@omega.js/desktop 0.50.0 → 0.51.0

package/dist/vendor/config/site-global.js

@@ -33,17 +33,19 @@
  * declaring a desktop target derives nothing, since the release may not
  * exist yet. WHICH repo those links address is not decided here: it is
  * [repo.js](repo.js)'s `releasesRepo`, the one home of the brand's public
- * releases repo (#799).
+ * releases repo (#799/#883): `<brand.id>-releases` under the brand's one
+ * `repo.org`, with no override key anywhere.
  *
  * Beside the hub sits `downloads` ([#620](https://github.com/Omega-JS-Stack/omega/issues/620)):
- * one DIRECT-download URL per artifact, so a download button hands over a file
- * instead of a GitHub page. The filenames are
- * [desktop-artifacts.js](desktop-artifacts.js)'s — the same rule
- * @omega.js/desktop packages under — and they carry no version, so releasing a
- * desktop build never touches the website.
+ * one DIRECT-download URL per FORMAT, so a download button hands over a file
+ * instead of a GitHub page. Both the format keys and the filenames are
+ * [platforms.js](platforms.js)'s, the same table @omega.js/desktop packages
+ * under, and they carry no version, so releasing a desktop build never touches
+ * the website. A `store` format (the snap) has no file: its URL is the store
+ * page itself ([#867](https://github.com/Omega-JS-Stack/omega/issues/867)).
  */
 
-const { desktopProductName, desktopArtifactNames } = require('./desktop-artifacts.js');
+const { enabledFormats, desktopProductName, desktopArtifactNames, sanitizeProductName } = require('./platforms.js');
 const { releasesRepo } = require('./repo.js');
 
 // Keys that are resolution machinery, not site content
@@ -56,11 +58,10 @@ const MACHINERY_KEYS = ['targets', 'enabled'];
  * `releases.enabled: false` always suppresses. On the pipeline's second
  * toSiteGlobal pass the raw block is gone, so a curated `releasesUrl` is
  * itself the opt-in (idempotence).
- * @param {object} config - resolved config object
+ * @param {object} desktop - the desktop target's entry
  * @returns {boolean}
  */
-function desktopReleasesEnabled(config) {
-  const desktop = targetEntry(config, 'desktop');
+function desktopReleasesEnabled(desktop) {
   if (!desktop) return false;
   if (desktop.releases) return desktop.releases.enabled !== false;
 
@@ -72,92 +73,101 @@ function desktopReleasesEnabled(config) {
  * public releases repo, whose address `@omega.js/config`'s `releasesRepo` owns
  * (#799). Nothing is derived here; a repo the derivation cannot address (no
  * owner, no brand.id) yields no URL.
+ * @param {object} desktop - the desktop target's entry
  * @param {object} config - resolved config object
  * @returns {string|undefined}
  */
-function desktopReleasesUrl(config) {
-  const desktop = targetEntry(config, 'desktop');
-
+function desktopReleasesUrl(desktop, config) {
   // Idempotence: the build pipeline applies toSiteGlobal more than once
   // (consumer.js loadSiteData, then engine.js configureOmega). On a second pass
   // the raw releases block is gone, so the curated view's own URL is the
-  // authority: re-deriving would rename a brand's explicit releases.repo to the
-  // `<brand.id>-releases` default behind its back.
+  // authority: re-deriving off a config that no longer carries the block would
+  // drop the links a brand already has.
   if (!desktop?.releases && desktop?.releasesUrl) return desktop.releasesUrl;
 
-  const { repo } = releasesRepo(config);
+  const releases = releasesRepo(config);
 
-  return repo ? `https://github.com/${repo}/releases/latest` : undefined;
+  return releases ? `https://github.com/${releases.slug}/releases/latest` : undefined;
 }
 
 /**
- * The direct-download URL of every desktop artifact, keyed platform → artifact
- * (#620). GitHub's `/releases/latest/download/<asset>` serves the newest
- * release's asset by name, which only holds because the names are versionless.
+ * The download URL of every desktop FORMAT, keyed platform then format (#620,
+ * #867). An `asset` format links the file itself: GitHub's
+ * `/releases/latest/download/<asset>` serves the newest release's asset by
+ * name, which only holds because the names are versionless. A `store` format
+ * links the store page, because the store holds the file.
+ * @param {object} desktop - the desktop target's entry
  * @param {object} config - resolved config object
  * @param {string} releasesUrl - the derived releases hub URL
  * @returns {object|undefined}
  */
-function desktopDownloads(config, releasesUrl) {
-  const desktop = targetEntry(config, 'desktop');
-
+function desktopDownloads(desktop, config, releasesUrl) {
   // Idempotence, same trap as the URL above: the second toSiteGlobal pass sees
   // the curated view, which carries no app block and no brand-derived product
-  // name — the curated URLs are the authority by then.
+  // name, so the curated URLs are the authority by then.
   if (desktop?.downloads) return desktop.downloads;
 
-  // No product name (an invalid config — brand.name is required) derives
-  // nothing: a guessed filename is a download button that 404s.
-  const names = desktopArtifactNames(desktopProductName({ app: desktop?.app, brand: config?.brand }));
+  // No product name (an invalid config: brand.name is required) derives
+  // nothing, because a guessed filename is a download button that 404s.
+  const productName = desktopProductName({ app: desktop?.app, brand: config?.brand });
+  const names = desktopArtifactNames(productName);
   if (!Object.keys(names).length) return undefined;
 
+  // Only what this brand SHIPS gets a link: a dropped platform or format must
+  // not render a button that 404s (#867).
   const downloads = {};
-  for (const [platform, artifacts] of Object.entries(names)) {
-    downloads[platform] = {};
-    for (const [artifact, filename] of Object.entries(artifacts)) {
-      downloads[platform][artifact] = `${releasesUrl}/download/${filename}`;
-    }
+  for (const { platform, format } of enabledFormats(desktop, 'desktop')) {
+    // An asset links its file; the one store format (the snap) links the Snap
+    // Store listing, whose slug is the snap's own name, which electron-builder
+    // derives from the executable name: the sanitized product name, lowercased.
+    const filename = names[platform]?.[format];
+    const url = filename
+      ? `${releasesUrl}/download/${filename}`
+      : `https://snapcraft.io/${sanitizeProductName(productName).toLowerCase()}`;
+
+    downloads[platform] = downloads[platform] || {};
+    downloads[platform][format] = url;
   }
 
-  return downloads;
+  return Object.keys(downloads).length ? downloads : undefined;
 }
 
 /**
- * A target's config entry when it is the plain-object form. Array-form
- * (multi-instance) targets return undefined: which instance's facts belong
- * on the site is ambiguous, so instance-form brands supply explicit page
- * maps instead of getting a silently wrong derivation.
- * @param {object} config - resolved config object
- * @param {string} name - target key
- * @returns {object|undefined}
+ * Whether an entry is a target of this TYPE (#886): the declared `type`, or,
+ * on the second toSiteGlobal pass, the curated fact only that type derives.
+ * The NAME is never the test, so a brand that names its desktop target `app`
+ * still gets `site.targets.app.downloads`.
+ * @param {object} entry - a raw or curated targets entry
+ * @param {string} type - 'desktop' | 'extension'
+ * @param {string} curatedKey - the curated key that type alone produces
+ * @returns {boolean}
  */
-function targetEntry(config, name) {
-  const entry = config?.targets?.[name];
-  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return undefined;
-  return entry;
+function isTargetOfType(entry, type, curatedKey) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return false;
+  return entry.type === type || entry[curatedKey] !== undefined;
 }
 
 /**
  * Curate one target's display-safe view. Presence = enabled; per-type
  * extras are allow-listed here, never spread from the raw entry.
- * @param {string} name - target key (web, backend, desktop, extension, …)
+ * @param {object} entry - the target's own config entry
  * @param {object} config - resolved config object
  * @returns {object}
  */
-function curateTarget(name, config) {
+function curateTarget(entry, config) {
   const view = { enabled: true };
 
-  if (name === 'desktop' && desktopReleasesEnabled(config)) {
-    const releasesUrl = desktopReleasesUrl(config);
+  if (isTargetOfType(entry, 'desktop', 'releasesUrl') && desktopReleasesEnabled(entry)) {
+    const releasesUrl = desktopReleasesUrl(entry, config);
     if (releasesUrl) {
       view.releasesUrl = releasesUrl;
-      const downloads = desktopDownloads(config, releasesUrl);
+      const downloads = desktopDownloads(entry, config, releasesUrl);
       if (downloads) view.downloads = downloads;
     }
   }
 
-  if (name === 'extension') {
-    const listings = targetEntry(config, 'extension')?.listings;
+  if (isTargetOfType(entry, 'extension', 'listings')) {
+    const { listings } = entry;
     if (listings) {
       const curated = {};
       for (const [store, entry] of Object.entries(listings)) {
@@ -194,8 +204,8 @@ function toSiteGlobal(config) {
   const targets = config?.targets;
   if (targets && typeof targets === 'object') {
     site.targets = {};
-    for (const name of Object.keys(targets)) {
-      site.targets[name] = curateTarget(name, config);
+    for (const [name, entry] of Object.entries(targets)) {
+      site.targets[name] = curateTarget(entry, config);
     }
   }
 

package/dist/vendor/config/targets.js

@@ -0,0 +1,187 @@
+/**
+ * The `targets` map: every key is a target NAME, every entry declares its
+ * `type` ([#886](https://github.com/Omega-JS-Stack/omega/issues/886)).
+ *
+ * The name is the whole addressing story: it is the folder
+ * (`targets/<name>`), the `--target=<name>` word, and the derived-repo
+ * suffix. The type says WHICH framework runs there, so a brand runs two web
+ * targets by declaring two names:
+ *
+ *   targets: {
+ *     web:       { type: 'web', url: 'https://somiibo.com' },
+ *     community: { type: 'web', url: 'https://community.somiibo.com' },
+ *     backend:   { type: 'backend' },
+ *     docs:      { type: 'custom' },
+ *   }
+ *
+ * There is no id, no folder key, and no name table: the key IS the answer, so
+ * the dir walk and the path derivation are each one line. This module is the
+ * ONE home of that derivation, imported by every framework and the manager,
+ * never copied.
+ */
+
+const path = require('node:path');
+
+const { TARGETS, CUSTOM_TARGET_TYPE } = require('./schema.js');
+
+// A target name is a folder name, so it must be a dir-safe slug
+const TARGET_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+
+// Every legal `type`: the framework targets plus the custom one whose verbs
+// come from its own package.json scripts (#603)
+const TARGET_TYPES = [...TARGETS, CUSTOM_TARGET_TYPE];
+
+/**
+ * Every declared target as `{ name, type, ...entry }`, in config order.
+ * @param {object} config - A raw or resolved config carrying `targets`.
+ * @returns {Array<object>} The entries; [] when the config declares none.
+ * @throws {Error} When an entry carries no `type`, or a type no framework owns.
+ */
+function targetEntries(config) {
+  const targets = config && config.targets;
+  if (!targets || typeof targets !== 'object') return [];
+
+  return Object.keys(targets).map((name) => {
+    const entry = targets[name] || {};
+
+    if (!TARGET_TYPES.includes(entry.type)) {
+      throw new Error(`targets.${name} must declare a type: one of [${TARGET_TYPES.join(', ')}] (got ${entry.type === undefined ? 'nothing' : JSON.stringify(entry.type)})`);
+    }
+
+    return { ...entry, name, type: entry.type };
+  });
+}
+
+/**
+ * The declared targets of one type, in config order.
+ * @param {object} config - A raw or resolved config carrying `targets`.
+ * @param {string} type - A value from TARGET_TYPES.
+ * @returns {Array<object>} The matching entries.
+ */
+function targetsOfType(config, type) {
+  return targetEntries(config).filter((entry) => entry.type === type);
+}
+
+/**
+ * Does this config declare a target of that TYPE? The ONE presence gate, for
+ * every "only when this brand runs a backend/desktop/mobile" check: a key
+ * lookup answers the wrong question now that a backend may be named `api`
+ * (#886). Raw, unvalidated configs answer too, so a missing or unknown `type`
+ * is simply "no", never a throw.
+ * @param {object} config - A raw or resolved config carrying `targets`.
+ * @param {string} type - A value from TARGET_TYPES.
+ * @returns {boolean} True when at least one entry declares that type.
+ */
+function hasTargetOfType(config, type) {
+  const targets = config && config.targets;
+  if (!targets || typeof targets !== 'object') return false;
+
+  return Object.values(targets).some((entry) => entry && entry.type === type);
+}
+
+/**
+ * A target's folder, relative to the brand root: the name IS the folder.
+ * @param {object} config - A raw or resolved config carrying `targets`.
+ * @param {string} name - The target name.
+ * @returns {string} `targets/<name>` (posix separators).
+ * @throws {Error} When the config declares no target of that name.
+ */
+function targetPath(config, name) {
+  const declared = config && config.targets ? Object.keys(config.targets) : [];
+
+  if (!declared.includes(name)) {
+    throw new Error(`No target "${name}" is declared: this brand declares [${declared.join(', ')}]`);
+  }
+
+  return `targets/${name}`;
+}
+
+/**
+ * WHICH target a project dir is: the target root's basename when the dir (or
+ * one of its TARGET_SUBDIRS, functions/ and dist/) sits inside a brand
+ * monorepo. A standalone project's dir name is arbitrary, so it names nothing.
+ * @param {string} projectDir - Target root, or one of its TARGET_SUBDIRS.
+ * @returns {string|null} The target name, or null outside a brand.
+ */
+function targetNameFromDir(projectDir) {
+  // Local require to avoid a load-time cycle (load.js requires this module)
+  const { findBrandRoot, TARGET_SUBDIRS } = require('./load.js');
+
+  let targetRoot = path.resolve(projectDir);
+  if (TARGET_SUBDIRS.includes(path.basename(targetRoot))) {
+    targetRoot = path.dirname(targetRoot);
+  }
+
+  if (!findBrandRoot(targetRoot)) return null;
+  return path.basename(targetRoot);
+}
+
+/**
+ * The host `brand.url` names, EXACTLY as it states it: a `www.` label is kept
+ * (a www brand is a www brand), any path is dropped, a port survives. A
+ * scheme-less value is read as https.
+ * @param {string} url - A brand URL.
+ * @returns {string} The host, or '' when the value is not a URL.
+ */
+function brandHost(url) {
+  try {
+    return new URL(url.includes('://') ? url : `https://${url}`).host;
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * The live URL of a target: its entry's `url`, a target-scoped `brand.url`
+ * override, then the derivation. A target NAMED for its type is the brand
+ * itself (`brand.url`); any other name is that name AS A SUBDOMAIN of the
+ * brand host (#588), which is what makes `community: { type: 'web' }` a
+ * complete declaration. Nothing is half-derived: no usable brand.url means
+ * null, never `https://community.`.
+ * @param {object} config - The (resolved) config carrying brand.url and targets.
+ * @param {string} name - The target name.
+ * @returns {string|null} The target's URL, or null when none is known.
+ */
+function targetUrl(config, name) {
+  const entry = config && config.targets ? config.targets[name] : null;
+
+  if (entry && entry.url) return entry.url;
+  if (entry && entry.brand && entry.brand.url) return entry.brand.url;
+
+  const brandUrl = config && config.brand ? config.brand.url : null;
+  if (!brandUrl) return null;
+  if (entry && name === entry.type) return brandUrl;
+
+  const host = brandHost(brandUrl);
+  return host ? `https://${name}.${host}` : null;
+}
+
+/**
+ * A target's deterministic dev-port offset: its position among the targets of
+ * ITS type, so N same-type targets get N side-by-side ports off the same
+ * classic base. Unknown names offset 0, and the N7 bump-if-taken allocator
+ * still guarantees a free port.
+ * @param {object} config - A raw or resolved config carrying `targets`.
+ * @param {string} name - The target name.
+ * @returns {number} Zero-based offset.
+ */
+function targetPortOffset(config, name) {
+  const entry = config && config.targets ? config.targets[name] : null;
+  if (!entry || !entry.type) return 0;
+
+  const index = targetsOfType(config, entry.type).findIndex((sibling) => sibling.name === name);
+  return index > 0 ? index : 0;
+}
+
+module.exports = {
+  TARGET_NAME_PATTERN,
+  TARGET_TYPES,
+  targetEntries,
+  targetsOfType,
+  hasTargetOfType,
+  targetPath,
+  targetNameFromDir,
+  targetUrl,
+  targetPortOffset,
+  brandHost,
+};

package/dist/vendor/config/validate.js

@@ -3,19 +3,24 @@
  *
  * The rule walker (runSchema) is electron-manager's proven validate-config
  * engine ported verbatim: required/type/match/enum semantics, where match +
- * enum only run on PRESENT values and a conditional `required` function
+ * enum (and itemEnum, the same check per member of an array value) only run on
+ * PRESENT values and a conditional `required` function
  * receives the full config. See schema.js for the rule format.
  *
  * validateConfig() layers on top of the walker:
  *   - SHARED_SCHEMA always runs; TARGET_SCHEMAS[options.target] adds that
  *     target's refinements against the same resolved top-level namespace
- *   - `targets` sanity: unknown target names are errors (typo protection —
- *     targets.website is a mistake, the canonical name is web) and each
- *     present entry must be an object ({} = enabled with defaults) OR an
- *     array of id'd instance entries (multi-instance targets: ids required,
- *     dir-safe, unique per type; >1 backend instance is a WARNING)
+ *   - `targets` sanity (#886): every key is a target NAME, so it must be a
+ *     dir-safe slug, and every entry must be an object declaring a `type` the
+ *     framework list knows (an ARRAY is the retired multi-instance form, whose
+ *     replacement is a sibling key; >1 backend target is a WARNING)
+ *   - the `repo` block (#883): one `provider` from REPO_PROVIDERS, and an `org`
+ *     that is a real non-empty string whenever the block is there, because the
+ *     org is the owner of every repo the brand's names derive under
+ *   - `hosting` (#883) is a WEB target's key: a non-web target carrying it says
+ *     something nothing serves, and its provider comes from HOSTING_PROVIDERS
  *   - `cloud.config.authDomain`, when set, must be the brand's OWN host (the
- *     resolved instance url, else brand.url): a firebaseapp.com value or a
+ *     resolved target url, else brand.url): a firebaseapp.com value or a
  *     mismatch is an error, and demo-* (emulator-only) projects are exempt
  *   - retired keys are always errors (see retired-keys.js) — a name that was
  *     renamed outright reads as nothing at all, so it fails loudly instead of
@@ -27,11 +32,12 @@
  *     used to pass in silence
  */
 
-const { TARGETS, isCustomTargetEntry, SHARED_SCHEMA, TARGET_SCHEMAS } = require('./schema.js');
+const { TARGETS, SHARED_SCHEMA, TARGET_SCHEMAS } = require('./schema.js');
 const { findSecretKeys } = require('./secrets.js');
 const { findRetiredKeys } = require('./retired-keys.js');
 const { isPlainObject } = require('./merge.js');
-const { INSTANCE_ID_PATTERN } = require('./instances.js');
+const { TARGET_NAME_PATTERN, TARGET_TYPES } = require('./targets.js');
+const { REPO_PROVIDERS, HOSTING_PROVIDERS } = require('./repo.js');
 const { isDemoProject } = require('./demo.js');
 const { isCountedFeature } = require('../account/features.js');
 
@@ -142,6 +148,18 @@ function runSchema(config, schema) {
     if (rule.enum && !rule.enum.includes(value)) {
       errors.push(`config.${rule.path} "${value}" is not allowed — must be one of [${rule.enum.join(', ')}]`);
     }
+
+    // ─── Item enum check (arrays) ───────────────────────────────────────────
+    // A LIST of allowed values (the extension's AMO categories): every member
+    // is named on its own line, so one bad slug in a good list is the one the
+    // error points at.
+    if (rule.itemEnum && Array.isArray(value)) {
+      for (const item of value) {
+        if (!rule.itemEnum.includes(item)) {
+          errors.push(`config.${rule.path} "${item}" is not allowed: must be one of [${rule.itemEnum.join(', ')}]`);
+        }
+      }
+    }
   }
 
   return errors;
@@ -149,13 +167,13 @@ function runSchema(config, schema) {
 
 /**
  * The host this (resolved) config's BRAND lives on, which is a brand-level
- * fact and never an instance one (#588, Ian 2026-09-01): one Firebase project,
- * one backend, one persona domain, shared by every instance a brand runs. So
- * `brand.url` answers first and the top-level `url` (the instance's own public
- * url, derived from its id or declared on its entry) is only the fallback for
+ * fact and never a per-target one (#588, Ian 2026-09-01): one Firebase project,
+ * one backend, one persona domain, shared by every target a brand runs. So
+ * `brand.url` answers first and the top-level `url` (the target's own public
+ * url, derived from its name or declared on its entry) is only the fallback for
  * a config that carries no brand.url at all. Reading them the other way round
- * made a `targets/website-admin` load fail its own brand's authDomain check
- * and seeded personas at a different domain than the backend's.
+ * made a `targets/admin` load fail its own brand's authDomain check and seeded
+ * personas at a different domain than the backend's.
  * @param {object} config - The resolved config object.
  * @returns {string} The lowercase hostname, or '' when no URL is known.
  */
@@ -173,6 +191,60 @@ function resolvedBrandHost(config) {
   }
 }
 
+/**
+ * The repo block and the hosting key (#883).
+ *
+ * `repo` is `{ provider, org }` and nothing else: its PRESENCE enables the repo
+ * service, and every repo name derives from `<brand.id>-<role>`, so the org is
+ * the whole address. A block with no usable org is the failure this catches
+ * loudly, because every derivation would otherwise answer null and each reader
+ * would skip in its own quiet way.
+ *
+ * `hosting` says where a WEB target is served from. Only a web target has a
+ * built site to serve, so the key on any other type is a statement nothing
+ * reads. The targets map rides every resolved config, so this check answers the
+ * same on a raw config and on a target-resolved one.
+ *
+ * @param {object} config - The resolved config object.
+ * @returns {string[]} Errors; empty when the config passes.
+ */
+function validateRepo(config) {
+  const errors = [];
+  const repo = config ? config.repo : undefined;
+
+  if (isPlainObject(repo)) {
+    if (repo.provider !== undefined && !REPO_PROVIDERS.includes(repo.provider)) {
+      errors.push(`config.repo.provider ${JSON.stringify(repo.provider)} is not a host OMEGA builds for: one of [${REPO_PROVIDERS.join(', ')}]`);
+    }
+
+    if (typeof repo.org !== 'string' || !repo.org.trim()) {
+      errors.push(
+        'config.repo.org is required when the repo block is present: it is the org every repo the brand owns lives in '
+        + '(`<brand.id>-omega`, `<brand.id>-releases`, `<brand.id>-<web target>`), and no repo name is configurable anywhere',
+      );
+    }
+  }
+
+  const targets = config ? config.targets : undefined;
+  if (!isPlainObject(targets)) return errors;
+
+  Object.entries(targets).forEach(([name, entry]) => {
+    if (!isPlainObject(entry) || entry.hosting === undefined) return;
+
+    if (entry.type !== 'web') {
+      errors.push(`config.targets.${name}.hosting is a web-target key: a ${JSON.stringify(entry.type)} target has no built site to serve`);
+      return;
+    }
+
+    const provider = isPlainObject(entry.hosting) ? entry.hosting.provider : undefined;
+    if (provider !== undefined && !HOSTING_PROVIDERS.includes(provider)) {
+      errors.push(`config.targets.${name}.hosting.provider ${JSON.stringify(provider)} is not a host OMEGA builds for: one of [${HOSTING_PROVIDERS.join(', ')}]`);
+    }
+  });
+
+  return errors;
+}
+
 /**
  * authDomain must be the brand's OWN host (cp268). Firebase's default
  * `<project>.firebaseapp.com` is a third-party host: under browser storage
@@ -410,64 +482,52 @@ function validateConfig(config, options) {
   // ─── targets sanity ────────────────────────────────────────────────────
   const targets = config ? config.targets : undefined;
   if (isPlainObject(targets)) {
+    const backends = [];
+
     Object.keys(targets).forEach((key) => {
       const entry = targets[key];
-      const framework = TARGETS.includes(key);
-
-      // A key no framework owns is legal ONLY as a declared custom target
-      // (#603) — that declaration is what separates a deliberate Render API or
-      // worker from a typo'd framework name. The framework keys are the
-      // inverse: they may never claim the custom type, since their verbs come
-      // from their framework, not from package.json scripts.
-      if (!framework && !isCustomTargetEntry(entry)) {
-        errors.push(
-          `config.targets.${key} is not a known target — must be one of [${TARGETS.join(', ')}], `
-          + `or declare \`type: 'custom'\` (every instance of the array form) to run through its own package.json scripts`,
-        );
-        return;
-      }
-      if (framework && isCustomTargetEntry(entry)) {
-        errors.push(`config.targets.${key} is a framework target — it cannot declare \`type: 'custom'\``);
+
+      // The key is a NAME, and the name is the folder (targets/<name>), so it
+      // has to be a dir-safe slug (#886).
+      if (!TARGET_NAME_PATTERN.test(key)) {
+        errors.push(`config.targets.${key} is not a usable target name (lowercase, starts with a letter, alnum/-): the name IS the folder targets/${key}`);
         return;
       }
 
-      // Multi-instance array form: every entry MUST carry a unique dir-safe
-      // id (it names the targets/<canonical>-<id> dir). Backend stays single-
-      // instance in practice — >1 is a warning, not an error (spec v1).
       if (Array.isArray(entry)) {
-        if (entry.length === 0) {
-          errors.push(`config.targets.${key} instance array must not be empty — use {} for a single default instance`);
-          return;
-        }
-
-        const seen = new Set();
-        entry.forEach((instance, index) => {
-          if (!isPlainObject(instance)) {
-            errors.push(`config.targets.${key}[${index}] must be an instance object — got ${Array.isArray(instance) ? 'array' : typeof instance}`);
-            return;
-          }
-          if (typeof instance.id !== 'string' || !INSTANCE_ID_PATTERN.test(instance.id)) {
-            errors.push(`config.targets.${key}[${index}] must carry a dir-safe id (lowercase, starts with a letter, alnum/-) — it names targets/<dir>-<id>`);
-            return;
-          }
-          if (seen.has(instance.id)) {
-            errors.push(`config.targets.${key} instance id "${instance.id}" is not unique — ids must be unique per target type`);
-          }
-          seen.add(instance.id);
-        });
-
-        if (key === 'backend' && entry.length > 1) {
-          warnings.push(`config.targets.backend has ${entry.length} instances — multi-instance backend is unsupported for now (Cloud Functions = one project surface per brand)`);
-        }
+        errors.push(`config.targets.${key} is an array; a second instance is a sibling key, see docs/shared/breaking-changes.md 2026-09-11`);
         return;
       }
 
       if (!isPlainObject(entry)) {
-        errors.push(`config.targets.${key} must be an object ({} = enabled with defaults) or an array of id'd instances — got ${typeof entry}`);
+        errors.push(`config.targets.${key} must be an object declaring its type, got ${typeof entry}`);
+        return;
+      }
+
+      // The TYPE says which framework runs there, and nothing else does: a
+      // name no framework owns is a deliberate brand choice, never a typo to
+      // guess at, so the type is what every reader keys off.
+      if (!TARGET_TYPES.includes(entry.type)) {
+        errors.push(
+          `config.targets.${key} must declare \`type\`, one of [${TARGET_TYPES.join(', ')}]`
+          + `${entry.type === undefined ? '' : ` (got ${JSON.stringify(entry.type)})`}`,
+        );
+        return;
       }
+
+      if (entry.type === 'backend') backends.push(key);
     });
+
+    // Backend stays single-target in practice (one Cloud Functions surface per
+    // brand), so more than one is a warning, not an error.
+    if (backends.length > 1) {
+      warnings.push(`config.targets declares ${backends.length} backend targets (${backends.join(', ')}): multiple backends are unsupported for now (Cloud Functions = one project surface per brand)`);
+    }
   }
 
+  // ─── the repo block, and where a web target is hosted (#883) ───────────
+  validateRepo(config).forEach((error) => errors.push(error));
+
   // ─── authDomain is the brand's own host (cp268) ────────────────────────
   validateAuthDomain(config).forEach((error) => errors.push(error));