@omega.js/desktop 0.50.0 → 0.51.0

package/dist/commands/lib/deploy-precheck.js

@@ -7,11 +7,15 @@
  * `omega deploy` — as a precheck before the dispatch:
  *
  *   framework freshness  the npm registry's latest vs the installed version
- *   validate-certs       the signing prereqs, soft (a warning, never fatal)
+ *   validate-certs       the signing prereqs, STRICT and fatal (#891)
  *   provision-repos      the public releases repo the config names (idempotent)
- *   push-secrets         the composed target env → GitHub Actions repo secrets
+ *   push-secrets         the composed target env into GitHub Actions repo
+ *                        secrets, fatal (#891)
  *
- * Every step is soft: a precheck reports, the deploy proceeds. `--no-secrets`
+ * The two SIGNING steps are fatal and everything else is soft: a deploy is how
+ * a signed, notarized release ships, so material that is missing or expired
+ * stops the run here ([#891](https://github.com/Omega-JS-Stack/omega/issues/891))
+ * instead of producing a green run with an app Gatekeeper refuses. `--no-secrets`
  * skips the whole precheck — the same opt-out name on web, desktop and
  * extension (parity; desktop's old `--quick` is gone).
  *
@@ -21,45 +25,60 @@
 const Manager = new (require('../../build.js'));
 const { runDeployPrecheck } = require('../../vendor/devkit/deploy-precheck.js');
 const { releasesRepo } = require('../../vendor/config/index.js');
+const { publishTargetSecrets } = require('../../vendor/devkit/target-secrets.js');
+const { resolveToken } = require('../../vendor/devkit/deploy.js');
 const { updateManager } = require('./dependencies.js');
-const { publishEnvSecrets } = require('../push-secrets.js');
 
 const package = Manager.getPackage('main');
 
 /**
  * Auto-provision the brand's ONE public releases repo, addressed by
- * @omega.js/config's `releasesRepo` (`<brand.id>-releases` under the brand repo
- * owner unless the config names another). Idempotent: only creates if missing.
- * Config-only, never the git remote: a brand nested in another repo would
- * provision under the enclosing repo's owner (#799).
+ * @omega.js/config's `releasesRepo` (`<brand.id>-releases` under the brand's
+ * org, #883: no repo name is ever typed). Idempotent: only creates if
+ * missing. Config-only, never the git remote: a brand nested in another repo
+ * would provision under the enclosing repo's owner (#799).
+ *
+ * PUBLIC, always: a shipped app polls this feed with no token, and so does a
+ * download button on the site. It is created with a first commit (`autoInit`),
+ * because a release needs a tag and a tag needs a commit.
+ *
+ * The repo itself is created by `@omega.js/devkit/github-repo`'s ensureRepo,
+ * the ONE home every OMEGA repo is created and reconciled from (#883): the
+ * manage walk and the web deploy call the same function.
  *
  * @param {object} input
  * @param {Function} input.log - Progress line sink.
  * @param {Function} input.warn - Warning sink.
- * @param {object} [input.octokit] - Injectable client (tests); defaults to the GH_TOKEN one.
  * @param {object} [input.config] - Injectable resolved config (tests).
+ * @param {boolean} [input.dryRun] - Plan only: ensureRepo builds the plan and
+ *   creates nothing (#895).
+ * @param {Function} [input.execFn] - Injectable `gh` exec (tests).
  */
-async function provisionReleaseRepos({ log, warn, octokit, config }) {
-  const { getOctokit, ensureRepo } = require('../../utils/github.js');
-  const client = octokit || getOctokit();
-  if (!client) return;
+async function provisionReleaseRepos({ log, warn, config, execFn, dryRun }) {
+  const { ensureRepo } = require('../../vendor/devkit/github-repo.js');
 
   const resolved = config || Manager.getConfig() || {};
   if (resolved.releases?.enabled === false) return;
 
-  const { owner, name, repo } = releasesRepo(resolved);
-  if (!repo) {
-    warn('provision-repos: could not address the releases repo. Set repo.providers.github.org (or targets.desktop.releases.owner) and brand.id in config/omega.json5.');
+  const releases = releasesRepo(resolved);
+  if (!releases) {
+    warn('provision-repos: could not address the releases repo. Set repo.org and brand.id in config/omega.json5 (the releases repo is <brand.id>-releases under that org).');
     return;
   }
 
-  const description = `Public release artifacts + auto-update feed for ${owner}'s @omega.js/desktop apps. Managed by @omega.js/desktop.`;
+  const description = `Public release artifacts + auto-update feed for ${releases.owner}'s @omega.js/desktop apps. Managed by @omega.js/desktop.`;
 
   try {
-    const result = await ensureRepo(client, owner, name, { description, private: false });
-    log(`provision-repos: ✓ ${result.created ? 'created ' : ''}${repo}${result.created ? '' : ' already exists'} — releases (auto-update feed + the site's download links)`);
+    const result = await ensureRepo({
+      owner: releases.owner,
+      name: releases.name,
+      private: false,
+      description,
+      autoInit: true,
+    }, { execFn, dryRun });
+    log(`provision-repos: ✓ ${result.created ? 'created ' : ''}${releases.slug}${result.created ? '' : ' already exists'}: releases (auto-update feed + the site's download links)`);
   } catch (e) {
-    warn(`provision-repos: ✗ ${repo} (releases) — ${e.message}`);
+    warn(`provision-repos: ✗ ${releases.slug} (releases): ${e.message}`);
   }
 }
 
@@ -73,32 +92,44 @@ const STEPS = [
     run: ({ projectDir, log, warn }) => updateManager({ projectDir, package, log, error: warn }),
   },
   {
+    // STRICT, and fatal: a deploy is how a signed release ships, so signing
+    // material that is missing, expired or unreadable stops it here rather than
+    // producing a green run with an unsigned app in it (#891).
     name: 'validate-certs',
-    run: async ({ log }) => {
+    fatal: true,
+    run: async () => {
       const validateCerts = require('../validate-certs.js');
-      const result = await validateCerts({ strict: false });
-      if (result?.ok === false) {
-        log('(Run `npx omega validate-certs` after wiring up your signing assets to re-check.)');
-      }
+      await validateCerts({ strict: true });
     },
   },
   {
     name: 'provision-repos',
-    run: async ({ projectDir, log, warn }) => {
+    run: async ({ projectDir, log, warn, dryRun }) => {
       require('../../vendor/config/index.js').loadEnv(projectDir);
-      if (!process.env.GH_TOKEN) {
-        return log('(Skipping repo provisioning: GH_TOKEN not set.)');
+      // The same token chain the dispatch resolves (`GH_TOKEN` →
+      // `GITHUB_TOKEN` → `gh auth token`): a machine signed in with `gh` and
+      // no variable exported can provision its repos like any other.
+      if (!resolveToken()) {
+        return log('(Skipping repo provisioning: no GitHub token. Set GH_TOKEN, or sign in with `gh auth login`.)');
       }
-      await provisionReleaseRepos({ log, warn });
+      await provisionReleaseRepos({ log, warn, dryRun });
     },
   },
   {
     name: 'push-secrets',
     // No .env check and no PAT: the keys come from the composed target env (the
     // brand root's .env, #678) and the transport is `gh`'s own auth session
-    // ([#682](https://github.com/Omega-JS-Stack/omega/issues/682)) — the same
-    // one-line call web and the extension make.
-    run: ({ projectDir, log, warn }) => publishEnvSecrets({ targetDir: projectDir, logger: { log, warn, error: warn } }),
+    // ([#682](https://github.com/Omega-JS-Stack/omega/issues/682)), the same
+    // one-line call web, backend and the extension make. Fatal: the runner
+    // signs with what this step sends, so a refused or half publish must stop
+    // the deploy instead of handing CI a set it cannot sign with (#891).
+    fatal: true,
+    run: ({ projectDir, log, warn, dryRun }) => publishTargetSecrets({
+      targetDir: projectDir,
+      target: 'desktop',
+      logger: { log, warn, error: warn },
+      dryRun,
+    }),
   },
 ];
 
@@ -108,10 +139,11 @@ const STEPS = [
  * @param {object} input.options - The parsed CLI options (`secrets: false` = opted out).
  * @param {object} input.logger - `{ log, warn, error }`.
  * @param {Array} [input.steps] - Injectable step list (tests).
+ * @param {boolean} [input.dryRun] - Plan only; handed to every step (#895).
  * @returns {Promise<{ skipped: string }|{ ran: string[] }>} The steps that ran, or the opt-out marker.
  */
-function deployPrecheck({ projectDir, options, logger, steps }) {
-  return runDeployPrecheck({ projectDir, options, logger, steps: steps || STEPS });
+function deployPrecheck({ projectDir, options, logger, steps, dryRun }) {
+  return runDeployPrecheck({ projectDir, options, logger, steps: steps || STEPS, dryRun });
 }
 
 module.exports = { deployPrecheck, STEPS, provisionReleaseRepos };

package/dist/commands/lib/ensure-target.js

@@ -34,7 +34,7 @@ const version = require('wonderful-version');
 const Manager = new (require('../../build.js'));
 const { ensurePeerDependencies, readProject } = require('./dependencies.js');
 const { renderSecretsBlock } = require('../../vendor/config/env-delivery.js');
-const { composeTargetWorkflows } = require('../../vendor/devkit/ci-workflows.js');
+const { composeTargetWorkflows, renderInstallFirewall, renderInstallWorkspace } = require('../../vendor/devkit/ci-workflows.js');
 const { assertScaffoldable } = require('../../vendor/devkit/scaffold-guard.js');
 
 const logger = Manager.logger('ensure-target');
@@ -42,7 +42,8 @@ const package = Manager.getPackage('main');
 
 /**
  * Sync the consumer manifest: the omega verb scripts, the npm-private latch,
- * and the electron main entry (the gulp `bundle` task's output bundle).
+ * the license (#884, seeded only when the manifest states none), and the
+ * electron main entry (the gulp `bundle` task's output bundle).
  * Identical content is not a write (#590).
  */
 function setupScripts(projectDir, result) {
@@ -60,6 +61,12 @@ function setupScripts(projectDir, result) {
   // Electron consumer projects should not be published to npm
   project.private = true;
 
+  // The license every OMEGA target states when it states none of its own
+  // ([#884](https://github.com/Omega-JS-Stack/omega/issues/884)): UNLICENSED is
+  // npm's word for closed-source commercial code, and electron-builder reads
+  // the field for the packaged app's metadata. A brand's own license is kept.
+  project.license = project.license || 'UNLICENSED';
+
   // Point electron at the built main bundle.
   // The gulp `bundle` task emits dist/main.bundle.js; the consumer's src/main.js is the *source* entry.
   project.main = 'dist/main.bundle.js';
@@ -75,7 +82,7 @@ function setupScripts(projectDir, result) {
   }
 
   jetpack.write(projectPath, contents);
-  result.changed.push('package.json (scripts + main + private)');
+  result.changed.push('package.json (scripts + main + private + license)');
 }
 
 /**
@@ -141,9 +148,15 @@ async function copyDefaults(projectDir, engineLogger) {
   // `KEY: ${{ secrets.KEY }}` line per key the schema delivers to desktop, at
   // the token's two-space indent. The yml rule below re-renders on every verb,
   // so the block tracks the schema like the node version tracks the pin.
+  // The composed half (#835): the brand's PRODUCTION values name the keys the
+  // schema cannot, which on desktop is the consumer's own `.env` lines. NAMES
+  // only ever reach the workflow file; no value is rendered anywhere.
+  const { composeTargetEnv } = require('../../vendor/config/index.js');
+  const { values: composed } = composeTargetEnv({ targetDir: projectDir, target: 'desktop', environment: 'production' });
+
   const templateContext = {
     versions: { ...(package.engines || {}), node: package.omega.nodeRuntime },
-    githubSecrets: renderSecretsBlock('desktop', { indent: '  ' }),
+    githubSecrets: renderSecretsBlock('desktop', { indent: '  ', values: composed }),
   };
 
   // Scaffolding runs through the shared devkit engine (vendored at prepare time).
@@ -177,6 +190,11 @@ async function copyDefaults(projectDir, engineLogger) {
       // target .env is an optional per-key override a HUMAN writes, and no
       // machine writes a target .env — so the template is gone.
       '_.gitignore': { mergeLines: true, template: templateContext },
+      // The one TRACKED file under config/certs/ ([#913](https://github.com/Omega-JS-Stack/omega/issues/913)),
+      // and framework-owned like the workflow YAMLs: it explains where signing
+      // material really lives, so a target keeps the explanation that matches
+      // the ignore rules the scaffold just wrote, never an older one.
+      'config/certs/README.md': { overwrite: true },
       // The agent-docs chain (#63): AGENTS.md carries the content (marker-merged
       // like .gitignore), CLAUDE.md is the one-line `@AGENTS.md` pointer — copied
       // when missing by the `**/*` rule above, never clobbered.
@@ -205,6 +223,15 @@ async function copyDefaults(projectDir, engineLogger) {
       // rule above; a STANDALONE target (its own git root) keeps its own copy.
       ...(isBrandTarget ? { '.github/**/*': { skip: true } } : {}),
     },
+    // The firewall step and the workspace flag are devkit's, rendered wherever
+    // a workflow is WRITTEN ([#872](https://github.com/Omega-JS-Stack/omega/issues/872),
+    // [#898](https://github.com/Omega-JS-Stack/omega/issues/898)): the brand
+    // lane gets both inside composeWorkflow below, a STANDALONE target here, on
+    // the copy this engine writes. The action, its pin and the flag live in ONE
+    // place, so none of the four templates restates them. A standalone target
+    // is its own repo root and declares no workspaces, so the flag renders to
+    // nothing here.
+    transform: (contents) => renderInstallWorkspace(renderInstallFirewall(contents)),
     logger: engineLogger,
   });
 
@@ -221,21 +248,54 @@ async function copyDefaults(projectDir, engineLogger) {
     });
   }
 
+  removeRetiredCertsIgnore(projectDir, engineLogger);
+
   return applied;
 }
 
-/** Warn when the framework is a `file:` link — that install never publishes. */
-function checkLocality(projectDir, warn) {
+/**
+ * Remove the sibling `config/certs/.gitignore` left over from the era when
+ * `config/certs/` was ignored whole
+ * ([#913](https://github.com/Omega-JS-Stack/omega/issues/913)). The directory's
+ * README is the one tracked explanation of where signing material really lives,
+ * and a nested ignore file of `*` + `!.gitignore` beats the parent file, so it
+ * keeps hiding the README on a target scaffolded before the new rules. The
+ * parent's own retired `config/certs/` line needs no healing: the marker merge
+ * drops it with the rest of the framework block
+ * ([#926](https://github.com/Omega-JS-Stack/omega/issues/926)). A copy an
+ * EARLIER run already moved into the consumer's Custom section is the
+ * consumer's by that rule and is left alone.
+ *
+ * The sibling is framework-written and known byte for byte, so only that exact
+ * shape is removed. Anything a consumer wrote stays.
+ *
+ * @param {string} projectDir - The target root.
+ * @param {object} engineLogger - `{ log, warn }`.
+ */
+function removeRetiredCertsIgnore(projectDir, engineLogger) {
+  const siblingPath = path.join(projectDir, 'config', 'certs', '.gitignore');
+  const sibling = jetpack.read(siblingPath);
+
+  if (sibling && sibling.replace(/\r\n/g, '\n').trim() === '*\n!.gitignore') {
+    jetpack.remove(siblingPath);
+    engineLogger.log('Healed → config/certs/.gitignore (retired: the target .gitignore owns this directory)');
+  }
+}
+
+/**
+ * The framework must BE a dependency of the target: everything below it reads
+ * the installed version. A `file:` spec is no finding of its own
+ * ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)): the deploy
+ * snapshot packs every locally linked package into the mirror it pushes, so a
+ * local install is exactly what the deploy is built for.
+ */
+function checkLocality(projectDir) {
   const project = readProject(projectDir);
   const installedVersion = project.devDependencies[package.name] || project.dependencies[package.name];
 
   if (!installedVersion) {
     throw new Error(`No installed version of ${package.name} found in dependencies or devDependencies.`);
   }
-
-  if (installedVersion.startsWith('file:')) {
-    warn(`⚠️  You are using the local version of ${package.name}. This WILL NOT WORK when published.`);
-  }
 }
 
 /**
@@ -288,7 +348,7 @@ async function ensureTarget(options) {
     result.merged.push(...applied.merged);
   }
 
-  checkLocality(projectDir, warn);
+  checkLocality(projectDir);
 
   for (const [label, files] of [['Created', result.written], ['Merged', result.merged], ['Synced', result.changed]]) {
     if (files.length > 0) log(`${label} ${files.join(', ')}`);

package/dist/commands/package.js

@@ -16,7 +16,6 @@ function plan(options) {
     env: { OMEGA_BUILD_MODE: 'true' },
     steps: [
       { type: 'clean' },
-      { type: 'certs' },
       { type: 'gulp', task: quick ? 'packageQuick' : 'packageBuild' },
     ],
   };

package/dist/commands/publish.js

@@ -5,9 +5,16 @@ const { runPipeline } = require('../utils/build-pipeline.js');
 
 // `npx omega publish` publishes from an already-built tree (the CI lane calls it
 // after its own build); `--local` (the consumer's `release:local` script) cleans
-// first. Both deliver the Apple signing artifacts (#678) and then run cert
-// validation before the gulp task — a warning gate unless `--strict` makes it
-// fatal (validate-certs.js owns that).
+// first. Both check the SHIP credentials the brand's declared formats need
+// before anything else runs (#867: a declared snap with no Snap Store login is
+// a release that dies on a runner, so it is refused in a second rather than in
+// a build), then deliver the Apple signing artifacts (#678) and run cert
+// validation before the gulp task, STRICT
+// ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)): publish is the
+// verb that puts a build in front of users, so signing material it cannot find
+// stops it here rather than shipping an app Gatekeeper refuses. What is strict
+// about it is the mac leg (validate-certs.js owns that rule: a leg that cannot
+// sign for mac only warns).
 function plan(options) {
   options = options || {};
 
@@ -17,7 +24,7 @@ function plan(options) {
     steps.push({ type: 'clean' });
   }
 
-  steps.push({ type: 'certs' }, { type: 'validate-certs' }, { type: 'gulp', task: 'publish' });
+  steps.push({ type: 'ship-keys' }, { type: 'validate-certs', strict: true }, { type: 'gulp', task: 'publish' });
 
   return {
     env: { OMEGA_BUILD_MODE: 'true', OMEGA_IS_PUBLISH: 'true' },