@rightkit/release 0.2.135 → 0.2.136

package/protected-credentials.mjs

@@ -0,0 +1,111 @@
+import { readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { isManagedHost, refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
+
+// Protected credential loaders for release sites that previously read only
+// ambient environment variables. The storage pattern matches release-token.mjs:
+// macOS Keychain generic passwords (account $USER) and, on Windows, a protected
+// token file under %APPDATA%\RightKit. Values are returned to the caller only;
+// they are never logged, and diagnostics name the secret, never its value.
+export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
+
+// Apple App Store Connect values are not stored here: the key ID and issuer come
+// from the release config or environment, and the .p8 is read from its file.
+export const PROTECTED_SECRETS = Object.freeze({
+  "cloudflare-api-token": { label: "Cloudflare API token", keychain: "rightkit-cloudflare-api-token", file: "cloudflare-api-token.token" },
+});
+
+export class ProtectedSecretMissingError extends Error {
+  constructor(name, storeCommand) {
+    const { label } = PROTECTED_SECRETS[name];
+    super(storeCommand
+      ? `${label} is not in the protected credential store; store it once with: ${storeCommand}`
+      : `${label} is not in a protected credential store on this platform`);
+    this.name = "ProtectedSecretMissingError";
+    this.code = PROTECTED_SECRET_MISSING;
+    this.secret = name;
+    this.storeCommand = storeCommand ?? null;
+  }
+}
+
+// One-line command the operator runs once per host. macOS prompts for the value
+// (-w with no argument); Windows prompts with Read-Host -AsSecureString.
+export function protectedSecretStoreCommand(name, platform = process.platform) {
+  const spec = PROTECTED_SECRETS[name];
+  if (!spec) throw new Error(`unknown protected secret: ${name}`);
+  if (platform === "darwin") return `security add-generic-password -a "$USER" -s ${spec.keychain} -U -w`;
+  if (platform === "win32") {
+    return `powershell -NoProfile -Command "$s = Read-Host -AsSecureString '${spec.label}'; $d = Join-Path $env:APPDATA 'RightKit'; New-Item -ItemType Directory -Force -Path $d | Out-Null; [IO.File]::WriteAllText((Join-Path $d '${spec.file}'), [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($s)))"`;
+  }
+  return null;
+}
+
+// Reads a generic password without echoing stderr; a missing item is undefined.
+function readKeychainSecret({ service, account }) {
+  const result = spawnSync("security", ["find-generic-password", "-a", account, "-s", service, "-w"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  if (result.error || result.status !== 0) return undefined;
+  return result.stdout;
+}
+
+function readProtectedFile(file) {
+  try {
+    return readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return undefined;
+    throw new Error("protected credential file is unreadable");
+  }
+}
+
+// The store is injectable so tests can use fakes without touching a real
+// Keychain or the Windows profile directory.
+export function createCredentialStore({
+  env = process.env,
+  platform = process.platform,
+  readKeychain = readKeychainSecret,
+  readFile = readProtectedFile,
+} = {}) {
+  return {
+    platform,
+    read(name) {
+      if (!PROTECTED_SECRETS[name]) throw new Error(`unknown protected secret: ${name}`);
+      const spec = PROTECTED_SECRETS[name];
+      let value;
+      if (platform === "darwin") {
+        value = readKeychain({ service: spec.keychain, account: env.USER || os.userInfo().username });
+      } else if (platform === "win32") {
+        const appData = env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+        value = readFile(path.win32.join(appData, "RightKit", spec.file));
+      }
+      const trimmed = typeof value === "string" ? value.trim() : "";
+      if (!trimmed) throw new ProtectedSecretMissingError(name, protectedSecretStoreCommand(name, platform));
+      return trimmed;
+    },
+  };
+}
+
+// Managed hosts refuse the named environment variable before any credential is
+// read. Unmanaged hosts try the protected store first and use the variable only
+// when the store has no value. A missing store entry on a managed host never
+// permits the environment fallback.
+export function resolveEnvBackedSecret({ name, envName, env = process.env, credentialStore, required = true }) {
+  refuseManagedEnvSecrets(env, [envName]);
+  if (!required) return undefined;
+  const store = credentialStore ?? createCredentialStore({ env });
+  try {
+    return store.read(name);
+  } catch (error) {
+    if (!(error instanceof ProtectedSecretMissingError)) throw error;
+    const fallback = isManagedHost(env) ? "" : String(env[envName] ?? "").trim();
+    if (fallback) return fallback;
+    throw error;
+  }
+}
+
+export function resolveCloudflareApiToken({ env = process.env, credentialStore, required = true } = {}) {
+  return resolveEnvBackedSecret({ name: "cloudflare-api-token", envName: "CLOUDFLARE_API_TOKEN", env, credentialStore, required });
+}

package/prune-r2.mjs

@@ -1,16 +1,17 @@
+import { resolveCloudflareApiToken } from "./protected-credentials.mjs";
+
 const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID || "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
 const BUCKETS = { public: "rightapps-downloads", private: "rightapps-updates" };
 
-export async function pruneReleaseObjects({ app, platform, keep, dryRun = false }) {
+export async function pruneReleaseObjects({ app, platform, keep, dryRun = false, env = process.env, credentialStore }) {
   if (!new Set(["mac", "windows"]).has(platform)) throw new Error(`invalid R2 prune platform: ${platform}`);
+  const token = resolveCloudflareApiToken({ env, credentialStore, required: !dryRun });
   for (const [alias, bucket] of Object.entries(BUCKETS)) {
     const retained = new Set(keep[alias] ?? []);
     if (dryRun) {
       console.log(`[dry-run] PRUNE ${bucket}/${app}/${platform} keep=${[...retained].sort().join(",") || "<none>"}`);
       continue;
     }
-    const token = process.env.CLOUDFLARE_API_TOKEN;
-    if (!token) throw new Error("CLOUDFLARE_API_TOKEN is required to prune stale R2 release objects");
     for (const key of await listObjects(bucket, app, token)) {
       if (!isReleaseObject(app, platform, key) || retained.has(key)) continue;
       console.log(`DELETE ${bucket}/${key}`);

package/pub-upload.mjs

@@ -1,86 +1,4 @@
 #!/usr/bin/env node
-import { accessSync, statSync } from "node:fs";
-import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
-
-const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
-const BUCKETS = new Map([
-  ["public", "rightapps-downloads"],
-  ["private", "rightapps-updates"],
-]);
-const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
-
-const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
-if (!localFile || !r2Key) {
-  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
-  process.exit(1);
-}
-
-const bucket = BUCKETS.get(bucketAlias);
-if (!bucket) {
-  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
-  process.exit(1);
-}
-
-try {
-  accessSync(localFile);
-} catch {
-  console.error(`upload-large: missing local file: ${localFile}`);
-  process.exit(1);
-}
-
-const fileSize = statSync(localFile).size;
-const object = `${bucket}/${r2Key}`;
-const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
-const env = cleanCloudflareEnv(process.env);
-
-console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
-console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
-
-// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
-// and that must fail here rather than after a signed build has already been produced.
-const runner = resolveRunner(env);
-if (!runner) {
-  console.error(
-    "upload-large: no package runner found. Tried: " +
-      "pnpm dlx. Install the pinned workspace package manager before release.",
-  );
-  process.exit(1);
-}
-console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
-
-if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
-  process.exit(0);
-}
-
-const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
-  env,
-  stdio: "inherit",
-  shell: process.platform === "win32",
-  windowsHide: true,
-});
-
-if (result.error) {
-  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
-  process.exit(1);
-}
-process.exit(result.status ?? 1);
-
-function resolveRunner(env) {
-  const probe = spawnSync(RUNNER.cmd, ["--version"], {
-    env,
-    stdio: "ignore",
-    shell: process.platform === "win32",
-    windowsHide: true,
-  });
-  return !probe.error && probe.status === 0 ? RUNNER : null;
-}
-
-function cleanCloudflareEnv(source) {
-  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
-  delete env.CLOUDFLARE_API_KEY;
-  delete env.CLOUDFLARE_EMAIL;
-  delete env.CF_API_KEY;
-  delete env.CF_EMAIL;
-  return env;
-}
+import { runLargeUpload } from "./upload-large.mjs";
+try { runLargeUpload(process.argv.slice(2)); }
+catch (error) { console.error(`pub-upload: ${error.message}`); process.exitCode = 1; }

package/publication-artifacts.mjs

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync, openSync, fstatSync, readSync, closeSync } from "node:fs";
+import path from "node:path";
+import { verifySealedRelease } from "./release-state.mjs";
+import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
+
+export class PublicationError extends Error {
+  constructor(code, message) { super(`[${code}] ${message}`); this.name = "PublicationError"; this.code = code; }
+}
+export const digestBytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+// Read once. Upload boundaries consume these bytes, never reopen their source path.
+export function readVerifiedArtifact(file, evidence) {
+  let bytes, identity;
+  try {
+    const before = statSync(file);
+    bytes = readFileSync(file);
+    identity = statSync(file);
+    if (!sameIdentity(before, identity)) throw new PublicationError("PUBLICATION_SOURCE_CHANGED", `artifact changed while reading: ${file}`);
+  } catch (error) {
+    if (error instanceof PublicationError) throw error;
+    throw new PublicationError("PUBLICATION_ARTIFACT_MISSING", `artifact unreadable: ${file}`);
+  }
+  if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "") || digestBytes(bytes) !== evidence.sha256) {
+    throw new PublicationError("PUBLICATION_HASH_MISMATCH", `artifact sha256 mismatch: ${file}`);
+  }
+  if (evidence.sizeBytes !== undefined && bytes.length !== evidence.sizeBytes) {
+    throw new PublicationError("PUBLICATION_SIZE_MISMATCH", `artifact size mismatch: ${file}`);
+  }
+  return { file, bytes, sha256: evidence.sha256, sizeBytes: bytes.length, identity };
+}
+function sameIdentity(a, b) {
+  return a.isFile() && b.isFile() && ["dev", "ino", "size", "mtimeMs", "ctimeMs"].every((key) => a[key] === b[key]);
+}
+export function assertArtifactUnchanged(artifact) {
+  let current;
+  try { current = statSync(artifact.file); } catch { /* refusal below */ }
+  if (!current || !sameIdentity(artifact.identity, current)) throw new PublicationError("PUBLICATION_SOURCE_CHANGED", `artifact replaced after verification: ${artifact.file}`);
+  if (digestBytes(artifact.bytes) !== artifact.sha256 || artifact.bytes.length !== artifact.sizeBytes) throw new PublicationError("PUBLICATION_HASH_MISMATCH", `verified bytes changed: ${artifact.file}`);
+  return artifact.bytes;
+}
+
+export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId }, deps = {}) {
+  let sealed;
+  try { sealed = verifySealedRelease(sealedDir); }
+  catch (error) {
+    const code = /hash mismatch/.test(error.message) ? "PUBLICATION_HASH_MISMATCH" : /size mismatch/.test(error.message) ? "PUBLICATION_SIZE_MISMATCH" : "PUBLICATION_SEAL_INVALID";
+    throw new PublicationError(code, error.message);
+  }
+  const manifest = sealed.manifest;
+  if (!/^[a-f0-9]{40}$/.test(commit ?? "") || manifest.commit !== commit
+    || (app && manifest.app !== app) || (version && manifest.version !== version)
+    || manifest.platform !== platform || (releaseId && manifest.releaseId !== releaseId)) throw new PublicationError("PUBLICATION_SOURCE_MISMATCH", "sealed release source or product identity mismatch");
+  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot);
+  if (!ownership.ok || manifest.ownershipEvidence?.commit !== commit) throw new PublicationError("PUBLICATION_OWNERSHIP_INVALID", `sealed ownership evidence rejected: ${ownership.reason ?? "commit mismatch"}`);
+  if (!manifest.checkpoints?.includes("signed") || !manifest.checkpoints?.includes("hardened")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "signed & hardened seal checkpoints are required");
+  if (configPath && digestBytes(readFileSync(configPath)) !== manifest.signing?.configSha256) throw new PublicationError("PUBLICATION_POLICY_MISMATCH", "release config differs from sealed signing policy");
+  const receipts = manifest.signing?.receipts;
+  if (!Array.isArray(receipts) || !receipts.length) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed signing receipts are required");
+  let notarized = false;
+  let signed = false;
+  for (const receipt of receipts) {
+    const artifact = readVerifiedArtifact(path.resolve(appRoot, receipt.file), receipt);
+    let value;
+    try { value = JSON.parse(artifact.bytes); } catch { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "invalid sealed signing receipt"); }
+    if (value.schema !== 1) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "malformed sealed signing receipt");
+    if (Array.isArray(value.files)) {
+      if (!value.files.length || value.files.some((item) => !/^[a-f0-9]{64}$/.test(item.after?.sha256 ?? "") || item.timestampPresent !== true
+        || (platform === "win" ? item.authenticode !== "Valid" || item.subject !== "CN=Damned Ventures LLC" : item.codesign !== "strict-valid" || item.identity !== value.identity))) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "sealed signature verification evidence rejected");
+      signed = true;
+    } else if (Array.isArray(value.embedded)) {
+      if (!value.embedded.length || !/^[a-f0-9]{64}$/.test(value.rawExe?.signedSha256 ?? "") || value.rawExe.signedSha256 !== value.rawExe.verifiedSha256
+        || value.embedded.some((item) => item.sha256 !== value.rawExe.signedSha256)) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "sealed installer embedding evidence rejected");
+    } else if (!value.notarization) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "unrecognized sealed signing receipt");
+    if (value.notarization) {
+      if (value.notarization.status !== "Accepted" || !value.stapling?.length || value.stapling.some((item) => item.validated !== true)) throw new PublicationError("PUBLICATION_NOTARIZATION_INVALID", "notarization/stapling evidence rejected");
+      if (!value.archive?.file || !value.archive.sha256) throw new PublicationError("PUBLICATION_NOTARIZATION_INVALID", "notarization archive binding missing");
+      readVerifiedArtifact(path.resolve(appRoot, value.archive.file), value.archive);
+      notarized = true;
+    }
+  }
+  if (!signed) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed native signing evidence is required");
+  if (platform === "mac" && !notarized) throw new PublicationError("PUBLICATION_NOTARIZATION_MISSING", "sealed notarization evidence is required");
+  const artifacts = new Map();
+  for (const entry of manifest.files ?? []) {
+    if (typeof entry.name !== "string" || path.basename(entry.name) !== entry.name || artifacts.has(entry.name)) throw new PublicationError("PUBLICATION_SEAL_INVALID", "unsafe or duplicate sealed artifact name");
+    artifacts.set(entry.name, readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
+  }
+  if (!artifacts.size) throw new PublicationError("PUBLICATION_SEAL_INVALID", "sealed release has no artifacts");
+  return { ...sealed, artifacts };
+}
+
+// Bounded memory for large artifacts. Transport must read back against this digest.
+export function verifyArtifactFile(file, evidence) {
+  if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "")) throw new PublicationError("PUBLICATION_SEAL_INVALID", "publication hash evidence is required");
+  const fd = openSync(file, "r");
+  try {
+    const before = fstatSync(fd), hash = createHash("sha256"), chunk = Buffer.alloc(1024 * 1024);
+    let sizeBytes = 0, count;
+    while (sizeBytes < before.size && (count = readSync(fd, chunk, 0, Math.min(chunk.length, before.size - sizeBytes), null)) > 0) {
+      hash.update(chunk.subarray(0, count)); sizeBytes += count;
+    }
+    if (!sameIdentity(before, fstatSync(fd))) throw new PublicationError("PUBLICATION_SOURCE_CHANGED", `artifact changed while hashing: ${file}`);
+    if (hash.digest("hex") !== evidence.sha256) throw new PublicationError("PUBLICATION_HASH_MISMATCH", `artifact sha256 mismatch: ${file}`);
+    if (evidence.sizeBytes !== undefined && sizeBytes !== evidence.sizeBytes) throw new PublicationError("PUBLICATION_SIZE_MISMATCH", `artifact size mismatch: ${file}`);
+    return { file, sha256: evidence.sha256, sizeBytes, identity: before };
+  } finally { closeSync(fd); }
+}

package/publication-gate.mjs

@@ -10,6 +10,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { recordPublished } from "./rightkit-sync.mjs";
 import { fileURLToPath } from "node:url";
+import { digestBytes, readVerifiedArtifact } from "./publication-artifacts.mjs";
 
 export const GATE_SCHEMA = 1;
 export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
@@ -28,7 +29,7 @@ function defaultGit(args, cwd) {
 }
 
 // Returns { ok, missing[] }. Pure apart from the injected git/readFile.
-export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
   const missing = [];
   const head = git(["rev-parse", "HEAD"], packagePath);
   if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
@@ -64,7 +65,10 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
     }
     if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
   }
-  return Object.freeze({ ok: missing.length === 0, missing });
+  if (artifactBytes !== undefined && evidence && digestBytes(artifactBytes) !== evidence.artifactSha256) missing.push("artifact sha256 does not match evidence artifactSha256");
+  const result = { ok: missing.length === 0, missing };
+  Object.defineProperty(result, "evidence", { value: evidence });
+  return Object.freeze(result);
 }
 
 // Enforce: throws on missing evidence unless dryRun (then reports and continues).
@@ -81,7 +85,8 @@ export const NPM_KEYCHAIN_SERVICE = "npm-rightkit-publish";
 
 // `right-release publish npm --package <name> [--evidence <file>] [--dry-run]` runs the gate only.
 // Add `--publish --tarball <file>` to publish that exact gated tarball: its sha256 must equal the
-// evidence artifactSha256, the token is read from the macOS Keychain inside this process (never
+// evidence artifactSha256. Mandatory registry readback compares against captured bytes,
+// so a source-path swap cannot return success or record publication. The token is read from the macOS Keychain inside this process (never
 // printed or passed on a command line), and the registry shasum is verified after publication.
 /** `right-release publish npm --check-auth`: prove the Keychain token authenticates (whoami +
  * @rightkit package access) without publishing. Prints only the username and counts. */
@@ -150,17 +155,32 @@ export function publishGatedTarball({ name, version, tarball, evidencePath }, de
       { encoding: "utf8", env: { ...process.env, RIGHTKIT_NPM_TOKEN: token }, windowsHide: true });
     const out = redact(`${result.stdout ?? ""}${result.stderr ?? ""}`);
     if (result.error || result.status !== 0) throw new Error(`npm publish failed for ${name}@${version}:\n${out.trim()}`);
-    process.stdout.write(`[right-release] published ${name}@${version}\n`);
+    process.stdout.write(`[right-release] submitted ${name}@${version}\n`);
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }
   const sha1 = crypto.createHash("sha1").update(bytes).digest("hex");
+  verifyNpmRegistryBytes({ name, version, sha1 }, deps);
+  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version });
+}
+
+// CI and the authenticated helper share mandatory, fail-closed registry equality.
+export function prepareNpmPublication({ name, version, tarball, evidencePath }) {
+  if (!name || !version) throw new Error("npm publication identity is required");
+  const evidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
+  const artifact = readVerifiedArtifact(tarball, { sha256: evidence.artifactSha256 });
+  return { name, version, sha1: crypto.createHash("sha1").update(artifact.bytes).digest("hex"), sha256: artifact.sha256 };
+}
+
+export function verifyNpmRegistryBytes({ name, version, sha1 }, deps = {}) {
+  if (!name || !version || !/^[a-f0-9]{40}$/.test(sha1 ?? "")) throw new Error("captured npm publication hash evidence is required");
+  const run = deps.spawnSync ?? spawnSync;
   const deadline = Date.now() + (deps.verifyTimeoutMs ?? 10 * 60 * 1000);
   for (;;) {
     const view = run("npm", ["view", `${name}@${version}`, "dist.shasum", "--prefer-online", "--registry", "https://registry.npmjs.org/"], { encoding: "utf8", windowsHide: true });
     const registry = (view.stdout ?? "").trim();
-    if (registry === sha1) { process.stdout.write(`[right-release] registry bytes verified for ${name}@${version} (shasum ${sha1})\n`); (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version }); return; }
-    if (registry && registry !== sha1) throw new Error(`registry shasum ${registry} != gated tarball ${sha1} for ${name}@${version}`);
+    if (!view.error && view.status === 0 && registry === sha1) { process.stdout.write(`[right-release] registry bytes verified for ${name}@${version} (shasum ${sha1})\n`); return; }
+    if (registry && registry !== sha1) throw new Error(`registry shasum ${registry} != gated tarball ${sha1} for ${name}@${version}; inspect remote package ${name}@${version}`);
     if (Date.now() > deadline) throw new Error(`${name}@${version} not visible on the registry after publish; verify later with npm view`);
     (deps.sleep ?? ((ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)))(15000);
   }
@@ -174,7 +194,8 @@ function readKeychainToken(run) {
   return token;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try { runNpmPreflight(process.argv.slice(2)); } catch (error) {
     process.stderr.write(`right-release publish npm: ${error.message}\n`); process.exitCode = 1;
   }

package/publish-cargo.mjs

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
+import { runCargoSync } from "./managed-cargo.mjs";
+import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
+import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
 import { recordPublished } from "./rightkit-sync.mjs";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
@@ -50,7 +52,15 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
     { label: "registry dry-run", command: "cargo", args: dryRunArgs },
   ];
-  if (!dryRun) plan.push({ label: "registry publish", command: "cargo", args: ["publish", "-p", crate] });
+  if (!dryRun) plan.push(
+    // `publish --dry-run` leaves its archive under target/package/tmp-crate on current Cargo; package
+    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads.
+    { label: "package archive", command: "cargo", args: ["package", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
+    { label: "package location", command: "cargo", args: ["metadata", "--format-version", "1", "--no-deps"], capture: true },
+    { label: "archive hash check", internal: "verify-archive" },
+    { label: "registry publish", command: "cargo", args: ["publish", "--no-verify", "-p", crate] },
+    { label: "registry readback", internal: "registry-readback" },
+  );
   return plan;
 }
 
@@ -77,17 +87,22 @@ export function scanCrateForSecrets(crateDir) {
   return [...new Set(violations)].sort();
 }
 
-export function runCargoPublish(options, execute = spawnSync) {
+export async function runCargoPublish(options, execute = (_command, args, settings) => runCargoSync(args, settings), deps = {}) {
   const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
   const manifest = path.join(crateDir, "Cargo.toml");
   if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
   const cargoVersion = fs.readFileSync(manifest, "utf8").match(/^version\s*=\s*"([^"]+)"/m)?.[1];
-  enforcePublicationGate({
+  const gateOptions = {
     kind: "cargo", name: options.crate, version: cargoVersion, packagePath: crateDir,
     evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(options.workspaceRoot, "cargo", options.crate)),
-  }, { dryRun: options.dryRun });
+  };
+  const gate = (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { dryRun: options.dryRun });
+  const expectedSha256 = gate.evidence?.artifactSha256;
   const plan = buildCargoPublishPlan({ ...options, crateDir });
 
+  let targetDir;
+  let artifact;
+  let publication;
   for (const step of plan) {
     process.stdout.write(`[right-release] cargo ${step.label}\n`);
     if (step.internal === "secret-scan") {
@@ -95,6 +110,19 @@ export function runCargoPublish(options, execute = spawnSync) {
       if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
       continue;
     }
+    if (step.internal === "verify-archive") {
+      // Revalidate source/evidence after packaging; preserve that exact evidence object.
+      const current = (deps.enforceGate ?? enforcePublicationGate)(gateOptions);
+      if (current.evidence?.artifactSha256 !== expectedSha256) throw new Error("publication evidence changed during packaging");
+      artifact = readVerifiedArtifact(path.join(targetDir, "package", `${options.crate}-${cargoVersion}.crate`),
+        { sha256: current.evidence?.artifactSha256 });
+      continue;
+    }
+    if (step.internal === "registry-readback") {
+      publication = await verifyCargoRegistry({ name: options.crate, version: cargoVersion, sha256: artifact.sha256 }, deps);
+      continue;
+    }
+    if (step.label === "registry publish") assertArtifactUnchanged(artifact);
     const result = execute(step.command, step.args, {
       cwd: options.workspaceRoot,
       encoding: "utf8",
@@ -106,7 +134,11 @@ export function runCargoPublish(options, execute = spawnSync) {
       if (step.capture && result.stderr) process.stderr.write(result.stderr);
       throw new Error(`${step.label} failed with exit code ${result.status}`);
     }
-    if (step.capture) {
+    if (step.label === "package location") {
+      const metadata = JSON.parse(result.stdout);
+      if (typeof metadata.target_directory !== "string" || !path.isAbsolute(metadata.target_directory)) throw new Error("invalid Cargo package target directory");
+      targetDir = metadata.target_directory;
+    } else if (step.capture) {
       if (result.stderr) process.stderr.write(result.stderr);
       const files = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);
       const violations = packageFileViolations(files);
@@ -114,6 +146,7 @@ export function runCargoPublish(options, execute = spawnSync) {
       process.stdout.write(`${files.join("\n")}\n`);
     }
   }
+  return publication ?? { name: options.crate, version: cargoVersion, dryRun: true };
 }
 
 function walkFiles(root) {
@@ -136,21 +169,19 @@ function valueAfter(argv, flag) {
   return index >= 0 ? argv[index + 1] : undefined;
 }
 
-function main() {
+async function main() {
   const options = parseCargoPublishArgs(process.argv.slice(2));
-  runCargoPublish(options);
+  const result = await runCargoPublish(options);
   process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
   if (!options.dryRun) {
-    const version = fs.readFileSync(path.join(options.workspaceRoot, "crates", options.crate, "Cargo.toml"), "utf8").match(/^version\s*=\s*"([^"]+)"/m)?.[1];
-    if (version) recordPublished({ registry: "cargo", name: options.crate, version });
+    recordPublished({ registry: "cargo", name: result.name, version: result.version });
   }
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
-  try {
-    main();
-  } catch (error) {
-    process.stderr.write(`right-release publish cargo: ${error instanceof Error ? error.message : String(error)}\n`);
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  main().catch((error) => {
+    process.stderr.write(`right-release publish cargo: ${error.code ? `[${error.code}] ` : ""}${error.message}\n`);
     process.exitCode = 1;
-  }
+  });
 }