@omega.js/desktop 0.50.0 → 0.51.0

package/dist/defaults/config/omega.json5

@@ -22,6 +22,16 @@
     },
   },
 
+  // Where this brand's code and artifacts live (#883): ONE org, and every repo
+  // derives from `<brand.id>-<role>`: `<brand.id>-omega` (source),
+  // `<brand.id>-releases` (the public artifact channel this app's updater
+  // polls), `<brand.id>-<web target>` (a built site). No repo NAME is ever
+  // typed. Uncomment and name the org to address them.
+  // repo: {
+  //   provider: 'github',
+  //   org: 'MyOrg',
+  // },
+
   monitoring: {
     providers: {
       sentry: {
@@ -84,13 +94,19 @@
     appearance: 'system',
   },
 
-  // ── Target-scoped config. Key presence = "this brand enables this target". ──
-  // For a standalone desktop repo only the `desktop` entry exists; in a brand
-  // monorepo the brand-level omega.json5 lists every enabled target.
+  // ── Target-scoped config. Every key is a target NAME (the folder
+  // targets/<name> in a brand monorepo) and every entry declares its framework
+  // `type`. For a standalone desktop repo only the `desktop` entry exists; in a
+  // brand monorepo the brand-level omega.json5 lists every declared target.
   targets: {
     desktop: {
+      type: 'desktop',
+
       // App-level metadata — universal cross-platform fields. @omega.js/desktop auto-derives sensible
-      // defaults from the BRAND: `appId` ← reverse-domain of `brand.url`
+      // defaults from the BRAND: `appId` ← `certificates.providers.apple.bundleIdPrefix`
+      // plus `brand.id` with its dashes as dots (`com.example` + `my-app` →
+      // `com.example.my.app`), the same id the certificates service registers.
+      // No prefix declared → reverse-domain of `brand.url`
       // (`https://foo.example.com` → `com.example.foo`; no url → `app.<brand.id>`),
       // `productName` ← `brand.name`, `copyright` ← `© <year>, <brand.name>`.
       // Override any of these explicitly only if you must.
@@ -112,7 +128,7 @@
         darkModeSupport: true,                // mac honors via NSRequiresAquaSystemAppearance; win/linux ignore
         // Icons are convention-only. Drop PNGs at:
         //   config/icons/global/<slot>.png       — universal default for all platforms
-        //   config/icons/macos/<slot>.png        — macOS override (beats global)
+        //   config/icons/mac/<slot>.png          : macOS override (beats global)
         //   config/icons/windows/<slot>.png      — Windows override
         //   config/icons/linux/<slot>.png        — Linux override (otherwise falls back to global → windows)
         // Slots: icon, tray (mac+win+linux); dmg (mac-only).
@@ -120,14 +136,26 @@
         // macOS tray must be 32×32; @omega.js/desktop renames the dist output to trayTemplate.png for the
         // OS dark-mode auto-inversion magic.
       },
-      // Per-platform install/distribution config. The keys here map directly to the same
-      // electron-builder concepts (`mac.target`, `win.target`, `linux.target`) but @omega.js/desktop owns
-      // the actual target list (dmg+zip on mac, nsis on win, deb+AppImage on linux) so
-      // auto-update keeps working — see docs/installer-options.md for why. Each block
-      // exposes only the knobs that exist for that platform — no cross-platform analog
-      // for any of these.
+      // What this app SHIPS, plus each platform's install knobs (#867). The
+      // vocabulary is the client's: mac, windows, linux (never macos, never win).
+      //
+      // `formats` is the declaration: presence = enabled, every format below is
+      // ON by default, and the only way to drop one is `false` (e.g.
+      // `snap: false`). Per-format settings live inside the format. The keys
+      // beside `formats` are install knobs that map onto the same
+      // electron-builder concepts (`mac.target`, `win.target`, `linux.target`),
+      // but @omega.js/desktop owns the actual target list so auto-update keeps
+      // working (see docs/installer-options.md for why). Each block exposes only
+      // the knobs that exist for that platform: there is no cross-platform
+      // analog for any of these.
       platforms: {
         mac: {
+          // The disk image the site's /download/mac/dmg hands over. The
+          // auto-update zip is not a format: electron-updater fetches it from
+          // the feed and nobody links it, so the mac leg always builds it.
+          formats: {
+            dmg: {},
+          },
           arch: ['universal'],   // universal binary (x64 + arm64 lipo'd) — one .dmg/.zip for both
           // Entitlements override map. @omega.js/desktop ships sensible defaults (allow-jit,
           // allow-unsigned-executable-memory, disable-library-validation, network.client/server,
@@ -148,7 +176,12 @@
             entitlementsInherit: null,
           },
         },
-        win: {
+        windows: {
+          // The one installer, at /download/windows/nsis. NSIS merges every
+          // arch below into a single .exe.
+          formats: {
+            nsis: {},
+          },
           arch: ['x64', 'ia32'],          // 64-bit + 32-bit (single multi-arch NSIS installer)
           oneClick:           true,        // no installer wizard, just installs immediately
           desktopShortcut:    true,
@@ -168,25 +201,28 @@
           },
         },
         linux: {
-          arch: ['x64'],                   // amd64; ia32 is essentially extinct on Linux
-          // Snap publishing — enabled by default. Adds a `snap` target to the linux build
-          // and auto-publishes to the Snap Store on release. Requires SNAPCRAFT_STORE_CREDENTIALS
-          // in your `.env` (run `snapcraft export-login -` locally to mint, then `mgr push-secrets`
-          // flows it to GH Actions). Set enabled:false here to skip the snap target entirely.
-          snap: {
-            enabled:     true,
-            confinement: 'strict',
-            grade:       'stable',
-            autoStart:   true,
-            channels:    ['stable'],
+          formats: {
+            deb: {},                       // /download/linux/deb (needs brand.url + brand.contact.email)
+            appimage: {},                  // /download/linux/appimage
+            // Snap publishing, on by default: adds a `snap` target to the linux
+            // build and publishes to the Snap Store on release. Needs
+            // SNAPCRAFT_STORE_CREDENTIALS in your `.env` (the manage walk asks
+            // for it; `snapcraft export-login -` mints it, then `omega deploy`
+            // flows it to GH Actions). `snap: false` drops it.
+            snap: {
+              confinement: 'strict',
+              grade:       'stable',
+              autoStart:   true,
+              channels:    ['stable'],
+            },
           },
+          arch: ['x64'],                   // amd64; ia32 is essentially extinct on Linux
         },
       },
       // Auto-updater (electron-updater wrapper). Feed URL is auto-derived from `releases` (below).
       // Set `OMEGA_DEV_UPDATE=available|unavailable|error` to simulate updates in dev.
       autoUpdate: {
         enabled:        true,
-        channel:        'latest',
         autoDownload:   true,
         startupDelayMs:      10000,      // 10s after whenReady → first check
         feedCheckIntervalMs: 3600000,    // 1h between feed polls (HTTP — keep slow)
@@ -234,17 +270,15 @@
       // Add a `windows: {}` block here only if you want to override defaults persistently.
 
       // Releases: the ONE public repo where built artifacts (and the auto-update feed) live.
-      // The app repo can stay private; this one MUST be public for unauthenticated downloads + auto-updates.
-      // Both keys default: repo is `<brand.id>-releases` and owner is the brand repo's owner, so the whole
-      // block can stay empty (`releases: {}`) and still address a repo.
+      // The source repo can stay private; this one is always public, for unauthenticated downloads + auto-updates.
+      // Nothing names it: it is always `<brand.id>-releases` under the top-level `repo.org`, so this block is
+      // a presence switch and nothing more (#883). An empty `releases: {}` addresses the repo in full.
       // `npx omega deploy`'s precheck auto-creates it if it doesn't exist (uses GH_TOKEN).
-      // Artifact names carry NO version (MyApp-mac-universal.dmg), so this repo also serves the marketing
-      // site: https://github.com/<owner>/<repo>/releases/latest/download/<asset> never changes across
-      // versions, and the website derives its download buttons from it. See docs/releasing.md.
+      // Artifact names carry NO version (MyApp-mac-dmg.dmg), so this repo also serves the marketing
+      // site: https://github.com/<org>/<brand.id>-releases/releases/latest/download/<asset> never changes
+      // across versions, and the website derives its download buttons from it. See docs/releasing.md.
       releases: {
         enabled: true,
-        // owner: null,             // null = the brand repo's owner
-        // repo:  'myapp-releases', // default: `<brand.id>-releases`
       },
       // Deep links: scheme is automatically `<brand.id>://...`. Built-in routes:
       //   auth/token  → @omega.js/client auth token handoff

package/dist/defaults/hooks/deploy/pre.js

@@ -0,0 +1,10 @@
+// Optional consumer extension hook: called by `omega deploy` on both lanes, after the local
+// scaffold and BEFORE the network precheck, the dispatch, or a local publish. No-op by default.
+// A dry run skips it.
+//
+// Use this for: resetting a release the deploy will recreate, last-mile validations, anything
+// that must happen before the publish reaches the release repo.
+
+module.exports = async (ctx) => {
+  // ctx = { manager, projectRoot, mode }
+};

package/dist/defaults/src/assets/scss/main.scss

@@ -4,11 +4,16 @@
 // Customize Classy theme variables here. See:
 // node_modules/@omega.js/desktop/dist/assets/themes/classy/_config.scss for all available variables.
 
+// The brand accent, generated from `brand.color` in config/omega.json5 by the
+// sass task. Deliberate divergence? Put a literal in its place below:
+//   $primary: #2563EB,      // in place of `brand.$primary`
+@use 'brand';
+
 @use 'omega-desktop' as * with (
   // ============================================
   // Brand Colors
   // ============================================
-  $primary: #2563EB,
+  $primary: brand.$primary,
   // $secondary: #6C757D,
 
   // ============================================
@@ -28,7 +33,12 @@
   // $border-radius: 0.5rem,
 );
 
+// The runtime --omega-accent ramp, the same light and dark families the web
+// target inlines into its <head>. It goes AFTER the framework import so it wins
+// the cascade over the token sheet's placeholders.
+@include brand.ramp;
+
 // ============================================
 // Custom Global Styles
 // ============================================
-// Add your project-specific styles below — applied on every page.
+// Add your project-specific styles below, applied on every page.

package/dist/defaults/src/integrations/tray/index.js

@@ -25,7 +25,7 @@ module.exports = ({ manager, tray }) => {
 
   // ───────── Examples (uncomment to use) ─────────
   //
-  // // Override the icon path (otherwise auto-resolved from config/icons/macos/tray.png).
+  // // Override the icon path (otherwise auto-resolved from config/icons/mac/tray.png).
   // // On macOS, the filename MUST end in `Template.png` for OS dark-mode auto-inversion.
   // tray.icon('src/assets/icons/my-trayTemplate.png');
   //

package/dist/gulp/main.js

@@ -1,4 +1,4 @@
-// Strip ELECTRON_RUN_AS_NODE — see bin/omega-desktop for the full story. Belt-and-suspenders
+// Strip ELECTRON_RUN_AS_NODE: see src/cli-run.js for the full story. Belt-and-suspenders
 // at the gulp boundary too because gulp can be invoked outside of mgr (e.g. `npx gulp build`).
 delete process.env.ELECTRON_RUN_AS_NODE;
 
@@ -15,10 +15,16 @@ const package = Manager.getPackage('main');
 const project = Manager.getPackage('project');
 const projectRoot = Manager.getRootPath('project');
 
-// Resolve the .env cascade from the project root (shell > app > brand > company).
-// `target` delivers the schema's `deliverAs` renames into process.env (#678);
-// gulp can be invoked outside the CLI (`npx gulp build`), so it asks here too.
-require('../vendor/config/index.js').loadEnv(projectRoot, { target: 'desktop' });
+// Resolve the .env cascade from the project root (shell > app > brand > company)
+// and derive the signing paths the brand's signing tree implies. gulp is its own
+// PROCESS (npm start invokes it with no CLI above it), so it asks the same
+// wrapper the CLI asks and gets the same answer
+// ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)). The load has to
+// precede the log tee (the tee reads the env it populates), so what it derived
+// is REPORTED below instead: the derived lines are what a CI signing failure is
+// diagnosed from, and they belong in build.log.
+const { loadDesktopEnv, reportSigningEnv } = require('../utils/load-env.js');
+const signingEnv = loadDesktopEnv(projectRoot);
 
 // Empty-string signing placeholders (CSC_LINK="" etc. from the .env template)
 // must read as UNSET — app-builder-lib only null-checks and would resolve ''
@@ -40,26 +46,8 @@ if (logFileEnv !== 'false' && logFileEnv !== '0') {
   logger.log(`Logs tee'd to ${logPath}`);
 }
 
-// Signing certificate lookup: explicit CSC_LINK → the brand's gitignored
-// .omega/certificates tree → the Keychain (the default, and what a tree-less
-// setup keeps getting). Runs AFTER the log tee so the chosen source and reason
-// land in build.log — the line a CI signing failure is diagnosed from.
-// See utils/resolve-signing-cert.js.
-const signingCert = require('../utils/resolve-signing-cert.js')({ projectRoot });
-if (signingCert.source === 'certificates') {
-  process.env.CSC_LINK = signingCert.cscLink;
-}
-logger.log(`Signing certificate: ${signingCert.source} (${signingCert.reason})`);
-
-// The signing paths the DELIVERED artifacts imply (#678): the manager's
-// disperse service used to stamp CSC_LINK / APPLE_API_KEY into the target's
-// .env; no machine writes a target .env any more, so an unset key whose file
-// sits in config/certs/ is derived here instead. Runs last: an explicit
-// answer, and the lookup above, always win. See utils/derive-signing-env.js.
-const derivedSigningKeys = require('../utils/derive-signing-env.js')({ env: process.env, projectDir: projectRoot });
-if (derivedSigningKeys.length) {
-  logger.log(`Derived signing env from the certs dir: ${derivedSigningKeys.map((entry) => `${entry.key}=${entry.value}`).join(', ')}`);
-}
+// What the env load derived, now that build.log is catching lines.
+reportSigningEnv(signingEnv, logger);
 
 logger.log('Starting...', argv);
 

package/dist/gulp/tasks/audit.js

@@ -20,7 +20,7 @@
 const path    = require('path');
 const jetpack = require('fs-jetpack');
 const Manager = new (require('../../build.js'));
-const { validateConfig, releasesRepo } = require('../../vendor/config/index.js');
+const { validateConfig, releasesRepo, hasOmegaConfig, loadConfig } = require('../../vendor/config/index.js');
 
 const logger = Manager.logger('audit');
 
@@ -41,6 +41,18 @@ module.exports = function audit(done) {
   const { errors: schemaErrors } = validateConfig(config, { target: 'desktop' });
   errors.push(...schemaErrors);
 
+  // ...and the validator's WARNINGS, which this task used to drop on the floor
+  // while reporting `0 warnings` ([#911](https://github.com/Omega-JS-Stack/omega/issues/911)).
+  // A key the schema does not declare is what a typo looks like, and the
+  // consumer has to see it at build time. They come off the LOAD, the same
+  // resolution `Manager.getConfig()` runs: loadConfig judges what the brand
+  // AUTHORED, before the loader fills its own resolved facts (`company.name`
+  // and friends) and before the build attaches `environment`.
+  const { warnings: configWarnings } = hasOmegaConfig(cwd)
+    ? loadConfig(cwd, 'desktop', { environment: Manager.getEnvironment() })
+    : { warnings: [] };
+  warnings.push(...configWarnings);
+
   // 2. File existence for paths the build references (not in schema because these are
   // tied to the build pipeline, not the config shape).
   fileMustExist('src/main.js',    'src/main.js');
@@ -49,11 +61,11 @@ module.exports = function audit(done) {
     // Icon must exist when packaging — dev runs fine with the default Electron icon.
     fileMustExist(config.brand.images?.icon, 'config.brand.images.icon');
   }
-  // Publishing needs an ADDRESS for the releases repo, not a hand-written name:
-  // @omega.js/config's releasesRepo defaults it to `<brand.id>-releases` under the
-  // brand repo owner, so only a missing owner (or brand.id) leaves it unaddressable.
-  if (Manager.isPublishMode() && config.releases?.enabled !== false && !releasesRepo(config).repo) {
-    errors.push('the releases repo is unaddressable: set repo.providers.github.org (or targets.desktop.releases.owner) and brand.id. The repo name defaults to "<brand.id>-releases"');
+  // Publishing needs an ADDRESS for the releases repo, and no repo name is ever
+  // typed: @omega.js/config's releasesRepo derives `<brand.id>-releases` under
+  // the brand's org, so only a missing org (or brand.id) leaves it unaddressable.
+  if (Manager.isPublishMode() && config.releases?.enabled !== false && !releasesRepo(config)) {
+    errors.push('the releases repo is unaddressable: set repo.org and brand.id. The repo is always "<brand.id>-releases" under that org');
   }
 
   // 3. Soft warnings — not fatal but worth surfacing.