@rightkit/release 0.2.137 → 0.2.138

package/README.md

@@ -18,6 +18,7 @@ Signing and publication rules are in the workspace file `docs/rules/release-sign
 | Group | Subcommands |
 |---|---|
 | Build | `release`, `build`, `package` |
+| Build (SwiftPM apps) | `swift-package` (`windows-stage`, `msix`, `mac-app`) (config schema 1: `windows.{exe,out,searchDirs,include,dependencies,publisher,assets}`, `mac.{executable,bundleId,out,frameworks,resources,entitlements}`) |
 | Install | `install-app` |
 | Publish | `publish`, `upload`, `publish-update`, `github`, `mirror-root-artifact` |
 | Signing | `sign-windows`, `sign-updater`, `signing-agent`, `create-mac-updater` |

package/cli/right-release.mjs

@@ -26,6 +26,7 @@ const commands = new Map([
   ["ownership", "ownership-command.mjs"],
   ["ownership-approval", "ownership-approval-command.mjs"],
   ["ownership-report", "ownership-report-command.mjs"],
+  ["swift-package", "swift-package-command.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -36,7 +37,7 @@ if (first === "dev") {
     process.exitCode = 1;
   });
 } else {
-const githubBuildCommands = new Set(["release", "build", "package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
+const githubBuildCommands = new Set(["release", "build", "package", "swift-package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
 
 try {
   if (githubBuildCommands.has(first)
@@ -178,6 +179,8 @@ Commands:
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]
                                                       Incremental unsigned build & optional local install
+  swift-package <windows-stage|msix|mac-app> --config <swift-package.json> [--dry-run] [--no-sign] [--sign] [--notarize] [--profile <name>]
+                                                      Stage SwiftPM app; build+sign MSIX (Windows) or assemble+sign+notarize .app (macOS); never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
   publish-update --release <id> --platform mac|win --tier patch|update

package/committed-source.mjs

@@ -132,7 +132,7 @@ function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runne
   const rows = parseTree(runGit(root, ["ls-tree", "-r", "-z", "--full-tree", tree], { encoding: "buffer", maxBuffer: MAX_TREE_BYTES, timeout: COMMAND_TIMEOUT_MS, runner, env }), objectFormat);
   const wanted = new Set(requiredPaths.filter(validatePath));
   const shouldRead = (row) => row.type === "blob" && row.mode !== "120000" && (
-    wanted.has(row.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json", "Cargo.lock", "pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock"].includes(path.posix.basename(row.rel)) ||
+    wanted.has(row.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", "Cargo.lock", "pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock"].includes(path.posix.basename(row.rel)) ||
     /\.(?:rs|ts|tsx|js|mjs|cjs|jsx|swift|m|mm|c|cc|cpp|h|py|go|kt|java|cs)$/i.test(row.rel)
   );
   const candidates = rows.filter(shouldRead);

package/development.mjs

@@ -6,7 +6,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
-import { acquireManagedRunLease, managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
+import { acquireManagedRunLease, managedRuntimeClient, managedRuntimeCommand, runCargoSync } from "./managed-cargo.mjs";
 import { BUNDLE_MARKERS, bundleMarkerBuffer, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
 import { installPortableDevelopment } from "./portable-development.mjs";
 import { signMacosDevelopmentBundle } from "./development-signing.mjs";
@@ -213,7 +213,7 @@ export function resolveCommand(command, args, { root, env = process.env } = {})
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
     const socket = discoverBrokerSocket(env);
     const childEnv = !env.RIGHTKIT_BUILD_BROKER_SOCKET && existsSync(socket) ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : undefined;
-    return { command: process.execPath, args: [client, ...args], ...(childEnv ? { env: childEnv } : {}) };
+    return { ...managedRuntimeCommand(client, args), ...(childEnv ? { env: childEnv } : {}) };
   }
   return { command, args };
 }

package/inventory-check.mjs

@@ -24,7 +24,7 @@ const CACHE_TTL_MS = 60 * 60 * 1000;
 const CONCURRENCY = 8;
 const REQUEST_TIMEOUT_MS = 15_000;
 const CRATES_API_INTERVAL_MS = 1000;
-const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/claude)";
+const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/rightkit)";
 const EXCLUDED_PREFIX = "build-control-";
 const OWNER_PROBE_CRATE = "rightkit-fs";
 const EXTRA_ACCOUNT_CRATES = Object.freeze(["agent-room-core"]);

package/managed-cargo.mjs

@@ -7,13 +7,19 @@ import { spawnSync } from "./background-process.mjs";
 export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
   const roots = managedControlCandidates({ env, platform });
   const paths = platform === 'win32' ? path.win32 : path.posix;
+  // runtime-current ships the native `rustright` client.
   for (const root of roots) {
-    const client = paths.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
+    const client = paths.join(root, "runtime-current", platform === 'win32' ? "rustright.exe" : "rustright");
     if (exists(client)) return client;
   }
   return undefined;
 }
 
+/** Command line that runs the managed client: the native rustright client runs directly. */
+export function managedRuntimeCommand(client, args) {
+  return { command: client, args };
+}
+
 /** Hold a client-run lease that blocks broker runtime cutover until release() (see
  * proveDevelopmentRunsDrained). No managed runtime → no lease; lease I/O failure warns and proceeds. */
 export function acquireManagedRunLease({ command, env = process.env, platform = process.platform, exists = existsSync, pid = process.pid } = {}) {
@@ -43,7 +49,8 @@ export function runCargoSync(args, options = {}, { platform = process.platform,
     const socket = discoverBrokerSocket(env, { platform, exists });
     if (platform === 'darwin' && (!socket || !exists(socket))) return unavailable('RightKit broker socket is unavailable');
     const childEnv = socket ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : env;
-    const result = spawn(process.execPath, [client, "cargo", ...args], { ...options, env: childEnv });
+    const invocation = managedRuntimeCommand(client, ["cargo", ...args]);
+    const result = spawn(invocation.command, invocation.args, { ...options, env: childEnv });
     if (platform === 'darwin' && result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) {
       return { ...result, error: unavailable(String(result.stderr).trim()).error };
     }

package/msix-build.mjs

@@ -0,0 +1,128 @@
+// Windows MSIX packaging for staged desktop apps (SwiftPM exe + app-local DLLs).
+// Order mirrors the Windows rule in docs/rules/release-signing.md: sign raw PE
+// files first, pack the exact signed bytes, then sign the package. All signing
+// goes through sign-windows.mjs (provisioned Azure Artifact Signing); this module
+// never touches credentials and never authenticates anything itself.
+
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { findWindowsSdkTool } from "./preflight.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const here = path.dirname(fileURLToPath(import.meta.url));
+export const MSIX_SIGNER_SUBJECT = "CN=Damned Ventures LLC";
+
+const xml = (value) => String(value).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+const PNG = Buffer.from("89504e470d0a1a0a", "hex");
+
+export function validateMsixIdentity(o) {
+  const errors = [];
+  if (!/^[-.A-Za-z0-9]{3,50}$/.test(o.name ?? "")) errors.push("name must be 3-50 chars of letters, digits, '-' or '.'");
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(o.version ?? "") || o.version.split(".").some((n) => Number(n) > 65535)) errors.push("version must be four numeric parts <=65535");
+  if (!["x64", "arm64"].includes(o.architecture)) errors.push("architecture must be x64 or arm64");
+  if (!/\bCN=/.test(o.publisher ?? "")) errors.push("publisher must be a distinguished name containing CN=");
+  else if (!o.publisher.includes(MSIX_SIGNER_SUBJECT)) errors.push(`publisher must contain ${MSIX_SIGNER_SUBJECT} (the provisioned signing subject); confirm the full DN natively`);
+  if (!o.displayName || !o.publisherDisplayName) errors.push("displayName and publisherDisplayName are required");
+  if (!/\.exe$/i.test(o.executable ?? "") || /[\\/]/.test(o.executable ?? "")) errors.push("executable must be a flat .exe name inside the package");
+  if (errors.length) throw fail("MSIX_INVALID_IDENTITY", errors.join("; "));
+}
+
+export function generateAppxManifest(o) {
+  validateMsixIdentity(o);
+  const deps = (o.dependencies ?? []).filter((d) => d.minVersion).map((d) =>
+    `    <PackageDependency Name="${xml(d.name)}" MinVersion="${xml(d.minVersion)}" Publisher="${xml(d.publisher ?? "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")}" />`);
+  const a = o.assets ?? {};
+  return `<?xml version="1.0" encoding="utf-8"?>
+<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+         xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+         xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+         IgnorableNamespaces="uap rescap">
+  <Identity Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" />
+  <Properties>
+    <DisplayName>${xml(o.displayName)}</DisplayName>
+    <PublisherDisplayName>${xml(o.publisherDisplayName)}</PublisherDisplayName>
+    <Logo>Assets\\StoreLogo.png</Logo>
+  </Properties>
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="${xml(o.minWindowsVersion ?? "10.0.19041.0")}" MaxVersionTested="${xml(o.maxWindowsVersionTested ?? "10.0.26100.0")}" />
+${deps.join("\n")}${deps.length ? "\n" : ""}  </Dependencies>
+  <Resources><Resource Language="${xml(o.language ?? "en-us")}" /></Resources>
+  <Applications>
+    <Application Id="App" Executable="${xml(o.executable)}" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements DisplayName="${xml(o.displayName)}" Description="${xml(o.description ?? o.displayName)}" BackgroundColor="transparent"
+        Square150x150Logo="Assets\\Square150x150Logo.png" Square44x44Logo="Assets\\Square44x44Logo.png" />
+    </Application>
+  </Applications>
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />${(o.capabilities ?? []).map((c) => `\n    <Capability Name="${xml(c)}" />`).join("")}
+  </Capabilities>
+</Package>
+`;
+}
+
+const ASSETS = { storeLogo: "StoreLogo.png", square150: "Square150x150Logo.png", square44: "Square44x44Logo.png" };
+
+/** Copy a staged directory plus assets and manifest into a package root. */
+export function assembleMsixRoot({ stageDir, root, manifest, assets }) {
+  stageDir = path.resolve(stageDir); root = path.resolve(root);
+  if (!existsSync(path.join(stageDir, manifest.executable))) throw fail("MSIX_MISSING_EXECUTABLE", `executable not in staged directory: ${manifest.executable}`);
+  rmSync(root, { recursive: true, force: true });
+  mkdirSync(path.join(root, "Assets"), { recursive: true });
+  for (const entry of readdirSync(stageDir, { withFileTypes: true })) {
+    if (entry.isFile()) copyFileSync(path.join(stageDir, entry.name), path.join(root, entry.name));
+    else throw fail("MSIX_NESTED_STAGE", `staged directory must be flat; found ${entry.name}/ (use include with flat files)`);
+  }
+  for (const [key, target] of Object.entries(ASSETS)) {
+    const source = assets?.[key] && path.resolve(assets[key]);
+    if (!source || !existsSync(source)) throw fail("MSIX_MISSING_ASSET", `assets.${key} (PNG) is required: ${assets?.[key] ?? "unset"}`);
+    if (!readFileSync(source).subarray(0, 8).equals(PNG)) throw fail("MSIX_MISSING_ASSET", `assets.${key} is not a PNG: ${source}`);
+    copyFileSync(source, path.join(root, "Assets", target));
+  }
+  writeFileSync(path.join(root, "AppxManifest.xml"), generateAppxManifest(manifest));
+  return root;
+}
+
+/** PE files the package ships; these get Authenticode before packing. */
+export function peFilesIn(root) {
+  return readdirSync(root).filter((name) => /\.(exe|dll)$/i.test(name)).sort().map((name) => path.join(root, name));
+}
+
+/**
+ * Pack + sign. `run` is injectable for tests. Steps:
+ *  1 sign every PE file in the root (raw bytes), 2 makeappx pack, 3 sign the .msix, 4 verify.
+ * Windows-only unless dryRun.
+ */
+export function buildMsix({ stageDir, out, workDir, manifest, assets, sign = true, dryRun = false, receiptDir },
+  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)) } = {}) {
+  out = path.resolve(out);
+  if (!out.endsWith(".msix")) throw fail("MSIX_INVALID_OPTIONS", "out must end with .msix");
+  validateMsixIdentity(manifest);
+  workDir = path.resolve(workDir ?? `${out}.root`);
+  const receipts = path.resolve(receiptDir ?? path.dirname(out));
+  const steps = ["assemble", ...(sign ? ["sign-pe"] : []), "pack", ...(sign ? ["sign-msix", "verify-msix"] : [])];
+  if (dryRun) { log({ event: "msix-dry-run", out, steps }); return { out, steps, dryRun: true }; }
+  if (platform !== "win32") throw fail("MSIX_NATIVE_HOST_REQUIRED", "MSIX packing and signing must run on Windows");
+  const makeappx = env.MAKEAPPX_PATH || findTool("makeappx.exe")?.toolPath;
+  if (!makeappx) throw fail("MSIX_TOOL_MISSING", "makeappx.exe not found; install the Windows SDK or set MAKEAPPX_PATH");
+  const checked = (cmd, args) => {
+    const r = run(cmd, args, { encoding: "utf8", windowsHide: true, timeout: 600000 });
+    if (r.error || r.status !== 0) throw fail("MSIX_COMMAND_FAILED", `${path.basename(cmd)} ${args[0] ?? ""} failed: ${r.error?.message ?? r.stderr ?? r.stdout ?? r.status}`);
+    return r;
+  };
+  const signer = (files, receipt) => checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--receipt", receipt, ...files]);
+  const root = assembleMsixRoot({ stageDir, root: workDir, manifest, assets });
+  mkdirSync(receipts, { recursive: true });
+  if (sign) signer(peFilesIn(root), path.join(receipts, "msix-pe-sign.receipt.json"));
+  mkdirSync(path.dirname(out), { recursive: true });
+  rmSync(out, { force: true });
+  checked(makeappx, ["pack", "/d", root, "/p", out, "/o"]);
+  if (!existsSync(out) || statSync(out).size === 0) throw fail("MSIX_PACK_EMPTY", `makeappx produced no package: ${out}`);
+  if (sign) {
+    signer([out], path.join(receipts, "msix-sign.receipt.json"));
+    checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--verify-only", out]);
+  }
+  log({ event: "msix-built", out, signed: sign });
+  return { out, steps, root, signed: sign };
+}

package/ownership-admission.mjs

@@ -0,0 +1,125 @@
+import { spawn as nodeSpawn } from './background-process.mjs';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+/** Protected ownership evidence: bounded worker scans & digest-bound verdict reuse. */
+export const OWNERSHIP_MODES = Object.freeze(['off', 'report', 'enforce']);
+const MAX_OUTPUT_BYTES = 32 * 1024 * 1024;
+const here = dirname(fileURLToPath(import.meta.url));
+
+/** The scanner lives beside this module (reference implementation for the RustRight admission contract). */
+export function defaultScannerRoot() {
+  for (const candidate of [here]) {
+    if (existsSync(join(candidate, 'ownership-scan-worker.mjs')) && existsSync(join(candidate, 'rightkit-ownership.json'))) return candidate;
+  }
+  return null;
+}
+const shared = defaultScannerRoot();
+const { ownershipVerdict, ownershipCacheKey } = shared
+  ? await import(pathToFileURL(join(shared, 'ownership-verdict.mjs')).href)
+  : { ownershipVerdict: () => ({ admit: false, code: 'RK_OWNERSHIP_UNVERIFIED', problems: ['shared ownership verdict is unavailable'] }), ownershipCacheKey: () => { throw new Error('shared ownership verdict is unavailable'); } };
+
+/** Always scan repository coverage; owner authority comes from protected registry. */
+export function ownershipScanRoot({ repositoryRoot, workspaceRoot }) {
+  const repository = repositoryRoot ?? workspaceRoot;
+  return typeof repository === 'string' && repository.length ? { root: resolve(repository) } : { error: 'repository root is missing or malformed' };
+}
+
+export function runScanWorker({ scannerRoot, scanRoot, timeoutMs, inputsOnly = false, spawn = nodeSpawn, execPath = process.execPath }) {
+  return new Promise((resolveScan) => {
+    let child, timer;
+    try {
+      child = spawn(execPath, [join(scannerRoot, 'ownership-scan-worker.mjs'), scanRoot, join(scannerRoot, 'rightkit-ownership.json'), ...(inputsOnly ? ['--inputs'] : [])], { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    } catch (error) { resolveScan({ error: 'scanner failed to start: ' + error.message }); return; }
+    const out = []; const err = []; let bytes = 0; let settled = false;
+    const settleScan = (value) => { if (settled) return; settled = true; clearTimeout(timer); resolveScan(value); };
+    const collect = (sink) => (chunk) => {
+      bytes += chunk.length;
+      if (bytes > MAX_OUTPUT_BYTES) { child.kill(); settleScan({ error: 'scanner output exceeded ' + MAX_OUTPUT_BYTES + ' bytes' }); return; }
+      sink.push(chunk);
+    };
+    child.stdout.on('data', collect(out)); child.stderr.on('data', collect(err));
+    child.once('error', (error) => settleScan({ error: 'scanner failed to start: ' + error.message }));
+    child.once('close', (code) => {
+      if (code !== 0) return settleScan({ error: Buffer.concat(err).toString('utf8').trim().slice(0, 2000) || 'scanner exited ' + code });
+      try { settleScan(JSON.parse(Buffer.concat(out).toString('utf8'))); }
+      catch (error) { settleScan({ error: 'scanner returned invalid JSON: ' + error.message }); }
+    });
+    timer = setTimeout(() => { child.kill(); settleScan({ error: 'scan exceeded ' + timeoutMs + ' ms' }); }, timeoutMs);
+    timer.unref?.();
+  });
+}
+
+const outcomes = Object.freeze({
+  RK_OWNERSHIP_CLEAN: 'clean', RK_OWNERSHIP_VIOLATION: 'violations', RK_OWNERSHIP_PENDING_ENROLLMENT: 'pending-enrollment',
+  RK_OWNERSHIP_MALFORMED_REPORT: 'malformed-report', RK_OWNERSHIP_INCOMPLETE_COVERAGE: 'incomplete-coverage',
+  RK_OWNERSHIP_INVALID_REGISTRATION: 'invalid-registration', RK_OWNERSHIP_POLICY_DOWNGRADE: 'policy-downgrade',
+  RK_OWNERSHIP_REPORT_FAILED: 'report-failed', RK_OWNERSHIP_UNVERIFIED: 'problems',
+});
+/** Classification delegates every acceptance decision to shared verdict contract. */
+export function classifyOwnershipReport(report, trust) {
+  const verdict = ownershipVerdict(report, trust);
+  const violations = Array.isArray(report?.violations) ? report.violations.filter((v) => v && typeof v === 'object').map((v) => ({ capability: v.capability ?? null, owner: v.package ?? null, fingerprint: v.fingerprint ?? null, file: v.file ?? null, line: v.line ?? null })) : [];
+  return { ...verdict, outcome: outcomes[verdict.code] ?? 'unscanned', violations };
+}
+
+export class OwnershipAdmission {
+  #mode; #timeoutMs; #scannerRoot; #now; #run; #inputs; #cache = new Map(); #inflight = new Map();
+
+  constructor({ mode = 'report', timeoutMs = 30_000, scannerRoot = defaultScannerRoot(), now = Date.now, runScan = runScanWorker, runInputs = runScanWorker } = {}) {
+    if (!OWNERSHIP_MODES.includes(mode)) throw new TypeError('ownership mode must be one of ' + OWNERSHIP_MODES.join(', '));
+    this.#mode = mode; this.#timeoutMs = timeoutMs; this.#scannerRoot = scannerRoot; this.#now = now; this.#run = runScan; this.#inputs = runInputs;
+  }
+
+  get mode() { return this.#mode; }
+
+  #failure(root, error, code = 'RK_OWNERSHIP_UNVERIFIED') {
+    return Object.freeze({ mode: this.#mode, admit: false, code, outcome: code === 'RK_OWNERSHIP_UNVERIFIED' ? 'unscanned' : outcomes[code] ?? 'unscanned', scanRoot: root, error, problems: [error], violations: [], scanMs: 0, cached: false });
+  }
+
+  /** Re-authenticate & hash inputs on every admission, including cache hits. */
+  async evaluate({ repositoryRoot, workspaceRoot } = {}) {
+    if (this.#mode === 'off') return Object.freeze({ mode: 'off', outcome: 'off' });
+    const target = ownershipScanRoot({ repositoryRoot, workspaceRoot });
+    if (target.error) return this.#failure(null, target.error, 'RK_OWNERSHIP_INVALID_REGISTRATION');
+    if (!this.#scannerRoot) return this.#failure(target.root, 'ownership scanner is not staged in this runtime');
+    try {
+      const observed = await this.#inputs({ scannerRoot: this.#scannerRoot, scanRoot: target.root, timeoutMs: this.#timeoutMs, inputsOnly: true });
+      if (observed?.error) return this.#failure(target.root, observed.error, observed.code);
+      if (typeof observed?.complete !== 'boolean') return this.#failure(target.root, 'source inventory completeness is missing or malformed', 'RK_OWNERSHIP_INVALID_INPUTS');
+      const key = ownershipCacheKey(observed?.inputs);
+      if (observed.complete === false) return this.#failure(target.root, 'source content inventory has incomplete coverage', 'RK_OWNERSHIP_INCOMPLETE_COVERAGE');
+      const cached = this.#cache.get(key);
+      if (cached?.scanRoot === target.root) return Object.freeze({ ...cached, cached: true });
+      // Root keeps distinct repository provenance separate; digests determine freshness.
+      const flight = target.root + ':' + key;
+      let pending = this.#inflight.get(flight);
+      if (!pending) {
+        pending = this.#scan(target.root, key, observed).finally(() => this.#inflight.delete(flight));
+        this.#inflight.set(flight, pending);
+      }
+      return await pending;
+    } catch (error) { return this.#failure(target.root, error.message, error.code?.startsWith('RK_OWNERSHIP_') ? error.code : 'RK_OWNERSHIP_UNVERIFIED'); }
+  }
+
+  /** Enforce refuses every non-admitted result; report records identical verdicts. */
+  assertAdmitted(result) {
+    if (this.#mode !== 'enforce') return;
+    if (result?.admit === true && result.code === 'RK_OWNERSHIP_CLEAN') return;
+    throw Object.assign(new Error('RightKit ownership refuses this build: ' + (result?.problems?.slice(0, 5).join('; ') || result?.error || 'ownership verdict is missing or malformed')), { code: result?.code ?? 'RK_OWNERSHIP_UNVERIFIED' });
+  }
+
+  async #scan(root, key, observed) {
+    const started = this.#now();
+    const scanned = await this.#run({ scannerRoot: this.#scannerRoot, scanRoot: root, timeoutMs: this.#timeoutMs });
+    if (scanned?.error) return this.#failure(root, scanned.error, scanned.code);
+    if (ownershipCacheKey(scanned?.inputs) !== key) return this.#failure(root, 'ownership inputs changed between admission & protected scan', 'RK_OWNERSHIP_INPUTS_CHANGED');
+    const result = Object.freeze({ mode: this.#mode, ...classifyOwnershipReport(scanned?.report, observed.trust), scanRoot: root, scanMs: this.#now() - started, cached: false });
+    if (!['RK_OWNERSHIP_MALFORMED_REPORT', 'RK_OWNERSHIP_UNVERIFIED'].includes(result.code)) {
+      this.#cache.set(key, result);
+      if (this.#cache.size > 128) this.#cache.delete(this.#cache.keys().next().value);
+    }
+    return result;
+  }
+}

package/ownership-approval.mjs

@@ -327,6 +327,9 @@ function protectedLocation(file, platform, { runner = spawnSync, inspect = lstat
 }
 export function loadTrustedExternal() {
   const platform = process.platform;
+  // Hosts without a protected trust location (Linux CI admission runners) can never hold
+  // enrolled trust: report the same pending, trust-absent state as an unenrolled host.
+  if (!DEFAULT_TRUST_PATH[platform]) return { enrolled: false, pending: true, protection: { ok: false, reason: "external trust file is absent" }, trust: null, path: null };
   const file = trustedPath();
   if (!existsSync(file)) return { enrolled: false, pending: true, protection: { ok: false, reason: "external trust file is absent" }, trust: null, path: file };
   if (lstatSync(file).isSymbolicLink()) throw new Error("ownership trust file may not be a symlink");

package/ownership-internal-owners.json

@@ -1,44 +1,9 @@
 {
   "owners": [
-    {
-      "package": "@rightkit/build-control-broker",
-      "path": "packages/build-control-broker/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-clients",
-      "path": "packages/build-control-clients/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-core",
-      "path": "packages/build-control-core/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-phase0",
-      "path": "packages/build-control-phase0/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
     {
       "package": "@rightkit/build-control-policy",
       "path": "packages/build-control-policy/package.json",
       "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-staging",
-      "path": "packages/build-control-staging/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-phase0-macos",
-      "path": "packages/build-control-phase0/macos/package.json",
-      "reason": "Private native build-control feasibility fixture"
-    },
-    {
-      "package": "@rightkit/build-control-phase0-windows",
-      "path": "packages/build-control-phase0/windows/package.json",
-      "reason": "Private native build-control feasibility fixture"
     }
   ]
 }

package/ownership-key-command.mjs

@@ -7,6 +7,7 @@ import { spawnSync, spawnSyncInteractive, windowsPowerShellEnvironment } from ".
 import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "./ownership-key-log.mjs";
 import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
+import { buildMacInvocation, delegateToDesktop, hasTerminal, needsDesktopDelegation } from "./ownership-key-elevation.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const LOG = ".rightkit/ownership-keys.json";
@@ -258,7 +259,7 @@ function validateNative(out, expectedHost = platform) {
   if (out.keyId !== `${expectedHost === "windows" ? "win" : "mac"}-${fingerprint}`) throw new Error("native helper key id does not match its public key");
   return { keyId: fingerprint, publicKeyPem: out.publicKeyPem, platform: expectedHost };
 }
-function elevate(run, requestPath, digest, { modulePath = fileURLToPath(import.meta.url), nodeExe = process.execPath, hostPlatform = process.platform, audit = (target) => approvalTestOnly.protectedLocation(target, hostPlatform) } = {}) {
+function elevate(run, requestPath, digest, { modulePath = fileURLToPath(import.meta.url), nodeExe = process.execPath, hostPlatform = process.platform, audit = (target) => approvalTestOnly.protectedLocation(target, hostPlatform), label, tty = hasTerminal() } = {}) {
   let child, wrapper, registry, currentNode;
   const refuse = (message) => { throw Object.assign(new Error(`RK_OWNERSHIP_ELEVATION_UNPROTECTED: ${message}`), { code: "RK_OWNERSHIP_ELEVATION_UNPROTECTED", type: "RK_OWNERSHIP_ELEVATION_UNPROTECTED" }); };
   try {
@@ -302,9 +303,10 @@ function elevate(run, requestPath, digest, { modulePath = fileURLToPath(import.m
     const r = run(invocation.parentExecutable, invocation.parentArgs, { env: windowsPowerShellEnvironment() });
     if (r.status !== 0) throw new Error("elevated trust update failed or was cancelled");
   } else {
+    const i = buildMacInvocation({ tty, nodeExe: currentNode, args, label });
     let r;
-    try { r = run("/usr/bin/sudo", ["-k", currentNode, ...args], { stdio: "inherit", env: { ...process.env, NODE_OPTIONS: "", NODE_PATH: "" } }); }
-    finally { try { run("/usr/bin/sudo", ["-K"], { stdio: "inherit" }); } catch {} }
+    try { r = run(i.command, i.args, i.options); }
+    finally { if (tty) { try { run("/usr/bin/sudo", ["-K"], { stdio: "inherit" }); } catch {} } }
     if (r.status !== 0) throw new Error("elevated trust update failed or was cancelled");
   }
 }
@@ -483,6 +485,13 @@ async function resumeRootEnrollment(log, d) {
 }
 /** Advance this host's protected checkpoint to the committed key log (after another host approved or revoked a key). */
 async function trustSync(_args, d) {
+  if (needsDesktopDelegation({ hostPlatform: d.hostPlatform, env: d.env, run: d.run, elevatedCheck: d.elevatedCheck })) {
+    const result = delegateToDesktop({ run: d.run, command: d.desktopCommand ?? [process.execPath, ...process.argv.slice(1)], ...(d.desktopOptions ?? {}) });
+    if (result.output) d.print(result.output.trimEnd());
+    if (result.status !== 0) throw new Error(`desktop-session trust-sync failed (exit ${result.status}); see output above`);
+    return 0;
+  }
+  d = { ...d, label: "RightKit ownership trust-sync" };
   const log = readLog(d.root);
   const pin = log.events[0]?.payload?.rootFingerprint;
   const state = verifyKeyLog(log, { rootFingerprint: pin });
@@ -498,7 +507,7 @@ async function trustSync(_args, d) {
 }
 async function installCheckpoint(log, rootFingerprint, baseline, d) {
   const request = makeTrustRequest(log, rootFingerprint, baseline, d.authority);
-  try { await (d.elevate ?? elevate)(d.run, request.file, request.digest); }
+  try { await (d.elevate ?? elevate)(d.run, request.file, request.digest, d.label ? { label: d.label } : undefined); }
   finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
 }
 

package/ownership-key-elevation.mjs

@@ -0,0 +1,124 @@
+// Launch helpers for the protected ownership trust update. These only change HOW the
+// privileged step is authorized or started; the verified trust child itself is unchanged.
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { windowsPowerShellEnvironment } from "./background-process.mjs";
+
+const POWERSHELL = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+const SCHTASKS = "C:\\Windows\\System32\\schtasks.exe";
+export const DESKTOP_DELEGATED_ENV = "RK_OWNERSHIP_DESKTOP_DELEGATED";
+export const DEFAULT_ELEVATION_LABEL = "RightKit ownership trust update";
+
+// ---- macOS: system Authorization Services prompt via osascript -----------------------
+// `do shell script ... with administrator privileges` shows the native auth dialog; the
+// password goes to Authorization Services only and never transits this process or a script.
+export function hasTerminal(stdin = process.stdin, stdout = process.stdout) {
+  return stdin?.isTTY === true && stdout?.isTTY === true;
+}
+
+/** Strict POSIX single-quote escaping: the result is one shell word that equals `value` exactly. */
+export function shellQuote(value) {
+  const text = String(value);
+  if (text.includes("\0")) throw new Error("shell argument contains a NUL byte");
+  return `'${text.replaceAll("'", "'\\''")}'`;
+}
+
+/** Escape text for an AppleScript double-quoted string literal. */
+export function appleScriptString(value) {
+  const text = String(value);
+  if (/[\r\n\0]/.test(text)) throw new Error("AppleScript string contains a line break or NUL byte");
+  return `"${text.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+export function buildMacShellCommand(nodeExe, args) {
+  return ["/usr/bin/env", "-u", "NODE_OPTIONS", "-u", "NODE_PATH", nodeExe, ...args].map(shellQuote).join(" ");
+}
+
+/** Choose the macOS launch. TTY keeps the unchanged sudo prompt; otherwise the native admin dialog via osascript. */
+export function buildMacInvocation({ tty, nodeExe, args, label = DEFAULT_ELEVATION_LABEL, env = process.env }) {
+  const baseEnv = { ...env, NODE_OPTIONS: "", NODE_PATH: "" };
+  if (tty) return { mode: "tty", command: "/usr/bin/sudo", args: ["-k", nodeExe, ...args], options: { stdio: "inherit", env: baseEnv } };
+  const script = `do shell script ${appleScriptString(buildMacShellCommand(nodeExe, args))} with administrator privileges with prompt ${appleScriptString(label)}`;
+  return { mode: "dialog", command: "/usr/bin/osascript", args: ["-e", script], options: { stdio: ["ignore", "inherit", "inherit"], env: baseEnv } };
+}
+
+// ---- Windows: hand a non-interactive/elevated run to the logged-on desktop session -
+export function isSshSession(env = process.env) {
+  return Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
+}
+
+export function windowsProcessIsElevated(run) {
+  const r = run(POWERSHELL, ["-NoProfile", "-NonInteractive", "-Command", "$p=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if (!$p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { exit 9 }"], { env: windowsPowerShellEnvironment() });
+  return r.status === 0;
+}
+
+export function needsDesktopDelegation({ hostPlatform = process.platform, env = process.env, run, elevatedCheck = windowsProcessIsElevated }) {
+  if (hostPlatform !== "win32" || env[DESKTOP_DELEGATED_ENV] === "1") return false;
+  return isSshSession(env) || elevatedCheck(run) === true;
+}
+
+const psq = (value) => `'${String(value).replaceAll("'", "''")}'`;
+
+export function buildDesktopWrapper(command, logPath, codePath) {
+  const invocation = command.map(psq).join(" ");
+  return [
+    "$ErrorActionPreference='Continue'",
+    `$env:${DESKTOP_DELEGATED_ENV}='1'`,
+    "$c=1",
+    `try { & ${invocation} *>&1 | Tee-Object -FilePath ${psq(logPath)}; $c=$LASTEXITCODE } catch { $_ | Out-File -Append -FilePath ${psq(logPath)}; $c=1 }`,
+    `Set-Content -LiteralPath ${psq(codePath)} -Value $c`,
+    "exit $c",
+    "",
+  ].join("\r\n");
+}
+
+export function buildSchtasksCreate(taskName, wrapperPath, user) {
+  return [SCHTASKS, ["/Create", "/TN", taskName, "/TR", `"${POWERSHELL}" -NoProfile -ExecutionPolicy Bypass -File "${wrapperPath}"`, "/SC", "ONCE", "/ST", "00:00", "/RU", user, "/IT", "/RL", "LIMITED", "/F"]];
+}
+
+const USER_RE = /^[^\\/:*?"<>|\s][^\\/:*?"<>|]*\\[^\\/:*?"<>|]+$/;
+
+/**
+ * Run `command` once in the logged-on user's interactive, non-elevated desktop session via a
+ * one-shot scheduled task, wait for it, then clean up. Returns { status, output }.
+ */
+export function delegateToDesktop({ run, command, tmp = os.tmpdir(), sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms), now = Date.now, timeoutMs = 10 * 60 * 1000, pollMs = 1000, startGraceMs = 15000, suffix = randomBytes(6).toString("hex") }) {
+  const env = windowsPowerShellEnvironment();
+  const who = run(POWERSHELL, ["-NoProfile", "-NonInteractive", "-Command", "(Get-CimInstance -ClassName Win32_ComputerSystem).UserName"], { env, encoding: "utf8" });
+  const user = String(who.stdout ?? "").trim();
+  if (who.status !== 0 || !user) throw new Error("no interactive user is logged on to this Windows machine; sign in at the desktop and rerun trust-sync");
+  if (!USER_RE.test(user)) throw new Error("the logged-on desktop user name is not in a recognized DOMAIN\\user form");
+  const dir = mkdtempSync(path.join(tmp, "rk-desktop-"));
+  const logPath = path.join(dir, "output.log");
+  const codePath = path.join(dir, "exit-code.txt");
+  const wrapperPath = path.join(dir, "run.ps1");
+  const taskName = `RightKitOwnershipTrustSync-${suffix}`;
+  let created = false;
+  try {
+    writeFileSync(wrapperPath, buildDesktopWrapper(command, logPath, codePath), { flag: "wx", mode: 0o600 });
+    const [createCmd, createArgs] = buildSchtasksCreate(taskName, wrapperPath, user);
+    const c = run(createCmd, createArgs, { env, encoding: "utf8" });
+    if (c.status !== 0) throw new Error(`could not create the desktop-session task: ${String(c.stderr || c.stdout || "").trim()}`);
+    created = true;
+    const s = run(SCHTASKS, ["/Run", "/TN", taskName], { env, encoding: "utf8" });
+    if (s.status !== 0) throw new Error(`could not start the desktop-session task: ${String(s.stderr || s.stdout || "").trim()}`);
+    const started = now();
+    for (;;) {
+      if (existsSync(codePath)) break;
+      const elapsed = now() - started;
+      if (elapsed > timeoutMs) throw new Error("timed out waiting for the desktop-session trust-sync (UAC prompt not answered?)");
+      const q = run(SCHTASKS, ["/Query", "/TN", taskName, "/FO", "LIST", "/V"], { env, encoding: "utf8" });
+      const running = /^\s*Status:\s*Running\s*$/im.test(String(q.stdout ?? ""));
+      if (!running && elapsed > startGraceMs && !existsSync(codePath)) throw new Error("the desktop-session task ended without reporting a result; check that the logged-on user is the same account");
+      sleep(pollMs);
+    }
+    const status = Number.parseInt(readFileSync(codePath, "utf8").replace(/^\uFEFF/, "").trim(), 10);
+    const output = existsSync(logPath) ? readFileSync(logPath, "utf8") : "";
+    return { status: Number.isInteger(status) ? status : 1, output, user };
+  } finally {
+    if (created) { try { run(SCHTASKS, ["/Delete", "/TN", taskName, "/F"], { env, encoding: "utf8" }); } catch {} }
+    try { rmSync(dir, { recursive: true, force: true }); } catch {}
+  }
+}

package/ownership-repositories.json

@@ -14,6 +14,8 @@
     { "repositoryIdentity": "https://github.com/orthic-labs/cockpit", "roots": ["."], "visibility": "public" },
     { "repositoryIdentity": "https://github.com/orthic-labs/legion", "roots": ["."], "visibility": "public" },
     { "repositoryIdentity": "https://github.com/bogusyogi/workright", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/orthic-labs/sellright", "roots": ["."], "visibility": "public" }
+    { "repositoryIdentity": "https://github.com/orthic-labs/sellright", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/orthic-labs/pulse", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/swiftright", "roots": ["."], "visibility": "private" }
   ]
 }

package/ownership.mjs

@@ -192,7 +192,7 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   const inventory = gitListedInventory(appRoot, {
     repositoryRoot,
     protectedPaths: [...protectedPaths],
-    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
+    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
     maxFileBytes: (rel) => CODE_EXT.has(path.posix.extname(rel).toLowerCase()) || protectedPaths.has(rel) ? 2 * 1024 * 1024 : 64 * 1024 * 1024,
   });
   for (const item of inventory.coverage) if (item.reason === "file-over-size-limit") item.reason = protectedPaths.has(item.path) ? "protected-provenance-file-over-2MiB" : CODE_EXT.has(path.posix.extname(item.path).toLowerCase()) ? "source-file-over-2MiB" : "manifest-file-over-64MiB";
@@ -212,7 +212,7 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
     if (entry.mode === "160000" || entry.type === "commit") { coverage.push({ path: rel, status: "unscanned", reason: "committed-gitlink" }); continue; }
     if (entry.type !== "blob") { coverage.push({ path: rel, status: "unscanned", reason: "committed-unsupported-entry" }); continue; }
-    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
+    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
     const bytes = relevant ? entry.bytes : undefined;
     if (relevant && !bytes) coverage.push({ path: rel, status: "unscanned", reason: "committed-blob-unavailable" });
     const isExceptionFile = path.posix.basename(rel) === "ownership-exceptions.json";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.137",
+  "version": "0.2.138",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -23,8 +23,8 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/bogusyogi/claude.git",
-    "directory": "tools/rightkit/packages/release"
+    "url": "git+https://github.com/bogusyogi/rightkit.git",
+    "directory": "packages/release"
   },
   "dependencies": {
     "smol-toml": "1.7.0"

package/pe-imports.mjs

@@ -0,0 +1,59 @@
+// Minimal PE import reader: names of DLLs a Windows binary loads (regular + delay-load).
+// Pure Buffer parsing so dependency closure checks run on any host.
+
+export const PE_MACHINES = Object.freeze({ 0x8664: "x64", 0xaa64: "arm64", 0x014c: "x86" });
+
+function fail(message) { throw Object.assign(new Error(message), { code: "PE_INVALID" }); }
+
+export function readPeImports(bytes) {
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  if (buf.length < 0x40 || buf.readUInt16LE(0) !== 0x5a4d) fail("not a PE file (missing MZ)");
+  const pe = buf.readUInt32LE(0x3c);
+  if (pe + 24 > buf.length || buf.readUInt32LE(pe) !== 0x00004550) fail("not a PE file (missing PE signature)");
+  const machine = buf.readUInt16LE(pe + 4);
+  const sectionCount = buf.readUInt16LE(pe + 6);
+  const optionalSize = buf.readUInt16LE(pe + 20);
+  const optional = pe + 24;
+  const magic = buf.readUInt16LE(optional);
+  if (magic !== 0x20b && magic !== 0x10b) fail("unsupported PE optional header");
+  const directories = optional + (magic === 0x20b ? 112 : 96);
+  const sectionsAt = optional + optionalSize;
+  const sections = [];
+  for (let i = 0; i < sectionCount; i++) {
+    const at = sectionsAt + i * 40;
+    if (at + 40 > buf.length) fail("truncated PE section table");
+    sections.push({ virtualSize: buf.readUInt32LE(at + 8), rva: buf.readUInt32LE(at + 12), rawSize: buf.readUInt32LE(at + 16), rawPtr: buf.readUInt32LE(at + 20) });
+  }
+  const toOffset = (rva) => {
+    for (const s of sections) if (rva >= s.rva && rva < s.rva + Math.max(s.virtualSize, s.rawSize)) return s.rawPtr + (rva - s.rva);
+    fail(`RVA 0x${rva.toString(16)} is outside every section`);
+  };
+  const cstring = (rva) => {
+    const start = toOffset(rva);
+    const end = buf.indexOf(0, start);
+    if (end < 0) fail("unterminated import name");
+    return buf.toString("latin1", start, end);
+  };
+  const directory = (index) => {
+    const at = directories + index * 8;
+    return at + 8 <= buf.length ? { rva: buf.readUInt32LE(at), size: buf.readUInt32LE(at + 4) } : { rva: 0, size: 0 };
+  };
+  const imports = new Set(), delayImports = new Set();
+  const table = directory(1);
+  if (table.rva) {
+    for (let at = toOffset(table.rva); at + 20 <= buf.length; at += 20) {
+      const name = buf.readUInt32LE(at + 12);
+      if (!name && !buf.readUInt32LE(at) && !buf.readUInt32LE(at + 16)) break;
+      imports.add(cstring(name));
+    }
+  }
+  const delay = directory(13);
+  if (delay.rva) {
+    for (let at = toOffset(delay.rva); at + 32 <= buf.length; at += 32) {
+      const attrs = buf.readUInt32LE(at), name = buf.readUInt32LE(at + 4);
+      if (!attrs && !name) break;
+      delayImports.add(cstring(name));
+    }
+  }
+  return { machine, architecture: PE_MACHINES[machine] ?? `0x${machine.toString(16)}`, imports: [...imports], delayImports: [...delayImports] };
+}

package/rightkit-ownership.json

@@ -2348,45 +2348,10 @@
     }
   ],
   "internalOwners": [
-    {
-      "package": "@rightkit/build-control-broker",
-      "path": "packages/build-control-broker/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-clients",
-      "path": "packages/build-control-clients/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-core",
-      "path": "packages/build-control-core/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-phase0",
-      "path": "packages/build-control-phase0/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
     {
       "package": "@rightkit/build-control-policy",
       "path": "packages/build-control-policy/package.json",
       "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-staging",
-      "path": "packages/build-control-staging/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-phase0-macos",
-      "path": "packages/build-control-phase0/macos/package.json",
-      "reason": "Private native build-control feasibility fixture"
-    },
-    {
-      "package": "@rightkit/build-control-phase0-windows",
-      "path": "packages/build-control-phase0/windows/package.json",
-      "reason": "Private native build-control feasibility fixture"
     }
   ]
 }

package/rightkit-sync.mjs

@@ -10,7 +10,7 @@ import { fileURLToPath } from "node:url";
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
 const rightkitRoot = path.resolve(packageRoot, "..", "..");
 const VERSIONS_FILE = path.join(packageRoot, "rightkit-versions.json");
-const USER_AGENT = "rightkit-sync/1 (https://github.com/bogusyogi/claude)";
+const USER_AGENT = "rightkit-sync/1 (https://github.com/bogusyogi/rightkit)";
 
 const field = (toml, key) => toml.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"))?.[1] ?? null;
 
@@ -178,12 +178,10 @@ export function recordPublished({ registry, name, version }, { file = VERSIONS_F
   } catch (error) { log(`[right-release] release feed not updated (${error.message}); run node rightkit-sync.mjs`); }
 }
 
-/** The broker client and the session hook carry byte copies of the catalog and versions; keep them exact. */
+/** The session hook carries byte copies of the catalog and versions; keep them exact. */
 export function syncConsumerCopies(root = rightkitRoot) {
   const release = path.join(root, "packages", "release");
   const targets = [
-    ["rightkit-ownership.json", path.join(root, "packages", "build-control-clients", "src", "ownership-catalog.json")],
-    ["rightkit-versions.json", path.join(root, "packages", "build-control-clients", "src", "rightkit-versions.json")],
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-catalog.json")],
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-fingerprints.json")],
     ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
@@ -191,7 +189,6 @@ export function syncConsumerCopies(root = rightkitRoot) {
     ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
     ["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
     ["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
-    ["ownership-availability.mjs", path.join(root, "packages", "build-control-clients", "src", "ownership-availability.mjs")],
   ];
   const updated = [];
   for (const [source, target] of targets) {

package/rightkit-versions.json

@@ -16,7 +16,7 @@
     "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
     "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.30",
+    "@rightkit/git": "0.2.31",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.137",
+    "@rightkit/release": "0.2.138",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -71,7 +71,8 @@
       "0.2.26",
       "0.2.27",
       "0.2.28",
-      "0.2.29"
+      "0.2.29",
+      "0.2.30"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -166,7 +167,8 @@
       "0.2.133",
       "0.2.134",
       "0.2.135",
-      "0.2.136"
+      "0.2.136",
+      "0.2.137"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -283,7 +285,7 @@
     "rightkit-oauth": "0.3.0",
     "rightkit-ocr": "0.1.2",
     "rightkit-ort": "0.2.2",
-    "rightkit-ownership": "0.2.0",
+    "rightkit-ownership": "0.2.1",
     "rightkit-pdf": "0.2.0",
     "rightkit-playback": "0.1.1",
     "rightkit-process": "0.3.3",
@@ -340,7 +342,7 @@
       "rightkit-oauth": "0.3.0",
       "rightkit-ocr": "0.1.2",
       "rightkit-ort": "0.2.2",
-      "rightkit-ownership": "0.2.0",
+      "rightkit-ownership": "0.2.1",
       "rightkit-pdf": "0.2.0",
       "rightkit-playback": "0.1.1",
       "rightkit-process": "0.3.3",
@@ -365,7 +367,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.30",
+      "@rightkit/git": "0.2.31",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -378,7 +380,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.137",
+      "@rightkit/release": "0.2.138",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -387,6 +389,9 @@
     }
   },
   "legacyCargo": {
+    "rightkit-ownership": [
+      "0.2.0"
+    ],
     "rightkit-browser": [
       "0.2.0",
       "0.2.1",

package/swift-mac-app.mjs

@@ -0,0 +1,146 @@
+// Assemble a macOS .app bundle from a SwiftPM executable, then sign (and
+// optionally notarize) it through the existing RightKit signers. Signing is
+// inside-out: nested code first (no entitlements), then the bundle. This module
+// owns bundle assembly only; sign-macos.mjs and notarize-macos.mjs own signing.
+
+import { cpSync, existsSync, mkdirSync, openSync, readSync, closeSync, readdirSync, rmSync, statSync, writeFileSync, lstatSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const here = path.dirname(fileURLToPath(import.meta.url));
+const xml = (v) => String(v).replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" })[c]);
+
+function plistValue(value, indent) {
+  const pad = "\t".repeat(indent);
+  if (typeof value === "string") return `${pad}<string>${xml(value)}</string>`;
+  if (typeof value === "boolean") return `${pad}<${value}/>`;
+  if (Number.isInteger(value)) return `${pad}<integer>${value}</integer>`;
+  if (typeof value === "number") return `${pad}<real>${value}</real>`;
+  if (Array.isArray(value)) return `${pad}<array>\n${value.map((v) => plistValue(v, indent + 1)).join("\n")}\n${pad}</array>`;
+  if (value && typeof value === "object") {
+    const rows = Object.keys(value).sort().map((k) => `${pad}\t<key>${xml(k)}</key>\n${plistValue(value[k], indent + 1)}`);
+    return `${pad}<dict>\n${rows.join("\n")}\n${pad}</dict>`;
+  }
+  throw fail("MAC_APP_PLIST", `unsupported plist value: ${value}`);
+}
+
+export function generateInfoPlist(o) {
+  const errors = [];
+  if (!/^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(o.name ?? "")) errors.push("name must be a simple bundle name");
+  if (!/^[A-Za-z0-9.-]+\.[A-Za-z0-9.-]+$/.test(o.bundleId ?? "")) errors.push("bundleId must be reverse-DNS");
+  if (!/^\d+(\.\d+){0,2}$/.test(o.version ?? "")) errors.push("version must be 1-3 numeric parts");
+  if (!/^\d+(\.\d+){0,2}$/.test(o.build ?? o.version ?? "")) errors.push("build must be 1-3 numeric parts");
+  if (!o.executable || /[\\/]/.test(o.executable)) errors.push("executable must be a flat file name");
+  if (errors.length) throw fail("MAC_APP_INVALID", errors.join("; "));
+  const info = {
+    CFBundleDevelopmentRegion: "en", CFBundleExecutable: o.executable, CFBundleIdentifier: o.bundleId,
+    CFBundleInfoDictionaryVersion: "6.0", CFBundleName: o.name, CFBundleDisplayName: o.displayName ?? o.name,
+    CFBundlePackageType: "APPL", CFBundleShortVersionString: o.version, CFBundleVersion: o.build ?? o.version,
+    LSMinimumSystemVersion: o.minimumSystemVersion ?? "14.0", NSHighResolutionCapable: true, NSPrincipalClass: "NSApplication",
+    ...(o.iconFile ? { CFBundleIconFile: path.basename(o.iconFile) } : {}),
+    ...(o.infoPlistExtra ?? {}),
+  };
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n${plistValue(info, 0)}\n</plist>\n`;
+}
+
+const MACHO = new Set([0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe, 0xbebafeca]);
+function isMachO(file) {
+  const fd = openSync(file, "r"); const b = Buffer.alloc(4);
+  try { return readSync(fd, b, 0, 4, 0) === 4 && MACHO.has(b.readUInt32BE(0)); } finally { closeSync(fd); }
+}
+const BUNDLE_DIR = /\.(framework|app|xpc|bundle|appex)$/;
+
+/** Nested code to sign before the app: Mach-O files and code bundles, deepest first. Main executable excluded. */
+export function discoverNestedCode(app, mainName) {
+  const main = path.join(app, "Contents", "MacOS");
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk(full);
+        if (/\.framework$/.test(entry.name) || (BUNDLE_DIR.test(entry.name) && existsSync(path.join(full, "Contents")))) found.push(full);
+      } else if (entry.isFile() && full !== main && !full.startsWith(main + path.sep) && isMachO(full)) found.push(full);
+    }
+  };
+  for (const sub of ["Contents/Frameworks", "Contents/Resources", "Contents/PlugIns", "Contents/XPCServices", "Contents/Helpers", "Contents/Library"]) {
+    const dir = path.join(app, sub);
+    if (existsSync(dir)) walk(dir);
+  }
+  const mainDir = path.join(app, "Contents", "MacOS");
+  for (const entry of readdirSync(mainDir)) { /* helpers beside main: sign them too */
+    const full = path.join(mainDir, entry);
+    if (entry !== mainName && lstatSync(full).isFile() && isMachO(full)) found.push(full);
+  }
+  const depth = (p) => p.split(path.sep).length;
+  return [...new Set(found)].sort((a, b) => depth(b) - depth(a) || a.localeCompare(b));
+}
+
+/**
+ * Assemble `<out>/<name>.app`. options: { executable (SwiftPM binary), name, bundleId, version, build,
+ * resources[] (files/dirs, e.g. SwiftPM *.bundle, copied into Contents/Resources), frameworks[] (dylibs/.frameworks
+ * copied into Contents/Frameworks), iconFile, infoPlistExtra, out }.
+ */
+export function assembleMacApp(o, { run = spawnSync, platform = process.platform } = {}) {
+  const exe = path.resolve(o.executable ?? "");
+  if (!existsSync(exe) || !statSync(exe).isFile()) throw fail("MAC_APP_INVALID", `executable not found: ${exe}`);
+  const execName = o.executableName ?? path.basename(exe);
+  const app = path.join(path.resolve(o.out), `${o.name}.app`);
+  const plist = generateInfoPlist({ ...o, executable: execName });
+  rmSync(app, { recursive: true, force: true });
+  const contents = path.join(app, "Contents");
+  for (const dir of ["MacOS", "Resources", ...(o.frameworks?.length ? ["Frameworks"] : [])]) mkdirSync(path.join(contents, dir), { recursive: true });
+  cpSync(exe, path.join(contents, "MacOS", execName)); chmodSync(path.join(contents, "MacOS", execName), 0o755);
+  const copyInto = (list, sub) => {
+    for (const item of list ?? []) {
+      const source = path.resolve(item);
+      if (!existsSync(source)) throw fail("MAC_APP_INVALID", `missing input: ${source}`);
+      cpSync(source, path.join(contents, sub, path.basename(source)), { recursive: true, verbatimSymlinks: true });
+    }
+  };
+  copyInto(o.resources, "Resources"); copyInto(o.frameworks, "Frameworks");
+  if (o.iconFile) copyInto([o.iconFile], "Resources");
+  writeFileSync(path.join(contents, "Info.plist"), plist);
+  writeFileSync(path.join(contents, "PkgInfo"), "APPL????");
+  if (o.frameworks?.length && platform === "darwin") {
+    // SwiftPM binaries do not search Contents/Frameworks by default.
+    const probe = run("otool", ["-l", path.join(contents, "MacOS", execName)], { encoding: "utf8" });
+    if (!probe.error && !/@executable_path\/\.\.\/Frameworks/.test(probe.stdout ?? "")) {
+      const r = run("install_name_tool", ["-add_rpath", "@executable_path/../Frameworks", path.join(contents, "MacOS", execName)], { encoding: "utf8" });
+      if (r.error || r.status !== 0) throw fail("MAC_APP_RPATH", `install_name_tool failed: ${r.error?.message ?? r.stderr}`);
+    }
+  }
+  return { app, nested: discoverNestedCode(app, execName), executable: execName };
+}
+
+/** Sign inside-out through sign-macos.mjs, then optionally notarize via notarize-macos.mjs. */
+export function signAndNotarizeMacApp({ app, nested, entitlements, receiptDir, notarize = false, profile, dryRun = false },
+  { run = spawnSync, platform = process.platform, log = (e) => console.error(JSON.stringify(e)) } = {}) {
+  const plan = [];
+  const node = (script, args) => { plan.push([script, ...args]); return args; };
+  const receipts = path.resolve(receiptDir);
+  const dry = dryRun ? ["--dry-run"] : [];
+  if (!dryRun && platform !== "darwin") throw fail("MAC_APP_NATIVE_HOST_REQUIRED", "macOS signing and notarization must run on macOS");
+  const calls = [];
+  if (nested.length) calls.push(["sign-macos.mjs", [...dry, "--receipt", path.join(receipts, "app-nested-sign.receipt.json"), ...nested]]);
+  calls.push(["sign-macos.mjs", [...dry, "--receipt", path.join(receipts, "app-sign.receipt.json"), ...(entitlements ? ["--entitlements", path.resolve(entitlements)] : []), app]]);
+  let zip;
+  if (notarize) {
+    zip = `${app}.zip`;
+    calls.push(["__ditto__", ["-c", "-k", "--keepParent", app, zip]]);
+    calls.push(["notarize-macos.mjs", [...dry, "--receipt", path.join(receipts, "app-notarize.receipt.json"), ...(profile ? ["--profile", profile] : []), "--app", app, zip]]);
+  }
+  if (!dryRun) mkdirSync(receipts, { recursive: true });
+  for (const [script, args] of calls) {
+    node(script, args);
+    if (dryRun && script === "__ditto__") continue;
+    const r = script === "__ditto__" ? run("/usr/bin/ditto", args, { encoding: "utf8" })
+      : run(process.execPath, [path.join(here, script), ...args], { encoding: "utf8" });
+    if (r.error || r.status !== 0) throw fail("MAC_APP_COMMAND_FAILED", `${script} failed: ${r.error?.message ?? r.stderr ?? r.stdout ?? r.status}`);
+    log({ event: "mac-app-step", script, ok: true });
+  }
+  return { plan, zip };
+}

package/swift-package-command.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// right-release swift-package <windows-stage|msix|mac-app|doctor> --config <swift-package.json> [options]
+//
+// One product config (schema 1) drives all three steps; paths resolve against the config file.
+// Build-only: nothing here uploads or publishes.
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { assembleMacApp, signAndNotarizeMacApp } from "./swift-mac-app.mjs";
+import { buildMsix } from "./msix-build.mjs";
+import { stageSwiftWindows } from "./swift-windows-stage.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+
+export function loadSwiftPackageConfig(file) {
+  const configPath = path.resolve(file ?? "");
+  if (!existsSync(configPath)) throw fail("SWIFT_PACKAGE_CONFIG", `config not found: ${configPath}`);
+  let config;
+  try { config = JSON.parse(readFileSync(configPath, "utf8")); } catch (e) { throw fail("SWIFT_PACKAGE_CONFIG", `invalid JSON: ${e.message}`); }
+  if (config.schema !== 1) throw fail("SWIFT_PACKAGE_CONFIG", "config.schema must be 1");
+  if (!config.name || !config.version) throw fail("SWIFT_PACKAGE_CONFIG", "config.name and config.version are required");
+  return { config, base: path.dirname(configPath) };
+}
+
+const rel = (base, value) => (value == null ? value : path.resolve(base, value));
+const relList = (base, list) => (list ?? []).map((v) => rel(base, v));
+
+export function windowsStageOptions({ config, base }) {
+  const w = config.windows;
+  if (!w?.exe || !w?.out) throw fail("SWIFT_PACKAGE_CONFIG", "windows.exe and windows.out are required");
+  return { exe: rel(base, w.exe), out: rel(base, w.stageDir ?? `${w.out}.stage`), searchDirs: relList(base, w.searchDirs),
+    include: relList(base, w.include), systemDlls: w.systemDlls, dependencies: w.dependencies, architecture: w.architecture };
+}
+
+export function msixOptions({ config, base }, staged) {
+  const w = config.windows;
+  const manifest = { name: w.packageName ?? config.name, version: w.msixVersion ?? `${config.version.replace(/^(\d+\.\d+\.\d+).*$/, "$1")}.0`,
+    architecture: staged.architecture, publisher: w.publisher, publisherDisplayName: w.publisherDisplayName,
+    displayName: config.displayName ?? config.name, description: config.description, executable: staged.exe,
+    dependencies: w.dependencies, capabilities: w.capabilities, minWindowsVersion: w.minWindowsVersion };
+  const assets = Object.fromEntries(Object.entries(w.assets ?? {}).map(([k, v]) => [k, rel(base, v)]));
+  return { manifest, assets, out: rel(base, w.out), stageDir: staged.out };
+}
+
+export function macOptions({ config, base }) {
+  const m = config.mac;
+  if (!m?.executable || !m?.bundleId || !m?.out) throw fail("SWIFT_PACKAGE_CONFIG", "mac.executable, mac.bundleId and mac.out are required");
+  return { executable: rel(base, m.executable), name: m.appName ?? config.displayName ?? config.name, displayName: config.displayName, bundleId: m.bundleId,
+    version: config.version, build: m.build, minimumSystemVersion: m.minimumSystemVersion, resources: relList(base, m.resources),
+    frameworks: relList(base, m.frameworks), iconFile: rel(base, m.iconFile), infoPlistExtra: m.infoPlist, out: rel(base, m.out) };
+}
+
+export async function main(argv, deps = {}) {
+  const [command, ...rest] = argv;
+  const flag = (name) => { const i = rest.indexOf(name); return i >= 0 ? rest[i + 1] : undefined; };
+  const has = (name) => rest.includes(name);
+  const log = deps.log ?? ((v) => console.log(JSON.stringify(v, null, 2)));
+  if (!["windows-stage", "msix", "mac-app"].includes(command)) {
+    throw fail("SWIFT_PACKAGE_USAGE", "usage: swift-package <windows-stage|msix|mac-app> --config <file> [--dry-run] [--no-sign] [--notarize]");
+  }
+  const loaded = loadSwiftPackageConfig(flag("--config"));
+  if (command === "windows-stage") return log(stageSwiftWindows(windowsStageOptions(loaded)));
+  if (command === "msix") {
+    const staged = stageSwiftWindows(windowsStageOptions(loaded));
+    const options = msixOptions(loaded, staged);
+    return log(buildMsix({ ...options, sign: !has("--no-sign"), dryRun: has("--dry-run") }, deps.msix));
+  }
+  const options = macOptions(loaded);
+  const assembled = assembleMacApp(options, deps.mac);
+  const out = { app: assembled.app, nested: assembled.nested };
+  if (has("--sign") || has("--notarize")) {
+    out.signing = signAndNotarizeMacApp({ app: assembled.app, nested: assembled.nested,
+      entitlements: rel(loaded.base, loaded.config.mac.entitlements), receiptDir: path.join(options.out, "receipts"),
+      notarize: has("--notarize"), profile: flag("--profile"), dryRun: has("--dry-run") }, deps.mac);
+  }
+  return log(out);
+}
+
+const self = (file) => { try { return path.resolve(file) === fileURLToPath(import.meta.url); } catch { return false; } };
+if (process.argv[1] && self(process.argv[1])) {
+  main(process.argv.slice(2)).catch((error) => {
+    console.error(`right-release swift-package: [${error.code ?? "SWIFT_PACKAGE_FAILED"}] ${error.message}`);
+    process.exitCode = error.code === "SWIFT_PACKAGE_USAGE" ? 2 : 1;
+  });
+}

package/swift-windows-stage.mjs

@@ -0,0 +1,103 @@
+// Stage a SwiftPM-built Windows app for packaging: copy the executable and every
+// app-local DLL it needs (transitively) into one flat directory, and fail closed
+// on any dependency that is neither staged, a Windows system DLL, nor provided by
+// a declared package dependency. Runs on any host (pure file + PE parsing).
+
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { readPeImports } from "./pe-imports.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+
+// Windows-owned DLLs present on every supported install. Anything else must ship.
+export const WINDOWS_SYSTEM_DLLS = Object.freeze([
+  "kernel32.dll", "kernelbase.dll", "ntdll.dll", "user32.dll", "gdi32.dll", "gdi32full.dll", "advapi32.dll", "shell32.dll",
+  "shlwapi.dll", "ole32.dll", "oleaut32.dll", "combase.dll", "rpcrt4.dll", "sechost.dll", "ws2_32.dll", "wsock32.dll",
+  "mswsock.dll", "iphlpapi.dll", "bcrypt.dll", "bcryptprimitives.dll", "ncrypt.dll", "crypt32.dll", "secur32.dll", "wintrust.dll",
+  "userenv.dll", "version.dll", "winmm.dll", "comctl32.dll", "comdlg32.dll", "imm32.dll", "uxtheme.dll", "dwmapi.dll",
+  "d2d1.dll", "d3d11.dll", "d3d12.dll", "dxgi.dll", "dwrite.dll", "dcomp.dll", "uiautomationcore.dll", "propsys.dll",
+  "msctf.dll", "setupapi.dll", "cfgmgr32.dll", "shcore.dll", "powrprof.dll", "psapi.dll", "dbghelp.dll", "wldap32.dll",
+  "normaliz.dll", "netapi32.dll", "winhttp.dll", "wininet.dll", "ucrtbase.dll", "msvcrt.dll", "oleacc.dll", "avrt.dll",
+  "mf.dll", "mfplat.dll", "dnsapi.dll", "wtsapi32.dll", "winspool.drv", "ntmarta.dll", "dxcore.dll", "windows.ui.dll", "cabinet.dll",
+]);
+
+const isApiSet = (name) => /^(api|ext)-ms-win-[a-z0-9-]+-l\d+-\d+-\d+\.dll$/.test(name);
+const lower = (value) => String(value).toLowerCase();
+const isPe = (file) => /\.(exe|dll)$/i.test(file);
+const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+function findInDirs(name, dirs) {
+  for (const dir of dirs) {
+    if (!existsSync(dir)) continue;
+    const match = readdirSync(dir).find((entry) => lower(entry) === lower(name));
+    if (match) return path.join(dir, match);
+  }
+  return null;
+}
+
+/**
+ * options: { exe, out, searchDirs[], include[] (extra files copied verbatim),
+ *   systemDlls[] (extra allowed), dependencies[{ name, provides[] }], architecture }
+ * Returns a manifest; throws SWIFT_STAGE_UNRESOLVED listing every missing DLL.
+ */
+export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], systemDlls = [], dependencies = [], architecture, clean = true } = {}) {
+  if (!exe || !out) throw fail("SWIFT_STAGE_OPTIONS", "exe and out are required");
+  exe = path.resolve(exe); out = path.resolve(out);
+  if (!/\.exe$/i.test(exe) || !existsSync(exe) || !statSync(exe).isFile()) throw fail("SWIFT_STAGE_OPTIONS", `exe must be an existing .exe: ${exe}`);
+  const dirs = [path.dirname(exe), ...searchDirs.map((dir) => path.resolve(dir))];
+  const system = new Set([...WINDOWS_SYSTEM_DLLS, ...systemDlls].map(lower));
+  const provided = new Map();
+  for (const dep of dependencies) for (const dll of dep.provides ?? []) provided.set(lower(dll), dep.name);
+  if (clean) rmSync(out, { recursive: true, force: true });
+  mkdirSync(out, { recursive: true });
+
+  const staged = new Map(); // lower name -> { file(source), name }
+  const queue = [{ name: path.basename(exe), source: exe, from: "<root>" }];
+  const missing = new Map(); // lower name -> importers
+  const seenSystem = new Set(), seenProvided = new Map();
+  let arch = architecture;
+  const extra = include.map((file) => path.resolve(file));
+  for (const file of extra) {
+    if (!existsSync(file) || !statSync(file).isFile()) throw fail("SWIFT_STAGE_OPTIONS", `include file missing: ${file}`);
+    queue.push({ name: path.basename(file), source: file, from: "<include>" });
+  }
+  while (queue.length) {
+    const item = queue.shift();
+    const key = lower(item.name);
+    if (staged.has(key)) continue;
+    staged.set(key, item);
+    if (!isPe(item.name)) continue;
+    const info = readPeImports(readFileSync(item.source));
+    if (!["x64", "arm64"].includes(info.architecture)) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture}; only x64 and arm64 are supported`);
+    arch ??= info.architecture;
+    if (info.architecture !== arch) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture} but package architecture is ${arch}`);
+    for (const dep of [...info.imports, ...info.delayImports]) {
+      const dk = lower(dep);
+      if (staged.has(dk)) continue;
+      const found = findInDirs(dep, dirs);
+      if (found) { queue.push({ name: path.basename(found), source: found, from: item.name }); continue; }
+      if (isApiSet(dk) || system.has(dk)) { seenSystem.add(dk); continue; }
+      if (provided.has(dk)) { seenProvided.set(dk, provided.get(dk)); continue; }
+      if (!missing.has(dk)) missing.set(dk, new Set());
+      missing.get(dk).add(item.name);
+    }
+  }
+  if (missing.size) {
+    const detail = [...missing].map(([dll, by]) => `${dll} (needed by ${[...by].join(", ")})`).join("; ");
+    throw fail("SWIFT_STAGE_UNRESOLVED", `unresolved DLL dependencies: ${detail}. Add the directory to searchDirs, stage it via include, or declare a package dependency that provides it`);
+  }
+  const files = [];
+  for (const [, item] of [...staged].sort(([a], [b]) => a.localeCompare(b))) {
+    const target = path.join(out, item.name);
+    copyFileSync(item.source, target);
+    files.push({ name: item.name, source: item.source, sha256: sha256(target), sizeBytes: statSync(target).size, requiredBy: item.from, pe: isPe(item.name) });
+  }
+  const manifest = {
+    schema: 1, architecture: arch, exe: path.basename(exe), out, files,
+    systemDlls: [...seenSystem].sort(),
+    providedByDependencies: Object.fromEntries([...seenProvided].sort()),
+  };
+  writeFileSync(`${out}.stage.json`, `${JSON.stringify(manifest, null, 2)}\n`);
+  return manifest;
+}