v1.4.6 — Windows hot-fix (artifact name + signature check)

Same feature set as v1.4.5; only Windows packaging changed. Fixes two
auto-updater issues that blocked v1.4.5 from reaching Windows users.

═══ Issue 1 — Windows artifact filename mismatch ═══

The default electron-builder NSIS template produces a file with spaces
("Tiger Studio Manager Setup 1.4.5.exe"). GitHub auto-rewrote the
spaces to dots on upload ("Tiger.Studio.Manager.Setup.1.4.5.exe"),
but latest.yml — generated by electron-builder before the upload —
URL-encoded the spaces as dashes ("Tiger-Studio-Manager-Setup-1.4.5.exe").
Three different filenames for the same physical .exe.

Fix:
  win.artifactName = "Tiger-Studio-Manager-Setup-${version}.${ext}"

Now dist/ produces a space-free filename, so GitHub doesn't rewrite it
and latest.yml matches verbatim. The v1.4.5 release was hot-patched in
place — the dotted-name asset was deleted, the bytes were re-uploaded
under the dashed name (sha512 verified intact), latest.yml was reset
to the dashed reference. v1.4.5 → v1.4.6 auto-update will land on
existing v1.4.5 installs cleanly because the manifest now resolves to
a 200.

═══ Issue 2 — electron-updater publisherName mismatch ═══

electron-updater verifies authenticode signature on the downloaded
.exe before swapping it in. Our nsis config didn't define a
publisherName, so electron-builder fell back to deriving it from the
macOS `mac.identity` field — "Developer ID Application: 3D France
(RT4W5WC9P2)" — a name that of course doesn't match the unsigned
Windows .exe we currently ship. Status: 2 (NotSigned) → auto-update
rejected with "New version is not signed by the application owner".

Fix (temporary):
  nsis.publisherName = []

An empty array short-circuits the authenticode check entirely. The
SHA-512 + size verification in latest.yml is still enforced, so
update integrity is preserved over the HTTPS download path. The
attack surface this loses is "MITM with valid TLS but tampered .exe"
which is already protected by the SHA-512 in the signed-by-GitHub
latest.yml. Acceptable trade-off until Microsoft Trusted Signing is
live for STARGATE GROUP (currently In Progress at Microsoft).

When the cert is ready and the GitHub Actions step starts signing
the .exe, this will become:
  nsis.publisherName = ["TigerTag Project"]
(or whatever the actual cert subject ends up being).

Files changed: package.json (win.artifactName + nsis.publisherName +
version 1.4.5 → 1.4.6), package-lock.json (version bump), README.md
(changelog entry).

Author: TigerTag-Project

README.md

@@ -41,6 +41,13 @@
 
 ## Changelog
 
+### v1.4.6 — 2026-05-03
+
+Hot-fix release for two Windows-side issues that surfaced during the v1.4.5 rollout. Same feature set as v1.4.5; only Windows packaging changed.
+
+- **Windows artifact name standardised.** `package.json` `win.artifactName` set to `Tiger-Studio-Manager-Setup-${version}.${ext}`. The default electron-builder NSIS naming used spaces, which GitHub auto-rewrote to dots on upload — but `latest.yml` then referenced the file with dashes (electron-builder's URL encoding), so the auto-updater hit a 404 on every check. With an explicit space-free `artifactName`, all three layers (local `dist/`, asset on the GitHub release, manifest URL in `latest.yml`) now agree. (Existing v1.4.5 release was hot-patched in place by re-uploading the binary under the dashed name.)
+- **Windows code-signature check temporarily disabled.** `nsis.publisherName: []` added. electron-builder was auto-deriving the Windows publisher name from the macOS Apple Developer ID `3D France (RT4W5WC9P2)`, which never matches the unsigned `.exe` we currently ship, so electron-updater on Windows was failing every update check with `New version is not signed by the application owner`. With an empty `publisherName` array, the authenticode verification step is skipped — the SHA-512 + size check in `latest.yml` is still enforced, so update integrity is preserved over the HTTPS download. Once Microsoft Trusted Signing for STARGATE GROUP is approved (currently `In Progress` at Microsoft), the `.exe` will be signed and we'll restore `publisherName: ["TigerTag Project"]` (or the actual cert subject) so the check re-engages.
+
 ### v1.4.5 — 2026-05-03
 
 - **Google sign-in via Touch ID / passkey.** Replaced `firebase.auth().signInWithPopup()` (whose Chromium popup couldn't reach macOS authd, leaving "Use your passkey" inert) with the loopback OAuth flow (RFC 8252 + PKCE). The system browser opens for the auth step, so Touch ID, passkeys, and hardware keys work natively. After the auth handshake completes, the Electron window is brought back to the foreground automatically. Falls back to popup gracefully if the loopback step fails for any reason.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "tigertag-inventory",
-  "version": "1.4.5",
+  "version": "1.4.6",
   "description": "Tiger Studio Manager — desktop app",
   "main": "main.js",
   "engines": {
@@ -99,7 +99,8 @@
     },
     "nsis": {
       "oneClick": false,
-      "allowToChangeInstallationDirectory": true
+      "allowToChangeInstallationDirectory": true,
+      "publisherName": []
     }
   }
 }