@omega.js/desktop 0.50.0 → 0.51.0

package/dist/utils/ship-keys.js

@@ -0,0 +1,52 @@
+// The ship-credential check every publish runs FIRST
+// ([#867](https://github.com/Omega-JS-Stack/omega/issues/867)).
+//
+// A format this brand DECLARES is one it means to ship, so a credential that
+// format cannot publish without is a release that dies on a runner: the snap
+// leg with no Snap Store login, the Windows leg with no credential for the
+// signing strategy it configured. Both used to surface minutes into a build,
+// or (worse) as a silently skipped target.
+//
+// What is owed comes from @omega.js/config's format table, narrowed to this
+// brand by the env schema's own `requiredWhen` gates, so a brand that never
+// mentions the snap owes nothing and a brand that writes
+// `platforms.linux.formats.snap` owes the login. The refusal carries the same
+// line shape push-secrets prints
+// ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)) and names the
+// ONE walk that collects it, exactly as the extension publish does.
+//
+// A BUILD is not a publish: it keeps its clean skip (gulp/build-config drops
+// the snap target when the login is absent), because nothing is being put in
+// front of users.
+
+const { shipPlan, missingShipKeys, shipKeyRefusal } = require('../vendor/devkit/ship-plan.js');
+
+const Manager = new (require('../build.js'));
+const logger = Manager.logger('ship-keys');
+
+/**
+ * Refuse a publish whose declared formats have no credential to ship with.
+ *
+ * @param {object} [options]
+ * @param {object} [options.config] - Resolved config (default: the consumer's).
+ * @param {object} [options.env] - Env map (default: process.env).
+ * @returns {Array<object>} The ship plan (what this brand ships).
+ * @throws {Error} Naming every missing key, its declaration, and the walk.
+ */
+function assertShipKeys(options) {
+  options = options || {};
+
+  const config = options.config || Manager.getConfig();
+  const plan = shipPlan(config, 'desktop');
+  const missing = missingShipKeys(plan, options.env || process.env);
+
+  if (missing.length > 0) {
+    throw new Error(shipKeyRefusal(missing));
+  }
+
+  logger.log(`Shipping ${plan.map((entry) => `${entry.platform}/${entry.format}`).join(', ')}`);
+
+  return plan;
+}
+
+module.exports = { assertShipKeys };

package/dist/utils/test-stealth.js

@@ -11,9 +11,11 @@
 //     which initializes its Manager only after app ready (too late to prevent
 //     the launch activation)
 //
-// Pass the Manager when you have one — its isTesting() is authoritative (honors
-// config.em.environment overrides). Without one (the harness, pre-Manager code),
-// falls back to the standalone mode-helpers check (OMEGA_TEST_MODE=true).
+// Pass the Manager when you have one: its isTesting() reads the environment the
+// Manager's own config was baked with. Without one (the harness, pre-Manager
+// code) the standalone check reads the process's OMEGA_ENVIRONMENT, the one
+// input every lane sets ([#817](https://github.com/Omega-JS-Stack/omega/issues/817));
+// the test runners spawn their children naming `testing`.
 //
 // Usage:
 //   const isTestStealth = require('./utils/test-stealth.js');

package/dist/utils/url-helpers.js

@@ -11,6 +11,10 @@
 // callers normally pass NO argument. An explicit `environment` arg is an override
 // (used mainly by tests to pin a specific environment's mapping).
 
+// The missing-fact error is the ONE shared one (#834). Its module requires
+// nothing, so it rides the renderer bundle exactly as this file does.
+const { devFactMissing } = require('../vendor/config/dev-facts.js');
+
 // Guarded the way @omega.js/extension's twin is: the renderer bundle is a
 // browser context, and only the Node-side contexts (main, preload, build, the
 // test harness) carry the resolved-port env channel.
@@ -20,14 +24,9 @@ function envPort(name) {
     : undefined;
 }
 
-// The classic dev WEBSITE ORIGIN: a lockstep copy of @omega.js/config's
-// CLASSIC_DEV_ORIGIN, which is the SSOT. This module is attached in the RENDERER
-// too (src/renderer.js), so it rides the browser bundle and cannot require that
-// Node-only package (fs, net, json5); @omega.js/client mirrors the same constant
-// for the same reason. The build suite pins this copy to the config package's
-// value, so a drift fails a test instead of a user
-// ([#747](https://github.com/Omega-JS-Stack/omega/issues/747)).
-const CLASSIC_DEV_ORIGIN = 'https://localhost:4000';
+// The step that writes the resolved dev map into this surface's artifact, named
+// in every missing-fact error below (#834).
+const DEV_FACT_WRITER = "@omega.js/desktop's bundle task, from the live stack's ports file plus the OMEGA_*_PORT env channel";
 
 // One local port, from whichever channel this context has: the env var first
 // (the CLI that booted the stack publishes it, N7), then the `dev.ports` map
@@ -35,10 +34,26 @@ const CLASSIC_DEV_ORIGIN = 'https://localhost:4000';
 // parent env, so a bumped emulator port reaches it only that way
 // ([#745](https://github.com/Omega-JS-Stack/omega/issues/745)). Same helper,
 // same order as @omega.js/extension's src/utils/url-helpers.js.
+//
+// There is no third step any more (#834): the classic numbers used to be
+// hand-typed here as a last resort for "a build made with no stack up", which
+// is a guess about a port nothing identity-checks. A miss is loud instead.
 function localPort(context, envName, name) {
   return envPort(envName) || context?.config?.dev?.ports?.[name];
 }
 
+// The same read, REQUIRED: the one every URL getter below uses, because every
+// one of them is answering with a real local address or not at all.
+function requiredPort(context, envName, name) {
+  const port = localPort(context, envName, name);
+
+  if (!port) {
+    throw devFactMissing(`dev port for \`${name}\``, DEV_FACT_WRITER);
+  }
+
+  return port;
+}
+
 function getFunctionsUrl(environment) {
   const env = environment || this.getEnvironment();
   const projectId = this?.config?.cloud?.config?.projectId;
@@ -51,7 +66,7 @@ function getFunctionsUrl(environment) {
   // same three-step chain getApiUrl() walks: the OMEGA_*_PORT env channel (N7),
   // then the baked map, then the classic default.
   if (env === 'development' || env === 'testing') {
-    const port = localPort(this, 'OMEGA_FUNCTIONS_PORT', 'functions') || 5001;
+    const port = requiredPort(this, 'OMEGA_FUNCTIONS_PORT', 'functions');
     return `http://localhost:${port}/${projectId}/us-central1`;
   }
 
@@ -64,12 +79,13 @@ function getApiUrl(environment) {
   // Local for development OR testing; production otherwise. Mirrors
   // @omega.js/backend's getApiUrl (N7): a resolved OMEGA_HTTPS_PORT means
   // `mgr serve`'s mkcert proxy is up (https); otherwise plain http to the
-  // hosting emulator (env port, baked port, or classic 5002).
+  // hosting emulator (env port, then baked port). Neither resolved is a broken
+  // build, not a case to assume the classic 5002 through (#834).
   if (env === 'development' || env === 'testing') {
     const httpsPort = localPort(this, 'OMEGA_HTTPS_PORT', 'https');
     return httpsPort
       ? `https://localhost:${httpsPort}`
-      : `http://localhost:${localPort(this, 'OMEGA_HOSTING_PORT', 'hosting') || 5002}`;
+      : `http://localhost:${requiredPort(this, 'OMEGA_HOSTING_PORT', 'hosting')}`;
   }
 
   // Prod: api.<brand host>. Mirrors @omega.js/client.getApiUrl. Never derive
@@ -89,9 +105,10 @@ function getApiUrl(environment) {
 // ([#262](https://github.com/Omega-JS-Stack/omega/issues/262)): the baked
 // `dev.origin` the live website published (scheme, host AND port, the complete
 // fact) wins, else a port from the usual chain (OMEGA_WEBSITE_PORT, then the baked
-// `dev.ports.website`) composed over https, else the classic dev origin. The scheme
-// is https because `omega dev` fronts its public port with the mkcert proxy by
-// default, so a port alone can never say it
+// `dev.ports.website`) composed over https. There is no classic-origin fallback
+// any more (#834): a wrong dev origin fails as a silent connection refusal. The
+// scheme is https because `omega dev` fronts its public port with the mkcert
+// proxy by default, so a port alone can never say it
 // ([#747](https://github.com/Omega-JS-Stack/omega/issues/747)).
 // Prod → `config.brand.url`. Use this whenever app code wants to link out to "the
 // website" (Help → Website tray/menu items, "Open in browser," billing portal
@@ -106,8 +123,7 @@ function getWebsiteUrl(environment) {
       return origin;
     }
 
-    const port = localPort(this, 'OMEGA_WEBSITE_PORT', 'website');
-    return port ? `https://localhost:${port}` : CLASSIC_DEV_ORIGIN;
+    return `https://localhost:${requiredPort(this, 'OMEGA_WEBSITE_PORT', 'website')}`;
   }
 
   const url = this?.config?.brand?.url;
@@ -160,8 +176,8 @@ function attachTo(Manager) {
 
 module.exports = {
   attachTo,
-  CLASSIC_DEV_ORIGIN,
   localPort,
+  requiredPort,
   getFunctionsUrl,
   getApiUrl,
   getWebsiteUrl,

package/dist/vendor/config/bundle-id.js

@@ -0,0 +1,53 @@
+/**
+ * Bundle-identifier policy — reverse-DNS ids derived from the brand's web
+ * identity (Ian 2026-07-14: the prefix is the reverse domain, autoset at
+ * onboarding from the parent company when one exists, else the brand's own
+ * url).
+ *
+ *   deriveBundleIdPrefix('https://itwcreativeworks.com')   → 'com.itwcreativeworks'
+ *   deriveBundleIdPrefix('https://playground.omegajs.dev') → 'dev.omegajs.playground'
+ *   composeBundleId('com.itwcreativeworks', 'daily-build')
+ *     → 'com.itwcreativeworks.daily.build'
+ *
+ * Sanitization keeps ids legal on BOTH stores: Apple allows hyphens but
+ * Android package segments don't, so domain labels drop non-alphanumerics
+ * and brand-id hyphens become dots (each id word is its own segment).
+ */
+
+/**
+ * Reverse-DNS prefix from a company/brand url, or null when the url does
+ * not parse. `www.` is dropped; every other hostname label survives (a
+ * subdomain brand derives a subdomain-scoped prefix).
+ *
+ * @param {string} url - http(s) url (brand.url shape)
+ * @returns {string|null}
+ */
+function deriveBundleIdPrefix(url) {
+  let hostname;
+  try {
+    hostname = new URL(url).hostname;
+  } catch {
+    return null;
+  }
+
+  const labels = hostname
+    .replace(/^www\./, '')
+    .split('.')
+    .map((label) => label.toLowerCase().replace(/[^a-z0-9]/g, ''))
+    .filter(Boolean);
+
+  return labels.length > 0 ? labels.reverse().join('.') : null;
+}
+
+/**
+ * Full bundle identifier: prefix + the brand id with hyphens as dots.
+ *
+ * @param {string} prefix - reverse-DNS prefix (config or derived)
+ * @param {string} brandId - brand.id ('daily-build')
+ * @returns {string}
+ */
+function composeBundleId(prefix, brandId) {
+  return `${prefix}.${String(brandId).toLowerCase().replace(/-+/g, '.')}`;
+}
+
+module.exports = { deriveBundleIdPrefix, composeBundleId };

package/dist/vendor/config/client-config.js

@@ -0,0 +1,141 @@
+/**
+ * client-config.js: the ONE browser-safe subset of a resolved config
+ * ([#894](https://github.com/Omega-JS-Stack/omega/issues/894)).
+ *
+ * Three surfaces bake a config into an artifact a browser can read: web's page
+ * chrome, desktop's renderer bundle, and every extension bundle. Each one used
+ * to decide what may go public on its own, three different ways (desktop
+ * shipped the WHOLE resolved config, the extension kept a hand-written allow
+ * list, web wired a subset together in its engine and its foot include), so a
+ * new public value had to be added in three places and every one of them could
+ * be the place it leaked.
+ *
+ * This is that decision, once. The schema's `CLIENT_SECTIONS` says which
+ * sections a browser may see (and how much of each), the list below says which
+ * BUILD FACTS ride beside them, and nothing else leaves the build. All three
+ * bakes call this and wrap the answer identically:
+ *
+ *   OMEGA_BUILD_JSON = { config: clientConfig(resolved), package, mode, license, builtAt }
+ *
+ * Secrets are a loud failure, not a filter: a secret-shaped key inside a
+ * section that is about to ship means the resolved config carried one at all,
+ * which loadConfig() and validateConfig() already refuse. A value a build is
+ * SANCTIONED to bake (`publicAtRest`, docs/shared/config.md) comes from .env
+ * and is added by that build after this gate, never carried through it.
+ */
+
+const { CLIENT_SECTIONS } = require('./schema.js');
+const { findSecretKeys } = require('./secrets.js');
+const { resolveWinbackOffer } = require('./winback.js');
+
+// The per-build facts a surface composes ON TOP of the resolved config before
+// baking it. They are not config sections (nothing authors them in
+// omega.json5): each is a fact about the artifact, spelled the same on every
+// surface so one read answers everywhere.
+//
+//   runtime      'web' | 'browser-extension' | 'electron'
+//   environment  the build's verdict ('development' | 'testing' | 'production')
+//   version      the target's own package version, the release tag every error
+//                report carries as `<brand.id>@<version>` (#380)
+//   buildTime    the build stamp (ms)
+//   target       WHICH target this artifact IS, by name (#887)
+//   url          this target's own resolved public url (#588)
+//   dev          the local stack's resolved map: ports + the sibling website's
+//                origin, development builds only (#300/#262). The extension's
+//                live-reload port rides here too (#896), the one home of a
+//                local-stack number.
+const CLIENT_FACT_KEYS = ['runtime', 'environment', 'version', 'buildTime', 'target', 'url', 'dev'];
+
+/**
+ * Copy exactly `paths` out of a section (dot-paths, deep).
+ * @param {*} section - the resolved section value.
+ * @param {string[]} paths - dot-paths inside it.
+ * @returns {object|undefined} the picked sub-tree, or undefined when it is empty.
+ */
+function pickPaths(section, paths) {
+  if (!section || typeof section !== 'object') {
+    return undefined;
+  }
+
+  const picked = {};
+  let found = false;
+
+  for (const path of paths) {
+    const keys = path.split('.');
+    let source = section;
+    let missing = false;
+
+    for (const key of keys) {
+      if (!source || typeof source !== 'object' || !(key in source)) {
+        missing = true;
+        break;
+      }
+      source = source[key];
+    }
+    if (missing) continue;
+
+    let cursor = picked;
+    for (const key of keys.slice(0, -1)) {
+      cursor[key] = cursor[key] || {};
+      cursor = cursor[key];
+    }
+    cursor[keys[keys.length - 1]] = source;
+    found = true;
+  }
+
+  return found ? picked : undefined;
+}
+
+/**
+ * The subset of a resolved config a browser may see.
+ * @param {object} [resolved] - a resolved config (Manager.getConfig() output),
+ *   with this build's facts composed onto it.
+ * @returns {object} the blob every browser surface bakes as OMEGA_BUILD_JSON.config.
+ * @throws {Error} when a section that is about to ship carries a secret-shaped key.
+ */
+function clientConfig(resolved) {
+  const source = resolved || {};
+  const client = {};
+
+  for (const key of CLIENT_FACT_KEYS) {
+    if (key in source) client[key] = source[key];
+  }
+
+  for (const [section, rule] of Object.entries(CLIENT_SECTIONS)) {
+    if (!(section in source)) continue;
+
+    const value = rule === true ? source[section] : pickPaths(source[section], rule);
+    if (value === undefined) continue;
+
+    client[section] = value;
+  }
+
+  // A secret in here is not a value to drop: it is a config that should never
+  // have loaded, so it fails the build at the one place that would have
+  // published it.
+  const secrets = findSecretKeys(client);
+  if (secrets.length) {
+    throw new Error(
+      `[@omega.js/config] refusing to bake a browser config carrying secret-shaped keys: ${secrets.join(', ')}. `
+      + 'Secrets live in .env, never in config/omega.json5 (docs/shared/config.md).',
+    );
+  }
+
+  // The one home of the cancel-flow save offer's default (#268) is
+  // @omega.js/config, so the browser is handed the RESOLVED offer: the dialog a
+  // customer reads and the coupon the backend creates can never name different
+  // numbers.
+  if (client.payment) {
+    client.payment = { ...client.payment, winback: resolveWinbackOffer(client.payment) };
+  }
+
+  // Never an alias of the resolved config: what a bake stamps into an artifact
+  // cannot be something a later build step can still mutate. A JSON round trip
+  // and not structuredClone, because JSON is what a bake CAN carry: a page's
+  // resolved config arrives through a template data cascade that hangs
+  // functions and accessors off it, and those drop out here rather than
+  // crashing the build.
+  return JSON.parse(JSON.stringify(client));
+}
+
+module.exports = { clientConfig, CLIENT_FACT_KEYS };