${{ secrets.VARIABLE_NAME }}.
---
@@ -228,7 +228,8 @@ publish:
Your server must host the same directory structure as the S3 layout above.
-> [!IMPORTANT] > **MIME Type Configuration**: Ensure your file server correctly serves `.yml` files with `text/yaml` and installer binaries with `application/octet-stream`. Incorrect MIME types will cause download corruption or silent update failures.
+> [!IMPORTANT]
+> **MIME Type Configuration**: Ensure your file server correctly serves `.yml` files with `text/yaml` and installer binaries with `application/octet-stream`. Incorrect MIME types will cause download corruption or silent update failures.
**Nginx reference:**
@@ -255,7 +256,8 @@ server {
## 🛡️ Code Signing: The Trust Boundary
-> [!WARNING] > **Code signing is not merely a requirement — it is the Trust Boundary established by the operating system.** macOS Gatekeeper will explicitly terminate unsigned applications or refuse background updates to maintain system integrity. Windows SmartScreen will display alarming warnings to users. Without valid signatures, `electron-updater` will **reject update payloads entirely**.
+> [!WARNING]
+> **Code signing is not merely a requirement — it is the Trust Boundary established by the operating system.** macOS Gatekeeper will explicitly terminate unsigned applications or refuse background updates to maintain system integrity. Windows SmartScreen will display alarming warnings to users. Without valid signatures, `electron-updater` will **reject update payloads entirely**.
### macOS
diff --git a/apps/desktop/docs/CONFIGURATION.md b/apps/docs-dev/src/apps/desktop/CONFIGURATION.md
similarity index 99%
rename from apps/desktop/docs/CONFIGURATION.md
rename to apps/docs-dev/src/apps/desktop/CONFIGURATION.md
index 208eb23..c0ec7f8 100644
--- a/apps/desktop/docs/CONFIGURATION.md
+++ b/apps/docs-dev/src/apps/desktop/CONFIGURATION.md
@@ -1,4 +1,3 @@
-[← Back to Root](../../../README.md)
# Desktop Configuration Guide
diff --git a/apps/desktop/docs/IPC_ARCHITECTURE.md b/apps/docs-dev/src/apps/desktop/IPC_ARCHITECTURE.md
similarity index 92%
rename from apps/desktop/docs/IPC_ARCHITECTURE.md
rename to apps/docs-dev/src/apps/desktop/IPC_ARCHITECTURE.md
index b36d79f..26a50e3 100644
--- a/apps/desktop/docs/IPC_ARCHITECTURE.md
+++ b/apps/docs-dev/src/apps/desktop/IPC_ARCHITECTURE.md
@@ -1,10 +1,21 @@
-[← Back to Root](../../../README.md)
+---
+outline: [2, 3]
+---
# IPC Architecture & Security Model
-The Secure Communication Blueprint.
+> **Scope**: Electron Main ↔ Renderer process communication
+> **Enforcement Level**: Mandatory — deviations constitute security violations
-> This document defines the **Hardened Security Perimeter** and communication topology governing the Desktop Wrapper. Every native capability exposed to the renderer is mediated through a **Non-Bypassable IPC Bridge**, ensuring that the Node.js Main Process remains cryptographically and logically isolated from untrusted web content. Adherence to this document is **mandatory** — deviations constitute security violations subject to immediate remediation.
+This document defines the **hardened security perimeter** and communication topology governing the Desktop Wrapper. Every native capability exposed to the Renderer is mediated through a **non-bypassable IPC bridge**, enforcing strict privilege separation between the Node.js Main Process and untrusted web content.
+
+The architecture operates on three invariants:
+
+| Invariant | Guarantee |
+|---|---|
+| **Context Encapsulation** | The Preload Script executes in a hermetically sealed V8 context, isolated from both Main Process globals and the Renderer DOM. |
+| **Interface Narrowing** | Only explicitly declared, type-safe API surfaces are exposed via `contextBridge`. No wildcard access patterns exist. |
+| **Deterministic Lifecycle** | All IPC subscriptions are paired with unsubscribe functions, tying native event listeners to React's component lifecycle to prevent memory leaks. |
---
@@ -96,7 +107,8 @@ These settings are declared in `BrowserWindow.webPreferences` and are **non-nego
Every native feature in this architecture **must** follow the Three-Step Bridge — a Standard Operating Procedure (SOP) that ensures traceability, type-safety, and auditability across the entire IPC surface.
-> [!IMPORTANT] > **Deterministic Synchronization**: Maintaining parity between the Main Process handler, the Preload Gateway exposure, and the TypeScript interface declaration is **mandatory**. A mismatch between any two of the three layers will result in either a **Type-Safety Gap** (silent failures in development) or a **Runtime Regression** (crashes in production).
+> [!IMPORTANT]
+> **Deterministic Synchronization**: Maintaining parity between the Main Process handler, the Preload Gateway exposure, and the TypeScript interface declaration is **mandatory**. A mismatch between any two of the three layers will result in either a **Type-Safety Gap** (silent failures in development) or a **Runtime Regression** (crashes in production).
### Step 1: Register the Handler — Main Process
diff --git a/apps/desktop/README.md b/apps/docs-dev/src/apps/desktop/index.md
similarity index 90%
rename from apps/desktop/README.md
rename to apps/docs-dev/src/apps/desktop/index.md
index 220e0ee..68e245e 100644
--- a/apps/desktop/README.md
+++ b/apps/docs-dev/src/apps/desktop/index.md
@@ -102,7 +102,7 @@ All artifacts are emitted to the `release/` directory.
> APPLE_APP_SPECIFIC_PASSWORD=Building high-end enterprise applications requires strict consistency, shared tooling, and well-defined boundaries. This monorepo serves as the absolute source of truth for our frontend ecosystem.
+ +By enforcing strict linting, formatting, and building patterns at the root, we ensure that every application in the ecosystem adheres to our high standards without duplicate configuration.
+The separation of UI and Core logic means our web, desktop, and potential mobile applications all share the same state management and event-driven architecture, reducing cognitive load.
+Stop reinventing the wheel. With a rich library of primitive components and pre-configured Vite/TypeScript environments, teams can start building product features on day one.
+Building high-end enterprise applications requires strict consistency, shared tooling, and well-defined boundaries. This monorepo serves as the absolute source of truth for our frontend ecosystem.
- -Building high-end enterprise applications requires strict consistency, shared tooling, and well-defined boundaries. This monorepo serves as the absolute source of truth for our frontend ecosystem.
+By enforcing strict linting, formatting, and building patterns at the root, we ensure that every application in the ecosystem adheres to our high standards without duplicate configuration.
+By enforcing strict linting, formatting, and building patterns at the root (powered by Turborepo), we ensure that every application in the ecosystem adheres to our high standards without duplicate configuration.
The separation of UI and Core logic means our web, desktop, and potential mobile applications all share the same state management and event-driven architecture, reducing cognitive load.
+The separation of UI components and Core logic guarantees that our web and desktop applications all share the exact same state management and event-driven architecture, drastically reducing cognitive load.
Stop reinventing the wheel. With a rich library of primitive components and pre-configured Vite/TypeScript environments, teams can start building product features on day one.
+With a rich library of 22+ advanced Form components, pre-configured Vite/TypeScript environments, and an enterprise App Shell, teams can stop reinventing the wheel and start building product features on day one.