@rightkit/release 0.2.132 → 0.2.133

package/build-release.mjs

@@ -27,6 +27,8 @@ import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
+import { signingReceiptPath } from "./signing-receipts.mjs";
+import { validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { resolveReleaseCacheMode } from "./release-cache-mode.mjs";
 import { resolveTargetRoot } from "./cargo-target.mjs";
@@ -36,14 +38,14 @@ import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, summarizePreBrokerWaits, terminateProcessTree } from "./heavy-command.mjs";
 import { processGroupCpuSeconds } from "./process-liveness.mjs";
 import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimits } from "./progress-control.mjs";
+import { beginArtifactLease, completeArtifactLease, materializeArtifacts, retainArtifacts, resolveArtifactDir, resolveManagedRoot } from "./artifact-storage.mjs";
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
 // and test-only edits and would force a cold Rust rebuild of every app each time.
-// These four files are the ones whose behaviour the cached target directory can
-// outlive.
+// Cached target directories must not outlive changes to these signing helpers.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "notarize-macos.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")
@@ -170,7 +172,9 @@ try {
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
-  const receiptRoot = path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(appRoot, ".right-release", "receipts"));
+  const releaseId = `${config.app}-${config.version}-${shortCommit}`;
+  const platformDir = platform === "win" ? "windows" : "mac";
+  const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
   const signingIdentity = platform === "win" ? {
     contract: target.signingContract ?? "<missing>",
     // Pipeline code participates in cache identity. Without it, a fix to the
@@ -184,10 +188,7 @@ try {
     // windows-<phase>.json name is only the fallback. Hardcoding the default
     // here made the seal read a path the signer never wrote whenever a config
     // (e.g. an architecture-qualified receipt) overrode it.
-    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => {
-      const configured = phase === "raw-exe" ? target.sign?.receipt : phase === "installer" ? target.sign?.installerReceipt : undefined;
-      return configured ? path.resolve(appRoot, configured) : path.join(receiptRoot, `windows-${phase}.json`);
-    }),
+    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => signingReceiptPath({ appRoot, target, platform, phase, stateRoot })),
   } : platform === "mac" ? {
     contract: target.signingContract ?? "<missing>",
     pipeline: PIPELINE_FINGERPRINT,
@@ -195,10 +196,7 @@ try {
     // Mac portable releases produce one Developer ID receipt before packaging
     // and one Accepted notarization receipt after. Both must be part of cache
     // identity and seal evidence, including configured receipt overrides.
-    receiptInputs: [
-      target.sign?.receipt ? path.resolve(appRoot, target.sign.receipt) : path.join(receiptRoot, "macos-signing.json"),
-      target.notarize?.receipt ? path.resolve(appRoot, target.notarize.receipt) : path.join(receiptRoot, "macos-notarization.json"),
-    ],
+    receiptInputs: ["signing", "notarization"].map((phase) => signingReceiptPath({ appRoot, target, platform, phase, stateRoot })),
   } : null;
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = nativeLayout.lockPath;
@@ -259,6 +257,8 @@ try {
     ...(pathPrefix ? { PATH: `${pathPrefix}${path.delimiter}${process.env.PATH ?? ""}` } : {}),
     RIGHT_RELEASE_REPO_ROOT: layout.repoRoot,
     RIGHT_RELEASE_APP_ROOT: layout.appRoot,
+    RIGHTKIT_MANAGED_ROOT: resolveManagedRoot({ env: process.env }),
+    RIGHT_RELEASE_ARTIFACT_DIR: resolveArtifactDir({ app: config.app, version: config.version, managedRoot: resolveManagedRoot({ env: process.env }) }),
   };
   if (managedCargoTarget) {
     for (const name of ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"]) {
@@ -277,10 +277,12 @@ try {
   const preBrokerWaits = summarizePreBrokerWaits({ heavySlot, suiteSlot, heavyOwnerInherited: process.env.RIGHTSUITE_HEAVY_WORK_OWNER === "1" });
   console.error(`[right-release] pre-broker waits: ${preBrokerWaits.summary}`);
   throwIfInterrupted();
-  const releaseId = `${config.app}-${config.version}-${shortCommit}`;
-  const platformDir = platform === "win" ? "windows" : "mac";
+  const managedRoot = resolveManagedRoot({ env: process.env });
+  const managedArtifactDir = resolveArtifactDir({ app: config.app, version: config.version, managedRoot });
+  beginArtifactLease({ app: config.app, version: config.version, managedRoot });
+  env.RIGHTKIT_MANAGED_ROOT = managedRoot;
+  env.RIGHT_RELEASE_ARTIFACT_DIR = managedArtifactDir;
   const buildRoot = managedCargoTarget ? null : path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
-  const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
   env.RIGHT_RELEASE_STATE_ROOT = stateRoot;
   const lockPayload = {
     schema: 1,
@@ -384,7 +386,7 @@ try {
         });
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -424,7 +426,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence }) {
+function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot }) {
   // Every app's right-release.config.mjs names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
@@ -442,7 +444,12 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     if (managedCargoTarget && effectiveTargetPrefix !== targetPrefix && normalized.startsWith(effectiveTargetPrefix)) {
       return path.join(managedCargoTarget, normalized.slice(effectiveTargetPrefix.length));
     }
-    return path.resolve(configRoot, file);
+    const local = path.resolve(configRoot, file);
+    if (existsSync(local)) return local;
+    const managed = resolveArtifactDir({ app: config.app, version: config.version, managedRoot });
+    const managedCandidate = path.join(managed, path.basename(file));
+    if (existsSync(managedCandidate)) return managedCandidate;
+    return local;
   };
   const sources = new Map();
   const addSource = (source, role) => {
@@ -460,6 +467,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   if (existsSync(temp)) rmSync(temp, { recursive: true, force: true });
   mkdirSync(temp, { recursive: true });
   const files = [];
+  const artifactInputs = [];
   const sourceNames = new Map();
   for (const [source, roles] of sources) {
     let name = path.basename(source);
@@ -467,6 +475,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     sourceNames.set(source, name);
     copyFileSync(source, path.join(temp, name));
     files.push({ role: [...roles].sort().join("+"), name, sha256: hashFile(source), sizeBytes: statSync(source).size });
+    artifactInputs.push({ source, name });
   }
   const routes = { patch: [], update: [] };
   for (const artifact of target.installer?.artifacts ?? []) {
@@ -497,6 +506,10 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     signing: signingIdentity ? { ...signingIdentity, receipts: (() => {
       const present = signingIdentity.receiptInputs.filter((file) => existsSync(file));
       if (present.length === 0) throw new Error(`no signing receipts found to seal; expected at least ${signingIdentity.receiptInputs[0]}`);
+      if (platform === "mac") {
+        if (present.length !== signingIdentity.receiptInputs.length) throw new Error("missing current-build macOS signing or notarization receipt");
+        validateNotarizationReceipt({ receiptPath: signingIdentity.receiptInputs[1], archive: resolveArtifactPath(target.notarize.file) });
+      }
       return present.map((file) => ({ file, sha256: hashFile(file) }));
     })() } : null,
     files,
@@ -514,6 +527,14 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     const file = path.join(sealedDir, item.name);
     try { chmodSync(file, 0o444); } catch { /* best effort; hashes are authoritative */ }
   }
+  // Keep candidate installer/updater bytes outside app repositories. Sealed
+  // copies remain immutable release authority; managed copies support local
+  // retention and recovery without reintroducing repo-root artifacts.
+  materializeArtifacts({ app: config.app, version: config.version, managedRoot, files: artifactInputs });
+  completeArtifactLease({ app: config.app, version: config.version, managedRoot });
+  const retention = retainArtifacts({ app: config.app, managedRoot });
+  if (retention.state === "unknown") console.error(`[right-release] artifact retention skipped: ${retention.reason}`);
+  else if (retention.removed.length) console.log(`[right-release] artifact retention removed ${retention.removed.join(", ")}`);
 }
 
 function collectToolVersions(packageManager) {

package/cli/right-release.mjs

@@ -18,6 +18,7 @@ const commands = new Map([
   ["hardeningscan", "hardeningscan.mjs"],
   ["sign-windows", "sign-windows.mjs"],
   ["sign-updater", "sign-updater.mjs"],
+  ["signing-agent", "signing-agent-command.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
   ["github", "github-release.mjs"],
@@ -31,7 +32,7 @@ const args = process.argv.slice(2);
 const first = args[0];
 if (first === "dev") {
   import("../development.mjs").then(({ main }) => main(args.slice(1))).catch((error) => {
-    console.error(`right-release dev: ${error.message}`);
+    console.error(`right-release dev: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
     process.exitCode = 1;
   });
 } else {
@@ -69,6 +70,8 @@ if (first === "--version" || first === "-v") {
   );
 } else if (first === "cache") {
   run("cache-command.mjs", args.slice(1));
+} else if (first === "apple") {
+  run("apple-profile-renew.mjs", args.slice(1));
 } else if (first === "publish") {
   const rest = args.slice(1);
   if (rest[0] === "cargo") {
@@ -166,9 +169,12 @@ Commands:
                                                       (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish swift [--repo <git-url>] [--dry-run] Test, tag, resolve a fresh exact-pin consumer, and publish RightKitSwift to its git repo
-  model promote --authority heardright --config <file> [--dry-run]
+  model promote --authority <app-key> --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
   addon doctor|build|upload|adopt <options>           Manage a signed headless add-on
+  apple profile renew [--config <file>] [--profile <file>] [--dry-run]
+                                                      Renew macOS profile for current Keychain signer
+  signing-agent install|uninstall|status              Manage invisible Aqua-session signing service
   doctor [--platform mac|win]                        Inspect one app's release config
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories
@@ -192,7 +198,7 @@ Commands:
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
   mirror-root-artifact --file <path> --package-root <dir>
-                                                      Persist a worktree artifact in the primary repo root
+                                                      Persist artifact in RIGHT_RELEASE_ARTIFACT_DIR
   github --release <id> --platform mac|win [--repo owner/repo] [--dry-run]
                                                       Attach sealed signed artifacts to a verified GitHub Release
 

package/create-mac-updater.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { execFileSync, spawnSync } from "./background-process.mjs";
+import { spawnSync } from "./background-process.mjs";
 import { existsSync, rmSync } from "node:fs";
-import os from "node:os";
 import path from "node:path";
+import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
 
 const args = process.argv.slice(2);
 let app;
@@ -27,18 +27,6 @@ const env = { ...process.env };
 // entries. Tauri's Rust extractor writes those entries as real bundle files,
 // invalidating the Developer ID seal and causing syspolicyd to trash the app.
 env.COPYFILE_DISABLE = "1";
-if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
-  try {
-    env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
-      "security",
-      ["find-generic-password", "-a", os.userInfo().username, "-s", "rightsuite-updater-key", "-w"],
-      { encoding: "utf8" },
-    ).trim();
-  } catch {
-    fail("shared updater key is missing from Keychain service rightsuite-updater-key");
-  }
-}
-env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ??= "";
 
 rmSync(outputPath, { force: true });
 rmSync(`${outputPath}.sig`, { force: true });
@@ -51,7 +39,12 @@ run("tar", [
   path.dirname(appPath),
   path.join(path.basename(appPath), "Contents"),
 ]);
-run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
+if (dryRun) run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
+else {
+  console.log(`pnpm exec tauri signer sign ${outputPath}`);
+  try { signMacUpdaterFiles([outputPath], { cwd, env }); }
+  catch (error) { fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
+}
 
 function run(command, commandArgs) {
   const envPrefix = command === "tar" ? "COPYFILE_DISABLE=1 " : "";

package/development-signing.mjs

@@ -0,0 +1,193 @@
+import { createHash, X509Certificate } from "node:crypto";
+import { closeSync, copyFileSync, existsSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+
+export class MacosDevelopmentSigningError extends Error {
+  constructor(code, message, details = {}) {
+    super(message, details.cause ? { cause: details.cause } : undefined);
+    this.name = "MacosDevelopmentSigningError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+
+const DEFAULT_TEAM = "6KLGD3LLKF";
+const output = (result) => `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+const captureOptions = (root, env) => ({ cwd: root, env, encoding: "utf8", stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: false });
+
+function checked(command, args, context, code, identity) {
+  const result = context.run(command, args, captureOptions(context.root, context.env));
+  if (result.error || result.status !== 0) {
+    const diagnostic = result.error?.message || output(result) || `exit ${result.status ?? "unavailable"}${result.signal ? ` (${result.signal})` : ""}`;
+    const interaction = result.status === 36 || /errSecInteractionNotAllowed|User interaction is not allowed/i.test(diagnostic);
+    throw new MacosDevelopmentSigningError(interaction ? "DEV_MAC_SIGNING_KEY_UNAVAILABLE" : code,
+      `${identity ? `Signing identity ${JSON.stringify(identity)}: ` : ""}${command} failed (${result.status ?? "unavailable"}): ${diagnostic}. ${interaction
+        ? "Run right-release dev from Terminal in a logged-in macOS GUI session where this identity's private key is accessible; SSH cannot authorize Keychain interaction."
+        : "Check the configured identity, profile and entitlements; confirm this identity and its private key are available in Keychain Access in a logged-in GUI session."}`,
+      { identity, status: result.status, diagnostic, cause: result.error });
+  }
+  return result;
+}
+
+function readPlist(file, context) {
+  const result = checked("plutil", ["-convert", "json", "-o", "-", file], context, "DEV_MAC_SIGNING_CONFIG_INVALID");
+  try { return JSON.parse(result.stdout); }
+  catch { throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", `Invalid plist JSON: ${file}`); }
+}
+
+function decodeProfile(file, context) {
+  const cms = checked("security", ["cms", "-D", "-i", file], context, "DEV_MAC_SIGNING_PROFILE_INVALID");
+  // plutil JSON conversion rejects the date/data values in provisioning profiles.
+  const parser = "import base64,datetime,json,plistlib,sys\ndef encode(v):\n if isinstance(v,bytes): return base64.b64encode(v).decode('ascii')\n if isinstance(v,(datetime.date,datetime.datetime)): return v.isoformat()\n raise TypeError(type(v).__name__)\nprint(json.dumps(plistlib.loads(sys.stdin.buffer.read()),default=encode))";
+  const parsed = context.run("python3", ["-c", parser], { ...captureOptions(context.root, context.env), stdio: "pipe", input: cms.stdout });
+  try {
+    if (parsed.error || parsed.status !== 0) throw new Error(parsed.error?.message || output(parsed));
+    const profile = JSON.parse(parsed.stdout);
+    if (!Array.isArray(profile.TeamIdentifier) || profile.TeamIdentifier.length !== 1 || !profile.TeamIdentifier[0]) throw new Error("profile must name one team");
+    if (!profile.Platform?.includes("OSX")) throw new Error("profile must target OSX");
+    if (!(Date.parse(profile.ExpirationDate) > Date.now())) throw new Error("profile is expired or has no expiration date");
+    const certificates = (profile.DeveloperCertificates ?? []).map((data) => {
+      const cert = new X509Certificate(Buffer.from(data, "base64"));
+      return { name: /^CN=(.+)$/m.exec(cert.subject)?.[1], sha1: createHash("sha1").update(cert.raw).digest("hex").toUpperCase() };
+    });
+    if (!certificates.length) throw new Error("profile has no signing certificates");
+    return { profile, certificates, team: profile.TeamIdentifier[0] };
+  } catch (cause) {
+    throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_PROFILE_INVALID", `Cannot use provisioning profile ${file}: ${cause.message}. Configure a valid macOS profile authorizing this app and signing certificate.`, { cause });
+  }
+}
+
+export function resolveMacosDevelopmentSigning({ root, bundle, descriptor = {}, config = {}, env = process.env, run = spawnSync }) {
+  const context = { root, env, run };
+  const tauriRoot = path.dirname(path.resolve(root, descriptor.manifestPath ?? "src-tauri/Cargo.toml"));
+  let mac = {};
+  for (const name of ["tauri.conf.json", "tauri.macos.conf.json"]) {
+    const file = path.join(tauriRoot, name);
+    if (existsSync(file)) mac = { ...mac, ...JSON.parse(readFileSync(file, "utf8")).bundle?.macOS };
+  }
+  const sign = config.targets?.mac?.sign ?? {};
+  const entitlements = sign.entitlements ? path.resolve(root, sign.entitlements) : mac.entitlements ? path.resolve(tauriRoot, mac.entitlements) : null;
+  if (entitlements && !existsSync(entitlements)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", `Configured entitlements file is missing: ${entitlements}`);
+  const tauriProfile = mac.provisioningProfile ?? mac.files?.["embedded.provisionprofile"] ?? mac.files?.["/embedded.provisionprofile"];
+  const configuredProfile = sign.provisioningProfile ? path.resolve(root, sign.provisioningProfile) : tauriProfile ? path.resolve(tauriRoot, tauriProfile) : null;
+  const embedded = path.join(bundle, "Contents", "embedded.provisionprofile");
+  // App preparation may already embed an app-specific profile (e.g. HeardRight).
+  let provisioningProfile = configuredProfile ?? (existsSync(embedded) ? embedded : null);
+  if (provisioningProfile && !existsSync(provisioningProfile)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_PROFILE_INVALID", `Configured provisioning profile is missing: ${provisioningProfile}`);
+  let profileInfo = provisioningProfile ? decodeProfile(provisioningProfile, context) : null;
+  const override = env.APPLE_SIGNING_IDENTITY?.trim() || env.APPLE_DEVELOPER_ID?.trim();
+  const releaseTeam = env.APPLE_TEAM_ID?.trim() || DEFAULT_TEAM;
+  const configuredIdentity = sign.identity?.trim() || mac.signingIdentity?.trim();
+  if (override === "-" || (!profileInfo && configuredIdentity === "-")) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_IDENTITY_INVALID", 'Signing identity "-" is ad hoc; configure APPLE_SIGNING_IDENTITY or APPLE_DEVELOPER_ID with a real Team identity.', { identity: "-" });
+  const requestedIdentity = override || (!profileInfo ? configuredIdentity : undefined);
+  const expected = requestedIdentity || profileInfo?.certificates.map((cert) => cert.name).join(" or ") || `Developer ID Application (team ${releaseTeam})`;
+  const found = checked("security", ["find-identity", "-v", "-p", "codesigning"], context, "DEV_MAC_SIGNING_IDENTITY_MISSING", expected);
+  const identities = [...String(found.stdout ?? "").matchAll(/([A-Fa-f0-9]{40})\s+"([^"\n]+)"/g)].map((match) => ({ sha1: match[1].toUpperCase(), name: match[2] }));
+  const matchesRequest = (item, requested) => item.name === requested || item.sha1 === requested?.toUpperCase();
+  const profiled = (info) => identities.filter((item) => info.certificates.some((cert) => cert.sha1 === item.sha1) && /^(Apple Development|Mac Developer|Developer ID Application):/.test(item.name));
+  // A configured profile can go stale when its certificate is renewed: prefer a sibling profile for the
+  // same app identifier that authorizes a certificate whose private key is in this Keychain.
+  if (profileInfo && !profiled(profileInfo).length && configuredProfile) {
+    const appId = (info) => info.profile.Entitlements?.["com.apple.application-identifier"] ?? info.profile.Entitlements?.["application-identifier"];
+    const siblings = readdirSync(path.dirname(configuredProfile)).filter((name) => name.endsWith(".provisionprofile")).map((name) => path.join(path.dirname(configuredProfile), name)).filter((file) => path.resolve(file) !== path.resolve(configuredProfile));
+    const usable = siblings.flatMap((file) => { try { const info = decodeProfile(file, context); return appId(info) === appId(profileInfo) && profiled(info).length ? [{ file, info }] : []; } catch { return []; } })
+      .sort((a, b) => Date.parse(b.info.profile.ExpirationDate) - Date.parse(a.info.profile.ExpirationDate));
+    if (usable.length) { provisioningProfile = usable[0].file; profileInfo = usable[0].info; }
+  }
+  let candidates = profileInfo
+    ? profiled(profileInfo)
+    : identities.filter((item) => item.name.startsWith("Developer ID Application:") && item.name.endsWith(`(${releaseTeam})`));
+  if (requestedIdentity) candidates = candidates.filter((item) => matchesRequest(item, requestedIdentity));
+  else if (profileInfo && configuredIdentity && candidates.some((item) => matchesRequest(item, configuredIdentity))) candidates = candidates.filter((item) => matchesRequest(item, configuredIdentity));
+  if (candidates.length !== 1) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_IDENTITY_MISSING", `Signing identity ${JSON.stringify(expected)}: ${candidates.length ? "multiple matching identities" : "no valid matching identity/private key"} in Keychain${provisioningProfile ? ` for ${provisioningProfile}` : ""}. ${candidates.length ? "Set APPLE_SIGNING_IDENTITY or APPLE_DEVELOPER_ID to one matching identity." : "Confirm the profile-authorized certificate and its private key are available in Keychain Access in a logged-in GUI session."}`, { identity: expected });
+  return { identity: candidates[0].name, certificateSha1: candidates[0].sha1, teamIdentifier: profileInfo?.team ?? releaseTeam, entitlements, provisioningProfile };
+}
+
+function bundleInfo(directory, context) {
+  for (const location of ["Contents/Info.plist", "Resources/Info.plist", "Info.plist"]) {
+    const file = path.join(directory, location);
+    if (existsSync(file)) return readPlist(file, context);
+  }
+  return {};
+}
+
+function macho(file) {
+  const fd = openSync(file, "r");
+  try {
+    const magic = Buffer.alloc(4);
+    return readSync(fd, magic, 0, 4, 0) === 4 && new Set(["feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca"]).has(magic.toString("hex"));
+  } finally { closeSync(fd); }
+}
+
+export function signMacosDevelopmentBundle(options) {
+  const { root, bundle, env = process.env, run = spawnSync } = options;
+  const context = { root, env, run };
+  const signing = resolveMacosDevelopmentSigning({ ...options, env, run });
+  const { identity, certificateSha1, teamIdentifier, entitlements, provisioningProfile } = signing;
+  const embedded = path.join(bundle, "Contents", "embedded.provisionprofile");
+  if (provisioningProfile && path.resolve(provisioningProfile) !== path.resolve(embedded)) copyFileSync(provisioningProfile, embedded);
+  const scratch = mkdtempSync(path.join(os.tmpdir(), "rightkit-dev-signing-"));
+  try {
+    const appInfo = bundleInfo(bundle, context);
+    const appEntitlements = entitlements ? readPlist(entitlements, context) : {};
+    // Loose tools cannot claim the parent app's profile-restricted entitlements.
+    // Retain their existing entitlements; give unsigned tools only the app's runtime relaxations.
+    const runtimeEntitlements = Object.fromEntries(Object.entries(appEntitlements).filter(([key]) => key.startsWith("com.apple.security.cs.") || key === "com.apple.security.device.audio-input"));
+    const runtimeFile = path.join(scratch, "runtime.plist");
+    writeFileSync(runtimeFile, JSON.stringify(runtimeEntitlements));
+    checked("plutil", ["-convert", "xml1", runtimeFile], context, "DEV_MAC_SIGNING_CONFIG_INVALID", identity);
+    // Apps keep sidecar/helper variants beside their main entitlements file:
+    // entitlements-engine.plist, entitlements-cloudsync.plist, entitlements-credentials.plist.
+    const entitlementVariants = entitlements ? readdirSync(path.dirname(entitlements))
+      .filter((name) => name.startsWith(`${path.basename(entitlements, path.extname(entitlements))}-`) && name.endsWith(".plist"))
+      .map((name) => ({ file: path.join(path.dirname(entitlements), name), suffix: path.basename(name, ".plist").slice(path.basename(entitlements, path.extname(entitlements)).length + 1).toLowerCase() }))
+      .sort((a, b) => b.suffix.length - a.suffix.length) : [];
+    const targets = [];
+    const bundleExecutables = new Set();
+    const visit = (directory, isBundle = false) => {
+      const info = isBundle ? bundleInfo(directory, context) : {};
+      if (info.CFBundleExecutable) {
+        for (const file of [path.join(directory, "Contents/MacOS", info.CFBundleExecutable), path.join(directory, info.CFBundleExecutable)]) {
+          if (existsSync(file)) bundleExecutables.add(realpathSync(file));
+        }
+      }
+      for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const file = path.join(directory, entry.name);
+        if (entry.isSymbolicLink()) continue;
+        if (entry.isDirectory()) visit(file, /\.(app|framework|xpc|appex|bundle)$/.test(entry.name));
+        else if (entry.isFile() && macho(file)) targets.push({ file, info: null });
+      }
+      if (isBundle) targets.push({ file: directory, info });
+    };
+    visit(bundle, true);
+    const ordered = targets.filter((target) => target.info || !bundleExecutables.has(realpathSync(target.file)))
+      .sort((a, b) => b.file.split(path.sep).length - a.file.split(path.sep).length || a.file.localeCompare(b.file));
+    const commands = [];
+    for (const target of ordered) {
+      // Bind the exact profile-authorized certificate even when names collide in Keychain.
+      const args = ["--force", "--options", "runtime", "--sign", certificateSha1];
+      const parent = target.file === bundle;
+      const profiledHelper = target.info && existsSync(path.join(target.file, "Contents/embedded.provisionprofile")) && target.info.CFBundleIdentifier === appInfo.CFBundleIdentifier;
+      if (profiledHelper && !parent && provisioningProfile) copyFileSync(embedded, path.join(target.file, "Contents/embedded.provisionprofile"));
+      const variant = !parent && entitlementVariants.find((item) => path.basename(target.file).replace(/\.(app|xpc|appex|bundle)$/, "").toLowerCase().endsWith(item.suffix));
+      if (variant) args.push("--entitlements", variant.file);
+      else if (entitlements && (parent || profiledHelper)) args.push("--entitlements", entitlements);
+      else {
+        const existing = run("codesign", ["--display", "--entitlements", ":-", target.file], captureOptions(root, env));
+        if (existing.status === 0 && /<plist|<dict/.test(String(existing.stdout ?? ""))) args.push("--preserve-metadata=entitlements");
+        else if (!target.info && (statSync(target.file).mode & 0o111) && !/\.(dylib|so)$/.test(target.file) && Object.keys(runtimeEntitlements).length) args.push("--entitlements", runtimeFile);
+      }
+      commands.push([...args, target.file]);
+    }
+    const signed = runMacCodesignCommands(commands, { ...options.sessionOptions, cwd: root, env, run });
+    for (const [index, args] of commands.entries()) checked("codesign", args, { ...context, run: () => signed[index] }, "DEV_MAC_SIGNING_FAILED", identity);
+    checked("codesign", ["--verify", "--strict", "--deep", bundle], context, "DEV_MAC_SIGNATURE_INVALID", identity);
+    const details = output(checked("codesign", ["--display", "--verbose=4", bundle], context, "DEV_MAC_SIGNATURE_INVALID", identity));
+    const actualTeam = /^TeamIdentifier=(.+)$/m.exec(details)?.[1]?.trim();
+    if (actualTeam !== teamIdentifier || /^Signature=adhoc$/m.test(details)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_TEAM_MISMATCH", `Signing identity ${JSON.stringify(identity)}: expected TeamIdentifier=${teamIdentifier}, found ${actualTeam ?? "missing"}. Refusing dev installation.`, { identity, expectedTeam: teamIdentifier, actualTeam });
+    return { ...signing, provisioningProfile: provisioningProfile ? embedded : null, verified: "strict-deep", signedTargets: ordered.length };
+  } finally { rmSync(scratch, { recursive: true, force: true }); }
+}

package/development.mjs

@@ -8,8 +8,10 @@ import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
 import { acquireManagedRunLease, managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
 import { BUNDLE_MARKERS, bundleMarkerBuffer, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
 import { installPortableDevelopment } from "./portable-development.mjs";
+import { signMacosDevelopmentBundle } from "./development-signing.mjs";
 
 export const DEVELOPMENT_PROFILE = "release-iterate";
+const RELEASE_ONLY_APPLE_ENV = ["APPLE_ID", "APPLE_PASSWORD", "APPLE_API_KEY", "APPLE_API_ISSUER", "APPLE_API_KEY_PATH", "APPLE_CERTIFICATE", "APPLE_CERTIFICATE_PASSWORD"];
 
 export function developmentEnvironment(env = process.env) {
   const result = {
@@ -18,12 +20,9 @@ export function developmentEnvironment(env = process.env) {
     RIGHTKIT_CARGO_PROFILE: DEVELOPMENT_PROFILE,
     TAURI_SIGNING_PRIVATE_KEY: "",
     TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "",
-    APPLE_SIGNING_IDENTITY: "-",
-    APPLE_ID: "",
-    APPLE_PASSWORD: "",
-    APPLE_TEAM_ID: "",
     CSC_IDENTITY_AUTO_DISCOVERY: "false",
   };
+  for (const key of RELEASE_ONLY_APPLE_ENV) delete result[key];
   delete result.CARGO_INCREMENTAL;
   const client = managedRuntimeClient(result);
   if (client) {
@@ -76,8 +75,8 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
     const startedMs = Date.now();
     for (const command of target.build) execute(command, { root, env: childEnv, dryRun, run, label: "build" });
     if (buildOnly || !target.install) return { built: true, installed: false };
-    install(target.install, { root, platform, env: childEnv, run, sinceMs: startedMs });
-    return { built: true, installed: true };
+    const signing = install(target.install, { root, platform, config, env: childEnv, run, sinceMs: startedMs });
+    return { built: true, installed: true, ...(platform === "mac" && target.install.kind === "tauri" ? { signing } : {}) };
   } finally { lease.release(); }
 }
 
@@ -85,7 +84,7 @@ export function assertNativeDevelopmentHost(platform, host = process.platform) {
   if ((platform === "win" && host !== "win32") || (platform === "mac" && host !== "darwin")) throw new Error(`development target ${platform} requires its native host`);
 }
 
-function install(descriptor, { root, platform, env, run, sinceMs = null }) {
+function install(descriptor, { root, platform, config, env, run, sinceMs = null }) {
   if (descriptor.kind === "command") return execute(descriptor, { root, env, run, label: "install" });
   if (descriptor.kind === "portable") return installPortableDevelopment(descriptor, { root, platform: platform === "win" ? "win32" : "darwin", env });
   if (platform === "win") {
@@ -111,11 +110,10 @@ function install(descriptor, { root, platform, env, run, sinceMs = null }) {
   const backup = `${destination}.rightkit-backup-${process.pid}`;
   rmSync(staging, { recursive: true, force: true });
   rmSync(backup, { recursive: true, force: true });
-  cpSync(app, staging, { recursive: true });
-  const signature = run("codesign", ["--force", "--deep", "--preserve-metadata=entitlements", "--sign", "-", staging], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
-  if (signature.status !== 0) { rmSync(staging, { recursive: true, force: true }); throw new Error(`ad-hoc signing failed (${signature.status}): ${staging}`); }
-  const verified = run("codesign", ["--verify", "--deep", "--strict", staging], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
-  if (verified.status !== 0) { rmSync(staging, { recursive: true, force: true }); throw new Error(`ad-hoc signature verification failed (${verified.status}): ${staging}`); }
+  cpSync(app, staging, { recursive: true, verbatimSymlinks: true });
+  let signing;
+  try { signing = signMacosDevelopmentBundle({ root, bundle: staging, descriptor, config, env, run }); }
+  catch (error) { rmSync(staging, { recursive: true, force: true }); throw error; }
   let backedUp = false;
   try {
     if (existsSync(destination)) { renameSync(destination, backup); backedUp = true; }
@@ -128,6 +126,9 @@ function install(descriptor, { root, platform, env, run, sinceMs = null }) {
     rmSync(staging, { recursive: true, force: true });
     throw error;
   }
+  if (signing.provisioningProfile) signing.provisioningProfile = path.join(destination, "Contents", "embedded.provisionprofile");
+  console.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; profile=${signing.provisioningProfile ?? "none"}`);
+  return signing;
 }
 
 export function resolveTauriArtifact(descriptor, { root, platform, env = process.env, runCargo = runCargoSync }) {
@@ -268,6 +269,7 @@ export async function main(args = process.argv.slice(2)) {
   const absoluteConfig = path.resolve(configPath);
   const safeEnv = developmentEnvironment(process.env);
   for (const [key, value] of Object.entries(safeEnv)) process.env[key] = value;
+  for (const key of RELEASE_ONLY_APPLE_ENV) delete process.env[key];
   delete process.env.CARGO_INCREMENTAL;
   const pathKey = Object.keys(process.env).find((key) => key.toLowerCase() === "path");
   if (pathKey) process.env[pathKey] = safeEnv[pathKey] ?? process.env[pathKey];
@@ -279,5 +281,5 @@ export async function main(args = process.argv.slice(2)) {
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
-  main().catch((error) => { console.error(`right-release dev: ${error.message}`); process.exitCode = 1; });
+  main().catch((error) => { console.error(`right-release dev: ${error.code ? `[${error.code}] ` : ""}${error.message}`); process.exitCode = 1; });
 }