@omega.js/desktop 0.53.0 → 0.54.1

package/dist/vendor/config/repo.js

@@ -1,31 +1,14 @@
 /**
- * @omega.js/config repo: the ONE derivation of every repo a brand owns
- * ([#883](https://github.com/Omega-JS-Stack/omega/issues/883)).
- *
- * ONE config block says where a brand hosts its code:
- *
- *   repo: { provider: 'github', org: 'Acme-Org' }
- *
- * and nothing else. Presence of the block enables the repo service, exactly
- * as a target's key presence enables a target; `provider` defaults to `github`
- * and `org` is the only typed value. No repo NAME is ever configured: every
- * name derives from the `<brand.id>-<role>` rule (Ian 2026-09-07,
- * [#809](https://github.com/Omega-JS-Stack/omega/issues/809)), one function per
- * role, so nobody types a repo name to get the right one:
- *
- *   - `<brand.id>-omega`    the SOURCE monorepo (`sourceRepo`)
- *   - `<brand.id>-releases` the public release channel (`releasesRepo`)
- *   - `<brand.id>-<name>`   one per web target that GitHub hosts (`websiteRepo`)
- *
- * A repo name that must differ is a brand id that must differ: the override
- * keys (`repo.providers.github.repo`, the top-level `github` block,
- * `targets.<name>.github.repo`, `targets.desktop.releases.owner/repo`) are
- * retired, each with a row in retired-keys.js.
- *
- * Visibility is NOT in omega.json5 either: the brand root's package.json
- * `private` field is the one statement of it (`brandVisibility`), absent
- * meaning private, because every brand monorepo is private by default
- * (Ian 2026-09-11).
+ * @omega.js/config repo: the ONE derivation of every repo a brand owns. One
+ * block says where a brand hosts its code, `repo: { provider: 'github', org }`:
+ * its presence enables the repo service, `provider` defaults to `github`, and
+ * `org` is the only typed value. No repo NAME is configured anywhere; each
+ * derives from `<brand.id>-<role>`, one function per role: `<brand.id>-omega`
+ * the source monorepo (`sourceRepo`), `<brand.id>-releases` the public release
+ * channel (`releasesRepo`), `<brand.id>-<name>` per GitHub-hosted web target
+ * (`websiteRepo`). The old override keys are rows in @omega.js/manager's
+ * src/migrate/retired-keys.js. Visibility is the brand root package.json's
+ * `private` field (`brandVisibility`), absent meaning private.
  */
 
 const fs = require('node:fs');

package/dist/vendor/config/schema-client.js

@@ -0,0 +1,64 @@
+/**
+ * Schema rules for the `client` blob: the @omega.js/client settings bag a web
+ * target carries. The bag is OPEN (the client normalizes it against its own
+ * defaults); only the keys a brand authors, and consent, are typed.
+ */
+
+const CLIENT_RULES = [
+  {
+    path:        'client',
+    type:        'object',
+    open:        true,
+    required:    false,
+    description: "The @omega.js/client runtime settings (auth, firebase, exitPopup, …), merged over the client's own defaults. Open by design: only consent and the keys a brand authors are typed below.",
+  },
+
+  // Consent decides whether a visitor is tracked at all: a typo that silently
+  // disabled the banner would ship a site with no consent gate and no error.
+  {
+    path:        'client.consent.enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: 'The consent banner + the provider-script gate (default true). false ships NO banner: legal only for a site that loads no analytics/marketing provider at all.',
+  },
+  {
+    path:        'client.consent.config.position',
+    type:        'string',
+    required:    false,
+    enum:        ['bottom-left', 'bottom-right', 'bottom'],
+    description: "Where the panel sits. 'bottom' is the centered full-width form.",
+  },
+  {
+    path:        'client.consent.config.content',
+    type:        'object',
+    required:    false,
+    description: "Banner copy: message, panelIntro, accept, customize, acceptAll, acceptNone (a literal `{terms}`/`{cookies}` links the terms/cookie-policy page). Category labels are framework copy: a brand renames the buttons, not the categories.",
+  },
+
+  // The keys a BRAND authors: each one reaches the client payload and changes
+  // what the site does, so each one is typed.
+  {
+    path:        'client.auth.config.policy',
+    type:        'string',
+    required:    false,
+    enum:        ['authenticated', 'unauthenticated', 'disabled'],
+    description: "Who a page is FOR: 'authenticated' redirects a signed-out visitor to the signin route, 'unauthenticated' redirects a signed-in one away, 'disabled' skips the auth module entirely (a vert iframe). Absent = no policy, which is the site-wide answer: the auth/admin layouts set theirs in page frontmatter, so a brand only sets this to blanket a whole site.",
+  },
+  {
+    path:        'client.exitPopup.enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: 'The exit-intent offer popup (default true). false ships no popup at all; its copy, timeout and avatars live under client.exitPopup.config.',
+  },
+  {
+    path:        'client.serviceWorker.enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: 'Registers the site service worker (default true): the offline/refresh lane and the push-notification registration ride it. false unregisters any worker the visitor already has.',
+  },
+];
+
+module.exports = { CLIENT_RULES };

package/dist/vendor/config/schema-cloud.js

@@ -0,0 +1,38 @@
+/**
+ * Schema rules for `cloud.config`, the provider's web-app config. For firebase
+ * it is the console's config verbatim: public by design (the web API key is no
+ * secret), and every key the Firebase web SDK takes is typed.
+ */
+
+const FIREBASE_WEB_KEYS = {
+  apiKey: 'The web API key the Firebase SDKs identify the project with. Public by design: it ships in every browser bundle.',
+  authDomain: "The Firebase Auth domain: the BRAND host, where the web build self-hosts /__/auth/* (docs/shared/config.md → authDomain).",
+  databaseURL: 'The Realtime Database URL, for a project that has one.',
+  storageBucket: 'The default Cloud Storage bucket.',
+  messagingSenderId: 'The Cloud Messaging sender id web push registers against.',
+  appId: 'The Firebase web app id.',
+  measurementId: 'The Google Analytics measurement id Firebase links to the web app.',
+};
+
+const CLOUD_CONFIG_RULES = [
+  {
+    path:        'cloud.config',
+    type:        'object',
+    required:    false,
+    description: 'Provider app config. For firebase: the web-app config verbatim from the console. Public by design: the web API key is not a secret.',
+  },
+  {
+    path:        'cloud.config.projectId',
+    type:        'string',
+    required:    false,
+    description: 'Drives auth, emulator project selection, analytics uuidv5 namespace, remote-config URL fallbacks.',
+  },
+  ...Object.entries(FIREBASE_WEB_KEYS).map(([key, description]) => ({
+    path:        `cloud.config.${key}`,
+    type:        'string',
+    required:    false,
+    description,
+  })),
+];
+
+module.exports = { CLOUD_CONFIG_RULES };

package/dist/vendor/config/schema-manager.js

@@ -0,0 +1,118 @@
+/**
+ * Schema rules for the keys the manager's services (and the backend's content
+ * generators) read or write back: the brand switch, service switches, and the
+ * Stripe, GA4, devlog, blog and SEO engine data. The four zero-data switches
+ * default ON here and are materialized into brand files; the engine data's
+ * defaults stay in the manager's config.js.
+ */
+
+const MANAGER_RULES = [
+  {
+    path:        'enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: 'Whether the brand is active. `false` makes the manager skip it: a company run stamps it but never spawns its walk.',
+  },
+  {
+    path:        'server.enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: "false (or `server: false`) skips the manager's server service, which registers this brand in the company server's brands collection.",
+  },
+  {
+    path:        'assets.enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: "false (or `assets: false`) skips the manager's assets service, which derives the brand's visual collateral from its logo sources.",
+  },
+  {
+    path:        'payment.enabled',
+    type:        'boolean',
+    required:    false,
+    default:     true,
+    description: "false skips the manager's payment service: no provider account, product, webhook or Radar reconciliation for this brand.",
+  },
+  {
+    path:        'payment.providers.stripe.updateAccountInfo',
+    type:        'boolean',
+    required:    false,
+    description: "false leaves the Stripe account's business profile alone instead of diffing it to the brand's name, url and support email.",
+  },
+  {
+    path:        'payment.providers.stripe.radar',
+    type:        'array',
+    required:    false,
+    description: "The Radar fraud rules ([{ action, predicate, description }]) the payment service prints as guidance: Radar has no API, so a human applies them in the Dashboard.",
+  },
+  {
+    path:        'payment.providers.stripe.radarConfirmed',
+    type:        'boolean',
+    required:    false,
+    description: 'Machine-written: the Radar rules were applied by hand in the Dashboard. The confirmation is the record, because nothing can read them back.',
+  },
+  {
+    path:        'payment.providers.stripe.disputesConfirmed',
+    type:        'boolean',
+    required:    false,
+    description: 'Machine-written: Enhanced Dispute Protection was switched on by hand in the Dashboard. The confirmation is the record, because nothing can read it back.',
+  },
+  {
+    path:        'analytics.providers.google.timeZone',
+    type:        'string',
+    required:    false,
+    description: 'The GA4 property reporting time zone the analytics service uses when it creates the property.',
+  },
+  {
+    path:        'analytics.providers.google.currency',
+    type:        'string',
+    required:    false,
+    description: 'The GA4 property reporting currency the analytics service uses when it creates the property.',
+  },
+  {
+    path:        'analytics.providers.google.enhancedMeasurement',
+    type:        'object',
+    required:    false,
+    description: "The GA4 web streams' Enhanced Measurement switches ({ scrollsEnabled, siteSearchEnabled, … }) the analytics service diffs every stream to.",
+  },
+  {
+    path:        'devlog.providers.ghostii',
+    type:        'object',
+    required:    false,
+    description: 'The devlog writer and its settings (orgs, lookbackDays, excludeRepos, excludeCommits, excludeTopics, includePrivate, postPath, destinations, overrides): the manager\'s devlog pipeline reads them here.',
+  },
+  {
+    path:        'blog.enabled',
+    type:        'boolean',
+    required:    false,
+    description: "true lets the backend's daily blog auto-publisher run; absent or false, it skips.",
+  },
+  {
+    path:        'blog.providers',
+    type:        'object',
+    required:    false,
+    description: 'The blog writer, a KEY under `providers` (ghostii when none is picked).',
+  },
+  {
+    path:        'blog.content',
+    type:        'object|array',
+    required:    false,
+    description: 'The blog pipeline entries ({ sources, categories, links, postPath, … }), one object or a list.',
+  },
+  {
+    path:        'seo.enabled',
+    type:        'boolean',
+    required:    false,
+    description: "false (or `seo: false`) skips the manager's seo service.",
+  },
+  {
+    path:        'seo.github',
+    type:        'object',
+    required:    false,
+    description: "The parasite-SEO content repos (`seo.github.content[]`) the seo service reconciles; a `config/seo.json5` sidecar merges over it.",
+  },
+];
+
+module.exports = { MANAGER_RULES };

package/dist/vendor/config/schema-overrides.js

@@ -0,0 +1,68 @@
+/**
+ * Per-target rules for what a brand hands a framework verbatim: the desktop
+ * install knobs electron-builder takes, and the documented override blocks
+ * whose shape belongs to someone else (electron-builder, Electron, the MCP
+ * client), where a rule types the block and never the keys inside it.
+ */
+
+// A platform's install knobs beside its `formats`, handed to electron-builder
+const knob = (path, type, description) => ({ path: `platforms.${path}`, type, required: false, description });
+
+const DESKTOP = [
+  knob('mac.arch', 'array|string', 'The mac architectures built (`universal`, `x64`, `arm64`).'),
+  knob('mac.entitlements', 'object|string', 'The mac hardened-runtime entitlements (a map, or a plist path).'),
+  knob('mac.mas.enabled', 'boolean', 'Mac App Store distribution: reserved, not implemented yet (the audit warns when true).'),
+  knob('mac.mas.provisioningProfile', 'string', 'The Mac App Store provisioning profile path (reserved).'),
+  knob('mac.mas.entitlements', 'string', 'The Mac App Store entitlements plist (reserved).'),
+  knob('mac.mas.entitlementsInherit', 'string', 'The Mac App Store inherited entitlements plist (reserved).'),
+  knob('windows.arch', 'array|string', 'The Windows architectures built (`x64`, `ia32`, `arm64`).'),
+  knob('windows.oneClick', 'boolean', 'NSIS one-click install (no wizard).'),
+  knob('windows.desktopShortcut', 'boolean', 'NSIS creates a desktop shortcut.'),
+  knob('windows.startMenuShortcut', 'boolean', 'NSIS creates a Start-menu shortcut.'),
+  knob('windows.runAfterFinish', 'boolean', 'NSIS launches the app when the install finishes.'),
+  knob('windows.perMachine', 'boolean', 'NSIS installs for every user rather than the current one.'),
+  knob('windows.signing.cloud', 'object', 'The cloud signing provider and its options, for the `cloud` signing strategy.'),
+  knob('linux.arch', 'array|string', 'The Linux architectures built (`x64`, `arm64`).'),
+  {
+    path:        'electronBuilder',
+    type:        'object',
+    required:    false,
+    description: "Merged over the generated electron-builder config as the LAST layer (build-config.js), for the rare knob the framework defaults do not cover. Any electron-builder key.",
+  },
+  {
+    path:        'fileAssociations',
+    type:        'array',
+    required:    false,
+    description: "The file types the packaged app registers for ([{ ext, name, role, icon }]), handed to electron-builder's fileAssociations as written.",
+  },
+  {
+    path:        'protocols',
+    type:        'array',
+    required:    false,
+    description: "The URL schemes the packaged app registers for ([{ name, schemes }]), handed to electron-builder's protocols as written.",
+  },
+  {
+    path:        'windows',
+    type:        'object',
+    required:    false,
+    description: 'Per-window BrowserWindow options keyed by window name (`windows.main.width`); the window manager merges each over its own defaults, and a call-site override still wins.',
+  },
+  {
+    path:        'cdp',
+    type:        'object',
+    required:    false,
+    description: 'The desktop cdp command\'s settings. `cdp.readySignal` is the URL substring of the view whose load marks boot complete, for an app that finishes after its first paint.',
+  },
+];
+
+const BACKEND = [
+  {
+    path:        'mcp.authUrl',
+    type:        'string',
+    required:    false,
+    match:       /^https?:\/\//,
+    description: "Overrides the consumer auth URL the backend's MCP OAuth flow sends a client to; unset derives `<website url>/token` (docs/backend/mcp.md).",
+  },
+];
+
+module.exports = { OVERRIDE_RULES: { desktop: DESKTOP, backend: BACKEND } };