@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/get-config.test.js

@@ -7,13 +7,34 @@ const fs      = require('fs');
 const os      = require('os');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
-function stageConsumer(jsonText) {
+function stageConsumer(jsonText, overlays) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-getconfig-'));
   fs.mkdirSync(path.join(tmp, 'config'), { recursive: true });
   fs.writeFileSync(path.join(tmp, 'config', 'omega.json5'), jsonText);
+  for (const [environment, contents] of Object.entries(overlays || {})) {
+    fs.writeFileSync(path.join(tmp, 'config', `omega.${environment}.json5`), contents);
+  }
   return tmp;
 }
 
+// Run `fn` with the build-mode flag and this machine's ambient environment
+// stated the way a real run states them; the originals come back after.
+function withEnv(vars, fn) {
+  const saved = Object.keys(vars).map((key) => [key, process.env[key]]);
+  try {
+    for (const [key, value] of Object.entries(vars)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    return fn();
+  } finally {
+    for (const [key, value] of saved) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+}
+
 function loadConfigInDir(dir) {
   const oldCwd = process.cwd();
   // Bust the build module cache since it's a singleton.
@@ -37,14 +58,14 @@ module.exports = defineCases({
     {
       name: 'derives appId from the BRAND: reverse-domain of brand.url, else app.<brand.id> (friction #18)',
       run: (ctx) => {
-        const withUrl = stageConsumer(`{ brand: { id: 'somiibo', name: 'Somiibo', url: 'https://www.somiibo.com' }, targets: { desktop: {} } }`);
+        const withUrl = stageConsumer(`{ brand: { id: 'somiibo', name: 'Somiibo', url: 'https://www.somiibo.com' }, targets: { desktop: { type: 'desktop' } } }`);
         try {
           ctx.expect(loadConfigInDir(withUrl).app.appId).toBe('com.somiibo');
         } finally {
           fs.rmSync(withUrl, { recursive: true, force: true });
         }
 
-        const noUrl = stageConsumer(`{ brand: { id: 'somiibo', name: 'Somiibo' }, targets: { desktop: {} } }`);
+        const noUrl = stageConsumer(`{ brand: { id: 'somiibo', name: 'Somiibo' }, targets: { desktop: { type: 'desktop' } } }`);
         try {
           ctx.expect(loadConfigInDir(noUrl).app.appId).toBe('app.somiibo');
         } finally {
@@ -52,10 +73,58 @@ module.exports = defineCases({
         }
       },
     },
+    {
+      // #909: the certificates service registers
+      // `<certificates.providers.apple.bundleIdPrefix>.<brand.id>` (dashes as
+      // dots), so a brand whose config carries a prefix (its own, or the
+      // company layer's) signs under that same id. The URL host is what a
+      // brand with no prefix still derives from, and a GitHub repo URL is
+      // exactly why that fallback cannot be the rule.
+      name: 'derives appId from certificates.providers.apple.bundleIdPrefix when the config carries one (#909)',
+      run: (ctx) => {
+        const withPrefix = stageConsumer(`{
+          brand: { id: 'my-app', name: 'My App', url: 'https://github.com/acme/my-app' },
+          certificates: { providers: { apple: { bundleIdPrefix: 'com.itwcreativeworks' } } },
+          targets: { desktop: { type: 'desktop' } },
+        }`);
+        try {
+          ctx.expect(loadConfigInDir(withPrefix).app.appId).toBe('com.itwcreativeworks.my.app');
+        } finally {
+          fs.rmSync(withPrefix, { recursive: true, force: true });
+        }
+
+        const noPrefix = stageConsumer(`{
+          brand: { id: 'my-app', name: 'My App', url: 'https://github.com/acme/my-app' },
+          targets: { desktop: { type: 'desktop' } },
+        }`);
+        try {
+          ctx.expect(loadConfigInDir(noPrefix).app.appId).toBe('com.github');
+        } finally {
+          fs.rmSync(noPrefix, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // ONE derivation, @omega.js/config's (#909). A hyphenated or uppercase
+      // host is exactly where reversing the string by hand and the helper part
+      // ways, and a bundle id carrying a hyphen is not a bundle id.
+      name: 'the url fallback is @omega.js/config\'s own derivation, hyphens and case included (#909)',
+      run: (ctx) => {
+        const { deriveBundleIdPrefix } = require('../../../vendor/config/index.js');
+        const url = 'https://My-App.Example.com';
+        const dir = stageConsumer(`{ brand: { id: 'my-app', name: 'My App', url: '${url}' }, targets: { desktop: { type: 'desktop' } } }`);
+
+        try {
+          ctx.expect(loadConfigInDir(dir).app.appId).toBe(deriveBundleIdPrefix(url));
+        } finally {
+          fs.rmSync(dir, { recursive: true, force: true });
+        }
+      },
+    },
     {
       name: 'derives productName from brand.name when not set',
       run: (ctx) => {
-        const tmp = stageConsumer(`{ brand: { id: 'somiibo', name: 'Somiibo' }, targets: { desktop: {} } }`);
+        const tmp = stageConsumer(`{ brand: { id: 'somiibo', name: 'Somiibo' }, targets: { desktop: { type: 'desktop' } } }`);
         try {
           const cfg = loadConfigInDir(tmp);
           ctx.expect(cfg.app.productName).toBe('Somiibo');
@@ -70,6 +139,7 @@ module.exports = defineCases({
         const tmp = stageConsumer(`{
           brand: { id: 'somiibo', name: 'Somiibo' },
           targets: { desktop: {
+            type: 'desktop',
             app: { appId: 'com.custom.id', productName: 'Custom Name' },
           } },
         }`);
@@ -88,14 +158,15 @@ module.exports = defineCases({
         const tmp = stageConsumer(`{
           brand: { id: 'somiibo', name: 'Somiibo' },
           targets: { desktop: {
+            type: 'desktop',
             startup:   { mode: 'hidden' },
-            platforms: { win: { signing: { strategy: 'cloud' } } },
+            platforms: { windows: { signing: { strategy: 'cloud' } } },
           } },
         }`);
         try {
           const cfg = loadConfigInDir(tmp);
           ctx.expect(cfg.startup.mode).toBe('hidden');
-          ctx.expect(cfg.platforms.win.signing.strategy).toBe('cloud');
+          ctx.expect(cfg.platforms.windows.signing.strategy).toBe('cloud');
         } finally {
           fs.rmSync(tmp, { recursive: true, force: true });
         }
@@ -108,6 +179,7 @@ module.exports = defineCases({
           brand:  { id: 'somiibo', name: 'Somiibo' },
           monitoring: { providers: { sentry: { dsn: 'https://shared.example.com' } } },
           targets: { desktop: {
+            type: 'desktop',
             monitoring: { providers: { sentry: { dsn: 'https://desktop-only.example.com' } } },
           } },
         }`);
@@ -119,6 +191,44 @@ module.exports = defineCases({
         }
       },
     },
+    {
+      // #856: the environment overlay a BUILD composes is the one the lane
+      // names, not the one the machine answers. OMEGA_BUILD_MODE is the lane's
+      // own word for a production bake, and a dev boot (no flag) is development
+      // ([#817](https://github.com/Omega-JS-Stack/omega/issues/817)). The
+      // resolved config carries the word it composed under, as `environment`,
+      // the build fact every OMEGA surface spells the same way (#896).
+      name: 'a PRODUCTION build composes the production overlay, a dev boot the ambient one (#856)',
+      run: (ctx) => {
+        const tmp = stageConsumer(
+          `{ brand: { id: 'somiibo', name: 'Somiibo' }, targets: { desktop: { type: 'desktop' } } }`,
+          {
+            production: `{ targets: { desktop: { app: { productName: 'Somiibo Production' } } } }`,
+            development: `{ targets: { desktop: { app: { productName: 'Somiibo Dev' } } } }`,
+          },
+        );
+        try {
+          // A fresh lane each time: OMEGA_ENVIRONMENT is the ONE input (#817)
+          // and src/build.js sets it at load from the build-mode flag, so each
+          // sub-case starts from a process that has not been told anything.
+          const freshLane = { OMEGA_ENVIRONMENT: undefined, OMEGA_TEST_MODE: undefined, ENVIRONMENT: undefined, FUNCTIONS_EMULATOR: undefined, TERM_PROGRAM: undefined };
+
+          const built = withEnv({ ...freshLane, OMEGA_BUILD_MODE: 'true' }, () => loadConfigInDir(tmp));
+          ctx.expect(built.app.productName).toBe('Somiibo Production');
+          ctx.expect(built.environment).toBe('production');
+
+          // A dev boot names nothing, and resolves development rather than the
+          // machine-sniffed answer its old copy gave (#817): the same run used
+          // to compose the PRODUCTION overlay in a terminal that did not look
+          // like one.
+          const dev = withEnv({ ...freshLane, OMEGA_BUILD_MODE: undefined }, () => loadConfigInDir(tmp));
+          ctx.expect(dev.app.productName).toBe('Somiibo Dev');
+          ctx.expect(dev.environment).toBe('development');
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
     {
       name: 'returns seeded {brand:{}, app:{}} when config file missing',
       run: (ctx) => {
@@ -126,8 +236,10 @@ module.exports = defineCases({
         // deref config.brand.X / config.app.X without optional-chaining at every site.
         const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-getconfig-empty-'));
         try {
-          const cfg = loadConfigInDir(tmp);
-          ctx.expect(cfg).toEqual({ brand: {}, app: {} });
+          // A fresh lane, so the seeded shape is stated against a known input.
+          const cfg = withEnv({ OMEGA_ENVIRONMENT: undefined, OMEGA_BUILD_MODE: undefined }, () => loadConfigInDir(tmp));
+          // `environment` rides on every resolved config as the build fact (#817/#896).
+          ctx.expect(cfg).toEqual({ environment: 'development', brand: {}, app: {} });
         } finally {
           fs.rmSync(tmp, { recursive: true, force: true });
         }

package/dist/test/suites/build/github-utils.test.js

@@ -1,6 +1,9 @@
-// Build-layer tests for src/utils/github.js — the octokit factory + repo ensure.
-// Repo DISCOVERY is not this module's job any more (#799): the app repo and the
-// releases repo come from @omega.js/config, never a package.json or a git remote.
+// Build-layer tests for src/utils/github.js: the octokit factory, and nothing
+// else. Repo DISCOVERY is not this module's job (#799): the source repo and the
+// releases repo come from @omega.js/config, never a package.json or a git
+// remote. Repo CREATION is not either (#883): `@omega.js/devkit/github-repo`'s
+// ensureRepo is the one home, so a bug in it is fixed once for the manage walk,
+// the web deploy and the release precheck alike.
 
 const path    = require('path');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
@@ -8,17 +11,20 @@ const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 module.exports = defineCases({
   type: 'suite',
   layer: 'build',
-  description: 'utils/github — octokit factory + repo ensure',
+  description: 'utils/github: the octokit factory, and only that',
   tests: [
     {
-      name: 'github utils exports the octokit surface and NO repo discovery (#799)',
+      name: 'github utils exports the octokit surface, no discovery (#799) and no ensure (#883)',
       run: (ctx) => {
         const mod = require(path.join(__dirname, '..', '..', '..', 'utils', 'github.js'));
         ctx.expect(typeof mod.getOctokit).toBe('function');
-        ctx.expect(typeof mod.ensureRepo).toBe('function');
         // The git-remote fallback is gone: in a brand monorepo it answered the
         // ENCLOSING repo, so every release verb targeted the wrong owner.
         ctx.expect(mod.discoverRepo).toBeUndefined();
+        // And the second ensureRepo is gone with it: one implementation, in
+        // devkit, so a repo this framework creates matches every other.
+        ctx.expect(mod.ensureRepo).toBeUndefined();
+        ctx.expect(typeof require('../../../vendor/devkit/github-repo.js').ensureRepo).toBe('function');
       },
     },
     {

package/dist/test/suites/build/license-stamp.test.js

@@ -22,13 +22,15 @@ module.exports = defineCases({
     {
       name: 'the stamp rides the build blob, never the client config',
       run: (ctx) => {
-        const { composeBuildJson } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
+        const { composeBuildJson, buildFacts } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
 
+        const pkg = { version: '3.1.4' };
+        const mode = { environment: 'production', build: true, publish: false };
         const buildJson = composeBuildJson({
           config: { brand: { id: 'paperloom' } },
-          dev: null,
-          pkg: { version: '3.1.4' },
-          mode: { environment: 'production' },
+          facts: buildFacts({ pkg, mode, dev: null }),
+          pkg,
+          mode,
           license: { status: 'licensed', payments: 'live', attribution: 'removed' },
         });
 

package/dist/test/suites/build/manager.test.js

@@ -3,6 +3,51 @@
 const Manager = require('../../../build.js');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
+// The one input and the two lane flags that decide it, saved and restored
+// around every case that touches them (#817).
+const LANE_KEYS = ['OMEGA_ENVIRONMENT', 'OMEGA_BUILD_MODE', 'OMEGA_TEST_MODE', 'NODE_ENV'];
+
+/**
+ * Run `fn` with exactly `vars` set on the lane keys (null clears them all).
+ * @param {object|null} vars - the lane env for this case.
+ * @param {function} fn - the body.
+ * @returns {*} whatever `fn` returns.
+ */
+function withEnvironment(vars, fn) {
+  const saved = {};
+  for (const key of LANE_KEYS) saved[key] = process.env[key];
+  try {
+    for (const key of LANE_KEYS) delete process.env[key];
+    Object.assign(process.env, vars || {});
+    return fn();
+  } finally {
+    for (const key of LANE_KEYS) {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    }
+  }
+}
+
+/**
+ * What src/build.js resolves at LOAD for a given lane. build.js sets the input
+ * once, at require time, so this loads a fresh copy of it per lane.
+ * @param {object} vars - the lane env.
+ * @returns {string} the resolved environment.
+ */
+function laneEnvironment(vars) {
+  const buildPath = require.resolve('../../../build.js');
+  return withEnvironment(vars, () => {
+    const saved = require.cache[buildPath];
+    delete require.cache[buildPath];
+    try {
+      return require(buildPath).getEnvironment();
+    } finally {
+      if (saved) require.cache[buildPath] = saved;
+      else delete require.cache[buildPath];
+    }
+  });
+}
+
 module.exports = defineCases({
   type: 'group', // independent tests; run all even on failure
   layer: 'build',
@@ -23,96 +68,71 @@ module.exports = defineCases({
         ctx.expect(mode).toHaveProperty('publish');
         ctx.expect(mode).toHaveProperty('server');
         ctx.expect(mode).toHaveProperty('environment');
-        ctx.expect(['development', 'production']).toContain(mode.environment);
+        ctx.expect(['development', 'testing', 'production']).toContain(mode.environment);
       },
     },
     {
-      name: 'getEnvironment is testing when OMEGA_TEST_MODE=true (takes precedence)',
+      // The environment reads ONE input, `OMEGA_ENVIRONMENT`
+      // ([#817](https://github.com/Omega-JS-Stack/omega/issues/817)), and the
+      // lane that boots or builds this app sets it (src/build.js does, at load).
+      // Nothing sniffs NODE_ENV, app.isPackaged or OMEGA_TEST_MODE any more.
+      name: 'getEnvironment answers the one input, for each of the three names',
       run: (ctx) => {
-        const prevTest = process.env.OMEGA_TEST_MODE;
-        const prevBuild = process.env.OMEGA_BUILD_MODE;
-        process.env.OMEGA_TEST_MODE = 'true';
-        process.env.OMEGA_BUILD_MODE = 'true'; // even with build mode set, testing wins
-        try {
-          ctx.expect(Manager.getEnvironment()).toBe('testing');
-        } finally {
-          if (prevTest === undefined) delete process.env.OMEGA_TEST_MODE; else process.env.OMEGA_TEST_MODE = prevTest;
-          if (prevBuild === undefined) delete process.env.OMEGA_BUILD_MODE; else process.env.OMEGA_BUILD_MODE = prevBuild;
-        }
+        withEnvironment(null, () => {
+          for (const name of ['development', 'testing', 'production']) {
+            process.env.OMEGA_ENVIRONMENT = name;
+            ctx.expect(Manager.getEnvironment()).toBe(name);
+          }
+        });
       },
     },
     {
-      name: 'getEnvironment is production when OMEGA_BUILD_MODE=true (and not testing)',
+      // The bug this replaced: with no signal desktop's own copy answered
+      // 'production', so a plain `npm start` bundled itself as a production
+      // artifact, while @omega.js/extension's copy of the same function
+      // answered 'development' from the same inputs (#817).
+      name: 'the build lane resolves production, a dev boot resolves development',
       run: (ctx) => {
-        const prevTest = process.env.OMEGA_TEST_MODE;
-        const prevBuild = process.env.OMEGA_BUILD_MODE;
-        delete process.env.OMEGA_TEST_MODE;
-        process.env.OMEGA_BUILD_MODE = 'true';
-        try {
-          ctx.expect(Manager.getEnvironment()).toBe('production');
-        } finally {
-          if (prevTest !== undefined) process.env.OMEGA_TEST_MODE = prevTest;
-          if (prevBuild === undefined) delete process.env.OMEGA_BUILD_MODE; else process.env.OMEGA_BUILD_MODE = prevBuild;
-        }
+        const buildLane = laneEnvironment({ OMEGA_BUILD_MODE: 'true' });
+        ctx.expect(buildLane).toBe('production');
+
+        const devBoot = laneEnvironment({});
+        ctx.expect(devBoot).toBe('development');
+
+        // A lane that already named one keeps it, EXCEPT a build lane: a
+        // production build spawned from a test run still bakes production.
+        ctx.expect(laneEnvironment({ OMEGA_ENVIRONMENT: 'testing' })).toBe('testing');
+        ctx.expect(laneEnvironment({ OMEGA_ENVIRONMENT: 'testing', OMEGA_BUILD_MODE: 'true' })).toBe('production');
       },
     },
     {
-      // @omega.js/desktop defaults to 'production' when no signal is present (no app.isPackaged in plain Node,
-      // no OMEGA_TEST_MODE/OMEGA_BUILD_MODE, no NODE_ENV=development). @omega.js/desktop's deployed RUNTIME can
-      // legitimately reach here without a dev signal (a shipped binary), so production is the
-      // safe default. NODE_ENV=development is the explicit dev override (tested separately).
-      name: 'getEnvironment defaults to production when no dev/test signal is present',
+      name: 'no input at all is a loud error naming OMEGA_ENVIRONMENT, never a default',
       run: (ctx) => {
-        const prevTest = process.env.OMEGA_TEST_MODE;
-        const prevBuild = process.env.OMEGA_BUILD_MODE;
-        const prevNode = process.env.NODE_ENV;
-        delete process.env.OMEGA_TEST_MODE;
-        delete process.env.OMEGA_BUILD_MODE;
-        delete process.env.NODE_ENV;
-        try {
-          ctx.expect(Manager.getEnvironment()).toBe('production');
-          // NODE_ENV=development is the explicit local-dev override.
-          process.env.NODE_ENV = 'development';
-          ctx.expect(Manager.getEnvironment()).toBe('development');
-        } finally {
-          if (prevTest !== undefined) process.env.OMEGA_TEST_MODE = prevTest;
-          if (prevBuild !== undefined) process.env.OMEGA_BUILD_MODE = prevBuild;
-          if (prevNode === undefined) delete process.env.NODE_ENV; else process.env.NODE_ENV = prevNode;
-        }
+        withEnvironment(null, () => {
+          delete process.env.OMEGA_ENVIRONMENT;
+          ctx.expect(() => Manager.getEnvironment()).toThrow(/OMEGA_ENVIRONMENT/);
+          process.env.OMEGA_ENVIRONMENT = 'staging';
+          ctx.expect(() => Manager.getEnvironment()).toThrow(/OMEGA_ENVIRONMENT/);
+        });
       },
     },
     {
-      // The core invariant of the SSOT refactor: is*() DERIVE from getEnvironment(), so they
-      // can NEVER disagree with it, and exactly one is always true. (In plain Node `app` is
-      // unavailable, so getEnvironment() resolves via the env-var / config fallback.)
+      // The core invariant: is*() DERIVE from getEnvironment(), so they can
+      // NEVER disagree with it, and exactly one is always true.
       name: 'invariant: is*() exactly matches getEnvironment() + mutually exclusive (every scenario)',
       run: (ctx) => {
-        const prevTest = process.env.OMEGA_TEST_MODE;
-        const prevBuild = process.env.OMEGA_BUILD_MODE;
-        const prevNode = process.env.NODE_ENV;
-        const scenarios = [
-          { env: { OMEGA_TEST_MODE: 'true', OMEGA_BUILD_MODE: 'true' }, expect: 'testing' },
-          { env: { OMEGA_BUILD_MODE: 'true' },                       expect: 'production' },
-          { env: { NODE_ENV: 'development' },                     expect: 'development' },
-          { env: {},                                              expect: 'production' }, // @omega.js/desktop defaults prod (shipped artifact)
-        ];
-        try {
-          for (const s of scenarios) {
-            delete process.env.OMEGA_TEST_MODE; delete process.env.OMEGA_BUILD_MODE; delete process.env.NODE_ENV;
-            for (const k of Object.keys(s.env)) process.env[k] = s.env[k];
+        withEnvironment(null, () => {
+          for (const name of ['development', 'testing', 'production']) {
+            process.env.OMEGA_ENVIRONMENT = name;
             const e = Manager.getEnvironment();
-            ctx.expect(e).toBe(s.expect);
+            ctx.expect(e).toBe(name);
             ctx.expect(Manager.isDevelopment()).toBe(e === 'development');
             ctx.expect(Manager.isTesting()).toBe(e === 'testing');
             ctx.expect(Manager.isProduction()).toBe(e === 'production');
             const trueCount = [Manager.isDevelopment(), Manager.isTesting(), Manager.isProduction()].filter(Boolean).length;
             ctx.expect(trueCount).toBe(1);
           }
-        } finally {
-          if (prevTest === undefined) delete process.env.OMEGA_TEST_MODE; else process.env.OMEGA_TEST_MODE = prevTest;
-          if (prevBuild === undefined) delete process.env.OMEGA_BUILD_MODE; else process.env.OMEGA_BUILD_MODE = prevBuild;
-          if (prevNode === undefined) delete process.env.NODE_ENV; else process.env.NODE_ENV = prevNode;
-        }
+        });
       },
     },
     {
@@ -162,13 +182,13 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'getWindowsSignStrategy reads config platforms.win.signing.strategy',
+      name: 'getWindowsSignStrategy reads config platforms.windows.signing.strategy',
       run: (ctx) => {
         const fs = require('fs'); const os = require('os'); const path = require('path');
         const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-strategy-'));
         fs.mkdirSync(path.join(tmp, 'config'), { recursive: true });
         fs.writeFileSync(path.join(tmp, 'config', 'omega.json5'),
-          `{ targets: { desktop: { platforms: { win: { signing: { strategy: 'cloud' } } } } } }`);
+          `{ targets: { desktop: { type: 'desktop', platforms: { windows: { signing: { strategy: 'cloud' } } } } } }`);
         const orig = process.cwd();
         try {
           process.chdir(tmp);

package/dist/test/suites/build/manifest-deps.test.js

@@ -0,0 +1,116 @@
+// Build-layer test: a library the runtime source requires by BARE specifier is
+// DECLARED by this package ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)).
+//
+// The class of bug: on a laptop the monorepo root hoists every workspace's deps
+// into one node_modules, so `require('sharp')` resolves from packages/desktop even
+// though the desktop manifest never named it. The packed tarball a runner installs
+// carries only what the manifest declares, and the first mac CI publish died on
+// `Cannot find module 'sharp'` inside resolve-icons.js. Nothing about that failure
+// was visible locally, so the manifest is checked HERE instead.
+//
+// Scope: src/lib and src/gulp, the two trees that run unbundled from the installed
+// package (main-process libs and the gulp build lane). Internal `@omega.js/*`
+// packages are excluded: the prepare lane vendors them into dist/vendor and rewires
+// the requires, so they are never resolved by name from an install.
+
+const path = require('path');
+const fs = require('fs');
+const { builtinModules } = require('module');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..', '..', '..');
+const SOURCE_DIRS = ['lib', 'gulp'];
+
+// The two specifiers that are ALLOWED to be undeclared, each one required inside a
+// try/catch whose catch is the documented behaviour, not a crash:
+//   firebase        @omega.js/client's own dependency; the client bridge falls back
+//                   to no-op mode when it is not there (lib/client-bridge.js)
+//   app-builder-bin electron-builder's own dependency; blockmap generation is
+//                   best-effort and warns-and-skips (lib/sign-helpers/update-info.js)
+const GUARDED = new Set(['firebase', 'app-builder-bin']);
+
+// Every bare specifier `require`d under a dir, as package names.
+function requiredPackages(dir) {
+  const names = new Map();
+
+  const walk = (current) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const file = path.join(current, entry.name);
+
+      if (entry.isDirectory()) {
+        walk(file);
+        continue;
+      }
+      if (!entry.name.endsWith('.js')) {
+        continue;
+      }
+
+      const source = fs.readFileSync(file, 'utf8');
+      for (const match of source.matchAll(/require\(\s*['"]([^'"]+)['"]\s*\)/g)) {
+        const specifier = match[1];
+        if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.startsWith('node:')) {
+          continue;
+        }
+
+        const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
+        if (builtinModules.includes(name)) {
+          continue;
+        }
+
+        if (!names.has(name)) {
+          names.set(name, path.relative(PACKAGE_ROOT, file));
+        }
+      }
+    }
+  };
+
+  walk(dir);
+
+  return names;
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'manifest deps: what the runtime source requires, the package declares (#872)',
+  tests: [
+    {
+      name: 'every bare require under src/lib and src/gulp is declared by the manifest',
+      run: (ctx) => {
+        const pkg = require(path.join(PACKAGE_ROOT, 'package.json'));
+        // dependencies ship inside the tarball; peers and optionals are installed
+        // beside it (ensureTarget installs the peers on every verb).
+        const declared = new Set([
+          ...Object.keys(pkg.dependencies || {}),
+          ...Object.keys(pkg.peerDependencies || {}),
+          ...Object.keys(pkg.optionalDependencies || {}),
+        ]);
+
+        const undeclared = [];
+        for (const dir of SOURCE_DIRS) {
+          for (const [name, file] of requiredPackages(path.join(PACKAGE_ROOT, 'src', dir))) {
+            // The package requiring ITSELF is node's self-reference through the
+            // exports map, and the internal packages are vendored at prepare time.
+            if (name === pkg.name || name.startsWith('@omega.js/') || GUARDED.has(name)) {
+              continue;
+            }
+            if (!declared.has(name)) {
+              undeclared.push(`${name} (${file})`);
+            }
+          }
+        }
+
+        ctx.expect(undeclared).toEqual([]);
+      },
+    },
+    {
+      name: 'sharp, the icon pipeline it was missing, is a dependency and not a hoisted accident',
+      run: (ctx) => {
+        const pkg = require(path.join(PACKAGE_ROOT, 'package.json'));
+
+        ctx.expect(Boolean(pkg.dependencies.sharp)).toBe(true);
+        ctx.expect(fs.readFileSync(path.join(PACKAGE_ROOT, 'src', 'lib', 'sign-helpers', 'resolve-icons.js'), 'utf8')).toContain("require('sharp')");
+      },
+    },
+  ],
+});

package/dist/test/suites/build/merge-line-files.test.js

@@ -117,7 +117,11 @@ ${CUSTOM_MARKER}
       },
     },
     {
-      name: 'gitignore: migrates user-added Default line to Custom when not in new defaults (no quoting for gitignore)',
+      // The framework block is COMPLETELY managed ([#926](https://github.com/Omega-JS-Stack/omega/issues/926)):
+      // a retired framework line and a line a user typed into the framework block
+      // cannot be told apart, and the block header says it is overwritten on
+      // every setup, so a line the new block does not carry leaves the file.
+      name: 'gitignore: a Default line the new defaults no longer carry DROPS instead of migrating (#926)',
       run: (ctx) => {
         const existing = `${DEFAULT_MARKER}
 node_modules/
@@ -132,10 +136,29 @@ dist/
 ${CUSTOM_MARKER}
 `;
         const merged = mergeLineBasedFiles(existing, incoming, '.gitignore');
-        ctx.expect(merged).toContain('my-fork-only.txt');
+        ctx.expect(merged).not.toContain('my-fork-only.txt');
         ctx.expect(merged).toContain('dist/');
-        // gitignore is NOT quoted.
-        ctx.expect(merged).not.toContain('"my-fork-only.txt"');
+      },
+    },
+    {
+      // The value a retired key holds is the user's DATA, so it still migrates
+      // (the case above); an EMPTY retired key holds nothing and drops (#926).
+      name: 'env: an EMPTY retired key drops instead of migrating to Custom (#926)',
+      run: (ctx) => {
+        const existing = `${DEFAULT_MARKER}
+GH_TOKEN="mine"
+MY_EMPTY_KEY=
+
+${CUSTOM_MARKER}
+`;
+        const incoming = `${DEFAULT_MARKER}
+GH_TOKEN=""
+
+${CUSTOM_MARKER}
+`;
+        const merged = mergeLineBasedFiles(existing, incoming, '.env');
+        ctx.expect(merged).not.toContain('MY_EMPTY_KEY');
+        ctx.expect(merged).toContain('GH_TOKEN="mine"');
       },
     },
     {