@omega.js/desktop 0.52.0 → 0.54.0

package/dist/commands/lib/ensure-target.js

@@ -20,7 +20,8 @@
  *   peer dependencies installed when missing or behind (a satisfied target
  *                     installs nothing)
  *   defaults tree     src/defaults/** — copy-if-missing, marker merges for
- *                     .env/.gitignore/AGENTS.md, workflows re-rendered
+ *                     .env/.gitignore, workflows re-rendered
+ *   AGENTS.md         standalone only, through devkit's one builder
  *   locality          a WARNING when the framework is a `file:` link
  *
  * Everything here is copy-if-missing, marker-merge or write-if-changed. What
@@ -31,14 +32,16 @@
 const path = require('path');
 const jetpack = require('fs-jetpack');
 const version = require('wonderful-version');
-const Manager = new (require('../../build.js'));
+const build = require('../../build.js');
 const { ensurePeerDependencies, readProject } = require('./dependencies.js');
 const { renderSecretsBlock } = require('../../vendor/config/env-delivery.js');
 const { composeTargetWorkflows, renderInstallFirewall, renderInstallWorkspace } = require('../../vendor/devkit/ci-workflows.js');
 const { assertScaffoldable } = require('../../vendor/devkit/scaffold-guard.js');
+const { scaffoldAgentsMd } = require('../../vendor/devkit/agents-md.js');
+const { projectScripts } = require('../../vendor/devkit/verb-scripts.js');
 
-const logger = Manager.logger('ensure-target');
-const package = Manager.getPackage('main');
+const logger = build.logger('ensure-target');
+const package = build.getPackage('main');
 
 /**
  * Sync the consumer manifest: the omega verb scripts, the npm-private latch,
@@ -47,16 +50,13 @@ const package = Manager.getPackage('main');
  * Identical content is not a write (#590).
  */
 function setupScripts(projectDir, result) {
-  projectDir = projectDir || Manager.getRootPath('project');
+  projectDir = projectDir || build.getRootPath('project');
   result = result || { changed: [] };
 
   const project = readProject(projectDir);
 
-  project.scripts = project.scripts || {};
-
-  Object.keys(package.projectScripts || {}).forEach((key) => {
-    project.scripts[key] = package.projectScripts[key];
-  });
+  // The verb table's scripts for this framework, the manifest's declarations over them
+  project.scripts = { ...project.scripts, ...projectScripts(package) };
 
   // Electron consumer projects should not be published to npm
   project.private = true;
@@ -128,7 +128,7 @@ function checkNodeVersion(projectDir, requiredMajor, warn) {
  * @param {object} log - `{ log, warn, error }` handed to the engine.
  */
 async function copyDefaults(projectDir, engineLogger) {
-  projectDir = projectDir || Manager.getRootPath('project');
+  projectDir = projectDir || build.getRootPath('project');
   engineLogger = engineLogger || logger;
 
   const defaultsDir = path.resolve(__dirname, '..', '..', 'defaults');
@@ -195,18 +195,10 @@ async function copyDefaults(projectDir, engineLogger) {
       // material really lives, so a target keeps the explanation that matches
       // the ignore rules the scaffold just wrote, never an older one.
       'config/certs/README.md': { overwrite: true },
-      // The agent-docs chain (#63): AGENTS.md carries the content (marker-merged
-      // like .gitignore), CLAUDE.md is the one-line `@AGENTS.md` pointer — copied
-      // when missing by the `**/*` rule above, never clobbered.
-      'AGENTS.md': { mergeLines: true, template: templateContext },
-      // Brand doc unification (Ian 2026-07-20): inside a brand monorepo the
-      // BRAND ROOT is the one doc home — per-target AGENTS.md/CLAUDE.md/CHANGELOG.md/docs/
-      // never scaffold, and existing framework-owned-only copies are swept
-      // (retire rules; consumer content is never destroyed). Standalone projects
-      // keep them. Last-match-wins: these override the rules above.
+      // In a brand the BRAND ROOT is the one doc home: per-target CHANGELOG.md
+      // and docs/ never scaffold, and framework-owned copies are swept (consumer
+      // content is kept). Last-match-wins over the rules above.
       ...(isBrandTarget ? {
-        'AGENTS.md': { retire: true, template: templateContext },
-        'CLAUDE.md': { retire: true, template: templateContext },
         'CHANGELOG.md': { retire: true },
         'docs/**/*': { retire: true },
       } : {}),
@@ -235,6 +227,9 @@ async function copyDefaults(projectDir, engineLogger) {
     logger: engineLogger,
   });
 
+  // The project-root AGENTS.md, through devkit's one builder.
+  scaffoldAgentsMd({ outputDir: projectDir, standalone: seed.standalone, result: applied, logger: engineLogger });
+
   if (isBrandTarget) {
     // The same templateContext the yml rule uses, so the composed copy carries
     // the generated `githubSecrets` block — a composed workflow with the raw
@@ -311,7 +306,7 @@ function checkLocality(projectDir) {
  */
 async function ensureTarget(options) {
   options = options || {};
-  const projectDir = options.projectDir || Manager.getRootPath('project');
+  const projectDir = options.projectDir || build.getRootPath('project');
   const log = options.log || (() => {});
   const warn = options.warn || (() => {});
   const result = { written: [], merged: [], changed: [] };

package/dist/commands/lib/migrate.js

@@ -0,0 +1,17 @@
+/**
+ * migrateTarget: the desktop leg of the brand root's `omega migrate`. No
+ * legacy electron-manager shape converts mechanically yet (the register's
+ * by-hand steps cover them), so it answers the shared shape with nothing due.
+ * Every framework exposes this entry, so the manager's walk never special-cases
+ * a framework name.
+ *
+ * @param {string} targetDir - the desktop target's root
+ * @param {object} [options]
+ * @param {boolean} [options.execute] - convert (default: report only)
+ * @returns {{ due: string[], changed: string[], errors: string[] }}
+ */
+function migrateTarget(targetDir, options = {}) {
+  return { due: [], changed: [], errors: [] };
+}
+
+module.exports = { migrateTarget };

package/dist/commands/logs.js

@@ -3,7 +3,7 @@
 //
 // The optional positional names the surface (default `runtime`) and resolves to
 // <projectRoot>/logs/<surface>.log — the same four files documented in
-// docs/logging.md. Every flag below works on whichever surface was named.
+// docs/desktop/logging.md. Every flag below works on whichever surface was named.
 //
 // `runtime` resolves to the file the runtime logger writes to:
 //   - Dev (running from a project directory): <projectRoot>/logs/runtime.log

package/dist/commands/package.js

@@ -1,6 +1,6 @@
 // Libraries
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('package');
+const build = require('../build.js');
+const logger = build.logger('package');
 const { runPipeline } = require('../utils/build-pipeline.js');
 
 // `npx omega package` (the consumer's `package` script) builds the full installer

package/dist/commands/publish.js

@@ -1,6 +1,6 @@
 // Libraries
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('publish');
+const build = require('../build.js');
+const logger = build.logger('publish');
 const { runPipeline } = require('../utils/build-pipeline.js');
 
 // `npx omega publish` publishes from an already-built tree (the CI lane calls it

package/dist/commands/release.js

@@ -2,7 +2,7 @@
 // run it started.
 //
 // Replaces the old "do it from my laptop" release flow with "let CI do it, but make it
-// feel local." User runs `npm run release` (or `npx omega release`) and gets:
+// feel local." User runs `npx omega release` and gets:
 //   1. The ONE deploy lane every target takes (`@omega.js/devkit/deploy`'s
 //      deployViaDispatch, #872, #915): the composed workflow files reach the
 //      default branch when they differ there (GitHub registers a workflow from
@@ -24,9 +24,9 @@ const attachLogFile = require('../utils/attach-log-file.js');
 const { deployViaDispatch, dispatchTarget, laneLabel, resolveToken } = require('../vendor/devkit/deploy.js');
 const { followRun } = require('../vendor/devkit/deploy-follow.js');
 const { targetNameFromDir } = require('../vendor/config/index.js');
-const Manager = new (require('../build.js'));
+const build = require('../build.js');
 
-const logger = Manager.logger('release');
+const logger = build.logger('release');
 
 module.exports = async function release(options = {}) {
   const projectRoot = process.cwd();
@@ -58,7 +58,7 @@ module.exports = async function release(options = {}) {
   // `build.yml` standalone). ONE helper for all four targets
   // ([#847](https://github.com/Omega-JS-Stack/omega/issues/847)), where this
   // file used to keep desktop's own copy of it.
-  const { owner, repo, workflow: WORKFLOW_FILE } = dispatchTarget({ projectRoot, config: Manager.getConfig(), workflow: 'build.yml' });
+  const { owner, repo, workflow: WORKFLOW_FILE } = dispatchTarget({ projectRoot, config: build.getConfig(), workflow: 'build.yml' });
 
   // Optional --platforms / --platform flag forwarded as a workflow input. Accepts a
   // single value ('windows') or comma-separated list ('mac,linux'). Special value

package/dist/commands/runner.js

@@ -24,7 +24,7 @@
 //   stop                 Kill every Runner.Listener.exe under RUNNER_HOME.
 //   status               Registered orgs, Startup shortcuts, live listeners.
 //   uninstall            Remove everything — legacy services and tasks, and the
-//                        electron-manager era's em-runner install, included.
+//                        legacy em-runner install, included.
 //   monitor              Tail the JSONL signing event log, pretty-printed.
 //
 // Every subcommand except `monitor` refuses on non-Windows
@@ -35,8 +35,8 @@ const fs       = require('fs');
 const os       = require('os');
 const jetpack  = require('fs-jetpack');
 
-const Manager  = new (require('../build.js'));
-const logger   = Manager.logger('runner');
+const build  = require('../build.js');
+const logger   = build.logger('runner');
 
 const RUNNER_LABELS = ['self-hosted', 'windows', 'ev-token'];
 
@@ -63,7 +63,7 @@ const attachLogFile = require('../utils/attach-log-file.js');
 const RUNNER_HOME = process.env.OMEGA_RUNNER_HOME || defaultRunnerHome();
 loadRunnerEnv({ home: RUNNER_HOME });
 
-// The electron-manager era of this command (`em runner`) laid the same design
+// The legacy generation of this command (`em runner`) laid the same design
 // down under other names: the home was %LOCALAPPDATA%\em-runner (C:\actions-runners
 // before that), and the Startup shortcuts and the GitHub-side runners were
 // `em-runner-<host>-<org>`. An upgraded box still has all of it — live, and
@@ -207,7 +207,7 @@ async function install(options) {
   // the calling terminal at normal user privilege.
 
   // Idempotent by replacement: always tear down any prior install before starting —
-  // the omega one, or the electron-manager one an upgraded box still runs.
+  // the omega one, or the legacy em-runner one an upgraded box still runs.
   if (jetpack.exists(home) || listLegacyRunnerHomes({ home }).length > 0 || listLegacyRunnerStartupShortcuts().length > 0) {
     logger.log(`Existing runner installation detected — uninstalling first for a clean re-install...`);
     try {
@@ -369,8 +369,8 @@ async function registerOrg(options) {
   // THIS host. Without this, re-running install accumulates orphaned runners (one per
   // failed/aborted install, one per host rename, etc.) which causes actions/runner to
   // auto-suffix the new runner's name (e.g. `-2872`) and breaks our ability to predict
-  // service names. Match prefix is `omega-runner-<host>-<org>` — and the electron-manager
-  // era's `em-runner-<host>-<org>`, the same box's older registration — so we never touch
+  // service names. Match prefix is `omega-runner-<host>-<org>` — and the legacy
+  // `em-runner-<host>-<org>`, the same box's older registration — so we never touch
   // user-created runners or runners from other hosts.
   //
   // We do this BEFORE fetching the registration token because the token is one-shot
@@ -900,7 +900,7 @@ async function statusServices(options) {
     }
   }
 
-  // The electron-manager era's install (`em runner`): its home, its Startup
+  // The legacy install (`em runner`): its home, its Startup
   // shortcuts, and any listener still running out of it. None of it answers to
   // the omega names above, so it is named here and torn down by `uninstall`.
   const legacyHomes     = listLegacyRunnerHomes({ home });
@@ -989,7 +989,7 @@ async function uninstall(options) {
   // handles asynchronously after stop).
   await removeRunnerHomeWithRetry(new Set(failed.map((f) => f.dir)), home);
 
-  // The electron-manager era's install, when this box still has one: the same
+  // The legacy em-runner install, when this box still has one: the same
   // teardown, org by org, so its GitHub-side registrations come off too.
   const legacy = await uninstallLegacyRunnerInstalls(home);
   const stillRegistered = [...failed, ...legacy.failed];
@@ -1002,7 +1002,7 @@ async function uninstall(options) {
   logger.warn(`  Their directories were kept — re-run 'npx omega runner uninstall' to retry, or delete them under each org's Settings → Actions → Runners.`);
 }
 
-// Tear down the electron-manager era's runner install: its `em-runner-*`
+// Tear down the legacy runner install: its `em-runner-*`
 // Startup shortcuts, then each legacy home — deregister every org dir through
 // its own config.cmd, kill what runs out of it, remove it. A registration that
 // did not come off keeps its directory, exactly as the omega home's does.
@@ -1657,7 +1657,7 @@ function listRunnerStartupShortcuts(startupDir) {
   return listStartupShortcuts('omega-runner-', startupDir);
 }
 
-// The electron-manager era's: `em-runner-<host>-<org>`, which `status` names
+// The legacy shortcuts: `em-runner-<host>-<org>`, which `status` names
 // and `uninstall` removes — never anything `start` would launch.
 function listLegacyRunnerStartupShortcuts(startupDir) {
   return listStartupShortcuts(LEGACY_RUNNER_PREFIX, startupDir);

package/dist/commands/sign-windows.js

@@ -21,8 +21,8 @@ const os      = require('os');
 const jetpack = require('fs-jetpack');
 const { execute } = require('node-powertools');
 
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('sign-windows');
+const build = require('../build.js');
+const logger = build.logger('sign-windows');
 
 // The box's own signing configuration (`<runner home>\.env`: the cert, the PIN,
 // signtool) is read before anything below looks at process.env, so a manual
@@ -90,9 +90,9 @@ async function runSignCommand(options) {
     return smokeTest();
   }
 
-  const strategy = Manager.getWindowsSignStrategy();
+  const strategy = build.getWindowsSignStrategy();
 
-  const config   = Manager.getConfig();
+  const config   = build.getConfig();
   const projectRoot = process.cwd();
 
   // Resolve --in and --out (CLI flags) → directories of unsigned / signed artifacts.
@@ -441,7 +441,7 @@ async function signWithSigntool(targets, inDir, outDir, deps) {
   // (mac/linux equivalents are produced by electron-builder during their publish step,
   // but Windows is split into a post-build sign job so we have to write the yml here).
   if (signedExes.length > 0) {
-    const pkg = Manager.getPackage('project') || {};
+    const pkg = build.getPackage('project') || {};
     const version = pkg.version;
     if (!version) {
       log.warn('Could not determine version from package.json; skipping latest.yml generation.');

package/dist/commands/test.js

@@ -1,8 +1,8 @@
 // Libraries
 const path = require('path');
 const fs = require('fs');
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('test');
+const build = require('../build.js');
+const logger = build.logger('test');
 const { run } = require('../test/runner.js');
 const attachLogFile = require('../utils/attach-log-file.js');
 const { EXTENDED_MODE_WARNING } = require('../test/utils/extended-mode-warning.js');
@@ -21,7 +21,7 @@ module.exports = async function (options) {
 
   // Tee all test output to <projectRoot>/logs/test.log (ANSI-stripped) — mirrors
   // @omega.js/backend's test.log and @omega.js/desktop's own dev.log pattern.
-  attachLogFile(path.join(process.cwd(), 'logs', 'test.log'));
+  const detachLog = attachLogFile(path.join(process.cwd(), 'logs', 'test.log'));
 
   // The local half of the retired `omega setup` (#675) — idempotent, offline,
   // and quiet on a converged target. The gulp verbs get it from the `defaults`
@@ -43,7 +43,7 @@ module.exports = async function (options) {
   // Extended mode — opt into tests that hit REAL external services (Firebase, analytics,
   // update feeds) instead of skipping them. Off by default so `npx omega test` stays fast and
   // offline-safe. The canonical signal is the unprefixed `TEST_EXTENDED_MODE` env var — the
-  // SAME name across @omega.js/backend, @omega.js/extension, UJM, and @omega.js/desktop (cross-framework parity); `--extended` is the CLI
+  // SAME name on every framework (cross-framework parity); `--extended` is the CLI
   // shorthand. Once set on process.env it propagates to every spawned child (electron
   // main/renderer/boot, the gulp boot build) automatically via `{ ...process.env }`.
   const extended    = options.extended === true
@@ -58,7 +58,7 @@ module.exports = async function (options) {
   // When @omega.js/desktop itself runs its own boot-layer tests (the cwd's package.json is @omega.js/desktop's), there's
   // no real consumer app to boot. Point the boot runner at the fixture under
   // dist/test/fixtures/consumer-app unless the caller has already set OMEGA_TEST_BOOT_PROJECT
-  // explicitly. Mirrors BXM's OMEGA_TEST_BOOT_PROJECT / UJM's UJ_TEST_BOOT_PROJECT.
+  // explicitly.
   if (!process.env.OMEGA_TEST_BOOT_PROJECT) {
     try {
       const cwdPkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
@@ -104,19 +104,19 @@ module.exports = async function (options) {
     // ONE target to every target, so a distinct code lets it count this as a
     // miss rather than a failure (#814).
     process.exitCode = noMatchExitCode();
-    await attachLogFile.detach();
+    detachLog();
     return;
   }
 
   if (result.failed > 0) {
     process.exitCode = 1;
-    await attachLogFile.detach();
+    detachLog();
     throw new Error(`${result.failed} test(s) failed`);
   }
 
   // Close test.log before exiting. Nothing to flush: every write already went
   // to the fd synchronously (#197), so the Results block survives the exit
   // below whatever happens — detach() just closes the handle.
-  await attachLogFile.detach();
+  detachLog();
   process.exit(0);
 };

package/dist/commands/update.js

@@ -1,18 +1,19 @@
 /**
- * `omega update` — dependency freshness report (npu-outdated semantics):
+ * `omega update` — dependency freshness (npu-outdated semantics):
  * installed/wanted/latest + patch/minor/major per dep, releases younger than
- * --min-age days (default 7) QUARANTINED. `--apply` installs the
+ * --min-age days (default 7) QUARANTINED. A bare run installs the
  * non-quarantined, non-breaking set (`--major` opts into breaking) through
- * npu when present. The whole verb is the shared devkit implementation.
+ * npu when present; `--dry-run` reports and installs nothing. The whole verb
+ * is the shared devkit implementation.
  */
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('update');
+const build = require('../build.js');
+const logger = build.logger('update');
 const { runUpdate } = require('../vendor/devkit/update.js');
 
 module.exports = async function (options) {
   await runUpdate({
     dir: process.cwd(),
-    apply: options.apply,
+    dryRun: options.dryRun || options['dry-run'],
     major: options.major,
     minAge: options.minAge ?? options['min-age'],
     forceFresh: options.forceFresh || options['force-fresh'],

package/dist/commands/validate-certs.js

@@ -38,8 +38,8 @@ const { certificateExpiry, EXPIRY_WARN_DAYS } = require('../vendor/devkit/certs.
 const { signingPathCandidates } = require('../vendor/devkit/signing-env.js');
 const { requiredWhenHolds } = require('../vendor/config/env-rules.js');
 
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('validate-certs');
+const build = require('../build.js');
+const logger = build.logger('validate-certs');
 
 module.exports = async function (options) {
   options = options || {};
@@ -48,8 +48,8 @@ module.exports = async function (options) {
   logger.log('Validating signing prerequisites...');
 
   const platform = process.platform;
-  const config = Manager.getConfig();
-  const winStrategy = Manager.getWindowsSignStrategy();
+  const config = build.getConfig();
+  const winStrategy = build.getWindowsSignStrategy();
 
   const issues = [];
 

package/dist/commands/version.js

@@ -1,8 +1,8 @@
 // Libraries
-const Manager = new (require('../build.js'));
-const logger = Manager.logger('version');
+const build = require('../build.js');
+const logger = build.logger('version');
 
-const package = Manager.getPackage('main');
+const package = build.getPackage('main');
 
 module.exports = async function (options) {
   logger.log(package.version);

package/dist/defaults/.github/workflows/build.yml

@@ -27,7 +27,7 @@ env:
   # `KEY: ${{ secrets.KEY }}` line per `delivery: { desktop: 'ci' | 'bake' }`
   # entry (@omega.js/config's env-delivery.js), re-rendered by every verb's
   # ensureTarget. Signing, notarization, store and analytics credentials all
-  # arrive here, workflow-wide — the jobs and steps below consume them without
+  # arrive here, workflow-wide: the jobs and steps below consume them without
   # restating one. Add a key to the schema, not to this file.
   {{ githubSecrets }}
 
@@ -103,7 +103,7 @@ jobs:
 
       {{ installFirewall }}
 
-      # On Windows, force cmd for every shell step in this job — the runner's default
+      # On Windows, force cmd for every shell step in this job: the runner's default
       # is PowerShell 7 which has its own ExecutionPolicy/wrapping quirks that cause
       # `npm ci` and similar to exit silently with no captured output. cmd has none
       # of that. mac/linux use their default bash regardless of this flag (per
@@ -135,7 +135,7 @@ jobs:
           echo "NPM: $(npm -v)"
           echo "Omega: $(node "${{ github.workspace }}/node_modules/@omega.js/desktop/bin/omega" version)"
 
-      # macOS — decode signing assets from secrets, then sign + notarize + publish.
+      # macOS: decode signing assets from secrets, then sign + notarize + publish.
       # `npx omega deploy`'s precheck uploads .p12 / .p8 files as base64-encoded secrets;
       # the workflow decodes them back to disk for electron-builder + notarytool to read.
       # Each decode is gated on its secret EXISTING (#872): `base64 --decode` of an
@@ -150,13 +150,13 @@ jobs:
           if [ -n "${{ secrets.CSC_LINK }}" ]; then
             echo "${{ secrets.CSC_LINK }}" | base64 --decode > config/certs/dev-id.p12
           else
-            echo "No CSC_LINK secret: run omega deploy from targets/desktop (its precheck pushes them). A mac build must be signed."
+            echo "No CSC_LINK secret: run omega deploy at the brand root (its precheck pushes them). A mac build must be signed."
             exit 1
           fi
           if [ -n "${{ secrets.APPLE_API_KEY }}" ]; then
             echo "${{ secrets.APPLE_API_KEY }}" | base64 --decode > config/certs/AuthKey.p8
           else
-            echo "No APPLE_API_KEY secret: run omega deploy from targets/desktop (its precheck pushes them). A mac build must be notarized."
+            echo "No APPLE_API_KEY secret: run omega deploy at the brand root (its precheck pushes them). A mac build must be notarized."
             exit 1
           fi
       # The two file-path OVERRIDES of the workflow env: electron-builder and
@@ -176,7 +176,7 @@ jobs:
       # Linux: install snapcraft when (a) the brand still SHIPS the snap format
       # (`platforms.linux.formats.snap`, on unless dropped with `false`) AND
       # (b) SNAPCRAFT_STORE_CREDENTIALS is set as a repo secret. Without the secret we
-      # skip snapcraft install entirely — build-config.js auto-skips the snap target on
+      # skip snapcraft install entirely: build-config.js auto-skips the snap target on
       # the same condition, so the build still produces .deb + .AppImage cleanly with
       # no snap publish attempt and no failure.
       - name: Install Snapcraft (Linux, when snap enabled + creds present)
@@ -192,7 +192,7 @@ jobs:
             CONFIG_OK=0
             echo "platforms.linux.formats.snap is dropped, skipping snapcraft install."
           fi
-          # (b) Credentials check — empty secret means no publish creds available.
+          # (b) Credentials check: empty secret means no publish creds available.
           if [ -n "$SNAPCRAFT_STORE_CREDENTIALS" ]; then
             CREDS_OK=1
           else
@@ -204,7 +204,7 @@ jobs:
             echo "Snapcraft installed."
           fi
 
-      # Linux — no signing. The workflow env carries the mac credentials as the
+      # Linux: no signing. The workflow env carries the mac credentials as the
       # base64 secrets themselves (only the mac job decodes them to disk), and a
       # leg that never signs for mac has no business holding them: empty reads as
       # UNSET after the build's sanitize pass (#872).
@@ -215,18 +215,18 @@ jobs:
           APPLE_API_KEY: ''
         run: npm run release:local
 
-      # Windows — package (build + electron-builder package) unsigned. We do NOT publish
+      # Windows: package (build + electron-builder package) unsigned. We do NOT publish
       # here. Mac/linux's `npm run release:local` step already created the GH Release via
       # electron-builder publish; windows-sign uploads signed .exe to that same release.
-      # shell: cmd as above — PowerShell 7's wrapping breaks long-running npm scripts.
+      # shell: cmd as above. PowerShell 7's wrapping breaks long-running npm scripts.
       - if: matrix.os == 'windows-latest'
         shell: cmd
         env:
           OMEGA_SKIP_WIN_SIGN: 'true'
           # The workflow env carries the mac signing cert (CSC_LINK is the
           # base64 .p12 the mac job decodes); electron-builder would otherwise
-          # try to sign the Windows build with it. Empty reads as UNSET — the
-          # build's sanitize pass drops it — so this step packages unsigned, as
+          # try to sign the Windows build with it. Empty reads as UNSET (the
+          # build's sanitize pass drops it), so this step packages unsigned, as
           # it always did. windows-sign signs separately.
           CSC_LINK: ''
           CSC_KEY_PASSWORD: ''
@@ -276,9 +276,9 @@ jobs:
     name: Sign Windows
     needs: [setup, build, windows-strategy]
     # Strategy comes from config platforms.windows.signing.strategy (read by windows-strategy job).
-    #   self-hosted (default) — runs on a self-hosted runner with EV USB token attached
-    #   cloud                 — runs on hosted windows-latest, calls cloud signing provider
-    #   local                 — skip this job; sign locally via `npx omega sign-windows`
+    #   self-hosted (default):  runs on a self-hosted runner with EV USB token attached
+    #   cloud:                  runs on hosted windows-latest, calls cloud signing provider
+    #   local:                  skip this job; sign locally via `npx omega sign-windows`
     # The trigger half of the signer guard (#875): only a DISPATCH may reach the
     # box that holds the EV token, so a `pull_request` or `push` trigger added to
     # this file later skips the sign job instead of signing a stray build. A skip,
@@ -298,7 +298,7 @@ jobs:
     defaults:
       run:
         shell: cmd
-    # Signing credentials — self-hosted EV USB token (WIN_EV_TOKEN_PATH,
+    # Signing credentials: self-hosted EV USB token (WIN_EV_TOKEN_PATH,
     # WIN_CSC_KEY_PASSWORD, SIGNTOOL_PATH) and the cloud providers (only the set
     # `platforms.windows.signing.cloud.provider` names is consumed), all arrive
     # through the workflow's generated env block. Set them in the brand .env and
@@ -348,11 +348,11 @@ jobs:
       {{ installFirewall }}
       - run: sfw npm ci {{ installWorkspace }}
       # Flip the releases-repo release from Draft to Published so electron-updater
-      # can read it. Idempotent — safe to run even if already published. ONLY runs
+      # can read it. Idempotent: safe to run even if already published. ONLY runs
       # on all-platforms builds: a partial run (e.g. `--platforms windows`) leaves
       # the release as a draft, so subsequent runs can fill in the missing platform
       # assets before electron-updater starts seeing the version.
       - if: needs.setup.outputs.mac == 'true' && needs.setup.outputs.linux == 'true' && needs.setup.outputs.windows == 'true'
         run: node "${{ github.workspace }}/node_modules/@omega.js/desktop/bin/omega" finalize-release --publish
       - if: needs.setup.outputs.mac != 'true' || needs.setup.outputs.linux != 'true' || needs.setup.outputs.windows != 'true'
-        run: echo "Partial-platform run (mac=${{ needs.setup.outputs.mac }} linux=${{ needs.setup.outputs.linux }} windows=${{ needs.setup.outputs.windows }}) — leaving release as draft. Run with --platforms all to publish."
+        run: echo "Partial-platform run (mac=${{ needs.setup.outputs.mac }} linux=${{ needs.setup.outputs.linux }} windows=${{ needs.setup.outputs.windows }}), leaving release as draft. Run with --platforms all to publish."

package/dist/defaults/_.gitignore

@@ -22,5 +22,3 @@ config/certs/*
 *.pem
 
 # ========== Custom Values ==========
-
-# Add your own ignores below. This section is preserved across framework re-syncs.

package/dist/defaults/_mas/README.md

@@ -1,4 +1,4 @@
-# MAS (Mac App Store) Reference Plists — ARCHIVED
+# MAS (Mac App Store) Reference Plists (ARCHIVED)
 
 These entitlement plists are reference material for a future Mac App Store
 distribution implementation. They are **NOT** part of the active scaffold copied
@@ -24,7 +24,7 @@ Team ID + appId at build time.
 ## Roadmap
 
 When MAS support is implemented (currently stubbed in
-`config.targets.mac.mas` — see `docs/installer-options.md`), this folder will be
+`config.targets.mac.mas`, see `node_modules/@omega.js/manager/docs/desktop/installer-options.md`), this folder will be
 the starting point for the entitlements @omega.js/desktop auto-generates into `dist/config/`
 when `mac.mas.enabled === true`. The structure should be similar to the existing
 `writeMacEntitlements` flow but with separate output files for `mas`, `mas.inherit`,
@@ -42,7 +42,7 @@ The other MAS-specific concerns:
 MAS distribution adds significant non-trivial complexity (sandboxed app, App Store
 review cycle, separate provisioning profile per app, manual submission to App
 Store Connect via Transporter or Xcode). It's the right move only for apps that
-genuinely benefit from App Store distribution — most consumer apps ship via DMG
+genuinely benefit from App Store distribution: most consumer apps ship via DMG
 download from a website, not the Mac App Store.
 
 If you need MAS now, the legacy @omega.js/desktop (pre-v1) had support that you

package/dist/defaults/config/certs/README.md

@@ -37,4 +37,4 @@ These are values, not files, and live in the brand `.env` (never here):
 
 Windows keeps no file here at all: the self-hosted EV USB token is addressed by `WIN_EV_TOKEN_PATH` / `WIN_CSC_KEY_PASSWORD`, and each cloud provider by its own env set.
 
-For the whole picture see [`docs/signing.md`](../../docs/signing.md).
+For the whole picture see `node_modules/@omega.js/manager/docs/desktop/signing.md`.