One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

apps/desktop/tests/fixtures/state/README.txt

@@ -6,3 +6,7 @@ empty.json               no file content yet (fresh install)
 d1-missing-folders.json  desktop D1 format (projects + accounts only, no version) with two folders that are gone
 d3-full.json             D3 format without version: studios, accounts in studios, overrides, settings, one folder
                          that exists and one that is gone
+shared-profiles.json     0.8 format: accounts name their credential profile (~/.storebound/credentials, shared with
+                         the CLI); the apple account comes from a profile the CLI wrote; the folder pins storebound 0.6.0
+The .host.json answers come after the start-up sync: D1's accounts have no keychain entry (they stay without a
+profile), D3's keychain entries move into credential profiles.

apps/desktop/tests/fixtures/state/d3-full.host.json

@@ -5,6 +5,7 @@
       "id": "0123456789abcdef",
       "kind": "play",
       "label": "Example Games Play",
+      "profile": "example-games-play",
       "studio": "s1"
     },
     {
@@ -12,6 +13,7 @@
       "id": "fedcba9876543210",
       "kind": "apple",
       "label": "Example Games App Store",
+      "profile": "example-games-app-store",
       "studio": "s1"
     },
     {
@@ -19,6 +21,7 @@
       "id": "00112233445566ff",
       "kind": "apple",
       "label": "Side project",
+      "profile": "side-project",
       "studio": null
     }
   ],

apps/desktop/tests/fixtures/state/shared-profiles.host.json

@@ -0,0 +1,58 @@
+{
+  "accounts_list": [
+    {
+      "created": "2026-10-13T00:00:00Z",
+      "id": "82a8c2561d950999",
+      "kind": "play",
+      "label": "Acme Games",
+      "profile": "default",
+      "studio": null
+    },
+    {
+      "created": "2026-10-13T00:00:00Z",
+      "id": "8e4050ce9325b4da",
+      "kind": "apple",
+      "label": "Acme Games",
+      "profile": "default",
+      "studio": null
+    }
+  ],
+  "projects_list": [
+    {
+      "added": "2026-10-13T00:00:00Z",
+      "appleAccount": "8e4050ce9325b4da",
+      "id": "p0game0000000001",
+      "name": "demo-game",
+      "path": "@EXAMPLES@/demo-game",
+      "playAccount": "82a8c2561d950999",
+      "storeboundPin": "0.6.0"
+    }
+  ],
+  "workspace_get": {
+    "overrides": {
+      "appStudio": [],
+      "ignored": [],
+      "links": [],
+      "pairs": [],
+      "unpairs": []
+    },
+    "settings": {
+      "cache": {
+        "keepDays": 30
+      },
+      "channel": "stable",
+      "notify": {
+        "crash": true,
+        "lowReviews": true,
+        "reviewState": true
+      },
+      "refresh": {
+        "autoMinutes": 0,
+        "icons": true,
+        "onLaunch": false,
+        "parallel": 4
+      }
+    },
+    "studios": []
+  }
+}

apps/desktop/tests/fixtures/state/shared-profiles.json

@@ -0,0 +1,17 @@
+{
+  "version": 2,
+  "projects": [
+    { "id": "p0game0000000001", "path": "@EXAMPLES@/demo-game", "name": "demo-game", "playAccount": "82a8c2561d950999", "appleAccount": "8e4050ce9325b4da", "added": "2026-10-13T00:00:00Z" }
+  ],
+  "accounts": [
+    { "id": "82a8c2561d950999", "label": "Acme Games", "kind": "play", "created": "2026-10-13T00:00:00Z", "studio": null, "profile": "default" }
+  ],
+  "studios": [],
+  "overrides": { "pairs": [], "unpairs": [], "links": [], "appStudio": [], "ignored": [] },
+  "settings": {
+    "refresh": { "autoMinutes": 0, "onLaunch": false, "parallel": 4, "icons": true },
+    "cache": { "keepDays": 30 },
+    "notify": { "reviewState": true, "lowReviews": true, "crash": true },
+    "channel": "stable"
+  }
+}

apps/desktop/tests/resilience.test.ts

@@ -72,7 +72,10 @@ describe('host data of any age', () => {
     ]);
     expect(p.map(x => [x.id, x.name, x.missing])).toEqual([['a', 'Prism Puddle', true], ['b', 'Tidy', false]]);
     expect(normalizeProjects(undefined)).toEqual([]);
-    expect(normalizeAccounts([{ id: 'x', kind: 'play' }, { id: 'y', kind: 'fax' }])).toEqual([{ id: 'x', label: 'x', kind: 'play', created: '', studio: null }]);
+    expect(normalizeAccounts([{ id: 'x', kind: 'play' }, { id: 'y', kind: 'fax' }])).toEqual([{ id: 'x', label: 'x', kind: 'play', created: '', studio: null, profile: null }]);
+    // 0.8: the credential profile shared with the CLI; a folder pinning another storebound version
+    expect(normalizeAccounts([{ id: 'z', kind: 'apple', profile: 'default' }])[0]!.profile).toBe('default');
+    expect(normalizeProjects([{ id: 'p', path: '/w/a', storeboundPin: '0.6.0' }])[0]!.storeboundPin).toBe('0.6.0');
   });
 });