@rightkit/release 0.2.135 → 0.2.137

package/publish-swift.mjs

@@ -9,7 +9,9 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { digestBytes } from "./publication-artifacts.mjs";
 import { scanCrateForSecrets } from "./publish-cargo.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
@@ -70,8 +72,8 @@ export function buildSwiftPublishPlan({ packageDir, name, version, repo, dryRun
   return plan;
 }
 
-function git(args, cwd) {
-  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
+function git(args, cwd, execute = spawnSync) {
+  const result = execute("git", args, { cwd, encoding: "utf8", windowsHide: true });
   if (result.error) throw result.error;
   if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
   return (result.stdout ?? "").trim();
@@ -84,20 +86,21 @@ function copyTree(from, to) {
     const source = path.join(from, entry.name);
     const target = path.join(to, entry.name);
     if (entry.isDirectory()) copyTree(source, target);
-    else if (entry.isFile()) fs.copyFileSync(source, target);
+    else if (entry.isFile()) { fs.copyFileSync(source, target); fs.chmodSync(target, fs.statSync(source).mode & 0o777); }
+    else throw new Error(`unsupported Swift source entry: ${entry.name}`);
   }
 }
 
-function mirrorAndTag(step, packageDir, work) {
+function mirrorAndTag(step, packageDir, work, execute) {
   const mirror = path.join(work, "rightkit-swift"); // SwiftPM names the package by repo directory
-  if (step.repo) git(["clone", step.repo, mirror], work);
-  else { fs.mkdirSync(mirror, { recursive: true }); git(["init", "-q", "-b", "main"], mirror); }
+  if (step.repo) git(["clone", step.repo, mirror], work, execute);
+  else { fs.mkdirSync(mirror, { recursive: true }); git(["init", "-q", "-b", "main"], mirror, execute); }
   for (const entry of fs.readdirSync(mirror)) if (entry !== ".git") fs.rmSync(path.join(mirror, entry), { recursive: true, force: true });
   copyTree(packageDir, mirror);
-  git(["add", "-A"], mirror);
-  git(["-c", "user.email=release@rightsuite.invalid", "-c", "user.name=right-release", "commit", "-q", "--allow-empty", "-m", `RightKitSwift ${step.tag}`], mirror);
-  if (git(["tag", "-l", step.tag], mirror) !== "") throw new Error(`tag ${step.tag} already exists: bump VERSION`);
-  git(["tag", step.tag], mirror);
+  git(["add", "-A"], mirror, execute);
+  git(["-c", "user.email=release@rightsuite.invalid", "-c", "user.name=right-release", "commit", "-q", "--allow-empty", "-m", `RightKitSwift ${step.tag}`], mirror, execute);
+  if (git(["tag", "-l", step.tag], mirror, execute) !== "") throw new Error(`tag ${step.tag} already exists: bump VERSION`);
+  git(["tag", step.tag], mirror, execute);
   return mirror;
 }
 
@@ -117,33 +120,58 @@ function consumeFresh(step, mirror, work, execute) {
   if (!pins.includes(`"version" : "${step.tag}"`)) throw new Error(`consumer did not resolve exact tag ${step.tag}`);
 }
 
+// Evidence binds this exact git-archive command, rooted at the package tree.
+export function verifySwiftSourceArchive(bytes, evidence) {
+  if (!/^[a-f0-9]{64}$/.test(evidence?.artifactSha256 ?? "")) throw new Error("Swift source archive hash evidence is required");
+  if (digestBytes(bytes) !== evidence.artifactSha256) throw new Error("Swift source archive sha256 does not match evidence artifactSha256");
+  return bytes;
+}
+
 export function runSwiftPublish(options, execute = spawnSync) {
   const packageDir = options.packageDir;
   const { name, version } = readPackageIdentity(packageDir);
   const workspaceRoot = path.resolve(options.workspace ?? path.join(packageDir, "..", ".."));
-  enforcePublicationGate({
+  const gate = enforcePublicationGate({
     kind: "swift", name, version, packagePath: packageDir,
     evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(workspaceRoot, "swift", name)),
   }, { dryRun: options.dryRun });
+  const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
+  const sourceCommit = gate.evidence?.commit ?? "HEAD";
+  const tree = git(["rev-parse", prefix ? `${sourceCommit}:${prefix}` : `${sourceCommit}^{tree}`], packageDir, execute);
+  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: packageDir, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
+  if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift source archive creation failed");
+  const bytes = Buffer.from(archive.stdout);
+  if (gate.ok || !options.dryRun) verifySwiftSourceArchive(bytes, gate.evidence);
   const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
   const work = fs.mkdtempSync(path.join(os.tmpdir(), "rightkit-swift-publish-"));
   let mirror = null;
+  let sealedCommit;
+  const snapshot = path.join(work, "source");
+  fs.mkdirSync(snapshot);
   try {
+    const extracted = execute("tar", ["-xf", "-", "-C", snapshot], { input: bytes, windowsHide: true });
+    if (extracted.error || extracted.status !== 0) throw new Error("Swift source archive extraction failed");
+    const identity = readPackageIdentity(snapshot);
+    if (identity.name !== name || identity.version !== version) throw new Error("Swift source archive identity mismatch");
     for (const step of plan) {
       process.stdout.write(`[right-release] swift ${step.label}\n`);
       if (step.internal === "secret-scan") {
-        const violations = scanCrateForSecrets(packageDir);
+        const violations = scanCrateForSecrets(snapshot);
         if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
         continue;
       }
-      if (step.internal === "mirror") { mirror = mirrorAndTag(step, packageDir, work); continue; }
+      if (step.internal === "mirror") { mirror = mirrorAndTag(step, snapshot, work, execute);
+        if (git(["rev-parse", `${step.tag}^{tree}`], mirror, execute) !== tree) throw new Error("Swift mirror differs from verified source archive");
+        sealedCommit = git(["rev-parse", step.tag], mirror, execute);
+        continue; }
       if (step.internal === "consume") { consumeFresh(step, mirror, work, execute); continue; }
       if (step.internal === "push") {
-        git(["push", "origin", "HEAD"], mirror);
-        git(["push", "origin", step.tag], mirror);
+        if (git(["rev-parse", `${sealedCommit}^{tree}`], mirror, execute) !== tree || git(["rev-parse", step.tag], mirror, execute) !== sealedCommit) throw new Error("Swift publication tag changed after verification");
+        const branch = git(["symbolic-ref", "--short", "HEAD"], mirror, execute);
+        git(["push", "--atomic", "origin", `${sealedCommit}:refs/heads/${branch}`, `${sealedCommit}:refs/tags/${step.tag}`], mirror, execute);
         continue;
       }
-      const result = execute(step.command, step.args, { cwd: packageDir, encoding: "utf8", windowsHide: true, stdio: "inherit" });
+      const result = execute(step.command, step.args.map((arg) => arg === packageDir ? snapshot : arg), { cwd: snapshot, encoding: "utf8", windowsHide: true, stdio: "inherit" });
       if (result.error) {
         if (result.error.code === "ENOENT") {
           throw new Error(`${step.command} not found -- run publish swift on macOS/Linux with the Swift toolchain installed`);
@@ -158,7 +186,8 @@ export function runSwiftPublish(options, execute = spawnSync) {
   return { name, version, published: !options.dryRun };
 }
 
-if (process.argv[1]?.endsWith("publish-swift.mjs")) {
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const options = parseSwiftPublishArgs(process.argv.slice(2));
     const packageDir = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "../../swift/RightKitSwift");

package/publish-update.mjs

@@ -1,16 +1,19 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { access, readFile, stat } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
+import { spawnSync } from "./background-process.mjs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { spawn } from "./background-process.mjs";
 import { pruneReleaseObjects } from "./prune-r2.mjs";
 import { loadReleaseToken } from "./release-token.mjs";
 import { registerRightAppsRelease } from "./rightapps-register.mjs";
-import { recordPublishedVersion, resolveArtifactInput } from "./artifact-storage.mjs";
+import { recordPublishedVersion } from "./artifact-storage.mjs";
+import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { assertCleanSource } from "./source-gate.mjs";
+import { verifyPublicationRelease, PublicationError, assertArtifactUnchanged } from "./publication-artifacts.mjs";
+import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
+import { verifyPlatformTrust } from "./github-release.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
-const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
 const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev";
 const PUBLIC_BASE = process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
@@ -20,6 +23,7 @@ const args = process.argv.slice(2);
 let configName = "right-release.config.mjs";
 let platform = process.platform === "win32" ? "win" : "mac";
 let dryRun = false;
+let releaseId = "";
 
 for (let i = 0; i < args.length; i++) {
   const arg = args[i];
@@ -27,12 +31,14 @@ for (let i = 0; i < args.length; i++) {
   else if (arg === "--platform") platform = args[++i];
   else if (arg === "--tier") tier = args[++i];
   else if (arg.startsWith("--tier=")) tier = arg.slice("--tier=".length);
+  else if (arg === "--release") releaseId = args[++i];
   else if (arg === "--dry-run") dryRun = true;
   else fail(`unknown argument: ${arg}`);
 }
 
 if (tier !== "patch" && tier !== "update") fail("tier is required (--tier patch|update or RIGHT_RELEASE_TIER)");
 
+if (!["win", "mac"].includes(platform)) throw new PublicationError("PUBLICATION_PLATFORM_INVALID", "--platform must be win or mac");
 const configPath = path.resolve(configName);
 const root = path.dirname(configPath);
 const config = (await import(pathToFileURL(configPath))).default;
@@ -43,13 +49,47 @@ const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
 const installers = target?.installer?.artifacts ?? [];
 const versionForStorage = config.version || target?.updater?.version;
-const artifactFile = (declared) => versionForStorage
-  ? resolveArtifactInput({ root, app: config.app, version: versionForStorage, declared })
-  : path.resolve(root, declared);
+let sealed;
+if (!dryRun || releaseId) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(releaseId)) throw new PublicationError("PUBLICATION_SEAL_REQUIRED", "--release <sealed-id> is required");
+  const repoRoot = git(["rev-parse", "--show-toplevel"]);
+  assertPrimaryReleaseCheckout(repoRoot);
+  const commit = git(["rev-parse", "HEAD"]);
+  assertCleanSource({ status: git(["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release publish-update" });
+  sealed = verifyPublicationRelease({ sealedDir: path.join(repoRoot, ".right-release", "sealed", releaseId, platform === "win" ? "windows" : "mac"), repoRoot, appRoot: root, commit, app: config.app, version: versionForStorage, platform, configPath, releaseId });
+  const routes = sealed.manifest.routes?.[tier] ?? [];
+  const configured = [...(tier === "patch" ? installers.map((item) => ({ ...item, role: "installer" })) : []), ...artifacts.map((item) => ({ ...item, key: tier === "patch" ? patchInstallerKey(item) : item.key, role: "updater" }))];
+  for (const item of configured) {
+    if (!routes.some((route) => route.key === item.key && route.role === item.role && route.bucket === (tier === "patch" ? "public" : "private") && route.name === path.basename(item.file) && (!item.signature || route.signature === path.basename(item.signature)))) throw new PublicationError("PUBLICATION_ROUTE_INVALID", `config route is not sealed: ${item.key}`);
+  }
+  if (!configured.length) throw new PublicationError("PUBLICATION_ROUTE_INVALID", "seal has no configured upload route");
+  const installer = sealed.manifest.files.find((item) => item.role.split("+").includes("installer"));
+  if (!installer) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed installer required for platform trust verification");
+  verifyPlatformTrust({ sealed, installer: path.join(sealed.sealedDir, installer.name) });
+  for (const artifact of sealed.artifacts.values()) assertArtifactUnchanged(artifact);
+}
+const artifactFile = (declared) => {
+  if (!sealed) return path.resolve(root, declared);
+  const artifact = sealed.artifacts.get(path.basename(declared));
+  if (!artifact) throw new PublicationError("PUBLICATION_ARTIFACT_MISSING", `artifact is not sealed: ${declared}`);
+  return artifact.file;
+};
+const verifiedArtifact = (file) => sealed.artifacts.get(path.basename(file));
+const signatureText = (file) => {
+  const signature = assertArtifactUnchanged(verifiedArtifact(file)).toString("utf8").trim();
+  if (!signature) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", `sealed updater signature is empty: ${file}`);
+  return signature;
+};
+function git(args) {
+  const result = spawnSync("git", args, { cwd: root, encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) throw new PublicationError("PUBLICATION_SOURCE_INVALID", "cannot read publication source identity");
+  return result.stdout.trim();
+}
 
 if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
+if (sealed) for (const artifact of artifacts) signatureText(artifactFile(artifact.signature));
 let releaseToken = null;
 if (!dryRun && (tier === "update" || artifacts.length > 0)) {
   try {
@@ -62,8 +102,7 @@ if (!dryRun && (tier === "update" || artifacts.length > 0)) {
 if (tier === "patch") {
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
-    const file = artifactFile(installer.file);
-    if (!dryRun) await access(file).catch(() => fail(`missing signed installer: ${installer.file}`));
+    artifactFile(installer.file);
   }
   const platforms = {};
   const registrations = new Map();
@@ -76,16 +115,12 @@ if (tier === "patch") {
     assertCurrentKey(installerKey, "installer");
     const file = artifactFile(artifact.file);
     const signatureFile = artifactFile(artifact.signature);
-    if (!dryRun) {
-      await access(file).catch(() => fail(`missing patch updater payload: ${artifact.file}`));
-      await access(signatureFile).catch(() => fail(`missing patch updater signature: ${artifact.signature}`));
-    }
     if (!uploadedKeys.has(installerKey)) {
       console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}`);
-      if (!dryRun) await run(process.execPath, [UPLOAD, file, installerKey, "public"], root);
+      if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installerKey, "public", { cwd: root });
       uploadedKeys.add(installerKey);
     }
-    const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
+    const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
     platforms[artifact.platform] = {
@@ -104,7 +139,7 @@ if (tier === "patch") {
     const file = artifactFile(installer.file);
     if (!uploadedKeys.has(installer.key)) {
       console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
-      if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
+      if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installer.key, "public", { cwd: root });
       uploadedKeys.add(installer.key);
     }
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
@@ -126,7 +161,7 @@ if (tier === "patch") {
         private: target.updater.artifacts.map((artifact) => artifact.key),
       },
     });
-    if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform });
+    if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
     process.exit(0);
   }
   const version = config.version || target.updater.version;
@@ -164,7 +199,7 @@ if (tier === "patch") {
       private: [],
     },
   });
-  if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform });
+  if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
   process.exit(0);
 }
 
@@ -176,16 +211,12 @@ for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = artifactFile(artifact.file);
   const signatureFile = artifactFile(artifact.signature);
-  if (!dryRun) {
-    await access(file).catch(() => fail(`missing updater artifact: ${artifact.file}`));
-    await access(signatureFile).catch(() => fail(`missing updater signature: ${artifact.signature}`));
-  }
   if (!uploadedKeys.has(artifact.key)) {
     console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`);
-    if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);
+    if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), artifact.key, "private", { cwd: root });
     uploadedKeys.add(artifact.key);
   }
-  const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
+  const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
   platforms[artifact.platform] = {
@@ -238,14 +269,12 @@ await pruneReleaseObjects({
     private: [...registrations.keys()],
   },
 });
-if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform });
+if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
 
-async function fileMetadata(file) {
-  const bytes = await readFile(file);
-  return {
-    sha256: createHash("sha256").update(bytes).digest("hex"),
-    sizeBytes: (await stat(file)).size,
-  };
+function fileMetadata(file) {
+  const artifact = verifiedArtifact(file);
+  assertArtifactUnchanged(artifact);
+  return { sha256: artifact.sha256, sizeBytes: artifact.sizeBytes };
 }
 
 function buildArtifactManifest({ appKey, appVersion, tier, platform, artifacts }) {
@@ -260,13 +289,6 @@ function buildArtifactManifest({ appKey, appVersion, tier, platform, artifacts }
   };
 }
 
-function run(cmd, runArgs, cwd) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(cmd, runArgs, { cwd, env: process.env, stdio: "inherit", windowsHide: true });
-    child.on("error", reject);
-    child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)));
-  });
-}
 
 function assertCurrentKey(key, kind) {
   const pattern = kind === "installer"

package/r2-verified-upload.mjs

@@ -0,0 +1,41 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { assertArtifactUnchanged, PublicationError, verifyArtifactFile } from "./publication-artifacts.mjs";
+
+// Wrangler's pipe input transports the verified buffer, with no path lookup by its child.
+export function uploadVerifiedR2Artifact(artifact, key, bucket, { run = spawnSync, env = process.env, cwd } = {}) {
+  if (!["public", "private"].includes(bucket) || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(key ?? "") || key.includes("..")) throw new PublicationError("PUBLICATION_ROUTE_INVALID", "invalid R2 publication route");
+  const input = assertArtifactUnchanged(artifact);
+  const cleanEnv = { ...env, CLOUDFLARE_ACCOUNT_ID: env.CLOUDFLARE_ACCOUNT_ID || "03ae77ccd7a07bcbb2dcfde47fa7ba3a" };
+  for (const name of ["CLOUDFLARE_API_KEY", "CLOUDFLARE_EMAIL", "CF_API_KEY", "CF_EMAIL"]) delete cleanEnv[name];
+  const result = run("pnpm", ["dlx", "wrangler@4", "r2", "object", "put", `${bucket === "public" ? "rightapps-downloads" : "rightapps-updates"}/${key}`, "--pipe", "--remote"], {
+    cwd, env: cleanEnv, input, stdio: ["pipe", "inherit", "inherit"], windowsHide: true, shell: process.platform === "win32",
+  });
+  if (result.error || result.status !== 0) throw new PublicationError("PUBLICATION_UPLOAD_FAILED", `R2 upload failed: ${key}`);
+}
+
+// Path-only large-file transport: success requires remote bytes matching captured evidence.
+export function uploadVerifiedR2File(file, evidence, key, bucket, { run = spawnSync, env = process.env, cwd, dryRun = false } = {}) {
+  if (!["public", "private"].includes(bucket) || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(key ?? "") || key.includes("..")) throw new PublicationError("PUBLICATION_ROUTE_INVALID", "invalid R2 publication route");
+  const artifact = verifyArtifactFile(file, evidence);
+  if (dryRun) return artifact;
+  const target = `${bucket === "public" ? "rightapps-downloads" : "rightapps-updates"}/${key}`;
+  const cleanEnv = { ...env, CLOUDFLARE_ACCOUNT_ID: env.CLOUDFLARE_ACCOUNT_ID || "03ae77ccd7a07bcbb2dcfde47fa7ba3a" };
+  for (const name of ["CLOUDFLARE_API_KEY", "CLOUDFLARE_EMAIL", "CF_API_KEY", "CF_EMAIL"]) delete cleanEnv[name];
+  const options = { cwd, env: cleanEnv, windowsHide: true, shell: process.platform === "win32", encoding: "utf8" };
+  const prefix = ["dlx", "wrangler@4", "r2", "object"];
+  const result = run("pnpm", [...prefix, "put", target, "--file", path.resolve(file), "--remote"], { ...options, stdio: "inherit" });
+  if (result.error || result.status !== 0) throw new PublicationError("PUBLICATION_UPLOAD_FAILED", `R2 upload failed; inspect remote key ${target}`);
+  const temporary = mkdtempSync(path.join(os.tmpdir(), "rightkit-r2-readback-"));
+  try {
+    const downloaded = path.join(temporary, "object");
+    const readback = run("pnpm", [...prefix, "get", target, "--file", downloaded, "--remote"], options);
+    if (readback.error || readback.status !== 0) throw new Error("remote readback failed");
+    verifyArtifactFile(downloaded, artifact);
+  } catch (error) {
+    throw new PublicationError("PUBLICATION_REMOTE_MISMATCH", `R2 verification failed (${error.message}); remove remote key ${target}`);
+  } finally { rmSync(temporary, { recursive: true, force: true }); }
+  return artifact;
+}

package/registry-parity.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
+import { realpathSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { execFileSync } from './background-process.mjs';
 import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { basename, join, relative } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
+import { basename, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 const packageRoot = fileURLToPath(new URL('.', import.meta.url));
 
@@ -108,7 +109,8 @@ export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl
   }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const flag = process.argv.indexOf('--package');
   const allowUnpublished = process.argv.includes('--allow-unpublished');
   (flag > 0 ? verifyRegistryParity({ allowUnpublished, packageName: process.argv[flag + 1] }) : verifyAllRegistryParity({ allowUnpublished }))

package/release-state.mjs

@@ -123,6 +123,7 @@ export function verifySealedRelease(sealedDir) {
   if (manifest.kind != null && typeof manifest.kind !== "string") throw new Error("sealed manifest kind must be a string when present");
   if (!manifest.checkpoints?.includes("sealed")) throw new Error("release is not sealed");
   for (const item of manifest.files ?? []) {
+    if (typeof item.name !== "string" || path.basename(item.name) !== item.name || item.name === "." || item.name === "..") throw new Error("unsafe sealed artifact name");
     const file = path.join(sealedDir, item.name);
     if (!existsSync(file)) throw new Error(`sealed file missing: ${item.name}`);
     const bytes = readFileSync(file);

package/release-token.mjs

@@ -1,4 +1,5 @@
 import { execFile } from "./background-process.mjs";
+import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
 import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -19,6 +20,7 @@ async function readTokenFile(file) {
 }
 
 export async function loadReleaseToken({ env = process.env, platform = process.platform } = {}) {
+  refuseManagedEnvSecrets(env, ["RIGHTAPPS_RELEASE_TOKEN", "RIGHTAPPS_RELEASE_TOKEN_FILE"]);
   const direct = env.RIGHTAPPS_RELEASE_TOKEN?.trim();
   if (direct) return direct;
 

package/rightkit-drift.mjs

@@ -4,7 +4,7 @@
 // Self-contained (node: built-ins only) so the SessionStart hook can carry a byte copy of it.
 //   node rightkit-drift.mjs [--apply [--all]] [app-root]   (--all also adopts breaking bumps)
 import { spawnSync } from "./background-process.mjs";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -102,7 +102,8 @@ export function formatDrift(drift) {
   return [`RightKit updates available (${drift.length}):`, ...drift.map((d) => `- ${d.name} ${d.current} -> ${d.latest}${d.breaking ? " (breaking)" : ""} (${d.file})`)].join("\n");
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const args = process.argv.slice(2); const apply = args.includes("--apply");
   const root = path.resolve(args.find((arg) => !arg.startsWith("--")) ?? process.cwd());
   try {