed can only ever be the
+        // brand's one derived releases repo.
         ctx.expect(publishConfig({
           brand: { id: 'acme' },
-          repo: { providers: { github: { org: 'Acme-Org' } } },
-          releases: { owner: 'Acme-Binaries', repo: 'acme-bins' },
-        }).repo).toBe('acme-bins');
+          repo: { provider: 'github', org: 'Acme-Org' },
+          releases: {},
+        })).toEqual({
+          provider:    'github',
+          owner:       'Acme-Org',
+          repo:        'acme-releases',
+          releaseType: 'release',
+        });
       },
     },
     {
@@ -436,7 +489,7 @@ module.exports = defineCases({
 
         ctx.expect(publishConfig({
           brand: { id: 'acme' },
-          repo: { providers: { github: { org: 'Acme-Org' } } },
+          repo: { provider: 'github', org: 'Acme-Org' },
           releases: { enabled: false },
         })).toBe(null);
 
@@ -453,5 +506,62 @@ module.exports = defineCases({
         ctx.expect(out.protocols).toBeUndefined();
       },
     },
+    // The .deb target's two metadata facts (#872). electron-builder reads the
+    // homepage off the app package.json (`extraMetadata` is what it merges in) and
+    // the maintainer off `linux.maintainer`; without them the deb build dies at
+    // PACKAGE time, after the AppImage of the same run has already uploaded.
+    {
+      name: 'baseConfig: the brand url and support email become the deb metadata (#872)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const yaml = require('js-yaml');
+
+        const out = baseConfig({
+          brand: {
+            name: 'OMEGA Playground',
+            url: 'https://playground.omegajs.dev',
+            contact: { email: 'support@playground.omegajs.dev' },
+          },
+        });
+
+        ctx.expect(out.extraMetadata.homepage).toBe('https://playground.omegajs.dev');
+        ctx.expect(out.linux.maintainer).toBe('OMEGA Playground <support@playground.omegajs.dev>');
+
+        // And they survive into the file that is actually written.
+        const written = yaml.load(yaml.dump(out, { lineWidth: -1, noRefs: true }));
+        ctx.expect(written.extraMetadata.homepage).toBe('https://playground.omegajs.dev');
+        ctx.expect(written.linux.maintainer).toBe('OMEGA Playground <support@playground.omegajs.dev>');
+      },
+    },
+    {
+      name: 'assertLinuxPackageMetadata: an absent value names its config key and never writes an empty one',
+      run: async (ctx) => {
+        const { baseConfig, assertLinuxPackageMetadata } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+
+        const bare = baseConfig({});
+        // Nothing to derive, so nothing is emitted: no `maintainer: ''` in the yml.
+        ctx.expect('extraMetadata' in bare).toBe(false);
+        ctx.expect('maintainer' in bare.linux).toBe(false);
+
+        await ctx.expect(() => assertLinuxPackageMetadata(bare)).toThrow(/brand\.url/);
+        await ctx.expect(() => assertLinuxPackageMetadata(bare)).toThrow(/brand\.contact\.email/);
+
+        // Only the missing half is named.
+        const noEmail = baseConfig({ brand: { name: 'App', url: 'https://app.example.com' } });
+        await ctx.expect(() => assertLinuxPackageMetadata(noEmail)).toThrow(/brand\.contact\.email/);
+        ctx.expect(noEmail.extraMetadata.homepage).toBe('https://app.example.com');
+
+        // A consumer override of `linux.maintainer` satisfies it, which is why the
+        // assert runs after the electronBuilder merge and not inside baseConfig.
+        const overridden = baseConfig({ brand: { name: 'App', url: 'https://app.example.com' } });
+        overridden.linux.maintainer = 'App Team <team@app.example.com>';
+        assertLinuxPackageMetadata(overridden);
+
+        // And a build with no deb target has nothing to check.
+        const noDeb = baseConfig({});
+        noDeb.linux.target = [{ target: 'AppImage', arch: ['x64'] }];
+        assertLinuxPackageMetadata(noDeb);
+      },
+    },
   ],
 });

package/dist/test/suites/build/build-json-bake.test.js

@@ -0,0 +1,245 @@
+// Build-layer tests for what the build bakes as OMEGA_BUILD_JSON
+// ([#894](https://github.com/Omega-JS-Stack/omega/issues/894),
+// [#743](https://github.com/Omega-JS-Stack/omega/issues/743)).
+//
+// One wrapper and one name on every surface: `{ config, package, mode, license,
+// builtAt }`. What differs is WHO reads it, and how it is delivered:
+//
+//   main / preload  the RESOLVED config, whole, as an esbuild `define` plus the
+//                   banner. The main process boots from it (main.js reads
+//                   OMEGA_BUILD_JSON.config in a packaged app, where
+//                   config/omega.json5 is inside the asar), so autoUpdate,
+//                   platforms, startup and the rest have to be there. Both are
+//                   Node, neither is a public surface.
+//   renderer        the browser-safe subset (@omega.js/config's clientConfig),
+//                   delivered as the ONE `dist/build.js` every view's shell
+//                   loads ahead of its bundle: the same file, the same shape and
+//                   the same load order web and the extension use. A renderer is
+//                   a public surface, its bundle is readable from DevTools, so
+//                   the GCP account facts and the brand's provisioning sections
+//                   must not be in it.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const vm = require('vm');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const FRAMEWORK_ROOT = path.join(__dirname, '..', '..', '..', '..');
+const SRC = path.join(FRAMEWORK_ROOT, 'src');
+const TASK = path.join(SRC, 'gulp', 'tasks', 'bundle.js');
+const PAGE_TEMPLATE = path.join(SRC, 'config', 'page-template.html');
+
+// A resolved desktop config with one section from each side of the gate.
+const CONFIG = () => ({
+  brand: { id: 'paperloom', name: 'Paperloom' },
+  theme: { id: 'classy' },
+  cloud: {
+    provider: 'firebase',
+    config: { apiKey: 'public-web-key', projectId: 'paperloom-prod' },
+    billingAccount: '01ABCD-234567-89EFGH',
+  },
+  app: { productName: 'Paperloom' },
+  platforms: { windows: { signing: 'cloud' } },
+  certificates: { providers: { apple: { teamId: 'TEAM' } } },
+  account: { admins: [{ email: 'root@paperloom.com' }] },
+  repo: { provider: 'github', org: 'Paperloom' },
+});
+
+const MODE = { environment: 'production', build: true, publish: false, server: false };
+
+const INPUT = () => {
+  const { buildFacts } = require(TASK);
+  const pkg = { name: 'paperloom', version: '3.1.4' };
+
+  return {
+    config: CONFIG(),
+    facts: buildFacts({ pkg, mode: MODE, dev: { ports: { backend: 5002 } } }),
+    pkg,
+    mode: MODE,
+    license: { status: 'licensed', payments: 'live', attribution: 'removed' },
+  };
+};
+
+// Run a `build.js` the way a browser does: a scope whose only global is `self`.
+function loadBuildJs(file) {
+  const scope = { self: {} };
+  vm.runInNewContext(fs.readFileSync(file, 'utf8'), scope);
+  return scope.self.OMEGA_BUILD_JSON;
+}
+
+// Stage a minimal desktop project and run the REAL bundle task in it: the task
+// reads its project (package.json / config / dist) from cwd at require time.
+async function inStagedProject(fn) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-build-json-'));
+  fs.writeFileSync(path.join(tmp, 'package.json'), '{ "name": "staged-desktop", "version": "3.1.4" }');
+  fs.mkdirSync(path.join(tmp, 'config'), { recursive: true });
+  fs.writeFileSync(path.join(tmp, 'config', 'omega.json5'), `{
+    brand: { id: 'staged', name: 'Staged' },
+    cloud: { config: { apiKey: 'AIza-staged', projectId: 'demo-staged' }, billingAccount: '01ABCD-234567-89EFGH' },
+    targets: { desktop: { type: 'desktop' } },
+  }`);
+
+  const write = (relative, contents) => {
+    const full = path.join(tmp, relative);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, contents);
+  };
+  write('src/main.js', 'globalThis.__main = OMEGA_BUILD_JSON.config.brand.id;\n');
+  write('src/preload.js', 'globalThis.__preload = OMEGA_BUILD_JSON.config.brand.id;\n');
+  write('src/assets/js/components/main/index.js', [
+    'try { globalThis.__fromWindow = window.OMEGA_BUILD_JSON.config.brand.id; } catch (e) { globalThis.__fromWindow = null; }',
+    '',
+  ].join('\n'));
+
+  const oldCwd = process.cwd();
+  const flush = () => {
+    for (const key of Object.keys(require.cache)) {
+      if (key.startsWith(SRC + path.sep)) delete require.cache[key];
+    }
+  };
+
+  flush();
+  try {
+    process.chdir(tmp);
+    const task = require(TASK);
+    await new Promise((resolve, reject) => task((error) => (error ? reject(error) : resolve())));
+    return await fn(tmp);
+  } finally {
+    process.chdir(oldCwd);
+    flush();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'build json bake: one wrapper, one dist/build.js for the renderer (#894, #743)',
+  timeout: 180000,
+  tests: [
+    {
+      name: 'the wrapper is { config, package, mode, license, builtAt } on both halves',
+      run: (ctx) => {
+        const { composeBuildJson, composeClientBuildJson } = require(TASK);
+
+        const input = INPUT();
+        const buildJson = composeBuildJson(input);
+        const clientJson = composeClientBuildJson(input);
+
+        for (const blob of [buildJson, clientJson]) {
+          ctx.expect(Object.keys(blob).sort()).toEqual(['builtAt', 'config', 'license', 'mode', 'package']);
+          ctx.expect(blob.package.version).toBe('3.1.4');
+          ctx.expect(blob.license.status).toBe('licensed');
+          ctx.expect(typeof blob.builtAt).toBe('string');
+          // The mode is the same THREE keys everywhere (#894): desktop's own
+          // `server` verdict stays inside the Manager.
+          ctx.expect(Object.keys(blob.mode).sort()).toEqual(['build', 'environment', 'publish']);
+          ctx.expect(blob.mode.environment).toBe('production');
+          ctx.expect(blob.mode.build).toBe(true);
+        }
+      },
+    },
+    {
+      name: 'main and preload keep the WHOLE resolved config: the main process boots from it',
+      run: (ctx) => {
+        const { composeBuildJson } = require(TASK);
+
+        const buildJson = composeBuildJson(INPUT());
+
+        ctx.expect(buildJson.config.platforms.windows.signing).toBe('cloud');
+        ctx.expect(buildJson.config.certificates.providers.apple.teamId).toBe('TEAM');
+        ctx.expect(buildJson.config.cloud.billingAccount).toBe('01ABCD-234567-89EFGH');
+        // Plus the build facts main reads off it
+        ctx.expect(buildJson.config.version).toBe('3.1.4');
+        ctx.expect(buildJson.config.dev.ports.backend).toBe(5002);
+      },
+    },
+    {
+      name: 'the RENDERER snapshot carries the client subset, and no credential section at all',
+      run: (ctx) => {
+        const { composeClientBuildJson } = require(TASK);
+
+        const clientJson = composeClientBuildJson(INPUT());
+
+        // What the renderer's @omega.js/client actually boots from
+        ctx.expect(clientJson.config.brand.id).toBe('paperloom');
+        ctx.expect(clientJson.config.theme.id).toBe('classy');
+        ctx.expect(clientJson.config.cloud.config.apiKey).toBe('public-web-key');
+        ctx.expect(clientJson.config.app.productName).toBe('Paperloom');
+        ctx.expect(clientJson.config.version).toBe('3.1.4');
+        ctx.expect(clientJson.config.dev.ports.backend).toBe(5002);
+        // The runtime is BAKED (#896): the client's own sniff has no Electron
+        // signal to find in a renderer and would answer 'web'.
+        ctx.expect(clientJson.config.runtime).toBe('electron');
+
+        // …and nothing a public surface has no business carrying
+        ctx.expect(clientJson.config.platforms).toBeUndefined();
+        ctx.expect(clientJson.config.certificates).toBeUndefined();
+        ctx.expect(clientJson.config.account).toBeUndefined();
+        ctx.expect(clientJson.config.repo).toBeUndefined();
+        ctx.expect(clientJson.config.cloud.billingAccount).toBeUndefined();
+      },
+    },
+    {
+      // The load order the renderer depends on: the shell's FIRST script is the
+      // snapshot, ahead of the view's own bundle. `../../build.js` from
+      // dist/views/<view>/ is dist/build.js, and a packaged app resolves it
+      // inside the asar exactly as the bundle tag beside it does.
+      name: 'the page template loads build.js as its first script, ahead of the view bundle (#743)',
+      run: (ctx) => {
+        const template = fs.readFileSync(PAGE_TEMPLATE, 'utf8');
+        const loader = template.indexOf('<script src="../../build.js');
+        const bundle = template.indexOf('<script src="../../assets/js/components/');
+
+        ctx.expect(loader > -1).toBe(true);
+        ctx.expect(bundle > loader).toBe(true);
+        // The FIRST script tag in the shell, full stop.
+        ctx.expect(template.indexOf('<script')).toBe(loader);
+      },
+    },
+    {
+      name: 'a real build writes ONE dist/build.js, and the renderer bundle carries no copy (#743)',
+      run: async (ctx) => {
+        await inStagedProject(async (tmp) => {
+          const loader = path.join(tmp, 'dist', 'build.js');
+          ctx.expect(fs.existsSync(loader)).toBe(true);
+
+          const buildJson = loadBuildJs(loader);
+          ctx.expect(buildJson.config.brand.id).toBe('staged');
+          ctx.expect(buildJson.config.runtime).toBe('electron');
+          ctx.expect(buildJson.config.cloud.config.apiKey).toBe('AIza-staged');
+          // The subset gate ran: a provisioning fact never reaches the file a
+          // renderer (and anyone with DevTools) reads.
+          ctx.expect(buildJson.config.cloud.billingAccount).toBeUndefined();
+
+          // The renderer bundle carries neither the banner nor the define: with
+          // no build.js loaded there is no snapshot in that scope at all.
+          const rendererBundle = path.join(tmp, 'dist', 'assets', 'js', 'components', 'main.bundle.js');
+          const source = fs.readFileSync(rendererBundle, 'utf8');
+          ctx.expect(source.includes('OMEGA_BUILD_JSON={')).toBe(false);
+          ctx.expect(source.includes('OMEGA_BUILD_JSON = {')).toBe(false);
+
+          const scope = { self: {} };
+          scope.window = scope.self;
+          vm.runInNewContext(source, scope);
+          ctx.expect(scope.__fromWindow).toBe(null);
+
+          // Loaded the way a view loads it, build.js first, it answers.
+          const loaded = { self: {} };
+          loaded.window = loaded.self;
+          vm.runInNewContext(fs.readFileSync(loader, 'utf8'), loaded);
+          vm.runInNewContext(source, loaded);
+          ctx.expect(loaded.__fromWindow).toBe('staged');
+
+          // main and preload still carry the WHOLE config as a define: they are
+          // Node, and a packaged main boots from it inside the asar.
+          const mainBundle = fs.readFileSync(path.join(tmp, 'dist', 'main.bundle.js'), 'utf8');
+          ctx.expect(mainBundle.includes('OMEGA_BUILD_JSON')).toBe(true);
+          ctx.expect(mainBundle.includes('01ABCD-234567-89EFGH')).toBe(true);
+          ctx.expect(fs.existsSync(path.join(tmp, 'dist', 'preload.bundle.js'))).toBe(true);
+        });
+      },
+    },
+  ],
+});