@omega.js/desktop 0.50.0 → 0.51.0

package/dist/utils/deliver-certs.js

@@ -1,69 +0,0 @@
-/**
- * Signing-artifact delivery on the desktop verbs
- * ([#678](https://github.com/Omega-JS-Stack/omega/issues/678)).
- *
- * The copy itself is devkit's (`@omega.js/devkit/certs`) — the ONE delivery
- * step, the same rules the manager's disperse writer rides. What lives here is
- * the desktop FRAMING: which root holds the signing tree, the brand block the
- * `{brand.id}` rules resolve from, and this framework's own voice.
- *
- * The source root is the COMPANY root when the brand is company-managed (the
- * `.omega/company.json` stamp @omega.js/config reads), the brand root
- * otherwise — the same rule disperse used, read through the same one reader.
- * A target outside a brand has no tree and no delivery.
- */
-const jetpack = require('fs-jetpack');
-const { findBrandRoot, readCompanyRoot, loadConfig } = require('../vendor/config/index.js');
-const { deliverCerts, certsSourceDir } = require('../vendor/devkit/certs.js');
-
-/**
- * The root holding `.omega/certificates/apple/` for a target: the company
- * workspace when one is stamped, else the brand root.
- *
- * @param {string} projectDir - The target root.
- * @returns {string|null} The source root, or null when the target is not in a brand.
- */
-function resolveSourceRoot(projectDir) {
-  const brandRoot = findBrandRoot(projectDir);
-  if (!brandRoot) return null;
-
-  return readCompanyRoot(brandRoot) || brandRoot;
-}
-
-/**
- * Deliver this target's Apple artifacts into its own certs dir, so signing
- * finds them on every verb rather than only after a manage run.
- *
- * Reports and returns; it never throws. A brandless target, a tree that was
- * never produced, or a missing artifact are all normal states — the signing
- * lookup and validate-certs are what judge them.
- *
- * @param {object} input
- * @param {string} input.projectDir - The target root.
- * @param {object} input.logger - `{ log, warn, error }`.
- * @returns {{ copied: string[], current: string[], missing: string[] }|null} null when there is no tree.
- */
-function deliverTargetCerts({ projectDir, logger }) {
-  const sourceRoot = resolveSourceRoot(projectDir);
-  if (!sourceRoot || !jetpack.exists(certsSourceDir(sourceRoot))) {
-    return null;
-  }
-
-  let brand = null;
-  try {
-    brand = loadConfig(projectDir, 'desktop').config.brand || null;
-  } catch (e) {
-    // Unloadable config — the `{brand.id}` rules simply resolve empty; the
-    // required rules below still deliver.
-  }
-
-  const result = deliverCerts({ sourceRoot, targetDir: projectDir, target: 'desktop', brand });
-
-  if (result.copied.length > 0) {
-    logger.log(`Delivered signing artifacts: ${result.copied.join(', ')}`);
-  }
-
-  return result;
-}
-
-module.exports = { deliverTargetCerts, resolveSourceRoot };

package/dist/utils/derive-signing-env.js

@@ -1,56 +0,0 @@
-// Where CSC_LINK and APPLE_API_KEY come from when nothing has answered yet
-// ([#678](https://github.com/Omega-JS-Stack/omega/issues/678)).
-//
-// The manager's disperse service used to stamp both into the target's .env as
-// target-relative paths, and only when the file was there. No machine writes a
-// target .env any more, so the build derives them instead: the artifacts are
-// delivered into config/certs/ by every verb (deliver-certs.js), and a delivered
-// file that nothing has pointed at IS the answer.
-//
-// Rules, per key: an env value that is already set always wins (an explicit
-// answer is never overridden), and a file that is not there sets nothing (an
-// unset key lets electron-builder's own skip/auto-discovery logic apply — the
-// same reason sanitize-signing-env.js deletes empty placeholders).
-//
-// APPLE_API_KEY's filename carries the key id, so an unset APPLE_API_KEY_ID
-// means there is no path to derive.
-
-const path = require('node:path');
-const jetpack = require('fs-jetpack');
-
-const CERTS_DIR = path.join('config', 'certs');
-const DEVELOPER_ID_APPLICATION = 'developer-id-application.p12';
-
-/**
- * Set the signing paths the delivered artifacts imply. Mutates `env`.
- *
- * @param {object} input
- * @param {object} input.env - The env map to derive into (the build's process env).
- * @param {string} input.projectDir - The target root (paths are written relative to it).
- * @returns {Array<{ key: string, value: string }>} What was derived — empty when nothing was.
- */
-function deriveSigningEnv({ env, projectDir }) {
-  const derived = [];
-
-  const candidates = [
-    { key: 'CSC_LINK', file: DEVELOPER_ID_APPLICATION },
-    { key: 'APPLE_API_KEY', file: env.APPLE_API_KEY_ID ? `AuthKey_${env.APPLE_API_KEY_ID}.p8` : null },
-  ];
-
-  for (const { key, file } of candidates) {
-    if (!file) continue;
-    if (typeof env[key] === 'string' && env[key].trim() !== '') continue;
-
-    const relative = path.join(CERTS_DIR, file);
-    if (!jetpack.exists(path.join(projectDir, relative))) continue;
-
-    env[key] = relative;
-    derived.push({ key, value: relative });
-  }
-
-  return derived;
-}
-
-module.exports = deriveSigningEnv;
-module.exports.CERTS_DIR = CERTS_DIR;
-module.exports.DEVELOPER_ID_APPLICATION = DEVELOPER_ID_APPLICATION;

package/dist/utils/resolve-signing-cert.js

@@ -1,175 +0,0 @@
-// Where the macOS signing certificate comes from — the ONE lookup order.
-//
-//   1. CSC_LINK in the environment — an explicit answer always wins.
-//   2. The BRAND's gitignored signing tree:
-//      <brandRoot>/.omega/certificates/apple/certificates/DEVELOPER_ID_APPLICATION_G2.p12
-//      The brand root is the nearest directory at or above the target carrying a
-//      `.omega/`. The manager's disperse service also copies this material into
-//      each app's config/certs/; this lookup is the portable/CI path that needs
-//      no dispersal first.
-//   3. The COMPANY's tree, when the brand is company-managed. A brand is NEVER
-//      physically inside its company folder — membership is the
-//      `.omega/company.json` stamp at the brand root, read through
-//      @omega.js/config's readCompanyRoot (the ecosystem's ONE company rule; no
-//      second reader lives here). The stamp's target is used as given: it is
-//      explicit config, not discovery, so the home bound below does not apply to it.
-//   4. The macOS Keychain — electron-builder's own identity auto-discovery,
-//      which is what happens when nothing sets CSC_LINK.
-//
-// Keychain stays the DEFAULT for local signed builds: a tree with no cert (every
-// setup that predates the certificates service) resolves to it untouched. Two
-// further conditions keep it there rather than handing electron-builder a file
-// it cannot use:
-//   - no CSC_KEY_PASSWORD (it comes from the .env cascade, never from config), or
-//   - a password that does not OPEN the .p12. An unopenable .p12 fails the build
-//     outright — worse than today's behavior. The check is the read-side twin of
-//     how the manager EXPORTS one (openssl `pkcs12 -legacy`; the legacy provider
-//     reads modern containers too).
-//
-// The brand-root walk stops BELOW the home directory: `~/.omega` is a real
-// personal overlay on developer machines, and a stray tree there must never sign
-// every build.
-
-const { execFileSync } = require('node:child_process');
-const { homedir } = require('node:os');
-const { dirname, join } = require('node:path');
-const jetpack = require('fs-jetpack');
-const { readCompanyRoot } = require('../vendor/config/index.js');
-
-const OMEGA_DIR = '.omega';
-const CERT_REL = join(OMEGA_DIR, 'certificates', 'apple', 'certificates', 'DEVELOPER_ID_APPLICATION_G2.p12');
-
-/**
- * The brand root a target belongs to: the nearest directory at or above it
- * carrying a `.omega/`. Stops below the home directory.
- *
- * @param {string} from - Directory to start walking up from
- * @param {string} homeDir - Boundary: this directory and everything above never count
- * @returns {string|null}
- */
-function findBrandRoot(from, homeDir) {
-  let dir = from;
-
-  while (true) {
-    // The home directory itself — and everything above it — is out of bounds.
-    if (dir === homeDir) {
-      return null;
-    }
-
-    if (jetpack.exists(join(dir, OMEGA_DIR)) === 'dir') {
-      return dir;
-    }
-
-    const parent = dirname(dir);
-    if (parent === dir) {
-      return null;
-    }
-    dir = parent;
-  }
-}
-
-/**
- * The signing certificate a root holds, if any.
- *
- * @param {string|null} root
- * @returns {string|null} - Absolute path to the .p12, or null
- */
-function certificateIn(root) {
-  if (!root) {
-    return null;
-  }
-
-  const candidate = join(root, CERT_REL);
-  return jetpack.exists(candidate) === 'file' ? candidate : null;
-}
-
-/**
- * Does this password actually open the container?
- *
- * Two openssl families answer differently: OpenSSL 3 needs `-legacy` to read
- * the legacy-format containers the manager exports (macOS `security import`
- * needs that format), while stock macOS /usr/bin/openssl is LibreSSL, which
- * rejects the `-legacy` FLAG but reads legacy containers natively. A flag
- * rejection is retried without it; only a real password/container failure
- * counts as "does not open".
- *
- * @param {string} p12Path - Path to the .p12
- * @param {string} password - Candidate password
- * @returns {{ opens: boolean, tooling?: string }} - tooling set when openssl
- *   itself was unavailable/unusable, so the caller can say so instead of
- *   blaming the password
- */
-function opensWith(p12Path, password) {
-  // Password rides an env var — never argv, never a shell string.
-  const run = (args) => execFileSync(
-    'openssl',
-    ['pkcs12', ...args, '-in', p12Path, '-nokeys', '-noout', '-passin', 'env:OMEGA_P12_PASSWORD'],
-    { stdio: 'pipe', env: { ...process.env, OMEGA_P12_PASSWORD: password } },
-  );
-
-  try {
-    run(['-legacy']);
-    return { opens: true };
-  } catch (error) {
-    if (error.code === 'ENOENT') {
-      return { opens: false, tooling: 'openssl is not available' };
-    }
-
-    if (String(error.stderr || '').includes('unknown option')) {
-      try {
-        run([]);
-        return { opens: true };
-      } catch (retryError) {
-        if (retryError.code === 'ENOENT') {
-          return { opens: false, tooling: 'openssl is not available' };
-        }
-        return { opens: false };
-      }
-    }
-
-    return { opens: false };
-  }
-}
-
-/**
- * Resolve which certificate source a signed build should use.
- *
- * @param {object} options
- * @param {string} options.projectRoot - The desktop app's root
- * @param {object} [options.env] - Environment to read (default process.env)
- * @param {string} [options.homeDir] - Walk boundary (default os.homedir())
- * @returns {{ source: 'env'|'certificates'|'keychain', cscLink: string|null, reason: string }}
- */
-function resolveSigningCert({ projectRoot, env = process.env, homeDir = homedir() }) {
-  const cscLink = typeof env.CSC_LINK === 'string' ? env.CSC_LINK.trim() : '';
-
-  if (cscLink) {
-    return { source: 'env', cscLink, reason: 'CSC_LINK is set' };
-  }
-
-  // The brand's own tree first, then the company's — reached ONLY through the
-  // brand's .omega/company.json stamp, never by walking up into a parent folder.
-  const brandRoot = findBrandRoot(projectRoot, homeDir);
-  const found = certificateIn(brandRoot) || certificateIn(brandRoot && readCompanyRoot(brandRoot));
-
-  if (!found) {
-    return { source: 'keychain', cscLink: null, reason: 'no .omega/certificates signing tree — using Keychain identity discovery' };
-  }
-
-  if (!env.CSC_KEY_PASSWORD) {
-    return { source: 'keychain', cscLink: null, reason: `found ${found} but CSC_KEY_PASSWORD is unset — using Keychain identity discovery` };
-  }
-
-  const check = opensWith(found, env.CSC_KEY_PASSWORD);
-  if (check.tooling) {
-    return { source: 'keychain', cscLink: null, reason: `${check.tooling} — cannot verify ${found}; using Keychain identity discovery` };
-  }
-  if (!check.opens) {
-    return { source: 'keychain', cscLink: null, reason: `CSC_KEY_PASSWORD does not open ${found} — using Keychain identity discovery` };
-  }
-
-  return { source: 'certificates', cscLink: found, reason: 'signing certificate from the brand .omega/certificates tree' };
-}
-
-module.exports = resolveSigningCert;
-module.exports.CERT_REL = CERT_REL;

package/dist/vendor/config/desktop-artifacts.js

@@ -1,110 +0,0 @@
-/**
- * @omega.js/config desktop-artifacts — the SINGLE naming rule for a desktop
- * target's release assets ([#620](https://github.com/Omega-JS-Stack/omega/issues/620)).
- *
- * Two readers, one rule: @omega.js/desktop's `gulp/build-config` writes these
- * names into `dist/electron-builder.yml`'s artifactName templates, and
- * [site-global.js](site-global.js) derives the website's direct-download URLs
- * from them (`<releasesUrl>/download/<name>`). A second spelling anywhere is a
- * dead download button on a live site, so the derivation lives here and both
- * sides call it.
- *
- * Names carry NO version. That is the whole point: GitHub's
- * `/releases/latest/download/<asset>` only resolves when the asset name is the
- * same in every release, so releasing a desktop version never touches the
- * website and the published URLs never change. electron-updater is unaffected —
- * it reads the feed files (`latest-mac.yml`, `latest.yml`), which name whatever
- * artifact the build produced.
- *
- * Nothing puts an arch back into a name that omits one: electron-builder's
- * macro expander only REPLACES a `${arch}` token where it appears. So these
- * names support exactly the default build — a UNIVERSAL mac, a SINGLE linux
- * arch, and windows' multi-arch NSIS installer (which merges every arch into
- * one file anyway). @omega.js/desktop's build-config refuses any other arch set
- * rather than let two builds collide on one name; per-arch names are a future
- * additive change.
- */
-
-// Every artifact a release publishes as a user-facing download, per platform,
-// in the order the platform offers them — the FIRST is the platform's default
-// (`/download/<platform>` leads with it, legacy UJM parity). The artifact keys
-// ARE the website's URL vocabulary (`/download/<platform>/<artifact>`).
-//
-// Deliberately absent: the mac auto-update ZIP (electron-updater fetches it
-// from the feed; nobody links it) and the snap (the Snap Store publishes it,
-// so it is never a release asset).
-const DESKTOP_ARTIFACTS = {
-  mac:     { universal: { ext: 'dmg' } },
-  windows: { universal: { ext: 'exe' } },
-  linux:   { debian: { ext: 'deb' }, appimage: { ext: 'AppImage' } },
-};
-
-/**
- * The product name a desktop target packages under — the same derivation
- * @omega.js/desktop's `Manager.getConfig()` applies (`app.productName` ←
- * `brand.name`), so the website reads the name the packager actually used.
- *
- * @param {object} config - Desktop-shaped config (`{ app, brand }`).
- * @returns {string} Product name ('' when neither key resolves).
- */
-function desktopProductName(config) {
-  return config?.app?.productName || config?.brand?.name || '';
-}
-
-/**
- * A product name reduced to filename-safe characters. electron-builder's
- * `${productName}` keeps spaces, which become dots in NSIS output and behave
- * inconsistently across targets; hyphens are consistent everywhere.
- *
- * @param {string} productName - Raw product name ("Deployment Playground").
- * @returns {string} Sanitized name ("Deployment-Playground"), '' when empty.
- */
-function sanitizeProductName(productName) {
-  return String(productName || '')
-    .replace(/[^A-Za-z0-9._-]+/g, '-')
-    .replace(/-+/g, '-')
-    .replace(/^-|-$/g, '');
-}
-
-/**
- * One artifact's versionless filename: `<Product>-<platform>-<artifact>.<ext>`.
- *
- * @param {string} productName - Raw product name (sanitized here).
- * @param {string} platform - Platform key (mac, windows, linux).
- * @param {string} artifact - Artifact key (universal, debian, appimage, …).
- * @param {string} [ext] - Extension override — pass electron-builder's literal
- *   `${ext}` to get a TEMPLATE that covers every target sharing the platform's
- *   fallback (mac's dmg + auto-update zip).
- * @returns {string} The filename ('' with no product name to build it from).
- */
-function desktopArtifactName(productName, platform, artifact, ext) {
-  const product = sanitizeProductName(productName);
-  const extension = ext || DESKTOP_ARTIFACTS[platform]?.[artifact]?.ext;
-  if (!product || !extension) return '';
-
-  return `${product}-${platform}-${artifact}.${extension}`;
-}
-
-/**
- * Every published artifact's filename, keyed platform → artifact, in offer
- * order.
- *
- * @param {string} productName - Raw product name.
- * @returns {object} `{ mac: { universal: 'App-mac-universal.dmg' }, … }`, or
- *   `{}` when there is no product name to derive from.
- */
-function desktopArtifactNames(productName) {
-  if (!sanitizeProductName(productName)) return {};
-
-  const names = {};
-  for (const [platform, artifacts] of Object.entries(DESKTOP_ARTIFACTS)) {
-    names[platform] = {};
-    for (const artifact of Object.keys(artifacts)) {
-      names[platform][artifact] = desktopArtifactName(productName, platform, artifact);
-    }
-  }
-
-  return names;
-}
-
-module.exports = { DESKTOP_ARTIFACTS, desktopProductName, sanitizeProductName, desktopArtifactName, desktopArtifactNames };

package/dist/vendor/config/instances.js

@@ -1,208 +0,0 @@
-/**
- * Multi-instance targets — the normalization trick and the target-dir mapping
- * (_attic/plans/multi-instance-targets.md, shape ratified by Ian 2026-07-20).
- *
- * `targets.<type>` may be an object (today's single-instance shape) or an
- * ARRAY of id'd instance entries. Normalization is the whole mechanism: a
- * single object normalizes to `[{ id: 'main', ...entry }]` internally, so
- * every consumer of target config iterates instances and the single-instance
- * world is just length 1 — zero breaking change for existing brands.
- *
- * Target-dir mapping: the `main` instance (or the single-object form) lives in
- * `targets/<canonical dir>` (targets/website, unchanged); any other id lives in
- * `targets/<canonical dir>-<id>` (targets/website-admin). The inverse walk resolves
- * WHICH instance a target dir is, and loadConfig/composeTargetConfig use it to
- * pick the instance entry as the target layer of the merge chain.
- *
- * This module is the ONE home for the instance iteration mechanism (mirrored-
- * implementation rule) — frameworks and the manager import it, never copy it.
- * The canonical dir names moved here from the manager's config.js so the
- * mapping and its inverse walk share a single SSOT.
- */
-
-const path = require('node:path');
-
-const { isPlainObject } = require('./merge.js');
-
-// targets/<dir> → target mapping when the target dir doesn't declare its target
-// in its own omega.json5. Exact match or `<name>-<id>` suffix (targets/website-admin →
-// web, instance admin). Moved here from @omega.js/manager's config.js (which
-// re-exports it) so the target-dir walk has one home.
-const DIR_TARGETS = {
-  website: 'web',
-  backend: 'backend',
-  desktop: 'desktop',
-  extension: 'extension',
-  mobile: 'mobile',
-};
-
-// Inverse: canonical target dir per target (targets/website for web, …)
-const TARGET_DIRS = Object.fromEntries(
-  Object.entries(DIR_TARGETS).map(([dir, target]) => [target, dir]),
-);
-
-// The conventional primary instance id — the single-object form normalizes
-// to it, and it maps to the canonical (un-suffixed) target dir.
-const MAIN_INSTANCE = 'main';
-
-// Instance ids are target-dir suffixes, so they must be dir-safe slugs
-const INSTANCE_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
-
-/**
- * Normalize a `targets.<type>` entry to the instances array. The whole trick:
- * a single object becomes `[{ id: 'main', ...entry }]` (an authored `id`
- * inside the object wins); an array passes through as-is — the validator, not
- * this function, enforces that array entries carry ids.
- * @param {object|Array|null|undefined} entry - The raw targets.<type> value.
- * @returns {Array<object>} Instance entries (shallow copies); [] when absent.
- */
-function normalizeTargetInstances(entry) {
-  if (entry === undefined || entry === null) return [];
-  if (Array.isArray(entry)) return entry.map((instance) => (isPlainObject(instance) ? { ...instance } : instance));
-  return [{ id: MAIN_INSTANCE, ...entry }];
-}
-
-/**
- * Target dir name → instance id for a target. The inverse walk of the mapping:
- * the canonical dir (targets/website) is `main`; a `<canonical>-<id>` suffix
- * names the instance (targets/website-admin → admin). Unconventional dir names
- * resolve to `main` — today's behavior for dirs like targets/api.
- * @param {string} dirName - The target directory basename.
- * @param {string} target - Canonical target name ('web', 'backend', ...).
- * @returns {string} The instance id.
- */
-function instanceIdFromDirName(dirName, target) {
-  const canonical = TARGET_DIRS[target] || target;
-  if (dirName.startsWith(`${canonical}-`)) {
-    return dirName.slice(canonical.length + 1);
-  }
-  return MAIN_INSTANCE;
-}
-
-/**
- * Instance id → its target dir name (`main` → the canonical dir, anything else
- * → `<canonical>-<id>`).
- * @param {string} target - Canonical target name.
- * @param {string} id - Instance id.
- * @returns {string} The target directory basename.
- */
-function instanceTargetDir(target, id) {
-  const canonical = TARGET_DIRS[target] || target;
-  return id === MAIN_INSTANCE ? canonical : `${canonical}-${id}`;
-}
-
-/**
- * Resolve THIS project dir's instance id for a target: TARGET_SUBDIR dirs
- * (functions/, dist/) normalize up to their target root, and only targets inside a
- * brand monorepo resolve through the dir-name walk — a standalone project
- * (whose dir name is arbitrary) is always `main`.
- * @param {string} projectDir - Target root (or one of its TARGET_SUBDIRS).
- * @param {string} target - Canonical target name.
- * @returns {string} The instance id.
- */
-function targetInstance(projectDir, target) {
-  // Local require to avoid a load-time cycle (load.js requires this module)
-  const { findBrandRoot, TARGET_SUBDIRS } = require('./load.js');
-
-  let targetRoot = path.resolve(projectDir);
-  if (TARGET_SUBDIRS.includes(path.basename(targetRoot))) {
-    targetRoot = path.dirname(targetRoot);
-  }
-
-  if (!findBrandRoot(targetRoot)) return MAIN_INSTANCE;
-  return instanceIdFromDirName(path.basename(targetRoot), target);
-}
-
-/**
- * The merge-chain layer for one instance: the single-object form applies to
- * EVERY target dir of the type (today's semantics, unchanged); the array form
- * applies only to the exact-id match — no match means no instance layer
- * (shared config alone). The `id` key is bookkeeping, never config — it is
- * stripped from the returned entry.
- * @param {object|Array|null|undefined} entry - The raw targets.<type> value.
- * @param {string} instanceId - The instance to resolve.
- * @returns {object|null} The instance's merge layer, or null.
- */
-function resolveInstanceEntry(entry, instanceId) {
-  if (entry === undefined || entry === null) return null;
-  if (!Array.isArray(entry)) return entry;
-
-  const hit = entry.find((instance) => isPlainObject(instance) && instance.id === instanceId);
-  if (!hit) return null;
-
-  const { id, ...rest } = hit;
-  return rest;
-}
-
-/**
- * Deterministic dev-port offset for an instance: its position in the
- * normalized instances array (main-or-object form = 0), so N instances get N
- * side-by-side ports off the same classic base. Unknown ids offset 0 — the
- * N7 bump-if-taken allocator still guarantees a free port.
- * @param {object|Array|null|undefined} entry - The raw targets.<type> value.
- * @param {string} instanceId - The instance id.
- * @returns {number} Zero-based offset.
- */
-function instancePortOffset(entry, instanceId) {
-  const index = normalizeTargetInstances(entry).findIndex((instance) => isPlainObject(instance) && instance.id === instanceId);
-  return index > 0 ? index : 0;
-}
-
-/**
- * The host `brand.url` names, EXACTLY as it states it: a `www.` label is kept
- * (a www brand is a www brand), any path is dropped, a port survives. A
- * scheme-less value is read as https.
- * @param {string} url - A brand URL.
- * @returns {string} The host, or '' when the value is not a URL.
- */
-function brandHost(url) {
-  try {
-    return new URL(url.includes('://') ? url : `https://${url}`).host;
-  } catch {
-    return '';
-  }
-}
-
-/**
- * The live URL of an instance: its entry's `url` (the spec's per-instance
- * key), an instance-scoped `brand.url` override, then, for every id but
- * `main`, the id AS A SUBDOMAIN of the brand host (#588), and the
- * brand-shared brand.url for `main`. The manager's per-instance live checks,
- * the resolved config's top-level `url` and site-global all read this.
- *
- * The id-is-the-subdomain default is what makes `web: [{ id: 'main' },
- * { id: 'admin' }]` a complete declaration; an explicit `url` overrides it for
- * a custom host (`{ id: 'store', url: 'https://shop.acme.com' }`). Nothing is
- * half-derived: no usable brand.url means null for every id, never
- * `https://admin.`.
- * @param {object|Array|null|undefined} entry - The raw targets.<type> value.
- * @param {string} instanceId - The instance id.
- * @param {object} config - The (resolved) config carrying brand.url.
- * @returns {string|null} The instance's URL, or null when none is known.
- */
-function resolveInstanceUrl(entry, instanceId, config) {
-  const instance = resolveInstanceEntry(entry, instanceId);
-  if (instance?.url) return instance.url;
-  if (instance?.brand?.url) return instance.brand.url;
-
-  const brandUrl = config?.brand?.url;
-  if (!brandUrl) return null;
-  if (instanceId === MAIN_INSTANCE) return brandUrl;
-
-  const host = brandHost(brandUrl);
-  return host ? `https://${instanceId}.${host}` : null;
-}
-
-module.exports = {
-  DIR_TARGETS,
-  TARGET_DIRS,
-  MAIN_INSTANCE,
-  INSTANCE_ID_PATTERN,
-  normalizeTargetInstances,
-  instanceIdFromDirName,
-  instanceTargetDir,
-  targetInstance,
-  resolveInstanceEntry,
-  instancePortOffset,
-  resolveInstanceUrl,
-};