@rightkit/release 0.2.134 → 0.2.136

package/cli/right-release.mjs

@@ -42,6 +42,7 @@ try {
   if (githubBuildCommands.has(first)
     || first?.startsWith("-")
     || (first === "addon" && args[1] === "build")
+    || (first === "dmg" && args[1] === "build")
     || (first === "publish" && ["cargo", "swift"].includes(args[1]))) {
     assertReleaseExecutionAllowed({ command: `right-release ${args.join(" ")}`.trim() });
   }
@@ -63,6 +64,8 @@ if (first === "--version" || first === "-v") {
   } else {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
+} else if (first === "hooks") {
+  run("ownership-hooks.mjs", args.slice(1));
 } else if (first === "suite-doctor") {
   runTest(
     ["--test", path.join(packageRoot, "right-suite-contract.test.mjs")],
@@ -70,6 +73,10 @@ if (first === "--version" || first === "-v") {
   );
 } else if (first === "cache") {
   run("cache-command.mjs", args.slice(1));
+} else if (first === "install-app") {
+  run("install-app.mjs", args.slice(1));
+} else if (first === "dmg") {
+  run("dmg-build.mjs", args.slice(1));
 } else if (first === "apple") {
   run("apple-profile-renew.mjs", args.slice(1));
 } else if (first === "publish") {
@@ -83,6 +90,12 @@ if (first === "--version" || first === "-v") {
   } else {
     run("upload-release.mjs", rest);
   }
+} else if (first === "inventory") {
+  if (args[1] !== "check") {
+    console.error("right-release inventory: expected check");
+    process.exit(2);
+  }
+  run("inventory-check.mjs", args.slice(2));
 } else if (first === "model") {
   const rest = args.slice(1);
   if (rest[0] !== "promote") {
@@ -155,12 +168,20 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
+  dmg build --app <.app> --out <dmg> --volname <name> [--background <png>]
+            [--icon-size N] [--app-position x,y] [--applications-position x,y] [--window w,h]
+                                                      Build branded UDZO image without Finder
+  install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id <id>] [--dest /Applications]
+              [--relaunch|--no-relaunch] [--json]
+                                                      Verify a signed DMG, quit, replace & relaunch hidden; no UI, no osascript (macOS)
   build [--platform mac|win] [--skip-checks] [--resume-from <phase>]
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]
                                                       Incremental unsigned build & optional local install
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
+  publish-update --release <id> --platform mac|win --tier patch|update
+                                                      Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
   publish                                             Compatibility alias for upload
   publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish
@@ -169,6 +190,8 @@ Commands:
                                                       (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish swift [--repo <git-url>] [--dry-run] Test, tag, resolve a fresh exact-pin consumer, and publish RightKitSwift to its git repo
+  inventory check [--json] [--warn-only] [--md <file>] [--no-cache]
+                                                      Registry, account, dependency, app & hygiene drift (public endpoints)
   model promote --authority <app-key> --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
   addon doctor|build|upload|adopt <options>           Manage a signed headless add-on
@@ -179,10 +202,13 @@ Commands:
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories
   ownership [--app <dir>] [--json]                   Fail on app copies of RightKit-owned capabilities
+  ownership --staged [--app <dir>] [--json]          Pre-commit gate: scan the staged index for block-tier findings
+  hooks install [--app <dir>]                        Install the advisory pre-commit ownership gate (pinned @rightkit/release)
   ownership enroll [--root] [--name <device>] [--root-fingerprint <sha256>] [--app <dir>]
                                                       Enroll one native key or create a signed-device request
   ownership approve-key <fingerprint|request.json>    Approve one pending device key from an active host
   ownership revoke-key <fingerprint>                  Revoke one active device key
+  ownership trust-sync                               Advance this host's protected trust to the committed key log
   ownership-approval --draft <input.json> [--out <draft.json>]
                                                       Draft an exception for native owner approval
   ownership-approval --verify <signed.json> --context <scan.json>

package/codesign-argv.mjs

@@ -0,0 +1,64 @@
+import path from "node:path";
+
+// Closed grammar shared by shim & agent. Never accept executable names, an
+// environment, keychains, detached signatures, or file-producing display flags.
+export function parseCodesignArgv(argv, cwd) {
+  const deny = () => { const error = new Error("Unsupported codesign argv"); error.code = "MAC_SIGNING_AGENT_ARGV_DENIED"; throw error; };
+  if (!Array.isArray(argv) || !argv.length || argv.length > 8192
+    || argv.some((arg) => typeof arg !== "string" || !arg || arg.includes("\0") || arg.length > 32768)
+    || typeof cwd !== "string" || !path.isAbsolute(cwd)) deny();
+  const targets = [], inputs = [], options = [];
+  let mode, verbose = false, operands = false;
+  const operation = (next) => { if (mode) deny(); mode = next; };
+  const value = (inline, i) => {
+    const result = inline ?? argv[i + 1];
+    if (!result || result.startsWith("--")) deny();
+    return result;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (operands || !arg.startsWith("-")) { targets.push(path.isAbsolute(arg) ? arg : `${cwd}/${arg}`); continue; }
+    if (arg === "--") { operands = true; continue; }
+    if (/^-[dv]+$/.test(arg)) {
+      if (arg.includes("d")) { if ((arg.match(/d/g) ?? []).length !== 1) deny(); operation("display"); }
+      if (arg.includes("v")) verbose = true;
+      continue;
+    }
+    const equal = arg.indexOf("=");
+    const flag = equal < 0 ? arg : arg.slice(0, equal);
+    const inline = equal < 0 ? undefined : arg.slice(equal + 1);
+    if (flag === "--display" && inline === undefined) { operation("display"); continue; }
+    if (flag === "--verify" && inline === undefined) { operation("verify"); continue; }
+    if (flag === "--verbose") { if (inline !== undefined && !/^\d{1,2}$/.test(inline)) deny(); verbose = true; continue; }
+    if (["-s", "--sign"].includes(flag) || /^-s.+/.test(arg)) {
+      const attached = flag === "-s" || flag === "--sign" ? inline : arg.slice(2);
+      const identity = value(attached, i);
+      if (identity.length > 512 || (identity.startsWith("-") && identity !== "-")) deny();
+      operation("sign"); if (attached === undefined) i++;
+      continue;
+    }
+    if (["--force", "--deep", "--strict"].includes(flag) && inline === undefined) { options.push(flag); continue; }
+    if (flag === "--timestamp" && (inline === undefined || inline === "none")) { options.push(flag); continue; }
+    if (["--options", "--identifier", "--preserve-metadata", "--entitlements", "--requirements"].includes(flag) || arg === "-r-") {
+      const parameter = arg === "-r-" ? "-" : value(inline, i);
+      if (arg !== "-r-" && inline === undefined) i++;
+      if (flag === "--options" && !/^(runtime|hard|kill|host|expires|restrict|library)(,(runtime|hard|kill|host|expires|restrict|library))*$/.test(parameter)) deny();
+      if (flag === "--preserve-metadata" && !/^(identifier|entitlements|requirements|flags|runtime)(,(identifier|entitlements|requirements|flags|runtime))*$/.test(parameter)) deny();
+      if (flag === "--identifier" && (parameter.startsWith("-") || parameter.length > 512)) deny();
+      options.push(arg === "-r-" ? "--requirements" : flag);
+      if (flag === "--entitlements") inputs.push({ value: parameter, path: path.isAbsolute(parameter) ? parameter : `${cwd}/${parameter}` });
+      if ((flag === "--requirements" || arg === "-r-") && parameter !== "-") deny();
+      continue;
+    }
+    deny();
+  }
+  mode ??= verbose ? "verify" : undefined;
+  if (!mode || !targets.length || targets.length > 4096) deny();
+  const permitted = mode === "sign"
+    ? ["--force", "--options", "--timestamp", "--entitlements", "--deep", "--preserve-metadata", "--identifier"]
+    : mode === "verify" ? ["--strict", "--deep"] : ["--entitlements", "--requirements"];
+  if (options.some((flag) => !permitted.includes(flag))) deny();
+  if (mode === "display" && inputs.some((input) => ![":-", "-"].includes(input.value))) deny();
+  if (mode === "sign" && inputs.some((input) => [":-", "-"].includes(input.value))) deny();
+  return { mode, targets, entitlements: mode === "sign" ? inputs.map((input) => input.path) : [] };
+}

package/codesign-environment.mjs

@@ -0,0 +1,58 @@
+import * as fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { detectMacSigningSession } from "./macos-signing-session.mjs";
+import { ensurePrivateDirectory, privatePath } from "./rightkit-signing-agent.mjs";
+import { resolveManagedRoot } from "./artifact-storage.mjs";
+
+const quote = (text) => `'${String(text).replaceAll("'", "'\\''")}'`;
+export function codesignShimScript({ route, node = process.execPath,
+  entrypoint = fileURLToPath(new URL("./codesign-shim.mjs", import.meta.url)), realCodesign = "/usr/bin/codesign" }) {
+  return `#!/bin/sh\nif [ -n "\${SSH_CONNECTION-}\${SSH_TTY-}\${SSH_CLIENT-}" ] || [ ${quote(route)} = agent ]; then
+  exec ${quote(node)} ${quote(entrypoint)} "$@"
+fi
+exec ${quote(realCodesign)} "$@"\n`;
+}
+
+export function macosCodesignEnvironment(env = process.env, { platform = process.platform, io = fs,
+  detect = detectMacSigningSession, node = process.execPath } = {}) {
+  if (platform !== "darwin") return env;
+  const route = detect({ env }).guiRunner ? "agent" : "direct";
+  const script = codesignShimScript({ route, node });
+  const automationScript = `#!/bin/sh\nexec ${quote(node)} ${quote(fileURLToPath(new URL("./osascript-guard.mjs", import.meta.url)))} "$@"\n`;
+  // Tauri's script invokes /usr/bin/osascript, bypassing PATH. Its env-bash
+  // shebang & app-side `bash bundle_dmg.sh` calls both traverse this wrapper.
+  const bashScript = `#!/bin/sh\nlayout_script=\nskip_layout=0\nfor arg in "$@"; do
+  case "$arg" in
+    */bundle_dmg.sh|bundle_dmg.sh) layout_script="$arg" ;;
+    --skip-jenkins) skip_layout=1 ;;
+  esac
+done
+if [ -n "$layout_script" ] && [ "$skip_layout" = 0 ]; then
+  exec ${quote(node)} ${quote(fileURLToPath(new URL("./osascript-guard.mjs", import.meta.url)))} --caller "$layout_script"
+fi
+exec /bin/bash "$@"\n`;
+  // Immutable wrappers avoid races between GUI & SSH builds or package versions.
+  const identity = createHash("sha256").update(script).update(automationScript).update(bashScript).digest("hex").slice(0, 24);
+  const bin = path.join(resolveManagedRoot({ env }), "signing", "codesign-bin", identity);
+  ensurePrivateDirectory(bin, { io });
+  const file = path.join(bin, "codesign");
+  if (io.existsSync(file)) {
+    privatePath(file, 0o700, { io });
+    if (io.readFileSync(file, "utf8") !== script) throw new Error("Managed codesign shim content changed");
+  } else io.writeFileSync(file, script, { mode: 0o700, flag: "wx" });
+  const automationFile = path.join(bin, "osascript");
+  if (io.existsSync(automationFile)) {
+    privatePath(automationFile, 0o700, { io });
+    if (io.readFileSync(automationFile, "utf8") !== automationScript) throw new Error("Managed osascript guard content changed");
+  } else io.writeFileSync(automationFile, automationScript, { mode: 0o700, flag: "wx" });
+  const bashFile = path.join(bin, "bash");
+  if (io.existsSync(bashFile)) {
+    privatePath(bashFile, 0o700, { io });
+    if (io.readFileSync(bashFile, "utf8") !== bashScript) throw new Error("Managed bash guard content changed");
+  } else io.writeFileSync(bashFile, bashScript, { mode: 0o700, flag: "wx" });
+  // Keep every other shim (especially managed Cargo) in its original order.
+  return { ...env, CI: "true", TAURI_BUNDLER_DMG_IGNORE_CI: "false",
+    PATH: [bin, ...(env.PATH ?? "").split(path.delimiter).filter((entry) => entry !== bin)].join(path.delimiter) };
+}

package/codesign-shim.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import * as fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { parseCodesignArgv } from "./codesign-argv.mjs";
+import { detectMacSigningSession } from "./macos-signing-session.mjs";
+import { requestSigningAgent } from "./signing-agent-client.mjs";
+import { defaultSigningRoots, privatePath, signingAgentPaths, SigningAgentError } from "./rightkit-signing-agent.mjs";
+
+export async function runCodesignShim(argv, { cwd = process.cwd(), env = process.env, home = os.userInfo().homedir,
+  io = fs, run = spawnSync, detect = detectMacSigningSession, request = requestSigningAgent } = {}) {
+  if (!detect({ env, run }).guiRunner) {
+    // Installed shell shim uses exec here; this branch also supports API callers.
+    const result = run("/usr/bin/codesign", argv, { cwd, env, stdio: "inherit", shell: false, windowsHide: true });
+    if (result.error) throw result.error;
+    return { status: result.status ?? 1, stdout: "", stderr: "" };
+  }
+  const paths = signingAgentPaths(home);
+  let roots = defaultSigningRoots(home, env.RIGHTKIT_MANAGED_ROOT);
+  if (io.existsSync(paths.config)) {
+    privatePath(paths.config, 0o600, { io });
+    roots = JSON.parse(io.readFileSync(paths.config, "utf8")).roots;
+  }
+  const { targets } = parseCodesignArgv(argv, cwd);
+  const report = await request({ schema: 1, type: "codesign-argv", argv, cwd, targets,
+    allowedRoots: roots.filter((root) => io.existsSync(root)), timeoutMs: 180000 }, { paths });
+  const result = report.results?.[0];
+  if (report.schema !== 1 || report.ok !== true || report.results?.length !== 1
+    || !Number.isInteger(result?.status) || result.status < 0 || result.status > 255
+    || typeof result.stdout !== "string" || typeof result.stderr !== "string") {
+    throw new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Invalid codesign result");
+  }
+  return result;
+}
+
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  try {
+    // Only the managed shell wrapper invokes this entry: session detection was
+    // already performed by right-release before selecting its wrapper directory.
+    const result = await runCodesignShim(process.argv.slice(2), { detect: () => ({ guiRunner: true }) });
+    process.stdout.write(result.stdout);
+    process.stderr.write(result.stderr);
+    process.exitCode = result.status;
+  } catch (error) {
+    process.stderr.write(`rightkit codesign: [${error.code ?? "MAC_SIGNING_AGENT_JOB_FAILED"}] ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}

package/committed-source.mjs

@@ -35,7 +35,7 @@ function gitEnv(env = process.env, platform = process.platform) {
 }
 
 function runGit(root, args, { encoding = "buffer", maxBuffer = 4 * 1024 * 1024, timeout = COMMAND_TIMEOUT_MS, runner = spawnSync, env = gitEnv(), input } = {}) {
-  const result = runner(nativeGitPath(), ["-C", root, "--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${os.devNull}`, ...args], {
+  const result = runner(nativeGitPath(), ["-C", root, "--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${os.devNull}`, "-c", `safe.directory=${root}`, ...args], {
     encoding, env, windowsHide: true, maxBuffer, timeout, ...(input ? { input } : {}),
   });
   if (result?.error || result?.status !== 0) throw new Error(`committed ownership: git ${args[0] ?? "command"} failed${result?.error?.code ? ` (${result.error.code})` : ""}`);
@@ -118,7 +118,7 @@ function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runne
   const text = (args) => runGit(root, args, { encoding: "utf8", runner, env }).trim();
   const repositoryRoot = path.resolve(text(["rev-parse", "--show-toplevel"]));
   const pathPrefix = text(["rev-parse", "--show-prefix"]).replaceAll("\\", "/");
-  const originResult = runner(nativeGitPath(), ["-C", repositoryRoot, "--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${os.devNull}`, "config", "--get", "remote.origin.url"], {
+  const originResult = runner(nativeGitPath(), ["-C", repositoryRoot, "--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${os.devNull}`, "-c", `safe.directory=${repositoryRoot}`, "config", "--get", "remote.origin.url"], {
     encoding: "utf8", env, windowsHide: true, maxBuffer: 4 * 1024 * 1024, timeout: COMMAND_TIMEOUT_MS,
   });
   const origin = originResult?.status === 0 ? String(originResult.stdout).trim() : null;
@@ -132,7 +132,7 @@ function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runne
   const rows = parseTree(runGit(root, ["ls-tree", "-r", "-z", "--full-tree", tree], { encoding: "buffer", maxBuffer: MAX_TREE_BYTES, timeout: COMMAND_TIMEOUT_MS, runner, env }), objectFormat);
   const wanted = new Set(requiredPaths.filter(validatePath));
   const shouldRead = (row) => row.type === "blob" && row.mode !== "120000" && (
-    wanted.has(row.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json"].includes(path.posix.basename(row.rel)) ||
+    wanted.has(row.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json", "Cargo.lock", "pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock"].includes(path.posix.basename(row.rel)) ||
     /\.(?:rs|ts|tsx|js|mjs|cjs|jsx|swift|m|mm|c|cc|cpp|h|py|go|kt|java|cs)$/i.test(row.rel)
   );
   const candidates = rows.filter(shouldRead);

package/development.mjs

@@ -1,14 +1,16 @@
+import { discoverBrokerSocket, resolveManagedRoots } from './managed-roots.mjs';
 import { spawnSync } from "./background-process.mjs";
 import { createHash } from "node:crypto";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
 import { acquireManagedRunLease, managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
 import { BUNDLE_MARKERS, bundleMarkerBuffer, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
 import { installPortableDevelopment } from "./portable-development.mjs";
 import { signMacosDevelopmentBundle } from "./development-signing.mjs";
+import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 
 export const DEVELOPMENT_PROFILE = "release-iterate";
 const RELEASE_ONLY_APPLE_ENV = ["APPLE_ID", "APPLE_PASSWORD", "APPLE_API_KEY", "APPLE_API_ISSUER", "APPLE_API_KEY_PATH", "APPLE_CERTIFICATE", "APPLE_CERTIFICATE_PASSWORD"];
@@ -26,16 +28,14 @@ export function developmentEnvironment(env = process.env) {
   delete result.CARGO_INCREMENTAL;
   const client = managedRuntimeClient(result);
   if (client) {
-    const managedRoot = result.RIGHTKIT_MANAGED_ROOT ?? result.RIGHTKIT_EXTERNAL_ROOT
-      ?? (process.platform === "win32" ? "D:\\.rightkit-managed" : process.platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined);
-    const agentBin = managedRoot && path.join(managedRoot, "agent-bin");
+    const { agentBin } = resolveManagedRoots({ env: result });
     if (agentBin && existsSync(agentBin)) {
       const pathKey = Object.keys(result).find((key) => key.toLowerCase() === "path") ?? "PATH";
       result[pathKey] = [agentBin, result[pathKey]].filter(Boolean).join(path.delimiter);
     }
     // Same default as the agent-bin `rightkit` shim: children that run the managed client directly
     // (resolveCommand("rightkit"), build scripts) must not lose the broker endpoint.
-    const socket = managedRoot && path.join(managedRoot, "broker.sock");
+    const socket = discoverBrokerSocket(result);
     if (!result.RIGHTKIT_BUILD_BROKER_SOCKET && socket && existsSync(socket)) result.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
   }
   return result;
@@ -60,7 +60,8 @@ export function validateDevelopmentConfig(config, platform) {
   return target;
 }
 
-export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync }) {
+export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync,
+  codesignEnvironment = macosCodesignEnvironment }) {
   if (!new Set(["win", "mac"]).has(platform)) throw new Error("--platform must be win or mac");
   assertNativeDevelopmentHost(platform);
   const target = validateDevelopmentConfig(config, platform);
@@ -68,7 +69,7 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   assertPrimaryReleaseCheckout(repoRoot, env);
   if (dryRun) return { built: false, installed: false, plan: { build: target.build, install: buildOnly ? null : target.install ?? null, profile: DEVELOPMENT_PROFILE } };
   assertReleaseExecutionAllowed({ cwd: repoRoot, environment: env, command: `right-release dev --platform ${platform}` });
-  const childEnv = developmentEnvironment(env);
+  const childEnv = codesignEnvironment(developmentEnvironment(env));
   // One lease spans every managed request this run makes, so a broker cutover cannot land between them.
   const lease = acquireManagedRunLease({ command: `right-release dev --platform ${platform}`, env });
   try {
@@ -210,7 +211,7 @@ export function resolveCommand(command, args, { root, env = process.env } = {})
   if (command === "rightkit") {
     const client = managedRuntimeClient(env);
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
-    const socket = path.join(path.dirname(path.dirname(path.dirname(path.dirname(client)))), "broker.sock");
+    const socket = discoverBrokerSocket(env);
     const childEnv = !env.RIGHTKIT_BUILD_BROKER_SOCKET && existsSync(socket) ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : undefined;
     return { command: process.execPath, args: [client, ...args], ...(childEnv ? { env: childEnv } : {}) };
   }
@@ -280,6 +281,7 @@ export async function main(args = process.argv.slice(2)) {
   return result;
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   main().catch((error) => { console.error(`right-release dev: ${error.code ? `[${error.code}] ` : ""}${error.message}`); process.exitCode = 1; });
 }

package/direct-bootstrap.mjs

@@ -1,5 +1,6 @@
+import { readVerifiedArtifact } from "./publication-artifacts.mjs";
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure } from "./sign-release-manifest.mjs";
@@ -539,7 +540,8 @@ export function planBootstrapPublication({ product, bootstrapVersion, scriptPath
   if (stableKey !== `${product}/install.ps1`) throw new Error("bootstrap stable key must be product/install.ps1");
   const script = statSync(scriptPath);
   if (!script.isFile() || script.size < 1 || script.size > MAX_BOOTSTRAP_BYTES || scriptPath.split(/[\\/]/).at(-1) !== "install.ps1") throw new Error("bootstrap must be one small install.ps1 file");
-  const validation = validatePowerShellBootstrap(readFileSync(scriptPath, "utf8"), { product });
+  const scriptBytes = readFileSync(scriptPath);
+  const validation = validatePowerShellBootstrap(scriptBytes.toString("utf8"), { product });
   if (!validation.valid) throw new Error("bootstrap script violates generated RightRelease contract: " + validation.errors.join("; "));
   const versionedKey = `${product}/versions/${bootstrapVersion}/install.ps1`;
   return {
@@ -549,7 +551,7 @@ export function planBootstrapPublication({ product, bootstrapVersion, scriptPath
     stableKey,
     versionedKey,
     scriptPath: resolve(scriptPath),
-    sha256: sha256File(scriptPath),
+    sha256: createHash("sha256").update(scriptBytes).digest("hex"),
   };
 }
 
@@ -567,16 +569,24 @@ export function createWranglerR2Client({ commandRunner = spawnSync, wranglerRunn
 
 export function publishBootstrapPlan(plan, r2, { verificationPath }) {
   validateBootstrapPublicationPlan(plan);
-  r2.put(plan.bucket, plan.versionedKey, plan.scriptPath);
-  r2.get(plan.bucket, plan.versionedKey, verificationPath);
-  if (sha256File(verificationPath) !== plan.sha256) throw new Error("immutable bootstrap remote verification failed");
-  r2.put(plan.bucket, plan.stableKey, plan.scriptPath);
-  r2.get(plan.bucket, plan.stableKey, verificationPath);
-  if (sha256File(verificationPath) !== plan.sha256) throw new Error("stable bootstrap remote verification failed");
+  readVerifiedArtifact(plan.scriptPath, { sha256: plan.sha256 });
+  for (const [label, key] of [["immutable", plan.versionedKey], ["stable", plan.stableKey]]) {
+    try { r2.put(plan.bucket, key, plan.scriptPath); }
+    catch { throw new Error(`bootstrap upload failed; inspect remote key ${plan.bucket}/${key}`); }
+    // A successful readback must materialize fresh bytes, never reuse prior output.
+    rmSync(verificationPath, { force: true });
+    try {
+      r2.get(plan.bucket, key, verificationPath);
+      readVerifiedArtifact(verificationPath, { sha256: plan.sha256 });
+    } catch {
+      throw new Error(`${label} bootstrap remote verification failed; remove remote key ${plan.bucket}/${key}`);
+    }
+  }
   return { ...plan, verified: true };
 }
 
 export function validateBootstrapPublicationPlan(plan) {
+  if (!/^[a-f0-9]{64}$/.test(plan?.sha256 ?? "")) throw new Error("bootstrap publication hash evidence is required");
   if (!plan || !/^[a-z][a-z0-9-]+$/.test(plan.product ?? "")) throw new Error("bootstrap publication product is invalid");
   if (!VERSION.test(plan.bootstrapVersion ?? "")) throw new Error("bootstrap publication version is invalid");
   if (plan.bucket !== "rightapps-downloads") throw new Error("bootstrap publication bucket is not branded public R2");

package/dmg-build.mjs

@@ -0,0 +1,117 @@
+import { copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { backgroundAlias, dmgDSStore } from "./dmg-layout.mjs";
+import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const pair = (value, label, positive = false) => {
+  const numbers = Array.isArray(value) ? value : String(value).split(",").map(Number);
+  if (numbers.length !== 2 || numbers.some((n) => !Number.isInteger(n) || n < (positive ? 1 : 0) || n > 32767)) {
+    throw fail("DMG_INVALID_OPTIONS", `${label} requires ${positive ? "positive" : "nonnegative"} x,y integers <=32767`);
+  }
+  return numbers;
+};
+
+export function buildDmg({ app, out, volname, background, iconSize = 128, appPosition = [158, 231],
+  applicationsPosition = [492, 231], window = [660, 400], volumeIcon } = {},
+{ platform = process.platform, run = spawnSync, makeAlias = backgroundAlias,
+  log = (event) => console.error(JSON.stringify(event)) } = {}) {
+  if (platform !== "darwin") throw fail("DMG_NATIVE_HOST_REQUIRED", "DMG creation requires macOS");
+  if (!app || !out || !volname) throw fail("DMG_INVALID_OPTIONS", "--app, --out & --volname are required");
+  app = path.resolve(app); out = path.resolve(out);
+  if (!app.endsWith(".app") || !statSync(app).isDirectory() || !existsSync(path.join(app, "Contents", "Info.plist"))) {
+    throw fail("DMG_INVALID_OPTIONS", `expected .app bundle with Contents/Info.plist: ${app}`);
+  }
+  if (!out.endsWith(".dmg") || out.startsWith(`${app}${path.sep}`)) throw fail("DMG_INVALID_OPTIONS", "--out must be a .dmg outside app bundle");
+  if (/[\0\r\n/:]/.test(volname) || Buffer.byteLength(volname) > 255) throw fail("DMG_INVALID_OPTIONS", "invalid volume name");
+  iconSize = Number(iconSize);
+  if (!Number.isInteger(iconSize) || iconSize < 16 || iconSize > 512) throw fail("DMG_INVALID_OPTIONS", "--icon-size must be 16..512");
+  appPosition = pair(appPosition, "--app-position"); applicationsPosition = pair(applicationsPosition, "--applications-position");
+  window = pair(window, "--window", true);
+  if (volumeIcon) {
+    volumeIcon = path.resolve(volumeIcon);
+    if (!existsSync(volumeIcon) || !statSync(volumeIcon).isFile() || !/\.icns$/i.test(volumeIcon)) throw fail("DMG_INVALID_OPTIONS", "--volume-icon must be an .icns file");
+  }
+  if (background) {
+    background = path.resolve(background);
+    // Existing Right Suite backgrounds include TIFF; accept PNG & TIFF without conversion.
+    if (!statSync(background).isFile() || !/\.(png|tiff?)$/i.test(background)) throw fail("DMG_INVALID_OPTIONS", "background must be PNG or TIFF");
+    if (/\.png$/i.test(background) && !readFileSync(background).subarray(0, 8).equals(Buffer.from("89504e470d0a1a0a", "hex"))) {
+      throw fail("DMG_INVALID_OPTIONS", "invalid PNG signature");
+    }
+  }
+  for (let cursor = out; cursor !== path.dirname(cursor); cursor = path.dirname(cursor)) {
+    if (existsSync(cursor) && lstatSync(cursor).isSymbolicLink()) throw fail("DMG_INVALID_OPTIONS", `output must not traverse symlink: ${cursor}`);
+  }
+  assertReleaseExecutionAllowed({ cwd: app, command: "right-release dmg build" });
+  mkdirSync(path.dirname(out), { recursive: true });
+  const work = mkdtempSync(path.join(path.dirname(out), ".rightkit-dmg-")), stage = path.join(work, "stage"), mount = path.join(work, "mount");
+  const rw = path.join(work, "writable.dmg"), compressed = path.join(work, "compressed.dmg");
+  let attached = false, attaching = false;
+  const command = (tool, args) => {
+    const result = run(tool, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], shell: false, timeout: 300000 });
+    if (result.error || result.status !== 0) throw fail("DMG_COMMAND_FAILED", `${tool} ${args[0]} failed: ${result.error?.message ?? result.stderr ?? result.status}`);
+    return result;
+  };
+  log({ event: "dmg-build-started", app, out, volname });
+  try {
+    mkdirSync(stage); mkdirSync(mount);
+    command("/usr/bin/ditto", [app, path.join(stage, path.basename(app))]);
+    symlinkSync("/Applications", path.join(stage, "Applications"));
+    const relative = background ? path.join(".background", path.basename(background)) : null;
+    if (relative) { mkdirSync(path.join(stage, ".background")); copyFileSync(background, path.join(stage, relative)); }
+    // Include layout headroom in hdiutil's source-folder size estimate. Alias
+    // CNIDs become available only after mounting, when this reservation is replaced.
+    writeFileSync(path.join(stage, ".DS_Store"), Buffer.alloc(64 * 1024));
+    command("/usr/bin/hdiutil", ["create", "-fs", "HFS+", "-format", "UDRW", "-volname", volname, "-srcfolder", stage, rw]);
+    attaching = true;
+    command("/usr/bin/hdiutil", ["attach", "-readwrite", "-nobrowse", "-noautoopen", "-mountpoint", mount, rw]);
+    attached = true; attaching = false;
+    if (volumeIcon) {
+      // Custom volume icon: .VolumeIcon.icns at the root plus the volume's kHasCustomIcon (0x0400) Finder flag.
+      copyFileSync(volumeIcon, path.join(mount, ".VolumeIcon.icns"));
+      const finderInfo = Buffer.alloc(32); finderInfo.writeUInt16BE(0x0400, 8);
+      command("/usr/bin/xattr", ["-wx", "com.apple.FinderInfo", finderInfo.toString("hex"), mount]);
+    }
+    const alias = relative ? makeAlias({ mount, volname, relative }) : undefined;
+    writeFileSync(path.join(mount, ".DS_Store"), dmgDSStore({ appName: path.basename(app), iconSize,
+      appPosition, applicationsPosition, window, alias }));
+    command("/usr/bin/hdiutil", ["detach", mount]); attached = false;
+    command("/usr/bin/hdiutil", ["convert", rw, "-format", "UDZO", "-imagekey", "zlib-level=9", "-o", compressed]);
+    command("/usr/bin/hdiutil", ["verify", compressed]);
+    renameSync(compressed, out);
+    log({ event: "dmg-build-completed", out, format: "UDZO" });
+    return { out, format: "UDZO" };
+  } catch (error) {
+    log({ event: "dmg-build-failed", out, code: error.code ?? "DMG_BUILD_FAILED", message: error.message });
+    throw error;
+  } finally {
+    if (attached || attaching) {
+      try { command("/usr/bin/hdiutil", ["detach", "-force", mount]); attached = false; attaching = false; }
+      catch (error) { log({ event: "dmg-cleanup-failed", mount, work, message: error.message }); }
+    }
+    // Never recurse through a mount that failed to detach.
+    if (!attached && !attaching) rmSync(work, { recursive: true, force: true });
+  }
+}
+
+export function parseDmgArguments(args) {
+  if (args[0] !== "build") throw fail("DMG_INVALID_OPTIONS", "expected dmg build");
+  const flags = new Map([["--app", "app"], ["--out", "out"], ["--volname", "volname"], ["--background", "background"],
+    ["--icon-size", "iconSize"], ["--app-position", "appPosition"], ["--applications-position", "applicationsPosition"], ["--window", "window"], ["--volume-icon", "volumeIcon"]]);
+  const options = {};
+  for (let i = 1; i < args.length; i += 2) {
+    const key = flags.get(args[i]);
+    if (!key || options[key] !== undefined || !args[i + 1] || args[i + 1].startsWith("--")) throw fail("DMG_INVALID_OPTIONS", `invalid option: ${args[i]}`);
+    options[key] = args[i + 1];
+  }
+  return options;
+}
+
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  try { buildDmg(parseDmgArguments(process.argv.slice(2))); }
+  catch (error) { console.error(`right-release dmg: [${error.code ?? "DMG_BUILD_FAILED"}] ${error.message}`); process.exitCode = 1; }
+}