@omega.js/desktop 0.50.0 → 0.51.0

package/dist/vendor/devkit/certs.js

@@ -1,199 +1,21 @@
 /**
- * Signing-artifact delivery — the copy layer of the ONE delivery step (#678).
+ * The signing-tree READERS, in one place.
  *
- * Sources are the certificates service's outputs under a signing tree,
- * `<sourceRoot>/.omega/certificates/apple/` (the company workspace's root for
- * a company-managed brand, the brand root otherwise); destinations are the
- * target's own certs dir (desktop: config/certs/ per EM v1.4.1+, mobile:
- * build/certs/). Copies are byte-compared first, so a converged run rewrites
- * nothing, and every certs dir gets a self-protecting .gitignore (`*`) — signing
- * material can never be committed, even in a target the framework's setup
- * hasn't touched yet.
+ * There is no delivery here any more
+ * ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)): nothing COPIES
+ * signing material into a target. The tree is read IN PLACE (company tier
+ * first, `signing-tree.js`, #892), and the paths into it are derived once, at
+ * the desktop env load, by `signing-env.js`. The copy step and its rule table
+ * had two homes for one fact (which file a key points at) and produced the
+ * dispersed duplicates a build could silently sign with; the manager's disperse
+ * `certs` operation went with it.
  *
- * Delivery is WARN-ONLY on a miss: a rule with no source reports `missing` and
- * leaves the dest alone. The dests are documented HUMAN drop points (desktop's
- * signing docs tell an operator to copy their .p12/.p8 straight into
- * config/certs/), and `omega company init` scaffolds the signing tree EMPTY —
- * so a delete-on-missing pass would eat hand-placed signing material on the
- * next build.
- *
- * This module DELIVERS and reports; it logs nothing and classifies nothing.
- * Which misses are tolerable (`optional`) is on the rules, which callers read
- * through resolveCertRules — the manager's disperse writer turns them into its
- * per-rule lines, a desktop build into whatever its own voice is.
- */
-const { join, dirname } = require('node:path');
-const jetpack = require('fs-jetpack');
-
-// Paths: source relative to .omega/certificates/apple/, dest relative to the
-// target dir. `{env.VAR}` and `{brand.id}` placeholders supported on both sides.
-const CERT_FILE_MAP = {
-  desktop: [
-    // macOS code signing — Developer ID Application (.p12 with private key)
-    {
-      source: 'certificates/DEVELOPER_ID_APPLICATION_G2.p12',
-      dest: 'config/certs/developer-id-application.p12',
-    },
-    // macOS installer signing (only used if shipping a .pkg installer)
-    {
-      source: 'certificates/DEVELOPER_ID_INSTALLER_G2.p12',
-      dest: 'config/certs/developer-id-installer.p12',
-      optional: true,
-    },
-    // Notarization API key — App Store Connect .p8
-    {
-      source: 'AuthKey_{env.APPLE_API_KEY_ID}.p8',
-      dest: 'config/certs/AuthKey_{env.APPLE_API_KEY_ID}.p8',
-    },
-    // Per-brand provisioning profile (only present if cert generation produced one)
-    {
-      source: 'profiles/{brand.id}/DEVELOPER_ID_APPLICATION_G2/MACOS.mobileprovision',
-      dest: 'config/certs/{brand.id}.provisionprofile',
-      optional: true,
-    },
-  ],
-  mobile: [
-    // iOS App Store distribution — used by xcodebuild
-    {
-      source: 'certificates/IOS_DISTRIBUTION.p12',
-      dest: 'build/certs/ios-distribution.p12',
-    },
-    // Notarization / API access from CI
-    {
-      source: 'AuthKey_{env.APPLE_API_KEY_ID}.p8',
-      dest: 'build/certs/AuthKey_{env.APPLE_API_KEY_ID}.p8',
-    },
-    // Per-brand iOS provisioning profile
-    {
-      source: 'profiles/{brand.id}/IOS_DISTRIBUTION/IOS.mobileprovision',
-      dest: 'build/certs/{brand.id}.mobileprovision',
-      optional: true,
-    },
-  ],
-};
-
-/**
- * Resolve `{env.VAR}` and `{brand.key}` placeholders. Returns null when an
- * env placeholder is unset — the rule can't produce a real path, and a
- * literal `AuthKey_.p8` miss would only confuse.
- */
-function resolveTemplate(template, brand) {
-  let missing = false;
-
-  const resolved = template.replace(/\{([^}]+)\}/g, (match, path) => {
-    const [source, ...keyParts] = path.split('.');
-    const key = keyParts.join('.');
-    if (source === 'env') {
-      const value = process.env[key] || '';
-      if (!value) missing = true;
-      return value;
-    }
-    if (source === 'brand') return brand?.[key] || '';
-    return match;
-  });
-
-  return missing ? null : resolved;
-}
-
-/**
- * Ensure the certs dir ignores everything it holds — signing material must
- * never land in git, regardless of whether the framework's own .gitignore
- * exists yet.
- */
-function ensureCertsIgnore(destDir) {
-  const ignorePath = join(destDir, '.gitignore');
-  if (!jetpack.exists(ignorePath)) {
-    jetpack.write(ignorePath, '*\n!.gitignore\n');
-  }
-}
-
-/**
- * The signing tree a source root holds — the ONE home of that path.
- *
- * @param {string} sourceRoot - Company root (company-managed brands) or brand root.
- * @returns {string} Absolute path to .omega/certificates/apple/.
- */
-function certsSourceDir(sourceRoot) {
-  return join(sourceRoot, '.omega', 'certificates', 'apple');
-}
-
-/**
- * A target's signing rules with their placeholders resolved.
- *
- * @param {object} input
- * @param {string} input.target - Target type ('desktop'/'mobile'); anything
- *   else has no signing rules and returns [].
- * @param {object} [input.brand] - Brand config block (`{brand.id}` resolves from it).
- * @returns {Array<{ source, dest, optional, sourceRel, destRel }>} `sourceRel`/
- *   `destRel` are null when an env placeholder is unset; `dest` is the template.
- */
-function resolveCertRules({ target, brand = null }) {
-  return (CERT_FILE_MAP[target] || []).map((rule) => {
-    const sourceRel = resolveTemplate(rule.source, brand);
-    const destRel = sourceRel === null ? null : resolveTemplate(rule.dest, brand);
-
-    return {
-      source: rule.source,
-      dest: rule.dest,
-      optional: !!rule.optional,
-      sourceRel,
-      destRel,
-    };
-  });
-}
-
-/**
- * Copy a target's signing artifacts out of the signing tree.
- *
- * @param {object} input
- * @param {string} input.sourceRoot - Company root or brand root holding .omega/certificates/apple/.
- * @param {string} input.targetDir - The target's own directory (destinations resolve inside it).
- * @param {string} input.target - Target type ('desktop'/'mobile').
- * @param {object} [input.brand] - Brand config block, for `{brand.id}` rules.
- * @param {boolean} [input.dryRun] - Plan only: `copied` says what WOULD be
- *   written, nothing is written.
- * @returns {{ copied: string[], current: string[], missing: string[] }}
- *   Target-relative paths — copied (written this pass), current (already
- *   byte-identical), missing (no source, or an unresolved placeholder: that rule
- *   reports its dest TEMPLATE).
+ * What remains is what every surface asks the tree: WHERE it is (signingTree)
+ * and WHEN what it holds expires (certificateExpiry), so the certificates walk,
+ * `validate-certs` and a build all answer with the same date and the same three
+ * rungs.
  */
-function deliverCerts({ sourceRoot, targetDir, target, brand = null, dryRun = false }) {
-  const appleDir = certsSourceDir(sourceRoot);
-  const copied = [];
-  const current = [];
-  const missing = [];
-
-  for (const rule of resolveCertRules({ target, brand })) {
-    // An unset env placeholder (e.g. APPLE_API_KEY_ID) means the rule has no
-    // real path to resolve to — it reports its template, which names the gap
-    if (rule.destRel === null) {
-      missing.push(rule.dest);
-      continue;
-    }
-
-    const destPath = join(targetDir, rule.destRel);
-    const sourcePath = join(appleDir, rule.sourceRel);
-    if (!jetpack.exists(sourcePath)) {
-      missing.push(rule.destRel);
-      continue;
-    }
-
-    const sourceBytes = jetpack.read(sourcePath, 'buffer');
-    const destBytes = jetpack.exists(destPath) ? jetpack.read(destPath, 'buffer') : null;
-
-    if (destBytes && sourceBytes.equals(destBytes)) {
-      current.push(rule.destRel);
-      continue;
-    }
-
-    copied.push(rule.destRel);
-    if (dryRun) continue;
-
-    jetpack.copy(sourcePath, destPath, { overwrite: true });
-    ensureCertsIgnore(dirname(destPath));
-  }
-
-  return { copied, current, missing };
-}
+const { signingTree, certsSourceDir } = require('./signing-tree.js');
+const { certificateExpiry, EXPIRY_WARN_DAYS } = require('./certificate-expiry.js');
 
-module.exports = { deliverCerts, resolveCertRules, certsSourceDir, CERT_FILE_MAP };
+module.exports = { signingTree, certsSourceDir, certificateExpiry, EXPIRY_WARN_DAYS };

package/dist/vendor/devkit/ci-workflows.js

@@ -29,11 +29,43 @@
 const path = require('path');
 const jetpack = require('fs-jetpack');
 
+// The ONE pinned Socket Firewall action. A workflow installs the firewall
+// through Socket's own action rather than through npm ([#871](https://github.com/Omega-JS-Stack/omega/issues/871)):
+// the action downloads the binary with the job's token, so a hosted runner's
+// shared anonymous GitHub API quota never fails the step, and it caches it.
+// Pinning a new version is this one edit, and every brand picks it up on its
+// next verb ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)).
+const FIREWALL_ACTION = 'SocketDev/action@v1.3.2';
+
+// The token every framework template carries where that step belongs, on its
+// own line, indented as the list item it becomes.
+const FIREWALL_TOKEN = '{{ installFirewall }}';
+
+// The action step's `id`, so the Windows shim below can read the binary path
+// the action reports (`firewall-path-binary`) instead of guessing at it.
+const FIREWALL_STEP_ID = 'omega-firewall';
+
+// The token every framework template carries at the END of its install command,
+// and what a COMPOSED job renders it into ([#898](https://github.com/Omega-JS-Stack/omega/issues/898)).
+// At a brand root npm installs every target's workspace, so the desktop job on
+// Electron's node installed the backend workspace whose engines.node is the
+// Firebase runtime pin and warned EBADENGINE on every leg. Each job installs
+// only the workspace it belongs to instead.
+//
+// `.`, not the target's path: npm resolves `--workspace` against the CWD, and
+// every composed run step already carries `working-directory: targets/<name>`,
+// so `--workspace targets/desktop` from inside targets/desktop looks for
+// targets/desktop/targets/desktop and refuses with "No workspaces found". The
+// dot is the target's real directory whatever the brand named it ([#886](https://github.com/Omega-JS-Stack/omega/issues/886)),
+// and no template ever spells a path.
+const INSTALL_WORKSPACE_TOKEN = '{{ installWorkspace }}';
+const INSTALL_WORKSPACE_FLAG = '--workspace .';
+
 /**
  * Action inputs that name a path inside the checkout, per action. `uses:` steps
  * ignore `working-directory:` entirely (it is a `run:` key), so a composed
- * workflow has to scope these itself — the gh-pages publish otherwise pushes a
- * repo-root `dist/` no build ever wrote, and the cache key hashes nothing.
+ * workflow has to scope these itself: an unscoped cache key hashes nothing and
+ * an unscoped artifact upload collects an empty repo-root path.
  *
  * Named per action on purpose: a blanket "any input called path" rule would
  * rewrite inputs that mean something else — `actions/checkout`'s `path:` names
@@ -44,9 +76,72 @@ const SCOPED_ACTION_INPUTS = {
   'actions/cache': ['path'],
   'actions/upload-artifact': ['path'],
   'actions/download-artifact': ['path'],
-  'peaceiris/actions-gh-pages': ['publish_dir'],
 };
 
+/**
+ * Render every `{{ installFirewall }}` token into the pinned Socket Firewall
+ * step, at the indentation the token itself stands at.
+ *
+ * The step is written ONCE, here, instead of four times across the framework
+ * templates: the action and its version live in `FIREWALL_ACTION` above, so a
+ * version bump is one edit rather than a sweep of every template that happens
+ * to install the firewall ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)).
+ * A template carrying no token is returned untouched.
+ *
+ * @param {string} contents - The workflow template.
+ * @returns {string} The same text with every token replaced.
+ */
+function renderInstallFirewall(contents) {
+  return contents.replace(new RegExp(`^([ \\t]*)${escapeRegExp(FIREWALL_TOKEN)}[ \\t]*$`, 'gm'), (full, indent) => [
+    `${indent}# The firewall binary comes through Socket's own action (#871): it downloads`,
+    `${indent}# with the job's token, so the shared anonymous GitHub API quota of a hosted`,
+    `${indent}# runner never fails the step, and it caches the binary between runs.`,
+    `${indent}- name: Install Socket Firewall`,
+    `${indent}  id: ${FIREWALL_STEP_ID}`,
+    `${indent}  uses: ${FIREWALL_ACTION}`,
+    `${indent}  with:`,
+    `${indent}    mode: firewall-free`,
+    // The action caches the Windows binary under the extension-less name `sfw`
+    // and puts its directory on PATH. cmd.exe cannot execute a file with no
+    // extension, and the desktop build forces `shell: cmd` on Windows, so every
+    // windows leg died on `'sfw' is not recognized` (#872). One copy next to the
+    // original, named `sfw.exe`, and cmd finds it through the same PATH entry.
+    // Rendered on every template: the `if` makes it a no-op everywhere else.
+    // Under cmd, not bash: a self-hosted Windows box (the EV signer) has no bash
+    // on the runner's PATH, and cmd is the one shell every Windows runner has.
+    `${indent}- name: Expose Socket Firewall to cmd (Windows)`,
+    `${indent}  if: runner.os == 'Windows'`,
+    `${indent}  shell: cmd`,
+    `${indent}  run: copy "\${{ steps.${FIREWALL_STEP_ID}.outputs.firewall-path-binary }}" "\${{ steps.${FIREWALL_STEP_ID}.outputs.firewall-path-binary }}.exe"`,
+  ].join('\n'));
+}
+
+/**
+ * Render every `{{ installWorkspace }}` token: into the workspace flag on a
+ * COMPOSED brand-root copy, into nothing at all on a standalone one.
+ *
+ * Both lanes go through this one function, like the firewall step above, so the
+ * flag lives in ONE place instead of four templates. A standalone target IS its
+ * own repo root and declares no workspaces, so the flag there would refuse the
+ * install by name ("No workspaces found: --workspace=."); the token and the
+ * space before it are dropped and the command is the plain install it always was.
+ *
+ * @param {string} contents - The workflow template.
+ * @param {object} [options]
+ * @param {boolean} [options.composed] - Composing into a brand root.
+ * @returns {string} The same text with every token replaced.
+ */
+function renderInstallWorkspace(contents, options) {
+  const composed = !!(options && options.composed);
+
+  return contents.replace(new RegExp(`[ \\t]*${escapeRegExp(INSTALL_WORKSPACE_TOKEN)}`, 'g'), composed ? ` ${INSTALL_WORKSPACE_FLAG}` : '');
+}
+
+/** The literal, safe to drop into a RegExp. */
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 /**
  * Compose one framework workflow template for a target inside a brand monorepo.
  * Pure: text in, text out.
@@ -60,13 +155,20 @@ function composeWorkflow(contents, options) {
   const targetPath = options.targetPath;
   const targetName = options.targetName;
 
-  let composed = contents;
+  // Before anything else, so the scoping pass below sees the rendered step for
+  // what it is: a `uses:` step, which is never scoped to the target dir.
+  let composed = renderInstallFirewall(contents);
+
+  // This job installs ONLY the target it belongs to (#898): the composed copy
+  // is the one that runs inside a brand, where every other target's workspace
+  // (and its own engines.node pin) sits beside it.
+  composed = renderInstallWorkspace(composed, { composed: true });
 
   // Display name carries the target — two targets' runs are told apart in the
   // Actions list, where only the workflow name shows.
   composed = composed.replace(/^name:[ \t]*(.*)$/m, (full, value) => `name: ${value.trim()} (${targetPath})`);
 
-  // Per-target concurrency: `${{ github.ref }}` alone means the website's deploy
+  // Per-target concurrency: `${{ github.ref }}` alone means the web target's deploy
   // cancels the extension's.
   composed = composed.replace(/^(concurrency:\n(?:[ \t]+.*\n)*?[ \t]+group:[ \t]*)(.*)$/m, (full, prefix, value) => `${prefix}${targetName}-${value.trim()}`);
 
@@ -149,7 +251,7 @@ function composeTargetWorkflows(options) {
  * @param {object} options
  * @param {string} options.brandRoot - The brand (repo) root
  * @param {string[]} options.liveTargets - The target DIR names the brand's config
- *   still enables (`website`, `extension`, …). A composed file owned by anything
+ *   still enables (`web`, `extension`, …). A composed file owned by anything
  *   else is a leftover.
  * @param {boolean} [options.dryRun] - Report what would go, delete nothing
  * @param {object} [options.logger] - Logger with `log`/`warn` (defaults to console)
@@ -201,7 +303,21 @@ function composedWorkflowName(options) {
   if (!options.brandRoot || path.resolve(options.brandRoot) === path.resolve(options.targetDir)) {
     return options.workflow;
   }
-  return `${path.basename(options.targetDir)}-${options.workflow}`;
+  return composedWorkflowNameFor(path.basename(options.targetDir), options.workflow);
+}
+
+/**
+ * The same name from the target's NAME, for a caller that holds the name and no
+ * path at all (the backend's deploy dispatch reads the target out of a request,
+ * never off a disk it does not have). The path-taking form above is this one
+ * plus a basename, so the two can never spell the rule differently.
+ *
+ * @param {string} name - The target name (e.g. web)
+ * @param {string} workflow - The framework's workflow file name (e.g. build.yml)
+ * @returns {string} the composed workflow file name
+ */
+function composedWorkflowNameFor(name, workflow) {
+  return `${name}-${workflow}`;
 }
 
 // Scope every `run:` step that executes AFTER its job's checkout to the target dir.
@@ -517,4 +633,4 @@ function header(targetPath) {
   ].join('\n');
 }
 
-module.exports = { composeWorkflow, composeTargetWorkflows, composedWorkflowName, reconcileComposedWorkflows };
+module.exports = { composeWorkflow, composeTargetWorkflows, composedWorkflowName, composedWorkflowNameFor, reconcileComposedWorkflows, renderInstallFirewall, renderInstallWorkspace, FIREWALL_ACTION, FIREWALL_STEP_ID, FIREWALL_TOKEN, INSTALL_WORKSPACE_TOKEN, INSTALL_WORKSPACE_FLAG };

package/dist/vendor/devkit/cli-router.js

@@ -1,6 +1,6 @@
 // createCliRouter(config) — the shared OMEGA framework CLI dispatcher.
 //
-// Every framework bin parses argv (yargs) and hands the result to a Main class
+// Every framework bin parses argv (src/argv.js) and hands the result to a Main class
 // whose process() resolves a command name and runs commands/<name>.js from the
 // framework's dist. That router was copy-pasted per framework (UJM/BXM/EM,
 // drift-identical); this is the single implementation. @omega.js/backend's CLI is a different
@@ -46,8 +46,8 @@ function createCliRouter(config) {
     // `--help`/`-h` route to the built-in help FIRST — before positionals, so
     // `omega deploy --help` prints help instead of RUNNING deploy, and never
     // the default command (the old fallthrough ran setup/manage on a help
-    // request). Frameworks must disable yargs' built-in help so the flag
-    // reaches the router.
+    // request). No parse may claim `--help` for itself: the flag has to reach
+    // the router.
     if (options.help || options.h) {
       return 'help';
     }

package/dist/vendor/devkit/defaults-engine.js

@@ -15,7 +15,9 @@
 //   template   object         render `{{ key.path }}` tokens with this data
 //                             (tolerant: unknown keys survive verbatim, so GitHub
 //                             Actions' `${{ secrets.X }}` passes through)
-//   merge      bool           JSON5 defaults-merge with the existing file
+//   merge      bool           JSON5 defaults-merge with the existing file, written
+//                             through @omega.js/config's comment-preserving editor
+//                             (only the differing keys change; comments stay)
 //   mergeLines bool           OMEGA marker-section line merge (.env/.gitignore/AGENTS.md)
 //   retire     bool           brand-context per-target doc retirement: NEVER scaffold
 //                             the file; an existing framework-owned-only copy is
@@ -38,6 +40,7 @@
 
 const path = require('path');
 const fs = require('fs');
+const { isDeepStrictEqual } = require('node:util');
 const jetpack = require('fs-jetpack');
 const { minimatch } = require('minimatch');
 const { mergeLineBasedFiles, hasSectionMarkers, getCustomSection } = require('./merge-line-files');
@@ -206,9 +209,7 @@ function applyDefaults(config) {
 
     if (options.merge && exists) {
       try {
-        const JSON5 = require('json5');
-        const merged = mergeJson5Defaults(JSON5.parse(jetpack.read(destination)), JSON5.parse(contents));
-        contents = JSON5.stringify(merged, null, 2);
+        contents = mergeJson5Text(jetpack.read(destination), contents);
         didMerge = true;
       } catch (error) {
         logger.error(`Error merging config file ${finalRelative}: ${error.message}`);
@@ -335,7 +336,10 @@ function renderTemplate(content, context) {
 
 // JSON5 defaults merge (BXM's mergeConfigs): framework defaults provide shape and
 // order; the consumer's values win unless they're the literal string 'default';
-// consumer-only keys survive at every nesting level.
+// consumer-only keys survive at every nesting level, EXCEPT one holding the
+// 'default' sentinel, which is the framework's own unset marker and drops (#926).
+// A JSON5 file carries no framework-block marker, so that sentinel is the only
+// signal telling a key the framework retired from a key the consumer added.
 function mergeJson5Defaults(existingConfig, newConfig) {
   const merged = { ...newConfig };
 
@@ -356,9 +360,11 @@ function mergeJson5Defaults(existingConfig, newConfig) {
       }
     }
 
-    // Consumer-only keys survive at every level.
+    // Consumer-only keys survive at every level, except a leftover 'default'
+    // sentinel: that is the framework's unset marker for a key it no longer
+    // declares, so it leaves with the key (#926).
     for (const key in source) {
-      if (!Object.prototype.hasOwnProperty.call(newDefaults, key)) {
+      if (!Object.prototype.hasOwnProperty.call(newDefaults, key) && source[key] !== 'default') {
         target[key] = source[key];
       }
     }
@@ -369,4 +375,60 @@ function mergeJson5Defaults(existingConfig, newConfig) {
   return merged;
 }
 
+// The merge WRITE: the consumer's JSON5 is hand-edited, so the merged object is
+// never re-stringified over it (that stripped every comment and the trailing
+// newline, #928). The merge result is diffed against the file on disk and the
+// differences go through @omega.js/config's comment-preserving editor, so only
+// the changed value spans move, every other byte survives, and an unchanged merge
+// returns the source untouched so the engine's idempotency check skips the write.
+// Output always ends with exactly one newline.
+function mergeJson5Text(existingText, defaultsText) {
+  const JSON5 = require('json5');
+  const { applyConfigEdits, applyConfigRemovals } = require('../config/index.js');
+
+  const existing = JSON5.parse(existingText);
+  const merged = mergeJson5Defaults(existing, JSON5.parse(defaultsText));
+
+  const edits = {};
+  const removals = [];
+  diffConfigPaths(existing, merged, '', edits, removals);
+
+  // Nothing to change is not a write: the file goes back byte for byte, final
+  // newline included or not, so a rerun never touches it.
+  if (removals.length === 0 && Object.keys(edits).length === 0) {
+    return existingText;
+  }
+
+  const written = applyConfigEdits(applyConfigRemovals(existingText, removals), edits);
+
+  return written.replace(/\n*$/, '\n');
+}
+
+// Diff the merged object against the one on disk into editor operations: dot-paths
+// to set (a leaf whose value differs, plus a key or whole branch the file lacks)
+// and dot-paths to delete (a key the merge dropped, #926's `default` sentinel).
+// Two objects at the same path recurse; anything else (primitive, array, or a
+// branch landing where the file has no object) is one value the editor writes whole.
+function diffConfigPaths(existing, merged, prefix, edits, removals) {
+  const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+  for (const key of Object.keys(merged)) {
+    const keyPath = prefix ? `${prefix}.${key}` : key;
+    const nextValue = merged[key];
+    const priorValue = existing[key];
+
+    if (isObject(nextValue) && isObject(priorValue)) {
+      diffConfigPaths(priorValue, nextValue, keyPath, edits, removals);
+    } else if (!isDeepStrictEqual(priorValue, nextValue)) {
+      edits[keyPath] = nextValue;
+    }
+  }
+
+  for (const key of Object.keys(existing)) {
+    if (!Object.prototype.hasOwnProperty.call(merged, key)) {
+      removals.push(prefix ? `${prefix}.${key}` : key);
+    }
+  }
+}
+
 module.exports = { applyDefaults, mergeJson5Defaults, renderTemplate };