@rightkit/release 0.2.134 → 0.2.136

package/signing-agent-client.mjs

@@ -6,7 +6,34 @@ import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { signingAgentPaths, privatePath, SigningAgentError, MAX_FRAME } from "./rightkit-signing-agent.mjs";
 
-export async function requestSigningAgent(request, { paths = signingAgentPaths(), timeoutMs = 185000,
+export function validateNotaryAgentReport(report) {
+  const fields = (value, allowed) => value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).every((key) => allowed.includes(key));
+  const uuid = (value) => typeof value === "string" && /^[a-f0-9-]{36}$/i.test(value);
+  const n = report?.notarization;
+  const summary = n?.logSummary;
+  if (!fields(report, ["schema", "ok", "id", "notarization", "steps", "stapling", "code", "message"])
+    || report.schema !== 1 || typeof report.ok !== "boolean" || !uuid(report.id)
+    || (report.code !== undefined && !["MAC_SIGNING_AGENT_TIMEOUT", "MAC_SIGNING_AGENT_JOB_FAILED", "MAC_SIGNING_NOTARIZATION_FAILED", "MAC_SIGNING_STAPLE_FAILED"].includes(report.code))
+    || (report.message !== undefined && !["Notarization deadline expired", "Notarization or stapling failed inside signing agent"].includes(report.message))
+    || !fields(n, ["id", "status", "logSummary"]) || !(n.id === null || uuid(n.id))
+    || !["Accepted", "Invalid", "Unknown", "In Progress", "Rejected"].includes(n.status)
+    || !(summary === null || (fields(summary, ["statusCode", "errors", "warnings", "issues"])
+      && (summary.statusCode === null || Number.isInteger(summary.statusCode))
+      && Number.isInteger(summary.errors) && summary.errors >= 0 && Number.isInteger(summary.warnings) && summary.warnings >= 0
+      && Array.isArray(summary.issues) && summary.issues.length <= 100 && summary.issues.every((issue) => fields(issue, ["severity", "code"])
+        && ["error", "warning", "unknown"].includes(issue.severity) && (issue.code === null || Number.isInteger(issue.code)))))
+    || !Array.isArray(report.steps) || report.steps.length > 10 || report.steps.some((step) => !fields(step, ["step", "file", "exitCode"])
+      || !["submit", "log", "probe", "staple", "validate"].includes(step.step)
+      || !(step.exitCode === null || (Number.isInteger(step.exitCode) && step.exitCode >= 0 && step.exitCode <= 255)))
+    || !Array.isArray(report.stapling) || report.stapling.length > 2 || report.stapling.some((item) => !fields(item, ["file", "alreadyStapled", "validated"])
+      || typeof item.file !== "string" || !path.isAbsolute(item.file) || typeof item.alreadyStapled !== "boolean" || item.validated !== true)) {
+    throw new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Invalid notarization agent report");
+  }
+  return report;
+}
+
+export async function requestSigningAgent(request, { paths = signingAgentPaths(), timeoutMs = (request.timeoutMs ?? 180000) + 5000,
+  onProgress = () => {},
   io = fs, connect = net.createConnection } = {}) {
   try {
     privatePath(paths.directory, 0o700, { io, kind: "directory" });
@@ -23,7 +50,7 @@ export async function requestSigningAgent(request, { paths = signingAgentPaths()
   if (frame.length > MAX_FRAME) throw new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Signing request is too large");
   return new Promise((resolve, reject) => {
     const socket = connect({ path: paths.socket });
-    let input = Buffer.alloc(0), settled = false;
+    let input = Buffer.alloc(0), settled = false, jobId;
     const finish = (error, report) => {
       if (settled) return;
       settled = true; clearTimeout(timer); socket.destroy();
@@ -38,30 +65,53 @@ export async function requestSigningAgent(request, { paths = signingAgentPaths()
     socket.on("data", (chunk) => {
       input = Buffer.concat([input, chunk]);
       if (input.length > MAX_FRAME) { finish(new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Signing agent response is too large")); return; }
-      const end = input.indexOf(10);
-      if (end < 0) return;
       try {
-        const report = JSON.parse(input.subarray(0, end).toString("utf8"));
-        if (end !== input.length - 1 || report.schema !== 1 || typeof report.ok !== "boolean") throw new Error();
-        if (!report.ok) {
-          const code = typeof report.code === "string" && report.code.startsWith("MAC_SIGNING_") ? report.code : "MAC_SIGNING_AGENT_JOB_FAILED";
-          finish(new SigningAgentError(code, request.type === "updater" ? "Updater signing failed inside signing agent" : String(report.message ?? "Signing agent rejected request")));
-          return;
+        while (input.indexOf(10) >= 0 && !settled) {
+          const end = input.indexOf(10);
+          const report = JSON.parse(input.subarray(0, end).toString("utf8"));
+          input = input.subarray(end + 1);
+          const notary = ["notarize", "staple"].includes(request.type);
+          if (report.event) {
+            if (!notary || report.schema !== 1 || !["status", "heartbeat"].includes(report.event)
+              || typeof report.id !== "string" || !/^[a-f0-9-]{36}$/i.test(report.id)
+              || Object.keys(report).some((key) => !["schema", "event", "id", "step"].includes(key))
+              || (report.step !== undefined && !["submit", "log", "probe", "staple", "validate"].includes(report.step))) throw new Error();
+            if (jobId && jobId !== report.id) throw new Error();
+            jobId = report.id;
+            onProgress(report);
+            continue;
+          }
+          if (input.length || report.schema !== 1 || typeof report.ok !== "boolean") throw new Error();
+          if (notary && report.notarization) validateNotaryAgentReport(report);
+          if (notary && jobId && jobId !== report.id) throw new Error();
+          if (!report.ok) {
+            const code = typeof report.code === "string" && report.code.startsWith("MAC_SIGNING_") ? report.code : "MAC_SIGNING_AGENT_JOB_FAILED";
+            const error = new SigningAgentError(code, request.type === "updater" ? "Updater signing failed inside signing agent" : notary ? "Notarization or stapling failed inside signing agent" : String(report.message ?? "Signing agent rejected request"));
+            if (notary && report.notarization) error.report = report;
+            finish(error);
+            return;
+          }
+          if (notary) {
+            validateNotaryAgentReport(report);
+          } else if (request.type === "health") {
+            if (report.service !== "dev.rightkit.signing-agent" || !Number.isInteger(report.pid)) throw new Error();
+          } else if (request.type === "codesign-argv") {
+            if (!Array.isArray(report.results) || report.results.length !== 1
+              || report.results.some((r) => !Number.isInteger(r.status) || r.status < 0 || r.status > 255
+                || typeof r.stdout !== "string" || typeof r.stderr !== "string")) throw new Error();
+          } else if (!Array.isArray(report.results) || report.results.length !== (request.items?.length ?? request.files?.length)
+            || report.results.some((r) => r.status !== 0 || typeof r.stdout !== "string" || typeof r.stderr !== "string")
+            || (request.type === "updater" && report.results.some((r) => r.stdout || r.stderr))) throw new Error();
+          finish(null, report);
         }
-        if (request.type === "health") {
-          if (report.service !== "dev.rightkit.signing-agent" || !Number.isInteger(report.pid)) throw new Error();
-        } else if (!Array.isArray(report.results) || report.results.length !== (request.items?.length ?? request.files?.length)
-          || report.results.some((r) => r.status !== 0 || typeof r.stdout !== "string" || typeof r.stderr !== "string")
-          || (request.type === "updater" && report.results.some((r) => r.stdout || r.stderr))) throw new Error();
-        finish(null, report);
       } catch { finish(new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Invalid signing agent response")); }
     });
   });
 }
-export function requestSigningAgentSync(request, { runClient = spawnSync, home, timeoutMs = 185000 } = {}) {
+export function requestSigningAgentSync(request, { runClient = spawnSync, home, timeoutMs = (request.timeoutMs ?? 180000) + 5000 } = {}) {
   // Existing signing call sites are synchronous. Only typed JSON goes to this
   // child's stdin; credentials & authentication token never enter argv/env.
-  const result = runClient(process.execPath, [fileURLToPath(import.meta.url)], { encoding: "utf8", stdio: "pipe", shell: false,
+  const result = runClient(process.execPath, [fileURLToPath(import.meta.url)], { encoding: "utf8", stdio: ["pipe", "pipe", "inherit"], shell: false,
     input: JSON.stringify({ request, home, timeoutMs }), timeout: timeoutMs + 1000, maxBuffer: MAX_FRAME,
     env: { PATH: process.env.PATH, HOME: process.env.HOME } });
   let report;
@@ -69,17 +119,23 @@ export function requestSigningAgentSync(request, { runClient = spawnSync, home,
     throw new SigningAgentError(result.error?.code === "ETIMEDOUT" ? "MAC_SIGNING_AGENT_TIMEOUT" : "MAC_SIGNING_AGENT_CONNECTION", "Signing agent client failed");
   }
   if (report.schema !== 1 || typeof report.ok !== "boolean") throw new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Invalid signing agent client report");
-  if (!report.ok) throw new SigningAgentError(report.code ?? "MAC_SIGNING_AGENT_JOB_FAILED", report.message ?? "Signing agent failed");
+  if (!report.ok) {
+    const error = new SigningAgentError(report.code ?? "MAC_SIGNING_AGENT_JOB_FAILED", report.message ?? "Signing agent failed");
+    if (["notarize", "staple"].includes(request.type) && report.notarization) error.report = validateNotaryAgentReport(report);
+    throw error;
+  }
   if (result.error || result.status !== 0) throw new SigningAgentError("MAC_SIGNING_AGENT_CONNECTION", "Signing agent client failed");
   return report;
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const { request, home, timeoutMs } = JSON.parse(fs.readFileSync(0, "utf8"));
-    const report = await requestSigningAgent(request, { paths: signingAgentPaths(home), timeoutMs });
+    const report = await requestSigningAgent(request, { paths: signingAgentPaths(home), timeoutMs,
+      onProgress: (frame) => process.stderr.write(`right-release signing-agent: ${frame.id} ${frame.step ?? frame.event}\n`) });
     process.stdout.write(JSON.stringify(report));
   } catch (error) {
-    process.stdout.write(JSON.stringify({ schema: 1, ok: false, code: error.code ?? "MAC_SIGNING_AGENT_PROTOCOL", message: error.message }));
+    process.stdout.write(JSON.stringify(error.report ?? { schema: 1, ok: false, code: error.code ?? "MAC_SIGNING_AGENT_PROTOCOL", message: error.message }));
     process.exitCode = 1;
   }
 }

package/signing-agent-command.mjs

@@ -5,10 +5,11 @@ const [command, ...args] = process.argv.slice(2);
 try {
   let result;
   if (command === "install") {
-    const options = {};
-    if (args.length) {
-      if (args.length !== 2 || args[0] !== "--managed-root" || !args[1]) throw new TypeError("Expected install [--managed-root <absolute-directory>]");
-      options.managedRoot = args[1];
+    const options = { cargoTargetDirs: [] };
+    for (let i = 0; i < args.length; i += 2) {
+      if (!["--managed-root", "--cargo-target-dir"].includes(args[i]) || !args[i + 1]) throw new TypeError("Expected install [--managed-root <directory>] [--cargo-target-dir <directory>]...");
+      if (args[i] === "--managed-root") options.managedRoot = args[i + 1];
+      else options.cargoTargetDirs.push(args[i + 1]);
     }
     result = installSigningAgent(options);
   } else if (command === "uninstall" && !args.length) result = uninstallSigningAgent();

package/signing-agent-install.mjs

@@ -1,3 +1,4 @@
+import { resolveManagedRoots } from './managed-roots.mjs';
 import * as fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -6,6 +7,8 @@ import { AGENT_LABEL, signingAgentPaths, defaultSigningRoots, ensurePrivateDirec
 import { requestSigningAgentSync } from "./signing-agent-client.mjs";
 
 const capture = { encoding: "utf8", stdio: "pipe", shell: false, timeout: 10000 };
+function sleepMs(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
+
 export function requireMacGuiSession({ run = spawnSync, uid = process.getuid?.() } = {}) {
   const session = run("/bin/launchctl", ["print", `gui/${uid}`], capture);
   if (session.error || session.status !== 0) throw new SigningAgentError("MAC_SIGNING_NO_GUI_SESSION", `No logged-in Aqua session for uid ${uid}`);
@@ -27,7 +30,7 @@ export function signingAgentPlist({ paths, node = process.execPath, home }) {
 }
 export function installSigningAgent({ home = os.userInfo().homedir, username = os.userInfo().username,
   uid = process.getuid?.(), platform = process.platform, run = spawnSync, io = fs, node = process.execPath,
-  managedRoot = "/Volumes/D/.rightkit-managed", health = requestSigningAgentSync,
+  managedRoot = resolveManagedRoots({ home }).dataRoot, cargoTargetDirs = [], health = requestSigningAgentSync,
   now = Date.now, sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms) } = {}) {
   if (platform !== "darwin") throw new SigningAgentError("MAC_SIGNING_AGENT_PLATFORM", "Signing agent requires macOS");
   requireMacGuiSession({ run, uid });
@@ -41,14 +44,26 @@ export function installSigningAgent({ home = os.userInfo().homedir, username = o
   const pnpm = String(found.stdout ?? "").trim();
   if (found.error || found.status !== 0 || !path.isAbsolute(pnpm) || pnpm.includes("\n")) throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", "Provisioned pnpm executable is unavailable");
   // Resident runtime is self-contained; no package/checkout imports after install.
-  for (const name of ["rightkit-signing-agent.mjs", "background-process.mjs"]) {
+  for (const root of cargoTargetDirs) {
+    if (typeof root !== "string" || !path.isAbsolute(root) || ["/", home, "/Volumes", "/Volumes/D"].includes(path.resolve(root))) throw new SigningAgentError("MAC_SIGNING_AGENT_PATH_DENIED", "Cargo target root must be a dedicated absolute directory");
+  }
+  for (const name of ["rightkit-signing-agent.mjs", "background-process.mjs", "codesign-argv.mjs", "managed-roots.mjs"]) {
     const target = path.join(paths.runtime, name);
     if (io.existsSync(target)) privatePath(target, 0o600, { io, uid });
     io.writeFileSync(target, io.readFileSync(new URL(`./${name}`, import.meta.url)), { mode: 0o600 });
   }
   if (io.existsSync(paths.config)) privatePath(paths.config, 0o600, { io, uid });
+  // SSH & Aqua can inherit different TMPDIR spellings. Include both aliases of
+  // this uid's Darwin temp root, since bundlers can canonicalize temporary paths.
+  const temp = run("/usr/bin/getconf", ["DARWIN_USER_TEMP_DIR"], capture);
+  const directory = String(temp.stdout ?? "").trim();
+  const temporaryRoots = [];
+  if (!temp.error && temp.status === 0 && path.isAbsolute(directory) && !directory.includes("\n")) {
+    temporaryRoots.push(path.resolve(directory));
+    try { temporaryRoots.push((io.realpathSync.native ?? io.realpathSync)(directory)); } catch {}
+  }
   io.writeFileSync(paths.config, JSON.stringify({ schema: 1, home, username, pnpm,
-    roots: defaultSigningRoots(home, path.resolve(managedRoot)),
+    roots: defaultSigningRoots(home, path.resolve(managedRoot), [...cargoTargetDirs.map((root) => path.resolve(root)), ...temporaryRoots]),
     environmentPath: [...new Set([path.dirname(node), path.dirname(pnpm), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"])].join(":") }), { mode: 0o600 });
   ensurePrivateDirectory(path.dirname(paths.plist), { io, uid });
   if (io.existsSync(paths.plist)) privatePath(paths.plist, 0o600, { io, uid });
@@ -57,8 +72,20 @@ export function installSigningAgent({ home = os.userInfo().homedir, username = o
   if (!loaded.error && loaded.status === 0) {
     const stopped = run("/bin/launchctl", ["bootout", `gui/${uid}/${AGENT_LABEL}`], capture);
     if (stopped.error || stopped.status !== 0) throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", "Could not stop existing signing agent");
+    // bootout is asynchronous: wait until launchd has released the label before bootstrapping again.
+    const gone = now() + 10000;
+    while (now() < gone) {
+      const still = run("/bin/launchctl", ["print", `gui/${uid}/${AGENT_LABEL}`], capture);
+      if (still.error || still.status !== 0) break;
+      sleepMs(100);
+    }
+  }
+  let boot = run("/bin/launchctl", ["bootstrap", `gui/${uid}`, paths.plist], capture);
+  // Exit 5 (EIO) is launchd still tearing the old job down; retry briefly.
+  for (let attempt = 0; attempt < 20 && !boot.error && boot.status === 5; attempt++) {
+    sleepMs(250);
+    boot = run("/bin/launchctl", ["bootstrap", `gui/${uid}`, paths.plist], capture);
   }
-  const boot = run("/bin/launchctl", ["bootstrap", `gui/${uid}`, paths.plist], capture);
   if (boot.error || boot.status !== 0) {
     requireMacGuiSession({ run, uid });
     throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", `Signing agent bootstrap failed (exit ${boot.status ?? "unavailable"})`);

package/standalone-clone-verify.mjs

@@ -1,4 +1,4 @@
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
@@ -140,7 +140,8 @@ function parseArgs(argv) {
   return { apps, evidencePath };
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const evidence = await verifyStandaloneClones(parseArgs(process.argv.slice(2)));
     for (const app of evidence.apps) process.stdout.write(`[standalone] ${app.key} ${app.revision.slice(0, 12)} install+doctor passed\n`);

package/tauri-bundle-marker.mjs

@@ -10,7 +10,7 @@
 // a byte changing outside the marker all mean the assumption no longer holds.
 
 import { createHash } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -147,7 +147,8 @@ function sha256(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const argv = process.argv.slice(2);
   const bundleIndex = argv.indexOf("--bundle");
   const bundle = bundleIndex >= 0 ? argv[bundleIndex + 1] : "nsis";

package/upload-large.mjs

@@ -1,86 +1,40 @@
 #!/usr/bin/env node
-import { accessSync, statSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-
-const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
-const BUCKETS = new Map([
-  ["public", "rightapps-downloads"],
-  ["private", "rightapps-updates"],
-]);
-const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
-
-const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
-if (!localFile || !r2Key) {
-  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
-  process.exit(1);
-}
-
-const bucket = BUCKETS.get(bucketAlias);
-if (!bucket) {
-  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
-  process.exit(1);
-}
-
-try {
-  accessSync(localFile);
-} catch {
-  console.error(`upload-large: missing local file: ${localFile}`);
-  process.exit(1);
-}
-
-const fileSize = statSync(localFile).size;
-const object = `${bucket}/${r2Key}`;
-const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
-const env = cleanCloudflareEnv(process.env);
-
-console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
-console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
-
-// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
-// and that must fail here rather than after a signed build has already been produced.
-const runner = resolveRunner(env);
-if (!runner) {
-  console.error(
-    "upload-large: no package runner found. Tried: " +
-      "pnpm dlx. Install the pinned workspace package manager before release.",
-  );
-  process.exit(1);
-}
-console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
-
-if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
-  process.exit(0);
-}
-
-const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
-  env,
-  stdio: "inherit",
-  shell: process.platform === "win32",
-  windowsHide: true,
-});
-
-if (result.error) {
-  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
-  process.exit(1);
-}
-process.exit(result.status ?? 1);
-
-function resolveRunner(env) {
-  const probe = spawnSync(RUNNER.cmd, ["--version"], {
-    env,
-    stdio: "ignore",
-    shell: process.platform === "win32",
-    windowsHide: true,
-  });
-  return !probe.error && probe.status === 0 ? RUNNER : null;
-}
-
-function cleanCloudflareEnv(source) {
-  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
-  delete env.CLOUDFLARE_API_KEY;
-  delete env.CLOUDFLARE_EMAIL;
-  delete env.CF_API_KEY;
-  delete env.CF_EMAIL;
-  return env;
+import { verifySealedRelease } from "./release-state.mjs";
+import { uploadVerifiedR2File } from "./r2-verified-upload.mjs";
+import { resolveCloudflareApiToken } from "./protected-credentials.mjs";
+
+export function runLargeUpload(argv, { run = spawnSync, env = process.env, credentialStore } = {}) {
+  const [localFile, r2Key, bucketAlias = "public", flag, evidencePath, ...extra] = argv;
+  if (!localFile || !r2Key) throw new Error("Usage: upload-large <file> <key> public|private --evidence <json> | --seal <sealed-dir>");
+  if (!["public", "private"].includes(bucketAlias)) throw new Error(`invalid bucket alias ${bucketAlias}; expected public|private`);
+  if (!["--evidence", "--seal"].includes(flag) || !evidencePath || extra.length) throw new Error("publication seal or hash evidence is required (--seal or --evidence)");
+  let evidence;
+  if (flag === "--seal") {
+    const sealed = verifySealedRelease(path.resolve(evidencePath));
+    if (path.dirname(path.resolve(localFile)) !== path.resolve(sealed.sealedDir)) throw new Error("artifact is outside sealed directory");
+    evidence = sealed.manifest.files.find((entry) => entry.name === path.basename(localFile));
+  } else {
+    const value = JSON.parse(readFileSync(evidencePath, "utf8"));
+    evidence = { sha256: value.artifactSha256, sizeBytes: value.sizeBytes };
+  }
+  // Validate before runner discovery or any remote operation, including dry runs.
+  uploadVerifiedR2File(localFile, evidence, r2Key, bucketAlias, { dryRun: true });
+  // The Cloudflare token is resolved only for a real upload; it is injected into the Wrangler child environment alone.
+  const dryRun = env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1";
+  const token = resolveCloudflareApiToken({ env, credentialStore, required: !dryRun });
+  const uploadEnv = dryRun ? env : { ...env, CLOUDFLARE_API_TOKEN: token };
+  const probe = run("pnpm", ["--version"], { env, stdio: "ignore", shell: process.platform === "win32", windowsHide: true });
+  if (probe.error || probe.status !== 0) throw new Error("no package runner found: pnpm dlx");
+  const object = `${bucketAlias === "public" ? "rightapps-downloads" : "rightapps-updates"}/${r2Key}`;
+  console.log(`wrangler r2 object put ${object} --remote (mandatory hash readback)`);
+  console.log("runner: pnpm dlx");
+  return uploadVerifiedR2File(localFile, evidence, r2Key, bucketAlias, { run, env: uploadEnv, dryRun });
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { runLargeUpload(process.argv.slice(2)); }
+  catch (error) { console.error(`upload-large: ${error.message}`); process.exitCode = 1; }
 }

package/verifier.mjs

@@ -13,6 +13,9 @@
  * human nor a model can hand-edit its way to a grant.
  */
 import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 export const GRANTS = Object.freeze(["BUILD_AUTHORIZED", "SIGNING_AUTHORIZED", "RELEASE_AUTHORIZED"]);
 
@@ -136,7 +139,8 @@ function decision(grant, granted, issues, input) {
   return body;
 }
 
-const invokedDirectly = process.argv[1] && process.argv[1].endsWith("verifier.mjs");
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+const invokedDirectly = process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url));
 if (invokedDirectly) {
   const grant = process.argv[2];
   let input = {};