@rightkit/release 0.2.135 → 0.2.137

package/rightkit-signing-agent.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { resolveManagedRoots } from './managed-roots.mjs';
 import * as fs from "node:fs";
 import net from "node:net";
 import os from "node:os";
@@ -17,12 +18,12 @@ export class SigningAgentError extends Error {
 }
 const fail = (code, message) => { throw new SigningAgentError(code, message); };
 export function signingAgentPaths(home = os.userInfo().homedir) {
-  const directory = path.join(home, "Library/Application Support/Orthic Labs/shared/signing-agent");
+  const directory = resolveManagedRoots({ platform: "darwin", home }).signingAgent;
   return { directory, socket: path.join(directory, "agent.sock"), token: path.join(directory, "token"),
     config: path.join(directory, "config.json"), runtime: path.join(directory, "runtime"),
     log: path.join(directory, "requests.jsonl"), plist: path.join(home, "Library/LaunchAgents", `${AGENT_LABEL}.plist`) };
 }
-export function defaultSigningRoots(home = os.userInfo().homedir, managedRoot = "/Volumes/D/.rightkit-managed", cargoTargetDirs = []) {
+export function defaultSigningRoots(home = os.userInfo().homedir, managedRoot = resolveManagedRoots({ home }).dataRoot, cargoTargetDirs = []) {
   return [...new Set(["/Volumes/D/claude", managedRoot, "/Volumes/D/rightkit-build-control",
     path.join(home, "Library/Caches/RightSuite/release"), "/tmp", "/private/tmp", os.tmpdir(), ...cargoTargetDirs])];
 }
@@ -380,7 +381,8 @@ export async function startSigningAgent({ paths = signingAgentPaths(), config, i
   server.on("error", () => { log({ event: "service.failed", code: "MAC_SIGNING_AGENT_SOCKET" }); });
   return server;
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   process.umask(0o077);
   startSigningAgent().then((server) => {
     const stop = () => { managedSigningLog(signingAgentPaths().log, { event: "service.stopping" }); server.close(() => process.exit(0)); setTimeout(() => process.exit(0), 2000).unref(); };

package/rightkit-sync.mjs

@@ -3,7 +3,7 @@
 // Every publishable crate under crates/ and package under packages/ is looked up; a newer
 // published version becomes the staged (latest) version and the one it replaces stays allowed
 // in legacyCargo / legacyNpm, so apps pinned to it keep validating until they adopt.
-import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -189,6 +189,9 @@ export function syncConsumerCopies(root = rightkitRoot) {
     ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
     ["rightkit-drift.mjs", path.join(root, "packages", "build-control-policy", "src", "rightkit-drift.mjs")],
     ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
+    ["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
+    ["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
+    ["ownership-availability.mjs", path.join(root, "packages", "build-control-clients", "src", "ownership-availability.mjs")],
   ];
   const updated = [];
   for (const [source, target] of targets) {
@@ -201,7 +204,8 @@ export function syncConsumerCopies(root = rightkitRoot) {
   return updated;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const main = async () => {
     const args = process.argv.slice(2);
     if (args[0] === "stage") {

package/rightkit-versions.json

@@ -13,28 +13,28 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/app-shell": "0.2.1",
+    "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
-    "@rightkit/doc-render": "0.1.3",
-    "@rightkit/git": "0.2.26",
-    "@rightkit/hooks": "0.1.1",
+    "@rightkit/doc-render": "0.1.4",
+    "@rightkit/git": "0.2.30",
+    "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
-    "@rightkit/legal-ui": "0.1.3",
+    "@rightkit/legal-ui": "0.2.0",
     "@rightkit/license": "0.1.8",
     "@rightkit/logs": "0.1.4",
-    "@rightkit/media-ui": "0.2.6",
-    "@rightkit/onboarding": "0.2.3",
+    "@rightkit/media-ui": "0.3.0",
+    "@rightkit/onboarding": "0.3.0",
     "@rightkit/pdf-ui": "0.1.2",
-    "@rightkit/platform-ui": "0.1.2",
-    "@rightkit/qa": "0.3.2",
+    "@rightkit/platform-ui": "0.2.0",
+    "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.135",
-    "@rightkit/settings-ui": "0.2.7",
+    "@rightkit/release": "0.2.137",
+    "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
-    "@rightkit/tauri": "0.1.1",
+    "@rightkit/tauri": "0.2.0",
     "@rightkit/theme": "0.2.1",
-    "@rightkit/updates": "0.2.4"
+    "@rightkit/updates": "0.2.5"
   },
   "legacyNpm": {
     "@rightkit/ax": [
@@ -67,15 +67,21 @@
       "0.2.22",
       "0.2.23",
       "0.2.24",
-      "0.2.25"
+      "0.2.25",
+      "0.2.26",
+      "0.2.27",
+      "0.2.28",
+      "0.2.29"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
       "0.1.1",
-      "0.1.2"
+      "0.1.2",
+      "0.1.3"
     ],
     "@rightkit/hooks": [
-      "0.1.0"
+      "0.1.0",
+      "0.1.1"
     ],
     "@rightkit/legal": [
       "0.3.0"
@@ -158,7 +164,9 @@
       "0.2.131",
       "0.2.132",
       "0.2.133",
-      "0.2.134"
+      "0.2.134",
+      "0.2.135",
+      "0.2.136"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -168,11 +176,13 @@
       "0.2.3",
       "0.2.4",
       "0.3.0",
-      "0.3.1"
+      "0.3.1",
+      "0.3.2"
     ],
     "@rightkit/app-shell": [
       "0.1.0",
-      "0.2.0"
+      "0.2.0",
+      "0.2.1"
     ],
     "@rightkit/media-ui": [
       "0.1.0",
@@ -181,7 +191,8 @@
       "0.2.2",
       "0.2.3",
       "0.2.4",
-      "0.2.5"
+      "0.2.5",
+      "0.2.6"
     ],
     "@rightkit/theme": [
       "0.1.0",
@@ -194,21 +205,25 @@
       "0.2.3",
       "0.2.4",
       "0.2.5",
-      "0.2.6"
+      "0.2.6",
+      "0.2.7"
     ],
     "@rightkit/onboarding": [
       "0.1.0",
       "0.2.0",
       "0.2.1",
-      "0.2.2"
+      "0.2.2",
+      "0.2.3"
     ],
     "@rightkit/doc-render": [
       "0.1.0",
       "0.1.1",
-      "0.1.2"
+      "0.1.2",
+      "0.1.3"
     ],
     "@rightkit/platform-ui": [
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "@rightkit/pdf-ui": [
       "0.1.0",
@@ -218,6 +233,12 @@
       "0.1.0",
       "0.1.1",
       "0.1.2"
+    ],
+    "@rightkit/updates": [
+      "0.2.4"
+    ],
+    "@rightkit/tauri": [
+      "0.1.1"
     ]
   },
   "cargo": {
@@ -238,41 +259,50 @@
     "rightkit-tauri": "0.1.0"
   },
   "stagedCargo": {
-    "rightkit-audio": "0.1.1",
+    "agent-room-core": "0.3.0",
+    "rightkit-asr": "0.0.2",
+    "rightkit-audio": "0.2.0",
     "rightkit-automation": "0.1.0",
-    "rightkit-browser": "0.2.2",
+    "rightkit-browser": "0.2.3",
     "rightkit-cache": "0.1.0",
+    "rightkit-contracts": "0.1.2",
     "rightkit-control": "0.1.9",
-    "rightkit-crash": "0.1.0",
-    "rightkit-db": "0.3.0",
-    "rightkit-embed": "0.2.2",
+    "rightkit-crash": "0.2.0",
+    "rightkit-db": "0.3.2",
+    "rightkit-embed": "0.3.1",
     "rightkit-framed-sidecar": "0.1.0",
-    "rightkit-fs": "0.1.0",
-    "rightkit-http": "0.1.0",
-    "rightkit-jobs": "0.2.2",
+    "rightkit-fs": "0.3.2",
+    "rightkit-fsindex": "0.1.0",
+    "rightkit-http": "0.2.2",
+    "rightkit-jobs": "0.2.6",
     "rightkit-license": "0.1.3",
     "rightkit-logs": "0.2.0",
-    "rightkit-mcp": "0.3.1",
-    "rightkit-media": "0.2.3",
-    "rightkit-models": "0.2.2",
-    "rightkit-oauth": "0.2.1",
-    "rightkit-ort": "0.2.0",
-    "rightkit-pdf": "0.1.0",
+    "rightkit-mcp": "0.5.1",
+    "rightkit-media": "0.2.4",
+    "rightkit-models": "0.2.7",
+    "rightkit-oauth": "0.3.0",
+    "rightkit-ocr": "0.1.2",
+    "rightkit-ort": "0.2.2",
+    "rightkit-ownership": "0.2.0",
+    "rightkit-pdf": "0.2.0",
     "rightkit-playback": "0.1.1",
-    "rightkit-process": "0.3.1",
-    "rightkit-qa": "0.2.12",
-    "rightkit-qts": "0.2.1",
-    "rightkit-qts-ggml": "0.1.0",
-    "rightkit-qts-ggml-sys": "0.1.0",
-    "rightkit-sandbox": "0.2.4",
-    "rightkit-search": "0.1.0",
-    "rightkit-secrets": "0.1.0",
-    "rightkit-service": "0.1.0",
+    "rightkit-process": "0.3.3",
+    "rightkit-qa": "0.2.14",
+    "rightkit-qts": "0.2.4",
+    "rightkit-qts-ggml": "0.1.1",
+    "rightkit-qts-ggml-sys": "0.1.1",
+    "rightkit-sandbox": "0.3.3",
+    "rightkit-search": "0.2.0",
+    "rightkit-secrets": "0.1.2",
+    "rightkit-service": "0.1.3",
     "rightkit-settings": "0.1.0",
-    "rightkit-shell": "0.1.3",
-    "rightkit-speech-client": "0.3.0",
+    "rightkit-shell": "0.1.4",
+    "rightkit-speech-client": "0.3.2",
     "rightkit-sync": "0.1.0",
-    "rightkit-tauri": "0.1.1",
+    "rightkit-tauri": "0.1.2",
+    "rightkit-transcript": "0.1.0",
+    "rightkit-tts": "0.1.0",
+    "rightkit-vad": "0.0.2",
     "rightkit-watch": "0.3.1"
   },
   "swift": {
@@ -289,125 +319,162 @@
   },
   "registry": {
     "cargo": {
-      "rightkit-audio": "0.1.1",
+      "rightkit-asr": "0.0.2",
+      "rightkit-audio": "0.2.0",
       "rightkit-browser": "0.2.2",
       "rightkit-cache": "0.1.0",
       "rightkit-control": "0.1.9",
-      "rightkit-crash": "0.1.0",
-      "rightkit-db": "0.3.0",
-      "rightkit-embed": "0.2.2",
+      "rightkit-crash": "0.2.0",
+      "rightkit-db": "0.3.2",
+      "rightkit-embed": "0.3.1",
       "rightkit-framed-sidecar": "0.1.0",
-      "rightkit-fs": "0.1.0",
-      "rightkit-http": "0.1.0",
-      "rightkit-jobs": "0.2.2",
+      "rightkit-fs": "0.3.2",
+      "rightkit-fsindex": "0.1.0",
+      "rightkit-http": "0.2.2",
+      "rightkit-jobs": "0.2.6",
       "rightkit-license": "0.1.3",
       "rightkit-logs": "0.2.0",
-      "rightkit-mcp": "0.3.1",
-      "rightkit-media": "0.2.3",
-      "rightkit-models": "0.2.2",
-      "rightkit-oauth": "0.2.1",
-      "rightkit-ort": "0.2.0",
-      "rightkit-pdf": "0.1.0",
+      "rightkit-mcp": "0.5.1",
+      "rightkit-media": "0.2.4",
+      "rightkit-models": "0.2.7",
+      "rightkit-oauth": "0.3.0",
+      "rightkit-ocr": "0.1.2",
+      "rightkit-ort": "0.2.2",
+      "rightkit-ownership": "0.2.0",
+      "rightkit-pdf": "0.2.0",
       "rightkit-playback": "0.1.1",
-      "rightkit-process": "0.3.1",
-      "rightkit-qa": "0.2.12",
-      "rightkit-qts": "0.2.1",
-      "rightkit-qts-ggml": "0.1.0",
-      "rightkit-qts-ggml-sys": "0.1.0",
-      "rightkit-sandbox": "0.2.4",
-      "rightkit-search": "0.1.0",
-      "rightkit-secrets": "0.1.0",
-      "rightkit-service": "0.1.0",
+      "rightkit-process": "0.3.3",
+      "rightkit-qa": "0.2.14",
+      "rightkit-qts": "0.2.4",
+      "rightkit-qts-ggml": "0.1.1",
+      "rightkit-qts-ggml-sys": "0.1.1",
+      "rightkit-sandbox": "0.3.3",
+      "rightkit-search": "0.2.0",
+      "rightkit-secrets": "0.1.2",
+      "rightkit-service": "0.1.3",
       "rightkit-settings": "0.1.0",
-      "rightkit-shell": "0.1.3",
-      "rightkit-speech-client": "0.3.0",
-      "rightkit-tauri": "0.1.1",
+      "rightkit-shell": "0.1.4",
+      "rightkit-speech-client": "0.3.2",
+      "rightkit-tauri": "0.1.2",
+      "rightkit-transcript": "0.1.0",
+      "rightkit-tts": "0.1.0",
+      "rightkit-vad": "0.0.2",
       "rightkit-watch": "0.3.1"
     },
     "npm": {
-      "@rightkit/app-shell": "0.2.1",
+      "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
-      "@rightkit/doc-render": "0.1.3",
-      "@rightkit/git": "0.2.26",
-      "@rightkit/hooks": "0.1.1",
+      "@rightkit/doc-render": "0.1.4",
+      "@rightkit/git": "0.2.30",
+      "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
-      "@rightkit/legal-ui": "0.1.3",
+      "@rightkit/legal-ui": "0.2.0",
       "@rightkit/license": "0.1.8",
       "@rightkit/logs": "0.1.4",
-      "@rightkit/media-ui": "0.2.6",
-      "@rightkit/onboarding": "0.2.3",
+      "@rightkit/media-ui": "0.3.0",
+      "@rightkit/onboarding": "0.3.0",
       "@rightkit/pdf-ui": "0.1.2",
-      "@rightkit/platform-ui": "0.1.2",
-      "@rightkit/qa": "0.3.2",
+      "@rightkit/platform-ui": "0.2.0",
+      "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.134",
-      "@rightkit/settings-ui": "0.2.7",
+      "@rightkit/release": "0.2.137",
+      "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
-      "@rightkit/tauri": "0.1.1",
+      "@rightkit/tauri": "0.2.0",
       "@rightkit/theme": "0.2.1",
-      "@rightkit/updates": "0.2.4"
+      "@rightkit/updates": "0.2.5"
     }
   },
   "legacyCargo": {
     "rightkit-browser": [
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.2.2"
     ],
     "rightkit-models": [
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4",
+      "0.2.5",
+      "0.2.6"
     ],
     "rightkit-audio": [
-      "0.1.0"
+      "0.1.0",
+      "0.1.1"
     ],
     "rightkit-db": [
-      "0.2.1"
+      "0.2.1",
+      "0.3.0",
+      "0.3.1"
     ],
     "rightkit-embed": [
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.3.0"
     ],
     "rightkit-jobs": [
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4",
+      "0.2.5"
     ],
     "rightkit-mcp": [
       "0.1.1",
       "0.2.0",
-      "0.3.0"
+      "0.3.0",
+      "0.3.1",
+      "0.4.0",
+      "0.5.0"
     ],
     "rightkit-media": [
-      "0.2.2"
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-oauth": [
-      "0.2.0"
+      "0.2.0",
+      "0.2.1"
     ],
     "rightkit-ort": [
-      "0.1.4"
+      "0.1.4",
+      "0.2.0",
+      "0.2.1"
     ],
     "rightkit-playback": [
       "0.1.0"
     ],
     "rightkit-process": [
       "0.2.1",
-      "0.3.0"
+      "0.3.0",
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-qa": [
       "0.2.7",
       "0.2.8",
       "0.2.9",
       "0.2.10",
-      "0.2.11"
+      "0.2.11",
+      "0.2.12"
     ],
     "rightkit-sandbox": [
       "0.1.0",
       "0.2.0",
       "0.2.1",
       "0.2.2",
-      "0.2.3"
+      "0.2.3",
+      "0.2.4",
+      "0.3.0",
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-shell": [
       "0.1.0",
       "0.1.1",
-      "0.1.2"
+      "0.1.2",
+      "0.1.3"
     ],
     "rightkit-watch": [
       "0.1.0",
@@ -415,12 +482,57 @@
       "0.3.0"
     ],
     "rightkit-qts": [
-      "0.2.0"
+      "0.2.0",
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-control": [
       "0.1.6",
       "0.1.7",
       "0.1.8"
+    ],
+    "rightkit-secrets": [
+      "0.1.0",
+      "0.1.1"
+    ],
+    "rightkit-http": [
+      "0.1.0",
+      "0.2.0",
+      "0.2.1"
+    ],
+    "rightkit-fs": [
+      "0.1.0",
+      "0.2.0",
+      "0.3.0",
+      "0.3.1"
+    ],
+    "rightkit-service": [
+      "0.1.0",
+      "0.1.1",
+      "0.1.2"
+    ],
+    "rightkit-search": [
+      "0.1.0"
+    ],
+    "rightkit-tauri": [
+      "0.1.1"
+    ],
+    "rightkit-qts-ggml": [
+      "0.1.0"
+    ],
+    "rightkit-pdf": [
+      "0.1.0"
+    ],
+    "rightkit-speech-client": [
+      "0.3.0",
+      "0.3.1"
+    ],
+    "rightkit-crash": [
+      "0.1.0"
+    ],
+    "rightkit-qts-ggml-sys": [
+      "0.1.0"
     ]
   }
 }

package/runtime-artifact-manifest.mjs

@@ -21,8 +21,8 @@ export const RIGHT_SUITE_APP_KEYS = Object.freeze([
   "voiceright",
 ]);
 
-const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios"]);
-const TARGET_ARCHES = new Set(["x86_64", "aarch64", "universal"]);
+const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios", "any"]);
+const TARGET_ARCHES = new Set(["x86_64", "aarch64", "universal", "any"]);
 const VERSION_FIELDS = Object.freeze([
   "runtime",
   "model",
@@ -32,6 +32,7 @@ const VERSION_FIELDS = Object.freeze([
   "provenance",
 ]);
 const SHA256 = /^[0-9a-f]{64}$/;
+const ARTIFACT_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
 export function buildRuntimeArtifactManifest(input) {
   const entitlement = cloneObject(input.entitlement);
@@ -53,6 +54,7 @@ export function buildRuntimeArtifactManifest(input) {
     provenance: cloneObject(input.provenance),
     promotion: cloneObject(input.promotion),
   };
+  if (Object.hasOwn(input, "artifactId")) manifest.artifactId = input.artifactId;
   if (manifest.distribution?.delivery === "bundled") {
     manifest.object.r2Key = null;
     manifest.pointerKey = null;
@@ -78,11 +80,15 @@ export function runtimeArtifactManifestPointerKey(value) {
   const kind = value?.artifactKind;
   const os = value?.target?.os;
   const arch = value?.target?.arch;
+  const hasArtifactId = value !== null && typeof value === "object" && Object.hasOwn(value, "artifactId");
   assertAppKey(appKey, "entitlement.appKey");
+  if (hasArtifactId) assertArtifactId(value.artifactId);
   if (!RUNTIME_ARTIFACT_KINDS.includes(kind)) fail("artifactKind is unsupported");
   if (!TARGET_OSES.has(os)) fail("target.os is unsupported");
   if (!TARGET_ARCHES.has(arch)) fail("target.arch is unsupported");
-  return `${appKey}/runtime-artifacts/${kind}/${os}/${arch}/current/manifest.json`;
+  if ((os === "any") !== (arch === "any")) fail("target any must use any/any");
+  const artifactPath = hasArtifactId ? `${value.artifactId}/` : "";
+  return `${appKey}/runtime-artifacts/${kind}/${artifactPath}${os}/${arch}/current/manifest.json`;
 }
 
 export function validateRuntimeArtifactManifest(value) {
@@ -90,7 +96,8 @@ export function validateRuntimeArtifactManifest(value) {
   assertExactKeys(value, [
     "schema", "artifactKind", "entitlement", "distribution", "target", "object", "pointerKey",
     "versions", "provenance", "promotion",
-  ], "manifest");
+  ], "manifest", ["artifactId"]);
+  if (Object.hasOwn(value, "artifactId")) assertArtifactId(value.artifactId);
   if (value.schema !== RUNTIME_ARTIFACT_SCHEMA) fail("schema must be 1");
   if (!RUNTIME_ARTIFACT_KINDS.includes(value.artifactKind)) fail("artifactKind is unsupported");
 
@@ -120,6 +127,7 @@ export function validateRuntimeArtifactManifest(value) {
   assertExactKeys(value.target, ["os", "arch"], "target");
   if (!TARGET_OSES.has(value.target.os)) fail("target.os is unsupported");
   if (!TARGET_ARCHES.has(value.target.arch)) fail("target.arch is unsupported");
+  if ((value.target.os === "any") !== (value.target.arch === "any")) fail("target any must use any/any");
 
   assertPlainObject(value.object, "object");
   assertExactKeys(value.object, ["r2Key", "filename", "sha256", "sizeBytes"], "object");
@@ -204,12 +212,18 @@ function sortDeep(value) {
   return value;
 }
 
-function assertExactKeys(value, expected, label) {
-  const expectedSet = new Set(expected);
+function assertExactKeys(value, expected, label, optional = []) {
+  const expectedSet = new Set([...expected, ...optional]);
   for (const key of Object.keys(value)) if (!expectedSet.has(key)) fail(`${label} has unknown field ${key}`);
   for (const key of expected) if (!Object.hasOwn(value, key)) fail(`${label}.${key} is required`);
 }
 
+function assertArtifactId(value) {
+  if (typeof value !== "string" || value.length > 128 || value.trim() !== value || !ARTIFACT_ID.test(value)) {
+    fail("artifactId must be a lowercase safe slug (^[a-z0-9]+(?:-[a-z0-9]+)*$), max 128 characters");
+  }
+}
+
 function assertPlainObject(value, label) {
   if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) fail(`${label} must be a plain object`);
 }

package/sign-updater.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from "./background-process.mjs";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import path from "node:path";
 import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
+import { refuseManagedEnvSecrets, MANAGED_HOST_ENV_SECRET_REFUSED } from "./managed-host-secrets.mjs";
 
 const args = process.argv.slice(2);
 const files = [];
@@ -15,6 +16,10 @@ for (let i = 0; i < args.length; i++) {
 if (!files.length) fail("at least one --file is required");
 
 const env = { ...process.env };
+if (!dryRun) {
+  try { refuseManagedEnvSecrets(process.env, ["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"]); }
+  catch (error) { fail(`[${MANAGED_HOST_ENV_SECRET_REFUSED}] ${error.message}`); }
+}
 if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
   if (process.platform === "win32") {
     const key = path.join(env.APPDATA || "", "ViewRight", "updater.key");

package/signing-agent-client.mjs

@@ -127,7 +127,8 @@ export function requestSigningAgentSync(request, { runClient = spawnSync, home,
   if (result.error || result.status !== 0) throw new SigningAgentError("MAC_SIGNING_AGENT_CONNECTION", "Signing agent client failed");
   return report;
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const { request, home, timeoutMs } = JSON.parse(fs.readFileSync(0, "utf8"));
     const report = await requestSigningAgent(request, { paths: signingAgentPaths(home), timeoutMs,