@rightkit/release 0.2.137 → 0.2.139

package/README.md

@@ -18,6 +18,7 @@ Signing and publication rules are in the workspace file `docs/rules/release-sign
 | Group | Subcommands |
 |---|---|
 | Build | `release`, `build`, `package` |
+| Build (SwiftPM apps) | `swift-package` (`windows-stage`, `msix`, `mac-app`) (config schema 1: `windows.{exe,out,searchDirs,include,dependencies,publisher,assets}`, `mac.{executable,bundleId,out,frameworks,resources,entitlements}`) |
 | Install | `install-app` |
 | Publish | `publish`, `upload`, `publish-update`, `github`, `mirror-root-artifact` |
 | Signing | `sign-windows`, `sign-updater`, `signing-agent`, `create-mac-updater` |
@@ -55,6 +56,16 @@ pnpm add -D @rightkit/release
 pnpm exec right-release deps --check
 ```
 
+## MSIX target and Swift app type
+
+Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (config or target; auto-detected from a `Package.swift` with no Cargo manifest) replaces the cargo/rustc requirement with `swift`, and skips the Rust target-bridge, sccache and Perl checks. Tauri/Rust targets are unchanged. `makeappx` and `signtool` are required only when `targets.win.msix` is configured.
+
+`targets.win` with `signingContract: "windows-msix-signed-v1"` packages an MSIX (schema in `msix-config.mjs`): `prePackage` builds and stages a flat payload (`right-release swift-package windows-stage`), then the msix step runs in the immutable order: verify the declared runtime-DLL inventory and PE import closure (fails closed), sign inner DLLs then EXEs through `sign-windows`, `makeappx pack`, sign the `.msix`, verify the signature and that the signer subject equals `Identity/@Publisher`, write the App Installer route, and write `msix-seal.json`. `msix.virtualization.fileSystemWrite|registryWrite` (`enabled|disabled`) are mandatory and emitted as `desktop6` manifest properties. List the `.msix` under `installer.artifacts` so it seals.
+
+`updater.kind: "appinstaller"` (default remains the Tauri minisign flow) generates `msix.appInstaller.out` (https `uri`/`msixUri`); trust is the MSIX Authenticode signature, so no `.sig` is produced and `publish-update` records the sealed package digest.
+
+macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
+
 ## Known issues
 
 - `smol-toml` is pinned exactly. A consumer that adds another `smol-toml` gets a second copy (npm audit 2026-10-08, release finding).

package/build-release.mjs

@@ -33,6 +33,8 @@ import { brokerManagedHost } from "./cargo-contract.mjs";
 import { resolveReleaseCacheMode } from "./release-cache-mode.mjs";
 import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
+import { collectSwiftToolVersions, planSwiftBuild } from "./swift-build-context.mjs";
+import { packageCommandOptional, requiredBuildExecutables, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, summarizePreBrokerWaits, terminateProcessTree } from "./heavy-command.mjs";
@@ -46,14 +48,14 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // Cached target directories must not outlive changes to these signing helpers.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs", "msix-build.mjs", "msix-plan.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")
   .slice(0, 16);
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
-function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout }) {
+function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
@@ -71,6 +73,8 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     // reject a legitimate resume of an in-flight build.
     version: undefined,
     cargoLockPaths: nativeLayout?.lockCandidates ?? [],
+    projectType: resolveProjectType({ appRoot, config, target }),
+    msix: targetUsesMsix(target),
   });
 }
 
@@ -124,7 +128,7 @@ if (dryRun) {
   const config = (await import(`${pathToFileURL(configPath).href}?dry-run=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   const target = config.targets?.[platform];
-  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  if (!target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
   console.log(`right-release build dry-run: ${config.app} ${config.version} ${platform}`);
   console.log(`config: ${configPath}`);
   console.log(`commit: ${commit}`);
@@ -163,7 +167,8 @@ try {
     fail("app and version must be safe release-id components");
   }
   const target = config.targets?.[platform];
-  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  if (!target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
+  const isSwiftBuild = resolveProjectType({ appRoot, config, target }) === "swiftpm";
   const nativeLayout = resolveNativeCargoLayout({ appRoot, config });
   if (platform === "win" && target.signingContract === "windows-raw-exe-authenticode-before-nsis-v1") {
     assertNsisInPlaceUpgradeContract(appRoot, target.nsisUpgradeContract);
@@ -171,7 +176,7 @@ try {
   const { requiredInputs, buildInputs } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
   const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
-  const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
+  const toolVersions = isSwiftBuild ? collectSwiftToolVersions({ packageManager: config.packageManager, exec: commandOutput }) : collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
   const platformDir = platform === "win" ? "windows" : "mac";
@@ -208,10 +213,12 @@ try {
   // shells take the Cache V2 branch, bridge resolved native target into release cache,
   // and then lose CARGO_TARGET_DIR to the broker's unconditional override — so the
   // app bundle landed in the broker workspace and packaging failed on an empty cache.
-  const managedCargoTarget = brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
-  const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
+  const swiftPlan = isSwiftBuild ? planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions }) : null;
+  // SwiftPM targets have no Cargo manifest: no broker cargo target, no Rust cache identity.
+  const managedCargoTarget = swiftPlan ? swiftPlan.managedCargoTarget : brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
+  const cacheIdentity = swiftPlan ? swiftPlan.identity : resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
-  const cacheModeRequested = resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
+  const cacheModeRequested = swiftPlan ? swiftPlan.cacheMode : resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
   // On a broker-managed host, Cache V2's lease/slot/prune/floor/mark chain is not
   // running against the directory that will actually hold build output — the
   // broker owns CARGO_TARGET_DIR unconditionally (see managedCargoTarget above).
@@ -233,7 +240,7 @@ try {
   // Preflight BEFORE any compile. These preconditions used to be discovered one
   // per build cycle, minutes deep, with errors that named a symptom instead of a
   // cause. Blocking problems stop here, in seconds, naming the fix.
-  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout });
+  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target });
   const preflightBlockers = preflightFailures(preflight);
   if (preflightBlockers.length > 0) {
     fail(`preflight found ${preflightBlockers.length} blocking problem(s):\n${formatPreflight(preflightBlockers)}`);
@@ -252,7 +259,7 @@ try {
   // resolves to MSYS Perl, which cannot configure OpenSSL. Put the real Windows
   // Perl first so the build behaves the same from any shell.
   const pathPrefix = buildPathPrefix({ platform });
-  const env = macosCodesignEnvironment({
+  const baseEnv = macosCodesignEnvironment({
     ...heavyCommandEnvironment(process.env),
     ...releaseEnvironment({ root: vaultRoot, cacheRoot: sharedCacheRoot, platform, architecture: cacheIdentity.architecture, app: config.app, cacheKey, kind: "release", appRoot, mode: cacheMode }),
     ...(pathPrefix ? { PATH: `${pathPrefix}${path.delimiter}${process.env.PATH ?? ""}` } : {}),
@@ -261,6 +268,7 @@ try {
     RIGHTKIT_MANAGED_ROOT: resolveManagedRoot({ env: process.env }),
     RIGHT_RELEASE_ARTIFACT_DIR: resolveArtifactDir({ app: config.app, version: config.version, managedRoot: resolveManagedRoot({ env: process.env }) }),
   });
+  const env = swiftPlan ? swiftPlan.sanitizeEnv(baseEnv) : baseEnv;
   if (managedCargoTarget) {
     for (const name of ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"]) {
       delete env[name];
@@ -302,7 +310,7 @@ try {
   // ownedRoot is the per-app cache parent holding every fingerprint dir, so a
   // link left by an earlier fingerprint is recognised as ours and repointed
   // instead of hard-stopping the build.
-  const targetBridge = createTargetBridge({
+  const targetBridge = swiftPlan ? swiftPlan.targetBridge : createTargetBridge({
     link: targetLink,
     target: managedCargoTarget ?? env.CARGO_TARGET_DIR,
     ownedRoot: path.dirname(managedCargoTarget ?? env.CARGO_TARGET_DIR),
@@ -329,7 +337,7 @@ try {
           const volumes = inspectWriteVolumes({ repoRoot, vaultRoot, cacheRoot: sharedCacheRoot });
           assertWriteVolumeFloors({ volumes, policy, configuredRepoMinimumBytes: Math.max(Number(target.preflight?.minFreeGb ?? 25), 25) * 1024 ** 3 });
         } else assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
-        assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
+        assertExecutables([...requiredBuildExecutables({ projectType: resolveProjectType({ appRoot, config, target }), packageManager: config.packageManager ?? "pnpm", usesPackageManager: Boolean(config.packageManager) || existsSync(path.join(appRoot, "package.json")) }), ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
         for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
         if (buildRoot) mkdirSync(buildRoot, { recursive: true });
@@ -341,7 +349,7 @@ try {
       },
       prepare: async () => {
         throwIfInterrupted();
-        const cacheTarget = managedCargoTarget ?? env.CARGO_TARGET_DIR;
+        const cacheTarget = swiftPlan ? swiftPlan.buildDir : managedCargoTarget ?? env.CARGO_TARGET_DIR;
         mkdirSync(cacheTarget, { recursive: true });
         // Broker-managed hosts route through the same target bridge as shared
         // mode even though cacheMode is forced to "broker" above: the naive
@@ -349,12 +357,13 @@ try {
         // directory, which is exactly the "corruption" misreading that nearly
         // cost ~5.9 GB of warm broker intermediates. The bridge's brokerManaged
         // flag already knows to leave a real directory untouched instead.
-        if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
+        if (swiftPlan) { /* SwiftPM: no Rust target link */ }
+        else if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
         else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
-        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
+        if (resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },
       build: async () => {
         throwIfInterrupted();
@@ -363,9 +372,9 @@ try {
           [WORKER, "--config", configPath, "--platform", platform, "--no-upload", "--resume", ...(resumeFrom ? ["--resume-from", resumeFrom] : []), ...(skipChecks ? ["--skip-checks"] : [])],
           appRoot,
           env,
-          [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          swiftPlan ? swiftPlan.watchDirs : [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
           path.join(stateRoot, "stall-build.log"),
-          { livenessOwnerTimeoutMs: target.package.livenessOwnerTimeoutMs ?? null },
+          { livenessOwnerTimeoutMs: target.package?.livenessOwnerTimeoutMs ?? null },
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -461,7 +470,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
     addSource(resolveArtifactPath(artifact.file), "updater");
-    addSource(resolveArtifactPath(artifact.signature), "updater-signature");
+    if (target.updater?.kind !== "appinstaller") addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
@@ -485,10 +494,10 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   }
   for (const artifact of target.updater?.artifacts ?? []) {
     const source = resolveArtifactPath(artifact.file);
-    const signatureSource = resolveArtifactPath(artifact.signature);
+    const signatureSource = target.updater?.kind === "appinstaller" ? null : resolveArtifactPath(artifact.signature);
     const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
-    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "public", key: patchKey, platform: artifact.platform });
-    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "private", key: artifact.key, platform: artifact.platform });
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "private", key: artifact.key, platform: artifact.platform });
   }
   writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
   const manifest = {

package/cache-policy.mjs

@@ -518,3 +518,17 @@ function isAbsoluteForPlatform(value) { return isWindowsAbsolute(value) || path.
 function resolveForPlatform(value) { return isWindowsAbsolute(value) ? path.win32.resolve(value) : path.posix.resolve(value); }
 function readRustcVerbose() { const result = spawnSync("rustc", ["-vV"], { encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`rustc -vV failed: ${(result.stderr || result.error?.message || `exit ${result.status}`).trim()}`); return result.stdout.trim(); }
 function cargoNativeFeatures(cargoTomlPath) { if (!cargoTomlPath || !existsSync(cargoTomlPath)) return []; return [...readFileSync(cargoTomlPath, "utf8").matchAll(/features\s*=\s*\[([^\]]+)\]/g)].flatMap((match) => match[1].match(/"([^"]+)"/g) ?? []).map((value) => value.slice(1, -1)).filter((value) => /sqlcipher|openssl/i.test(value)); }
+
+/**
+ * SwiftPM counterpart of resolveSharedCacheIdentity: identity is the Swift toolchain, Package.resolved
+ * (dependency pins; absent for dependency-free packages), target architecture and profile. No Rust inputs.
+ */
+export function resolveSwiftCacheIdentity({ swiftVersion, packageResolvedPath, architecture, profile = "release" } = {}) {
+  if (!swiftVersion || !String(swiftVersion).trim()) throw new Error("swift --version did not report a toolchain");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(architecture ?? "")) throw new Error("invalid Swift target architecture");
+  const resolved = packageResolvedPath && existsSync(packageResolvedPath) ? readFileSync(packageResolvedPath, "utf8").replace(/\r\n?/g, "\n") : null;
+  const packageResolvedSha256 = resolved === null ? "none" : sha256(resolved);
+  const swift = String(swiftVersion).trim();
+  return { projectType: "swiftpm", packageResolvedSha256, swift, target: architecture, architecture, profile, features: [],
+    fingerprint: sha256(JSON.stringify({ projectType: "swiftpm", packageResolvedSha256, swift, architecture, profile })).slice(0, 16) };
+}

package/cli/right-release.mjs

@@ -26,6 +26,7 @@ const commands = new Map([
   ["ownership", "ownership-command.mjs"],
   ["ownership-approval", "ownership-approval-command.mjs"],
   ["ownership-report", "ownership-report-command.mjs"],
+  ["swift-package", "swift-package-command.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -36,7 +37,7 @@ if (first === "dev") {
     process.exitCode = 1;
   });
 } else {
-const githubBuildCommands = new Set(["release", "build", "package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
+const githubBuildCommands = new Set(["release", "build", "package", "swift-package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
 
 try {
   if (githubBuildCommands.has(first)
@@ -178,6 +179,8 @@ Commands:
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]
                                                       Incremental unsigned build & optional local install
+  swift-package <windows-stage|msix|mac-app> --config <swift-package.json> [--dry-run] [--no-sign] [--sign] [--notarize] [--profile <name>]
+                                                      Stage SwiftPM app; build+sign MSIX (Windows) or assemble+sign+notarize .app (macOS); never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
   publish-update --release <id> --platform mac|win --tier patch|update

package/committed-source.mjs

@@ -132,7 +132,7 @@ function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runne
   const rows = parseTree(runGit(root, ["ls-tree", "-r", "-z", "--full-tree", tree], { encoding: "buffer", maxBuffer: MAX_TREE_BYTES, timeout: COMMAND_TIMEOUT_MS, runner, env }), objectFormat);
   const wanted = new Set(requiredPaths.filter(validatePath));
   const shouldRead = (row) => row.type === "blob" && row.mode !== "120000" && (
-    wanted.has(row.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json", "Cargo.lock", "pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock"].includes(path.posix.basename(row.rel)) ||
+    wanted.has(row.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", "Cargo.lock", "pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock"].includes(path.posix.basename(row.rel)) ||
     /\.(?:rs|ts|tsx|js|mjs|cjs|jsx|swift|m|mm|c|cc|cpp|h|py|go|kt|java|cs)$/i.test(row.rel)
   );
   const candidates = rows.filter(shouldRead);

package/development.mjs

@@ -6,7 +6,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
-import { acquireManagedRunLease, managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
+import { acquireManagedRunLease, managedRuntimeClient, managedRuntimeCommand, runCargoSync } from "./managed-cargo.mjs";
 import { BUNDLE_MARKERS, bundleMarkerBuffer, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
 import { installPortableDevelopment } from "./portable-development.mjs";
 import { signMacosDevelopmentBundle } from "./development-signing.mjs";
@@ -213,7 +213,7 @@ export function resolveCommand(command, args, { root, env = process.env } = {})
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
     const socket = discoverBrokerSocket(env);
     const childEnv = !env.RIGHTKIT_BUILD_BROKER_SOCKET && existsSync(socket) ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : undefined;
-    return { command: process.execPath, args: [client, ...args], ...(childEnv ? { env: childEnv } : {}) };
+    return { ...managedRuntimeCommand(client, args), ...(childEnv ? { env: childEnv } : {}) };
   }
   return { command, args };
 }

package/inventory-check.mjs

@@ -24,7 +24,7 @@ const CACHE_TTL_MS = 60 * 60 * 1000;
 const CONCURRENCY = 8;
 const REQUEST_TIMEOUT_MS = 15_000;
 const CRATES_API_INTERVAL_MS = 1000;
-const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/claude)";
+const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/rightkit)";
 const EXCLUDED_PREFIX = "build-control-";
 const OWNER_PROBE_CRATE = "rightkit-fs";
 const EXTRA_ACCOUNT_CRATES = Object.freeze(["agent-room-core"]);

package/managed-cargo.mjs

@@ -7,13 +7,19 @@ import { spawnSync } from "./background-process.mjs";
 export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
   const roots = managedControlCandidates({ env, platform });
   const paths = platform === 'win32' ? path.win32 : path.posix;
+  // runtime-current ships the native `rustright` client.
   for (const root of roots) {
-    const client = paths.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
+    const client = paths.join(root, "runtime-current", platform === 'win32' ? "rustright.exe" : "rustright");
     if (exists(client)) return client;
   }
   return undefined;
 }
 
+/** Command line that runs the managed client: the native rustright client runs directly. */
+export function managedRuntimeCommand(client, args) {
+  return { command: client, args };
+}
+
 /** Hold a client-run lease that blocks broker runtime cutover until release() (see
  * proveDevelopmentRunsDrained). No managed runtime → no lease; lease I/O failure warns and proceeds. */
 export function acquireManagedRunLease({ command, env = process.env, platform = process.platform, exists = existsSync, pid = process.pid } = {}) {
@@ -43,13 +49,17 @@ export function runCargoSync(args, options = {}, { platform = process.platform,
     const socket = discoverBrokerSocket(env, { platform, exists });
     if (platform === 'darwin' && (!socket || !exists(socket))) return unavailable('RightKit broker socket is unavailable');
     const childEnv = socket ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : env;
-    const result = spawn(process.execPath, [client, "cargo", ...args], { ...options, env: childEnv });
+    const invocation = managedRuntimeCommand(client, ["cargo", ...args]);
+    const result = spawn(invocation.command, invocation.args, { ...options, env: childEnv });
     if (platform === 'darwin' && result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) {
       return { ...result, error: unavailable(String(result.stderr).trim()).error };
     }
     return result;
   }
-  if (platform === 'darwin' || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
+  // The Mac never falls back to direct Cargo, except on GitHub Actions runners, which have no
+  // RightKit runtime and use the toolchain's cargo (release-candidate signing jobs).
+  const hostedCi = env.GITHUB_ACTIONS === 'true' && !managedHost(env);
+  if ((platform === 'darwin' && !hostedCi) || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
   return spawn("cargo", args, options);
 }
 

package/msix-appinstaller.mjs

@@ -0,0 +1,24 @@
+// App Installer (.appinstaller) update route for MSIX packages. Trust comes from the
+// MSIX Authenticode signature (publisher must match the manifest); no separate updater key.
+
+const xml = (value) => String(value).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+const fail = (message) => Object.assign(new Error(message), { code: "APPINSTALLER_INVALID" });
+
+export function generateAppInstaller(o) {
+  const errors = [];
+  for (const key of ["uri", "msixUri"]) { try { if (new URL(o[key]).protocol !== "https:") throw 0; } catch { errors.push(`${key} must be an https URL`); } }
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(o.version ?? "")) errors.push("version must be four numeric parts");
+  if (!["x64", "arm64"].includes(o.architecture)) errors.push("architecture must be x64 or arm64");
+  if (!o.name || !o.publisher) errors.push("name and publisher are required");
+  const hours = o.hoursBetweenUpdateChecks ?? 24;
+  if (!Number.isInteger(hours) || hours < 0 || hours > 255) errors.push("hoursBetweenUpdateChecks must be an integer 0-255");
+  if (errors.length) throw fail(errors.join("; "));
+  return `<?xml version="1.0" encoding="utf-8"?>
+<AppInstaller xmlns="http://schemas.microsoft.com/appx/appinstaller/2018" Version="${xml(o.version)}" Uri="${xml(o.uri)}">
+  <MainPackage Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" Uri="${xml(o.msixUri)}" />
+  <UpdateSettings>
+    <OnLaunch HoursBetweenUpdateChecks="${hours}" ShowPrompt="${o.showPrompt ? "true" : "false"}" UpdateBlocksActivation="${o.updateBlocksActivation ? "true" : "false"}" />
+  </UpdateSettings>
+</AppInstaller>
+`;
+}

package/msix-build.mjs

@@ -0,0 +1,164 @@
+// Windows MSIX packaging for staged desktop apps (SwiftPM exe + app-local DLLs).
+// Order mirrors the Windows rule in docs/rules/release-signing.md: sign raw PE
+// files first, pack the exact signed bytes, then sign the package. All signing
+// goes through sign-windows.mjs (provisioned Azure Artifact Signing); this module
+// never touches credentials and never authenticates anything itself.
+
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { findWindowsSdkTool } from "./preflight.mjs";
+import { generateAppInstaller } from "./msix-appinstaller.mjs";
+import { assertPublisherMatchesSigner, planMsixSigning, verifyPayloadInventory } from "./msix-plan.mjs";
+import { createHash } from "node:crypto";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const here = path.dirname(fileURLToPath(import.meta.url));
+export const MSIX_SIGNER_SUBJECT = "CN=Damned Ventures LLC";
+
+const xml = (value) => String(value).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+const PNG = Buffer.from("89504e470d0a1a0a", "hex");
+
+export function validateMsixIdentity(o) {
+  const errors = [];
+  if (!/^[-.A-Za-z0-9]{3,50}$/.test(o.name ?? "")) errors.push("name must be 3-50 chars of letters, digits, '-' or '.'");
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(o.version ?? "") || o.version.split(".").some((n) => Number(n) > 65535)) errors.push("version must be four numeric parts <=65535");
+  if (!["x64", "arm64"].includes(o.architecture)) errors.push("architecture must be x64 or arm64");
+  if (!/\bCN=/.test(o.publisher ?? "")) errors.push("publisher must be a distinguished name containing CN=");
+  else if (!o.publisher.includes(MSIX_SIGNER_SUBJECT)) errors.push(`publisher must contain ${MSIX_SIGNER_SUBJECT} (the provisioned signing subject); confirm the full DN natively`);
+  if (!o.displayName || !o.publisherDisplayName) errors.push("displayName and publisherDisplayName are required");
+  if (!/\.exe$/i.test(o.executable ?? "") || /[\\/]/.test(o.executable ?? "")) errors.push("executable must be a flat .exe name inside the package");
+  if (errors.length) throw fail("MSIX_INVALID_IDENTITY", errors.join("; "));
+}
+
+export function generateAppxManifest(o) {
+  validateMsixIdentity(o);
+  const deps = (o.dependencies ?? []).filter((d) => d.minVersion).map((d) =>
+    `    <PackageDependency Name="${xml(d.name)}" MinVersion="${xml(d.minVersion)}" Publisher="${xml(d.publisher ?? "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")}" />`);
+  const v = o.virtualization;
+  for (const key of ["fileSystemWrite", "registryWrite"]) {
+    if (v?.[key] !== undefined && !["enabled", "disabled"].includes(v[key])) throw fail("MSIX_INVALID_IDENTITY", `virtualization.${key} must be "enabled" or "disabled"`);
+  }
+  const virt = v ? [["fileSystemWrite", "FileSystemWriteVirtualization"], ["registryWrite", "RegistryWriteVirtualization"]]
+    .filter(([k]) => v[k]).map(([k, el]) => `\n    <desktop6:${el}>${v[k]}</desktop6:${el}>`).join("") : "";
+  // Opting out of virtualization is a restricted capability.
+  const unvirtualized = v && (v.fileSystemWrite === "disabled" || v.registryWrite === "disabled") ? '\n    <rescap:Capability Name="unvirtualizedResources" />' : "";
+  return `<?xml version="1.0" encoding="utf-8"?>
+<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+         xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+         xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+         xmlns:desktop6="http://schemas.microsoft.com/appx/manifest/desktop/windows10/6"
+         IgnorableNamespaces="uap rescap">
+  <Identity Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" />
+  <Properties>
+    <DisplayName>${xml(o.displayName)}</DisplayName>
+    <PublisherDisplayName>${xml(o.publisherDisplayName)}</PublisherDisplayName>
+    <Logo>Assets\\StoreLogo.png</Logo>${virt}
+  </Properties>
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="${xml(o.minWindowsVersion ?? "10.0.19041.0")}" MaxVersionTested="${xml(o.maxWindowsVersionTested ?? "10.0.26100.0")}" />
+${deps.join("\n")}${deps.length ? "\n" : ""}  </Dependencies>
+  <Resources><Resource Language="${xml(o.language ?? "en-us")}" /></Resources>
+  <Applications>
+    <Application Id="App" Executable="${xml(o.executable)}" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements DisplayName="${xml(o.displayName)}" Description="${xml(o.description ?? o.displayName)}" BackgroundColor="transparent"
+        Square150x150Logo="Assets\\Square150x150Logo.png" Square44x44Logo="Assets\\Square44x44Logo.png" />
+    </Application>
+  </Applications>
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />${unvirtualized}${(o.capabilities ?? []).map((c) => `\n    <Capability Name="${xml(c)}" />`).join("")}
+  </Capabilities>
+</Package>
+`;
+}
+
+const ASSETS = { storeLogo: "StoreLogo.png", square150: "Square150x150Logo.png", square44: "Square44x44Logo.png" };
+
+/** Copy a staged directory plus assets and manifest into a package root. */
+export function assembleMsixRoot({ stageDir, root, manifest, assets }) {
+  stageDir = path.resolve(stageDir); root = path.resolve(root);
+  if (!existsSync(path.join(stageDir, manifest.executable))) throw fail("MSIX_MISSING_EXECUTABLE", `executable not in staged directory: ${manifest.executable}`);
+  rmSync(root, { recursive: true, force: true });
+  mkdirSync(path.join(root, "Assets"), { recursive: true });
+  for (const entry of readdirSync(stageDir, { withFileTypes: true })) {
+    if (entry.isFile()) copyFileSync(path.join(stageDir, entry.name), path.join(root, entry.name));
+    else throw fail("MSIX_NESTED_STAGE", `staged directory must be flat; found ${entry.name}/ (use include with flat files)`);
+  }
+  for (const [key, target] of Object.entries(ASSETS)) {
+    const source = assets?.[key] && path.resolve(assets[key]);
+    if (!source || !existsSync(source)) throw fail("MSIX_MISSING_ASSET", `assets.${key} (PNG) is required: ${assets?.[key] ?? "unset"}`);
+    if (!readFileSync(source).subarray(0, 8).equals(PNG)) throw fail("MSIX_MISSING_ASSET", `assets.${key} is not a PNG: ${source}`);
+    copyFileSync(source, path.join(root, "Assets", target));
+  }
+  writeFileSync(path.join(root, "AppxManifest.xml"), generateAppxManifest(manifest));
+  return root;
+}
+
+/** PE files the package ships; these get Authenticode before packing. */
+export function peFilesIn(root) {
+  return readdirSync(root).filter((name) => /\.(exe|dll)$/i.test(name)).sort().map((name) => path.join(root, name));
+}
+
+const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+function readSignerSubject(file, run) {
+  const r = run("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${file.replace(/'/g, "''")}').SignerCertificate.Subject`], { encoding: "utf8", windowsHide: true });
+  return r.status === 0 ? String(r.stdout ?? "").trim() : "";
+}
+
+/**
+ * Pack + sign. `run` is injectable for tests. Ordered per planMsixSigning():
+ *  assemble, verify-inventory, sign-pe (DLLs then EXEs, raw bytes), pack, sign-msix, verify-msix,
+ *  verify-publisher, appinstaller, seal. Windows-only unless dryRun.
+ * options.runtime = { dlls, systemDlls, dependencies } (declared inventory, verified fail-closed);
+ * options.appInstaller = { uri, msixUri, out, ... } generates the update route after the package is signed.
+ */
+export function buildMsix({ stageDir, out, workDir, manifest, assets, runtime, appInstaller, sign = true, dryRun = false, receiptDir, peReceipt, msixReceipt },
+  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)), readSubject = (file) => readSignerSubject(file, run) } = {}) {
+  out = path.resolve(out);
+  if (!out.endsWith(".msix")) throw fail("MSIX_INVALID_OPTIONS", "out must end with .msix");
+  validateMsixIdentity(manifest);
+  workDir = path.resolve(workDir ?? `${out}.root`);
+  const receipts = path.resolve(receiptDir ?? path.dirname(out));
+  const planFor = (files) => planMsixSigning({ files, sign, appInstaller: Boolean(appInstaller) });
+  const staged = existsSync(path.resolve(stageDir)) ? readdirSync(path.resolve(stageDir)) : [];
+  const steps = planFor(staged.filter((n) => /\.(exe|dll)$/i.test(n))).map((p) => p.step);
+  if (dryRun) { log({ event: "msix-dry-run", out, steps }); return { out, steps, dryRun: true }; }
+  if (platform !== "win32") throw fail("MSIX_NATIVE_HOST_REQUIRED", "MSIX packing and signing must run on Windows");
+  const makeappx = env.MAKEAPPX_PATH || findTool("makeappx.exe")?.toolPath;
+  if (!makeappx) throw fail("MSIX_TOOL_MISSING", "makeappx.exe not found; install the Windows SDK or set MAKEAPPX_PATH");
+  const checked = (cmd, args) => {
+    const r = run(cmd, args, { encoding: "utf8", windowsHide: true, timeout: 600000 });
+    if (r.error || r.status !== 0) throw fail("MSIX_COMMAND_FAILED", `${path.basename(cmd)} ${args[0] ?? ""} failed: ${r.error?.message ?? r.stderr ?? r.stdout ?? r.status}`);
+    return r;
+  };
+  const signer = (files, receipt) => checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--receipt", receipt, ...files]);
+  const root = assembleMsixRoot({ stageDir, root: workDir, manifest, assets });
+  const inventory = runtime ? verifyPayloadInventory({ root, inventory: runtime, architecture: manifest.architecture }) : null;
+  mkdirSync(receipts, { recursive: true });
+  const ordered = planFor(readdirSync(root).filter((n) => /\.(exe|dll)$/i.test(n))).find((p) => p.step === "sign-pe")?.files ?? [];
+  if (sign) signer(ordered.map((f) => path.join(root, path.basename(f))), peReceipt ?? path.join(receipts, "msix-pe-sign.receipt.json"));
+  mkdirSync(path.dirname(out), { recursive: true });
+  rmSync(out, { force: true });
+  checked(makeappx, ["pack", "/d", root, "/p", out, "/o"]);
+  if (!existsSync(out) || statSync(out).size === 0) throw fail("MSIX_PACK_EMPTY", `makeappx produced no package: ${out}`);
+  if (sign) {
+    signer([out], msixReceipt ?? path.join(receipts, "msix-sign.receipt.json"));
+    checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--verify-only", out]);
+    assertPublisherMatchesSigner(manifest.publisher, readSubject(out));
+  }
+  let appInstallerFile = null;
+  if (appInstaller) {
+    appInstallerFile = path.resolve(appInstaller.out);
+    mkdirSync(path.dirname(appInstallerFile), { recursive: true });
+    writeFileSync(appInstallerFile, generateAppInstaller({ ...appInstaller, name: manifest.name, publisher: manifest.publisher, version: manifest.version, architecture: manifest.architecture }));
+  }
+  const seal = { schema: 1, msix: { file: out, sha256: sha256(out), sizeBytes: statSync(out).size }, signed: sign, identity: { name: manifest.name, version: manifest.version, publisher: manifest.publisher, architecture: manifest.architecture },
+    payload: readdirSync(root, { recursive: true }).map((n) => String(n).split(path.sep).join("/")).filter((n) => statSync(path.join(root, n)).isFile()).sort().map((n) => ({ name: n, sha256: sha256(path.join(root, n)) })), inventory,
+    appInstaller: appInstallerFile && { file: appInstallerFile, sha256: sha256(appInstallerFile) } };
+  const sealFile = path.join(receipts, "msix-seal.json");
+  writeFileSync(sealFile, `${JSON.stringify(seal, null, 2)}\n`);
+  log({ event: "msix-built", out, signed: sign });
+  return { out, steps, root, signed: sign, seal: sealFile, appInstaller: appInstallerFile };
+}

package/msix-config.mjs

@@ -0,0 +1,70 @@
+// `msix` target schema for right-release configs (targets.win.msix) and the
+// `windows-msix-signed-v1` signing contract. Pure validation; no I/O.
+//
+// targets.win = {
+//   signed: true, signingContract: "windows-msix-signed-v1",
+//   projectType: "swiftpm",                      // optional; auto-detected from Package.swift
+//   prePackage: { cmd, args },                   // SwiftPM build + stage (swift-package windows-stage)
+//   msix: {
+//     stageDir, out,                             // flat payload dir produced by prePackage; .msix path
+//     identity: { name, publisher, publisherDisplayName, displayName, description?, version, architecture, executable },
+//     capabilities: ["internetClient"], minWindowsVersion?, maxWindowsVersionTested?,
+//     virtualization: { fileSystemWrite: "enabled|disabled", registryWrite: "enabled|disabled" },  // explicit, required
+//     assets: { storeLogo, square150, square44 },
+//     runtime: { dlls: ["swiftCore.dll", ...], systemDlls?: [], dependencies?: [{ name, minVersion, provides: [] }] },
+//     appInstaller?: { uri, msixUri, out, hoursBetweenUpdateChecks?, showPrompt?, updateBlocksActivation? },
+//   },
+//   updater?: { kind: "tauri" | "appinstaller", artifacts: [...] },   // tauri stays the default
+//   installer: { artifacts: [{ file: "<out>.msix", key }] },
+// }
+
+export const MSIX_SIGNING_CONTRACT = "windows-msix-signed-v1";
+export const UPDATER_KINDS = Object.freeze(["tauri", "appinstaller"]);
+export const VIRTUALIZATION_VALUES = Object.freeze(["enabled", "disabled"]);
+
+export const isMsixTarget = (target) => target?.signingContract === MSIX_SIGNING_CONTRACT;
+export const updaterKind = (target) => target?.updater?.kind ?? "tauri";
+
+const isHttps = (value) => { try { return new URL(value).protocol === "https:"; } catch { return false; } };
+
+/** Returns an array of human-readable problems (empty when valid). */
+export function validateMsixTarget(target, app = "app") {
+  const e = [];
+  const at = (message) => e.push(`${app} win msix: ${message}`);
+  if (!isMsixTarget(target)) at(`signingContract must be ${MSIX_SIGNING_CONTRACT}`);
+  const m = target?.msix;
+  if (!m || typeof m !== "object") { at("msix block is required"); return e; }
+  if (!target.prePackage?.cmd) at("prePackage is required (SwiftPM build + payload staging)");
+  if (target.sign?.prePackageFiles?.length || target.sign?.files?.length) at("omit sign.prePackageFiles/sign.files: the msix step signs payload PE files, then the package");
+  if (!m.stageDir) at("msix.stageDir is required");
+  if (!/\.msix$/i.test(m.out ?? "")) at("msix.out must end with .msix");
+  const id = m.identity ?? {};
+  for (const key of ["name", "publisher", "publisherDisplayName", "displayName", "version", "architecture", "executable"]) if (!id[key]) at(`msix.identity.${key} is required`);
+  const v = m.virtualization ?? {};
+  for (const key of ["fileSystemWrite", "registryWrite"]) {
+    if (!VIRTUALIZATION_VALUES.includes(v[key])) at(`msix.virtualization.${key} must be explicitly "enabled" or "disabled"`);
+  }
+  for (const key of ["storeLogo", "square150", "square44"]) if (!m.assets?.[key]) at(`msix.assets.${key} (PNG) is required`);
+  const dlls = m.runtime?.dlls;
+  if (!Array.isArray(dlls)) at("msix.runtime.dlls (explicit runtime dependency inventory; use [] only for a dependency-free app) is required");
+  else if (dlls.some((d) => !/\.dll$/i.test(d) || /[\\/]/.test(d))) at("msix.runtime.dlls entries must be flat .dll names");
+  const kind = updaterKind(target);
+  if (!UPDATER_KINDS.includes(kind)) at(`updater.kind must be one of ${UPDATER_KINDS.join(", ")}`);
+  if (kind === "appinstaller") {
+    const a = m.appInstaller;
+    if (!a) at("updater.kind appinstaller requires msix.appInstaller");
+    else {
+      if (!isHttps(a.uri)) at("msix.appInstaller.uri must be an https URL");
+      if (!isHttps(a.msixUri)) at("msix.appInstaller.msixUri must be an https URL");
+      if (!/\.appinstaller$/i.test(a.out ?? "")) at("msix.appInstaller.out must end with .appinstaller");
+    }
+  }
+  const outName = String(m.out ?? "").split(/[\\/]/).pop();
+  if (outName && !(target.installer?.artifacts ?? []).some((a) => String(a.file).split(/[\\/]/).pop() === outName)) at("installer.artifacts must list the .msix so it is sealed");
+  return e;
+}
+
+export function assertValidMsixTarget(target, app) {
+  const errors = validateMsixTarget(target, app);
+  if (errors.length) throw Object.assign(new Error(errors.join("; ")), { code: "MSIX_CONFIG_INVALID" });
+}