@omega.js/desktop 0.52.0 → 0.54.0

package/dist/test/suites/build/manager.test.js

@@ -1,213 +0,0 @@
-// Build-time tests for the Manager class (build.js).
-
-const Manager = require('../../../build.js');
-const defineCases = require('../../../vendor/devkit/test/define-cases.js');
-
-// The one input and the two lane flags that decide it, saved and restored
-// around every case that touches them (#817).
-const LANE_KEYS = ['OMEGA_ENVIRONMENT', 'OMEGA_BUILD_MODE', 'OMEGA_TEST_MODE', 'NODE_ENV'];
-
-/**
- * Run `fn` with exactly `vars` set on the lane keys (null clears them all).
- * @param {object|null} vars - the lane env for this case.
- * @param {function} fn - the body.
- * @returns {*} whatever `fn` returns.
- */
-function withEnvironment(vars, fn) {
-  const saved = {};
-  for (const key of LANE_KEYS) saved[key] = process.env[key];
-  try {
-    for (const key of LANE_KEYS) delete process.env[key];
-    Object.assign(process.env, vars || {});
-    return fn();
-  } finally {
-    for (const key of LANE_KEYS) {
-      if (saved[key] === undefined) delete process.env[key];
-      else process.env[key] = saved[key];
-    }
-  }
-}
-
-/**
- * What src/build.js resolves at LOAD for a given lane. build.js sets the input
- * once, at require time, so this loads a fresh copy of it per lane.
- * @param {object} vars - the lane env.
- * @returns {string} the resolved environment.
- */
-function laneEnvironment(vars) {
-  const buildPath = require.resolve('../../../build.js');
-  return withEnvironment(vars, () => {
-    const saved = require.cache[buildPath];
-    delete require.cache[buildPath];
-    try {
-      return require(buildPath).getEnvironment();
-    } finally {
-      if (saved) require.cache[buildPath] = saved;
-      else delete require.cache[buildPath];
-    }
-  });
-}
-
-module.exports = defineCases({
-  type: 'group', // independent tests; run all even on failure
-  layer: 'build',
-  description: 'Manager (build.js)',
-  tests: [
-    {
-      name: 'class is exported and instantiable',
-      run: (ctx) => {
-        ctx.expect(typeof Manager).toBe('function');
-        ctx.expect(new Manager()).toBeInstanceOf(Manager);
-      },
-    },
-    {
-      name: 'getMode returns the mode shape',
-      run: (ctx) => {
-        const mode = Manager.getMode();
-        ctx.expect(mode).toHaveProperty('build');
-        ctx.expect(mode).toHaveProperty('publish');
-        ctx.expect(mode).toHaveProperty('server');
-        ctx.expect(mode).toHaveProperty('environment');
-        ctx.expect(['development', 'testing', 'production']).toContain(mode.environment);
-      },
-    },
-    {
-      // The environment reads ONE input, `OMEGA_ENVIRONMENT`
-      // ([#817](https://github.com/Omega-JS-Stack/omega/issues/817)), and the
-      // lane that boots or builds this app sets it (src/build.js does, at load).
-      // Nothing sniffs NODE_ENV, app.isPackaged or OMEGA_TEST_MODE any more.
-      name: 'getEnvironment answers the one input, for each of the three names',
-      run: (ctx) => {
-        withEnvironment(null, () => {
-          for (const name of ['development', 'testing', 'production']) {
-            process.env.OMEGA_ENVIRONMENT = name;
-            ctx.expect(Manager.getEnvironment()).toBe(name);
-          }
-        });
-      },
-    },
-    {
-      // The bug this replaced: with no signal desktop's own copy answered
-      // 'production', so a plain `npm start` bundled itself as a production
-      // artifact, while @omega.js/extension's copy of the same function
-      // answered 'development' from the same inputs (#817).
-      name: 'the build lane resolves production, a dev boot resolves development',
-      run: (ctx) => {
-        const buildLane = laneEnvironment({ OMEGA_BUILD_MODE: 'true' });
-        ctx.expect(buildLane).toBe('production');
-
-        const devBoot = laneEnvironment({});
-        ctx.expect(devBoot).toBe('development');
-
-        // A lane that already named one keeps it, EXCEPT a build lane: a
-        // production build spawned from a test run still bakes production.
-        ctx.expect(laneEnvironment({ OMEGA_ENVIRONMENT: 'testing' })).toBe('testing');
-        ctx.expect(laneEnvironment({ OMEGA_ENVIRONMENT: 'testing', OMEGA_BUILD_MODE: 'true' })).toBe('production');
-      },
-    },
-    {
-      name: 'no input at all is a loud error naming OMEGA_ENVIRONMENT, never a default',
-      run: (ctx) => {
-        withEnvironment(null, () => {
-          delete process.env.OMEGA_ENVIRONMENT;
-          ctx.expect(() => Manager.getEnvironment()).toThrow(/OMEGA_ENVIRONMENT/);
-          process.env.OMEGA_ENVIRONMENT = 'staging';
-          ctx.expect(() => Manager.getEnvironment()).toThrow(/OMEGA_ENVIRONMENT/);
-        });
-      },
-    },
-    {
-      // The core invariant: is*() DERIVE from getEnvironment(), so they can
-      // NEVER disagree with it, and exactly one is always true.
-      name: 'invariant: is*() exactly matches getEnvironment() + mutually exclusive (every scenario)',
-      run: (ctx) => {
-        withEnvironment(null, () => {
-          for (const name of ['development', 'testing', 'production']) {
-            process.env.OMEGA_ENVIRONMENT = name;
-            const e = Manager.getEnvironment();
-            ctx.expect(e).toBe(name);
-            ctx.expect(Manager.isDevelopment()).toBe(e === 'development');
-            ctx.expect(Manager.isTesting()).toBe(e === 'testing');
-            ctx.expect(Manager.isProduction()).toBe(e === 'production');
-            const trueCount = [Manager.isDevelopment(), Manager.isTesting(), Manager.isProduction()].filter(Boolean).length;
-            ctx.expect(trueCount).toBe(1);
-          }
-        });
-      },
-    },
-    {
-      name: 'getPackage("main") resolves to @omega.js/desktop package.json',
-      run: (ctx) => {
-        const pkg = Manager.getPackage('main');
-        ctx.expect(pkg.name).toBe('@omega.js/desktop');
-        ctx.expect(pkg).toHaveProperty('version');
-        ctx.expect(pkg).toHaveProperty('exports');
-      },
-    },
-    {
-      name: 'getRootPath("main") returns a non-empty string',
-      run: (ctx) => {
-        const root = Manager.getRootPath('main');
-        ctx.expect(typeof root).toBe('string');
-        ctx.expect(root.length).toBeGreaterThan(0);
-      },
-    },
-    {
-      name: 'getLiveReloadPort defaults to 35729',
-      run: (ctx) => {
-        const prev = process.env.OMEGA_LIVERELOAD_PORT;
-        delete process.env.OMEGA_LIVERELOAD_PORT;
-        try {
-          ctx.expect(Manager.getLiveReloadPort()).toBe(35729);
-        } finally {
-          if (prev !== undefined) process.env.OMEGA_LIVERELOAD_PORT = prev;
-        }
-      },
-    },
-    {
-      name: 'getWindowsSignStrategy defaults to self-hosted when no config',
-      run: (ctx) => {
-        // No EM_WIN_SIGN_STRATEGY env-var support anymore — config is the only source.
-        // Run from a cwd with no omega.json5 to confirm the default.
-        const fs = require('fs'); const os = require('os'); const path = require('path');
-        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-strategy-'));
-        const orig = process.cwd();
-        try {
-          process.chdir(tmp);
-          ctx.expect(Manager.getWindowsSignStrategy()).toBe('self-hosted');
-        } finally {
-          process.chdir(orig);
-          fs.rmSync(tmp, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'getWindowsSignStrategy reads config platforms.windows.signing.strategy',
-      run: (ctx) => {
-        const fs = require('fs'); const os = require('os'); const path = require('path');
-        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-strategy-'));
-        fs.mkdirSync(path.join(tmp, 'config'), { recursive: true });
-        fs.writeFileSync(path.join(tmp, 'config', 'omega.json5'),
-          `{ targets: { desktop: { type: 'desktop', platforms: { windows: { signing: { strategy: 'cloud' } } } } } }`);
-        const orig = process.cwd();
-        try {
-          process.chdir(tmp);
-          ctx.expect(Manager.getWindowsSignStrategy()).toBe('cloud');
-        } finally {
-          process.chdir(orig);
-          fs.rmSync(tmp, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      name: 'logger returns a named logger',
-      run: (ctx) => {
-        const m = new Manager();
-        const logger = m.logger('test-name');
-        ctx.expect(logger.name).toBe('test-name');
-        ctx.expect(typeof logger.log).toBe('function');
-        ctx.expect(typeof logger.error).toBe('function');
-      },
-    },
-  ],
-});

package/dist/test/suites/main/client-bridge.test.js

@@ -1,262 +0,0 @@
-// Main-process tests for lib/client-bridge.js — unit-level coverage that doesn't hit Firebase.
-//
-// Real Firebase integration tests live in client-bridge.integration.test.js
-// (gated on extended mode); the sign-in proof itself is #904's, through a
-// persona the backend emulator seeds.
-
-const defineCases = require('../../../vendor/devkit/test/define-cases.js');
-
-module.exports = defineCases({
-  type: 'suite',
-  layer: 'main',
-  description: 'client-bridge (main, unit)',
-  cleanup: async (ctx) => {
-    await ctx.manager.omega._resetForTests();
-  },
-  tests: [
-    {
-      name: 'initialize ran during boot',
-      run: (ctx) => {
-        ctx.expect(ctx.manager.omega._initialized).toBe(true);
-      },
-    },
-    {
-      name: 'IPC handlers are registered',
-      run: (ctx) => {
-        ctx.expect(ctx.manager.ipc.hasHandler('desktop:auth:sync-request')).toBe(true);
-        ctx.expect(ctx.manager.ipc.hasHandler('desktop:auth:sign-out')).toBe(true);
-        ctx.expect(ctx.manager.ipc.hasHandler('desktop:auth:get-user')).toBe(true);
-      },
-    },
-    {
-      name: 'getCurrentUser returns null when nothing is signed in',
-      run: (ctx) => {
-        // The harness boots without auth; either firebase isn't loaded (no cloud.config
-        // in default config) or it is and there's no user. Either way, currentUser is null.
-        ctx.expect(ctx.manager.omega.getCurrentUser()).toBeNull();
-      },
-    },
-    {
-      name: 'getIdToken returns null when nothing is signed in',
-      run: async (ctx) => {
-        // Same no-auth harness as getCurrentUser above — signed-in token
-        // round-trips are the integration suite's domain.
-        ctx.expect(await ctx.manager.omega.getIdToken()).toBeNull();
-      },
-    },
-    {
-      name: 'handleAuthToken returns no-op result when firebase not loaded',
-      run: async (ctx) => {
-        // Default config has empty cloud.config → firebase fails to init → _firebaseAuth=null.
-        if (ctx.manager.omega._firebaseAuth) {
-          ctx.skip('firebase did load (cloud.config was set) — covered by integration tests');
-        }
-        const r = await ctx.manager.omega.handleAuthToken('whatever');
-        ctx.expect(r.success).toBe(false);
-        ctx.expect(r.reason).toBe('firebase-not-loaded');
-      },
-    },
-    {
-      name: 'handleAuthToken with empty token returns no-token failure',
-      run: async (ctx) => {
-        // Stub _firebaseAuth so we hit the "no token" branch instead of "firebase-not-loaded."
-        const origAuth = ctx.manager.omega._firebaseAuth;
-        ctx.manager.omega._firebaseAuth = { currentUser: null }; // truthy so we pass the firebase check
-        try {
-          const r = await ctx.manager.omega.handleAuthToken('');
-          ctx.expect(r.success).toBe(false);
-          ctx.expect(r.reason).toBe('no-token');
-        } finally {
-          ctx.manager.omega._firebaseAuth = origAuth;
-        }
-      },
-    },
-    {
-      name: 'sync-request: same UID → no sync needed',
-      run: async (ctx) => {
-        // Stub the auth so we control bgUid.
-        const origAuth = ctx.manager.omega._firebaseAuth;
-        ctx.manager.omega._firebaseAuth = { currentUser: { uid: 'abc' } };
-        try {
-          const result = await ctx.manager.ipc.invoke('desktop:auth:sync-request', { contextUid: 'abc' });
-          ctx.expect(result.needsSync).toBe(false);
-        } finally {
-          ctx.manager.omega._firebaseAuth = origAuth;
-        }
-      },
-    },
-    {
-      name: 'sync-request: main signed out, renderer signed in → tells renderer to sign out',
-      run: async (ctx) => {
-        const origAuth = ctx.manager.omega._firebaseAuth;
-        ctx.manager.omega._firebaseAuth = { currentUser: null };
-        try {
-          const result = await ctx.manager.ipc.invoke('desktop:auth:sync-request', { contextUid: 'someone' });
-          ctx.expect(result.needsSync).toBe(true);
-          ctx.expect(result.signOut).toBe(true);
-        } finally {
-          ctx.manager.omega._firebaseAuth = origAuth;
-        }
-      },
-    },
-    {
-      name: 'sync-request: firebase not loaded → no sync',
-      run: async (ctx) => {
-        const origAuth = ctx.manager.omega._firebaseAuth;
-        ctx.manager.omega._firebaseAuth = null;
-        try {
-          const result = await ctx.manager.ipc.invoke('desktop:auth:sync-request', { contextUid: null });
-          ctx.expect(result.needsSync).toBe(false);
-          ctx.expect(result.reason).toBe('firebase-not-loaded');
-        } finally {
-          ctx.manager.omega._firebaseAuth = origAuth;
-        }
-      },
-    },
-    {
-      name: 'sign-out IPC succeeds when nothing is signed in',
-      run: async (ctx) => {
-        const result = await ctx.manager.ipc.invoke('desktop:auth:sign-out');
-        ctx.expect(result.success).toBe(true);
-      },
-    },
-    {
-      name: 'get-user IPC returns null when no current user',
-      run: async (ctx) => {
-        const result = await ctx.manager.ipc.invoke('desktop:auth:get-user');
-        ctx.expect(result).toBeNull();
-      },
-    },
-    {
-      name: 'onAuthChange returns an unsubscribe fn',
-      run: (ctx) => {
-        const fn = () => {};
-        const off = ctx.manager.omega.onAuthChange(fn);
-        ctx.expect(ctx.manager.omega._stateSubs.has(fn)).toBe(true);
-        off();
-        ctx.expect(ctx.manager.omega._stateSubs.has(fn)).toBe(false);
-      },
-    },
-    {
-      name: '_snapshotUser returns the public user shape (no token)',
-      run: (ctx) => {
-        const snap = ctx.manager.omega._snapshotUser({
-          uid: 'u1',
-          email: 'a@b.com',
-          displayName: 'Bob',
-          photoURL: 'http://x/p.png',
-          emailVerified: true,
-          // sensitive stuff that should NOT be exposed
-          stsTokenManager: { accessToken: 'SECRET' },
-          providerData: ['xxx'],
-        });
-        ctx.expect(snap).toEqual({
-          uid: 'u1',
-          email: 'a@b.com',
-          displayName: 'Bob',
-          photoURL: 'http://x/p.png',
-          emailVerified: true,
-        });
-      },
-    },
-    {
-      // The emulator gate (#46). _getFirebaseAuth resolves firebase through the
-      // bridge's OWN seams (_firebase / _firebaseModule, filled by
-      // _tryLoadFirebase) — swapping those recording namespaces in drives the real
-      // method, no stubbing of the module under test. The manager is an input too:
-      // isTesting() is the whole gate.
-      name: 'auth emulator: a testing run connects, dev/production never do',
-      run: (ctx) => {
-        const bridge = ctx.manager.omega;
-        const saved = {
-          firebase:  bridge._firebase,
-          module:    bridge._firebaseModule,
-          auth:      bridge._firebaseAuth,
-          manager:   bridge._manager,
-          port:      process.env.OMEGA_AUTH_PORT,
-        };
-
-        // One recording firebase namespace pair, reused per run
-        const connects = [];
-        const authInstance = { __auth: true };
-        bridge._firebase = {
-          getApp:        () => { throw new Error('no app'); },
-          initializeApp: () => ({ __app: true }),
-        };
-        bridge._firebaseModule = {
-          getAuth: () => authInstance,
-          connectAuthEmulator: (auth, url, opts) => connects.push({ auth, url, opts }),
-        };
-
-        const run = (isTesting, dev) => {
-          bridge._firebaseAuth = null;
-          bridge._manager = {
-            config: { cloud: { config: { apiKey: 'AIza-test', projectId: 'demo-desktop' } }, ...(dev ? { dev } : {}) },
-            isTesting: () => isTesting,
-          };
-          return bridge._getFirebaseAuth(null);
-        };
-
-        try {
-          delete process.env.OMEGA_AUTH_PORT;
-
-          // production / dev shape — no emulator, ever
-          ctx.expect(run(false)).toBe(authInstance);
-          ctx.expect(connects.length).toBe(0);
-
-          // testing shape: the port comes from the map the bundle baked, which
-          // carries @omega.js/config's classic 9099 as its floor
-          // ([#834](https://github.com/Omega-JS-Stack/omega/issues/834)).
-          ctx.expect(run(true, { ports: { auth: 9099 } })).toBe(authInstance);
-          ctx.expect(connects.length).toBe(1);
-          ctx.expect(connects[0].auth).toBe(authInstance);
-          ctx.expect(connects[0].url).toBe('http://localhost:9099');
-
-          // a bumped port arrives on OMEGA_AUTH_PORT (N7)
-          process.env.OMEGA_AUTH_PORT = '9199';
-          run(true, { ports: { auth: 9099 } });
-          ctx.expect(connects.length).toBe(2);
-          ctx.expect(connects[1].url).toBe('http://localhost:9199');
-
-          // Neither channel is a broken artifact, and it says so by name
-          // rather than dialling a port nothing identity-checks (#834).
-          delete process.env.OMEGA_AUTH_PORT;
-          let threw;
-          try { run(true); } catch (e) { threw = e; }
-          ctx.expect(threw).toBeDefined();
-          ctx.expect(threw.message).toMatch(/dev port for `auth`/);
-          ctx.expect(threw.message).toMatch(/bundle task/);
-          ctx.expect(connects.length).toBe(2);
-        } finally {
-          bridge._firebase       = saved.firebase;
-          bridge._firebaseModule = saved.module;
-          bridge._firebaseAuth   = saved.auth;
-          bridge._manager        = saved.manager;
-          if (saved.port === undefined) delete process.env.OMEGA_AUTH_PORT;
-          else                          process.env.OMEGA_AUTH_PORT = saved.port;
-        }
-      },
-    },
-    {
-      name: 'deep-link auth/token route is wired to handleAuthToken',
-      run: async (ctx) => {
-        // We've already tested the deep-link side in deep-link.test.js. Here we verify
-        // the integration is actually live: dispatching the route triggers our spy.
-        let received = null;
-        const orig = ctx.manager.omega.handleAuthToken;
-        ctx.manager.omega.handleAuthToken = async (token) => {
-          received = token;
-          return { success: true };
-        };
-        try {
-          ctx.manager.deepLink.dispatch('myapp://auth/token?authToken=BRIDGE-TEST-TOKEN');
-          // Built-in handler is sync up to the await — give it a tick.
-          await new Promise((r) => setImmediate(r));
-          ctx.expect(received).toBe('BRIDGE-TEST-TOKEN');
-        } finally {
-          ctx.manager.omega.handleAuthToken = orig;
-        }
-      },
-    },
-  ],
-});

package/dist/vendor/config/env-retired.js

@@ -1,137 +0,0 @@
-/**
- * Retired ENV keys ([#893](https://github.com/Omega-JS-Stack/omega/issues/893))
- * - the `.env` half of retired-keys.js.
- *
- * Six values were declared in both homes at once: the env schema carried them
- * as non-secret keys while the config schema already declared (or now
- * declares) the same fact. Two homes for one value drift, and the rule that
- * settles which one wins is in docs/shared/config.md ("Config or env?"):
- * config holds what is PUBLIC by design (an id a store URL carries, a key a
- * browser bundle ships, a value printed in a binary), `.env` holds secrets,
- * the login coordinates that only travel with a secret, and machine paths.
- *
- * There is no dual-read anywhere in OMEGA, so a `.env` line left behind is a
- * value nothing reads: the id a brand carefully pasted would be ignored and
- * the publish would address the wrong listing, or none. Every layer read
- * therefore FAILS on one, naming the config path the value moved to
- * (env.js's parseEnvFile, the one place a `.env` layer is parsed).
- *
- * The config-side register gets nothing from this move: these were never
- * config keys, so nothing there was renamed.
- *
- * The register also carries the env-side RENAMES
- * ([#845](https://github.com/Omega-JS-Stack/omega/issues/845)): a key that is
- * still a secret and still lives in `.env`, under a new name. Same silence,
- * same refusal; the fix it names is renaming the line, not deleting it.
- *
- * And it carries the keys that are retired OUTRIGHT
- * ([#819](https://github.com/Omega-JS-Stack/omega/issues/819)): no config path,
- * no new env name, because what replaced the key is a MECHANISM rather than a
- * value. Such a row declares `replacement: null` and its refusal reads as a
- * deletion with nowhere to move the value to.
- */
-
-// env var name -> { replacement, why, home } (docs/shared/config.md carries the
-// rows). `home` is where the replacement LIVES: 'config' by default (the #893
-// move), or 'env' for a key that stayed a secret and only changed NAME, which
-// is a rename of the line rather than a deletion. `replacement: null` is a key
-// with no successor of any kind (#819): the line is simply deleted, and the
-// row's `why` names the mechanism that made it unnecessary.
-const RETIRED_ENV_KEYS = {
-  CHROME_EXTENSION_ID: {
-    replacement: 'targets.<name>.listings.chrome.id',
-    why: 'a store item id is public by design (it is in the listing URL), so it lives beside that listing in config',
-  },
-  FIREFOX_EXTENSION_ID: {
-    replacement: 'targets.<name>.listings.firefox.id',
-    why: "the AMO add-on id IS the manifest's gecko id, and config is its ONE home: the local scaffold pins the derived id there and the package task writes it into the manifest",
-  },
-  EDGE_PRODUCT_ID: {
-    replacement: 'targets.<name>.listings.edge.id',
-    why: 'a store product id is public by design (it is in the listing URL), so it lives beside that listing in config',
-  },
-  RECAPTCHA_SITE_KEY: {
-    replacement: 'captcha.providers.recaptcha.siteKey',
-    why: 'the site key is rendered into every page that carries a form, so it is public by definition; RECAPTCHA_SECRET_KEY stays in .env',
-  },
-  PAYPAL_CLIENT_ID: {
-    replacement: 'payment.providers.paypal.clientId',
-    why: 'the public half of the PayPal pair, already declared in config; the backend read it through a boot bridge that copied config into env',
-  },
-  CHARGEBEE_SITE: {
-    replacement: 'payment.providers.chargebee.site',
-    why: 'the site name is in every Chargebee URL, already declared in config; the backend read it through a boot bridge that copied config into env',
-  },
-  // The connections pair ([#845](https://github.com/Omega-JS-Stack/omega/issues/845)):
-  // these are SECRETS and stayed in `.env`, so the row is a rename, not a move.
-  // Exact names only, one per provider: the register is a name lookup, so the
-  // `OAUTH2_*` family is spelled out a row at a time as a brand needs it, and
-  // Google is the pair every brand carries today.
-  OAUTH2_GOOGLE_CLIENT_ID: {
-    home: 'env',
-    replacement: 'CONNECTIONS_GOOGLE_CLIENT_ID',
-    why: '#788 renamed the oauth2 feature to connections, the env family included; the backend reads only CONNECTIONS_<PROVIDER>_CLIENT_ID now',
-  },
-  OAUTH2_GOOGLE_CLIENT_SECRET: {
-    home: 'env',
-    replacement: 'CONNECTIONS_GOOGLE_CLIENT_SECRET',
-    why: '#788 renamed the oauth2 feature to connections, the env family included; the backend reads only CONNECTIONS_<PROVIDER>_CLIENT_SECRET now',
-  },
-  // The test-lane pair ([#819](https://github.com/Omega-JS-Stack/omega/issues/819),
-  // Ian 2026-09-13): retired outright, so neither row names a replacement. A
-  // suite no longer holds a credential of its own, which is why there is
-  // nothing to move the value to.
-  OMEGA_TEST_FIREBASE_ADMIN_KEY: {
-    replacement: null,
-    why: 'retired: desktop, extension and web test their own sign-in through a seeded persona from the backend emulator (#904), so no suite mints a custom token from a service account any more',
-  },
-  OMEGA_TEST_USER_UID: {
-    replacement: null,
-    why: 'retired: desktop, extension and web test their own sign-in through a seeded persona from the backend emulator (#904), and the roster names the persona, so no uid is configured anywhere',
-  },
-};
-
-/**
- * The retired keys a parsed `.env` layer carries, in the layer's own order.
- *
- * Presence is the whole test: an empty value (`KEY=`) documents a key nothing
- * reads, so it is owed the same deletion as a valued one.
- *
- * @param {Object<string, string>} values - Parsed `.env` values.
- * @returns {Array<{ key: string, replacement: string|null, why: string }>}
- */
-function findRetiredEnvKeys(values) {
-  return Object.keys(values || {})
-    .filter((key) => RETIRED_ENV_KEYS[key])
-    .map((key) => ({ key, ...RETIRED_ENV_KEYS[key] }));
-}
-
-/**
- * Refuse a `.env` layer that still carries a retired key, spelling the move
- * out. A row with no replacement says so plainly: the line is deleted and
- * nothing takes the value anywhere (#819).
- *
- * @param {Object<string, string>} values - Parsed `.env` values.
- * @param {string} envPath - The file the values came from (named in the error).
- * @throws {Error} Naming every retired key in the layer, its new home, and why.
- */
-function assertNoRetiredEnvKeys(values, envPath) {
-  const found = findRetiredEnvKeys(values);
-  if (found.length === 0) return;
-
-  const moves = found.map(({ key, replacement, why, home }) => {
-    if (!replacement) return `  ${key} is retired outright: delete the .env line, nothing replaces the value (${why})`;
-
-    return home === 'env'
-      ? `  ${key} renamed to ${replacement}; rename the .env line (${why})`
-      : `  ${key} moved to ${replacement} in config/omega.json5; delete the .env line (${why})`;
-  });
-
-  throw new Error(
-    `${envPath} carries ${found.length} retired env key(s). Nothing reads them, so the value is silently lost:\n`
-    + `${moves.join('\n')}\n`
-    + 'The rule, and the whole register: docs/shared/config.md ("Config or env?").',
-  );
-}
-
-module.exports = { RETIRED_ENV_KEYS, findRetiredEnvKeys, assertNoRetiredEnvKeys };