@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/derive-signing-env.test.js

@@ -1,122 +0,0 @@
-// derive-signing-env tests — the .env stamp the manager's disperse service used
-// to write is derived at build time instead
-// ([#678](https://github.com/Omega-JS-Stack/omega/issues/678)).
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const jetpack = require('fs-jetpack');
-
-const deriveSigningEnv = require('../../../utils/derive-signing-env.js');
-const defineCases = require('../../../vendor/devkit/test/define-cases.js');
-
-function stageTarget(files) {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-derive-'));
-  for (const file of files) {
-    jetpack.write(path.join(tmp, 'config', 'certs', file), 'artifact');
-  }
-  return tmp;
-}
-
-module.exports = defineCases({
-  type: 'group',
-  layer: 'build',
-  description: 'derive-signing-env',
-  tests: [
-    {
-      name: 'unset + the file is delivered → the target-relative path is set',
-      run: (ctx) => {
-        const tmp = stageTarget(['developer-id-application.p12', 'AuthKey_ABCDE12345.p8']);
-
-        try {
-          const env = { APPLE_API_KEY_ID: 'ABCDE12345' };
-          const derived = deriveSigningEnv({ env, projectDir: tmp });
-
-          ctx.expect(env.CSC_LINK).toBe('config/certs/developer-id-application.p12');
-          ctx.expect(env.APPLE_API_KEY).toBe('config/certs/AuthKey_ABCDE12345.p8');
-          ctx.expect(derived.map((entry) => entry.key).sort()).toEqual(['APPLE_API_KEY', 'CSC_LINK']);
-        } finally {
-          fs.rmSync(tmp, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'already set → never overridden (an explicit answer wins)',
-      run: (ctx) => {
-        const tmp = stageTarget(['developer-id-application.p12', 'AuthKey_ABCDE12345.p8']);
-
-        try {
-          const env = {
-            APPLE_API_KEY_ID: 'ABCDE12345',
-            CSC_LINK: '/keychain/mine.p12',
-            APPLE_API_KEY: '/secrets/AuthKey.p8',
-          };
-          const derived = deriveSigningEnv({ env, projectDir: tmp });
-
-          ctx.expect(env.CSC_LINK).toBe('/keychain/mine.p12');
-          ctx.expect(env.APPLE_API_KEY).toBe('/secrets/AuthKey.p8');
-          ctx.expect(derived).toEqual([]);
-        } finally {
-          fs.rmSync(tmp, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'the file is absent → the key stays unset (electron-builder skips/auto-discovers)',
-      run: (ctx) => {
-        const tmp = stageTarget([]);
-
-        try {
-          const env = { APPLE_API_KEY_ID: 'ABCDE12345' };
-          const derived = deriveSigningEnv({ env, projectDir: tmp });
-
-          ctx.expect('CSC_LINK' in env).toBe(false);
-          ctx.expect('APPLE_API_KEY' in env).toBe(false);
-          ctx.expect(derived).toEqual([]);
-        } finally {
-          fs.rmSync(tmp, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'no APPLE_API_KEY_ID → no notarization path to derive',
-      run: (ctx) => {
-        const tmp = stageTarget(['AuthKey_ABCDE12345.p8']);
-
-        try {
-          const env = {};
-          deriveSigningEnv({ env, projectDir: tmp });
-
-          ctx.expect('APPLE_API_KEY' in env).toBe(false);
-        } finally {
-          fs.rmSync(tmp, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      // The gulp boot is too heavy to require here (it pulls in Manager, gulp and
-      // every task), so the call site is checked statically: the option name has
-      // to be the one the deriver reads, and the value it passes has to be a
-      // binding main.js actually declares. Shipped bound to an undeclared
-      // `projectDir` once, which is a ReferenceError on every desktop build.
-      name: 'the gulp main call site passes a declared binding as projectDir',
-      run: (ctx) => {
-        const source = fs.readFileSync(path.join(__dirname, '..', '..', '..', 'gulp', 'main.js'), 'utf8');
-        const call = source.match(/require\('\.\.\/utils\/derive-signing-env\.js'\)\(\{([^}]*)\}\)/);
-        ctx.expect(call).toBeTruthy();
-
-        const options = {};
-        for (const part of call[1].split(',')) {
-          const [name, value] = part.split(':').map((piece) => piece.trim());
-          options[name] = value === undefined ? name : value;
-        }
-
-        ctx.expect(Object.keys(options).sort()).toEqual(['env', 'projectDir']);
-
-        const binding = options.projectDir;
-        const declared = new RegExp(`\\b(?:const|let|var)\\s+${binding}\\s*=`).test(source);
-        ctx.expect(declared).toBe(true);
-      },
-    },
-  ],
-});

package/dist/test/suites/build/push-secrets.test.js

@@ -1,226 +0,0 @@
-// Build-layer tests for commands/push-secrets.js — the composed source, desktop's
-// file → base64 value seam, and the publish itself.
-//
-// Offline by construction ([#682](https://github.com/Omega-JS-Stack/omega/issues/682)):
-// the brand and target are temp dirs and the `gh`/`git` boundaries are injected,
-// so the suite proves the real send shape without a repo, a credential or a
-// network. What the shared publisher owns (the five loud skips, the declared-repo
-// guard) is pinned once in @omega.js/devkit's target-secrets suite.
-
-const path = require('path');
-const fs   = require('fs');
-const os   = require('os');
-
-const pushSecrets = require(path.join(__dirname, '..', '..', '..', 'commands', 'push-secrets.js'));
-const defineCases = require('../../../vendor/devkit/test/define-cases.js');
-
-const quiet = { log() {}, warn() {}, error() {} };
-
-// A brand root (config/omega.json5) with a targets/desktop target under it.
-function tmpBrand({ brandEnv, targetEnv, repo } = {}) {
-  const brand = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-brand-'));
-  fs.mkdirSync(path.join(brand, 'config'), { recursive: true });
-  fs.writeFileSync(path.join(brand, 'config', 'omega.json5'), [
-    '{',
-    '  brand: { id: "b" },',
-    ...(repo ? [`  repo: { providers: { github: { repo: '${repo}' } } },`] : []),
-    '}',
-  ].join('\n'));
-  if (brandEnv !== undefined) fs.writeFileSync(path.join(brand, '.env'), brandEnv);
-
-  const target = path.join(brand, 'targets', 'desktop');
-  fs.mkdirSync(target, { recursive: true });
-  if (targetEnv !== undefined) fs.writeFileSync(path.join(target, '.env'), targetEnv);
-
-  return { brand, target };
-}
-
-module.exports = defineCases({
-  type: 'suite',
-  layer: 'build',
-  description: 'push-secrets — composed env source + value resolution',
-  tests: [
-    {
-      name: 'publishEnvSecrets: the schema set over the gh boundary, file-path secrets base64\'d, values on stdin',
-      run: (ctx) => {
-        const { brand, target } = tmpBrand({
-          repo: 'acme/app',
-          brandEnv: [
-            'GH_TOKEN=brand-token',
-            'APPLE_TEAM_ID=BRANDTEAM',
-            'CSC_LINK=config/certs/dev-id.p12',
-            'MY_CUSTOM_THING=custom',
-            '',
-          ].join('\n'),
-        });
-        // A brand-level certificate: named by a path the target root does not
-        // hold, resolved from the brand root.
-        const cert = path.join(brand, 'config', 'certs', 'dev-id.p12');
-        fs.mkdirSync(path.dirname(cert), { recursive: true });
-        fs.writeFileSync(cert, Buffer.from('FAKE-CERT-BYTES'));
-
-        const gh = [];
-        try {
-          const result = pushSecrets.publishEnvSecrets({
-            targetDir: target,
-            logger: quiet,
-            env: {},
-            gitExecFn: () => 'git@github.com:acme/app.git\n',
-            execFn: (file, args, options) => { gh.push({ file, args, input: options.input }); return ''; },
-          });
-
-          ctx.expect(result.published).toEqual(['APPLE_TEAM_ID', 'CSC_LINK', 'GH_TOKEN']);
-          ctx.expect(gh.map((c) => c.args.join(' '))).toEqual([
-            'auth status',
-            'secret set APPLE_TEAM_ID --repo acme/app',
-            'secret set CSC_LINK --repo acme/app',
-            'secret set GH_TOKEN --repo acme/app',
-          ]);
-          // The CERTIFICATE travels, never this laptop's path to it — and every
-          // value goes on stdin, never in argv.
-          ctx.expect(gh.slice(1).map((c) => c.input)).toEqual([
-            'BRANDTEAM',
-            Buffer.from('FAKE-CERT-BYTES').toString('base64'),
-            'brand-token',
-          ]);
-          ctx.expect(gh.every((c) => c.file === 'gh')).toBe(true);
-        } finally {
-          fs.rmSync(brand, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'publishEnvSecrets: a checkout that is not the brand\'s DECLARED repo skips loudly, never touching gh',
-      run: (ctx) => {
-        // The declared repo is the only proof of where these certificates
-        // belong — an inferred remote is a fork, a template clone or a vendored
-        // target away from arming a stranger's Actions. Desktop pushes the most
-        // dangerous payload of the three binds.
-        const { brand, target } = tmpBrand({ repo: 'acme/app', brandEnv: 'GH_TOKEN=brand-token\n' });
-        const undeclared = tmpBrand({ brandEnv: 'GH_TOKEN=brand-token\n' });
-        const said = [];
-        const loud = { log: (m) => said.push(m), warn: (m) => said.push(m), error: (m) => said.push(m) };
-        const noGh = () => { throw new Error('gh must not run'); };
-
-        try {
-          ctx.expect(pushSecrets.publishEnvSecrets({
-            targetDir: target,
-            logger: loud,
-            env: {},
-            execFn: noGh,
-            gitExecFn: () => 'git@github.com:Omega-JS-Stack/omega.git\n',
-          })).toEqual({ skipped: 'repo-mismatch' });
-
-          ctx.expect(pushSecrets.publishEnvSecrets({
-            targetDir: undeclared.target,
-            logger: loud,
-            env: {},
-            execFn: noGh,
-            gitExecFn: () => 'git@github.com:acme/app.git\n',
-          })).toEqual({ skipped: 'no-declared-repo' });
-
-          const heard = said.join('\n');
-          ctx.expect(heard).toContain("this brand's repo is acme/app");
-          ctx.expect(heard).toContain('names no GitHub repo in config');
-        } finally {
-          fs.rmSync(brand, { recursive: true, force: true });
-          fs.rmSync(undeclared.brand, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'collectEnvSecrets: the brand-root .env supplies the target — no target .env exists (#678)',
-      run: (ctx) => {
-        const { brand, target } = tmpBrand({
-          brandEnv: [
-            'GH_TOKEN=brand-token',
-            'APPLE_TEAM_ID=BRANDTEAM',
-            'STRIPE_SECRET_KEY=sk_live_backend_only',
-            'GOOGLE_ANALYTICS_SECRET_DESKTOP=desktop-stream',
-            'MY_CUSTOM_THING=custom',
-            'OMEGA_FONTAWESOME_ROOT=/Users/dev/.omega/fontawesome',
-            '',
-          ].join('\n'),
-        });
-
-        try {
-          ctx.expect(fs.existsSync(path.join(target, '.env'))).toBe(false);
-
-          ctx.expect(pushSecrets.collectEnvSecrets(target)).toEqual({
-            APPLE_TEAM_ID: 'BRANDTEAM',
-            GH_TOKEN: 'brand-token',
-            GOOGLE_ANALYTICS_SECRET: 'desktop-stream',
-          });
-        } finally {
-          fs.rmSync(brand, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'collectEnvSecrets: a target .env overrides the brand root per key (#678)',
-      run: (ctx) => {
-        const { brand, target } = tmpBrand({
-          brandEnv: 'GH_TOKEN=brand-token\nAPPLE_TEAM_ID=BRANDTEAM\n',
-          targetEnv: 'APPLE_TEAM_ID=TARGETTEAM\nCSC_KEY_PASSWORD=target-pass\n',
-        });
-
-        try {
-          ctx.expect(pushSecrets.collectEnvSecrets(target)).toEqual({
-            APPLE_TEAM_ID: 'TARGETTEAM',
-            CSC_KEY_PASSWORD: 'target-pass',
-            GH_TOKEN: 'brand-token',
-          });
-        } finally {
-          fs.rmSync(brand, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'collectEnvSecrets: --only narrows the composed set',
-      run: (ctx) => {
-        const { brand, target } = tmpBrand({ brandEnv: 'GH_TOKEN=brand-token\nAPPLE_TEAM_ID=BRANDTEAM\n' });
-
-        try {
-          ctx.expect(pushSecrets.collectEnvSecrets(target, { only: 'GH_TOKEN' })).toEqual({ GH_TOKEN: 'brand-token' });
-        } finally {
-          fs.rmSync(brand, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'fileValueResolver: a plain string travels as itself, a path that names no file too',
-      run: (ctx) => {
-        const resolve = pushSecrets.fileValueResolver({ targetDir: '/tmp' });
-
-        ctx.expect(resolve('plain-string-value', 'CSC_KEY_PASSWORD')).toBe('plain-string-value');
-        // Path-shaped but nowhere on disk: it is a string, not a certificate.
-        ctx.expect(resolve('config/certs/does-not-exist.p12', 'CSC_LINK')).toBe('config/certs/does-not-exist.p12');
-      },
-    },
-    {
-      name: 'fileValueResolver: an existing file travels as base64 — absolute, target-relative, or brand-relative',
-      run: (ctx) => {
-        const { brand, target } = tmpBrand();
-
-        const absolute = path.join(brand, 'cert.p12');
-        fs.writeFileSync(absolute, Buffer.from('ABS'));
-        fs.mkdirSync(path.join(target, 'config', 'certs'), { recursive: true });
-        fs.writeFileSync(path.join(target, 'config', 'certs', 'target.pem'), Buffer.from('TARGET'));
-        fs.mkdirSync(path.join(brand, '.omega', 'secrets'), { recursive: true });
-        fs.writeFileSync(path.join(brand, '.omega', 'secrets', 'brand-cert.p8'), Buffer.from('BRAND'));
-
-        try {
-          const resolve = pushSecrets.fileValueResolver({ targetDir: target });
-
-          ctx.expect(resolve(absolute, 'CSC_LINK')).toBe(Buffer.from('ABS').toString('base64'));
-          ctx.expect(resolve('config/certs/target.pem', 'CSC_LINK')).toBe(Buffer.from('TARGET').toString('base64'));
-          // Brand-level material: the path is relative to the BRAND root, which
-          // the target root does not hold.
-          ctx.expect(resolve('.omega/secrets/brand-cert.p8', 'APPLE_API_KEY')).toBe(Buffer.from('BRAND').toString('base64'));
-        } finally {
-          fs.rmSync(brand, { recursive: true, force: true });
-        }
-      },
-    },
-  ],
-});

package/dist/test/suites/build/resolve-signing-cert.test.js

@@ -1,342 +0,0 @@
-// resolve-signing-cert tests ([#28](https://github.com/Omega-JS-Stack/omega/issues/28)) —
-// the signing lookup ORDER: an explicit CSC_LINK wins, then the brand's
-// gitignored .omega/certificates/apple/ tree, then the company's tree (reached
-// through the brand's .omega/company.json stamp — a brand is NEVER physically
-// inside its company folder), then the Keychain.
-//
-// The Keychain branch is today's default and MUST stay it: with no cert in the
-// tree the resolver hands electron-builder nothing, exactly as before.
-//
-// The tree branch is only taken when the password actually OPENS the .p12 —
-// the adoption flow can pair an adopted legacy .p12 with a freshly generated
-// CSC_KEY_PASSWORD, and handing electron-builder an unopenable file is the
-// failure this lookup exists to avoid. Real openssl material is generated in a
-// temp dir for that check; nothing here is stubbed.
-
-const { execFileSync } = require('node:child_process');
-const { mkdtempSync } = require('node:fs');
-const { homedir, tmpdir } = require('node:os');
-const { join } = require('node:path');
-const jetpack = require('fs-jetpack');
-
-const resolveSigningCert = require('../../../utils/resolve-signing-cert.js');
-const defineCases = require('../../../vendor/devkit/test/define-cases.js');
-
-const CERT_REL = join('.omega', 'certificates', 'apple', 'certificates', 'DEVELOPER_ID_APPLICATION_G2.p12');
-const REAL_PASSWORD = 'fixture-p12-password';
-
-// One real self-signed key/cert exported to a .p12, the same way the manager's
-// certificate-manager.js exports one (`pkcs12 -export -legacy`).
-let realP12 = null;
-function realP12Bytes() {
-  if (realP12) {
-    return realP12;
-  }
-
-  const dir = mkdtempSync(join(tmpdir(), 'omega-signing-material-'));
-  execFileSync('openssl', [
-    'req', '-x509', '-nodes', '-newkey', 'rsa:2048',
-    '-keyout', join(dir, 'private.key'), '-out', join(dir, 'cert.cer'),
-    '-days', '2', '-subj', '/CN=Signing Fixture/C=US', '-outform', 'DER',
-  ], { stdio: 'pipe' });
-  execFileSync('openssl', [
-    'pkcs12', '-export', '-legacy',
-    '-inkey', join(dir, 'private.key'), '-in', join(dir, 'cert.cer'),
-    '-out', join(dir, 'fixture.p12'), '-passout', 'env:OMEGA_P12_PASSWORD',
-  ], { stdio: 'pipe', env: { ...process.env, OMEGA_P12_PASSWORD: REAL_PASSWORD } });
-
-  realP12 = jetpack.read(join(dir, 'fixture.p12'), 'buffer');
-  return realP12;
-}
-
-// A brand root with a desktop app under it, mirroring a real brand monorepo.
-// `cert: 'real'` writes an openable .p12; `cert: 'dummy'` writes bytes that are
-// not a certificate at all. A brand root ALWAYS carries a `.omega/` — that is
-// what identifies it to the walk.
-function stageBrand({ cert = null, root = null } = {}) {
-  const brandRoot = root || mkdtempSync(join(tmpdir(), 'omega-signing-'));
-  const targetRoot = join(brandRoot, 'targets', 'desktop');
-
-  jetpack.dir(targetRoot);
-  jetpack.dir(join(brandRoot, '.omega'));
-  if (cert === 'real') {
-    jetpack.write(join(brandRoot, CERT_REL), realP12Bytes());
-  } else if (cert === 'dummy') {
-    jetpack.write(join(brandRoot, CERT_REL), 'p12-bytes');
-  }
-
-  return { brandRoot, targetRoot };
-}
-
-// Stamp a brand as company-managed — the ONE membership rule
-// (@omega.js/config's readCompanyRoot / .omega/company.json).
-function stampCompany(brandRoot, companyRoot) {
-  jetpack.write(join(brandRoot, '.omega', 'company.json'), JSON.stringify({ root: companyRoot }));
-}
-
-module.exports = defineCases({
-  type: 'group',
-  layer: 'build',
-  description: 'resolve-signing-cert',
-  tests: [
-    {
-      name: 'no cert anywhere → keychain (today\'s default, unchanged)',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand();
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: {} });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.cscLink).toBe(null);
-      },
-    },
-    {
-      name: 'an explicit CSC_LINK always wins',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand({ cert: 'real' });
-
-        const resolved = resolveSigningCert({
-          projectRoot: targetRoot,
-          env: { CSC_LINK: 'config/certs/developer-id-application.p12', CSC_KEY_PASSWORD: REAL_PASSWORD },
-        });
-
-        ctx.expect(resolved.source).toBe('env');
-        ctx.expect(resolved.cscLink).toBe('config/certs/developer-id-application.p12');
-      },
-    },
-    {
-      name: 'the brand certificates tree is preferred over the keychain',
-      run: (ctx) => {
-        const { brandRoot, targetRoot } = stageBrand({ cert: 'real' });
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('certificates');
-        ctx.expect(resolved.cscLink).toBe(join(brandRoot, CERT_REL));
-      },
-    },
-    {
-      name: 'a stamped brand reaches its company tree — a SIBLING directory, never an ancestor',
-      run: (ctx) => {
-        // No nesting: the company workspace lives beside the brand, and the
-        // brand's .omega/company.json is the only thing pointing at it.
-        const { brandRoot, targetRoot } = stageBrand();
-        const companyRoot = mkdtempSync(join(tmpdir(), 'omega-company-'));
-        jetpack.write(join(companyRoot, CERT_REL), realP12Bytes());
-        stampCompany(brandRoot, companyRoot);
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('certificates');
-        ctx.expect(resolved.cscLink).toBe(join(companyRoot, CERT_REL));
-      },
-    },
-    {
-      name: 'the brand tree wins over the company tree',
-      run: (ctx) => {
-        const { brandRoot, targetRoot } = stageBrand({ cert: 'real' });
-        const companyRoot = mkdtempSync(join(tmpdir(), 'omega-company-'));
-        jetpack.write(join(companyRoot, CERT_REL), realP12Bytes());
-        stampCompany(brandRoot, companyRoot);
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.cscLink).toBe(join(brandRoot, CERT_REL));
-      },
-    },
-    {
-      name: 'an unstamped brand with no tree stays on the keychain — no company is guessed',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand();
-        // A company workspace exists on disk but nothing points at it.
-        const companyRoot = mkdtempSync(join(tmpdir(), 'omega-company-'));
-        jetpack.write(join(companyRoot, CERT_REL), realP12Bytes());
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.cscLink).toBe(null);
-      },
-    },
-    {
-      name: 'a stamp pointing at a company with no tree stays on the keychain',
-      run: (ctx) => {
-        const { brandRoot, targetRoot } = stageBrand();
-        stampCompany(brandRoot, mkdtempSync(join(tmpdir(), 'omega-company-')));
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('keychain');
-      },
-    },
-    {
-      name: 'a cert with no CSC_KEY_PASSWORD stays on the keychain — an unopenable .p12 would fail the build',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand({ cert: 'real' });
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: {} });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.cscLink).toBe(null);
-        ctx.expect(resolved.reason.includes('CSC_KEY_PASSWORD')).toBe(true);
-      },
-    },
-    {
-      name: 'a password that does NOT open the .p12 stays on the keychain',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand({ cert: 'real' });
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: 'not-the-password' } });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.cscLink).toBe(null);
-        ctx.expect(resolved.reason.includes('does not open')).toBe(true);
-      },
-    },
-    {
-      name: 'a file that is not a .p12 at all stays on the keychain',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand({ cert: 'dummy' });
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.reason.includes('does not open')).toBe(true);
-      },
-    },
-    {
-      name: 'an empty CSC_LINK is not an answer — the tree still wins',
-      run: (ctx) => {
-        const { brandRoot, targetRoot } = stageBrand({ cert: 'real' });
-
-        const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { CSC_LINK: '', CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('certificates');
-        ctx.expect(resolved.cscLink).toBe(join(brandRoot, CERT_REL));
-      },
-    },
-    {
-      name: 'a tree AT the home directory never signs a build (the ~/.omega overlay)',
-      run: (ctx) => {
-        // ~/.omega is a real personal overlay on developer machines. A stand-in
-        // home carries the tree here; without the bound the walk would take it.
-        const fakeHome = mkdtempSync(join(tmpdir(), 'omega-fake-home-'));
-        const targetRoot = join(fakeHome, 'brand', 'targets', 'desktop');
-        jetpack.dir(targetRoot);
-        jetpack.write(join(fakeHome, CERT_REL), realP12Bytes());
-
-        const resolved = resolveSigningCert({
-          projectRoot: targetRoot,
-          env: { CSC_KEY_PASSWORD: REAL_PASSWORD },
-          homeDir: fakeHome,
-        });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.cscLink).toBe(null);
-      },
-    },
-    {
-      name: 'a tree ABOVE the home directory is out of bounds too',
-      run: (ctx) => {
-        const above = mkdtempSync(join(tmpdir(), 'omega-above-home-'));
-        const fakeHome = join(above, 'home');
-        const targetRoot = join(fakeHome, 'brand', 'targets', 'desktop');
-        jetpack.dir(targetRoot);
-        jetpack.write(join(above, CERT_REL), realP12Bytes());
-
-        const resolved = resolveSigningCert({
-          projectRoot: targetRoot,
-          env: { CSC_KEY_PASSWORD: REAL_PASSWORD },
-          homeDir: fakeHome,
-        });
-
-        ctx.expect(resolved.source).toBe('keychain');
-      },
-    },
-    {
-      name: 'a tree BELOW home still resolves — the bound is the home dir, not "anywhere under it"',
-      run: (ctx) => {
-        const fakeHome = mkdtempSync(join(tmpdir(), 'omega-under-home-'));
-        const brandRoot = join(fakeHome, 'Developer', 'brand');
-        const targetRoot = join(brandRoot, 'targets', 'desktop');
-        jetpack.dir(targetRoot);
-        jetpack.write(join(brandRoot, CERT_REL), realP12Bytes());
-
-        const resolved = resolveSigningCert({
-          projectRoot: targetRoot,
-          env: { CSC_KEY_PASSWORD: REAL_PASSWORD },
-          homeDir: fakeHome,
-        });
-
-        ctx.expect(resolved.source).toBe('certificates');
-        ctx.expect(resolved.cscLink).toBe(join(brandRoot, CERT_REL));
-      },
-    },
-    {
-      name: 'a LibreSSL openssl (no -legacy flag) still verifies the cert — the check retries without the flag',
-      run: (ctx) => {
-        // Stock macOS /usr/bin/openssl is LibreSSL: it rejects the -legacy FLAG
-        // but reads legacy containers natively. A stub front presents exactly
-        // that behavior, delegating the flagless retry to the system binary.
-        const { brandRoot, targetRoot } = stageBrand({ cert: 'real' });
-        const stubDir = mkdtempSync(join(tmpdir(), 'omega-libressl-stub-'));
-        const stub = join(stubDir, 'openssl');
-        jetpack.write(stub, [
-          '#!/bin/sh',
-          'for a in "$@"; do',
-          '  if [ "$a" = "-legacy" ]; then echo "pkcs12: unknown option \'-legacy\'" >&2; exit 1; fi',
-          'done',
-          'if [ -x /usr/bin/openssl ]; then exec /usr/bin/openssl "$@"; fi',
-          'exit 0',
-          '',
-        ].join('\n'));
-        execFileSync('chmod', ['+x', stub]);
-
-        const realPath = process.env.PATH;
-        process.env.PATH = `${stubDir}:${realPath}`;
-        try {
-          const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { ...process.env, CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-          ctx.expect(resolved.source).toBe('certificates');
-          ctx.expect(resolved.cscLink).toBe(join(brandRoot, CERT_REL));
-        } finally {
-          process.env.PATH = realPath;
-        }
-      },
-    },
-    {
-      name: 'no openssl at all names the tooling, not the password, and stays on the keychain',
-      run: (ctx) => {
-        const { targetRoot } = stageBrand({ cert: 'real' });
-        const emptyDir = mkdtempSync(join(tmpdir(), 'omega-no-openssl-'));
-
-        const realPath = process.env.PATH;
-        process.env.PATH = emptyDir;
-        try {
-          const resolved = resolveSigningCert({ projectRoot: targetRoot, env: { ...process.env, CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-          ctx.expect(resolved.source).toBe('keychain');
-          ctx.expect(resolved.reason.includes('openssl is not available')).toBe(true);
-          ctx.expect(resolved.reason.includes('does not open')).toBe(false);
-        } finally {
-          process.env.PATH = realPath;
-        }
-      },
-    },
-    {
-      name: 'the default boundary is the REAL home — a project under it picks up no stray tree',
-      run: (ctx) => {
-        const projectRoot = mkdtempSync(join(homedir(), '.omega-signing-probe-'));
-
-        // No homeDir passed: the default must apply, and nothing in the real
-        // home (including its ~/.omega overlay) may be reached.
-        const resolved = resolveSigningCert({ projectRoot, env: { CSC_KEY_PASSWORD: REAL_PASSWORD } });
-
-        ctx.expect(resolved.source).toBe('keychain');
-        ctx.expect(resolved.cscLink).toBe(null);
-
-        jetpack.remove(projectRoot);
-      },
-    },
-  ],
-});