@rightkit/release 0.2.106 → 0.2.108

package/cli/right-release.mjs

@@ -26,6 +26,12 @@ const commands = new Map([
 
 const args = process.argv.slice(2);
 const first = args[0];
+if (first === "dev") {
+  import("../development.mjs").then(({ main }) => main(args.slice(1))).catch((error) => {
+    console.error(`right-release dev: ${error.message}`);
+    process.exitCode = 1;
+  });
+} else {
 const githubBuildCommands = new Set(["release", "build", "package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
 
 try {
@@ -143,6 +149,8 @@ function printHelp() {
 Commands:
   build [--platform mac|win] [--skip-checks] [--resume-from <phase>]
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
+  dev --platform win|mac [--config <path>] [--dry-run] [--build-only]
+                                                      Incremental unsigned build & optional local install
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
   release                                             Compatibility alias for build
@@ -169,5 +177,6 @@ Commands:
                                                       Attach sealed signed artifacts to a verified GitHub Release
 
 Direct flags are treated as: right-release build <flags>.
-Build is tier-neutral. Upload requires an explicit tier. Unsigned/local smoke builds stay app-local.`);
+Build is tier-neutral. Upload requires an explicit tier. Dev builds are incremental and unsigned.`);
+}
 }

package/development.mjs

@@ -0,0 +1,230 @@
+import { spawnSync } from "./background-process.mjs";
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
+import { managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
+import { installPortableDevelopment } from "./portable-development.mjs";
+
+export const DEVELOPMENT_PROFILE = "release-iterate";
+
+export function developmentEnvironment(env = process.env) {
+  const result = {
+    ...env,
+    RIGHTKIT_BUILD_MODE: "dev",
+    RIGHTKIT_CARGO_PROFILE: DEVELOPMENT_PROFILE,
+    TAURI_SIGNING_PRIVATE_KEY: "",
+    TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "",
+    APPLE_SIGNING_IDENTITY: "-",
+    APPLE_ID: "",
+    APPLE_PASSWORD: "",
+    APPLE_TEAM_ID: "",
+    CSC_IDENTITY_AUTO_DISCOVERY: "false",
+  };
+  delete result.CARGO_INCREMENTAL;
+  const client = managedRuntimeClient(result);
+  if (client) {
+    const managedRoot = result.RIGHTKIT_MANAGED_ROOT ?? result.RIGHTKIT_EXTERNAL_ROOT
+      ?? (process.platform === "win32" ? "D:\\.rightkit-managed" : process.platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined);
+    const agentBin = managedRoot && path.join(managedRoot, "agent-bin");
+    if (agentBin && existsSync(agentBin)) {
+      const pathKey = Object.keys(result).find((key) => key.toLowerCase() === "path") ?? "PATH";
+      result[pathKey] = [agentBin, result[pathKey]].filter(Boolean).join(path.delimiter);
+    }
+  }
+  return result;
+}
+
+export function validateDevelopmentConfig(config, platform) {
+  const target = config?.development?.targets?.[platform];
+  if (!target || !Array.isArray(target.build) || target.build.length === 0) throw new Error(`development.targets.${platform}.build must be a non-empty command array`);
+  for (const [index, command] of target.build.entries()) validateCommand(command, `development.targets.${platform}.build[${index}]`);
+  if (target.install?.kind === "command") validateCommand(target.install, `development.targets.${platform}.install`);
+  else if (target.install?.kind === "tauri") {
+    if (!target.install.productName || !target.install.targetTriple) throw new Error(`development.targets.${platform}.install requires productName and targetTriple`);
+    if (target.install.manifestPath && path.isAbsolute(target.install.manifestPath)) throw new Error("install.manifestPath must be relative to app root");
+  } else if (target.install?.kind === "portable") {
+    const descriptor = target.install;
+    if (descriptor.activation?.kind !== "current" || !path.isAbsolute(descriptor.installRoot ?? "")) throw new Error("portable development installer requires absolute installRoot and current activation");
+    for (const key of ["sourceDirectory", "entrypoint"]) {
+      if (typeof descriptor[key] !== "string" || !descriptor[key] || path.isAbsolute(descriptor[key]) || path.win32.isAbsolute(descriptor[key]) || descriptor[key].split(/[\\/]/).includes("..")) throw new Error(`portable development ${key} must be a contained relative path`);
+    }
+  } else if (target.install) throw new Error(`unsupported development installer kind: ${target.install.kind}`);
+  return target;
+}
+
+export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync }) {
+  if (!new Set(["win", "mac"]).has(platform)) throw new Error("--platform must be win or mac");
+  assertNativeDevelopmentHost(platform);
+  const target = validateDevelopmentConfig(config, platform);
+  const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+  assertPrimaryReleaseCheckout(repoRoot, env);
+  assertReleaseExecutionAllowed({ cwd: repoRoot, environment: env, command: `right-release dev --platform ${platform}` });
+  const childEnv = developmentEnvironment(env);
+  if (dryRun) return { built: false, installed: false, plan: { build: target.build, install: buildOnly ? null : target.install ?? null, profile: DEVELOPMENT_PROFILE } };
+  for (const command of target.build) execute(command, { root, env: childEnv, dryRun, run, label: "build" });
+  if (buildOnly || !target.install) return { built: true, installed: false };
+  install(target.install, { root, platform, env: childEnv, run });
+  return { built: true, installed: true };
+}
+
+export function assertNativeDevelopmentHost(platform, host = process.platform) {
+  if ((platform === "win" && host !== "win32") || (platform === "mac" && host !== "darwin")) throw new Error(`development target ${platform} requires its native host`);
+}
+
+function install(descriptor, { root, platform, env, run }) {
+  if (descriptor.kind === "command") return execute(descriptor, { root, env, run, label: "install" });
+  if (descriptor.kind === "portable") return installPortableDevelopment(descriptor, { root, platform: platform === "win" ? "win32" : "darwin", env });
+  if (platform === "win") {
+    if (!descriptor.expectedInstalledPath) throw new Error("Windows Tauri installer requires expectedInstalledPath for installed verification");
+    const { bundleRoot, installer: app } = resolveTauriBundleDirectory(descriptor, { root, platform, env });
+    const built = path.resolve(bundleRoot, "..", "..", path.basename(descriptor.expectedInstalledPath));
+    assertNonEmptyExecutable(built);
+    const result = run(app, ["/S"], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
+    if (result.status !== 0) throw new Error(`development installer failed (${result.status}): ${app}`);
+    const installed = path.resolve(root, descriptor.expectedInstalledPath);
+    assertInstalledExecutableMatches(built, installed);
+    return;
+  }
+  const app = resolveTauriArtifact(descriptor, { root, platform, env });
+  const destination = path.resolve(descriptor.destination ?? path.join("/Applications", path.basename(app)));
+  const destinationRoot = path.dirname(destination);
+  mkdirSync(destinationRoot, { recursive: true });
+  const staging = `${destination}.rightkit-dev-${process.pid}`;
+  const backup = `${destination}.rightkit-backup-${process.pid}`;
+  rmSync(staging, { recursive: true, force: true });
+  rmSync(backup, { recursive: true, force: true });
+  cpSync(app, staging, { recursive: true });
+  const signature = run("codesign", ["--force", "--deep", "--preserve-metadata=entitlements", "--sign", "-", staging], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (signature.status !== 0) { rmSync(staging, { recursive: true, force: true }); throw new Error(`ad-hoc signing failed (${signature.status}): ${staging}`); }
+  const verified = run("codesign", ["--verify", "--deep", "--strict", staging], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (verified.status !== 0) { rmSync(staging, { recursive: true, force: true }); throw new Error(`ad-hoc signature verification failed (${verified.status}): ${staging}`); }
+  let backedUp = false;
+  try {
+    if (existsSync(destination)) { renameSync(destination, backup); backedUp = true; }
+    renameSync(staging, destination);
+    if (!existsSync(path.join(destination, "Contents", "Info.plist"))) throw new Error(`installed app verification failed: ${destination}`);
+    if (backedUp) rmSync(backup, { recursive: true, force: true });
+  } catch (error) {
+    rmSync(destination, { recursive: true, force: true });
+    if (backedUp && existsSync(backup)) renameSync(backup, destination);
+    rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+export function resolveTauriArtifact(descriptor, { root, platform, env = process.env, runCargo = runCargoSync }) {
+  return resolveTauriBundleDirectory(descriptor, { root, platform, env, runCargo }).installer;
+}
+
+export function resolveTauriBundleDirectory(descriptor, { root, platform, env = process.env, runCargo = runCargoSync }) {
+  const bundleRoot = descriptor.bundleDirectory
+    ? path.resolve(root, descriptor.bundleDirectory)
+    : resolveBundleRoot(descriptor, { root, env, runCargo });
+  if (descriptor.bundleDirectory && !inside(root, bundleRoot)) throw new Error("Tauri bundleDirectory must stay inside app root");
+  const entries = readdirSync(bundleRoot, { withFileTypes: true });
+  const candidates = platform === "mac"
+    ? entries.filter((entry) => entry.isDirectory() && entry.name === `${descriptor.productName}.app`).map((entry) => path.join(bundleRoot, entry.name))
+    : entries.filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".exe") && entry.name.toLowerCase().includes("setup")).map((entry) => path.join(bundleRoot, entry.name));
+  if (candidates.length !== 1) throw new Error(`expected exactly one ${platform} Tauri installer for ${descriptor.productName} in ${bundleRoot}; found ${candidates.length}`);
+  if (!statSync(candidates[0]).isFile() && platform === "win") throw new Error(`installer is not a file: ${candidates[0]}`);
+  return { bundleRoot, installer: candidates[0] };
+}
+
+export function assertInstalledExecutableMatches(built, installed, read = readFileSync) {
+  assertNonEmptyExecutable(built);
+  assertNonEmptyExecutable(installed);
+  const digest = (file) => createHash("sha256").update(read(file)).digest("hex");
+  if (digest(built) !== digest(installed)) throw new Error(`installed executable does not match this dev build: ${installed}`);
+}
+function assertNonEmptyExecutable(file) { if (!existsSync(file) || !statSync(file).isFile() || statSync(file).size === 0) throw new Error(`installed executable verification failed: missing or empty file ${file}`); }
+
+function resolveBundleRoot(descriptor, { root, env, runCargo }) {
+  if (!descriptor.manifestPath) throw new Error("Tauri installer requires manifestPath when bundleDirectory is omitted");
+  const manifest = path.resolve(root, descriptor.manifestPath);
+  const cwd = process.cwd();
+  let metadata;
+  try {
+    process.chdir(root);
+    metadata = runCargo(["metadata", "--offline", "--no-deps", "--format-version", "1", "--manifest-path", manifest], { cwd: root, env, encoding: "utf8", windowsHide: true, shell: false });
+  } finally { process.chdir(cwd); }
+  if (metadata.error || metadata.status !== 0) throw new Error(`RightKit Cargo metadata failed (${metadata.status ?? "unavailable"})${metadata.error ? `: ${metadata.error.message}` : ""}`);
+  let targetDirectory;
+  try { targetDirectory = JSON.parse(metadata.stdout).target_directory; } catch { throw new Error("RightKit Cargo metadata returned invalid JSON"); }
+  if (!targetDirectory || !path.isAbsolute(targetDirectory)) throw new Error("Cargo metadata omitted absolute target_directory");
+  return path.join(targetDirectory, descriptor.targetTriple, DEVELOPMENT_PROFILE, "bundle", platformBundleKind(descriptor));
+}
+
+function platformBundleKind(descriptor) { return descriptor.targetTriple.includes("apple") ? "macos" : "nsis"; }
+function validateCommand(command, label) { if (!command || typeof command.cmd !== "string" || !command.cmd.trim() || (command.args !== undefined && !Array.isArray(command.args))) throw new Error(`${label} must declare cmd and args`); }
+function execute(command, { root, env, dryRun, run, label }) {
+  validateCommand(command, `development ${label}`);
+  const cwd = path.resolve(root, command.cwd ?? ".");
+  if (!inside(root, cwd)) throw new Error(`development ${label} cwd must stay inside app root`);
+  const args = (command.args ?? []).map(String);
+  if (dryRun) return { cmd: command.cmd, args, cwd };
+  const launch = resolveCommand(command.cmd, args, { root, env });
+  const result = run(launch.command, launch.args, { cwd, env, stdio: "inherit", windowsHide: true, shell: false, timeout: command.timeoutMs });
+  if (result.status !== 0) throw new Error(`development ${label} command failed (${result.status}): ${command.name ?? command.cmd}`);
+}
+export function resolveCommand(command, args, { root, env = process.env } = {}) {
+  if (command === "node") return { command: process.execPath, args };
+  if (command === "pnpm") return { command: process.execPath, args: [resolvePnpmCli({ root, env }), ...args] };
+  if (command === "rightkit") {
+    const client = managedRuntimeClient(env);
+    if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
+    return { command: process.execPath, args: [client, ...args] };
+  }
+  return { command, args };
+}
+export function resolvePnpmCli({ root, env = process.env } = {}) {
+  const candidates = [];
+  if (env.npm_execpath && /pnpm/i.test(path.basename(env.npm_execpath))) candidates.push(env.npm_execpath);
+  const nodeDir = path.dirname(process.execPath);
+  candidates.push(path.join(nodeDir, "node_modules", "corepack", "dist", "pnpm.js"));
+  candidates.push(path.join(nodeDir, "node_modules", "pnpm", "bin", "pnpm.cjs"));
+  for (let dir = path.resolve(root ?? process.cwd()); ; dir = path.dirname(dir)) {
+    const store = path.join(dir, "node_modules", ".pnpm");
+    if (existsSync(store)) {
+      for (const entry of readdirSync(store).filter((name) => /^pnpm@/.test(name)).sort().reverse()) {
+        candidates.push(path.join(store, entry, "node_modules", "pnpm", "bin", "pnpm.cjs"));
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+  }
+  const selected = candidates.find((candidate) => existsSync(candidate));
+  if (!selected) throw new Error("could not resolve pnpm JavaScript CLI entrypoint; install/pin pnpm through Corepack");
+  return selected;
+}
+function git(cwd, args) { const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed`); return result.stdout.trim(); }
+function inside(root, child) { const rel = path.relative(path.resolve(root), path.resolve(child)); return rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel)); }
+export async function main(args = process.argv.slice(2)) {
+  let platform, configPath = "right-release.config.mjs", dryRun = false, buildOnly = false;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "-h" || args[i] === "--help") { console.log("usage: right-release dev --platform win|mac [--config right-release.config.mjs] [--dry-run] [--build-only]"); return; }
+    if (args[i] === "--platform") platform = args[++i];
+    else if (args[i] === "--config") configPath = args[++i];
+    else if (args[i] === "--dry-run") dryRun = true;
+    else if (args[i] === "--build-only") buildOnly = true;
+    else throw new Error(`unknown dev option: ${args[i]}`);
+  }
+  if (!platform) throw new Error("right-release dev requires --platform win|mac");
+  const absoluteConfig = path.resolve(configPath);
+  const safeEnv = developmentEnvironment(process.env);
+  for (const [key, value] of Object.entries(safeEnv)) process.env[key] = value;
+  delete process.env.CARGO_INCREMENTAL;
+  const pathKey = Object.keys(process.env).find((key) => key.toLowerCase() === "path");
+  if (pathKey) process.env[pathKey] = safeEnv[pathKey] ?? process.env[pathKey];
+  const loaded = await import(pathToFileURL(absoluteConfig));
+  const config = loaded.default ?? loaded.config ?? loaded;
+  const result = runDevelopment({ root: path.dirname(absoluteConfig), platform, config, dryRun, buildOnly });
+  if (dryRun) console.log(JSON.stringify(result.plan, null, 2));
+  return result;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  main().catch((error) => { console.error(`right-release dev: ${error.message}`); process.exitCode = 1; });
+}

package/notary-auth.mjs

@@ -1,10 +1,18 @@
 import os from "node:os";
 import path from "node:path";
 
-export function notarytoolAuthArgs({ profile = "apple-dev-notary" } = {}) {
-  const keyPath = process.env.APPLE_API_KEY_PATH?.trim();
-  const keyId = process.env.APPLE_API_KEY?.trim();
-  const issuer = process.env.APPLE_API_ISSUER?.trim();
+export function notarytoolAuthArgs({ profile, env = process.env } = {}) {
+  // A configured profile explicitly selects Keychain authentication. Inherited
+  // API settings belong to automatic selection only.
+  if (profile !== undefined) {
+    if (typeof profile !== "string" || !profile.trim()) {
+      throw new Error("Notarization keychain profile must be a non-empty string");
+    }
+    return ["--keychain-profile", profile.trim()];
+  }
+  const keyPath = env.APPLE_API_KEY_PATH?.trim();
+  const keyId = env.APPLE_API_KEY?.trim();
+  const issuer = env.APPLE_API_ISSUER?.trim();
   const apiValues = [keyPath, keyId, issuer];
 
   if (apiValues.every(Boolean)) {
@@ -13,7 +21,7 @@ export function notarytoolAuthArgs({ profile = "apple-dev-notary" } = {}) {
   if (apiValues.some(Boolean)) {
     throw new Error("Notarization API auth requires APPLE_API_KEY_PATH, APPLE_API_KEY, and APPLE_API_ISSUER together");
   }
-  return ["--keychain-profile", profile];
+  return ["--keychain-profile", "apple-dev-notary"];
 }
 
 function expandHome(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.106",
+  "version": "0.2.108",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/portable-development.mjs

@@ -0,0 +1,181 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+const CHUNK_BYTES = 1024 * 1024;
+
+/** Install an unsigned development payload through an owned, versioned `current` pointer. */
+export function installPortableDevelopment(descriptor, { root, platform = process.platform, env = process.env } = {}) {
+  const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}\n`);
+  let backup = null;
+  let switched = false;
+  let versionRoot;
+  let digest;
+  let current;
+  try {
+    validateDescriptor(descriptor, root, platform);
+    const installRoot = path.resolve(descriptor.installRoot);
+    if (!path.isAbsolute(descriptor.installRoot) || isFilesystemRoot(installRoot, platform)) {
+      throw new Error("development installRoot must be an absolute non-filesystem-root path");
+    }
+    const source = resolveContained(root, descriptor.sourceDirectory, "sourceDirectory");
+    const sourceReal = fs.realpathSync(source);
+    if (!isWithin(fs.realpathSync(root), sourceReal, platform)) throw new Error("development sourceDirectory resolves outside repository root");
+    const sourceInfo = fs.lstatSync(source);
+    if (!sourceInfo.isDirectory() || sourceInfo.isSymbolicLink()) throw new Error("development sourceDirectory must be a real directory");
+    const sourceEntrypoint = resolveContained(source, descriptor.entrypoint, "entrypoint");
+    const sourceEntrypointInfo = fs.lstatSync(sourceEntrypoint);
+    if (!sourceEntrypointInfo.isFile() || sourceEntrypointInfo.isSymbolicLink()) throw new Error("development entrypoint must be a regular file inside sourceDirectory");
+    const sourceDigest = digestTree(source);
+    digest = sourceDigest;
+    versionRoot = path.join(installRoot, "versions", `dev-${digest}`);
+    current = path.join(installRoot, "current");
+    emit("STAGE", { sourceDirectory: source, versionRoot, digest });
+
+    fs.mkdirSync(path.dirname(versionRoot), { recursive: true });
+    if (exists(versionRoot)) {
+      if (digestTree(versionRoot) !== digest) throw new Error(`development version digest collision: ${versionRoot}`);
+    } else {
+      const staging = path.join(path.dirname(versionRoot), `.stage-${process.pid}-${randomSuffix()}`);
+      try {
+        copyTree(source, staging);
+        if (digestTree(staging) !== digest) throw new Error("staged development payload did not match source digest");
+        fs.renameSync(staging, versionRoot);
+      } catch (error) {
+        removeIfExists(staging);
+        throw error;
+      }
+    }
+
+    validateCurrent(current, installRoot, platform);
+    if (exists(current)) {
+      backup = path.join(installRoot, `.current-backup-${process.pid}-${randomSuffix()}`);
+      fs.renameSync(current, backup);
+    }
+    try {
+      fs.symlinkSync(versionRoot, current, platform === "win32" ? "junction" : "dir");
+      switched = true;
+      emit("ACTIVATE", { current, versionRoot });
+      const activeRoot = fs.realpathSync(current);
+      if (!samePath(activeRoot, fs.realpathSync(versionRoot), platform)) throw new Error("development current pointer did not resolve to staged version");
+      const entrypoint = resolveContained(versionRoot, descriptor.entrypoint, "entrypoint");
+      const entryDigest = hashFile(entrypoint);
+      if (entryDigest !== hashFile(path.join(source, descriptor.entrypoint))) throw new Error("development entrypoint readback did not match source");
+      if (backup) removeIfExists(backup);
+      emit("SUCCEEDED", { installRoot, current, versionRoot, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
+      return { installRoot, current, versionRoot, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
+    } catch (error) {
+      if (switched) removeIfExists(current);
+      if (backup && exists(backup)) fs.renameSync(backup, current);
+      throw error;
+    }
+  } catch (error) {
+    emit("FAILED", { installRoot: descriptor?.installRoot, versionRoot, digest, message: error?.message ?? String(error) });
+    throw error;
+  }
+}
+
+function validateDescriptor(descriptor, root, platform) {
+  if (!descriptor || descriptor.kind !== "portable" || descriptor.activation?.kind !== "current") throw new Error("unsupported portable development descriptor");
+  if (typeof root !== "string" || !path.isAbsolute(root)) throw new Error("repository root must be absolute");
+  if (typeof descriptor.installRoot !== "string" || !path.isAbsolute(descriptor.installRoot)) throw new Error("development installRoot must be absolute");
+  resolveContained(root, descriptor.sourceDirectory, "sourceDirectory");
+  resolveContained(root, descriptor.entrypoint, "entrypoint");
+  if (!isRelativePath(descriptor.sourceDirectory) || !isRelativePath(descriptor.entrypoint)) throw new Error("development sourceDirectory and entrypoint must be relative paths");
+  if (platform !== "win32" && platform !== "darwin" && platform !== "linux") throw new Error(`unsupported development install platform: ${platform}`);
+}
+
+function isRelativePath(value) {
+  return typeof value === "string" && value.length > 0 && !path.isAbsolute(value) && !path.win32.isAbsolute(value) && !value.split(/[\\/]/).includes("..");
+}
+
+function resolveContained(base, relative, label) {
+  if (!isRelativePath(relative)) throw new Error(`${label} must be a contained relative path`);
+  const resolved = path.resolve(base, relative);
+  if (!isWithin(path.resolve(base), resolved, process.platform)) throw new Error(`${label} escapes its parent directory`);
+  return resolved;
+}
+
+function isFilesystemRoot(value, platform) {
+  const parsed = path.parse(value);
+  return samePath(parsed.root, value, platform);
+}
+
+function isWithin(parent, child, platform) {
+  const relative = path.relative(parent, child);
+  return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+
+function samePath(left, right, platform) {
+  const a = path.normalize(left);
+  const b = path.normalize(right);
+  return platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+function exists(file) {
+  try { fs.lstatSync(file); return true; } catch (error) { if (error?.code === "ENOENT") return false; throw error; }
+}
+
+function digestTree(directory) {
+  const hash = createHash("sha256");
+  const visit = (dir, relative = "") => {
+    const entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+      const rel = relative ? `${relative}/${entry.name}` : entry.name;
+      const absolute = path.join(dir, entry.name);
+      const stat = fs.lstatSync(absolute);
+      if (stat.isSymbolicLink()) throw new Error(`development payload contains a symbolic link: ${rel}`);
+      if (stat.isDirectory()) { hash.update(`D\0${rel}\0`); visit(absolute, rel); }
+      else if (stat.isFile()) hash.update(`F\0${rel}\0${stat.size}\0${hashFile(absolute)}\0`);
+      else throw new Error(`development payload contains a non-regular entry: ${rel}`);
+    }
+  };
+  visit(directory);
+  return hash.digest("hex");
+}
+
+function hashFile(file) {
+  const fd = fs.openSync(file, "r");
+  const hash = createHash("sha256");
+  const buffer = Buffer.allocUnsafe(CHUNK_BYTES);
+  try {
+    let bytes;
+    while ((bytes = fs.readSync(fd, buffer, 0, buffer.length, null)) > 0) hash.update(buffer.subarray(0, bytes));
+  } finally { fs.closeSync(fd); }
+  return hash.digest("hex");
+}
+
+function copyTree(source, target) {
+  fs.mkdirSync(target, { recursive: true });
+  for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+    const from = path.join(source, entry.name);
+    const to = path.join(target, entry.name);
+    const stat = fs.lstatSync(from);
+    if (stat.isSymbolicLink()) throw new Error(`development payload contains a symbolic link: ${from}`);
+    if (stat.isDirectory()) copyTree(from, to);
+    else if (stat.isFile()) fs.copyFileSync(from, to, fs.constants.COPYFILE_EXCL);
+    else throw new Error(`development payload contains a non-regular entry: ${from}`);
+  }
+}
+
+function validateCurrent(current, installRoot, platform) {
+  if (!exists(current)) return;
+  const stat = fs.lstatSync(current);
+  if (!stat.isSymbolicLink()) throw new Error(`development current pointer is not a symlink or junction; refusing to replace: ${current}`);
+  let target;
+  try { target = fs.realpathSync(current); } catch (error) { throw new Error(`development current pointer is dangling or unreadable: ${current}`, { cause: error }); }
+  const versionsRoot = path.join(installRoot, "versions");
+  const versionName = path.basename(target);
+  if (!isWithin(fs.realpathSync(installRoot), target, platform)
+    || !samePath(path.dirname(target), fs.realpathSync(versionsRoot), platform)
+    || !versionName || versionName === "." || versionName === "..") {
+    throw new Error(`development current pointer does not resolve to an owned version: ${current}`);
+  }
+}
+
+function removeIfExists(target) {
+  if (!exists(target)) return;
+  fs.rmSync(target, { recursive: true, force: true });
+}
+
+function randomSuffix() { return `${Date.now()}-${Math.random().toString(16).slice(2)}`; }

package/rightkit-versions.json

@@ -1,141 +1,143 @@
-{
-  "schema": 2,
-  "packageManager": "pnpm@11.24.0",
-  "npm": {
-    "@rightkit/git": "0.2.0",
-    "@rightkit/legal": "0.2.0",
-    "@rightkit/license": "0.1.5",
-    "@rightkit/logs": "0.1.3",
-    "@rightkit/platform-ui": "0.1.0",
-    "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.47",
-    "@rightkit/tauri": "0.1.0",
-    "@rightkit/updates": "0.2.3"
-  },
-  "stagedNpm": {
-    "@rightkit/ax": "0.2.4",
-    "@rightkit/git": "0.2.25",
-    "@rightkit/hooks": "0.1.1",
-    "@rightkit/legal": "0.3.1",
-    "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.7",
-    "@rightkit/logs": "0.1.4",
-    "@rightkit/platform-ui": "0.1.1",
-    "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.106",
-    "@rightkit/tauri": "0.1.1",
-    "@rightkit/updates": "0.2.4"
-  },
-  "legacyNpm": {
-    "@rightkit/ax": [
-      "0.2.0",
-      "0.2.1",
-      "0.2.2",
-      "0.2.3"
-    ],
-    "@rightkit/git": [
-      "0.2.1",
-      "0.2.2",
-      "0.2.3",
-      "0.2.4",
-      "0.2.5",
-      "0.2.6",
-      "0.2.7",
-      "0.2.8",
-      "0.2.9",
-      "0.2.10",
-      "0.2.11",
-      "0.2.12",
-      "0.2.13",
-      "0.2.14",
-      "0.2.15",
-      "0.2.16",
-      "0.2.18",
-      "0.2.19",
-      "0.2.20",
-      "0.2.21",
-      "0.2.22",
-      "0.2.23",
-      "0.2.24"
-    ],
-    "@rightkit/legal-ui": [
-      "0.1.0"
-    ],
-    "@rightkit/hooks": [
-      "0.1.0"
-    ],
-    "@rightkit/legal": [
-      "0.3.0"
-    ],
-    "@rightkit/license": [
-      "0.1.6"
-    ],
-    "@rightkit/release": [
-      "0.2.22",
-      "0.2.29",
-      "0.2.30",
-      "0.2.31",
-      "0.2.41",
-      "0.2.42",
-      "0.2.43",
-      "0.2.44",
-      "0.2.45",
-      "0.2.46",
-      "0.2.49",
-      "0.2.50",
-      "0.2.51",
-      "0.2.53",
-      "0.2.54",
-      "0.2.55",
-      "0.2.56",
-      "0.2.61",
-      "0.2.62",
-      "0.2.63",
-      "0.2.64",
-      "0.2.65",
-      "0.2.66",
-      "0.2.67",
-      "0.2.68",
-      "0.2.69",
-      "0.2.70",
-      "0.2.71",
-      "0.2.72",
-      "0.2.73",
-      "0.2.74",
-      "0.2.75",
-      "0.2.76",
-      "0.2.82",
-      "0.2.83",
-      "0.2.91",
-      "0.2.92",
-      "0.2.94",
-      "0.2.95",
-      "0.2.96",
-      "0.2.97",
-      "0.2.98",
-      "0.2.99",
-      "0.2.104",
-      "0.2.105"
-    ],
-    "@rightkit/qa": [
-      "0.1.0",
-      "0.2.0"
-    ]
-  },
-  "cargo": {
-    "rightkit-license": "0.1.2",
-    "rightkit-logs": "0.1.0",
-    "rightkit-process": "0.1.0",
-    "rightkit-tauri": "0.1.0"
-  },
-  "stagedCargo": {
-    "rightkit-license": "0.1.3",
-    "rightkit-tauri": "0.1.1"
-  },
-  "swift": {
-    "rightkit-swift": {
-      "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.1.1"
-    }
-  }
-}
+{
+  "schema": 2,
+  "packageManager": "pnpm@11.24.0",
+  "npm": {
+    "@rightkit/git": "0.2.0",
+    "@rightkit/legal": "0.2.0",
+    "@rightkit/license": "0.1.5",
+    "@rightkit/logs": "0.1.3",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.47",
+    "@rightkit/tauri": "0.1.0",
+    "@rightkit/updates": "0.2.3"
+  },
+  "stagedNpm": {
+    "@rightkit/ax": "0.2.4",
+    "@rightkit/git": "0.2.25",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
+    "@rightkit/legal-ui": "0.1.1",
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.108",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4"
+  },
+  "legacyNpm": {
+    "@rightkit/ax": [
+      "0.2.0",
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
+    ],
+    "@rightkit/git": [
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4",
+      "0.2.5",
+      "0.2.6",
+      "0.2.7",
+      "0.2.8",
+      "0.2.9",
+      "0.2.10",
+      "0.2.11",
+      "0.2.12",
+      "0.2.13",
+      "0.2.14",
+      "0.2.15",
+      "0.2.16",
+      "0.2.18",
+      "0.2.19",
+      "0.2.20",
+      "0.2.21",
+      "0.2.22",
+      "0.2.23",
+      "0.2.24"
+    ],
+    "@rightkit/legal-ui": [
+      "0.1.0"
+    ],
+    "@rightkit/hooks": [
+      "0.1.0"
+    ],
+    "@rightkit/legal": [
+      "0.3.0"
+    ],
+    "@rightkit/license": [
+      "0.1.6"
+    ],
+    "@rightkit/release": [
+      "0.2.22",
+      "0.2.29",
+      "0.2.30",
+      "0.2.31",
+      "0.2.41",
+      "0.2.42",
+      "0.2.43",
+      "0.2.44",
+      "0.2.45",
+      "0.2.46",
+      "0.2.49",
+      "0.2.50",
+      "0.2.51",
+      "0.2.53",
+      "0.2.54",
+      "0.2.55",
+      "0.2.56",
+      "0.2.61",
+      "0.2.62",
+      "0.2.63",
+      "0.2.64",
+      "0.2.65",
+      "0.2.66",
+      "0.2.67",
+      "0.2.68",
+      "0.2.69",
+      "0.2.70",
+      "0.2.71",
+      "0.2.72",
+      "0.2.73",
+      "0.2.74",
+      "0.2.75",
+      "0.2.76",
+      "0.2.82",
+      "0.2.83",
+      "0.2.91",
+      "0.2.92",
+      "0.2.94",
+      "0.2.95",
+      "0.2.96",
+      "0.2.97",
+      "0.2.98",
+      "0.2.99",
+      "0.2.104",
+      "0.2.105",
+      "0.2.106",
+      "0.2.107"
+    ],
+    "@rightkit/qa": [
+      "0.1.0",
+      "0.2.0"
+    ]
+  },
+  "cargo": {
+    "rightkit-license": "0.1.2",
+    "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
+    "rightkit-tauri": "0.1.0"
+  },
+  "stagedCargo": {
+    "rightkit-license": "0.1.3",
+    "rightkit-tauri": "0.1.1"
+  },
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.1"
+    }
+  }
+}