Improve desktop security by isolating Electron

Enable `contextIsolation` in Electron to securely expose a limited set
of Node.js APIs to the renderer process. It:

1. Isolates renderer and main process contexts. It ensures that the
   powerful main process functions aren't directly accessible from
   renderer process(es), adding a security boundary.
2. Mitigates remote exploitation risks. By isolating contexts, potential
   malicious code injections in the renderer can't directly reach and
   compromise the main process.
3. Reduces attack surface.
4. Protect against prototype pollution: It prevents tampering of
   JavaScript object prototypes in one context from affecting another
   context, improving app reliability and security.

Supporting changes include:

- Extract environment and system operations classes to the infrastructure
  layer. This removes node dependencies from core domain and application
  code.
- Introduce `ISystemOperations` to encapsulate OS interactions. Use it
  from `CodeRunner` to isolate node API usage.
- Add a preloader script to inject validated environment variables into
  renderer context. This keeps Electron integration details
  encapsulated.
- Add new sanity check to fail fast on issues with preloader injected
  variables.
- Improve test coverage of runtime sanity checks and environment
  components. Move validation logic into separate classes for Single
  Responsibility.
- Improve absent value test case generation.

.browserslistrc

@@ -1,2 +1,3 @@
 > 1%
 last 2 versions
+not dead

.dockerignore

@@ -0,0 +1,9 @@
+node_modules
+dist
+dist_electron
+.vs
+.vscode
+.github
+.git
+docs
+docker

.editorconfig

@@ -0,0 +1,7 @@
+[*.{js,jsx,ts,tsx,vue,sh}]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+max_line_length = 100

.eslintignore

@@ -0,0 +1,2 @@
+dist/
+dist_electron/

.eslintrc.cjs

@@ -0,0 +1,95 @@
+const { rules: baseStyleRules } = require('eslint-config-airbnb-base/rules/style');
+const tsconfigJson = require('./tsconfig.json');
+require('@rushstack/eslint-patch/modern-module-resolution');
+
+module.exports = {
+  root: true,
+  env: {
+    node: true,
+    es2022: true, // add globals and sets parserOptions.ecmaVersion to 2022
+  },
+  extends: [
+    // Vue specific rules, eslint-plugin-vue
+    'plugin:vue/essential',
+
+    // Extends eslint-config-airbnb
+    '@vue/eslint-config-airbnb-with-typescript',
+
+    // Extends @typescript-eslint/recommended
+    // Uses the recommended rules from the @typescript-eslint/eslint-plugin
+    '@vue/typescript/recommended',
+  ],
+  rules: {
+    ...getOwnRules(),
+    ...getTurnedOffBrokenRules(),
+    ...getOpinionatedRuleOverrides(),
+    ...getTodoRules(),
+  },
+};
+
+function getOwnRules() {
+  return {
+    'no-console': process.env.NODE_ENV === 'production' ? 'warn' : 'off',
+    'no-debugger': process.env.NODE_ENV === 'production' ? 'warn' : 'off',
+    'linebreak-style': ['error', 'unix'], // This is also enforced in .editorconfig and .gitattributes files
+    'import/order': [ // Enforce strict import order taking account into aliases
+      'error',
+      {
+        groups: [ // Enforce more strict order than AirBnb
+          'builtin', 'external', 'internal', 'parent', 'sibling', 'index', 'object', 'type'],
+        pathGroups: [ // Fix manually configured paths being incorrectly grouped as "external"
+          ...getAliasesFromTsConfig(),
+          'js-yaml-loader!@/**',
+        ].map((pattern) => ({ pattern, group: 'internal' })),
+      },
+    ],
+  };
+}
+
+function getTodoRules() { // Should be worked on separate future commits
+  return {
+    'import/no-extraneous-dependencies': 'off',
+    // Accessibility improvements:
+    'vuejs-accessibility/form-control-has-label': 'off',
+    'vuejs-accessibility/click-events-have-key-events': 'off',
+    'vuejs-accessibility/anchor-has-content': 'off',
+    'vuejs-accessibility/accessible-emoji': 'off',
+  };
+}
+
+function getTurnedOffBrokenRules() {
+  return {
+    // Broken in TypeScript
+    'no-useless-constructor': 'off', // Cannot interpret TypeScript constructors
+    'no-shadow': 'off', // Fails with TypeScript enums
+  };
+}
+
+function getOpinionatedRuleOverrides() {
+  return {
+    // https://erkinekici.com/articles/linting-trap#no-use-before-define
+    'no-use-before-define': 'off',
+    '@typescript-eslint/no-use-before-define': 'off',
+    // https://erkinekici.com/articles/linting-trap#arrow-body-style
+    'arrow-body-style': 'off',
+    // https://erkinekici.com/articles/linting-trap#no-plusplus
+    'no-plusplus': 'off',
+    // https://erkinekici.com/articles/linting-trap#no-param-reassign
+    'no-param-reassign': 'off',
+    // https://erkinekici.com/articles/linting-trap#class-methods-use-this
+    'class-methods-use-this': 'off',
+    // https://erkinekici.com/articles/linting-trap#importprefer-default-export
+    'import/prefer-default-export': 'off',
+    // https://erkinekici.com/articles/linting-trap#disallowing-for-of
+    // Original: https://github.com/airbnb/javascript/blob/d8cb404da74c302506f91e5928f30cc75109e74d/packages/eslint-config-airbnb-base/rules/style.js#L333-L351
+    'no-restricted-syntax': [
+      baseStyleRules['no-restricted-syntax'][0],
+      ...baseStyleRules['no-restricted-syntax'].slice(1).filter((rule) => rule.selector !== 'ForOfStatement'),
+    ],
+  };
+}
+
+function getAliasesFromTsConfig() {
+  return Object.keys(tsconfigJson.compilerOptions.paths)
+    .map((path) => `${path}*`);
+}

.gitattributes

@@ -0,0 +1,6 @@
+# Prevent Git from auto-converting to CRLF on Windows, and convert to LF on checkin.
+#   *           : All files
+#   text=auto   : If Git decides content it text, it converts CRLF to LF on checkin.
+#   eol=lf      : forces Git to normalize line endings to LF on checkin and prevents conversion
+#                 to CRLF when the file is checked out.
+* text=auto eol=lf

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: undergroundwires

.github/ISSUE_TEMPLATE/1-bug-report-scripts.md

@@ -0,0 +1,57 @@
+---
+name: Bug report (script bug or unexpected script behavior)
+about: Create a bug report for generated scripts to help privacy.sexy improve
+labels: bug
+title: '[BUG]: '
+---
+
+<!--
+Thank you for reporting an issue with generated script(s).
+Please fill in as much of the template below as you're able.
+As a small open source project with small community, it can sometimes take a long time for issues to be addressed so please be patient. 
+-->
+
+### Description
+
+<!--
+A clear and concise description of what the bug is.
+-->
+
+### OS
+
+<!--
+Which OS are you using? What version of OS you were using?
+On Windows: Open "Start button" > "Settings" > "System" > "About".
+On macOS: Open "Apple menu (top left corner)" > "About This Mac".
+On Linux: Open terminal > type: lsb_release -a > copy paste the result.
+-->
+
+### Reproduction steps
+
+<!--
+How can the bug be recreated?
+It's the most important information in the bug report. Bugs that cannot be reproduced cannot be fixed and verified.
+E.g.
+    1. Go to '...'
+    2. Click on '....'
+    3. Scroll down to '....'
+    4. See error
+-->
+
+### Scripts
+
+<!--
+If applicable, please attach the generated privacy.sexy file instead of copy pasting which becomes too long.
+-->
+
+### Screenshots
+
+<!--
+If applicable, add screenshots to help explain your problem.
+-->
+
+### Additional information
+
+<!--
+If applicable, add any other context about the problem here.
+-->

.github/ISSUE_TEMPLATE/2-bug-report-generic.md

@@ -0,0 +1,55 @@
+---
+name: Bug report (unrelated to generated scripts)
+about: Create a bug report that's not related to generated scripts to help privacy.sexy improve
+labels: bug
+title: '[BUG]: '
+---
+
+<!--
+Thank you for reporting an issue.
+Please fill in as much of the template below as you're able.
+As a small open source project with small community, it can sometimes take a long time for issues to be addressed so please be patient. 
+-->
+
+### Description
+
+<!--
+A clear and concise description of what the bug is.
+-->
+
+### Reproduction steps
+
+<!--
+It's the most important information in the bug report. Bugs that cannot be reproduced cannot be fixed and verified.
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+-->
+
+### Expected behavior
+
+<!--
+A clear and concise description of what you expected to happen.
+-->
+
+### Screenshots
+
+<!--
+If applicable, add screenshots to help explain your problem.
+-->
+
+### Distribution
+
+<!--
+If applicable, mention how you were using privacy.sexy when the bug was encountered:
+   - Web (on Desktop or mobile?)
+   - Or desktop (Windows, macOS or Linux?)
+-->
+
+### Additional context
+
+<!--
+If applicable, add any other context about the problem here.
+-->

.github/ISSUE_TEMPLATE/3-feature-request.md

@@ -0,0 +1,36 @@
+---
+name: Feature request
+about: Suggest an idea for privacy.sexy
+labels: enhancement
+---
+
+<!--
+Thank you for suggesting an idea to improve privacy better 🤗.
+Please fill in as much of the template below as you're able.
+-->
+
+### Problem description
+
+<!--
+What are we trying to solve?
+Please add a clear and concise description of the problem you are seeking to solve with this feature request.
+E.g. I'm always frustrated when [...]
+-->
+
+### Proposed solution
+
+<!--
+Describe the solution you'd like in a clear and concise manner.
+-->
+
+### Alternatives considered
+
+<!--
+A clear and concise description of any alternative solutions or features you've considered.
+-->
+
+### Additional information
+
+<!--
+If applicable, add any other context or screenshots about the feature request here.
+-->

.github/ISSUE_TEMPLATE/4-new-script-suggestion.md

@@ -0,0 +1,75 @@
+---
+name: New script suggestion
+about: Suggest a new script for privacy.sexy
+labels: enhancement
+---
+
+<!--
+Thank you for suggesting an script to make privacy better. 🤗 
+Please fill in as much of the template below as you're able.
+You could alternatively send a PR directly (see CONTRIBUTING.md).
+-->
+
+### OS
+
+<!--
+Which OS will the new script configure?
+One of the supported OSes: "Windows", "macOS" or "Linux".
+-->
+
+### Name
+
+<!--
+The name of the script.
+It should start with an imperative noun such as "disable", "turn off" , "clear"...
+E.g. "Disable webcam telemetry"
+-->
+
+### Script code
+
+<!--
+Code that will be executed when script is selected.
+Try to keep it as simple and backwards-compatible as possible.
+Allowed languages:
+  - Windows: PowerShell (ps1) or batchfile
+    - 💡 Prioritize the one that's simpler, batchfile if similar.
+  - macOS: bash (sh)
+  - Linux: bash (sh) or Python 3
+    - 💡 Prioritize the one that's simpler, bash if similar.
+-->
+
+### Revert code
+
+<!--
+If applicable, add code that will revert the script code to its original (OS default) state.
+It may require additional time, but it's much appreciated by the community.
+Leave blank if the script is nonreversible (e.g. when clearing data without backup).
+-->
+
+### Suggested category
+
+<!--
+If applicable, suggest one more multiple suitable parent category of script.
+A category is the item where the script will be presented under.
+Most likely there already is a category for the script, so check the existing categories.
+If you're unsure, leave blank and maintainer(s) will choose one.
+-->
+
+### Suggested recommendation level
+
+<!--
+If applicable, suggest recommending the script or not recommending at all.
+A script should be only recommended if it'll be safe for your grandmother to run.
+So you have three options here:
+  STANDARD: Non-breaking scripts that does not limit any functionality.
+  STRICT: Scripts that can break certain functionality but not intrusive to common daily OS usage.
+  NONE: Script is not recommended for newbies at all, only those who knows what's going on should select it.
+If you're unsure, leave blank and maintainer(s) will choose one.
+-->
+
+### Additional documentation/references
+
+<!-- 
+If applicable, refer to documentation that should show up on the script description.
+Sources (URLs) should be as high quality as possible e.g. vendor documentation is favored over user forums.
+-->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/actions/setup-node/action.yml

@@ -0,0 +1,8 @@
+runs:
+  using: composite
+  steps:
+    -
+      name: Setup node
+      uses: actions/setup-node@v2
+      with:
+        node-version: 16.x

.github/workflows/build-and-deploy.yaml

@@ -1,91 +0,0 @@
-name: Build & deploy
-
-on:
-  push:
-    branches:
-    - master
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-18.04
-    steps:
-      -
-        name: "Prepare: Checkout"
-        uses: actions/checkout@v1
-      -
-        name: "Prepare: Create AWS user profile"
-        run: >-
-          bash "aws/scripts/configure/create-user-profile.sh" \
-            --profile user \
-            --access-key-id ${{secrets.AWS_DEPLOYMENT_USER_ACCESS_KEY_ID}} \
-            --secret-access-key ${{secrets.AWS_DEPLOYMENT_USER_SECRET_ACCESS_KEY}} \
-            --region us-east-1
-      -
-        name: "Infrastructure: Deploy IAM stack"
-        run: >-
-          bash "aws/scripts/deploy/deploy-stack.sh" \
-            --template-file aws/iam-stack.yaml \
-            --stack-name privacysexy-iam-stack \
-            --capabilities CAPABILITY_IAM  \
-            --region us-east-1 --role-arn ${{secrets.AWS_IAM_STACK_DEPLOYMENT_ROLE_ARN}} \
-            --profile user --session ${{github.actor}}-${{github.event_name}}-${{github.sha}}
-      -
-        name: "Infrastructure: Deploy certificate stack"
-        run: >-
-          bash "aws/scripts/deploy/deploy-stack.sh" \
-            --template-file aws/certificate-stack.yaml \
-            --stack-name privacysexy-certificate-stack \
-            --region us-east-1 \
-            --role-arn ${{secrets.AWS_CERTIFICATE_STACK_DEPLOYMENT_ROLE_ARN}} \
-            --profile user --session ${{github.actor}}-${{github.event_name}}-${{github.sha}}
-      -
-        name: "Infrastructure: Deploy DNS stack"
-        run: >-
-          bash "aws/scripts/deploy/deploy-stack.sh" \
-            --template-file aws/dns-stack.yaml \
-            --stack-name privacysexy-dns-stack \
-            --region us-east-1 \
-            --role-arn ${{secrets.AWS_DNS_STACK_DEPLOYMENT_ROLE_ARN}} \
-            --profile user --session ${{github.actor}}-${{github.event_name}}-${{github.sha}}
-      -
-        name: "Infrastructure: Deploy web stack"
-        run: >-
-          bash "aws/scripts/deploy/deploy-stack.sh" \
-            --template-file aws/web-stack.yaml \
-            --stack-name privacysexy-web-stack \
-            --region us-east-1 \
-            --role-arn ${{secrets.AWS_WEB_STACK_DEPLOYMENT_ROLE_ARN}} \
-            --profile user --session ${{github.actor}}-${{github.event_name}}-${{github.sha}}
-      -
-        name: "App: Setup node"
-        uses: actions/setup-node@v1
-        with:
-          node-version: '11.x'
-      -
-        name: "App: Install dependencies"
-        run: npm install
-      -
-        name: "App: Run tests"
-        run: npm run test:unit
-      - 
-        name: "App: Build"
-        run: npm run build
-      -
-        name: "App: Deploy to S3"
-        run: >-
-          bash "aws/scripts/deploy/deploy-to-s3.sh" \
-            --folder dist \
-            --web-stack-name privacysexy-web-stack --web-stack-s3-name-output-name S3BucketName \
-            --storage-class ONEZONE_IA \
-            --role-arn ${{secrets.AWS_S3_SITE_DEPLOYMENT_ROLE_ARN}} \
-            --region us-east-1 \
-            --profile user --session ${{github.actor}}-${{github.event_name}}-${{github.sha}}
-      -
-        name: "App: Invalidate CloudFront cache"
-        run: >-
-          bash "aws/scripts/deploy/invalidate-cloudfront-cache.sh" \
-            --paths "/*" \
-            --web-stack-name privacysexy-web-stack --web-stack-cloudfront-arn-output-name CloudFrontDistributionArn \
-            --role-arn ${{secrets.AWS_CLOUDFRONT_SITE_DEPLOYMENT_ROLE_ARN}} \
-            --region us-east-1 \
-            --profile user --session ${{github.actor}}-${{github.event_name}}-${{github.sha}}

.github/workflows/checks.build.yaml

@@ -0,0 +1,81 @@
+name: build-checks
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build-web:
+    strategy:
+      matrix:
+        os: [ macos, ubuntu, windows ]
+        mode: [
+          # Vite mode: https://vitejs.dev/guide/env-and-mode.html
+          development,  # Used by `dev` command
+          production,   # Used by `build` command
+          # Vitest mode: https://vitest.dev/guide/cli.html
+          test,         # Used by Vitest
+        ]
+      fail-fast: false # Allows to see results from other combinations
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Build
+        run: npm run build -- --mode ${{ matrix.mode }}
+
+  build-desktop:
+    strategy:
+      matrix:
+        os: [ macos, ubuntu, windows ]
+        mode: [
+          # electron-vite modes: https://electron-vite.org/guide/env-and-mode.html#global-env-variables
+          development,  # Used by `dev` command
+          production,   # Used by `build` and `preview` commands
+        ]
+      fail-fast: false # Allows to see results from other combinations
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Prebuild
+        run: npm run electron:prebuild -- --mode ${{ matrix.mode }}
+      -
+        name: Build
+        run: npm run electron:build -- --publish never
+
+  create-icons:
+    strategy:
+      matrix:
+        os: [ macos, ubuntu, windows ]
+      fail-fast: false # Allows to see results from other combinations
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Create icons
+        run: npm run icons:build

.github/workflows/checks.desktop-runtime-errors.yaml

@@ -0,0 +1,67 @@
+name: checks.desktop-runtime-errors
+# Verifies desktop builds for Electron applications across multiple OS platforms (macOS ,Ubuntu, and Windows).
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build-desktop:
+    strategy:
+      matrix:
+        os: [ macos, ubuntu, windows ]
+      fail-fast: false # Allows to see results from other combinations
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Configure Ubuntu
+        if: matrix.os == 'ubuntu'
+        shell: bash
+        run: |-
+          sudo apt update
+
+          # Configure AppImage dependencies
+          sudo apt install -y libfuse2
+
+          # Configure DBUS (fixes `Failed to connect to the bus: Could not parse server address: Unknown address type`)
+           if ! command -v 'dbus-launch' &> /dev/null; then
+            echo 'DBUS does not exist, installing...'
+            sudo apt install -y dbus-x11 # Gives both dbus and dbus-launch utility
+          fi
+          sudo systemctl start dbus
+          DBUS_LAUNCH_OUTPUT=$(dbus-launch)
+          if [ $? -eq 0 ]; then
+            echo "${DBUS_LAUNCH_OUTPUT}" >> $GITHUB_ENV
+          else
+            echo 'Error: dbus-launch command did not execute successfully. Exiting.' >&2
+            echo "${DBUS_LAUNCH_OUTPUT}" >&2
+            exit 1
+          fi
+
+          # Configure fake (virtual) display
+          sudo apt install -y xvfb
+          sudo Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &
+          echo "DISPLAY=:99" >> $GITHUB_ENV
+
+          # Install ImageMagick for screenshots
+          sudo apt install -y imagemagick
+
+          # Install xdotool and xprop (from x11-utils) for window title capturing
+          sudo apt install -y xdotool x11-utils
+      -
+        name: Test
+        shell: bash
+        run: node ./scripts/check-desktop-runtime-errors --screenshot
+      -
+        name: Upload screenshot
+        if: always() # Run even if previous step fails
+        uses: actions/upload-artifact@v3
+        with:
+          name: screenshot-${{ matrix.os }}
+          path: screenshot.png

.github/workflows/checks.quality.yaml

@@ -0,0 +1,26 @@
+name: quality-checks
+
+on: [ push, pull_request ]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        lint-command:
+          - npm run lint:eslint
+          - npm run lint:yaml
+          - npm run lint:md
+          - npm run lint:md:relative-urls
+          - npm run lint:md:consistency
+        os: [ macos, ubuntu, windows ]
+      fail-fast: false # Still interested to see results from other combinations
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Setup node
+        uses: ./.github/actions/setup-node
+      - name: Install dependencies
+        run: npm ci
+      - name: Lint
+        run: ${{ matrix.lint-command }}

.github/workflows/checks.security.yaml

@@ -0,0 +1,22 @@
+name: security-checks
+
+on:
+  push:
+  pull_request:
+    paths: [ '/package.json', '/package-lock.json' ] # Allow PRs to be green if they do not introduce dependency change
+  schedule:
+    - cron: '0 0 * * 0' # at 00:00 on every Sunday
+
+jobs:
+  npm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: NPM audit
+        run:  npm audit --omit=dev

.github/workflows/release.desktop.yaml

@@ -0,0 +1,41 @@
+name: release-desktop
+
+on:
+ release:
+   types: [created] # will be triggered when a NON-draft release is created and published.
+
+jobs:
+  publish-desktop-app:
+    name: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [macos, ubuntu, windows]
+      fail-fast: false # So publish runs for other OSes if one fails
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        uses: actions/checkout@v2
+        with:
+          ref: master # otherwise it defaults to the version tag missing bump commit
+          fetch-depth: 0 # fetch all history
+      -
+        name: Checkout to bump commit
+        run: git checkout "$(git rev-list "${{ github.event.release.tag_name }}"..master | tail -1)"
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Run unit tests
+        run: npm run test:unit
+      -
+        name: Prebuild
+        run: npm run electron:prebuild
+      -
+        name: Build and publish
+        run: npm run electron:build -- --publish always
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EP_GH_IGNORE_TIME: true # Otherwise publishing fails if GitHub release is more than 2 hours old https://github.com/electron-userland/electron-builder/issues/2074

.github/workflows/release.git.yaml

@@ -0,0 +1,17 @@
+name: release-git
+
+on:
+  push: # Ensure a new release is created for each new tag
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+jobs:
+  bump-version-and-release:
+    if: github.event.base_ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: undergroundwires/bump-everywhere@master
+        with:
+          user: undergroundwires-bot
+          release-token: ${{ secrets.BUMP_GITHUB_PAT }} # Does not trigger release pipeline if we use default token: https://github.community/t5/GitHub-Actions/Github-Action-trigger-on-release-not-working-if-releases-was/td-p/34559
+                                                        # GitHub does not inject secrets if pipeline runs from fork or a fork is merged to main repo. 

.github/workflows/release.site.yaml

@@ -0,0 +1,115 @@
+name: release-site
+
+on:
+  release:
+    types: [created] # will be triggered when a NON-draft release is created and published.
+
+jobs:
+  aws-deploy: # see: https://github.com/undergroundwires/aws-static-site-with-cd
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: "Infrastructure: Checkout"
+        uses: actions/checkout@v2
+        with:
+          path: aws
+          repository: undergroundwires/aws-static-site-with-cd
+      -
+        name: "Infrastructure: Create AWS user profile & session name"
+        run: >-
+          bash "scripts/configure/create-user-profile.sh" \
+            --profile user \
+            --access-key-id ${{secrets.AWS_DEPLOYMENT_USER_ACCESS_KEY_ID}} \
+            --secret-access-key ${{secrets.AWS_DEPLOYMENT_USER_SECRET_ACCESS_KEY}} \
+            --region us-east-1 \
+          && \
+            echo "SESSION_NAME=${{github.actor}}-${{github.event_name}}-$(echo ${{github.sha}} | cut -c1-8)" >> $GITHUB_ENV
+        working-directory: aws
+      -
+        name: "Infrastructure: Deploy IAM stack"
+        run: >-
+          bash "scripts/deploy/deploy-stack.sh" \
+            --template-file stacks/iam-stack.yaml \
+            --stack-name privacysexy-iam-stack \
+            --capabilities CAPABILITY_IAM \
+            --parameter-overrides "WebStackName=privacysexy-web-stack DnsStackName=privacysexy-dns-stack \
+                                   CertificateStackName=privacysexy-cert-stack RootDomainName=privacy.sexy" \
+            --region us-east-1 --role-arn ${{secrets.AWS_IAM_STACK_DEPLOYMENT_ROLE_ARN}} \
+            --profile user --session ${{ env.SESSION_NAME }}
+        working-directory: aws
+      -
+        name: "Infrastructure: Deploy DNS stack"
+        run: >-
+          bash "scripts/deploy/deploy-stack.sh" \
+            --template-file stacks/dns-stack.yaml \
+            --stack-name privacysexy-dns-stack \
+            --parameter-overrides "RootDomainName=privacy.sexy" \
+            --region us-east-1 \
+            --role-arn ${{secrets.AWS_DNS_STACK_DEPLOYMENT_ROLE_ARN}} \
+            --profile user --session ${{ env.SESSION_NAME }}
+        working-directory: aws
+      -
+        name: "Infrastructure: Deploy certificate stack"
+        run: >-
+          bash "scripts/deploy/deploy-stack.sh" \
+            --template-file stacks/certificate-stack.yaml \
+            --stack-name privacysexy-cert-stack \
+            --capabilities CAPABILITY_IAM \
+            --parameter-overrides "IamStackName=privacysexy-iam-stack RootDomainName=privacy.sexy DnsStackName=privacysexy-dns-stack" \
+            --region us-east-1 \
+            --role-arn ${{secrets.AWS_CERTIFICATE_STACK_DEPLOYMENT_ROLE_ARN}} \
+            --profile user --session ${{ env.SESSION_NAME }}
+        working-directory: aws
+      -
+        name: "Infrastructure: Deploy web stack"
+        run: >-
+          bash "scripts/deploy/deploy-stack.sh" \
+            --template-file stacks/web-stack.yaml \
+            --stack-name privacysexy-web-stack \
+            --parameter-overrides "CertificateStackName=privacysexy-cert-stack DnsStackName=privacysexy-dns-stack \
+                                   RootDomainName=privacy.sexy UseDeepLinks=true" \
+            --capabilities CAPABILITY_IAM \
+            --region us-east-1 \
+            --role-arn ${{secrets.AWS_WEB_STACK_DEPLOYMENT_ROLE_ARN}} \
+            --profile user --session ${{ env.SESSION_NAME }}
+        working-directory: aws
+      -
+        name: "App: Checkout"
+        uses: actions/checkout@v2
+        with:
+          path: app
+          ref: master # otherwise we don't get version bump commit
+      -
+        name: "App: Setup node"
+        uses: ./app/.github/actions/setup-node
+      -
+        name: "App: Install dependencies"
+        run: npm ci
+        working-directory: app
+      -
+        name: "App: Run unit tests"
+        run: npm run test:unit
+        working-directory: app
+      - 
+        name: "App: Build"
+        run: npm run build
+        working-directory: app
+      -
+        name: "App: Deploy to S3"
+        run: >-
+          bash "aws/scripts/deploy/deploy-to-s3.sh" \
+            --folder app/dist \
+            --web-stack-name privacysexy-web-stack --web-stack-s3-name-output-name S3BucketName \
+            --storage-class ONEZONE_IA \
+            --role-arn ${{secrets.AWS_S3_SITE_DEPLOYMENT_ROLE_ARN}} \
+            --region us-east-1 \
+            --profile user --session ${{ env.SESSION_NAME }}
+      -
+        name: "App: Invalidate CloudFront cache"
+        run: >-
+          bash "aws/scripts/deploy/invalidate-cloudfront-cache.sh" \
+            --paths "/*" \
+            --web-stack-name privacysexy-web-stack --web-stack-cloudfront-arn-output-name CloudFrontDistributionArn \
+            --role-arn ${{secrets.AWS_CLOUDFRONT_SITE_DEPLOYMENT_ROLE_ARN}} \
+            --region us-east-1 \
+            --profile user --session ${{ env.SESSION_NAME }}

.github/workflows/run-tests.yaml

@@ -1,26 +0,0 @@
-name: Run tests
-
-on:
-  push:
-    branches:
-      - '*'
-      - '!master'
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v1
-      -
-        name: Setup node
-        uses: actions/setup-node@v1
-        with:
-          node-version: '11.x'
-      -
-        name: Install dependencies
-        run: npm install
-      -
-        name: Run tests
-        run: npm run test:unit

.github/workflows/tests.e2e.yaml

@@ -0,0 +1,26 @@
+name: e2e-tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  run-tests:
+    strategy:
+      matrix:
+        os: [macos, ubuntu, windows]
+      fail-fast: false # So it still runs on other OSes if one of them fails
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Run e2e tests
+        run: npm run test:cy:run

.github/workflows/tests.integration.yaml

@@ -0,0 +1,28 @@
+name: integration-tests
+
+on:
+  push:
+  pull_request:
+  schedule: # To get notified about problems from third party dependencies
+    - cron: '0 0 * * 0' # at 00:00 on every Sunday
+
+jobs:
+  run-tests:
+    strategy:
+      matrix:
+        os: [macos, ubuntu, windows]
+      fail-fast: false # So it still runs on other OSes if one of them fails
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Setup node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Run integration tests
+        run: npm run test:integration

.github/workflows/tests.unit.yaml

@@ -0,0 +1,26 @@
+name: unit-tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  run-tests:
+    strategy:
+      matrix:
+        os: [macos, ubuntu, windows]
+      fail-fast: false # So it still runs on other OSes if one of them fails
+    runs-on: ${{ matrix.os }}-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set-up node
+        uses: ./.github/actions/setup-node
+      -
+        name: Install dependencies
+        run: npm ci
+      -
+        name: Run unit tests
+        run: npm run test:unit

.gitignore

@@ -1,4 +1,7 @@
 node_modules
-/dist
+dist/
 .vs
-.vscode
+.vscode/**/*
+!.vscode/extensions.json
+#Electron-builder output
+/dist_electron

.markdownlint.json

@@ -0,0 +1,4 @@
+{
+    "default": true,
+    "MD013": false
+}

.vscode/extensions.json

@@ -0,0 +1,23 @@
+{
+  "recommendations": [
+    // Common
+    "editorconfig.editorconfig",        // Applies .editorconfig to follow project style.
+    "wengerk.highlight-bad-chars",      // Highlights bad chars.
+    "wayou.vscode-todo-highlight",      // Highlights TODO.
+    "wix.vscode-import-cost",           // Shows in KB how much a require include in code.
+    // Documentation
+    "davidanson.vscode-markdownlint",   // Lints markdown.
+    // TypeScript / JavaScript
+    "dbaeumer.vscode-eslint",           // Lints JavaScript/TypeScript.
+    "pmneo.tsimporter",                 // Provides better auto-complete for TypeScripts imports.
+    // Vue
+    "Vue.volar",                        // Official Vue extensions
+    "Vue.vscode-typescript-vue-plugin", // Official TypeScript Vue Plugin
+    // Scripting
+    "timonwong.shellcheck",             // Lints bash files.
+    "ms-vscode.powershell",             // Lints PowerShell files.
+    "ms-python.python",                 // Lints Python files.
+    // Distribution
+    "ms-azuretools.vscode-docker"       // Adds Docker support.
+  ]
+}

CHANGELOG.md

@@ -0,0 +1,598 @@
+# Changelog
+
+## 0.12.1 (2023-08-17)
+
+* Transition to eslint-config-airbnb-with-typescript | [ff84f56](https://github.com/undergroundwires/privacy.sexy/commit/ff84f5676e496dd7ec5b3599e34ec9627d181ea2)
+* Improve user privacy with secure outbound links | [3a594ac](https://github.com/undergroundwires/privacy.sexy/commit/3a594ac7fd708dc1e98155ffb9b21acd4e1fcf2d)
+* Refactor Vue components using Composition API #230 | [1b9be8f](https://github.com/undergroundwires/privacy.sexy/commit/1b9be8fe2d72d8fb5cf1fed6dcc0b9777171aa98)
+* Fix failing security tests | [3bc8da4](https://github.com/undergroundwires/privacy.sexy/commit/3bc8da4cbf1e2bd758dc3fffe4b1e62dc3beb7b3)
+* Improve Defender scripts #201 | [061afad](https://github.com/undergroundwires/privacy.sexy/commit/061afad9673a41454c2421c318898f2b4f4cf504)
+* Fix failing tests due to failed error logging | [986ba07](https://github.com/undergroundwires/privacy.sexy/commit/986ba078a643de6acbee50fff9cf77494ca7ea7f)
+* Implement custom lightweight modal #230 | [9e5491f](https://github.com/undergroundwires/privacy.sexy/commit/9e5491fdbf2d9d40d974f5ad0e879a6d5c6d1e55)
+* Refactor usage of tooltips for flexibility | [bc91237](https://github.com/undergroundwires/privacy.sexy/commit/bc91237d7c54bdcd15c5c39a55def50d172bb659)
+* Fix revert toggle partial rendering | [39e650c](https://github.com/undergroundwires/privacy.sexy/commit/39e650cf110bee6b1b21d9b2902b36b0e2568d54)
+* Increase testability through dependency injection | [ae75059](https://github.com/undergroundwires/privacy.sexy/commit/ae75059cc14db41f55dd2056f528442c7d319dd2)
+* Refactor filter (search query) event handling | [6a20d80](https://github.com/undergroundwires/privacy.sexy/commit/6a20d804dc365d22c1248d787f9912271f508eeb)
+* Migrate to ES6 modules | [a14929a](https://github.com/undergroundwires/privacy.sexy/commit/a14929a13cc6260b514692d9b4f1cdf5fb85d8b2)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.12.0...0.12.1)
+
+## 0.12.0 (2023-08-03)
+
+* Improve script/category name validation | [b210aad](https://github.com/undergroundwires/privacy.sexy/commit/b210aaddf26629179f77fe19f62f65d8a0ca2b87)
+* Improve touch like hover on devices without mouse | [99e24b4](https://github.com/undergroundwires/privacy.sexy/commit/99e24b4134c461c336f6d08f49d193d853325d31)
+* Improve click/touch without unintended interaction | [3233d9b](https://github.com/undergroundwires/privacy.sexy/commit/3233d9b8024dd59600edddef6d017e0089f59a9d)
+* Align card icons vertically in cards view | [8608072](https://github.com/undergroundwires/privacy.sexy/commit/8608072bfb52d10a843a86d3d89b14e8b9776779)
+* Fix broken npm installation and builds | [924b326](https://github.com/undergroundwires/privacy.sexy/commit/924b326244a175428175e0df3a50685ee5ac2ec6)
+* Improve documentation support with markdown | [6067bdb](https://github.com/undergroundwires/privacy.sexy/commit/6067bdb24e6729d2249c9685f4f1c514c3167d91)
+* win: add more Visual Studio scripts, support 2022 | [df533ad](https://github.com/undergroundwires/privacy.sexy/commit/df533ad3b19cebdf3454895aa2182bd4184e0360)
+* win: add script to remove Widgets | [bbc6156](https://github.com/undergroundwires/privacy.sexy/commit/bbc6156281fb3fd4b66c63dec3f765780fafa855)
+* Use line endings based on script language #88 | [6b3f465](https://github.com/undergroundwires/privacy.sexy/commit/6b3f4659df0afe1c99a8af6598df44a33c1f863a)
+* win: improve OneDrive removal | [58ed7b4](https://github.com/undergroundwires/privacy.sexy/commit/58ed7b456b3cf11774c83c8c1c04db37ef3058c2)
+* Use lowercase in script names and search text | [430537f](https://github.com/undergroundwires/privacy.sexy/commit/430537f70411756bbcaae837964c0223f78581e8)
+* Improve manual execution instructions | [7d3670c](https://github.com/undergroundwires/privacy.sexy/commit/7d3670c26d0151ddc43303e8ed5e47715f0e0f00)
+* Add multiline support for with expression | [e8d06e0](https://github.com/undergroundwires/privacy.sexy/commit/e8d06e0f3e178a69861e0197f9d1cce9af3958f1)
+* Break line in inline codes in documentation | [c1c2f29](https://github.com/undergroundwires/privacy.sexy/commit/c1c2f2925fe88ec1f56bf7655b6b9a10aa3ea024)
+* win: add script to increase RSA key exchange #165 | [a2e0921](https://github.com/undergroundwires/privacy.sexy/commit/a2e092190d8eb0fc9ceb8533572f04fff52f097b)
+* win: add scripts to downloaded file handling #153 | [e7b816d](https://github.com/undergroundwires/privacy.sexy/commit/e7b816d1564afa98c63291f9d7fd6f3fee92f4ec)
+* Drop support for dead browsers | [bf0c55f](https://github.com/undergroundwires/privacy.sexy/commit/bf0c55fa60bf2be070678ba27db14baf13fec511)
+* Add support for nested templates | [68a5d69](https://github.com/undergroundwires/privacy.sexy/commit/68a5d698a2ce644ce25754016fb9e9bb642e41a7)
+* mac: add scripts to configure Parallels Desktop | [64cca1d](https://github.com/undergroundwires/privacy.sexy/commit/64cca1d9b8946b92e21e86deb6db5612570befb1)
+* Rework icon with higher quality and new color | [f4a7ca7](https://github.com/undergroundwires/privacy.sexy/commit/f4a7ca76b885b8346d8a9c32e6269eabc2d8139f)
+* Relax and improve code validation | [e819993](https://github.com/undergroundwires/privacy.sexy/commit/e8199932b462380741d9f2d8b6b55485ab16af02)
+* Add initial Linux support #150 | [c404dfe](https://github.com/undergroundwires/privacy.sexy/commit/c404dfebe2908bb165279f8279f3f5e805b647d7)
+* mac: add script to disable personalized ads | [8b374a3](https://github.com/undergroundwires/privacy.sexy/commit/8b374a37b401699d5056bfd6b735b6a26c395ae0)
+* Update dependencies and add npm setup script | [5721796](https://github.com/undergroundwires/privacy.sexy/commit/57217963787a8ab0c71d681c6b1673c484c88226)
+* Fix macOS desktop build failure in CI | [5901dc5](https://github.com/undergroundwires/privacy.sexy/commit/5901dc5f11dd29be14c2616fc0ceb45196a43224)
+* Change subtitle heading to new slogan | [1e80ee1](https://github.com/undergroundwires/privacy.sexy/commit/1e80ee1fb0208d92943619468dc427853cbe8de7)
+* win: add new scripts to disable more telemetry | [298b058](https://github.com/undergroundwires/privacy.sexy/commit/298b058e5c89397db6f759b275442ba05499ac8c)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.11.4...0.12.0)
+
+## 0.11.4 (2022-03-08)
+
+* Improve performance of selecting scripts | [8e96c19](https://github.com/undergroundwires/privacy.sexy/commit/8e96c19126aa4cba6418de5ccaa9e2dcf8faab78)
+* Fix reverting of Windows NVIDIA telemetry service | [2354f0b](https://github.com/undergroundwires/privacy.sexy/commit/2354f0ba9fed3aa23569b5ea6391a7119fe1ab53)
+* Add AirBnb TypeScript overrides for linting | [834ce8c](https://github.com/undergroundwires/privacy.sexy/commit/834ce8cf9e8e46934dfa604526360870d109765b)
+* Transpile dependencies for wider browser support | [0e52a99](https://github.com/undergroundwires/privacy.sexy/commit/0e52a99efa2b02d1aba10885a76e03aa6f9be7f8)
+* Add more and unify tests for absent object cases | [44d79e2](https://github.com/undergroundwires/privacy.sexy/commit/44d79e2c9a97639bbd188a8fdfd740f1a5a1d6ee)
+* Fix Windows DoSvc not being disabled #115 | [43ce834](https://github.com/undergroundwires/privacy.sexy/commit/43ce834750ddf471636d1ece4324d02357947f9f)
+* Move stubs from `./stubs` to `./shared/Stubs` | [803ef2b](https://github.com/undergroundwires/privacy.sexy/commit/803ef2bb3eea68306377e40e326c791402998650)
+* Improve documentation for developing | [3c3ec80](https://github.com/undergroundwires/privacy.sexy/commit/3c3ec80525b97e8a24db4c44bbf42a7b4e089056)
+* Improve documentation for architecture | [1bcc6c8](https://github.com/undergroundwires/privacy.sexy/commit/1bcc6c8b2b923b4d4b1662f990d86b190ce73342)
+* Improve existing documentation | [db47440](https://github.com/undergroundwires/privacy.sexy/commit/db47440d470ea6a6e100b620b10d078c01314992)
+* Refactor to remove code coupling with Webpack | [5bbbb9c](https://github.com/undergroundwires/privacy.sexy/commit/5bbbb9cecca0a3828036e7fc34dcd66970ce334a)
+* Refactor to remove hardcoding of aliases | [481a02a](https://github.com/undergroundwires/privacy.sexy/commit/481a02afd5190eb77a37fa450e50816b2268e99c)
+* Document WpnService breaking on Windows 10 #110 | [3785e41](https://github.com/undergroundwires/privacy.sexy/commit/3785e410db461f667a834e0b388d81e4baa028e4)
+* Fix error when reverting Windows Defender setting | [956052c](https://github.com/undergroundwires/privacy.sexy/commit/956052c8fff042812fe84fe4d7fa5c579365ff9b)
+* Fix Windows 11 being detected as Windows 10 | [d6bc33e](https://github.com/undergroundwires/privacy.sexy/commit/d6bc33ec865d50efc6b8d4ccc2f789edd874fcee)
+* Refactor to use version object #59 | [eeb1d5b](https://github.com/undergroundwires/privacy.sexy/commit/eeb1d5b0c40a55675921af3f67f366b2ff658acf)
+* Fix Microsoft Defender alert for uninstaller #114 | [112e79a](https://github.com/undergroundwires/privacy.sexy/commit/112e79a64c6153f4ce3b48c27a09639e7647aebc)
+* Add donation information | [05a6a84](https://github.com/undergroundwires/privacy.sexy/commit/05a6a84c3739ec900343591ac1f7a9f310cd73f2)
+* Bump node environment to 16.x | [242a497](https://github.com/undergroundwires/privacy.sexy/commit/242a497e7debb351da19b20b63a3554f0cca4b5c)
+* Bump dependencies to latest | [efd63ff](https://github.com/undergroundwires/privacy.sexy/commit/efd63ff85dea4c9a9c033c54bc1be378742de351)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.11.3...0.11.4)
+
+## 0.11.3 (2022-01-05)
+
+* Fix double backlashes in Windows vscode scripts | [5f091bb](https://github.com/undergroundwires/privacy.sexy/commit/5f091bb6abed878271e2321cd784f34436c677bd)
+* Fix OS desktop detection tests and edge cases | [a8358b8](https://github.com/undergroundwires/privacy.sexy/commit/a8358b8e7a93214f3d22a4488007ded5f623d845)
+* Fix clearing Windows product key showing dialog | [9b6636e](https://github.com/undergroundwires/privacy.sexy/commit/9b6636e21a922a4750dc19f4854f8ae679187926)
+* Document and unrecommend Cloud Experience Host | [9b5e0b0](https://github.com/undergroundwires/privacy.sexy/commit/9b5e0b0591fee56af52d83334a1f19180a49516f)
+* Add initial e2e testing with cypress | [ddd2e70](https://github.com/undergroundwires/privacy.sexy/commit/ddd2e704dbd361cbd219f3dfe644b983ad254095)
+* Restructure pipelines and badges | [5a2c263](https://github.com/undergroundwires/privacy.sexy/commit/5a2c263af35b8785e75ead6c43c3f17186dc15c8)
+* Fix failing of functions without revert code | [87de017](https://github.com/undergroundwires/privacy.sexy/commit/87de017afd6e08acbd2deea150c6af9c7ee778fc)
+* Fix typos in privacy modal #109 | [a1871a2](https://github.com/undergroundwires/privacy.sexy/commit/a1871a2982c9e3192193f836b97b1a6ccda5a2ab)
+* Refactor to add readonly interfaces | [c3c5b89](https://github.com/undergroundwires/privacy.sexy/commit/c3c5b897f308f613c252182a02cdd4cfa7150fa3)
+* Document and unrecommend AAD app removal #24, #54 | [455084c](https://github.com/undergroundwires/privacy.sexy/commit/455084c17b32d11d046515e8dc1447adf4bea4c3)
+* Migrate from TSLint to ESLint | [61b475f](https://github.com/undergroundwires/privacy.sexy/commit/61b475fa8de433cdada2efa7eac197683aacd956)
+* Add build checks and improve existing CI/CD checks | [17298f0](https://github.com/undergroundwires/privacy.sexy/commit/17298f0b2c51cb9becc0eb2ffe0d93d6a4c503a6)
+* Upgrade to Vue CLI 5 (and webpack 5) | [96265b7](https://github.com/undergroundwires/privacy.sexy/commit/96265b75deafb85978b16460138fb4a814c07cfe)
+* Refactor code to comply with ESLint rules | [5b1fbe1](https://github.com/undergroundwires/privacy.sexy/commit/5b1fbe1e2fb1354a5f060f8c8e3794ce756e16a7)
+* Fix mutated line endings on Windows | [bd23faa](https://github.com/undergroundwires/privacy.sexy/commit/bd23faa28f6d781581a33d5b780f4b33f7e2cd8b)
+* Refactor to improve iterations | [31f7091](https://github.com/undergroundwires/privacy.sexy/commit/31f70913a2f30baf5a9d6690f192e6a63da50114)
+* win: unrecommend and document Live ID service #100 | [d11a674](https://github.com/undergroundwires/privacy.sexy/commit/d11a674a3c4ad8f4972a870c2f0977ac53297273)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.11.2...0.11.3)
+
+## 0.11.2 (2021-12-03)
+
+* Fix Windows TrustedInstaller session errors | [20a0071](https://github.com/undergroundwires/privacy.sexy/commit/20a0071c0d3d769a8f31218abdbfc4cafa25c6ff)
+* Improve tests for `UserSelection` | [2f90cac](https://github.com/undergroundwires/privacy.sexy/commit/2f90cac52ab9e57615aeec41f9daa842bce770a5)
+* Fix disabling/enabling Defender on Windows #104 | [2e08293](https://github.com/undergroundwires/privacy.sexy/commit/2e082932c952b0849ab2b8709ff0c75293b88e95)
+* Refactor Saas naming, structure and modules | [bf83c58](https://github.com/undergroundwires/privacy.sexy/commit/bf83c58982ffa178facc6d35e50c7f1eac7ff236)
+* Fix Defender features errors in Windows #104 | [d7761ab](https://github.com/undergroundwires/privacy.sexy/commit/d7761ab30e7f1e10a2919c196804d67511d6163a)
+* Fix unintendedly inlined Windows scripts | [f2d9881](https://github.com/undergroundwires/privacy.sexy/commit/f2d988138257ff184884e4adc83c39e3bc247e9b)
+* Fix Defender error due to non-english Windows #104 | [7c02ffb](https://github.com/undergroundwires/privacy.sexy/commit/7c02ffb6c95382b94f0b05e6f259cc418ec91c93)
+* Improve and unify disabling of Windows services | [70cdf38](https://github.com/undergroundwires/privacy.sexy/commit/70cdf3865a0de3214fc9e26fbdada4b0cb413c46)
+* Improve Windows defender docs and errors #104 | [d2518b1](https://github.com/undergroundwires/privacy.sexy/commit/d2518b11a7774ec58b9b46a691e2f013855bf0f9)
+* Unrecommend and complete Windows Push Notif. #101 | [c65209e](https://github.com/undergroundwires/privacy.sexy/commit/c65209e6a99230f15ace8955e8d5a6f3333d146b)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.11.1...0.11.2)
+
+## 0.11.1 (2021-11-04)
+
+* Update dependencies | [64631a4](https://github.com/undergroundwires/privacy.sexy/commit/64631a4552fad7f7b06286aba8d3ca2d731f9342)
+* Fix, document, unrecommend Windows browser cleanup | [5ead1a0](https://github.com/undergroundwires/privacy.sexy/commit/5ead1a087d91948890bc4ae6fea176123f18c285)
+* Fix failing URL status checking integration tests | [799fb09](https://github.com/undergroundwires/privacy.sexy/commit/799fb091b8eb06c70ac0c67f2ef5385dce73501f)
+* Refactor to remove "Async" function name suffix | [82c43ba](https://github.com/undergroundwires/privacy.sexy/commit/82c43ba2e37fb6e7f62ccd9bec8c5f48575f0613)
+* Fix dead URLs and use forks as GitHub references | [97ddc02](https://github.com/undergroundwires/privacy.sexy/commit/97ddc027cb5395a74991cabc1d8c875ee945636d)
+* Fix website not loading on Safari | [0db8cc4](https://github.com/undergroundwires/privacy.sexy/commit/0db8cc420655e01cbbed57c4658489b761a15899)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.11.0...0.11.1)
+
+## 0.11.0 (2021-10-21)
+
+* Change "grouping" to "view" | [c0c475f](https://github.com/undergroundwires/privacy.sexy/commit/c0c475ff564b23a4dabcc03ac2909207a8eb61ce)
+* Tighten parameter substitution tolerance | [dcccb61](https://github.com/undergroundwires/privacy.sexy/commit/dcccb617813625c224a28242c5b965bb4cd6f189)
+* Add optionality for parameters | [6a89c62](https://github.com/undergroundwires/privacy.sexy/commit/6a89c6224bdef5eb96980471f3b3935b9351b197)
+* Do not collapse cards on links and code area #88 | [e73c0ad](https://github.com/undergroundwires/privacy.sexy/commit/e73c0ad1bf922b1dd3360fc5aafc3434951fa63c)
+* Add scripts to disable, hide and opt-out from Siri | [c92dc1e](https://github.com/undergroundwires/privacy.sexy/commit/c92dc1e25387c65a3a41ca64d2a23cf8131b4c86)
+* Improve macOS scripts for cleaning OS logs | [6c3c2e6](https://github.com/undergroundwires/privacy.sexy/commit/6c3c2e6709ec84f8e0411f19c024bab2c7e5753b)
+* Add "with" expression for templating #53 | [862914b](https://github.com/undergroundwires/privacy.sexy/commit/862914b06ea9ef74c4b58a9a4164a10a38273638)
+* Add support for pipes in templates #53 | [4d7ff7e](https://github.com/undergroundwires/privacy.sexy/commit/4d7ff7edc5a96cc0d99d3c1ca4fdf9bbdace3fd2)
+* Bump node environment to 15.x | [2f0321f](https://github.com/undergroundwires/privacy.sexy/commit/2f0321f315ac0da8c713dd50e37032f1de194942)
+* Add new UX for optionally downloading updates | [ddf417a](https://github.com/undergroundwires/privacy.sexy/commit/ddf417a16a79551b43576befab0541ea08487969)
+* Add pipes to write pretty PowerShell #53 | [5217b0b](https://github.com/undergroundwires/privacy.sexy/commit/5217b0b7587ccfe509ba8adc3a7748b9bae14d7a)
+* Improve alignment, padding/margin issues on UI | [c8cb7a5](https://github.com/undergroundwires/privacy.sexy/commit/c8cb7a5c28420557319606da82f56b011e88f470)
+* Support disabling per-user services in Windows #16 | [4b23907](https://github.com/undergroundwires/privacy.sexy/commit/4b2390736ac1f9de2d5176b7b07da0e827112f9a)
+* Add script to remove Meet Now icon in Windows | [f39ee76](https://github.com/undergroundwires/privacy.sexy/commit/f39ee76c0cda95f54502b19d5c49390fd0f12b5e)
+* Add support for more depth in function calls | [20b7d28](https://github.com/undergroundwires/privacy.sexy/commit/20b7d283b02dd751dfbde18ef1fe334c6bf76e2b)
+* Increase default screen width on desktop app | [9942df1](https://github.com/undergroundwires/privacy.sexy/commit/9942df16c8334ff041fb92f432a3a29e351c88df)
+* Improve disabling of SmartScreen #74 | [0696ed8](https://github.com/undergroundwires/privacy.sexy/commit/0696ed8396e298a358bec17adb91c9145dd90418)
+* Remove integration tests from deployments #90 | [37ad26a](https://github.com/undergroundwires/privacy.sexy/commit/37ad26a082851c02497c36e7fce40555b9480e11)
+* Use a consistent color system | [b08a6b5](https://github.com/undergroundwires/privacy.sexy/commit/b08a6b5cecf4a53023053695292146edbd24b960)
+* Add semi-automatic update support for macOS | [410bcd8](https://github.com/undergroundwires/privacy.sexy/commit/410bcd82445097c29c9fcf0eabf7af9ebcb93c1e)
+* Add more ways to disable and clean Defender #74 | [2492f2d](https://github.com/undergroundwires/privacy.sexy/commit/2492f2d8141b3abdf590ccad59680b1f50ecb59e)
+* Add privacy over security scripts for macOS #83 | [236a0f6](https://github.com/undergroundwires/privacy.sexy/commit/236a0f6c8241294fc397194cd1b20bdeccbbb50b)
+* Change PowerShell double quotes escape | [9aa8166](https://github.com/undergroundwires/privacy.sexy/commit/9aa816689146ee6cd86d8262112677c38651c6bd)
+* Change theme colors | [a8031d1](https://github.com/undergroundwires/privacy.sexy/commit/a8031d18d520dd3b0567f7b8cfe2dcd694b65073)
+* Improve security hardening for macOS | [e6152fa](https://github.com/undergroundwires/privacy.sexy/commit/e6152fa76f5e7d23b0f79d5dd98713daaecbff90)
+* Support disabling of protected services #74 | [ab8bce7](https://github.com/undergroundwires/privacy.sexy/commit/ab8bce768650a10677f0a13b3a9fae93c83802ff)
+* Fix minor issues with Defender scripts | [739287a](https://github.com/undergroundwires/privacy.sexy/commit/739287ac71b3f8b04348fc101f1fa06f2d7d86a2)
+* Update screenshot | [504fa05](https://github.com/undergroundwires/privacy.sexy/commit/504fa056d7d8b17fc20afd398f9a557495fca7e8)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.10.3...0.11.0)
+
+## 0.10.3 (2021-08-27)
+
+* unrecommend VSS and document its breaking behavior | [7714898](https://github.com/undergroundwires/privacy.sexy/commit/77148980e08859f89c15c6604e55b56ce4f74358)
+* fix incorrect modification of Desktop folder on ThisPC (#71) | [eb9ac35](https://github.com/undergroundwires/privacy.sexy/commit/eb9ac35a923325cc2c9983ef71c0d904337a58f5)
+* add initial integration tests | [49600c5](https://github.com/undergroundwires/privacy.sexy/commit/49600c5f37ca33c1687885fdf02a71ef7d3e6e8c)
+* unify usage of sleepAsync and add tests | [36f0805](https://github.com/undergroundwires/privacy.sexy/commit/36f08055909f371fd9cbe3480ea813b963aea22b)
+* fix broken URLs and automate broken URL checks #70 | [db62ed7](https://github.com/undergroundwires/privacy.sexy/commit/db62ed7f3ac63e9f2d762eb946060595eb9f5626)
+* fix hiding recent files in quick access | [b976b92](https://github.com/undergroundwires/privacy.sexy/commit/b976b920318dba55b32d39f148fdca4f6be3cce3)
+* bump dependencies to latest #75, #69 | [0a857aa](https://github.com/undergroundwires/privacy.sexy/commit/0a857aa09ee703d34ad0422bd1731158017a9a58)
+* Fix NTP configuration before running the service (#72) | [71e70e5](https://github.com/undergroundwires/privacy.sexy/commit/71e70e50c51249bb10f6203414948b325acc2b2a)
+* Fix typo on main page (#82) | [487001a](https://github.com/undergroundwires/privacy.sexy/commit/487001af485fdbb958615d7b52c09c2e386ddaf2)
+* Improve issue templates | [f2935e4](https://github.com/undergroundwires/privacy.sexy/commit/f2935e4008f1231ef174f8932290e11715564d20)
+* Fix infinitely subscribing to state changes | [ea5f9ec](https://github.com/undergroundwires/privacy.sexy/commit/ea5f9ec27df7cec6ac575e23fef18948d2b8e68a)
+* Fix select options being clickable when disabled | [1c6b305](https://github.com/undergroundwires/privacy.sexy/commit/1c6b3057ea6e45125cadf374f20a905712ccdf3c)
+* Fix tests for `ParameterSubstitutionParser` | [2a08855](https://github.com/undergroundwires/privacy.sexy/commit/2a08855e5d1bdf74354fd692cbfebd1a48e495ac)
+* Fix excessive highlighting on hover | [ec0c972](https://github.com/undergroundwires/privacy.sexy/commit/ec0c972d348ffd5897f115d201031b704875b56a)
+* Fix dead URLs | [439cd30](https://github.com/undergroundwires/privacy.sexy/commit/439cd303ff3db96a53664e5f44fefe12b95c5e6c)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.10.2...0.10.3)
+
+## 0.10.2 (2021-04-19)
+
+* in CI/CD, run other tests/check even if one of them fails | [5c43965](https://github.com/undergroundwires/privacy.sexy/commit/5c43965f0bc44f991ada7d3bad68937a80665dc3)
+* fix desktop initial window size being bigger than current display size on smaller Linux/Windows screens | [02bdc4c](https://github.com/undergroundwires/privacy.sexy/commit/02bdc4cf0426c452f3fc9af52b819ca9b0757290)
+* refactor extra code, duplicates, complexity | [00d8e55](https://github.com/undergroundwires/privacy.sexy/commit/00d8e551db001247fadfb6f6af7a4c5ce19a9e64)
+* improve disabling ads and marketing #65 | [040ed27](https://github.com/undergroundwires/privacy.sexy/commit/040ed2701c4a468749901f4c5369b221bc0973c4)
+* document breaking behavior in script name #64 | [b1ed3ce](https://github.com/undergroundwires/privacy.sexy/commit/b1ed3ce55f2d003cad1ead23e674aa66d4eb5802)
+* add module alias '@tests/' | [60c8061](https://github.com/undergroundwires/privacy.sexy/commit/60c80611eab227791fabb883caf93418cef5fd00)
+* document chromium warning for policy changes | [aea04e5](https://github.com/undergroundwires/privacy.sexy/commit/aea04e5f7cd48fbb9b407b68ade75575a6064c82)
+* fix script revert activating recommendation level | [a2f1085](https://github.com/undergroundwires/privacy.sexy/commit/a2f10857e2a8debb3ce01f79b0dfbe8649ea9a17)
+* fix typo and dead URL in Windows scripts (#70) | [8141a01](https://github.com/undergroundwires/privacy.sexy/commit/8141a01ef798331b4d82f5ca95f7b18df4f6f912)
+* fix vue warning for undefined property during render | [b25b8cc](https://github.com/undergroundwires/privacy.sexy/commit/b25b8cc8052655af70b0695c6c3085974d783bb6)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.10.1...0.10.2)
+
+## 0.10.1 (2021-03-25)
+
+* refactor script compilation to make it easy to add new expressions #41 #53 | [646db90](https://github.com/undergroundwires/privacy.sexy/commit/646db9058541cebd0af437554de04fdc6bb63a6e)
+* restructure presentation layer | [f3c7413](https://github.com/undergroundwires/privacy.sexy/commit/f3c7413f529be4a00dba7b0ab23904b48ea13a35)
+* fix a test where "it" is not used inside "describe" | [1a5f920](https://github.com/undergroundwires/privacy.sexy/commit/1a5f92021f7423cd039f8f5326cd6f99b355c962)
+* bump dependencies to latest | [1f515e7](https://github.com/undergroundwires/privacy.sexy/commit/1f515e7be525291c960ccb71db05312db6da53f5)
+* fix throttle function not being able to run with argument(s) | [1935db1](https://github.com/undergroundwires/privacy.sexy/commit/1935db10192051401ab00ca2cd767955d0d3b866)
+* fix fs module hanging not allowing code to run | [5f527a0](https://github.com/undergroundwires/privacy.sexy/commit/5f527a00cf225d3e74b3f6577d6e2456e919de24)
+* refactor all modals to use same dialog component | [6f46cdb](https://github.com/undergroundwires/privacy.sexy/commit/6f46cdb4ed49a8941c6c0dde5c5e2a816c06daef)
+* fix safari cleanup scripts that are not working on modern versions | [05932c5](https://github.com/undergroundwires/privacy.sexy/commit/05932c5a36446d551c5bc811165e3295fbe15e3f)
+* refactor features to use shared functions #41 | [ac2249f](https://github.com/undergroundwires/privacy.sexy/commit/ac2249f25664827d8a6d2c7ebd659ccf126b0cde)
+* increase performance by polyfilling ResizeObserver only if required | [448e378](https://github.com/undergroundwires/privacy.sexy/commit/448e378dc4501f9de69af63634c87d0e5060bf52)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.10.0...0.10.1)
+
+## 0.10.0 (2021-03-02)
+
+* allow functions to call other functions #53 | [7661575](https://github.com/undergroundwires/privacy.sexy/commit/7661575573c6d3e8f4bc28bfa7a124a764c72ef9)
+* add option to run script directly in desktop app | [9a6b903](https://github.com/undergroundwires/privacy.sexy/commit/9a6b903b9297802845043fd41115756acd4a145c)
+* add script to automatically kill devicecensus process | [c9b91f6](https://github.com/undergroundwires/privacy.sexy/commit/c9b91f6d8f9bd16308b6beda119e7154a985b6cf)
+* refactor disabling application experience and document better | [45a3669](https://github.com/undergroundwires/privacy.sexy/commit/45a3669443d82855a52f60524d341c15f380f9e7)
+* escape printed characters to prevent command injection #45 | [1260eea](https://github.com/undergroundwires/privacy.sexy/commit/1260eea690e4fa5420e58c9de9f88cc29cb242db)
+* move code area to right on bigger screens | [cf39e6d](https://github.com/undergroundwires/privacy.sexy/commit/cf39e6d2541ea547f41d9553c380c54c24c58038)
+* more scripts to disable speech recognition and Cortana | [ee43fd9](https://github.com/undergroundwires/privacy.sexy/commit/ee43fd92a019ebd26c13890f9146c5b5bb56afaf)
+* add more macos scripts for privacy cleanup | [b0a7d0b](https://github.com/undergroundwires/privacy.sexy/commit/b0a7d0b53b3d8ac144a0241d70c037f460b0c0cc)
+* add better error messages to setting vscode settings | [65226f3](https://github.com/undergroundwires/privacy.sexy/commit/65226f3984480d0bc7932fd8d76a328f08308850)
+* remove windows scripts for removing non-bloating system apps #55 | [15004ff](https://github.com/undergroundwires/privacy.sexy/commit/15004ff1f1fb85a1d92e11ef695bcb2f37110610)
+* remove "preview" disclaimer from macOS | [970221b](https://github.com/undergroundwires/privacy.sexy/commit/970221b996e25fe5b029cbaa78607c9bbc8c3c0e)
+* update screenshot | [bd41af4](https://github.com/undergroundwires/privacy.sexy/commit/bd41af466fd135f7dc2f171633e4f60d8547c373)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.9.2...0.10.0)
+
+## 0.9.2 (2021-02-13)
+
+* do not compile with unused locals vuejs/vetur#1063 | [73e0520](https://github.com/undergroundwires/privacy.sexy/commit/73e0520de70cdbaf0ecdc6e9be5e85f003fcfb79)
+* fix wrong path for NvTelemtry file in NVIDIA script | [34b8822](https://github.com/undergroundwires/privacy.sexy/commit/34b8822ac821acb47e483e21b57e380551bcf455)
+* refactor event handling to consume base class for lifecycling | [f1e21ba](https://github.com/undergroundwires/privacy.sexy/commit/f1e21babbfaac21903594a37e30163bfe3338279)
+* make compiler throw if a function call includes an unexpected parameter | [15353d0](https://github.com/undergroundwires/privacy.sexy/commit/15353d0e2513c89ee4ffd9d9c5e9e83ef69b96b6)
+* refactor vscode configuration scripts using functions #41 | [67b2d1c](https://github.com/undergroundwires/privacy.sexy/commit/67b2d1c11cd5b131dff93a4437db79d96ed8b3dc)
+* refactor state handling to make application available independent of the state | [df273f7](https://github.com/undergroundwires/privacy.sexy/commit/df273f7f635ab156ac51a8dfb3fec66c4979f1c4)
+* add test to ensure correct shared functions are being parsed | [d7de420](https://github.com/undergroundwires/privacy.sexy/commit/d7de420d5c91bd9ce64880cd4a4391ad3a0a5401)
+* refactor and add tests for NonCollapsingDirective | [5934b17](https://github.com/undergroundwires/privacy.sexy/commit/5934b1728328c3b2ece1597b74dd87477d162175)
+* add GitHub issue templates | [daa997b](https://github.com/undergroundwires/privacy.sexy/commit/daa997b21b624d133c6f5e4cd6b70214588f9144)
+* correct the typo in application.md (#60) | [575636e](https://github.com/undergroundwires/privacy.sexy/commit/575636e6b728a2bdd1a9bd72c57bbf2752f10887)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.9.1...0.9.2)
+
+## 0.9.1 (2021-01-23)
+
+* in CI/CD, allow publishing to github if release is more than 2 hours old electron-userland/electron-builder#2074 | [cf907d0](https://github.com/undergroundwires/privacy.sexy/commit/cf907d029a6d80682ba78ec887a9c4fab639db51)
+* in CI/CD, publish packages for other OSes if single one fails | [4015e2c](https://github.com/undergroundwires/privacy.sexy/commit/4015e2ccd8492e0693365b70fbfe3bd0ac7a6ea2)
+* specify desktop publish targets as defaults (may) change | [2316e3f](https://github.com/undergroundwires/privacy.sexy/commit/2316e3fb6867e5d765eafcf675b77f88bd2a0f52)
+* fix selection state indicator on cards not showing up | [8b0e47d](https://github.com/undergroundwires/privacy.sexy/commit/8b0e47da38c49cfe2645d7d25970c448ecd200f8)
+* transpile using babel for legacy browser support | [7930bef](https://github.com/undergroundwires/privacy.sexy/commit/7930bef48c4e9a4fe0823673958ed8377f5ee533)
+* fix node APIs no longer working on desktop nklayman/vue-cli-plugin-electron-builder#610, nklayman/vue-cli-plugin-electron-builder#742 | [d7f9ef1](https://github.com/undergroundwires/privacy.sexy/commit/d7f9ef1cbebe911aa19f29be8c5fa9360550793e)
+* improve explanation for selections | [229c13a](https://github.com/undergroundwires/privacy.sexy/commit/229c13a195dee92e4a31731b7b41c319273a16f1)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.9.0...0.9.1)
+
+## 0.9.0 (2021-01-15)
+
+* refactor application.yaml to become an os definition #40 | [f7557bc](https://github.com/undergroundwires/privacy.sexy/commit/f7557bcc0faf44e8395b68c7eb14c5f715f07b92)
+* refactor folders to move "/state" (IApplicationState) inside "/context" (IApplicationContext) | [3467241](https://github.com/undergroundwires/privacy.sexy/commit/34672414c3e0757173036e351df0a73c1708ded5)
+* add scripts to prevent family safety monitoring | [e14bf2b](https://github.com/undergroundwires/privacy.sexy/commit/e14bf2bfa03efe28ff39942c9891fca605f13eed)
+* rework Cortana scripts to remove duplicates, better document and support Windows version 2004/2009 #43 | [7cc161c](https://github.com/undergroundwires/privacy.sexy/commit/7cc161c828a3fa49f6f254e31834a95a502b7aa2)
+* rename Application to CategoryCollection #40 | [6fe858d](https://github.com/undergroundwires/privacy.sexy/commit/6fe858d86aeb0f8b6d5ae5c2a5e3c25ff32e5f6f)
+* add script to clean previous windows installation #35 | [3455a2c](https://github.com/undergroundwires/privacy.sexy/commit/3455a2ca6ce13f9b0e866d88532a5c3d6de30d4d)
+* refactor to allow switching ICategoryCollection context #40 | [2e40605](https://github.com/undergroundwires/privacy.sexy/commit/2e40605d59eb764768457c6af561487e7ff09777)
+* fix typo causing uninstalling capabilities to fail #51 | [c299e95](https://github.com/undergroundwires/privacy.sexy/commit/c299e95bc6d588317b69a9efcf5752ff5c9c3926)
+* improve uninstalling apps to show errors and exit if taking ownership fails #51 | [72e925f](https://github.com/undergroundwires/privacy.sexy/commit/72e925fb6f908cd58fb50618f29726b3fb54a7f1)
+* move application.yaml to collections/windows.yaml #40 | [6b83dcb](https://github.com/undergroundwires/privacy.sexy/commit/6b83dcbf8fa08b4efe9974c7d7a667458f7c595c)
+* recommend onedrive removal on strict mode | [663d63b](https://github.com/undergroundwires/privacy.sexy/commit/663d63bde08dd1b0d43ec144c758399cec90ec70)
+* document app connector removal and recommend on strict mode | [9d009c4](https://github.com/undergroundwires/privacy.sexy/commit/9d009c40dd411c73c7ae032a78ec51490ecce024)
+* recommend removing cortana taskbar icon on standard mode | [7ec889e](https://github.com/undergroundwires/privacy.sexy/commit/7ec889e759df04bba99d3b6c4d0597809bd94058)
+* fix unintended null file creation #52 | [2428de2](https://github.com/undergroundwires/privacy.sexy/commit/2428de23ee02de987e7e6ec80ebd67be369d9048)
+* add initial macOS support #40 | [8a8b731](https://github.com/undergroundwires/privacy.sexy/commit/8a8b7319d539b31c1d8ad9eaf541762d64f02493)
+* add scripts to manage chromium based edge | [86a2b2f](https://github.com/undergroundwires/privacy.sexy/commit/86a2b2fda0b6a2565c550758c7c175fa795926b7)
+* update screenshot | [c318bd3](https://github.com/undergroundwires/privacy.sexy/commit/c318bd301a2cbebbf5cdba06c0f18ac291aa4788)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.8.2...0.9.0)
+
+## 0.8.2 (2020-12-26)
+
+* replace ampersand in "Movies & TV app" with "and" to prevent batch file from misinterpreting it (#45) | [52d4313](https://github.com/undergroundwires/privacy.sexy/commit/52d4313156d2dcbc508b7271e7d9dfd45723d7bc)
+* update dependencies to latest #46 | [d9e44e2](https://github.com/undergroundwires/privacy.sexy/commit/d9e44e25744e5d0aa01b8fc0f0af74c48027aea3)
+* fix type assignment error after typescript upgrade | [55f936f](https://github.com/undergroundwires/privacy.sexy/commit/55f936fee9f86757f63fa8952d89711feb247e5b)
+* correct typos (#48) | [a744415](https://github.com/undergroundwires/privacy.sexy/commit/a744415eb2ab65ee4f519f863fdd6a43953377bb)
+* in ci/cd, do not run security checks if PRs do not change dependencies #48 | [54ba4db](https://github.com/undergroundwires/privacy.sexy/commit/54ba4dbb0bf8f08f9479f8facb2e12c786c1bc51)
+* rename app launch tracking tweak to make it more clear #44 | [b3117c2](https://github.com/undergroundwires/privacy.sexy/commit/b3117c27f283c2d5a25fd94021a9f628a272cda6)
+* refactor capabilities to use a shared function #41 #47 | [c4ec6a1](https://github.com/undergroundwires/privacy.sexy/commit/c4ec6a1445d2fd5eb923c97b54aee01e272e13a8)
+* rename "disable" to "uninstall" for removing capabilities #47 | [8cd3352](https://github.com/undergroundwires/privacy.sexy/commit/8cd3352017f9dc85f8efcd7b450d90f555d3e92e)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.8.1...0.8.2)
+
+## 0.8.1 (2020-11-16)
+
+* refactor removing bloatware to use functions #41 | [ffa279f](https://github.com/undergroundwires/privacy.sexy/commit/ffa279f3dfe51db564f0a3859543eb212170e173)
+* fix reinstalling store apps by searching appx for all users | [2c5ab3e](https://github.com/undergroundwires/privacy.sexy/commit/2c5ab3ea7da159cfb9fbfbbb7cdd28afbee965ea)
+* fix clearing jump lists causing os to break and user pin removal #37 | [92c3dd9](https://github.com/undergroundwires/privacy.sexy/commit/92c3dd923257ac940eab6cbab858698ed55a09b7)
+* fix reinstalling store apps by searching appx for all users | [4e72673](https://github.com/undergroundwires/privacy.sexy/commit/4e7267337301fe4a0480ba0603218fca25c2d096)
+* refactor unused imports | [45b8dd9](https://github.com/undergroundwires/privacy.sexy/commit/45b8dd972b1edf9e263858c23b27e7a1d2e07077)
+* fix not being able to uninstall system apps | [31e08d2](https://github.com/undergroundwires/privacy.sexy/commit/31e08d231d52e2a691400468b7c599c142a29448)
+* fix wrong app names caused by wrong Microsoft docs | [e41e40c](https://github.com/undergroundwires/privacy.sexy/commit/e41e40c5bf01e2971d3054fcd3a48f8465a96622)
+* unrecommend some system apps and document more | [29c7704](https://github.com/undergroundwires/privacy.sexy/commit/29c7704e0bd38f6e9923cde84accb569b02d2dd6)
+* fix not being able to rename paths including brackets | [ad1872e](https://github.com/undergroundwires/privacy.sexy/commit/ad1872e7cd4ad7ef9facf33fadfa8c6a55065dd3)
+* fix errors when file already exists | [c26bc20](https://github.com/undergroundwires/privacy.sexy/commit/c26bc209eb167aa71cad10b7f3ea02d0dedd97b0)
+* move Microsoft.Appconnector to right category | [b247b12](https://github.com/undergroundwires/privacy.sexy/commit/b247b12c3f009aab4350e33f4779fd193e570050)
+* replace deprecated github ::set-env command | [ab7d617](https://github.com/undergroundwires/privacy.sexy/commit/ab7d617886a65fe4f3c2daa929168e5678ccae60)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.8.0...0.8.1)
+
+## 0.8.0 (2020-11-01)
+
+* add support for different recommendation levels: strict and standard | [14be301](https://github.com/undergroundwires/privacy.sexy/commit/14be3017c55ed5e0d9bdecb63fcc4e1131e79ab0)
+* Add GroupMe and Spotify removal option (#34) | [3785c62](https://github.com/undergroundwires/privacy.sexy/commit/3785c623f837b182d82fa383dfe7709722a67248)
+* switch places of download and copy buttons | [50fb290](https://github.com/undergroundwires/privacy.sexy/commit/50fb29038ae19b17ec006093db02cf1e568d53c3)
+* change "download" button to "save" on desktop | [07fc555](https://github.com/undergroundwires/privacy.sexy/commit/07fc555324d8bf4fa3594a9701daaa124a873153)
+* show icons on cards during indeterminate and fully selected states | [1072505](https://github.com/undergroundwires/privacy.sexy/commit/1072505219edc47d82a91f148d1f310f32869fea)
+* add scripts to increase cryptography, enable camera notifications and remove todo app (#36) | [4c68408](https://github.com/undergroundwires/privacy.sexy/commit/4c68408f1ec339dc8d39c7ab044f825a7f7185cb)
+* update recommendations to be safer and consistent | [d0019c2](https://github.com/undergroundwires/privacy.sexy/commit/d0019c2c9b1eea620e2e8e02b586903ce62b80e3)
+* rework disabling metadata retrieval | [ac70b06](https://github.com/undergroundwires/privacy.sexy/commit/ac70b063b8a15bc528256185792939685be6b36f)
+* add all dist folders in gitignore because of files auto-generated by vscode | [1a9db31](https://github.com/undergroundwires/privacy.sexy/commit/1a9db31c7778c3269a71c0bd9665827efda70a02)
+* add support for shared functions #41 | [8ce06fa](https://github.com/undergroundwires/privacy.sexy/commit/8ce06facbd54184402a4b1af3c7303e64db85b8a)
+* hide scrollbars on code area when not overflowing | [fd28eaa](https://github.com/undergroundwires/privacy.sexy/commit/fd28eaad061c75ea1aa7e0f0d60ea37a7e52f8c4)
+* update screenshot | [cfedcd7](https://github.com/undergroundwires/privacy.sexy/commit/cfedcd724cad7708b30c7390a7bca3b6313b6726)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.6...0.8.0)
+
+## 0.7.6 (2020-10-18)
+
+* add docs for default0 pointing to github discussion (#30) | [a3fc378](https://github.com/undergroundwires/privacy.sexy/commit/a3fc3782efd346b4c99d2a0b40df2eb0229f5b36)
+* add robots.txt to explicitly allow indexing | [4c2f749](https://github.com/undergroundwires/privacy.sexy/commit/4c2f74949b0758d33049bdfa4f0124a28958f8ea)
+* add more reversibility | [19a092d](https://github.com/undergroundwires/privacy.sexy/commit/19a092dd31fb3588277f1ab3120b409d98506752)
+* refactor to read more from package.json | [784a67a](https://github.com/undergroundwires/privacy.sexy/commit/784a67afff681bc19147d03c947de0e165d97e87)
+* simplify "why" section | [77c3d2b](https://github.com/undergroundwires/privacy.sexy/commit/77c3d2bbb8d13db86bb82ed0b5cbeaacfdea3db9)
+* update dependencies to latest | [11e0613](https://github.com/undergroundwires/privacy.sexy/commit/11e06131655398db08faeeacff62062e46e0dddd)
+* run tests on all operating systems: macos, ubuntu, windows | [d9d7f62](https://github.com/undergroundwires/privacy.sexy/commit/d9d7f62d81d4d8f95104d33211e82641884d711f)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.5...0.7.6)
+
+## 0.7.5 (2020-09-14)
+
+* fix reverting (reinstalling) capabilities not working | [939d838](https://github.com/undergroundwires/privacy.sexy/commit/939d838e3535bb1c9b00c8ea9dacb735ae41d700)
+* fix tests and checks are not running on PRs | [82d5091](https://github.com/undergroundwires/privacy.sexy/commit/82d509129b4e4a5df4b84786a0d6842a7d26e888)
+* fix the recycling bin option (#32) | [15db311](https://github.com/undergroundwires/privacy.sexy/commit/15db3118012a172a2191a2afad57084a65b34642)
+* fix rendering issue in older edge/IE | [6efed72](https://github.com/undergroundwires/privacy.sexy/commit/6efed72bf25c2ddf0901caab7f22966ca13cd47a)
+* fix pasting in search bar after page load showing no results | [d169434](https://github.com/undergroundwires/privacy.sexy/commit/d1694341578288eeaf8b80caf9296a38d76789f0)
+* fix typo | [7dd15ed](https://github.com/undergroundwires/privacy.sexy/commit/7dd15ed06433e0e6583ab0fa46a683ce6554bbea)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.4...0.7.5)
+
+## 0.7.4 (2020-09-12)
+
+* fix checked checkbox has blue border | [4ae385b](https://github.com/undergroundwires/privacy.sexy/commit/4ae385b7fcea9014a68442714b7d99e2ee7df7d0)
+* fix spectre protection getting single lined #31 | [22b23a9](https://github.com/undergroundwires/privacy.sexy/commit/22b23a9ece446c7f9abd4ede293051eb616ad50a)
+* fix missing reg value in denying app access to account | [3c13a9e](https://github.com/undergroundwires/privacy.sexy/commit/3c13a9e837e06e097450b31d7eb0c0e6bf20cefb)
+* fix wrong path in clear all firefox user profile settings | [ee66196](https://github.com/undergroundwires/privacy.sexy/commit/ee66196d9a60f27d17ae7f62d02b4f119a47e6e0)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.3...0.7.4)
+
+## 0.7.3 (2020-09-12)
+
+* fix vscode settings file override and add more configs | [a0d6172](https://github.com/undergroundwires/privacy.sexy/commit/a0d61728ead04b4455437f85820121a848db9e00)
+* fix nvidia tweak error message, categorize and add reversibility | [99a2035](https://github.com/undergroundwires/privacy.sexy/commit/99a2035fdb0766a4dfc2753133eab0d7666516cd)
+* improve CPU specific tweaks by conditional platform checks and reversibility | [8df5faf](https://github.com/undergroundwires/privacy.sexy/commit/8df5faf4ef05a49da63973bd0fbb5c5d07d5bd93)
+* fix wrong path to the main telemetry file | [de4ac97](https://github.com/undergroundwires/privacy.sexy/commit/de4ac978bdda79573b36d355697b8a028d2c0beb)
+* fix naming of firefox cleanup to mention profiles | [3ab48b1](https://github.com/undergroundwires/privacy.sexy/commit/3ab48b1cf5f7f934f07e468ef2318ccee07f530c)
+* add reversibility and more scripts to denying app access with better structure | [1d465ee](https://github.com/undergroundwires/privacy.sexy/commit/1d465ee3189d0e5a827453b3f0eb4361efe23770)
+* fix comment lines are being detected as duplicate in validation | [b6ccb59](https://github.com/undergroundwires/privacy.sexy/commit/b6ccb5927a20412976a54fd2215eb645092f98a8)
+* add more detailed error message | [1f11c39](https://github.com/undergroundwires/privacy.sexy/commit/1f11c39773c12eccfb3efb898b58c2f6f37ab9ca)
+* fix typo in a test | [1f19b25](https://github.com/undergroundwires/privacy.sexy/commit/1f19b2528a69383e63e579d2885f01cd804abf6c)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.2...0.7.3)
+
+## 0.7.2 (2020-09-06)
+
+* update onesync documentation and do not recommend it as it breaks other apps | [f36d8bf](https://github.com/undergroundwires/privacy.sexy/commit/f36d8bfc7848bb65ac0c641e318a689bf3816ccf)
+* add reversibility for biometric disabling and do not recommend it | [db74531](https://github.com/undergroundwires/privacy.sexy/commit/db74531cd4139615c6d595959217d3651f099019)
+* fix bad highlighting of selected nodes when using keyboard navigation | [255133a](https://github.com/undergroundwires/privacy.sexy/commit/255133af4dfae40171406648a3e2920f16d71cb3)
+* add reversibility to removing bloatware | [c7b2a70](https://github.com/undergroundwires/privacy.sexy/commit/c7b2a703128470a05f12c9c6e8002444def37ef8)
+* fix indeterminate state being lost | [1f266c3](https://github.com/undergroundwires/privacy.sexy/commit/1f266c33535f72b69c65985bf2eff27cd2c5a104)
+* fix wording in default text in text area | [ca63a09](https://github.com/undergroundwires/privacy.sexy/commit/ca63a0979ef55d07d09d9443e5cea9aa888870a5)
+* add best practice suggestion to come back | [f4885b6](https://github.com/undergroundwires/privacy.sexy/commit/f4885b6f1c82752f2143934e336d6d1b1af03015)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.1...0.7.2)
+
+## 0.7.1 (2020-09-04)
+
+* fix some browsers (including firefox) downloading the script as a text file | [8c17929](https://github.com/undergroundwires/privacy.sexy/commit/8c17929151f9c4fa5f48564492bbf400ced95eea)
+* rename screenshot image file | [b8682a8](https://github.com/undergroundwires/privacy.sexy/commit/b8682a852a14ed6cf49986695d9510b840ac9d3d)
+* fix new/changed script higlighting not working on production builds | [8c38dd7](https://github.com/undergroundwires/privacy.sexy/commit/8c38dd73d8c7b77d8d341c0389f4d7229f9b97fd)
+* refactor unused imports | [6badfef](https://github.com/undergroundwires/privacy.sexy/commit/6badfef9daace0c5de3fd33652a82bfe22261b11)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.7.0...0.7.1)
+
+## 0.7.0 (2020-09-02)
+
+* [search] better (multilined) message when there are no results | [ec15af0](https://github.com/undergroundwires/privacy.sexy/commit/ec15af01dd020b364c2174fe562fd66227c2320c)
+* [search] added clear/close button | [d6fa9a2](https://github.com/undergroundwires/privacy.sexy/commit/d6fa9a2a03c0ebe68b94f0b80cc52b4e200c9213)
+* move script generation to /generation | [5df4587](https://github.com/undergroundwires/privacy.sexy/commit/5df458739d076719e350ba194c4f3f772884fcdb)
+* add auto-highlighting of selected/updated code | [b789250](https://github.com/undergroundwires/privacy.sexy/commit/b789250cb89e2130b08e1a927df8181cf945dfeb)
+* prompt admin priviliges automatically | [f8ba5c4](https://github.com/undergroundwires/privacy.sexy/commit/f8ba5c46e4923d9c35f200f8a08aa6437f7c0ecc)
+* add removal of ghost (default0) telemetry user | [c262681](https://github.com/undergroundwires/privacy.sexy/commit/c262681011f39b4412669b6cf233476f676ca550)
+* add more windows defender tweaks, categorization and reversibility | [1a34c73](https://github.com/undergroundwires/privacy.sexy/commit/1a34c7374ba56bafa0209bbb55c81b233bb419ed)
+* fix NTP script documentation is on wrong place | [3060ebf](https://github.com/undergroundwires/privacy.sexy/commit/3060ebf79cf242370433495cc3e1878b7581b202)
+* updated dependencies to latest and audit fixes (#25) | [c628aa9](https://github.com/undergroundwires/privacy.sexy/commit/c628aa9aef8ab7c815661d3c1711e7fbc65c69a2)
+* categorize, fix and extend windows log files cleanup | [594a14d](https://github.com/undergroundwires/privacy.sexy/commit/594a14d6ca76cbd27a21877b8c373c1930589ca6)
+* add more OneDrive cleanup scripts and categorize them | [978d7d0](https://github.com/undergroundwires/privacy.sexy/commit/978d7d08638dd161082f239ed088b12302f29458)
+* add disabling firefox telemetry | [f8b8b4c](https://github.com/undergroundwires/privacy.sexy/commit/f8b8b4c97ab734d5ba7370894b694993924388da)
+* add disabling ccleaner telemetry | [018b7e2](https://github.com/undergroundwires/privacy.sexy/commit/018b7e270f207aac926cb12f8069ebfcdce193ce)
+* Add disabling of PowerShell 7+ telemetry (#29) | [456e40b](https://github.com/undergroundwires/privacy.sexy/commit/456e40bedf9afcc846f9b13f1ea144cef6115cf6)
+* categorize, fix, make scripts reversible in "UI for privacy", "security improvements" and "configure browsers" | [532915b](https://github.com/undergroundwires/privacy.sexy/commit/532915b95da9fecd6b981d91bf489359e4e53caa)
+* fix "Configure Defender" being in wrong category #28 | [f709d6a](https://github.com/undergroundwires/privacy.sexy/commit/f709d6a566ed7846b677b383863deda9680a2a9c)
+* do not hardcode capability versions and make them reversible | [2afef4e](https://github.com/undergroundwires/privacy.sexy/commit/2afef4ea3d0d3d09aa1fa1eedba8493680bd8f10)
+* exclude paint, wordpad and notepad from bloatware removal | [d235dee](https://github.com/undergroundwires/privacy.sexy/commit/d235dee95514a01745aef9479d07f88ffb4b40b8)
+* add reversibility on category level | [f51e885](https://github.com/undergroundwires/privacy.sexy/commit/f51e8859eeb32c944126d692cfe03a0320c8b568)
+* refactor unused imports & variables | [a23d28f](https://github.com/undergroundwires/privacy.sexy/commit/a23d28f2cfa2d64d45460697cf5ee9d6b5920752)
+* fix search (got broken in b789250) with tests and refactorings | [8bbe6eb](https://github.com/undergroundwires/privacy.sexy/commit/8bbe6ebf750f1a1cbab493fb99b5ea91f4e21609)
+* update the screenshot to show off highlighting | [b4aacea](https://github.com/undergroundwires/privacy.sexy/commit/b4aacea2a3e0bbcf2d8a79ff67f51c0f19e888a6)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.6.2...0.7.0)
+
+## 0.6.2 (2020-08-16)
+
+* 🐛 fixed disabling error reporting for november 2019 update | [5967347](https://github.com/undergroundwires/privacy.sexy/commit/5967347b80976a519f6f4eb1972a62f3e600df2b)
+* 🐛 fixed blank screen and icons on mac | [7fac0fe](https://github.com/undergroundwires/privacy.sexy/commit/7fac0fe79f252e8f9dda4f6f83cd6fa4ba2b539f)
+* 🐛 fixed removing onedrive does not delete scheduled tasks | [b6bfc25](https://github.com/undergroundwires/privacy.sexy/commit/b6bfc2572740c0cd46d3bc0058fa767dd5fa862e)
+* ⚙️ enhanced tweak to disable for office telemetry | [afc3bfb](https://github.com/undergroundwires/privacy.sexy/commit/afc3bfb3b8896f332c9a196973ded3dce8fd21e4)
+* ✨ added script to clear dotnet telemery | [1663bfe](https://github.com/undergroundwires/privacy.sexy/commit/1663bfeac7b6580b1335ca5fcf3587b69c080c72)
+* 🐛 fixed changing time server not working | [c69998c](https://github.com/undergroundwires/privacy.sexy/commit/c69998c7cb29ffcf40f0af03b73150736581da69)
+* 🔥 removed disabling ClickToRun as it breaks office | [3d3380f](https://github.com/undergroundwires/privacy.sexy/commit/3d3380f27ebeea53f17f49974aaa89300ffaf2dd)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.6.1...0.6.2)
+
+## 0.6.1 (2020-08-09)
+
+* updated documentation | [5963d2b](https://github.com/undergroundwires/privacy.sexy/commit/5963d2bac551083f9d16cce6b851abf0e8b88ce7)
+* fixed typo in footer | [5c15a7a](https://github.com/undergroundwires/privacy.sexy/commit/5c15a7a64aaf24578a32713dec491bf494216303)
+* more scripts can be reverted | [831c014](https://github.com/undergroundwires/privacy.sexy/commit/831c014f977515454ee6dc664d77a8c434495501)
+* moved windows connect now to security & recommended | [6049a2b](https://github.com/undergroundwires/privacy.sexy/commit/6049a2b834d8d17af741f8d8f8b07cd15153b001)
+* fixed mac / linux download links | [4c8be45](https://github.com/undergroundwires/privacy.sexy/commit/4c8be45e287b5ea009d6f828f7f327f37850569e)
+* tweaks to disable webcam, speech and compatibility telemetry | [a5dbe66](https://github.com/undergroundwires/privacy.sexy/commit/a5dbe66fc175e39397f296ab2ff703e9b0ab4d7c)
+* refactorings | [66d4d39](https://github.com/undergroundwires/privacy.sexy/commit/66d4d39d5bf3db305450514c6b6224654dafbfb2)
+* fixed removing onedrive does not clean start menu / quick access | [1cc1219](https://github.com/undergroundwires/privacy.sexy/commit/1cc12195a3e9a11c590d3ed64d80299b50f74838)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.6.0...0.6.1)
+
+## 0.6.0 (2020-07-26)
+
+* fixed dead links in documentation | [25ce236](https://github.com/undergroundwires/privacy.sexy/commit/25ce236a7737decaf2eb9b8c29a4c4f34d43f770)
+* runs tests on each push on the repository | [73c4268](https://github.com/undergroundwires/privacy.sexy/commit/73c426844a0330718a9ab7de12b61ca05e853323)
+* code area now shows "how" before "why" | [4ff4b52](https://github.com/undergroundwires/privacy.sexy/commit/4ff4b52202b1c5dbfe2b80580bbe7d93132ab05c)
+* support for desktop versions #20 | [04b9b59](https://github.com/undergroundwires/privacy.sexy/commit/04b9b59e14766ccd251474ad3710baf1f682fd49)
+* reworked on footer & removed github icon | [60a5a2a](https://github.com/undergroundwires/privacy.sexy/commit/60a5a2aa4026d384bef9e6a203f1b7514a269c33)
+* updated dependencies to latest | [45816a2](https://github.com/undergroundwires/privacy.sexy/commit/45816a2bccb3d11a50e3f2bc19c0a6cc2587deaa)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.5.0...0.6.0)
+
+## 0.5.0 (2020-07-19)
+
+* added ability to revert (#21) | [9c063d5](https://github.com/undergroundwires/privacy.sexy/commit/9c063d59defa6297c64f50b49403e8bd10620de9)
+* search placeholder shows total scripts | [1d5225d](https://github.com/undergroundwires/privacy.sexy/commit/1d5225de07186f853f4cf7aedd4998f5d00c107a)
+* do not collapse card when on "Search" and "Select" | [dd7e141](https://github.com/undergroundwires/privacy.sexy/commit/dd7e1416b4df54bf71b719d4654db88769dc0994)
+* opening a card scrolls to its content div | [31d2067](https://github.com/undergroundwires/privacy.sexy/commit/31d2067f076c3159483baec49975617dddbd158d)
+* all cards in same line now have same height | [a9f9e90](https://github.com/undergroundwires/privacy.sexy/commit/a9f9e9044385d9aed3b5551fc6c6823e813fd1e5)
+* patched loadash vulnerability (#18) | [92a7118](https://github.com/undergroundwires/privacy.sexy/commit/92a7118d1c5013312772e075b9ee5a79c93710b8)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.10...0.5.0)
+
+## 0.4.10 (2020-07-15)
+
+* fixed script errors & added tests | [9e722dd](https://github.com/undergroundwires/privacy.sexy/commit/9e722ddfb3825fb29d6298025baaaa033120d017)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.9...0.4.10)
+
+## 0.4.9 (2020-07-14)
+
+* disable office telemetry Disassembler0/Win10-Initial-Setup-Script#288 | [53cf595](https://github.com/undergroundwires/privacy.sexy/commit/53cf595e1726ee3de79137fd566978fd512d218f)
+* updated to may 2020 update | [909c44d](https://github.com/undergroundwires/privacy.sexy/commit/909c44d72a4a602ee8f27d06b6ec706c1e432ce1)
+* simplified docker builds | [f27a287](https://github.com/undergroundwires/privacy.sexy/commit/f27a2871d74e5117fc029be82caef12246e10879)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.8...0.4.9)
+
+## 0.4.8 (2020-07-11)
+
+* added more scripts #16 (#17) | [d8552c6](https://github.com/undergroundwires/privacy.sexy/commit/d8552c62ffea13ce62abce836c7dd4980eef6bb9)
+* stopping services before disabling #16 | [628c16e](https://github.com/undergroundwires/privacy.sexy/commit/628c16eb952495f5b3f6d794161b355f4b08b819)
+* can disable features, capabilities & remove onedrive #16 | [30efbcc](https://github.com/undergroundwires/privacy.sexy/commit/30efbcc621eb83dd5a9c1e66b8f1f5350eb95006)
+* updated one more typo (#19) | [d7a1325](https://github.com/undergroundwires/privacy.sexy/commit/d7a1325c0b7665ce712dc411965d00fc1d6fa384)
+* more tweaks #16 | [2c4eb78](https://github.com/undergroundwires/privacy.sexy/commit/2c4eb78c3f156cb0d033977cffbe7464697680f5)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.7...0.4.8)
+
+## 0.4.7 (2020-06-30)
+
+* removed HKU tweak as all HKU's are changed #10 | [c937af8](https://github.com/undergroundwires/privacy.sexy/commit/c937af8ee7da9aa95131e56abf7bf24800390fe6)
+* Fixed types + script in "Clear Windows log files" (#15) | [461a4f1](https://github.com/undergroundwires/privacy.sexy/commit/461a4f122b342369db5cc08c5e30961c64e68cdd)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.6...0.4.7)
+
+## 0.4.6 (2020-06-16)
+
+* Fixed Some More Issues (#12) | [52d5713](https://github.com/undergroundwires/privacy.sexy/commit/52d5713a99422cdf900aba819e49e998abac33cc)
+* removed failing continuous deployment #14 | [583c566](https://github.com/undergroundwires/privacy.sexy/commit/583c5660d6ac934b845a044e013357aa91f61c15)
+* Updated Some Tweaks (#11) | [0fc1845](https://github.com/undergroundwires/privacy.sexy/commit/0fc18459cde57684f00764815062f838f932aed5)
+* Updated Some More Tweaks (#13) | [019b838](https://github.com/undergroundwires/privacy.sexy/commit/019b838925e963b7ec052ac76c6faf5650b9eb67)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.5...0.4.6)
+
+## 0.4.5 (2020-06-13)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.4...0.4.5)
+
+## 0.4.4 (2020-05-24)
+
+* fixed close card button not being visible & cleanup | [0d2efe5](https://github.com/undergroundwires/privacy.sexy/commit/0d2efe5b05aa965458b78b8fa43754ce2f4fe11b)
+* new footer with privacy policy | [e2ab124](https://github.com/undergroundwires/privacy.sexy/commit/e2ab124fb799f56ada3570fdc911361cb803e889)
+* one command to lint everything "npm run lint" | [bb98d20](https://github.com/undergroundwires/privacy.sexy/commit/bb98d20637cbf1d524ebb2973e308773006e3153)
+* fix "group by" overflows on smaller screens | [c668a97](https://github.com/undergroundwires/privacy.sexy/commit/c668a97950a1cb7c8bf2a7fd8a72d1101e65e8ce)
+* clicking outside of a card closes it | [aab8f21](https://github.com/undergroundwires/privacy.sexy/commit/aab8f21a8d8dbed54798af581e6e1ad9e86a4be1)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.3...0.4.4)
+
+## 0.4.3 (2020-05-23)
+
+* removed redundant documentation | [749a140](https://github.com/undergroundwires/privacy.sexy/commit/749a140eb8dba09cb67fec2f8dec937e66e3cff5)
+* fixed broke link | [97b7e03](https://github.com/undergroundwires/privacy.sexy/commit/97b7e03233d9718a8df30cb01ce06ca9489a0295)
+* simplified heading | [226074c](https://github.com/undergroundwires/privacy.sexy/commit/226074c5342f7463c06fcff1457d352ca30295a3)
+* reading version from package.json instead of version file #5 | [691f989](https://github.com/undergroundwires/privacy.sexy/commit/691f989682179016ddcbf55a05cded29155288c9)
+* automatically increases patch number #5 | [3e3bc07](https://github.com/undergroundwires/privacy.sexy/commit/3e3bc07576f7c7e74e3e11fc7d197cbb9a9fb8c0)
+* using deployment operations from aws-static-site-with-cd | [997be71](https://github.com/undergroundwires/privacy.sexy/commit/997be7113f676888892ffa35566d9ebb58a3e9ea)
+* automated using bump-everywhere + more quality checks (#8) | [4a91e8c](https://github.com/undergroundwires/privacy.sexy/commit/4a91e8ccd8a707bc6bea34ee28cff7fa4f66ee2f)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.2...0.4.3)
+
+## 0.4.2 (2020-02-29)
+
+* added missing semicolon for masking | [e63ac4a](https://github.com/undergroundwires/privacy.sexy/commit/e63ac4ae67da68243a525af149ff30e5d485b641)
+* set font on input | [0c39a06](https://github.com/undergroundwires/privacy.sexy/commit/0c39a06be5e4b0a2031ad5e9f5220dd669afee53)
+* shortened all HKEY paths | [802b36b](https://github.com/undergroundwires/privacy.sexy/commit/802b36bdd8dcc1f0a2853fe7da2ea2fccd69a88c)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.1...0.4.2)
+
+## 0.4.1 (2020-01-11)
+
+* fixed search bug | [31364bd](https://github.com/undergroundwires/privacy.sexy/commit/31364bdfec503af09ffbb58044a17dfb833fc8d9)
+* hide grouping while searching | [92f1a36](https://github.com/undergroundwires/privacy.sexy/commit/92f1a36bcb1e1fe7c90efe8ccd3ede55991e9d9c)
+* 👀🔍  showing search queries | [97a7747](https://github.com/undergroundwires/privacy.sexy/commit/97a7747933d2b515cc03ab8243e6a8ae702ef16a)
+* more efficient queries with single lowercase | [19813b6](https://github.com/undergroundwires/privacy.sexy/commit/19813b691746d98670823025c460480400e34b6e)
+* using right 🔍 input type | [0ce354e](https://github.com/undergroundwires/privacy.sexy/commit/0ce354ea0956391ad3f37b252daac1127bfc601a)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.4.0...0.4.1)
+
+## 0.4.0 (2020-01-11)
+
+* 🔍 support for search | [89862b2](https://github.com/undergroundwires/privacy.sexy/commit/89862b2775703257b9dc2e19fbebde2c0d0fbda0)
+* more scripts & better organized | [95baf31](https://github.com/undergroundwires/privacy.sexy/commit/95baf3175b0d2c7df516f7893a96346b94ac8eca)
+* refactorings | [e3f82e0](https://github.com/undergroundwires/privacy.sexy/commit/e3f82e069e305f6d94eab335470c8e7b44295dd6)
+* more margin for the scripts | [5ea46ec](https://github.com/undergroundwires/privacy.sexy/commit/5ea46ecbf52236953d19f09a8eade08b83e6cd34)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.3.0...0.4.0)
+
+## 0.3.0 (2020-01-09)
+
+* added description & more descriptive title | [9957634](https://github.com/undergroundwires/privacy.sexy/commit/99576340b648550149871e2c0fe0b0d8c2dd0d7c)
+* allow robots | [eee0e78](https://github.com/undergroundwires/privacy.sexy/commit/eee0e785ec2c5e6bed53d21b4126a57773e35dba)
+* removed unused references | [cfd888f](https://github.com/undergroundwires/privacy.sexy/commit/cfd888f3afc5c260a0a4a73f2843b86b9f1df2cd)
+* 🚫 disable NVIDIA telemetry | [ab28f4e](https://github.com/undergroundwires/privacy.sexy/commit/ab28f4ed8538d51e1777c86302a63a0cd9c3cb2a)
+* backwards compatibility for fonts | [4bc13e1](https://github.com/undergroundwires/privacy.sexy/commit/4bc13e11926a6df77079646499e799742153b4ab)
+* added back meta needed for responsiveness | [ed872ef](https://github.com/undergroundwires/privacy.sexy/commit/ed872ef3d9f6c92afc0ce0d06998c60463a8b4e8)
+* fancy-font is renamed to main and now used | [6825001](https://github.com/undergroundwires/privacy.sexy/commit/6825001c61426194dc363b96b57a321241f3ba57)
+* added support for grouping | [ec6b3c5](https://github.com/undergroundwires/privacy.sexy/commit/ec6b3c54072a77bb4305da1c234db6c649218b88)
+* less hyphens as it looks better on mobile | [e0b080a](https://github.com/undergroundwires/privacy.sexy/commit/e0b080af69157f46ba12e2c25e794f5384671b51)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.2.0...0.3.0)
+
+## 0.2.0 (2020-01-06)
+
+* added GitHub Actions badge for build & deploy | [a229aca](https://github.com/undergroundwires/privacy.sexy/commit/a229aca68a92bbcd8e8176ac1dd25ce03509e074)
+* more badges 📛🏆📜 | [090e831](https://github.com/undergroundwires/privacy.sexy/commit/090e8319091044e53484ba8338510f6fb7c3cb80)
+* typo fixes + whitespace refactorings | [e99f210](https://github.com/undergroundwires/privacy.sexy/commit/e99f210c9dcf61a21e445e2a331384b6066f2c98)
+* switched content information to "why" section | [beb3c83](https://github.com/undergroundwires/privacy.sexy/commit/beb3c8339f83a224ca66ad8a911a9265ffe7c9c0)
+* fixed contribution URL | [7b4277d](https://github.com/undergroundwires/privacy.sexy/commit/7b4277d7706ccf6ba7e4b7b01aa46f8e3852cfc6)
+* fixed wrong relation + lighter style | [8d05b03](https://github.com/undergroundwires/privacy.sexy/commit/8d05b03c9f3c9fc015be6615da8c283809712065)
+* better URL validation | [aff463d](https://github.com/undergroundwires/privacy.sexy/commit/aff463dd64fecff92a786fcba88621dff6b1cf73)
+* refactoring to new function | [c646c10](https://github.com/undergroundwires/privacy.sexy/commit/c646c102730481c3f4648eb714dc0a84ce35b13c)
+* optimized find queries & refactorings | [d38f6cd](https://github.com/undergroundwires/privacy.sexy/commit/d38f6cd6a8b33e11df854c7abea05974dc04d4ce)
+* 🎨  styled no JS error | [c359f1d](https://github.com/undergroundwires/privacy.sexy/commit/c359f1d89c6874b3cc94154b993e33f58bd32268)
+* simplified finding duplicates | [57037aa](https://github.com/undergroundwires/privacy.sexy/commit/57037aaefcc0e80f0f4719cea89568490a731028)
+* fixed maintainability badge URL | [aaea47e](https://github.com/undergroundwires/privacy.sexy/commit/aaea47e7d15fe41dea26968db0107a0c53d108f3)
+* fixed wrong line dumps | [5ccc7c5](https://github.com/undergroundwires/privacy.sexy/commit/5ccc7c59528885ae7729197df3dfa00f924a2b3f)
+* refactorings in parsing | [2aa3742](https://github.com/undergroundwires/privacy.sexy/commit/2aa3742e30646bf1d1f3779419d161c3fb6c4808)
+* using free function | [20020af](https://github.com/undergroundwires/privacy.sexy/commit/20020af7c1d8de13948d8761fd4e7f0affb2badb)
+* default selection is now none | [3140cc6](https://github.com/undergroundwires/privacy.sexy/commit/3140cc663b86394d543de90228aa53e6a304d8d9)
+* added hyphen lines for longer names | [cced601](https://github.com/undergroundwires/privacy.sexy/commit/cced601d686d550f4225018e5311b7433efbb5ae)
+* more descriptive subtitle | [2cf9214](https://github.com/undergroundwires/privacy.sexy/commit/2cf9214b14d9720f747a71b3864ba7a28acf0ff4)
+* added footer with version | [10a34fa](https://github.com/undergroundwires/privacy.sexy/commit/10a34fae2f1a219ec52db0c74edb39b46ebd8abc)
+* using font variables | [60e6348](https://github.com/undergroundwires/privacy.sexy/commit/60e6348dc8d53f1e81ebdb2ec0e1962aac1e9842)
+* code-gen refactorings | [246e753](https://github.com/undergroundwires/privacy.sexy/commit/246e753ddc9dc8bf630e538663584bf3423cc749)
+* added text when nothing is chosen | [a7da75d](https://github.com/undergroundwires/privacy.sexy/commit/a7da75d4428090423b692ce45423f5bd300d8442)
+
+[compare](https://github.com/undergroundwires/privacy.sexy/compare/0.1.0...0.2.0)
+
+## 0.1.0 (2019-12-31)
+
+Initial release | [commits](https://github.com/undergroundwires/privacy.sexy/commit/4e7f244190c6ffbf7b20443e3e69cf2402c4268a)

CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# Contributing
+
+Love your input! Contributing to this project should be as easy and transparent as possible, whether it's:
+
+- reporting a bug,
+- discussing the current state of the code,
+- submitting a fix,
+- proposing new features,
+- or becoming a maintainer.
+
+As a small open source project with small community, it can sometimes take a long time to address the issues so please be patient.
+
+## Pull request process
+
+Your pull requests are actively welcomed. We collaborate using [GitHub flow](https://docs.github.com/en/get-started/quickstart/github-flow).
+
+The steps:
+
+1. Fork the repo and create your branch from master.
+2. If you've added code that requires testing, add tests. See [tests.md](./docs/tests.md).
+3. If you've done a major change, update the documentation. See [docs/](./docs/).
+4. Ensure the test suite passes. See [development.md | Testing](./docs/development.md#testing) for commands.
+5. Make sure your code lints.See [development.md | Linting](./docs/development.md#linting) for commands.
+6. Issue that pull request!
+
+**🙏 DO:**
+
+- Document why (what you're trying to solve) rather than what in the pull request.
+
+**❗ DON'T:**
+
+- Do not update the versions, current version is [set by the maintainer](./docs/ci-cd.md#gitops) and updated automatically by [bump-everywhere](https://github.com/undergroundwires/bump-everywhere).
+
+Automated pipelines will run to control your PR and they will publish your code once the maintainer merges your PR.
+
+📖 You can read more in [ci-cd.md](./docs/ci-cd.md).
+
+## Extend scripts
+
+Here's quick information for you who want to add more scripts.
+
+You have two alternatives:
+
+1. [Create an issue](https://github.com/undergroundwires/privacy.sexy/issues/new/choose) and ask for someone else to add the script for you.
+2. Or send a PR yourself. This would make it faster to get your code into the project. You need to add scripts to related OS in [collections](src/application/collections/) folder. Then you'd sent a pull request, see [pull request process](#pull-request-process).
+   - 📖 If you're unsure about the syntax, check [collection-files.md](docs/collection-files.md).
+   - 📖 If you wish to use templates, use [templating.md](./docs/templating.md).
+
+## License
+
+By contributing, you agree that your [GNU General Public License v3.0](./LICENSE) will be the license for your contributions.

Dockerfile

@@ -1,20 +1,12 @@
-# +-+-+-+-+-+ +-+-+-+-+-+
-# |B|u|i|l|d| |S|t|a|g|e|
-# +-+-+-+-+-+ +-+-+-+-+-+
+# Build
 FROM node:lts-alpine as build-stage
 WORKDIR /app
 COPY package*.json ./
 RUN npm install
 COPY . .
 RUN npm run build
-# For testing purposes, it's easy to run http-server on lts-alpine such as continuing from here:
-#       RUN npm install -g http-server
-#       EXPOSE 8080
-#       CMD [ "http-server", "dist" ]
 
-# +-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+
-# |P|r|o|d|u|c|t|i|o|n| |S|t|a|g|e|
-# +-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+
+# Production stage
 FROM nginx:stable-alpine as production-stage
 COPY --from=build-stage /app/dist /usr/share/nginx/html
 EXPOSE 80

README.md

@@ -1,119 +1,147 @@
-# privacy.sexy
+# privacy.sexy — Now you have the choice
 
-Privacy & security generator tool for Windows.
+> Enforce privacy & security best-practices on Windows, macOS and Linux, because privacy is sexy 🍑🍆
 
-> because privacy is sexy 🍑🍆
+<!-- markdownlint-disable MD033 -->
+<p align="center">
+  <a href="https://undergroundwires.dev/donate?project=privacy.sexy" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="donation badge"
+      src="https://undergroundwires.dev/img/badges/donate/flat.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/blob/master/CONTRIBUTING.md" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="contributions are welcome"
+      src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"
+    />
+  </a>
+  <!-- Code quality -->
+  <br />
+  <a href="https://lgtm.com/projects/g/undergroundwires/privacy.sexy/context:javascript" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Language grade: JavaScript/TypeScript"
+      src="https://img.shields.io/lgtm/grade/javascript/g/undergroundwires/privacy.sexy.svg?logo=lgtm&logoWidth=18"
+    />
+  </a>
+  <a href="https://codeclimate.com/github/undergroundwires/privacy.sexy/maintainability" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Maintainability"
+      src="https://api.codeclimate.com/v1/badges/3a70b7ef602e2264342c/maintainability"
+    />
+  </a>
+  <!-- Tests -->
+  <br />
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/tests.unit.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Unit tests status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/unit-tests/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/tests.integration.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Integration tests status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/integration-tests/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/tests.e2e.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="E2E tests status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/e2e-tests/badge.svg"
+    />
+  </a>
+  <!-- Checks -->
+  <br />
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/checks.quality.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Quality checks status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/quality-checks/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/checks.security.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Security checks status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/security-checks/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/checks.build.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Build checks status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/build-checks/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/checks.desktop-runtime-errors.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Status of runtime error checks for the desktop application"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/checks.desktop-runtime-errors/badge.svg"
+    />
+  </a>
+  <!-- Release -->
+  <br />
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/release.git.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Git release status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/release-git/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/release.site.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Site release status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/release-site/badge.svg"
+    />
+  </a>
+  <a href="https://github.com/undergroundwires/privacy.sexy/actions/workflows/release.desktop.yaml" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Desktop application release status"
+      src="https://github.com/undergroundwires/privacy.sexy/workflows/release-desktop/badge.svg"
+    />
+  </a>
+  <!-- Others -->
+  <br />
+  <a href="https://github.com/undergroundwires/bump-everywhere" target="_blank" rel="noopener noreferrer">
+    <img
+      alt="Auto-versioned by bump-everywhere"
+      src="https://github.com/undergroundwires/bump-everywhere/blob/master/badge.svg?raw=true"
+    />
+  </a>
+</p>
+<!-- markdownlint-restore -->
 
-[https://privacy.sexy](https://privacy.sexy)
+## Get started
 
-In this repo you find:
+- 🌍️ **Online**: [https://privacy.sexy](https://privacy.sexy).
+- 🖥️ **Offline**: Check [releases page](https://github.com/undergroundwires/privacy.sexy/releases), or download directly for: [Windows](https://github.com/undergroundwires/privacy.sexy/releases/download/0.11.2/privacy.sexy-Setup-0.11.2.exe), [macOS](https://github.com/undergroundwires/privacy.sexy/releases/download/0.11.2/privacy.sexy-0.11.2.dmg), [Linux](https://github.com/undergroundwires/pr.vacy.sexy/releases/download/0.11.2/privacy.sexy-0.11.2.AppImage).
 
-- Application & infrastructure code of privacy.sexy, simply everything is code & open-sourced.
-- Fully automated CI/CD pipeline to AWS for provisioning serverless infrastructure using GitHub actions.
-- Vue.js application in conjunction with domain-driven design, event-driven architecture & data-driven programming.
+Online version does not require to run any software on your computer. Offline version has more functions such as running the scripts directly.
 
-## Commands
+💡 You should apply your configuration from time to time (more than once). It would strengthen your privacy and security control because privacy.sexy and its scripts get better and stronger in every new version.
 
-- Setup and run
-  - For development:
-    - `npm install` to project setup.
-    - `npm run serve` to compile & hot-reload for development.
-  - Production (using Docker):
-    - Build `docker build -t undergroundwires/privacy.sexy .`
-    - Run `docker run -it -p 8080:8080 --rm --name privacy.sexy-1 undergroundwires/privacy.sexy`
-- Prepare for production: `npm run build`
-- Run tests: `npm run test:unit`
-- Lint and fix files: `npm run lint`
+[![privacy.sexy application](img/screenshot.png?raw=true )](https://privacy.sexy)
 
-## Extend scripts
+## Features
 
-Fork it & add more scripts in `src/application/application.yml` and send a pull request 👌
+- **Rich**: Hundreds of scripts that aims to give you control of your data.
+- **Free**: Both free as in "beer" and free as in "speech".
+- **Transparent**. Have full visibility into what the tweaks do as you enable them.
+- **Reversible**. Revert if something feels wrong.
+- **Accessible**. No need to run any compiled software on your computer with web version.
+- **Open**. What you see as code in this repository is what you get. The application itself, its infrastructure and deployments are open-source and automated thanks to [bump-everywhere](https://github.com/undergroundwires/bump-everywhere).
+- **Tested**. A lot of tests. Automated and manual. Community-testing and verification. Stability improvements comes before new features.
+- **Extensible**. Effortlessly [extend scripts](./CONTRIBUTING.md#extend-scripts) with a custom designed [templating language](./docs/templating.md).
+- **Portable and simple**. Every script is independently executable without cross-dependencies.
 
-## Architecture
+## Support
 
-### Application
+**Sponsor 💕**. Consider sponsoring on [GitHub Sponsors](https://github.com/sponsors/undergroundwires), or you can donate using [other ways such as crypto or a coffee](https://undergroundwires.dev/donate).
 
-- Powered by **TypeScript** + **Vue.js** 💪
-  - and driven by **Domain-driven design**, **Event-driven architecture**, **Data-driven programming** concepts.
-- Application uses highly decoupled models & services in different DDD layers.
-  - **Domain layer** is where the application is modelled with validation logic.
-  - **Presentation Layer**
-    - Consists of Vue.js components & UI stuff.
-    - Event driven as in components simply listens to events from the state and act accordingly.
-  - **Application Layer**
-    - Keeps the application state
-      - The [state](src/application/State/ApplicationState.ts) is a mutable singleton & event producer.
-    - The application is defined & controlled in a [single YAML file](`\application\application.yaml`) (see [Data-driven programming](https://en.wikipedia.org/wiki/Data-driven_programming))
+**Star 🤩**. Feel free to give it a star ⭐ .
 
-![DDD + vue.js](docs/app-ddd.png)
+**Contribute 👷**. Contributions of any type are welcome. See [CONTRIBUTING.md](./CONTRIBUTING.md) as the starting point. It includes useful information like [how to add new scripts](./CONTRIBUTING.md#extend-scripts).
 
-### AWS Infrastructure
+## Development
 
-- The application runs in AWS 100% serverless and automatically provisioned using [CloudFormation files](/aws) and GitHub Actions.
-- Maximum security & automation and minimum AWS costs were the highest priorities of the design.
+Refer to [development.md](./docs/development.md) for Docker usage and reading more about setting up your development environment.
 
-![AWS solution](docs/aws-solution.png)
+Check [architecture.md](./docs/architecture.md) for an overview of design and how different parts and layers work together. You can refer to [application.md](./docs/application.md) for a closer look at application layer codebase and [presentation.md](./docs/presentation.md) for code related to GUI layer. [collection-files.md](./docs/collection-files.md) explains the YAML files that are the core of the application and [templating.md](./docs/templating.md) documents how to use templating language in those files. In [ci-cd.md](./docs/ci-cd.md), you can read more about the pipelines that automates maintenance tasks and ensures you get what see.
 
-#### GitOps: CI/CD to AWS
-
-- Everything that's merged in the master goes directly to production.
-  - Deploy infrastructure ► Deploy web application ► Invalidate CloudFront Cache
-- See more at [build-and-deploy.yaml](.GitHub/workflows/build-and-deploy.yaml)
-
-![CI/CD to AWS with GitHub Actions](docs/ci-cd.png)
-
-##### CloudFormation
-
-![CloudFormation design](docs/aws-cloudformation.png)
-
-- AWS infrastructure is defined as code with following files:
-  - `iam-stack`: Creates & updates the deployment user.
-    - Everything in IAM layer is fine-grained using least privileges principle.
-    - Each deployment step has its own temporary credentials with own permissions.
-  - `certificate-stack.yaml`
-    - It'll generate SSL certification for the root domain and www subdomain.
-    - ❗ It [must](https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-invalid-viewer-certificate/) be deployed in `us-east-1` to be able to be used by CloudFront by `web-stack`.
-    - It uses CustomResource and a lambda instead of native `AWS::CertificateManager::Certificate` because:
-      - Problem:
-        - AWS variant waits until a certificate is validated.
-        - There's no way to automate validation without workaround.
-      - Solution:
-        - Deploy a lambda that deploys the certificate (so we don't wait until certificate is validated)
-        - Get DNS records to be used in validation & export it to be used later.
-  - `web-stack.yaml`: It'll deploy S3 bucket and CloudFront in front of it.
-  - `dns-stack.yaml`: It'll deploy Route53 hosted zone
-    - Each time Route53 hosted zone is re-created it's required to update the DNS records in the domain registrar. See *Configure your domain registrar*.
-- I use cross stacks instead of single stack or nested stacks because:
-  - Easier to test & maintain & smaller files and different lifecycles for different areas.
-  - It allows to deploy web bucket in different region than others as other stacks are global (`us-east-1`) resources.
-
-##### Initial deployment
-
-- ❗ Prerequisite: A registered domain name for website.
-
-1. **Configure build agent (GitHub actions)**
-   - Deploy manually `iam-stack.yaml` with stack name `privacysexy-iam-stack` (to follow the convention)
-     - It'll give you deploy user. Go to console &  generate secret id + key (Security credentials => Create access key) for the user [IAM users](https://console.aws.amazon.com/iam/home#/users).
-       - 🚶 Deploy secrets:
-         - Add secret id & key in GitHub Secrets.
-           - `AWS_DEPLOYMENT_USER_ACCESS_KEY_ID`, `AWS_DEPLOYMENT_USER_SECRET_ACCESS_KEY`
-         - Add more secrets given from Outputs section of the CloudFormation stack.
-     - Run GitHub actions to deploy rest of the application.
-       - It'll run `certificate-stack.yaml` and then `iam-stack.yaml`.
-
-2. **Configure your domain registrar**
-   - ❗ **Web stack will fail** after DNS stack because you need to validate your domain.
-   - 🚶 Go to your domain registrar and change name servers to NS values
-     - `dns-stack.yaml` outputs those in CloudFormation stack.
-     - You can alternatively find those in [Route53](https://console.aws.amazon.com/route53/home#hosted-zones)
-   - When nameservers of your domain updated, the certification will get validated automatically, you can then delete the failed stack in CloudFormation & re-run the GitHub actions.
-
-## Thank you for the awesome projects 🍺
-
-- [Vue.js](https://vuejs.org/) the only big JavaScript framework that's not backed by companies that make money off your data.
-- [liquor-tree](https://GitHub.com/amsik/liquor-tree) for the awesome & super extensible tree component.
-- [Ace](https://ace.c9.io/) for code box.
-- [FileSaver.js](https://GitHub.com/eligrey/FileSaver.js) for save file dialog.
-- [chai](https://GitHub.com/chaijs/chai) & [mocha](https://GitHub.com/mochajs/mocha) for making testing fun.
-- [js-yaml-loader](https://GitHub.com/wwilsman/js-yaml-loader) for ahead of time loading `application.yml`
-- [v-tooltip](https://GitHub.com/Akryum/v-tooltip) takes seconds to have a tooltip, exactly what I needed.
+[docs/](./docs/) folder includes all other documentation.

aws.drawio

@@ -1 +0,0 @@
-<mxfile host="www.draw.io" modified="2019-12-27T14:40:11.720Z" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36" etag="6t_Q0ZRAKXZ_lLm1WdcF" version="12.4.3" type="device" pages="1"><diagram id="pFg2tUHn5hOZkmQyf_J4" name="Page-1">7Vvtd6I4F/9r+lEOEMLLR23rzJzdme3qPLMvXzwUomaLxA2x1f3rnwSIEoIWFdqd3bXnKLmEJNz7u69Jb8DtavuBhuvlZxKj5MY24+0NuLux7SAA/FsQdgXBD8yCsKA4LkjWgTDFf6GSKLttcIwypSMjJGF4rRIjkqYoYgotpJS8qN3mJFFnXYcLpBGmUZjo1F9wzJblW0DzQP+I8GIpZ7bM8s4qlJ1LQrYMY/JSIYH7G3BLCWHF1Wp7ixLBO8mX4rnxkbv7hVGUsjYPfB19Hf0+Wf6+DcbR9Mtksvm2hANYjPIcJpvyhe/IKsQpp03QAmeMhrRcPttJnqwJThmi9898ZsFe6waM9m9n8kYcZksUl40lWyWyE6PkCd2ShFBOSUnKBxzNcZJI0o0NoCn+OD0JH1HyQDLMMEn5vQiJSfmNZ0QZ5hL6sdbhkTBGVpUOwwQvxA1G1pxKNizBKZ9dAkVMEpZd9oPz91iL11xtFwLPBpnPcYSMDNFn/psZVHJlVpL4M7okSuGIhaBthVRK5gMiK8Tojncp79qeXzxSqgmQ+H85gA66BWlZwRu0S6iXMF/sRz4ggV+UYDgDGJatIUPDASWbNN7L+WWJGZquQ8GSuxfOPFX2e0xYNZmXMFCxwYEQe8GjaXbDXslNyd1A564r9bTKXuCYffEXvM5fiUW8yo1UlZvNEH9VM3KdGoXR0yKXXYXb8/zDu+STDbN1RUdkY463QoKjcj13S8aEFR4KTtjjKE5tA3M7PMccFdSI+Iz2OA5ZyH8EPeO/4Sr8i6SD8CUbZAylEU4ENTea4y/8xrRQqtmUT4m55s0ist7NZsNfprPbhGxijkvfWKeLDjAxMA1gBpWP76kgcW0dJIGOEUm7BiJ/bp/idPL8FMApjNFk+8N6+/NA18CcBWNK+DvXsdJo3ea8Z0XG/G8s5h9x0xZjpNwLHHg3tiv37jDlAxX4SQkVHNBM9RCYI9iku3s0KZ7gQsOt2eiKHog3LIMGy5btkiuN2K3bd45Ehxv1jGxohD5FYj0j3iyu1F6R4P485343RslXrZJrAg1w0i1UASdpnQNON0lTTjJHm+gJdY841xwC4J2HONvzLMv91yAuA90gDToq0mDgGa7zvmDTI0+JM/OBJDjadQu45mDzCJ7Kzn87KB0JvHV4rQsOdgIexwlU8EDdTEHfkAMr0WkH0VMjeFwNPBOODsRJcnH/uca3NFRUcH8GOzJXAKjmyrGC97VVnh6JCXHw+DTMQfc5THlErCfKjcjrW+4NYgRGdFjvbFWsdmbrsPVgcHvKfHZhTmquCDiNrggYsCHUBj0J2NcEfJ/OCYc9z07cRMR7j1y67kJcffz69WGqiRrFCyS1S5gEsiBpmNwfqCM1Wz70+ZEIkeai+wMxtit1NtwwogqW85zufq02fhODGVA277bl4EVrV209IIo5rwRY7k4m1YW6n+BVmZawkC4Qe11pBGNO4oKiJGT4Wa23NUm4fPRBOMFKFO2qlRPoBgb0LMf2i29PHbB4vXKMarWsNqzt2IbFAed5rmfbZmB558xSMEebJcfm/tUvh6ulB08TFOdeKXsPZBZOTtZH7avg5baEl/028OKiNZQigQoDD14GL+Aq8PIDeHrcngEli0//smpUil4GOxTSgYhyko1YnyALfzSukAZm0GHdybUMT5U2MC3dATZUI72+wmlbz/xVbq4pfg6jnZGhrZ6XfWcGRkK7amFO7Y30bWGAr+ZXPN9SXIt7oQfbF7nLce2gBp++bYqjgSqf63vyUKdw8aqHclvip5SXaXCnUD5zLaQsqxdI2Y5v+JWBaoUB4LYC2JDScFfptt6j4piC1HZvHLuG12LE2tNyeDKfZ6gfhOtpA0/1GE43ZMPfx4zROiG6vbw+Edhi9qsM7vl1JQ3grUMWIBoyCejUgrbVAHCuBlhWYCuyHgTXKcQbgECPxT9gttw8fv8BlPlqAEUiJi8tUxj88SqkT4NFzoAuYya3VhFym6sGPQVNz2vPu/92v8tcb/fTty+TzAzmA0uT+08UL/KjE8MoQpmwAJ9i/s6YvUkt+9azgDX+59WyKUkOpScNMg3AOn7IwndUhwVB220Qx+kJRXri9TG8JEK6JCaqHtnh6o0jxVdUoGXmH9FrQ5/3hzgajXtnNaXjOnfCf0DLUVMrv5N4qn46B/r2ZQEUcLiP24dh/FsZ1gXtykjnBlB8veryPbdNACXPSfhNHO3UsTbKWk8fhkkizvMJcYbxu6QRHUK+IYa6APID0zDBlTGS3CSGgeF7PAfJt0UDUxW7C4Im5J6rAC6oQd6EhgUq9bVeFMDR9NdvowD9Y1zfx3wz69+XKQc6ro/j/xSubUv11t2kxrC2twi9GuTaIhlaavbrgnbllXOxq53daGe8Zf4kz3H2j2V9k3TyXmb6WLLbV6xyXBF62I/oagcCng5FeisWNns53RL+L0M6eN6ldtIleNq6/cLcdQ4fLZEOLoQPdKChhtqOC7jN5jmV5zqO67mB86YIatjDeAU95xxYF42HkPGENc0pttn2GPujz1l1QNFVCSw0a9Jr2DgKGmogltnBGeVmruvVr32U/kI5f/tU4b3a/la506UKnwTapQ7gEOFAt7YRuPfWV2q5452y7bB+jKa1zgNvf8xvd5jJdDzXCuR3K6V/yxjb1l3Lp+FnTuAOhmro/K8w17owF8Zxfiaw2TZ2Yu4CDW+O/p87jfW6vqq+tqdBphrQlkKtVtM6s3DmSQunVPOOV/C6Co1bm8YTHa+Ibq6SoYxtNYvwgfumtSZfDmDWlF80Ofma6s/9CEVRk4bWFXmF4zhPfpqiEtVltghM3jHWsM/XPHHaZv9vsIXZP/wvMbj/Pw==</diagram></mxfile>

aws/certificate-stack.yaml

@@ -1,211 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Description: Creates certificate for the root + www subdomain. !! It must be deployed in us-east-1 to be able to be used by CloudFront.
-
-Parameters:
-  
-  RootDomainName:
-    Type: String
-    Default: privacy.sexy
-    Description: The root DNS name of the website e.g. privacy.sexy
-    AllowedPattern: (?!-)[a-zA-Z0-9-.]{1,63}(?<!-)
-    ConstraintDescription: Must be a valid root domain name
-  
-  IamStackName:
-    Type: String
-    Default: privacysexy-iam-stack
-    Description: Name of the IAM stack.
-  
-Resources:
-
-  # The lambda workaround exists to be able to automate certificate deployment.
-  # Problem:
-  #   Normally AWS AWS::CertificateManager::Certificate waits until a certificate is validated
-  #   And there's no way to get validation DNS records from it to validate it.
-  # Solution:
-  #   Deploy a lambda that deploys the certificate (so we don't wait until certificate is validated)
-  #   Get DNS records to be used in validation & export it to be used later.
-  
-  AcmCertificateForHostedZone:
-    Type: Custom::VerifiableCertificate #A Can use AWS::CloudFormation::CustomResource or Custom::String
-    Properties:
-      ServiceToken: !GetAtt ResolveCertificateLambda.Arn
-      # Lambda gets the following data:
-      RootDomainName: !Ref RootDomainName # Lambda will create both for root and www.root
-      Tags:
-        -
-          Key: Name
-          Value: !Ref RootDomainName
-        -
-          Key: Application
-          Value: privacy.sexy
-
-  ResolveCertificateLambda:
-    Type: AWS::Lambda::Function
-    Properties:
-      Description: Deploys certificate for root domain name + www and returns immediately arn + verification records.
-      Role:
-        Fn::ImportValue: !Join [':', [!Ref IamStackName, ResolveCertificateLambdaRoleArn]]
-      FunctionName: !Sub ${AWS::StackName}-cert-resolver-lambda # StackName- required for role to function
-      Handler: index.handler
-      Runtime: nodejs12.x
-      Timeout: 30
-      Tags: 
-        -
-          Key: Application
-          Value: privacy.sexy
-      Code:
-        # Inline script is not the best way. Some variables are named shortly to not exceed the limit 4096 but it's the cheapest way (no s3 file)
-        ZipFile: >
-          'use strict';
-          const aws = require('aws-sdk');
-          const acm = new aws.ACM();
-          const log = (t) => console.log(t);
-
-          exports.handler = async (event, context) => {
-            log(`Request recieved:\n${JSON.stringify(event)}`);
-            const userData = event.ResourceProperties;
-            const rootDomain = userData.RootDomainName;
-            let data = null;
-            try {
-              switch(event.RequestType) {
-                case 'Create':
-                  data = await handleCreateAsync(rootDomain, userData.Tags);
-                  break;
-                case 'Update':
-                  data = await handleUpdateAsync();
-                  break;
-                case 'Delete':
-                  data = await handleDeleteAsync(rootDomain);
-                  break;
-              }
-              await sendResponseAsync(event, context, 'SUCCESS', data);
-            } catch(error) {
-              await sendResponseAsync(event, context, 'ERROR', {
-                title: `Failed to ${event.RequestType}, see error`,
-                error: error
-              });
-            }
-          }
-
-          async function handleCreateAsync(rootDomain, tags) {
-            const { CertificateArn } = await acm.requestCertificate({
-              DomainName: rootDomain,
-              SubjectAlternativeNames: [`www.${rootDomain}`],
-              Tags: tags,
-              ValidationMethod: 'DNS',
-            }).promise();
-            log(`Cert requested:${CertificateArn}`);
-            const waitAsync = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-            const maxAttempts = 10;
-            let options = undefined;
-            for (let attempt = 0; attempt < maxAttempts && !options; attempt++) {
-              await waitAsync(2000);
-              const { Certificate } = await acm.describeCertificate({ CertificateArn }).promise();
-              if(Certificate.DomainValidationOptions.filter((o) => o.ResourceRecord).length === 2) {
-                options = Certificate.DomainValidationOptions;
-              }
-            }
-            if(!options) {
-              throw new Error(`No records after ${maxAttempts} attempts.`);
-            }
-            return getResponseData(options, CertificateArn, rootDomain);
-          }
-
-          async function handleDeleteAsync(rootDomain) {
-            const certs = await acm.listCertificates({}).promise();
-            const cert = certs.CertificateSummaryList.find((cert) => cert.DomainName === rootDomain);
-            if (cert) {
-              await acm.deleteCertificate({ CertificateArn: cert.CertificateArn }).promise();
-              log(`Deleted ${cert.CertificateArn}`);
-            } else {
-              log('Cannot find'); // Do not fail, delete can be called when e.g. CF fails before creating cert
-            }
-            return null;
-          }
-
-          async function handleUpdateAsync() {
-            throw new Error(`Not yet implemented update`);
-          }
-
-          function getResponseData(options, arn, rootDomain) {
-            const findRecord = (url) => options.find(option => option.DomainName === url).ResourceRecord;
-            const root = findRecord(rootDomain);
-            const www = findRecord(`www.${rootDomain}`);
-            const data = {
-                CertificateArn: arn,
-                RootVerificationRecordName: root.Name,
-                RootVerificationRecordValue: root.Value,
-                WwwVerificationRecordName: www.Name,
-                WwwVerificationRecordValue: www.Value,
-            };
-            return data;
-          }
-
-          /* cfn-response can't async / await :( */
-          async function sendResponseAsync(event, context, responseStatus, responseData, physicalResourceId) {
-            return new Promise((s, f) => {
-              var b = JSON.stringify({
-                        Status: responseStatus,
-                        Reason: `See the details in CloudWatch Log Stream: ${context.logStreamName}`,
-                        PhysicalResourceId: physicalResourceId || context.logStreamName,
-                        StackId: event.StackId,
-                        RequestId: event.RequestId,
-                        LogicalResourceId: event.LogicalResourceId,
-                        Data: responseData
-              });
-              log(`Response body:\n${b}`);
-              var u = require("url").parse(event.ResponseURL);
-              var r = require("https").request(
-                {
-                  hostname: u.hostname,
-                  port: 443,
-                  path: u.path,
-                  method: "PUT",
-                  headers: {
-                    "content-type": "",
-                    "content-length": b.length
-                  }
-                }, (p) => {
-                  log(`Status code: ${p.statusCode}`);
-                  log(`Status message: ${p.statusMessage}`);
-                  s(context.done());
-                });
-              r.on("error", (e) => {
-                log(`request failed: ${e}`);
-                f(context.done(e));
-              });
-              r.write(b);
-              r.end();
-            });
-          }
-
-Outputs:
-  CertificateArn:
-    Description: The Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate.
-    Value: !GetAtt AcmCertificateForHostedZone.CertificateArn
-    Export:
-      Name: !Join [':', [ !Ref 'AWS::StackName', CertificateArn ]]
-
-  RootVerificationRecordName:
-    Description: Name for root domain CNAME verification record
-    Value: !GetAtt AcmCertificateForHostedZone.RootVerificationRecordName
-    Export:
-      Name: !Join [':', [ !Ref 'AWS::StackName', RootVerificationRecordName ]]
-
-  RootVerificationRecordValue:
-    Description: Value for root domain name CNAME verification record
-    Value: !GetAtt AcmCertificateForHostedZone.RootVerificationRecordValue
-    Export:
-      Name: !Join [':', [ !Ref 'AWS::StackName', RootVerificationRecordValue ]]
-
-  WwwVerificationRecordName:
-    Description: Name for www domain name CNAME verification record
-    Value: !GetAtt AcmCertificateForHostedZone.WwwVerificationRecordName
-    Export:
-      Name: !Join [':', [ !Ref 'AWS::StackName', WwwVerificationRecordName ]]
-
-  WwwVerificationRecordValue:
-    Description: Value for www domain name CNAME verification record
-    Value: !GetAtt AcmCertificateForHostedZone.WwwVerificationRecordValue
-    Export:
-      Name: !Join [':', [ !Ref 'AWS::StackName', WwwVerificationRecordValue ]]

aws/dns-stack.yaml

@@ -1,61 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Description: Creates hosted zone & sets up records for the CloudFront URL.
-
-Parameters:
-
-  RootDomainName:
-    Type: String
-    Default: privacy.sexy
-    Description: The root DNS name of the website e.g. privacy.sexy
-    AllowedPattern: (?!-)[a-zA-Z0-9-.]{1,63}(?<!-)
-    ConstraintDescription: Must be a valid root domain name
-  
-  CertificateStackName:
-    Type: String
-    Default: privacysexy-certificate-stack
-    Description: Name of the certificate stack.
-
-Resources:
-
-  DNSHostedZone:
-    Type: AWS::Route53::HostedZone
-    Properties:
-      Name: !Ref RootDomainName
-      HostedZoneConfig:
-        Comment: !Join ['', ['Hosted zone for ', !Ref RootDomainName]]
-      HostedZoneTags:
-        -
-          Key: Application
-          Value: privacy.sexy
-
-  CertificateValidationDNSRecords:
-    Type: AWS::Route53::RecordSetGroup
-    Properties: 
-      HostedZoneId: !Ref DNSHostedZone
-      RecordSets:
-        -
-          Name: 
-            Fn::ImportValue: !Join [':', [!Ref CertificateStackName, RootVerificationRecordName]]
-          Type: 'CNAME'
-          TTL: '60'
-          ResourceRecords:
-            - Fn::ImportValue: !Join [':', [!Ref CertificateStackName, RootVerificationRecordValue]]
-        -
-          Name: 
-            Fn::ImportValue: !Join [':', [!Ref CertificateStackName, WwwVerificationRecordName]]
-          Type: 'CNAME'
-          TTL: '60'
-          ResourceRecords:
-            - Fn::ImportValue: !Join [':', [!Ref CertificateStackName, WwwVerificationRecordValue]]
-
-Outputs:
-  
-  DNSHostedZoneNameServers:
-    Description: Name servers to update in domain registrar.
-    Value: !Join ['           ', !GetAtt DNSHostedZone.NameServers]
- 
-  DNSHostedZoneId:
-    Description: The ID of the hosted zone that you want to create the record in.
-    Value: !Ref DNSHostedZone
-    Export:
-      Name: !Join [':', [ !Ref 'AWS::StackName', DNSHostedZoneId ]]

aws/iam-stack.yaml

@@ -1,496 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Description: |-
-  > Deploys the identity management for the deployment
-
-# Granulatiy cheatsheet: https://iam.cloudonaut.io/
-
-Parameters:
-    WebStackName:
-      Type: String
-      Default: privacysexy-web-stack
-      Description: Name of the web stack.
-    DnsStackName:
-      Type: String
-      Default: privacysexy-dns-stack
-      Description: Name of the DNS stack.
-    CertificateStackName:
-      Type: String
-      Default: privacysexy-certificate-stack
-      Description: Name of the IAM stack.
-
-Resources:
-
-  # -----------------------------
-  # ------ User & Group ---------
-  # -----------------------------
-  DeploymentGroup:
-    Type: AWS::IAM::Group
-    Properties: 
-      # GroupName: No hardcoded naming because of easier CloudFormation management
-      ManagedPolicyArns:
-        - !Ref AllowValidateTemplatePolicy
-  
-  DeploymentUser:
-    Type: AWS::IAM::User
-    Properties:
-    #   # UserName: No hardcoded naming because of easier CloudFormation management
-    #   # Policies: Assing policies on group level
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy
-
-  AddDeploymentUserToDeploymentGroup:
-    Type: AWS::IAM::UserToGroupAddition
-    Properties:
-      GroupName: !Ref DeploymentGroup
-      Users:
-        - !Ref DeploymentUser
-
-  # -----------------------------
-  # ----------- Roles -----------
-  # -----------------------------
-  IamStackDeployRole:
-    Type: AWS::IAM::Role
-    Properties:
-      Description: Allows to deploy IAM stack
-      AssumeRolePolicyDocument:
-        Statement:
-          -
-            Effect: Allow
-            Principal:
-              AWS: !GetAtt DeploymentUser.Arn
-            Action: sts:AssumeRole
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy
-      ManagedPolicyArns: 
-        - !Ref CloudFormationDeployPolicy
-        - !Ref PolicyDeployPolicy
-        - !Ref IamStackDeployPolicy
-
-  CertificateStackDeployRole:
-    Type: AWS::IAM::Role
-    Properties:
-      Description: Allows to deploy certificate stack
-      AssumeRolePolicyDocument:
-        Statement:
-          -
-            Effect: Allow
-            Principal:
-              AWS: !GetAtt DeploymentUser.Arn
-            Action: sts:AssumeRole
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy
-      ManagedPolicyArns: 
-        - !Ref CloudFormationDeployPolicy
-        - !Ref LambdaBackedCustomResourceDeployPolicy
-
-  DnsStackDeployRole:
-    Type: AWS::IAM::Role
-    Properties:
-      Description: Allows to deploy DNS stack
-      AssumeRolePolicyDocument:
-        Statement:
-          -
-            Effect: Allow
-            Principal:
-              AWS: !GetAtt DeploymentUser.Arn
-            Action: sts:AssumeRole
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy
-      ManagedPolicyArns: 
-        - !Ref CloudFormationDeployPolicy
-        - !Ref DnsStackDeployPolicy
-
-  WebStackDeployRole:
-    Type: AWS::IAM::Role
-    Properties:
-      Description: Allows to deploy web stack
-      AssumeRolePolicyDocument:
-        Statement:
-          -
-            Effect: Allow
-            Principal:
-              AWS: !GetAtt DeploymentUser.Arn
-            Action: sts:AssumeRole
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy
-      ManagedPolicyArns: 
-        - !Ref CloudFormationDeployPolicy
-        - !Ref WebStackDeployPolicy
-
-  S3SiteDeployRole:
-      Type: 'AWS::IAM::Role'
-      Properties:
-        Description: "Allows to deploy website to S3"
-        AssumeRolePolicyDocument:
-          Statement:
-            -
-              Effect: Allow
-              Principal:
-                AWS: !GetAtt DeploymentUser.Arn
-              Action: sts:AssumeRole
-        Tags:
-          -
-            Key: Application
-            Value: privacy.sexy
-        ManagedPolicyArns:
-          - !Ref S3SiteDeployPolicy
-          - !Ref StackExportReaderPolicy
-
-  CloudFrontSiteDeployRole:
-      Type: 'AWS::IAM::Role'
-      Properties:
-        Description: "Allows to informs to CloudFront to renew its cache from S3"
-        AssumeRolePolicyDocument:
-          Statement:
-            -
-              Effect: Allow
-              Principal:
-                AWS: !GetAtt DeploymentUser.Arn
-              Action: sts:AssumeRole
-        Tags:
-          -
-            Key: Application
-            Value: privacy.sexy
-        ManagedPolicyArns:
-          - !Ref CloudFrontInvalidationPolicy
-          - !Ref StackExportReaderPolicy
-
-  ResolveCertificateLambdaRole: # See certificate stack
-    Type: AWS::IAM::Role
-    Properties:
-      Description: Allow deployment of certificates
-      AssumeRolePolicyDocument:
-        Statement:
-          -
-            Effect: Allow
-            Principal:
-              Service: lambda.amazonaws.com
-            Action: sts:AssumeRole
-      ManagedPolicyArns:
-        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-        - !Ref CertificateDeployPolicy
-
-  # --------------------------------
-  # ----------- Policies -----------
-  # --------------------------------
-
-  AllowValidateTemplatePolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: "No read & writes to resources, reveals just basic CloudFormation API to be used for validating templates"
-      # ManagedPolicyName: No hardcoded naming because of easier CloudFormation management
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowCloudFormationTemplateValidation
-            Effect: Allow
-            Action:
-              - cloudformation:ValidateTemplate
-            Resource: '*'
-
-  CloudFormationDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: "Allows deploying CloudFormation using CLI command 'aws cloudformation deploy' (with change sets)"
-      # ManagedPolicyName: No hardcoded naming because of easier CloudFormation management
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowCloudFormationStackOperations
-            Effect: Allow
-            Action:
-              - cloudformation:GetTemplateSummary
-              - cloudformation:DescribeStacks
-              - cloudformation:CreateChangeSet
-              - cloudformation:ExecuteChangeSet
-              - cloudformation:DescribeChangeSet
-            Resource:
-              - !Sub arn:aws:cloudformation:*:${AWS::AccountId}:stack/${WebStackName}/*
-              - !Sub arn:aws:cloudformation:*:${AWS::AccountId}:stack/${DnsStackName}/*
-              - !Sub arn:aws:cloudformation:*:${AWS::AccountId}:stack/${AWS::StackName}/*
-              - !Sub arn:aws:cloudformation:*:${AWS::AccountId}:stack/${CertificateStackName}/*
-
-  IamStackDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows deploying IAM CloudFormation stack.
-      # ManagedPolicyName: No hardcoded naming because of easier CloudFormation management
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowUserArnExport
-            Effect: Allow
-            Action:
-              - iam:GetUser
-            Resource:
-              - !GetAtt DeploymentUser.Arn
-          -
-            Sid: AllowTagging
-            Effect: Allow
-            Action:
-              - iam:TagResource
-            Resource:
-              - !Sub arn:aws:cloudformation::${AWS::AccountId}:stack/${AWS::StackName}/*
-              - !GetAtt DeploymentUser.Arn
-          -
-            Sid: AllowRoleDeployment
-            Effect: Allow
-            Action:
-              - iam:CreateRole
-            Resource:
-              - !Sub arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}-*
-
-  LambdaBackedCustomResourceDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows deploying a lambda-backed custom resource.
-      # ManagedPolicyName: # ManagedPolicyName: No hardcoded naming because of easier CloudFormation management
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowLambdaDeployment
-            Effect: Allow
-            Action:
-              - lambda:GetFunction
-              - lambda:DeleteFunction
-              - lambda:CreateFunction
-              - lambda:GetFunctionConfiguration
-              - lambda:InvokeFunction
-            Resource:
-              - !Sub arn:aws:lambda:*:${AWS::AccountId}:function:${CertificateStackName}*
-          -
-            Sid: AllowPassingLambdaRole
-            Effect: Allow
-            Action:
-              - iam:PassRole
-            Resource:
-              - !GetAtt ResolveCertificateLambdaRole.Arn
-
-  CertificateDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows deploying certifications stack.
-      # ManagedPolicyName: # ManagedPolicyName: No hardcoded naming because of easier CloudFormation management
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowCertificateDeployment
-            Effect: Allow
-            Action:
-              - acm:RequestCertificate
-              - acm:DescribeCertificate
-              - acm:DeleteCertificate
-              - acm:AddTagsToCertificate
-              - acm:ListCertificates
-            Resource: '*' # Certificate Manager does not support resource level IAM
-
-  PolicyDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows deployment of policies
-      # ManagedPolicyName: Commented out because CloudFormation requires to rename when replacing custom-named resource
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowPolicyUpdates
-            Effect: Allow
-            Action:
-              - iam:ListPolicyVersions
-              - iam:CreatePolicyVersion
-              - iam:DeletePolicyVersion
-              - iam:CreatePolicy 
-              - iam:DeletePolicy 
-              - iam:GetPolicy
-            Resource:
-              - !Sub arn:aws:iam::${AWS::AccountId}:policy/${AWS::StackName}-* # when ManagedPolicyName is not given policies get name like StackName-*
-          -
-            Sid: AllowPoliciesOnRoles
-            Effect: Allow
-            Action:
-              - iam:AttachRolePolicy
-              - iam:DetachRolePolicy
-              - iam:GetRole
-            Resource:
-              - !Sub arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}-*
-          - 
-            Sid: AllowPolicyAssigmentToGroup
-            Effect: Allow
-            Action:
-              - iam:AttachGroupPolicy
-              - iam:DetachGroupPolicy
-            Resource:
-              - !GetAtt DeploymentGroup.Arn
-          - 
-            Sid: AllowGettingGroupInformation
-            Effect: Allow
-            Action:
-              - iam:GetGroup
-            Resource: !Sub arn:aws:iam::${AWS::AccountId}:group/${DeploymentGroup}
-
-  DnsStackDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows deployment of DNS stack
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowHostedZoneDeployment
-            Effect: Allow
-            Action:
-              - route53:CreateHostedZone
-              - route53:ListQueryLoggingConfigs
-              - route53:DeleteHostedZone
-              - route53:GetChange
-              - route53:ChangeTagsForResource
-              - route53:GetHostedZone
-              - route53:ChangeResourceRecordSets
-            Resource: '*' # Does not support resource-level permissions https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-manage-access-intro-resource-policies
-          
-  WebStackDeployPolicy:
-    # We need a role to run s3:PutBucketPolicy, IAM users cannot run it. See https://stackoverflow.com/a/48551383 
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows deployment of web stack
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowCloudFrontOAIDeployment
-            Effect: Allow
-            Action:
-              - cloudfront:GetCloudFrontOriginAccessIdentity
-              - cloudfront:CreateCloudFrontOriginAccessIdentity
-              - cloudfront:GetCloudFrontOriginAccessIdentityConfig
-              - cloudfront:DeleteCloudFrontOriginAccessIdentity
-            Resource: '*' # Does not support resource-level permissions https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html
-          -
-            Sid: AllowCloudFrontDistributionDeployment
-            Effect: Allow
-            Action:
-              - cloudfront:CreateDistribution
-              - cloudfront:DeleteDistribution
-              - cloudfront:UpdateDistribution
-              - cloudfront:GetDistribution
-              - cloudfront:TagResource
-              - cloudfront:UpdateCloudFrontOriginAccessIdentity
-            Resource: !Sub arn:aws:cloudfront::${AWS::AccountId}:*
-          -
-            Sid: AllowS3BucketPolicyAccess
-            Effect: Allow
-            Action:
-              - s3:CreateBucket
-              - s3:DeleteBucket
-              - s3:PutBucketWebsite
-              - s3:DeleteBucketPolicy
-              - s3:PutBucketPolicy
-              - s3:GetBucketPolicy
-            Resource: !Sub arn:aws:s3:::${WebStackName}*
-          -
-            Sid: AllowRecordDeploymentToRoute53
-            Effect: Allow
-            Action:
-              - route53:GetHostedZone
-              - route53:ChangeResourceRecordSets
-              - route53:GetChange
-              - route53:ListResourceRecordSets
-            Resource: '*' # Does not support resource-level permissions https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-manage-access-intro-resource-policies
-
-  S3SiteDeployPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows listing buckets to be able to list objects in a bucket
-      # ManagedPolicyName: Commented out because CloudFormation requires to rename when replacing custom-named resources
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowListingObjects
-            Effect: Allow
-            Action:
-              - s3:ListBucket # To allow ListObjectsV2
-            Resource: !Sub arn:aws:s3:::${WebStackName}*
-          -
-            Sid: AllowUpdatingObjects
-            Effect: Allow
-            Action:
-              - s3:PutObject
-              - s3:DeleteObject
-            Resource: !Sub arn:aws:s3:::${WebStackName}*/*
-
-  CloudFrontInvalidationPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows creating invalidations on CloudFront
-      # ManagedPolicyName: Commented out because CloudFormation requires to rename when replacing custom-named resource
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowCloudFrontInvalidations
-            Effect: Allow
-            Action:
-              - cloudfront:CreateInvalidation
-            Resource: "*" # Does not support resource-level permissions https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html
-
-  StackExportReaderPolicy:
-    Type: AWS::IAM::ManagedPolicy
-    Properties:
-      Description: Allows creating invalidations on CloudFront
-      # ManagedPolicyName: Commented out because CloudFormation requires to rename when replacing custom-named resource
-      PolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          -
-            Sid: AllowGettingBucketName
-            Effect: Allow
-            Action:
-              - cloudformation:DescribeStacks
-            Resource: !Sub arn:aws:cloudformation:*:${AWS::AccountId}:stack/${WebStackName}/*
-    
-Outputs:
-  ResolveCertificateLambdaRoleArn: 
-    Description: The Amazon Resource Name (ARN) of the lambda for deploying certificates.
-    Value: !GetAtt ResolveCertificateLambdaRole.Arn
-    Export:
-      Name: !Join [ ':', [ !Ref 'AWS::StackName', ResolveCertificateLambdaRoleArn ] ]
-
-  CertificateStackDeployRoleArn: 
-    Description: "GitHub secret: AWS_CERTIFICATE_STACK_DEPLOYMENT_ROLE_ARN"
-    Value: !GetAtt CertificateStackDeployRole.Arn
-
-  DnsStackDeployRoleArn: 
-    Description: "GitHub secret: AWS_DNS_STACK_DEPLOYMENT_ROLE_ARN"
-    Value: !GetAtt DnsStackDeployRole.Arn
-
-  IamStackDeployRoleArn: 
-    Description: "GitHub secret: AWS_IAM_STACK_DEPLOYMENT_ROLE_ARN"
-    Value: !GetAtt IamStackDeployRole.Arn
-
-  WebStackDeployRoleArn: 
-    Description: "GitHub secret: AWS_WEB_STACK_DEPLOYMENT_ROLE_ARN"
-    Value: !GetAtt WebStackDeployRole.Arn
-
-  S3SiteDeployRoleArn: 
-    Description: "GitHub secret: AWS_S3_SITE_DEPLOYMENT_ROLE_ARN"
-    Value: !GetAtt S3SiteDeployRole.Arn
-
-  CloudFrontSiteDeployRoleArn: 
-    Description: "GitHub secret: AWS_CLOUDFRONT_SITE_DEPLOYMENT_ROLE_ARN"
-    Value: !GetAtt CloudFrontSiteDeployRole.Arn

aws/scripts/configure/create-role-profile.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-
-# Parse parameters
-while [[ "$#" -gt 0 ]]; do case $1 in
-  --user-profile) USER_PROFILE="$2"; shift;;
-  --role-profile) ROLE_PROFILE="$2"; shift;;
-  --role-arn) ROLE_ARN="$2"; shift;;
-  --session) SESSION="$2";shift;;
-  --region) REGION="$2";shift;;
-  *) echo "Unknown parameter passed: $1"; exit 1;;
-esac; shift; done
-
-# Verify parameters
-if [ -z "$USER_PROFILE" ]; then echo "User profile name is not set."; exit 1; fi;
-if [ -z "$ROLE_PROFILE" ]; then echo "Role profile name is not set."; exit 1; fi;
-if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set"; exit 1; fi;
-if [ -z "$SESSION" ]; then echo "Session name is not set."; exit 1; fi;
-if [ -z "$REGION" ]; then echo "Region is not set."; exit 1; fi;
-
-creds=$(aws sts assume-role --role-arn $ROLE_ARN --role-session-name $SESSION --profile $USER_PROFILE)
-
-aws_access_key_id=$(echo $creds | jq -r '.Credentials.AccessKeyId')
-echo ::add-mask::$aws_access_key_id
-aws_secret_access_key=$(echo $creds | jq -r '.Credentials.SecretAccessKey')
-echo ::add-mask::$aws_secret_access_key
-aws_session_token=$(echo $creds | jq -r '.Credentials.SessionToken')
-echo ::add-mask::$aws_session_token
-
-aws configure --profile $ROLE_PROFILE set aws_access_key_id $aws_access_key_id
-aws configure --profile $ROLE_PROFILE set aws_secret_access_key $aws_secret_access_key
-aws configure --profile $ROLE_PROFILE set aws_session_token $aws_session_token
-aws configure --profile $ROLE_PROFILE set region $REGION
-
-echo Profile $ROLE_PROFILE is created
-
-bash "${BASH_SOURCE%/*}/mask-identity.sh" --profile $ROLE_PROFILE

aws/scripts/configure/create-user-profile.sh

@@ -1,25 +0,0 @@
-#!/bin/bash
-
-# Parse parameters
-while [[ "$#" -gt 0 ]]; do case $1 in
-  --profile) PROFILE="$2"; shift;;
-  --access-key-id) ACCESS_KEY_ID="$2"; shift;;
-  --secret-access-key) SECRET_ACCESS_KEY="$2"; shift;;
-  --region) REGION="$2";shift;;
-  *) echo "Unknown parameter passed: $1"; exit 1;;
-esac; shift; done
-
-# Verify parameters
-if [ -z "$PROFILE" ]; then echo "Profile name is not set."; exit 1; fi;
-echo $PROFILE
-if [ -z "$ACCESS_KEY_ID" ]; then echo "Access key ID is not set"; exit 1; fi;
-if [ -z "$SECRET_ACCESS_KEY" ]; then echo "Secret access key is not set."; exit 1; fi;
-if [ -z "$REGION" ]; then echo "Region is not set."; exit 1; fi;
-
-aws configure --profile $PROFILE set aws_access_key_id $ACCESS_KEY_ID
-aws configure --profile $PROFILE set aws_secret_access_key $SECRET_ACCESS_KEY
-aws configure --profile $PROFILE set region $REGION
-
-echo Profile $PROFILE is created
-
-bash "${BASH_SOURCE%/*}/mask-identity.sh" --profile $PROFILE

aws/scripts/configure/mask-identity.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-
-# Parse parameters
-while [[ "$#" -gt 0 ]]; do case $1 in
-  --profile) PROFILE="$2";shift;;
-  *) echo "Unknown parameter passed: $1"; exit 1;;
-esac; shift; done
-
-# Verify parameters
-if [ -z "$PROFILE" ]; then echo "Profile name is not set."; exit 1; fi;
-
-aws_identity=$(aws sts get-caller-identity --profile $PROFILE)
-echo ::add-mask::$(echo $aws_identity | jq -r '.Account')
-echo ::add-mask::$(echo $aws_identity | jq -r '.UserId')
-echo ::add-mask::$(echo $aws_identity | jq -r '.Arn')
-
-echo Credentials are masked

aws/scripts/deploy/deploy-stack.sh

@@ -1,43 +0,0 @@
-#!/bin/bash
-
-# Parse parameters
-while [[ "$#" -gt 0 ]]; do case $1 in
-  --template-file) TEMPLATE_FILE="$2"; shift;;
-  --stack-name) STACK_NAME="$2"; shift;;
-  --profile) PROFILE="$2"; shift;;
-  --capabilities) CAPABILITY_IAM="$2"; shift;;
-  --role-arn) ROLE_ARN="$2";shift;;
-  --session) SESSION="$2";shift;;
-  --region) REGION="$2";shift;;
-  *) echo "Unknown parameter passed: $1"; exit 1;;
-esac; shift; done
-
-# Verify parameters
-if [ -z "$TEMPLATE_FILE" ]; then echo "Template file is not set."; exit 1; fi;
-if [ -z "$STACK_NAME" ]; then echo "Template file is not set."; exit 1; fi;
-if [ -z "$PROFILE" ]; then echo "Profile is not set."; exit 1; fi;
-if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set."; exit 1; fi;
-if [ -z "$SESSION" ]; then echo "Role session is not set."; exit 1; fi;
-
-
-echo Validating stack "$STACK_NAME"
-aws cloudformation validate-template \
-    --template-body file://$TEMPLATE_FILE \
-    --profile $PROFILE
-
-ROLE_PROFILE=$STACK_NAME
-
-echo Assuming role
-bash "${BASH_SOURCE%/*}/../configure/create-role-profile.sh" \
-    --role-profile $ROLE_PROFILE --user-profile $PROFILE \
-    --role-arn $ROLE_ARN \
-    --session $SESSION \
-    --region $REGION
-
-echo Deploying stack "$TEMPLATE_FILE"
-aws cloudformation deploy \
-    --template-file $TEMPLATE_FILE \
-    --stack-name $STACK_NAME \
-    ${CAPABILITY_IAM:+ --capabilities $CAPABILITY_IAM} \
-    --no-fail-on-empty-changeset \
-    --profile $ROLE_PROFILE

aws/scripts/deploy/deploy-to-s3.sh

@@ -1,47 +0,0 @@
-#!/bin/bash
-
-# Parse parameters
-while [[ "$#" -gt 0 ]]; do case $1 in
-  --folder) FOLDER="$2"; shift;;
-  --web-stack-name) WEB_STACK_NAME="$2"; shift;;
-  --web-stack-s3-name-output-name) WEB_STACK_S3_NAME_OUTPUT_NAME="$2"; shift;;
-  --storage-class) STORAGE_CLASS="$2"; shift;;
-  --profile) PROFILE="$2"; shift;;
-  --role-arn) ROLE_ARN="$2";shift;;
-  --session) SESSION="$2";shift;;
-  --region) REGION="$2";shift;;
-  *) echo "Unknown parameter passed: $1"; exit 1;;
-esac; shift; done
-
-# Verify parameters
-if [ -z "$FOLDER" ]; then echo "Folder is not set."; exit 1; fi;
-if [ -z "$PROFILE" ]; then echo "Profile is not set."; exit 1; fi;
-if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set."; exit 1; fi;
-if [ -z "$SESSION" ]; then echo "Role session is not set."; exit 1; fi;
-if [ -z "$WEB_STACK_NAME" ]; then echo "Web stack name is not set."; exit 1; fi;
-if [ -z "$WEB_STACK_S3_NAME_OUTPUT_NAME" ]; then echo "S3 name output name is not set."; exit 1; fi;
-if [ -z "$STORAGE_CLASS" ]; then echo "S3 object storage class is not set."; exit 1; fi;
-
-echo Assuming role
-ROLE_PROFILE=deploy-s3
-bash "${BASH_SOURCE%/*}/../configure/create-role-profile.sh" \
-    --role-profile $ROLE_PROFILE --user-profile $PROFILE \
-    --role-arn $ROLE_ARN \
-    --session $SESSION \
-    --region $REGION
-
-echo Getting S3 bucket name from stack "$WEB_STACK_NAME" with output "$WEB_STACK_S3_NAME_OUTPUT_NAME"
-S3_BUCKET_NAME=$(aws cloudformation describe-stacks \
-            --stack-name $WEB_STACK_NAME \
-            --query "Stacks[0].Outputs[?OutputKey=='$WEB_STACK_S3_NAME_OUTPUT_NAME'].OutputValue" \
-            --output text \
-            --profile $ROLE_PROFILE)
-if [ -z "$S3_BUCKET_NAME" ]; then echo "Could not read S3 bucket name"; exit 1; fi;
-echo ::add-mask::$S3_BUCKET_NAME # Just being extra cautious
-
-echo Syncing folder to S3
-
-aws s3 sync $FOLDER s3://$S3_BUCKET_NAME \
-    --storage-class $STORAGE_CLASS  \
-    --no-progress --follow-symlinks --delete \
-    --profile $ROLE_PROFILE

aws/scripts/deploy/invalidate-cloudfront-cache.sh

@@ -1,45 +0,0 @@
-#!/bin/bash
-
-# Parse parameters
-while [[ "$#" -gt 0 ]]; do case $1 in
-  --paths) PATHS="$2"; shift;;
-  --web-stack-name) WEB_STACK_NAME="$2"; shift;;
-  --web-stack-cloudfront-arn-output-name) WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME="$2"; shift;;
-  --profile) PROFILE="$2"; shift;;
-  --role-arn) ROLE_ARN="$2";shift;;
-  --session) SESSION="$2";shift;;
-  --region) REGION="$2";shift;;
-  *) echo "Unknown parameter passed: $1"; exit 1;;
-esac; shift; done
-
-# Verify parameters
-if [ -z "$PATHS" ]; then echo "Paths is not set."; exit 1; fi;
-if [ -z "$PROFILE" ]; then echo "Profile is not set."; exit 1; fi;
-if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set."; exit 1; fi;
-if [ -z "$SESSION" ]; then echo "Role session is not set."; exit 1; fi;
-if [ -z "$WEB_STACK_NAME" ]; then echo "Web stack name is not set."; exit 1; fi;
-if [ -z "$WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME" ]; then echo "CloudFront ARN output name is not set."; exit 1; fi;
-
-
-echo Assuming role
-ROLE_PROFILE=invalidate-cloudfront
-bash "${BASH_SOURCE%/*}/../configure/create-role-profile.sh" \
-    --role-profile $ROLE_PROFILE --user-profile $PROFILE \
-    --role-arn $ROLE_ARN \
-    --session $SESSION \
-    --region $REGION
-
-echo Getting CloudFront ARN from stack "$WEB_STACK_NAME" with output "$WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME"
-CLOUDFRONT_ARN=$(aws cloudformation describe-stacks \
-            --stack-name $WEB_STACK_NAME \
-            --query "Stacks[0].Outputs[?OutputKey=='$WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME'].OutputValue" \
-            --output text \
-            --profile $ROLE_PROFILE)
-if [ -z "$CLOUDFRONT_ARN" ]; then echo "Could not read CloudFront ARN"; exit 1; fi;
-echo :add-mask::$CLOUDFRONT_ARN
-
-echo Syncing folder to S3
-aws cloudfront create-invalidation \
-    --paths $PATHS \
-    --distribution-id $CLOUDFRONT_ARN \
-    --profile $ROLE_PROFILE

aws/web-stack.yaml

@@ -1,138 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-
-Description: |-
-  > Creates an S3 bucket configured for hosting a static webpage.
-  > Creates CloudFront distribution that has access to read the S3 bucket.
-
-Parameters:
-
-  RootDomainName:
-    Type: String
-    Default: privacy.sexy
-    Description: The root DNS name of the website e.g. privacy.sexy
-    AllowedPattern: (?!-)[a-zA-Z0-9-.]{1,63}(?<!-)
-    ConstraintDescription: Must be a valid root domain name
-
-  CertificateStackName:
-    Type: String
-    Default: privacysexy-certificate-stack
-    Description: Name of the certificate stack.
-
-  DnsStackName:
-    Type: String
-    Default: privacysexy-dns-stack
-    Description: Name of the certificate stack.
-
-  PriceClass:
-    Type: String
-    Description: The CloudFront distribution price class
-    Default: 'PriceClass_100'
-    AllowedValues:
-      - 'PriceClass_100'
-      - 'PriceClass_200'
-      - 'PriceClass_All'
-
-Resources:
-
-  S3Bucket:
-    Type: AWS::S3::Bucket
-    Properties:
-      BucketName: !Sub ${AWS::StackName}-${RootDomainName} # Must have stack name for IAM to allow
-      WebsiteConfiguration:
-        IndexDocument: index.html
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy    
- 
-  S3BucketPolicy:
-    Type: AWS::S3::BucketPolicy
-    Properties:
-      Bucket: !Ref S3Bucket
-      PolicyDocument: # Only used for CloudFront as it's the only way, otherwise use IAM roles in IAM stack.
-        Statement:
-          -
-            Sid: AllowCloudFrontRead
-            Action: s3:GetObject
-            Effect: Allow
-            Principal:
-                CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
-            Resource: !Join ['', ['arn:aws:s3:::', !Ref S3Bucket, /*]]
-    
-  CloudFrontOriginAccessIdentity:
-    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
-    Properties:
-      CloudFrontOriginAccessIdentityConfig:
-        Comment: !Sub 'CloudFront OAI for ${S3Bucket}'
-    
-  CloudFrontDistribution:
-    Type: AWS::CloudFront::Distribution
-    Properties:
-      DistributionConfig:
-        Comment: Cloudfront Distribution pointing to S3 bucket
-        Origins:
-          -
-            DomainName: !GetAtt S3Bucket.DomainName
-            Id: S3Origin
-            S3OriginConfig:
-                OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
-        Enabled: true
-        HttpVersion: 'http2'
-        DefaultRootObject: index.html
-        Aliases:
-          - !Ref RootDomainName
-          - !Sub 'www.${RootDomainName}'
-        DefaultCacheBehavior:
-          AllowedMethods:
-            - GET
-            - HEAD
-          Compress: true
-          TargetOriginId: S3Origin
-          ForwardedValues:
-            QueryString: true
-            Cookies:
-              Forward: none
-          ViewerProtocolPolicy: redirect-to-https
-        PriceClass: !Ref PriceClass
-        ViewerCertificate:
-          AcmCertificateArn:
-            # Certificate must be validated before it can be used here
-            Fn::ImportValue: !Join [':', [!Ref CertificateStackName, CertificateArn]]
-          SslSupportMethod: sni-only
-          MinimumProtocolVersion: TLSv1.1_2016
-      Tags:
-        -
-          Key: Application
-          Value: privacy.sexy
-
-  CloudFrontDNSRecords:
-    Type: AWS::Route53::RecordSetGroup
-    Properties: 
-      HostedZoneId:
-        Fn::ImportValue: !Join [':', [!Ref DnsStackName, DNSHostedZoneId]]
-      RecordSets:
-        -
-          Name: !Ref RootDomainName
-          Type: A         
-          AliasTarget: 
-            DNSName: !GetAtt CloudFrontDistribution.DomainName
-            EvaluateTargetHealth: false
-            HostedZoneId: Z2FDTNDATAQYW2 # Static CloudFront distribution zone https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
-        -
-          Name: !Join ['', ['www.', !Ref RootDomainName]]
-          Type: A
-          AliasTarget: 
-            DNSName: !GetAtt CloudFrontDistribution.DomainName
-            EvaluateTargetHealth: false
-            HostedZoneId: Z2FDTNDATAQYW2 # Static CloudFront distribution zone https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
-Outputs:
-
-  CloudFrontDistributionArn:  # Used by deployment script to be able to deploy to right S3 bucket
-    Description: Tthe Amazon Resource Name (ARN) of the CloudFront distribution.
-    Value: !Ref CloudFrontDistribution
-
-  S3BucketName: # Used by deployment script to be able to deploy to right S3 bucket
-    Description: Name of the S3 bucket.
-    Value: !Ref S3Bucket
-
-

build/README.md

@@ -0,0 +1,5 @@
+# build
+
+This folder contains files that are used by Electron to serve the desktop version.
+
+Icons are created from the main logo file and should not be changed manually, see [related documentation](./../img/README.md).

cypress.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from 'cypress';
+import ViteConfig from './vite.config';
+
+const CYPRESS_BASE_DIR = 'tests/e2e/';
+
+export default defineConfig({
+  fixturesFolder: `${CYPRESS_BASE_DIR}/fixtures`,
+  screenshotsFolder: `${CYPRESS_BASE_DIR}/screenshots`,
+  videosFolder: `${CYPRESS_BASE_DIR}/videos`,
+  e2e: {
+    baseUrl: `http://localhost:${ViteConfig.server.port}/`,
+    specPattern: `${CYPRESS_BASE_DIR}/**/*.cy.{js,jsx,ts,tsx}`, // Default: cypress/e2e/**/*.cy.{js,jsx,ts,tsx}
+    supportFile: `${CYPRESS_BASE_DIR}/support/e2e.ts`,
+  },
+});

docs/app-ddd.drawio

@@ -1 +0,0 @@
-<mxfile host="www.draw.io" modified="2019-12-27T03:04:27.829Z" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36" etag="O-1eaon4mqUmgvki0auB" version="12.4.3" pages="1"><diagram id="rhL8jzEM8kVVyiS98U7u" name="Page-1">3Zpdk6I4FIZ/jZdakPDlpa3tzlTNbnVVV83OzE1XhACZAUKF2Or8+k0wCBhau1f8GrpayUkC5HlzTg7IAE7T9V8M5fHfNMDJABjBegBnAwA8YIpPadhsDS50t4aIkWBrMmvDM/mNldFQ1iUJcNFqyClNOMnbRp9mGfZ5y4YYo6t2s5Am7bPmKMKa4dlHiW79lwQ8VsOyjdr+CZMors5sGqomRVVjZShiFNBVwwQfB3DKKOXbvXQ9xYlkV3HZ9pu/Ubu7MIYz/p4OD0/efJxMXmZfs6kd/vj2Txp+HlrVxfFNNWIcCACqSBmPaUQzlDzW1gdGl1mA5WENUarbfKE0F0ZTGH9izjdKTbTkVJhiniaqFq8J/ya7j2xV+t6oma3VkcvCpipknG0anWTxe7Ou7laWqn4FZ/QXntKEsnJ8cFxuomY7cjncN4kqU0GXzMcHMFYzE7EI8wPtwE534S+YplhcqejHcII4eW1fB1IzN9q1q8UVO0rfj2gNrqL1TreWarWI96AbPFG3suuEMbRpNMgpyXjROPKTNIgGKnZC5Zsqctp77n24NTDtvQmzPX09fXbjOGFGwatGj0bsMEbAfmf4uONpaF0zfKjjvqJkqc70xHAhxirOTTNtIrRlXsWE4+cclRhWIlNoSxqSJGkwDmzsBVYXfQ8soOPIHjTj1TyrrgwzjteHxdDhqQ6O23Yf5U2res2H1coeN9Z7xzgTbehc07XMlmu907PMtmeBm3AtcCHX+n8RftwO2iZsBe2j7YHrnj/IQ+9eUsSbmlCnpgwnRQ+gxepJnifE7yNUtwKvFrpDW/51ieGUmzpCw77ddiKdFMXtdhTf3Yw1wzjoCOPu2cK4fS/Oc9P3V/AeEiSoOd2Mpoj0mxotzCAIO7mbhgvH+Ayp0XjPqca6UwGrw6nsczmVpYH+nIUMCSJLny8Z7hV46PnY97uALzzbso0zAHf3clGnA7h3ySjmaMDxK1aZzRugzY+DDrHTDTpwxwvD6GeF8PbYujpbtwMtOBdaV0PLcE4Lwqk6+F3jhR0L8EXxenqoeMw44ffIdj8uXB3uWIPLY4ZRQLLoD8B79dBg6ll8Kn9e6TfsLpDvBbALLoCWZQf9wBXJSRuuYelw7ZHZgRecC6+er4ldEhy7R7pVxMA2R+Obg2xrkAuO+KEU7R18e6C15+xm9ZTjiqjOk2X1MbOc47DMrqej52Olp02o+YDDSGhE/NsDZ+pLymXBVWPoBjfaiNFfG9rtMdMXCg1SEaNc7pK0fJ+giUTCEHyTSUKiTNi4fIizs35BC5w8yYRfTlw4W1DOaSoaJLLiAfm/olKAVjokN9GkPNmkyLfvPcg0CFWFkKylZA/qemYx5/KFiYkkAeZ+kFkj4tMsJEJaNvLFGcFcrHxIfEm7iDlz4UK0GKIsGC6Y+JQmW6Ykc+i4L1+X+GfxIpuINMUb5VXG1+t9r60Jb1/yMQPQ16771x1+WPchCugC79QHnvfyjIqiR91NcGPC6yvx/QtvHhV+ka3Ep5B1Lf7FnlgYpFk+3Sp6Uhq4+zkqBCNdbQh1tStb/2rrucT9q20cVTukLMLZsMBU/rI/d8Stwjwn5fPTYkhzTlLyu0wKenR0WN0O7MTXpbc6pLc+LL0o1m/WbX8JrV9PhI//AQ==</diagram></mxfile>

docs/application.md

@@ -0,0 +1,45 @@
+# Application
+
+Application layer is mainly responsible for:
+
+- creating an event-based and mutable [application state](#application-state),
+- [parsing and compiling](#parsing-and-compiling) the [application data](#application-data).
+
+📖 Refer to [architecture.md | Layered Application](./architecture.md#layered-application) to read more about the layered architecture.
+
+## Structure
+
+Application layer code exists in [`/src/application`](./../src/application/) and includes following structure:
+
+- [**`collections/`**](./../src/application/collections/): Holds [collection files](./collection-files.md).
+- [**`Common/`**](./../src/application/Common/): Contains common functionality in application layer.
+- `...`: rest of the application layer source code organized using folders-by-feature structure.
+
+## Application state
+
+It uses [state pattern](https://en.wikipedia.org/wiki/State_pattern) with context and state objects. [`ApplicationContext.ts`](./../src/application/Context/ApplicationContext.ts) the "Context" of state pattern provides an instance of [`CategoryCollectionState.ts`](./../src/application/Context/State/CategoryCollectionState.ts) (the "State" of the state pattern) for every supported collection.
+
+Presentation layer uses a singleton (same instance of) [`ApplicationContext.ts`](./../src/application/Context/ApplicationContext.ts) throughout the application to ensure consistent state.
+
+📖 Refer to [architecture.md | Application State](./architecture.md#application-state) to get an overview of event handling and [presentation.md | Application State](./presentation.md#application-state) for deeper look into how the presentation layer manages state.
+
+## Application data
+
+Application data is collection files using YAML. You can refer to [collection-files.md](./collection-files.md) to read more about the scheme and structure of application data files. You can also check the source code [collection yaml files](./../src/application/collections/) to directly see the application data using that scheme.
+
+Application layer [parses and compiles](#parsing-and-compiling) application data into [`Application`](./../src/domain/Application.ts)). Once parsed, application layer provides the necessary functionality to presentation layer based on the application data. You can read more about how presentation layer consumes the application data in [presentation.md | Application Data](./presentation.md#application-data).
+
+Application layer enables [data-driven programming](https://en.wikipedia.org/wiki/Data-driven_programming) by leveraging the data to the rest of the source code. It makes it easy for community to contribute on the project by using a declarative language used in collection files.
+
+### Parsing and compiling
+
+Application layer parses the application data to compile the domain object [`Application.ts`](./../src/domain/Application.ts).
+
+The build tool loads (or injects) application data ([collection yaml files](./../src/application/collections/)) into the application layer in compile time. Application layer ([`ApplicationFactory.ts`](./../src/application/ApplicationFactory.ts)) parses and compiles this data in runtime.
+
+Application layer compiles templating syntax during parsing to create the end scripts. You can read more about templating syntax in [templating.md](./templating.md) and how application data uses them through functions in [collection-files.md | Function](./collection-files.md#function).
+
+The steps to extend the templating syntax:
+
+1. Add a new parser under [SyntaxParsers](./../src/application/Parser/Script/Compiler/Expressions/SyntaxParsers) where you can look at other parsers to understand more.
+2. Register your in [CompositeExpressionParser](./../src/application/Parser/Script/Compiler/Expressions/Parser/CompositeExpressionParser.ts).

docs/architecture.md

@@ -0,0 +1,80 @@
+# Architecture overview
+
+This repository consists of:
+
+- A [layered application](#layered-application).
+- [AWS infrastructure](#aws-infrastructure) as code and instructions to host the website.
+- [GitOps](#gitops) practices for development, maintenance and deployment.
+
+## Layered application
+
+Application is
+
+- powered by **TypeScript**, **Vue.js** and **Electron** 💪,
+- and driven by **Domain-driven design**, **Event-driven architecture**, **Data-driven programming** concepts.
+
+Application uses highly decoupled models & services in different DDD layers:
+
+**Application layer** (see [application.md](./application.md)):
+
+- Coordinates application activities and consumes the domain layer.
+
+**Presentation layer** (see [presentation.md](./presentation.md)):
+
+- Handles UI/UX, consumes both the application and domain layers.
+- May communicate directly with the infrastructure layer for technical needs, but avoids domain logic.
+
+**Domain layer**:
+
+- Serves as the system's core and central truth.
+- Facilitates communication between the application and presentation layers through the domain model.
+
+**Infrastructure layer**:
+
+- Manages technical implementations without dependencies on other layers or domain knowledge.
+
+![DDD + vue.js](./../img/architecture/app-ddd.png)
+
+### Application state
+
+State handling uses an event-driven subscription model to signal state changes and special functions to register changes. It does not depend on third party packages.
+
+The presentation layer can read and modify state through the context. State changes trigger events that components can subscribe to for reactivity.
+
+Each layer treat application layer differently.
+
+![State](./../img/architecture/app-state.png)
+
+*[Presentation layer](./presentation.md)*:
+
+- Each component holds their own state about presentation-related data.
+- Components register shared state changes into application state using functions.
+- Components listen to shared state changes using event subscriptions.
+- 📖 Read more: [presentation.md | Application state](./presentation.md#application-state).
+
+*[Application layer](./application.md)*:
+
+- Stores the application-specific state.
+- The state it exposed for read with getter functions and set using setter functions, setter functions also fire application events that allows other parts of application and the view in presentation layer to react.
+- So state is mutable, and fires related events when mutated.
+- 📖 Read more: [application.md | Application state](./application.md#application-state).
+
+It's comparable with `flux`, `vuex`, and `pinia`. A difference is that mutable application layer state in privacy.sexy is mutable and lies in single "store" that holds app state and logic. The "actions" mutate the state directly which in turns act as dispatcher to notify its own event subscriptions (callbacks).
+
+## AWS infrastructure
+
+The web-site runs on serverless AWS infrastructure. Infrastructure is open-source and deployed as code. [aws-static-site-with-cd](https://github.com/undergroundwires/aws-static-site-with-cd) project includes the source code.
+
+[![AWS solution](../img/architecture/aws-solution.png)](https://github.com/undergroundwires/aws-static-site-with-cd)
+
+The design priorities highest security then minimizing cloud infrastructure costs.
+
+This project includes [GitHub Actions](../.github/workflows/) to automatically provision the infrastructure with zero-touch and without any "hidden" steps, ensuring everything is open-source and transparent. Git repositories includes all necessary instructions and automation with [GitOps](#gitops) practices.
+
+## GitOps
+
+CI/CD pipelines automate operational tasks based on different Git events. [bump-everywhere](https://github.com/undergroundwires/bump-everywhere) enables this automation.
+
+📖 Read more in [`ci-cd.md`](./ci-cd.md#gitops).
+
+[![CI/CD using GitHub Actions](../img/architecture/gitops.png)](../.github/workflows/)

docs/ci-cd.drawio

@@ -1 +0,0 @@
-<mxfile host="www.draw.io" modified="2019-12-30T13:07:22.931Z" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36" etag="vfXOAJJrIONaUEloGBPR" version="12.4.7" type="device"><diagram id="ymF_tBZ9P2_Wfw9L8arg" name="Page-1">5Vpbb9s2FP41AbYHC7zp9hjHdVqsGwpkQNu9FIxEy2xlUaWo2N6v36FEOZLlXNw6S7IpQUwd3j9+/M4hnTN6sdpcal4uf1epyM8ISjdndHZGSOQT+GsN29YwIRFqLZmWaWvDt4Yr+bdwxq5YLVNRDQoapXIjy6ExUUUhEjOwca3VelhsofJhryXPxMhwlfB8bP0oU7Ps5oVu7W+FzJZdzxi5nBXvCjtDteSpWvdM9M0ZvdBKmTa12lyI3ILX4dLWm9+RuxuYFoV5TAWx2swv/wy+49kff33Kok8f39/8NnHLc8Pz2k14JspcbStbsVhoXhldJ6bWwk3CbDtktKqLVNjG0RmdKm2WKlMFz98rVYIRg/GrMGbr1pTXRoFpaVa5y015tWzqdy8fuDFCF42FIGsdz9FNu1K1TsQ9E2OOK1xnwtxTDvttQZEOeOAgvBRqJYzeQgHH6AnyCGVBW8mRmro2tMi5kTdD5nBHwGzX1K71D0rCtHZN05B6FB4/ZiGNCQoHneAgxF7Mho22MLh2+mu/17QfIA8F8e0zbBrHyMOxH0IyojgkZNhLC+LDvezNWC0WlRjUgEQP01tTw9QjWEtHrJ3WMk+rRgdSoGqQw5pPrzWkMptqSQ3Za3FtR1iWuUxgrVTxH6V1eDSrEQuGhCPsNKxm2KMIIYZY5Ef0dJwOgsALaLij9HBPYqC71yN87B/J6adnMRux+FKat7Ul6HliuVmNyAk+pLRJuWrcVp92N0Ib4HR+nsvMcs1Yuu6s7/m1yD+oSjacp7NrZYxaQYHcZkx58i1riH+hcqWbvuiieaBI09l5Vbbu1e4K3r0s5MZSferGM1saY/3yucWKzJO0YJ4Ez7yQsKW0l0CPZJ5yw+HD2iv7qYou6WPiMiaVSiTPJ5k0y/p6gknklUUGHS1knndjLFRhMViowlw5iA44RWeyQIjNY/YCCXwvYOj2YUNikcA59PVtPAADbG3LfizQGQ9tlgGZjmWOP2LOuwJeJEArGhHkyfKFOezHKhE4IhoPEacnEqKYgl7c6QMp6IUfhjTwGWUhi+kPelofeywaNs380KMEiERiGuGXKEXBiFAXuarTuVZuTH0eqdrkshAXu4gbuV3YEw/4mdv+p5nmqRSDvJj5sznp5c2kFokTpsLycm+jQx3/nKKpD3aIR9U3cUimduxEj9G9w3LJ3VsCoxJ6yP5GZ9qtgclIdw6IYifWq01mz0YeX1fM06Jl0rvEjmcKr21qWCqx6C8a9J1E9+awG1zaww1abXA7gQAepDAdi154QPPCp5K8cMTQK3pyZgbonNLwOGaSMMQ4+N8ws6I2b+dJcNtae7C108tyXlUuDf5eJi59El5SL9p3xpH/vLyMRryciZvXH7eRB+O2QqwnW8H1xPImr128Og9ggeY90wTFvfDtTikb0fvUUZ0PJ5z+Q/d5FI95hA7wCD0Rj+IRj8q6qaXF91pUNgyQ1fhguxIQO6TNpVhz51RZ9J4j8IOV0dtProvm5bN98fzudbbpZ862D+nCg0dht/MePAqz4wJQOApTTIcyc6KjMEN0cLLA+xEo82gckBgHPmE4+tEINACZJHfGuYwhj4Uh8eMwBK8eBi8uGO2ufnt74fULKn1QUMVKfZUTbPnaqugXmGO5/VKtZC6295+BD8Qyu1GfQDztsexY9SQH1JM8lXpiPKLMmDPQjiwrC9d6KY24KnmjL2sIbvbiqWGEt1iIIEkORXhpGF8j9ATeiu0Dvne5hSPidRrVw5ziMeb0yTAff3cwjshfE+bB/ZhD/PnMgI+vvdmrBjxi9wJOGX1mwMc3tPg1A473g+ARw8eH/H8X8PHFZhfyViUvBsAH32v7zSkcMhvgzm14ll3/AkODX+ge9VK/2qT1hMhCOlm7udg6oS3XtdVF1e3ll9Ir9xVROwSYUjuKttCICT97+zCnjEVH3otNLzD1X+7tw8EY6afvxXYL82TXCqA9h/zriW4W7Al597V/GzXf/vMEffMP</diagram></mxfile>

docs/ci-cd.md

@@ -0,0 +1,45 @@
+# CI/CD overview
+
+## GitOps
+
+CI/CD is fully automated using different Git events and GitHub actions. This repository uses [bump-everywhere](https://github.com/undergroundwires/bump-everywhere) to automate versioning, tagging, creation of `CHANGELOG.md` and GitHub releases. A dedicated workflow [release.desktop.yaml](./../.github/workflows/release.desktop.yaml) creates desktop installers and executables and attaches them into GitHub releases.
+
+Everything that's merged in the master goes directly to production.
+
+[![CI/CD using GitHub Actions](./../img/architecture/gitops.png)](../.github/workflows/)
+
+## Pipeline files
+
+privacy.sexy uses [GitHub actions](https://github.com/features/actions) to define and run pipelines as code.
+
+GitHub workflows i.e. pipelines exist in [`/.github/workflows/`](./../.github/workflows/) folder without any subfolders due to GitHub actions requirements [1] .
+
+Local GitHub actions are defined in [`/.github/actions/`](./../.github/actions/) and used to reuse same workflow steps.
+
+## Pipeline types
+
+We categorize pipelines into different categories. We use these names in convention when naming files and actions, see [naming conventions](#naming-conventions).
+
+The categories consist of:
+
+- `tests`: Different types of tests to verify functionality.
+- `checks`: Other controls such as vulnerability scans or styling checks.
+- `release`: Pipelines used for release of deployment such as building and testing.
+
+## Naming conventions
+
+Convention for naming pipeline files: **`<type>.<name>.yaml`**.
+
+**`type`**:
+
+- Sub-folders do not work for GitHub workflows [1] so we use `<type>.` prefix to organize them.
+- See also [pipeline types](#pipeline-types) for list of all usable types.
+
+**`name`**:
+
+- We name workflows using kebab-case.
+- E.g. file name `tests.unit.yaml`, pipeline file should set the naem as: `name: unit-tests`.
+- Kebab-case allows to have better URL references to them.
+  - [README.md](./../README.md) uses URL references to show status badges for actions.
+
+[1]: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#about-yaml-syntax-for-workflows

docs/collection-files.md

@@ -0,0 +1,176 @@
+# Collection files
+
+- privacy.sexy is a data-driven application where it reads the necessary OS-specific logic from yaml files in [`application/collections`](./../src/application/collections/)
+- 💡 Best practices
+  - If you repeat yourself, try to utilize [YAML-defined functions](#function)
+  - Always try to add documentation and a way to revert a tweak in [scripts](#script)
+- 📖 Types in code: [`collection.yaml.d.ts`](./../src/application/collections/collection.yaml.d.ts)
+
+## Objects
+
+### `Collection`
+
+- A collection simply defines:
+  - different categories and their scripts in a tree structure
+  - OS specific details
+- Also allows defining common [function](#function)s to be used throughout the collection if you'd like different scripts to share same code.
+
+#### `Collection` syntax
+
+- `os:` *`string`*  (**required**)
+  - Operating system that the [Collection](#collection) is written for.
+  - 📖 See [OperatingSystem.ts](./../src/domain/OperatingSystem.ts) enumeration for allowed values.
+- `actions: [` ***[`Category`](#category)*** `, ... ]` **(required)**
+  - Each [category](#category) is rendered as different cards in card presentation.
+  - ❗ A [Collection](#collection) must consist of at least one category.
+- `functions: [` ***[`Function`](#function)*** `, ... ]`
+  - Functions are optionally defined to re-use the same code throughout different scripts.
+- `scripting:` ***[`ScriptingDefinition`](#scriptingdefinition)*** **(required)**
+  - Defines the scripting language that the code of other action uses.
+
+### `Category`
+
+- Category has a parent that has tree-like structure where it can have subcategories or subscripts.
+- It's a logical grouping of different scripts and other categories.
+
+#### `Category` syntax
+
+- `category:` *`string`*  (**required**)
+  - Name of the category
+  - ❗ Must be unique throughout the [Collection](#collection)
+- `children: [` ***[`Category`](#category)*** `|` [***`Script`***](#script) `, ... ]`  (**required**)
+  - ❗ Category must consist of at least one subcategory or script.
+  - Children can be combination of scripts and subcategories.
+- `docs`: *`string`* | `[`*`string`*`, ... ]`
+  - Documentation pieces related to the category.
+  - Rendered as markdown.
+
+### `Script`
+
+- Script represents a single tweak.
+- A script can be of two different types (just like [functions](#function)):
+  1. Inline script; a script with an inline code
+     - Must define `code` property and optionally `revertCode` but not `call`
+  2. Caller script; a script that calls other functions
+     - Must define `call` property but not `code` or `revertCode`
+- 🙏 For any new script, please add `revertCode` and `docs` values if possible.
+
+#### `Script` syntax
+
+- `name`: *`string`* (**required**)
+  - Name of the script
+  - ❗ Must be unique throughout the [Collection](#collection)
+  - E.g. `Disable targeted ads`
+- `code`: *`string`* (may be **required**)
+  - Batch file commands that will be executed
+  - 💡 If defined, best practice to also define `revertCode`
+  - ❗ If not defined `call` must be defined, do not define if `call` is defined.
+- `revertCode`: `string`
+  - Code that'll undo the change done by `code` property.
+  - E.g. let's say `code` sets an environment variable as `setx POWERSHELL_TELEMETRY_OPTOUT 1`
+    - then `revertCode` should be doing `setx POWERSHELL_TELEMETRY_OPTOUT 0`
+  - ❗ Do not define if `call` is defined.
+- `call`: ***[`FunctionCall`](#functioncall)*** | `[` ***[`FunctionCall`](#functioncall)*** `, ... ]` (may be **required**)
+  - A shared function or sequence of functions to call (called in order)
+  - ❗ If not defined `code` must be defined
+- `docs`: *`string`* | `[`*`string`*`, ... ]`
+  - Documentation pieces related to the script.
+  - Rendered as markdown.
+- `recommend`: `"standard"` | `"strict"` | `undefined` (default)
+  - If not defined then the script will not be recommended
+  - If defined it can be either
+    - `standard`: Only non-breaking scripts without limiting OS functionality
+    - `strict`: Scripts that can break certain functionality in favor of privacy and security
+
+### `FunctionCall`
+
+- Describes a single call to a function by optionally providing values to its parameters.
+- 👀 See [parameter substitution](./templating.md#parameter-substitution) for an example usage
+
+#### `FunctionCall` syntax
+
+- `function`: *`string`* (**required**)
+  - Name of the function to call.
+  - ❗ Function with same name must defined in `functions` property of [Collection](#collection)
+- `parameters`: `[ parameterName:` *`parameterValue`*`, ... ]`
+  - Defines key value dictionary for each parameter and its value
+  - E.g.
+
+    ```yaml
+      parameters:
+        userDefinedParameterName: parameterValue
+        # ...
+        appName: Microsoft.WindowsFeedbackHub
+    ```
+
+  - 💡 [Expressions (templating)](./templating.md#expressions) can be used as parameter value
+
+### `Function`
+
+- Functions allow re-usable code throughout the defined scripts.
+- Functions are templates compiled by privacy.sexy and uses special expression expressions.
+- A function can be of two different types (just like [scripts](#script)):
+  1. Inline function: a function with an inline code.
+     - Must define `code` property and optionally `revertCode` but not `call`.
+  2. Caller function: a function that calls other functions.
+     - Must define `call` property but not `code` or `revertCode`.
+- 👀 Read more on [Templating](./templating.md) for function expressions and [example usages](./templating.md#parameter-substitution).
+
+#### `Function` syntax
+
+- `name`: *`string`* (**required**)
+  - Name of the function that scripts will use.
+  - Convention is to use camelCase, and be verbs.
+  - E.g. `uninstallStoreApp`
+  - ❗ Function names must be unique
+- `parameters`: `[` ***[`FunctionParameter`](#functionparameter)*** `, ... ]`
+  - List of parameters that function code refers to.
+  - ❗ Must be defined to be able use in [`FunctionCall`](#functioncall) or [expressions (templating)](./templating.md#expressions)
+ `code`: *`string`* (**required** if `call` is undefined)
+  - Batch file commands that will be executed
+  - 💡 [Expressions (templating)](./templating.md#expressions) can be used in its value
+  - 💡 If defined, best practice to also define `revertCode`
+  - ❗ If not defined `call` must be defined
+- `revertCode`: *`string`*
+  - Code that'll undo the change done by `code` property.
+  - E.g. let's say `code` sets an environment variable as `setx POWERSHELL_TELEMETRY_OPTOUT 1`
+    - then `revertCode` should be doing `setx POWERSHELL_TELEMETRY_OPTOUT 0`
+  - 💡 [Expressions (templating)](./templating.md#expressions) can be used in code
+- `call`: ***[`FunctionCall`](#functioncall)*** | `[` ***[`FunctionCall`](#functioncall)*** `, ... ]` (may be **required**)
+  - A shared function or sequence of functions to call (called in order)
+  - The parameter values that are sent can use [expressions (templating)](./templating.md#expressions)
+  - ❗ If not defined `code` must be defined
+
+### `FunctionParameter`
+
+- Defines a parameter that function requires optionally or mandatory.
+- Its arguments are provided by a [Script](#script) through a [FunctionCall](#functioncall).
+
+#### `FunctionParameter` syntax
+
+- `name`: *`string`* (**required**)
+  - Name of the parameters that the function has.
+  - Parameter names must be defined to be used in [expressions (templating)](./templating.md#expressions).
+  - ❗ Parameter names must be unique and include alphanumeric characters only.
+- `optional`: *`boolean`* (default: `false`)
+  - Specifies whether the caller [Script](#script) must provide any value for the parameter.
+  - If set to `false` i.e. an argument value is not optional then it expects a non-empty value for the variable;
+    - Otherwise it throws.
+  - 💡 Set it to `true` if a parameter is used conditionally;
+    - Or else set it to `false` for verbosity or do not define it as default value is `false` anyway.
+  - 💡 Can be used in conjunction with [`with` expression](./templating.md#with).
+
+### `ScriptingDefinition`
+
+- Defines global properties for scripting that's used throughout its parent [Collection](#collection).
+
+#### `ScriptingDefinition` syntax
+
+- `language:` *`string`* (**required**)
+  - 📖 See [ScriptingLanguage.ts](./../src/domain/ScriptingLanguage.ts) enumeration for allowed values.
+- `startCode:` *`string`* (**required**)
+  - Code that'll be inserted on top of user created script.
+  - Global variables such as `$homepage`, `$version`, `$date` can be used using [parameter substitution](./templating.md#parameter-substitution) code syntax such as `Welcome to {{ $homepage }}!`
+- `endCode:` *`string`* (**required**)
+  - Code that'll be inserted at the end of user created script.
+  - Global variables such as `$homepage`, `$version`, `$date` can be used using [parameter substitution](./templating.md#parameter-substitution) code syntax such as `Welcome to {{ $homepage }}!`

docs/development.md

@@ -0,0 +1,75 @@
+# Development
+
+Before your commit, a good practice is to:
+
+1. [Run unit tests](#testing)
+2. [Lint your code](#linting)
+
+You could run other types of tests as well, but they may take longer time and overkill for your changes. Automated actions executes the tests for a pull request or change in the main branch. See [ci-cd.md](./ci-cd.md) for more information.
+
+## Commands
+
+### Prerequisites
+
+- Install node >15.x.
+- Install dependencies using `npm install`.
+
+### Testing
+
+- Run unit tests: `npm run test:unit`
+- Run integration tests: `npm run test:integration`
+- Run end-to-end (e2e) tests:
+  - `npm run test:cy:open`: Run tests interactively using the development server with hot-reloading.
+  - `npm run test:cy:run`: Run tests on the production build in a headless mode.
+
+📖 Read more about testing in [tests](./tests.md).
+
+### Linting
+
+- Lint all (recommended 💡): `npm run lint`
+- Markdown: `npm run lint:md`
+- Markdown consistency `npm run lint:md:consistency`
+- Markdown relative URLs: `npm run lint:md:relative-urls`
+- JavaScript/TypeScript: `npm run lint:eslint`
+- Yaml: `npm run lint:yaml`
+
+### Running
+
+**Web:**
+
+- Run in local server: `npm run dev`
+  - 💡 Meant for local development with features such as hot-reloading.
+- Preview production build: `npm run preview`
+  - Start a local web server that serves the built solution from `./dist`.
+  - 💡 Run `npm run build` before `npm run preview`.
+
+**Desktop apps:**
+
+- `npm run electron:dev`: The command will build the main process and preload scripts source code, and start a dev server for the renderer, and start the Electron app.
+- `npm run electron:preview`: The command will build the main process, preload scripts and renderer source code, and start the Electron app to preview.
+- `npm run electron:prebuild`: The command will build the main process, preload scripts and renderer source code. Usually before packaging the Electron application, you need to execute this command.
+- `npm run electron:build`: Prebuilds the Electron application, packages and publishes it through `electron-builder`.
+
+**Docker:**
+
+1. Build: `docker build -t undergroundwires/privacy.sexy:latest .`
+2. Run: `docker run -it -p 8080:80 --rm --name privacy.sexy undergroundwires/privacy.sexy:latest`
+
+### Building
+
+- Build web application: `npm run build`
+- Build desktop application: `npm run electron:build`
+- (Re)create icons (see [documentation](../img/README.md)): `npm run create-icons`
+
+### Utility Scripts
+
+- Run fresh NPM install: [`./scripts/fresh-npm-install.sh`](../scripts/fresh-npm-install.sh)
+  - This script provides a clean NPM install, removing existing node modules and optionally the package-lock.json (when run with -n), then installs dependencies and runs unit tests.
+- Configure VSCode: [`./scripts/configure-vscode.sh`](../scripts/configure-vscode.sh)
+  - This script checks and sets the necessary configurations for VSCode in `settings.json` file.
+
+## Recommended extensions
+
+You should use EditorConfig to follow project style.
+
+For Visual Studio Code, [`.vscode/extensions.json`](./../.vscode/extensions.json) includes list of recommended extensions.

docs/presentation.md

@@ -0,0 +1,107 @@
+# Presentation layer
+
+The presentation layer handles UI concerns using Vue as JavaScript framework and Electron to provide desktop functionality.
+
+It reflects the [application state](./application.md#application-state) and allows user interactions to modify it. Components manage their own local UI state.
+
+The presentation layer uses an event-driven architecture for bidirectional reactivity between the application state and UI. State change events flow bottom-up to trigger UI updates, while user events flow top-down through components, some ultimately modifying the application state.
+
+📖 Refer to [architecture.md (Layered Application)](./architecture.md#layered-application) to read more about the layered architecture.
+
+## Structure
+
+- [`/src/` **`presentation/`**](./../src/presentation/): Contains Vue and Electron code.
+  - [**`bootstrapping/`**](./../src/presentation/bootstrapping/): Registers Vue components and plugins.
+  - [**`components/`**](./../src/presentation/components/): Contains Vue components and helpers.
+    - [**`Shared/`**](./../src/presentation/components/Shared): Contains shared Vue components and helpers.
+      - [**`hooks`**](../src/presentation/components/Shared/Hooks): Hooks used by components through [dependency injection](#dependency-injections).
+  - [**`/public/`**](../src/presentation/public/): Contains static assets.
+  - [**`assets/`**](./../src/presentation/assets/styles/): Contains assets processed by Vite.
+    - [**`fonts/`**](./../src/presentation/assets/fonts/): Contains fonts.
+    - [**`styles/`**](./../src/presentation/assets/styles/): Contains shared styles.
+      - [**`components/`**](./../src/presentation/assets/styles/components): Contains styles for Vue components.
+      - [**`vendors-extensions/`**](./../src/presentation/assets/styles/third-party-extensions): Contains styles for third-party components.
+      - [**`main.scss`**](./../src/presentation/assets/styles/main.scss): Main Sass file, imported by other components as single entrypoint.
+  - [**`main.ts`**](./../src/presentation/main.ts): Starts Vue app.
+  - [**`electron/`**](./../src/presentation/electron/): Contains Electron code.
+    - [`/main/` **`index.ts`**](./../src/presentation/main.ts): Main entry for Electron, managing application windows and lifecycle events.
+    - [`/preload/` **`index.ts`**](./../src/presentation/main.ts): Script executed before the renderer, securing Node.js features for renderer use.
+- [**`/vite.config.ts`**](./../vite.config.ts): Contains Vite configurations for building web application.
+- [**`/electron.vite.config.ts`**](./../electron.vite.config.ts): Contains Vite configurations for building desktop applications.
+- [**`/postcss.config.cjs`**](./../postcss.config.cjs): Contains PostCSS configurations for Vite.
+
+## Visual design best-practices
+
+Add visual clues for clickable items. It should be as clear as possible that they're interactable at first look without hovering. They should also have different visual state when hovering/touching on them that indicates that they are being clicked, which helps with accessibility.
+
+## Application data
+
+Components (should) use [`UseApplication`](./../src/presentation/components/Shared/Hooks/UseApplication.ts) to reach the application domain to avoid [parsing and compiling](./application.md#parsing-and-compiling) the application again.
+
+[Application.ts](../src/domain/Application.ts) is an immutable domain model that represents application state. It includes:
+
+- available scripts, collections as defined in [collection files](./collection-files.md),
+- package information as defined in [`package.json`](./../package.json).
+
+You can read more about how application layer provides application data to he presentation in [application.md | Application data](./application.md#application-data).
+
+## Application state
+
+This project uses a singleton instance of the application state, making it available to all Vue components.
+
+The decision to not use third-party state management libraries like [`vuex`](https://web.archive.org/web/20230801191617/https://vuex.vuejs.org/) or [`pinia`](https://web.archive.org/web/20230801191743/https://pinia.vuejs.org/) was made to promote code independence and enhance portability.
+
+Stateful components can mutate and/or react to state changes (e.g., user selection, search queries) in the [ApplicationContext](./../src/application/Context/ApplicationContext.ts). Vue components import [`CollectionState.ts`](./../src/presentation/components/Shared/Hooks/UseCollectionState.ts) to access both the application context and the state.
+
+[`UseCollectionState.ts`](./../src/presentation/components/Shared/Hooks/UseCollectionState.ts) provides several functionalities including:
+
+- **Singleton State Instance**: It creates a singleton instance of the state, which is shared across the presentation layer. The singleton instance ensures that there's a single source of truth for the application's state.
+- **State Change Callback and Lifecycle Management**: It offers a mechanism to register callbacks, which will be invoked when the state initializes or mutates. It ensures that components unsubscribe from state events when they are no longer in use or when [ApplicationContext](./../src/application/Context/ApplicationContext.ts) switches the active [collection](./collection-files.md).
+- **State Access and Modification**: It provides functions to read and mutate for accessing and modifying the state, encapsulating the details of these operations.
+- **Event Subscription Lifecycle Management**: Includes an `events` member that simplifies state subscription lifecycle events. This ensures that components unsubscribe from state events when they are no longer in use, or when [ApplicationContext](./../src/application/Context/ApplicationContext.ts) switches the active [collection](./collection-files.md).
+
+📖 Refer to [architecture.md | Application State](./architecture.md#application-state) for an overview of event handling and [application.md | Application State](./presentation.md#application-state) for an in-depth understanding of state management in the application layer.
+
+## Dependency injections
+
+The presentation layer uses Vue's native dependency injection system to increase testability and decouple components.
+
+To add a new dependency:
+
+1. **Define its symbol**: Define an associated symbol for every dependency in [`injectionSymbols.ts`](./../src/presentation/injectionSymbols.ts). Symbols are grouped into:
+   - **Singletons**: Shared across components, instantiated once.
+   - **Transients**: Factories yielding a new instance on every access.
+2. **Provide the dependency**: Modify the [`provideDependencies`](./../src/presentation/bootstrapping/DependencyProvider.ts) function to include the new dependency. [`App.vue`](./../src/presentation/components/App.vue) calls this function within its `setup()` hook to register the dependencies.
+3. **Inject the dependency**: Use Vue's `inject` method alongside the defined symbol to incorporate the dependency into components.
+   - For singletons, invoke the factory method: `inject(symbolKey)()`.
+   - For transients, directly inject: `inject(symbolKey)`.
+
+## Shared UI components
+
+Shared UI components promote consistency and simplifies the creation of the front-end.
+
+In order to maintain portability and easy maintainability, the preference is towards using homegrown components over third-party ones or comprehensive UI frameworks like Quasar.
+
+Shared components include:
+
+- [ModalDialog.vue](./../src/presentation/components/Shared/Modal/ModalDialog.vue) is utilized for rendering modal windows.
+- [TooltipWrapper.vue](./../src/presentation/components/Shared/TooltipWrapper.vue) acts as a wrapper for rendering tooltips.
+
+## Desktop builds
+
+Desktop builds uses `electron-vite` to bundle the code, and `electron-builder` to build and publish the packages.
+
+## Sass naming convention
+
+- Use lowercase for variables/functions/mixins, e.g.:
+  - Variable: `$variable: value;`
+  - Function: `@function function() {}`
+  - Mixin: `@mixin mixin() {}`
+- Use - for a phrase/compound word, e.g.:
+  - Variable: `$some-variable: value;`
+  - Function: `@function some-function() {}`
+  - Mixin: `@mixin some-mixin() {}`
+- Grouping and name variables from generic to specific, e.g.:
+  - ✅ `$border-blue`, `$border-blue-light`, `$border-blue-lightest`, `$border-red`
+  - ❌ `$blue-border`, `$light-blue-border`, `$lightest-blue-border`, `$red-border`
+  

docs/templating.md

@@ -0,0 +1,122 @@
+# Templating
+
+## Benefits of templating
+
+- Generating scripts by sharing code to increase best-practice usage and maintainability.
+- Creating self-contained scripts without cross-dependencies.
+- Use of pipes for writing cleaner code and letting pipes do dirty work.
+
+## Expressions
+
+- Expressions start and end with mustaches (double brackets, `{{` and `}}`).
+  - E.g. `Hello {{ $name }} !`
+- Syntax is close to [Go Templates ❤️](https://pkg.go.dev/text/template) but not the same.
+- Functions enables usage of expressions.
+  - In script definition parts of a function, see [`Function`](./collection-files.md#Function).
+  - When doing a call as argument values, see [`FunctionCall`](./collection-files.md#Function).
+- Expressions inside expressions (nested templates) are supported.
+  - An expression can output another expression that will also be compiled.
+  - E.g. following would compile first [with expression](#with), and then [parameter substitution](#parameter-substitution) in its output.
+
+    ```go
+      {{ with $condition }}
+        echo {{ $text }}
+      {{ end }}
+    ```
+
+### Parameter substitution
+
+A simple function example:
+
+```yaml
+  function: EchoArgument
+  parameters:
+    - name: 'argument'
+  code: Hello {{ $argument }} !
+```
+
+It would print "Hello world" if it's called in a [script](./collection-files.md#script) as following:
+
+```yaml
+  script: Echo script
+  call:
+    function: EchoArgument
+    parameters:
+      argument: World
+```
+
+A function can call other functions such as:
+
+```yaml
+  - 
+    function: CallerFunction
+    parameters:
+      - name: 'value'
+    call:
+      function: EchoArgument
+      parameters:
+        argument: {{ $value }}
+  -
+    function: EchoArgument
+    parameters:
+      - name: 'argument'
+    code: Hello {{ $argument }} !
+```
+
+### with
+
+Skips its "block" if the variable is absent or empty. Its "block" is between `with` start (`{{ with .. }}`) and end (`{{ end }`}) expressions.
+E.g. `{{ with $parameterName }} Hi, I'm a block! {{ end }}` would only output `Hi, I'm a block!` if `parameterName` has any value..
+
+It binds its context (value of the provided parameter value) as arbitrary `.` value. It allows you to use the argument value of the given parameter when it is provided and not empty such as:
+
+```go
+  {{ with $parameterName }}Parameter value is {{ . }} here {{ end }}
+```
+
+It supports multiline text inside the block. You can have something like:
+
+```go
+  {{ with $argument }}
+    First line
+    Second line
+  {{ end }}
+```
+
+You can also use other expressions inside its block, such as [parameter substitution](#parameter-substitution):
+
+```go
+  {{ with $condition }}
+    This is a different parameter: {{ $text }}
+  {{ end }}
+```
+
+💡 Declare parameters used for `with` condition as optional. Set `optional: true` for the argument if you use it like `{{ with $argument }} .. {{ end }}`.
+
+Example:
+
+```yaml
+  function: FunctionThatOutputsConditionally
+  parameters:
+    - name: 'argument'
+      optional: true
+  code: |- 
+    {{ with $argument }}
+      Value is: {{ . }}
+    {{ end }}
+```
+
+### Pipes
+
+- Pipes are functions available for handling text.
+- Allows stacking actions one after another also known as "chaining".
+- Like [Unix pipelines](https://en.wikipedia.org/wiki/Pipeline_(Unix)), the concept is simple: each pipeline's output becomes the input of the following pipe.
+- You cannot create pipes. [A dedicated compiler](./application.md#parsing-and-compiling) provides pre-defined pipes to consume in collection files.
+- You can combine pipes with other expressions such as [parameter substitution](#parameter-substitution) and [with](#with) syntax.
+- ❗ Pipe names must be camelCase without any space or special characters.
+- **Existing pipes**
+  - `inlinePowerShell`: Converts a multi-lined PowerShell script to a single line.
+  - `escapeDoubleQuotes`: Escapes `"` characters, allows you to use them inside double quotes (`"`).
+- **Example usages**
+  - `{{ with $code }} echo "{{ . | inlinePowerShell }}" {{ end }}`
+  - `{{ with $code }} echo "{{ . | inlinePowerShell | escapeDoubleQuotes }}" {{ end }}`

docs/tests.md

@@ -0,0 +1,83 @@
+# Tests
+
+There are different types of tests executed:
+
+1. [Unit tests](#unit-tests)
+2. [Integration tests](#integration-tests)
+3. [End-to-end (E2E) tests](#e2e-tests)
+4. [Automated checks](#automated-checks)
+
+## Unit and integration tests
+
+- They utilize [Vitest](https://vitest.dev/).
+- Test files are suffixed with `.spec.ts`.
+
+### Act, arrange, assert
+
+- Tests implement the act, arrange, and assert (AAA) pattern.
+- **Arrange**
+  - Sets up the test scenario and environment.
+  - Begins with comment line `// arrange`.
+- **Act**
+  - Executes the actual test.
+  - Begins with comment line `// act`.
+- **Assert**
+  - Sets an expectation for the test's outcome.
+  - Begins with comment line `// assert`.
+
+### Unit tests
+
+- Evaluate individual components in isolation.
+- Located in [`./tests/unit`](./../tests/unit).
+- Achieve isolation using [stubs](./../tests/unit/shared/Stubs).
+- Include Vue component tests, enabled by `@vue/test-utils`.
+
+#### Unit tests naming
+
+- Test suites start with a description of the component or system under test.
+  - E.g., tests for `Application.ts` are contained in `Application.spec.ts`.
+- Whenever possible, `describe` blocks group tests of the same function.
+  - E.g., tests for `run()` are inside `describe('run', () => ...)`.
+
+### Integration tests
+
+- Assess the combined functionality of components.
+- They verify that third-party dependencies function as anticipated.
+
+## E2E tests
+
+- Examine the live web application's functionality and performance.
+- Uses Cypress to run the tests.
+
+## Automated checks
+
+These checks validate various qualities like runtime execution, building process, security testing, etc.
+
+- Use [various tools](./../package.json) and [scripts](./../scripts).
+- Are automatically executed as [GitHub workflows](./../.github/workflows).
+
+## Tests structure
+
+- [`package.json`](./../package.json): Defines test commands and includes tools used in tests.
+- [`vite.config.ts`](./../vite.config.ts): Configures `vitest` for unit and integration tests.
+- [`./src/`](./../src/): Contains the code subject to testing.
+- [`./tests/shared/`](./../tests/shared/): Contains code shared by different test categories.
+  - [`bootstrap/setup.ts`](./../tests/shared/bootstrap/setup.ts): Initializes unit and integration tests.
+- [`./tests/unit/`](./../tests/unit/)
+  - Stores unit test code.
+  - The directory structure mirrors [`./src/`](./../src).
+    - E.g., tests for [`./src/application/ApplicationFactory.ts`](./../src/application/ApplicationFactory.ts) reside in [`./tests/unit/application/ApplicationFactory.spec.ts`](./../tests/unit/application/ApplicationFactory.spec.ts).
+  - [`shared/`](./../tests/unit/shared/)
+    - Contains shared unit test functionalities.
+    - [`Assertions/`](./../tests/unit/shared/Assertions): Contains common assertion functions, prefixed with `expect`.
+    - [`TestCases/`](./../tests/unit/shared/TestCases/)
+      - Shared test cases.
+      - Functions that calls `it()` from [Vitest](https://vitest.dev/) should have `it` prefix.
+    - [`Stubs/`](./../tests/unit/shared/Stubs): Maintains stubs for component isolation, equipped with basic functionalities and, when necessary, spying or mocking capabilities.
+- [`./tests/integration/`](./../tests/integration/): Contains integration test files.
+- [`cypress.config.ts`](./../cypress.config.ts): Cypress (E2E tests) configuration file.
+- [`./tests/e2e/`](./../tests/e2e/): Base Cypress folder, includes tests with `.cy.ts` extension.
+  - [`/support/e2e.ts`](./../tests/e2e/support/e2e.ts): Support file, runs before every single spec file.
+  - [`/tsconfig.json`]: TypeScript configuration for file Cypress code, improves IDE support, recommended to have by official documentation.
+  - *(git ignored)* `/videos`: Asset folder for videos taken during tests.
+  - *(git ignored)* `/screenshots`: Asset folder for Screenshots taken during tests.

electron-builder.yml

@@ -0,0 +1,31 @@
+# -------
+# Windows
+# -------
+win:
+  target: nsis
+nsis:
+  artifactName: ${name}-${version}-Setup.${ext}
+
+# -----
+# Linux
+# -----
+linux:
+  target: AppImage
+appImage:
+  artifactName: ${name}-${version}.${ext}
+
+# -----
+# macOS
+# -----
+mac:
+  target: dmg
+dmg:
+  artifactName: ${name}-${version}.${ext}
+
+# ----------------
+# Publish options
+# ----------------
+publish:
+  provider: 'github'
+  vPrefixedTagName: false # default: true
+  releaseType: release # default: draft

electron.vite.config.ts

@@ -0,0 +1,68 @@
+import { resolve } from 'path';
+import { mergeConfig, UserConfig } from 'vite';
+import { defineConfig, externalizeDepsPlugin } from 'electron-vite';
+import { getAliasesFromTsConfig, getClientEnvironmentVariables } from './vite-config-helper';
+import { createVueConfig } from './vite.config';
+
+const MAIN_ENTRY_FILE = resolvePathFromProjectRoot('src/presentation/electron/main/index.ts');
+const PRELOAD_ENTRY_FILE = resolvePathFromProjectRoot('src/presentation/electron/preload/index.ts');
+const WEB_INDEX_HTML_PATH = resolvePathFromProjectRoot('src/presentation/index.html');
+const DIST_DIR = resolvePathFromProjectRoot('dist_electron/');
+
+export default defineConfig({
+  main: getSharedElectronConfig({
+    distDirSubfolder: 'main',
+    entryFilePath: MAIN_ENTRY_FILE,
+  }),
+  preload: getSharedElectronConfig({
+    distDirSubfolder: 'preload',
+    entryFilePath: PRELOAD_ENTRY_FILE,
+  }),
+  renderer: mergeConfig(
+    createVueConfig({
+      supportLegacyBrowsers: false,
+    }),
+    {
+      build: {
+        outDir: resolve(DIST_DIR, 'renderer'),
+        rollupOptions: {
+          input: {
+            index: WEB_INDEX_HTML_PATH,
+          },
+        },
+      },
+    },
+  ),
+});
+
+function getSharedElectronConfig(options: {
+  readonly distDirSubfolder: string;
+  readonly entryFilePath: string;
+}): UserConfig {
+  return {
+    build: {
+      outDir: resolve(DIST_DIR, options.distDirSubfolder),
+      lib: {
+        entry: options.entryFilePath,
+      },
+      rollupOptions: {
+        output: {
+          entryFileNames: '[name].cjs', // This is needed so `type="module"` works
+        },
+      },
+    },
+    plugins: [externalizeDepsPlugin()],
+    define: {
+      ...getClientEnvironmentVariables(),
+    },
+    resolve: {
+      alias: {
+        ...getAliasesFromTsConfig(),
+      },
+    },
+  };
+}
+
+function resolvePathFromProjectRoot(pathSegment: string) {
+  return resolve(__dirname, pathSegment);
+}

img/README.md

@@ -0,0 +1,9 @@
+# img
+
+This folder contains image files and other resources related to images.
+
+## logo.svg
+
+[`logo.svg`](./logo.svg) serves as the primary logo from which all other icons and images are derived.
+Only modify this file manually.
+After making changes, execute `npm run build:icons` to regenerate logo files in various formats.

img/architecture/app-ddd.drawio

@@ -0,0 +1 @@
+<mxfile host="Electron" modified="2021-01-31T12:32:01.751Z" agent="5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/14.1.8 Chrome/87.0.4280.88 Electron/11.1.1 Safari/537.36" etag="OTbSPW1ZOLwiPL6mt-j9" version="14.1.8" type="device"><diagram id="rhL8jzEM8kVVyiS98U7u" name="Page-1">3VtZd6JKF/01/dhZjA6PREjCXRbGFpM2L70QCYIoLsUI/PpvnwKcMD3cazrJl6wEqfHU3vvsKoz5Infm6e3KWU5ZPPGiL5IwSb/I+hdJUsUmflNBVhQoDaEo8FfBpCgS9wWDIPfKwqrZJph466OGSRxHSbA8LnTjxcJzk6MyZ7WKt8fNnuPoeNal43u1goHrRPXSx2CSTIvSlirsy++8wJ9WM4tCWTN3qsZlwXrqTOLtQZFsfJE7qzhOilfztONFhF2FS9Hv5pXaXWArb5H8Tofr+9ZNO9J+6A+Ljvr89N2aP5tflSq4JKtW7E0AQHkbr5Jp7McLJzL2pdereLOYeDSsgLt9m24cL1EoojD0kiQr2XQ2SYyiaTKPylovDZLv1P1KLe9GBzV6Wo7Mb7LqZpGssoNOdDs6rNt343dVv3WyimdeJ47iFV+f3OZfqKkDWGK6jjcr1/sJapUQnZXvJT9pJxXtCNGDCUp6br147iFSNFh5kZMEL8eSc0rl+rt2e3LxouT3T7iW3oXrHW9HrO1J/IC8yZfmjXfVVisnO2iwjINFsj4Y+Z4K0KD0TrnMzdI51ZP0/nlrSVRPBFNMv5fPbh3/QVHyu7rHgXcIV5L6m/bxeWSofCj7KMd9caJNOdP9yltj8Zg7XtSEcEzzdhok3mDpcFy2OCkcU/ocRNEBxhPVa02Uc+i3pLHcaFCPeJFUOjuzFVbBeqvES38KXlnbaB6nT5lN2/2eL1c7+/Rgv69OMxdHW268Z2qJR6n1m5klHmeW9B6pJb1Xav07h28fm7YoH5n2L9tLzebbm7zc+ixHxPcU1MWPDP/JPaSaV2vLZRS4l7DqI+OtWfezSt/nyGjwr3KEg/Li62ck/b6Lq8cuvnsYO7Rx6YyNN9/MxtXPkjwf6flK/pQHJLmWdHo8d4LLHo3G4mTyfBZ3UWjKbe8Njkbtk6Rq15NKUs4klfpWSaXUgDYXzysHiGzcZLPyLgr4c8v1XPcc4OOWqqjCGwDePDmLNs4A3vqbLtaoAe69eOXJ5hWgxT8H+tlrnAd60myPBeEyO0TrBNtmHdvmGWilt4K2WYN25S3jdZDE5eCfGl75zAb8V+Ft1a3CWCRB8hmxPfWFdwe3XQM3ma48ZxIs/P8DeN/dGsT6KX5Of165rO2OBU/2GufAFbyW0GpdBlwcTo7BFZQ6uOqVeAZe6a3grZ/X8DKY/OoZ6aNCLKniVfvDgazWQF4nTvKzI9qf42vo9H0ZFE9MQKze/XhHCP/K6euSGJ6+mXoORPHcu6lvh2H9mOUcviEiRLEfuJ8HULG+Nf1dQHdr2AOazamXG0eR5xKqH1efHw/N+lZUA289dZb0MpjzTywcQkUrh5QjLQr8BcoSeptoV9p1xl50T48UJHVZH8dJEs/RIKKKa8ed+ZyYowMXfaEJn0xbL4tPVtBBy6lunoOUqLwu49GnSUIfydAICenGnSyUq8CNF88BKF9duZhRusHe6uBC5VDHDZIuXn91FpOv4xV+U5FKh54budH88bDxwvUPaoKDUOtqWZ0pL/pk3aa/UpxyryhXap38fenl6a9vkp+ffvmP6f/qTOKxtxOB1Gr9GDjr9QXpl9TWVVP9PQlI5zUgvZkI6tv85xeB+EsRjBdb/AbFKX7wCtsyFdNbausLsS7LyhHlcuOqVT+QSO0zht9+K7Lr55HPT7bwS7Kf45XvLb6uvZg+TXDTAC83y4C/Z7v+Gi+TYB7k/ER2wZzfvUtSsS/XqK/0cUh9VfZfqH/Y3Hrj5vegr7fv2awhLwLh8cyf5n7J/CWIPS+Z8+Qe8V/RzamUteJWulm/gJzrlM58nfs7S3rKrpXxY7pxcyFw7r4Jrh6/dOWJPMlUmWXqizt3X1iobVmnnU/mbmDeTZZPd9/i+4GZWfYoMG+nkfM4iSe6ELBwKJnBteQ8Psj9eVtBm62paz4v103RCkzMfX/r+k/zaD1Gj/G8vXkamMV9R8wmj2l0P/gnmswfNmPp28wMldZIirKRlEbm7dNyfLttmwHL+uE/N0wwMLtFs6Qs9Om1unt9Z7bN0Mh6HfPlPkwXB33Vb7OH62/hLCjLEnfxsH6yi1i8+UM2zniUd9fTya3vPyFK2zawfkVkuulbubGxwijs2qbUBS7WQBC6oZtbgSBYgSJaobthoZl27SGVSyzQUqujCMweJqhPcfWZrW0se5Z17f6G5SMZ2KDtKLcGGq6mYOpMxb1gzY0MV8nKtOoKPA2fdajdKMOcVC4yiSVWpsiWbSbMZhjbxNgzxDFCHKZIYzEepylYmZAjnhx1PuJRmO6jD9aUz1LiqBsaQq8jpKjLMJZv6RjH9uWubaTd0M+tx3MxaRTTpmcPJawb8/Zlby4kWBvKZqqpu2jLtpbEUo4jxwBz2kOxWLshW4GWsUDJe3bfZ/kM8ZBmGOZkSq+j5bQ+FjJoiWL1wYO76el+jv4y4tiygaaijYR+GBu42po0sk1wxfEtr4hzoG27wIjpmkj4WzraZVgvjU9zow/TXQXrABY+8Qeeh4SJivi2TGcJHz830MYgvMCvoIBrzkcP2Fq8DeFPPDDU9WX0zxnVvcqpkHfDmQAN4DpUvYArdzv6/i02b/ttcyakPYo3NGl9W8xHvFPcWyg+QY5izQblGcadIXcFgc+n+xwP8CsWmhymLBBIu+grEB8CcEW8Ptqwck0zWgv0CDz1IepGGLt/Hs8O8BwoWyuc+Wifs9wKGdeARtio4C4j3Vvh0IfuVHALfg1gPEOsBtbaV0x9RPFluE8pZ4ABrn3oxkQe+FuKE30zWgt+gP1MfY1bU+8Tf9Ay8kDvS6RDi17nlAsjhWvtkdY7pHFIY4h1poInmluxOhrmdIUe8gXYiozj7UNrTCy4nAms0KqAssQKSQt96Jj0MiIfkICpwmwXGoWOwdPrsRJOrgz8ZCt/CLkubZYjZ0n3AmLJMJZq6W5i0Rj5CJgMEYNJmMiESY+0w/EeIUcpTkMs8sYAf8CNuAk06Arj5CbnGXy/ih/4Jx3JRR4b4hkdKtxrMi3t6S7laT7KMa+tCUUu+6RB4lXqwc8QP7h3eU739D7mIe0apPuUUUz6kDREeKo9e5T0qL3OuEYseFGXvIzy5/bVvCFNy/C3jPN2W3ohjYs1kkd0aT2hKUKLaW+gKD3ySfJpvQ//MEhjyG3kAvyD8XgE0qxI8XA/DYeUx7S2DJiCY7STXo0HOsB6uIZd1ZKXCTiBRkzu9z19BLwoj42kyEsT+qdYfLHUYIo4Ea+m0N6CeAXue1inRdjkM65dC+OAb8xtSow8PSM9ukmP+1c/ezVXqd4eCZQnaC+McoPvNSzTuIfhWuwPpF/eZkQ5grWT12jEPfj0aayUv87dpPBt4piwYrTPUR5R/iiv40T+oEHPtA/McuSpCK1k2DtoPInZ/4RYM+FAuSgSLvBZeBe45X7F84G4zfg+m1VtuYbLMu20n1/1IzzIO7G/kW/tvL+o2/Xf9ava0rqrGE777eYF5zx/4Iamfj0lbjAW4uvnZZ7Bi4wyV3gcx/WYAzGU9dcN2+7THqLynON7Vz8d5aSZ4UE8/dN4hAMcgAnXu0px4QwjHuC2679fB28LXWrJHhPe73DMPaaFXgn7Au+BdgbvPTZFjgAdySjXDB/RWbVu0jr5vQLfOq2vtFPUL+Kgmyst9/ZGcDrXM5wcLcxH5wHSqkjnLkv/Fv4Rd3WshDpW7BQr9V9j1flbWGEs7rczn2so9zOce6CxmVLstxo8XeBeWJwrNRWemvL9Jx8mHMP8aQo/ynCu86trNU9RT35J50BXIo/r2eRptNe78B/yf9pvyZ/orGls6ZxSxK3RtYxBK2OqYtCKmIr85vtOEdNTwwxadFLvtBf34fblCUroyniiyRV6hrrMnz8l+Uo9fuNJlurPoY0zz6GNP34Oxe3+v8qKTwHv/zVPNv4H</diagram></mxfile>

img/logo.svg

@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN"
+              "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
+
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="90.2998mm" height="90.2998mm"
+     viewBox="0 0 256 256">
+  <path id="logo"
+        fill="#3a65ab" stroke="#3a65ab" stroke-width="1"
+        d="M 128.00,173.00
+           C 128.00,173.00 102.00,175.00 102.00,175.00
+             85.39,174.97 64.02,170.31 49.00,163.22
+             38.46,158.24 28.39,152.17 20.01,143.96
+             14.88,138.93 10.72,133.32 7.31,127.00
+             3.36,119.66 1.10,112.37 1.00,104.00
+             1.00,104.00 1.00,98.00 1.00,98.00
+             1.29,73.92 24.76,53.44 44.00,42.43
+             84.66,19.15 129.75,23.12 169.00,47.00
+             188.74,59.02 207.93,76.23 208.00,101.00
+             208.00,101.00 188.00,101.00 188.00,101.00
+             186.46,86.48 168.72,71.84 157.00,64.61
+             140.76,54.59 121.33,46.78 102.00,47.00
+             88.42,47.16 72.20,52.52 60.00,58.32
+             45.30,65.30 19.83,84.81 21.10,103.00
+             21.39,107.16 22.92,110.33 24.76,114.00
+             32.70,129.78 48.16,140.02 64.00,146.72
+             75.16,151.44 92.90,155.26 105.00,154.99
+             113.45,154.79 121.81,152.84 130.00,151.00
+             130.00,151.00 128.00,173.00 128.00,173.00 Z
+           M 136.00,79.00
+           C 142.71,81.35 144.84,93.60 144.99,100.00
+             145.51,122.74 130.31,140.73 107.00,141.00
+             83.63,141.26 67.43,126.52 66.09,103.00
+             64.82,80.73 85.85,58.90 104.00,64.00
+             100.18,69.73 95.45,74.53 96.20,82.00
+             97.29,92.87 110.06,102.98 121.00,99.03
+             129.92,95.81 134.61,87.96 136.00,79.00 Z
+           M 186.00,113.46
+           C 206.11,110.69 225.57,114.92 239.91,130.01
+             252.85,143.63 255.21,157.09 255.00,175.00
+             254.76,195.49 241.26,214.25 223.00,222.88
+             213.06,227.58 204.72,228.12 194.00,228.00
+             150.34,227.49 126.71,178.85 146.32,142.00
+             154.93,125.82 168.55,117.23 186.00,113.46 Z
+           M 233.00,181.00
+           C 242.24,158.78 221.84,133.54 199.00,133.01
+             188.40,132.77 182.75,135.31 174.00,141.00
+             178.60,146.85 195.92,157.24 203.00,161.86
+             209.82,166.32 226.61,178.55 233.00,181.00 Z
+           M 221.00,200.00
+           C 216.39,194.15 206.42,188.61 200.00,184.33
+             192.31,179.21 168.77,162.59 162.00,160.00
+             159.67,165.03 159.94,166.57 160.00,172.00
+             160.23,190.99 177.11,207.55 196.00,207.99
+             206.60,208.23 212.25,205.69 221.00,200.00 Z" />
+</svg>

package.json

@@ -1,42 +1,110 @@
 {
   "name": "privacy.sexy",
-  "version": "0.1.0",
+  "version": "0.12.1",
   "private": true,
+  "slogan": "Now you have the choice",
+  "description": "Enforce privacy & security best-practices on Windows, macOS and Linux, because privacy is sexy 🍑🍆",
+  "author": "undergroundwires",
+  "type": "module",
   "scripts": {
-    "serve": "vue-cli-service serve",
-    "build": "vue-cli-service build",
-    "lint": "vue-cli-service lint",
-    "test:unit": "vue-cli-service test:unit"
+    "dev": "vite",
+    "build": "vue-tsc --noEmit && vite build",
+    "preview": "vite preview",
+    "test:unit": "vitest run --dir tests/unit",
+    "test:integration": "vitest run --dir tests/integration",
+    "test:e2e": "vue-cli-service test:e2e",
+    "test:cy:run": "start-server-and-test \"vite build && vite preview --port 7070\" http://localhost:7070 \"cypress run --config baseUrl=http://localhost:7070\"",
+    "test:cy:open": "start-server-and-test \"vite --port 7070 --mode production\" http://localhost:7070 \"cypress open --config baseUrl=http://localhost:7070\"",
+    "lint": "npm run lint:md && npm run lint:md:consistency && npm run lint:md:relative-urls && npm run lint:eslint && npm run lint:yaml",
+    "icons:build": "node scripts/logo-update.js",
+    "electron:dev": "electron-vite dev",
+    "electron:preview": "electron-vite preview",
+    "electron:prebuild": "electron-vite build",
+    "electron:build": "electron-builder",
+    "lint:eslint": "eslint .",
+    "lint:md": "markdownlint **/*.md --ignore node_modules",
+    "lint:md:consistency": "remark . --frail --use remark-preset-lint-consistent",
+    "lint:md:relative-urls": "remark . --frail --use remark-validate-links",
+    "lint:yaml": "yamllint **/*.yaml --ignore=node_modules/**/*.yaml",
+    "postinstall": "electron-builder install-app-deps",
+    "postuninstall": "electron-builder install-app-deps"
   },
+  "main": "./dist_electron/main/index.cjs",
   "dependencies": {
-    "@fortawesome/fontawesome-svg-core": "^1.2.26",
-    "@fortawesome/free-brands-svg-icons": "^5.12.0",
-    "@fortawesome/free-regular-svg-icons": "^5.12.0",
-    "@fortawesome/free-solid-svg-icons": "^5.12.0",
-    "@fortawesome/vue-fontawesome": "^0.1.9",
-    "ace-builds": "^1.4.7",
-    "file-saver": "^2.0.2",
-    "inversify": "^5.0.1",
+    "@fortawesome/fontawesome-svg-core": "^6.4.0",
+    "@fortawesome/free-brands-svg-icons": "^6.4.0",
+    "@fortawesome/free-regular-svg-icons": "^6.4.0",
+    "@fortawesome/free-solid-svg-icons": "^6.4.0",
+    "@fortawesome/vue-fontawesome": "^2.0.9",
+    "@juggle/resize-observer": "^3.4.0",
+    "ace-builds": "^1.23.4",
+    "cross-fetch": "^4.0.0",
+    "electron-progressbar": "^2.1.0",
+    "file-saver": "^2.0.5",
+    "install": "^0.13.0",
     "liquor-tree": "^0.2.70",
-    "v-tooltip": "^2.0.2",
-    "vue": "^2.6.11",
-    "vue-class-component": "^7.1.0",
-    "vue-property-decorator": "^8.3.0"
+    "markdown-it": "^13.0.1",
+    "npm": "^9.8.1",
+    "v-tooltip": "2.1.3",
+    "vue": "^2.7.14"
   },
   "devDependencies": {
-    "@types/chai": "^4.2.7",
-    "@types/mocha": "^5.2.7",
-    "@types/ace": "0.0.42",
-    "@types/file-saver": "^2.0.1",
-    "@vue/cli-plugin-typescript": "^4.1.1",
-    "@vue/cli-plugin-unit-mocha": "^4.1.1",
-    "@vue/cli-service": "^4.1.1",
-    "@vue/test-utils": "1.0.0-beta.30",
-    "chai": "^4.2.0",
-    "sass": "^1.24.0",
-    "sass-loader": "^8.0.0",
-    "js-yaml-loader": "^1.2.2",
-    "typescript": "^3.7.4",
-    "vue-template-compiler": "^2.6.11"
+    "@modyfi/vite-plugin-yaml": "^1.0.4",
+    "@rushstack/eslint-patch": "^1.3.2",
+    "@types/ace": "^0.0.48",
+    "@types/file-saver": "^2.0.5",
+    "@typescript-eslint/eslint-plugin": "^5.62.0",
+    "@typescript-eslint/parser": "^5.62.0",
+    "@vitejs/plugin-legacy": "^4.1.1",
+    "@vitejs/plugin-vue2": "^2.2.0",
+    "@vue/eslint-config-airbnb-with-typescript": "^7.0.0",
+    "@vue/eslint-config-typescript": "^11.0.3",
+    "@vue/test-utils": "^1.3.6",
+    "autoprefixer": "^10.4.15",
+    "cypress": "^12.17.2",
+    "electron": "^25.3.2",
+    "electron-builder": "^24.6.3",
+    "electron-devtools-installer": "^3.2.0",
+    "electron-icon-builder": "^2.0.1",
+    "electron-log": "^4.4.8",
+    "electron-updater": "^6.1.4",
+    "electron-vite": "^1.0.27",
+    "eslint": "^8.46.0",
+    "eslint-plugin-cypress": "^2.14.0",
+    "eslint-plugin-vue": "^9.6.0",
+    "eslint-plugin-vuejs-accessibility": "^1.2.0",
+    "icon-gen": "^3.0.1",
+    "jsdom": "^22.1.0",
+    "markdownlint-cli": "^0.35.0",
+    "postcss": "^8.4.28",
+    "remark-cli": "^11.0.0",
+    "remark-lint-no-dead-urls": "^1.1.0",
+    "remark-preset-lint-consistent": "^5.1.2",
+    "remark-validate-links": "^12.1.1",
+    "sass": "^1.64.1",
+    "start-server-and-test": "^2.0.0",
+    "svgexport": "^0.4.2",
+    "terser": "^5.19.2",
+    "tslib": "~2.4.0",
+    "typescript": "~4.6.2",
+    "vite": "^4.4.9",
+    "vitest": "^0.34.2",
+    "vue-tsc": "^1.8.8",
+    "yaml-lint": "^1.7.0"
+  },
+  "//devDependencies": {
+    "terser": "Used by @vitejs/plugin-legacy for minification",
+    "typescript": [
+      "Cannot upgrade to 5.X.X due to unmaintained @vue/cli-plugin-typescript, https://github.com/vuejs/vue-cli/issues/7401",
+      "Cannot upgrade to > 4.6.X otherwise unit tests do not work, https://github.com/evanw/node-source-map-support/issues/252"
+    ],
+    "tslib": "Cannot upgrade to > 2.4.X otherwise unit tests do not work, https://github.com/evanw/node-source-map-support/issues/252",
+    "@typescript-eslint/eslint-plugin": "Cannot upgrade to 6.X.X due to @vue/eslint-config-typescript, https://github.com/vuejs/eslint-config-typescript/pull/60",
+    "@typescript-eslint/parser": "Cannot upgrade to 6.X.X due to @vue/eslint-config-typescript, https://github.com/vuejs/eslint-config-typescript/pull/60"
+  },
+  "homepage": "https://privacy.sexy",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/undergroundwires/privacy.sexy.git"
   }
 }

postcss.config.cjs

@@ -0,0 +1,9 @@
+const autoprefixer = require('autoprefixer');
+
+module.exports = () => {
+  return {
+    plugins: [
+      autoprefixer(),
+    ],
+  };
+};

postcss.config.js

@@ -1,5 +0,0 @@
-module.exports = {
-  plugins: {
-    autoprefixer: {}
-  }
-}

public/index.html

@@ -1,21 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta http-equiv="X-UA-Compatible" content="IE=edge">
-    <meta name="viewport" content="width=device-width,initial-scale=1.0">
-    <link rel="icon" href="<%= BASE_URL %>favicon.ico">
-    <title>Privacy is sexy 🍑🍆</title>
-  </head>
-  <body>
-    <noscript>
-      <strong>
-        The page does not work without JavaScript enabled.
-        Please enable it to continue.
-        There's no shady stuff as 100% of the website is open source.
-      </strong>
-    </noscript>
-    <div id="app"></div>
-    <!-- built files will be auto injected -->
-  </body>
-</html>

scripts/check-desktop-runtime-errors/.eslintrc.cjs

@@ -0,0 +1,10 @@
+require('@rushstack/eslint-patch/modern-module-resolution.js');
+
+module.exports = {
+  env: {
+    node: true,
+  },
+  rules: {
+    'import/extensions': ['error', 'always'],
+  },
+};

scripts/check-desktop-runtime-errors/README.md

@@ -0,0 +1,35 @@
+# check-desktop-runtime-errors
+
+This script automates the processes of:
+
+1) Building
+2) Packaging
+3) Installing
+4) Executing
+5) Verifying Electron distributions
+
+It runs the application for a duration and detects runtime errors in the packaged application via:
+
+- **Log verification**: Checking application logs for errors and validating successful application initialization.
+- **`stderr` monitoring**: Continuous listening to the `stderr` stream for unexpected errors.
+- **Window title inspection**: Checking for window titles that indicate crashes before logging becomes possible.
+
+Upon error, the script captures a screenshot (if `--screenshot` is provided) and terminates.
+
+## Usage
+
+```sh
+node ./scripts/check-desktop-runtime-errors
+```
+
+## Options
+
+- `--build`: Clears the electron distribution directory and forces a rebuild of the Electron app.
+- `--screenshot`: Takes a screenshot of the desktop environment after running the application.
+
+This module provides utilities for building, executing, and validating Electron desktop apps.
+It can be used to automate checking for runtime errors during development.
+
+## Configs
+
+Configurations are defined in [`config.js`](./config.js).

scripts/check-desktop-runtime-errors/app/app-logs.js

@@ -0,0 +1,55 @@
+import { unlink, readFile } from 'fs/promises';
+import { join } from 'path';
+import { log, die, LOG_LEVELS } from '../utils/log.js';
+import { exists } from '../utils/io.js';
+import { SUPPORTED_PLATFORMS, CURRENT_PLATFORM } from '../utils/platform.js';
+import { getAppName } from '../utils/npm.js';
+
+export async function clearAppLogFile(projectDir) {
+  if (!projectDir) { throw new Error('missing project directory'); }
+  const logPath = await determineLogPath(projectDir);
+  if (!logPath || !await exists(logPath)) {
+    log(`Skipping clearing logs, log file does not exist: ${logPath}.`);
+    return;
+  }
+  try {
+    await unlink(logPath);
+    log(`Successfully cleared the log file at: ${logPath}.`);
+  } catch (error) {
+    die(`Failed to clear the log file at: ${logPath}. Reason: ${error}`);
+  }
+}
+
+export async function readAppLogFile(projectDir) {
+  if (!projectDir) { throw new Error('missing project directory'); }
+  const logPath = await determineLogPath(projectDir);
+  if (!logPath || !await exists(logPath)) {
+    log(`No log file at: ${logPath}`, LOG_LEVELS.WARN);
+    return undefined;
+  }
+  const logContent = await readLogFile(logPath);
+  return logContent;
+}
+
+async function determineLogPath(projectDir) {
+  if (!projectDir) { throw new Error('missing project directory'); }
+  const appName = await getAppName(projectDir);
+  if (!appName) {
+    die('App name not found.');
+  }
+  const logFilePaths = {
+    [SUPPORTED_PLATFORMS.MAC]: () => join(process.env.HOME, 'Library', 'Logs', appName, 'main.log'),
+    [SUPPORTED_PLATFORMS.LINUX]: () => join(process.env.HOME, '.config', appName, 'logs', 'main.log'),
+    [SUPPORTED_PLATFORMS.WINDOWS]: () => join(process.env.USERPROFILE, 'AppData', 'Roaming', appName, 'logs', 'main.log'),
+  };
+  const logFilePath = logFilePaths[CURRENT_PLATFORM]?.();
+  if (!logFilePath) {
+    log(`Cannot determine log path, unsupported OS: ${CURRENT_PLATFORM}`, LOG_LEVELS.WARN);
+  }
+  return logFilePath;
+}
+
+async function readLogFile(logFilePath) {
+  const content = await readFile(logFilePath, 'utf-8');
+  return content?.trim().length > 0 ? content : undefined;
+}

scripts/check-desktop-runtime-errors/app/check-for-errors.js

@@ -0,0 +1,126 @@
+import { splitTextIntoLines, indentText } from '../utils/text.js';
+import { die } from '../utils/log.js';
+import { readAppLogFile } from './app-logs.js';
+
+const ELECTRON_CRASH_TITLE = 'Error'; // Used by electron for early crashes
+const LOG_ERROR_MARKER = '[error]'; // from electron-log
+const EXPECTED_LOG_MARKERS = [
+  '[WINDOW_INIT]',
+  '[PRELOAD_INIT]',
+  '[APP_MOUNT_INIT]',
+];
+
+export async function checkForErrors(stderr, windowTitles, projectDir) {
+  if (!projectDir) { throw new Error('missing project directory'); }
+  const errors = await gatherErrors(stderr, windowTitles, projectDir);
+  if (errors.length) {
+    die(formatErrors(errors));
+  }
+}
+
+async function gatherErrors(stderr, windowTitles, projectDir) {
+  if (!projectDir) { throw new Error('missing project directory'); }
+  const logContent = await readAppLogFile(projectDir);
+  return [
+    verifyStdErr(stderr),
+    verifyApplicationLogsExist(logContent),
+    ...EXPECTED_LOG_MARKERS.map((marker) => verifyLogMarkerExistsInLogs(logContent, marker)),
+    verifyWindowTitle(windowTitles),
+    verifyErrorsInLogs(logContent),
+  ].filter(Boolean);
+}
+
+function formatErrors(errors) {
+  if (!errors || !errors.length) { throw new Error('missing errors'); }
+  return [
+    'Errors detected during execution:',
+    ...errors.map(
+      (error) => formatError(error),
+    ),
+  ].join('\n---\n');
+}
+
+function formatError(error) {
+  if (!error) { throw new Error('missing error'); }
+  if (!error.reason) { throw new Error(`missing reason, error (${typeof error}): ${JSON.stringify(error)}`); }
+  let message = `Reason: ${indentText(error.reason, 1)}`;
+  if (error.description) {
+    message += `\nDescription:\n${indentText(error.description, 2)}`;
+  }
+  return message;
+}
+
+function verifyApplicationLogsExist(logContent) {
+  if (!logContent || !logContent.length) {
+    return describeError(
+      'Missing application logs',
+      'Application logs are empty not were not found.',
+    );
+  }
+  return undefined;
+}
+
+function verifyLogMarkerExistsInLogs(logContent, marker) {
+  if (!marker) {
+    throw new Error('missing marker');
+  }
+  if (!logContent?.includes(marker)) {
+    return describeError(
+      'Incomplete application logs',
+      `Missing identifier "${marker}" in application logs.`,
+    );
+  }
+  return undefined;
+}
+
+function verifyWindowTitle(windowTitles) {
+  const errorTitles = windowTitles.filter(
+    (title) => title.toLowerCase().includes(ELECTRON_CRASH_TITLE),
+  );
+  if (errorTitles.length) {
+    return describeError(
+      'Unexpected window title',
+      'One or more window titles suggest an error occurred in the application:'
+        + `\nError Titles: ${errorTitles.join(', ')}`
+        + `\nAll Titles: ${windowTitles.join(', ')}`,
+    );
+  }
+  return undefined;
+}
+
+function verifyStdErr(stderrOutput) {
+  if (stderrOutput && stderrOutput.length > 0) {
+    return describeError(
+      'Standard error stream (`stderr`) is not empty.',
+      stderrOutput,
+    );
+  }
+  return undefined;
+}
+
+function verifyErrorsInLogs(logContent) {
+  if (!logContent || !logContent.length) {
+    return undefined;
+  }
+  const logLines = getNonEmptyLines(logContent)
+    .filter((line) => line.includes(LOG_ERROR_MARKER));
+  if (!logLines.length) {
+    return undefined;
+  }
+  return describeError(
+    'Application log file',
+    logLines.join('\n'),
+  );
+}
+
+function describeError(reason, description) {
+  return {
+    reason,
+    description: `${description}\n\nThis might indicate an early crash or significant runtime issue.`,
+  };
+}
+
+function getNonEmptyLines(text) {
+  return splitTextIntoLines(text)
+    .filter((line) => line?.trim().length > 0);
+}

scripts/check-desktop-runtime-errors/app/extractors/linux.js

@@ -0,0 +1,34 @@
+import { access, chmod } from 'fs/promises';
+import { constants } from 'fs';
+import { findSingleFileByExtension } from '../../utils/io.js';
+import { log } from '../../utils/log.js';
+
+export async function prepareLinuxApp(desktopDistPath) {
+  const { absolutePath: appFile } = await findSingleFileByExtension(
+    'AppImage',
+    desktopDistPath,
+  );
+  await makeExecutable(appFile);
+  return {
+    appExecutablePath: appFile,
+  };
+}
+
+async function makeExecutable(appFile) {
+  if (!appFile) { throw new Error('missing file'); }
+  if (await isExecutable(appFile)) {
+    log('AppImage is already executable.');
+    return;
+  }
+  log('Making it executable...');
+  await chmod(appFile, 0o755);
+}
+
+async function isExecutable(file) {
+  try {
+    await access(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}

scripts/check-desktop-runtime-errors/app/extractors/macos.js

@@ -0,0 +1,66 @@
+import { runCommand } from '../../utils/run-command.js';
+import { findSingleFileByExtension, exists } from '../../utils/io.js';
+import { log, die, LOG_LEVELS } from '../../utils/log.js';
+
+export async function prepareMacOsApp(desktopDistPath) {
+  const { absolutePath: dmgPath } = await findSingleFileByExtension('dmg', desktopDistPath);
+  const { mountPath } = await mountDmg(dmgPath);
+  const appPath = await findMacAppExecutablePath(mountPath);
+  return {
+    appExecutablePath: appPath,
+    cleanup: async () => {
+      log('Cleaning up resources...');
+      await detachMount(mountPath);
+    },
+  };
+}
+
+async function mountDmg(dmgFile) {
+  const { stdout: hdiutilOutput, error } = await runCommand(`hdiutil attach '${dmgFile}'`);
+  if (error) {
+    die(`Failed to mount DMG file at ${dmgFile}.\n${error}`);
+  }
+  const mountPathMatch = hdiutilOutput.match(/\/Volumes\/[^\n]+/);
+  const mountPath = mountPathMatch ? mountPathMatch[0] : null;
+  return {
+    mountPath,
+  };
+}
+
+async function findMacAppExecutablePath(mountPath) {
+  const { stdout: findOutput, error } = await runCommand(
+    `find '${mountPath}' -maxdepth 1 -type d -name "*.app"`,
+  );
+  if (error) {
+    die(`Failed to find executable path at mount path ${mountPath}\n${error}`);
+  }
+  const appFolder = findOutput.trim();
+  const appName = appFolder.split('/').pop().replace('.app', '');
+  const appPath = `${appFolder}/Contents/MacOS/${appName}`;
+  if (await exists(appPath)) {
+    log(`Application is located at ${appPath}`);
+  } else {
+    die(`Application does not exist at ${appPath}`);
+  }
+  return appPath;
+}
+
+async function detachMount(mountPath, retries = 5) {
+  const { error } = await runCommand(`hdiutil detach '${mountPath}'`);
+  if (error) {
+    if (retries <= 0) {
+      log(`Failed to detach mount after multiple attempts: ${mountPath}\n${error}`, LOG_LEVELS.WARN);
+      return;
+    }
+    await sleep(500);
+    await detachMount(mountPath, retries - 1);
+    return;
+  }
+  log(`Successfully detached from ${mountPath}`);
+}
+
+function sleep(milliseconds) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, milliseconds);
+  });
+}

scripts/check-desktop-runtime-errors/app/extractors/windows.js

@@ -0,0 +1,38 @@
+import { mkdtemp, rmdir } from 'fs/promises';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { findSingleFileByExtension, exists } from '../../utils/io.js';
+import { log, die } from '../../utils/log.js';
+import { runCommand } from '../../utils/run-command.js';
+
+export async function prepareWindowsApp(desktopDistPath) {
+  const workdir = await mkdtemp(join(tmpdir(), 'win-nsis-installation-'));
+  if (await exists(workdir)) {
+    log(`Temporary directory ${workdir} already exists, cleaning up...`);
+    await rmdir(workdir, { recursive: true });
+  }
+  const { appExecutablePath } = await installNsis(workdir, desktopDistPath);
+  return {
+    appExecutablePath,
+    cleanup: async () => {
+      log(`Cleaning up working directory ${workdir}...`);
+      await rmdir(workdir, { recursive: true });
+    },
+  };
+}
+
+async function installNsis(installationPath, desktopDistPath) {
+  const { absolutePath: installerPath } = await findSingleFileByExtension('exe', desktopDistPath);
+
+  log(`Silently installing contents of ${installerPath} to ${installationPath}...`);
+  const { error } = await runCommand(`"${installerPath}" /S /D=${installationPath}`);
+  if (error) {
+    die(`Failed to install.\n${error}`);
+  }
+
+  const { absolutePath: appExecutablePath } = await findSingleFileByExtension('exe', installationPath);
+
+  return {
+    appExecutablePath,
+  };
+}

scripts/check-desktop-runtime-errors/app/runner.js

@@ -0,0 +1,164 @@
+import { spawn } from 'child_process';
+import { log, LOG_LEVELS, die } from '../utils/log.js';
+import { captureScreen } from './system-capture/screen-capture.js';
+import { captureWindowTitles } from './system-capture/window-title-capture.js';
+
+const TERMINATION_GRACE_PERIOD_IN_SECONDS = 60;
+const TERMINATION_CHECK_INTERVAL_IN_MS = 1000;
+const WINDOW_TITLE_CAPTURE_INTERVAL_IN_MS = 100;
+
+export function runApplication(
+  appFile,
+  executionDurationInSeconds,
+  enableScreenshot,
+  screenshotPath,
+) {
+  if (!appFile) {
+    throw new Error('Missing app file');
+  }
+
+  logDetails(appFile, executionDurationInSeconds);
+
+  const processDetails = {
+    stderrData: '',
+    stdoutData: '',
+    explicitlyKilled: false,
+    windowTitles: [],
+    isCrashed: false,
+    isDone: false,
+    process: undefined,
+    resolve: () => { /* NOOP */ },
+  };
+
+  const process = spawn(appFile);
+  processDetails.process = process;
+
+  return new Promise((resolve) => {
+    processDetails.resolve = resolve;
+    handleTitleCapture(process.pid, processDetails);
+    handleProcessEvents(
+      processDetails,
+      enableScreenshot,
+      screenshotPath,
+      executionDurationInSeconds,
+    );
+  });
+}
+
+function logDetails(appFile, executionDurationInSeconds) {
+  log(
+    [
+      'Executing the app to check for errors...',
+      `Maximum execution time: ${executionDurationInSeconds}`,
+      `Application path: ${appFile}`,
+    ].join('\n\t'),
+  );
+}
+
+function handleTitleCapture(processId, processDetails) {
+  const capture = async () => {
+    const titles = await captureWindowTitles(processId);
+
+    (titles || []).forEach((title) => {
+      if (!title || !title.length) {
+        return;
+      }
+      if (!processDetails.windowTitles.includes(title)) {
+        log(`New window title captured: ${title}`);
+        processDetails.windowTitles.push(title);
+      }
+    });
+
+    if (!processDetails.isDone) {
+      setTimeout(capture, WINDOW_TITLE_CAPTURE_INTERVAL_IN_MS);
+    }
+  };
+
+  capture();
+}
+
+function handleProcessEvents(
+  processDetails,
+  enableScreenshot,
+  screenshotPath,
+  executionDurationInSeconds,
+) {
+  const { process } = processDetails;
+  process.stderr.on('data', (data) => {
+    processDetails.stderrData += data.toString();
+  });
+  process.stdout.on('data', (data) => {
+    processDetails.stdoutData += data.toString();
+  });
+
+  process.on('error', (error) => {
+    die(`An issue spawning the child process: ${error}`, LOG_LEVELS.ERROR);
+  });
+
+  process.on('exit', async (code) => {
+    await onProcessExit(code, processDetails, enableScreenshot, screenshotPath);
+  });
+
+  setTimeout(async () => {
+    await onExecutionLimitReached(process, processDetails, enableScreenshot, screenshotPath);
+  }, executionDurationInSeconds * 1000);
+}
+
+async function onProcessExit(code, processDetails, enableScreenshot, screenshotPath) {
+  log(`Application exited ${code === null || Number.isNaN(code) ? '.' : `with code ${code}`}`);
+
+  if (processDetails.explicitlyKilled) return;
+
+  processDetails.isCrashed = true;
+
+  if (enableScreenshot) {
+    await captureScreen(screenshotPath);
+  }
+
+  finishProcess(processDetails);
+}
+
+async function onExecutionLimitReached(process, processDetails, enableScreenshot, screenshotPath) {
+  if (enableScreenshot) {
+    await captureScreen(screenshotPath);
+  }
+
+  processDetails.explicitlyKilled = true;
+  await terminateGracefully(process);
+  finishProcess(processDetails);
+}
+
+function finishProcess(processDetails) {
+  processDetails.isDone = true;
+  processDetails.resolve({
+    stderr: processDetails.stderrData,
+    stdout: processDetails.stdoutData,
+    windowTitles: [...processDetails.windowTitles],
+    isCrashed: processDetails.isCrashed,
+  });
+}
+
+async function terminateGracefully(process) {
+  let elapsedSeconds = 0;
+  log('Attempting to terminate the process gracefully...');
+  process.kill('SIGTERM');
+
+  return new Promise((resolve) => {
+    const checkInterval = setInterval(() => {
+      elapsedSeconds += TERMINATION_CHECK_INTERVAL_IN_MS / 1000;
+
+      if (!process.killed) {
+        if (elapsedSeconds >= TERMINATION_GRACE_PERIOD_IN_SECONDS) {
+          process.kill('SIGKILL');
+          log('Process did not terminate gracefully within the grace period. Forcing termination.', LOG_LEVELS.WARN);
+          clearInterval(checkInterval);
+          resolve();
+        }
+      } else {
+        log('Process terminated gracefully.');
+        clearInterval(checkInterval);
+        resolve();
+      }
+    }, TERMINATION_CHECK_INTERVAL_IN_MS);
+  });
+}

scripts/check-desktop-runtime-errors/app/system-capture/screen-capture.js

@@ -0,0 +1,59 @@
+import { unlink } from 'fs/promises';
+import { runCommand } from '../../utils/run-command.js';
+import { log, LOG_LEVELS } from '../../utils/log.js';
+import { CURRENT_PLATFORM, SUPPORTED_PLATFORMS } from '../../utils/platform.js';
+import { exists } from '../../utils/io.js';
+
+export async function captureScreen(imagePath) {
+  if (!imagePath) {
+    throw new Error('Path for screenshot not provided');
+  }
+
+  if (await exists(imagePath)) {
+    log(`Screenshot file already exists at ${imagePath}. It will be overwritten.`, LOG_LEVELS.WARN);
+    unlink(imagePath);
+  }
+
+  const platformCommands = {
+    [SUPPORTED_PLATFORMS.MAC]: `screencapture -x ${imagePath}`,
+    [SUPPORTED_PLATFORMS.LINUX]: `import -window root ${imagePath}`,
+    [SUPPORTED_PLATFORMS.WINDOWS]: `powershell -NoProfile -EncodedCommand ${encodeForPowershell(getScreenshotPowershellScript(imagePath))}`,
+  };
+
+  const commandForPlatform = platformCommands[CURRENT_PLATFORM];
+
+  if (!commandForPlatform) {
+    log(`Screenshot capture not supported on: ${CURRENT_PLATFORM}`, LOG_LEVELS.WARN);
+    return;
+  }
+
+  log(`Capturing screenshot to ${imagePath} using command:\n\t> ${commandForPlatform}`);
+
+  const { error } = await runCommand(commandForPlatform);
+  if (error) {
+    log(`Failed to capture screenshot.\n${error}`, LOG_LEVELS.WARN);
+    return;
+  }
+  log(`Captured screenshot to ${imagePath}.`);
+}
+
+function getScreenshotPowershellScript(imagePath) {
+  return `
+    $ProgressPreference = 'SilentlyContinue' # Do not pollute stderr
+    Add-Type -AssemblyName System.Windows.Forms
+    $screenBounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds
+
+    $bmp = New-Object System.Drawing.Bitmap $screenBounds.Width, $screenBounds.Height
+    $graphics = [System.Drawing.Graphics]::FromImage($bmp)
+    $graphics.CopyFromScreen([System.Drawing.Point]::Empty, [System.Drawing.Point]::Empty, $screenBounds.Size)
+
+    $bmp.Save('${imagePath}')
+    $graphics.Dispose()
+    $bmp.Dispose()
+  `;
+}
+
+function encodeForPowershell(script) {
+  const buffer = Buffer.from(script, 'utf-16le');
+  return buffer.toString('base64');
+}

scripts/check-desktop-runtime-errors/app/system-capture/window-title-capture.js

@@ -0,0 +1,113 @@
+import { runCommand } from '../../utils/run-command.js';
+import { log, LOG_LEVELS } from '../../utils/log.js';
+import { SUPPORTED_PLATFORMS, CURRENT_PLATFORM } from '../../utils/platform.js';
+
+export async function captureWindowTitles(processId) {
+  if (!processId) { throw new Error('Missing process ID.'); }
+
+  const captureFunction = windowTitleCaptureFunctions[CURRENT_PLATFORM];
+  if (!captureFunction) {
+    log(`Cannot capture window title, unsupported OS: ${CURRENT_PLATFORM}`, LOG_LEVELS.WARN);
+    return undefined;
+  }
+
+  return captureFunction(processId);
+}
+
+const windowTitleCaptureFunctions = {
+  [SUPPORTED_PLATFORMS.MAC]: captureTitlesOnMac,
+  [SUPPORTED_PLATFORMS.LINUX]: captureTitlesOnLinux,
+  [SUPPORTED_PLATFORMS.WINDOWS]: captureTitlesOnWindows,
+};
+
+async function captureTitlesOnWindows(processId) {
+  if (!processId) { throw new Error('Missing process ID.'); }
+
+  const { stdout: tasklistOutput, error } = await runCommand(
+    `tasklist /FI "PID eq ${processId}" /fo list /v`,
+  );
+  if (error) {
+    log(`Failed to retrieve window title.\n${error}`, LOG_LEVELS.WARN);
+    return [];
+  }
+  const match = tasklistOutput.match(/Window Title:\s*(.*)/);
+  if (match && match[1]) {
+    const title = match[1].trim();
+    if (title === 'N/A') {
+      return [];
+    }
+    return [title];
+  }
+  return [];
+}
+
+async function captureTitlesOnLinux(processId) {
+  if (!processId) { throw new Error('Missing process ID.'); }
+
+  const { stdout: windowIdsOutput, error: windowIdError } = await runCommand(
+    `xdotool search --pid '${processId}'`,
+  );
+
+  if (windowIdError || !windowIdsOutput) {
+    return undefined;
+  }
+
+  const windowIds = windowIdsOutput.trim().split('\n');
+
+  const titles = await Promise.all(windowIds.map(async (windowId) => {
+    const { stdout: titleOutput, error: titleError } = await runCommand(
+      `xprop -id ${windowId} | grep "WM_NAME(STRING)" | cut -d '=' -f 2 | sed 's/^[[:space:]]*"\\(.*\\)"[[:space:]]*$/\\1/'`,
+    );
+    if (titleError || !titleOutput) {
+      return undefined;
+    }
+    return titleOutput.trim();
+  }));
+
+  return titles.filter(Boolean);
+}
+
+let hasAssistiveAccessOnMac = true;
+
+async function captureTitlesOnMac(processId) {
+  if (!processId) { throw new Error('Missing process ID.'); }
+  if (!hasAssistiveAccessOnMac) {
+    return [];
+  }
+  const script = `
+      tell application "System Events"
+      try
+        set targetProcess to first process whose unix id is ${processId}
+      on error
+        return
+      end try
+      tell targetProcess
+        if (count of windows) > 0 then
+          set window_name to name of front window
+          return window_name
+        end if
+      end tell
+    end tell
+  `;
+  const argument = script.trim()
+    .split(/[\r\n]+/)
+    .map((line) => `-e '${line.trim()}'`)
+    .join(' ');
+
+  const { stdout: titleOutput, error } = await runCommand(`osascript ${argument}`);
+  if (error) {
+    let errorMessage = '';
+    if (error.includes('-25211')) {
+      errorMessage += 'Capturing window title requires assistive access. You do not have it.\n';
+      hasAssistiveAccessOnMac = false;
+    }
+    errorMessage += error;
+    log(errorMessage, LOG_LEVELS.WARN);
+    return [];
+  }
+  const title = titleOutput?.trim();
+  if (!title) {
+    return [];
+  }
+  return [title];
+}

scripts/check-desktop-runtime-errors/cli-args.js

@@ -0,0 +1,20 @@
+import { log } from './utils/log.js';
+
+const PROCESS_ARGUMENTS = process.argv.slice(2);
+
+export const COMMAND_LINE_FLAGS = Object.freeze({
+  FORCE_REBUILD: '--build',
+  TAKE_SCREENSHOT: '--screenshot',
+});
+
+export function logCurrentArgs() {
+  if (!PROCESS_ARGUMENTS.length) {
+    log('No additional arguments provided.');
+    return;
+  }
+  log(`Arguments: ${PROCESS_ARGUMENTS.join(', ')}`);
+}
+
+export function hasCommandLineFlag(flag) {
+  return PROCESS_ARGUMENTS.includes(flag);
+}