@rightkit/release 0.2.137 → 0.2.139

package/preflight.mjs

@@ -23,6 +23,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
+import { isSwiftProject } from "./project-type.mjs";
 
 export const PREFLIGHT_OK = "ok";
 export const PREFLIGHT_WARN = "warn";
@@ -179,11 +180,24 @@ export function collectPreflight({
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
+  projectType,
+  msix = false,
+  findSdkTool = findWindowsSdkTool,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
+  const swift = isSwiftProject(projectType);
 
-  if (appRoot) {
+  if (swift) {
+    const swiftVersion = versionProbe("swift");
+    checks.push(
+      swiftVersion
+        ? ok("swift", swiftVersion)
+        : fail("swift", "swift was not found on PATH; SwiftPM apps build with the Swift toolchain", "install the pinned Swift toolchain (swift.org / Swift on Windows) and verify: swift --version"),
+    );
+  }
+
+  if (appRoot && !swift) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -225,29 +239,27 @@ export function collectPreflight({
   }
 
   if (windows) {
-    const makeappx = findWindowsSdkTool("makeappx.exe");
-    checks.push(
-      makeappx
-        ? ok("windows-sdk", `makeappx.exe from SDK ${makeappx.version}`)
-        : fail(
-            "windows-sdk",
-            "no makeappx.exe found under any installed Windows 10/11 SDK",
-            "install the Windows SDK, or set MAKEAPPX_PATH to an explicit makeappx.exe",
-          ),
-    );
+    // makeappx/signtool are MSIX requirements; NSIS/portable targets sign through sign-windows.
+    if (msix) {
+      const makeappx = process.env.MAKEAPPX_PATH ? { version: "MAKEAPPX_PATH" } : findSdkTool("makeappx.exe");
+      checks.push(
+        makeappx
+          ? ok("windows-sdk", `makeappx.exe from SDK ${makeappx.version}`)
+          : fail(
+              "windows-sdk",
+              "msix target configured but no makeappx.exe found under any installed Windows 10/11 SDK",
+              "install the Windows SDK, or set MAKEAPPX_PATH to an explicit makeappx.exe",
+            ),
+      );
+    }
 
-    const signtool = findWindowsSdkTool("signtool.exe");
-    checks.push(
-      signtool
-        ? ok("signtool", `signtool.exe from SDK ${signtool.version}`)
-        : warn(
-            "signtool",
-            "no signtool.exe found under any installed Windows SDK",
-            "install the Windows SDK Build Tools, or set AZURE_SIGNTOOL_PATH",
-          ),
-    );
+    const signtool = findSdkTool("signtool.exe");
+    const signtoolMissing = "install the Windows SDK Build Tools, or set AZURE_SIGNTOOL_PATH";
+    if (signtool) checks.push(ok("signtool", `signtool.exe from SDK ${signtool.version}`));
+    else if (msix) checks.push(fail("signtool", "msix target configured but no signtool.exe found under any installed Windows SDK", signtoolMissing));
+    else checks.push(warn("signtool", "no signtool.exe found under any installed Windows SDK", signtoolMissing));
 
-    const vendorsOpenssl = cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
+    const vendorsOpenssl = !swift && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
     if (vendorsOpenssl) {
       const perl = resolveWindowsPerl({ env });
       checks.push(
@@ -262,7 +274,9 @@ export function collectPreflight({
     }
   }
 
-  if (isBrokerManagedHost(env)) {
+  if (swift) {
+    // No Rust compiler cache applies to SwiftPM targets.
+  } else if (isBrokerManagedHost(env)) {
     checks.push(ok("compiler-cache", "broker-managed; compiler-cache selection and status are recorded in build receipts"));
   } else {
     const sccache = versionProbe("sccache");

package/project-type.mjs

@@ -0,0 +1,43 @@
+// Project-type awareness for release preflight: which toolchain a target needs.
+// Pure; filesystem access is injectable. Swift (SwiftPM) apps need `swift`, not
+// cargo/rustc; Tauri/Rust targets keep their existing requirements.
+
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+export const PROJECT_TYPES = Object.freeze(["tauri", "cargo", "swiftpm"]);
+
+/**
+ * Explicit `target.projectType` / `config.projectType` wins. Otherwise a Package.swift with no Cargo
+ * manifest (root or src-tauri) is swiftpm; everything else is tauri/cargo (unchanged behaviour).
+ */
+export function resolveProjectType({ appRoot, config = {}, target = {}, exists = existsSync } = {}) {
+  const explicit = target.projectType ?? config.projectType;
+  if (explicit !== undefined) {
+    if (!PROJECT_TYPES.includes(explicit)) throw Object.assign(new Error(`projectType must be one of ${PROJECT_TYPES.join(", ")}; got ${explicit}`), { code: "PROJECT_TYPE_INVALID" });
+    return explicit;
+  }
+  if (appRoot) {
+    const roots = [appRoot, path.resolve(appRoot, config.workdir ?? ".")];
+    const hasSwift = roots.some((r) => exists(path.join(r, "Package.swift")));
+    const hasCargo = roots.some((r) => exists(path.join(r, "Cargo.toml")) || exists(path.join(r, "src-tauri", "Cargo.toml")));
+    if (hasSwift && !hasCargo) return "swiftpm";
+  }
+  return "tauri";
+}
+
+export const isSwiftProject = (projectType) => projectType === "swiftpm";
+
+/** Executables the build itself needs (the config's own preflight.executables are appended by callers). */
+export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true } = {}) {
+  if (isSwiftProject(projectType)) return ["git", "swift", ...(usesPackageManager && packageManager ? [packageManager] : [])];
+  return ["git", packageManager, "cargo", "rustc"];
+}
+
+/** True when the Windows target packages an MSIX (needs makeappx and signtool). */
+export function targetUsesMsix(target) {
+  return Boolean(target?.msix) || target?.signingContract === "windows-msix-signed-v1";
+}
+
+/** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
+export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/publish-update.mjs

@@ -75,6 +75,12 @@ const artifactFile = (declared) => {
   return artifact.file;
 };
 const verifiedArtifact = (file) => sealed.artifacts.get(path.basename(file));
+// MSIX updates (updater.kind appinstaller) trust the package Authenticode signature (publisher-pinned in
+// the manifest), so no minisign .sig exists; the route records the sealed package digest instead.
+const appInstallerKind = target?.updater?.kind === "appinstaller";
+const signatureFor = (artifact) => appInstallerKind
+  ? `msix-authenticode-sha256:${assertArtifactUnchanged(verifiedArtifact(artifact.file)) && verifiedArtifact(artifact.file).sha256}`
+  : signatureText(artifactFile(artifact.signature));
 const signatureText = (file) => {
   const signature = assertArtifactUnchanged(verifiedArtifact(file)).toString("utf8").trim();
   if (!signature) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", `sealed updater signature is empty: ${file}`);
@@ -89,7 +95,7 @@ function git(args) {
 if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
-if (sealed) for (const artifact of artifacts) signatureText(artifactFile(artifact.signature));
+if (sealed) for (const artifact of artifacts) signatureFor(artifact);
 let releaseToken = null;
 if (!dryRun && (tier === "update" || artifacts.length > 0)) {
   try {
@@ -114,13 +120,13 @@ if (tier === "patch") {
     const installerKey = patchInstallerKey(artifact);
     assertCurrentKey(installerKey, "installer");
     const file = artifactFile(artifact.file);
-    const signatureFile = artifactFile(artifact.signature);
+    if (!appInstallerKind) artifactFile(artifact.signature);
     if (!uploadedKeys.has(installerKey)) {
       console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}`);
       if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installerKey, "public", { cwd: root });
       uploadedKeys.add(installerKey);
     }
-    const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
+    const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
     platforms[artifact.platform] = {
@@ -210,13 +216,13 @@ const uploadedKeys = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = artifactFile(artifact.file);
-  const signatureFile = artifactFile(artifact.signature);
+  if (!appInstallerKind) artifactFile(artifact.signature);
   if (!uploadedKeys.has(artifact.key)) {
     console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`);
     if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), artifact.key, "private", { cwd: root });
     uploadedKeys.add(artifact.key);
   }
-  const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
+  const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
   platforms[artifact.platform] = {

package/release-invocation.mjs

@@ -1,4 +1,5 @@
 import { spawnSync } from "./background-process.mjs";
+import { resolveProjectType } from "./project-type.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
@@ -128,18 +129,19 @@ export function resolveConfiguredBuildInputs(config, target, label = "release co
 }
 
 export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
+  const swift = resolveProjectType({ appRoot, config, target }) === "swiftpm";
   const nativeLayout = resolveNativeCargoLayout({
     appRoot,
     config,
-    requireManifest: true,
-    requireLock: true,
+    requireManifest: !swift,
+    requireLock: !swift,
   });
   const requiredInputs = [
     configPath,
-    path.join(appRoot, "package.json"),
-    path.join(appRoot, "pnpm-lock.yaml"),
-    nativeLayout.manifestPath,
-    nativeLayout.lockPath,
+    ...(swift
+      // SwiftPM: Package.swift is required; Package.resolved and the Node manifests only when they exist.
+      ? [path.join(appRoot, "Package.swift"), ...["Package.resolved", "package.json", "pnpm-lock.yaml"].map((f) => path.join(appRoot, f)).filter((f) => existsSync(f))]
+      : [path.join(appRoot, "package.json"), path.join(appRoot, "pnpm-lock.yaml"), nativeLayout.manifestPath, nativeLayout.lockPath]),
     ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
   ].filter((file, index, files) => files.indexOf(file) === index);
   for (const file of requiredInputs) {

package/release.mjs

@@ -17,6 +17,10 @@ import {
   resolveNativeFinalizerConfig,
   validateNativeFinalizationOutput,
 } from "./native-release-finalization.mjs";
+import { packageCommandOptional, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
+import { MSIX_SIGNING_CONTRACT, assertValidMsixTarget } from "./msix-config.mjs";
+import { buildMsix } from "./msix-build.mjs";
+import { msixBuildOptions } from "./msix-target.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
@@ -118,7 +122,10 @@ const workdir = path.resolve(root, config.workdir ?? ".");
 const nativeLayout = resolveNativeCargoLayout({ appRoot: root, config });
 const nativeAssembly = config.nativeAssembly;
 const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
-await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
+// A SwiftPM app without a package.json has no Node package contract to validate.
+if (!(resolveProjectType({ appRoot: root, config, target: config.targets?.[opts.platform] }) === "swiftpm" && !existsSync(path.join(root, "package.json")))) {
+  await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
+}
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
@@ -131,13 +138,18 @@ if (target.signed !== true) {
 if (opts.platform === "win") {
   const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
   const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
-  if (!isNsis && !isPortable) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT} or ${WINDOWS_PORTABLE_SIGNING_CONTRACT}`);
+  const isMsix = target.signingContract === MSIX_SIGNING_CONTRACT;
+  if (!isNsis && !isPortable && !isMsix) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT}, ${WINDOWS_PORTABLE_SIGNING_CONTRACT} or ${MSIX_SIGNING_CONTRACT}`);
+  if (isMsix) {
+    try { assertValidMsixTarget(target, config.app ?? "app"); } catch (error) { fail(error.message); }
+  } else {
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
   if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
   if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
   if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
   if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
+  }
 }
 if (opts.platform === "mac") {
   if (target.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT) fail(`${config.app ?? "app"} mac must declare signingContract: ${MACOS_PORTABLE_SIGNING_CONTRACT}`);
@@ -150,7 +162,7 @@ if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.pl
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout, projectTarget = config.targets?.[platform] }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -173,6 +185,8 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
     cargoLockPaths,
     nativeLayout: suppliedNativeLayout,
     targetLink: suppliedNativeLayout?.targetLink,
+    projectType: resolveProjectType({ appRoot: root, config, target: projectTarget }),
+    msix: targetUsesMsix(projectTarget),
   });
 }
 
@@ -234,7 +248,7 @@ if (opts.doctor) {
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
-if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (!command && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
   fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
 }
@@ -255,7 +269,17 @@ await runConfiguredChecks({
 
 let nativeFinalization = null;
 let bundleMarkerReceipts = [];
-if (opts.platform === "win") {
+if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT) {
+  // MSIX order: prePackage builds + stages the payload; buildMsix signs inner PE files (DLLs, EXEs),
+  // packs the exact signed bytes, signs the package through sign-windows, verifies signer == Publisher,
+  // writes the App Installer route and the seal record. Never a second signer.
+  await runCommand(target.prePackage, root);
+  const options = msixBuildOptions({ root, target, app: config.app, dryRun: opts.dryRun, receipts: {
+    pe: windowsReceiptPath(root, "raw-exe"), msix: windowsReceiptPath(root, "installer"),
+    dir: path.dirname(windowsReceiptPath(root, "raw-exe")) } });
+  const built = buildMsix(options, { log: (event) => console.log(`right-release: ${JSON.stringify(event)}`) });
+  console.log(`right-release: msix ${built.dryRun ? "dry-run" : "built"} ${options.out}`);
+} else if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
   await runCommand(target.prePackage, root);
   for (const file of rawFiles) await mustExist(file, `missing raw EXE signing artifact: ${file}`);
@@ -300,7 +324,7 @@ if (opts.platform === "win") {
   }
 }
 
-if (opts.platform !== "mac" || runMacPhase("package")) await runCommand(command, root);
+if (command && (opts.platform !== "mac" || runMacPhase("package"))) await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
   await mustExist(resolveReleaseArtifactPath(root, rel), `missing release artifact: ${rel}`);

package/rightkit-ownership.json

@@ -2348,45 +2348,10 @@
     }
   ],
   "internalOwners": [
-    {
-      "package": "@rightkit/build-control-broker",
-      "path": "packages/build-control-broker/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-clients",
-      "path": "packages/build-control-clients/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-core",
-      "path": "packages/build-control-core/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-phase0",
-      "path": "packages/build-control-phase0/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
     {
       "package": "@rightkit/build-control-policy",
       "path": "packages/build-control-policy/package.json",
       "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-staging",
-      "path": "packages/build-control-staging/package.json",
-      "reason": "Private build-control infrastructure; not an application capability"
-    },
-    {
-      "package": "@rightkit/build-control-phase0-macos",
-      "path": "packages/build-control-phase0/macos/package.json",
-      "reason": "Private native build-control feasibility fixture"
-    },
-    {
-      "package": "@rightkit/build-control-phase0-windows",
-      "path": "packages/build-control-phase0/windows/package.json",
-      "reason": "Private native build-control feasibility fixture"
     }
   ]
 }

package/rightkit-sync.mjs

@@ -10,7 +10,7 @@ import { fileURLToPath } from "node:url";
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
 const rightkitRoot = path.resolve(packageRoot, "..", "..");
 const VERSIONS_FILE = path.join(packageRoot, "rightkit-versions.json");
-const USER_AGENT = "rightkit-sync/1 (https://github.com/bogusyogi/claude)";
+const USER_AGENT = "rightkit-sync/1 (https://github.com/bogusyogi/rightkit)";
 
 const field = (toml, key) => toml.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"))?.[1] ?? null;
 
@@ -178,12 +178,10 @@ export function recordPublished({ registry, name, version }, { file = VERSIONS_F
   } catch (error) { log(`[right-release] release feed not updated (${error.message}); run node rightkit-sync.mjs`); }
 }
 
-/** The broker client and the session hook carry byte copies of the catalog and versions; keep them exact. */
+/** The session hook carries byte copies of the catalog and versions; keep them exact. */
 export function syncConsumerCopies(root = rightkitRoot) {
   const release = path.join(root, "packages", "release");
   const targets = [
-    ["rightkit-ownership.json", path.join(root, "packages", "build-control-clients", "src", "ownership-catalog.json")],
-    ["rightkit-versions.json", path.join(root, "packages", "build-control-clients", "src", "rightkit-versions.json")],
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-catalog.json")],
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-fingerprints.json")],
     ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
@@ -191,7 +189,6 @@ export function syncConsumerCopies(root = rightkitRoot) {
     ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
     ["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
     ["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
-    ["ownership-availability.mjs", path.join(root, "packages", "build-control-clients", "src", "ownership-availability.mjs")],
   ];
   const updated = [];
   for (const [source, target] of targets) {

package/rightkit-versions.json

@@ -16,7 +16,7 @@
     "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
     "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.30",
+    "@rightkit/git": "0.2.31",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.137",
+    "@rightkit/release": "0.2.139",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -71,7 +71,8 @@
       "0.2.26",
       "0.2.27",
       "0.2.28",
-      "0.2.29"
+      "0.2.29",
+      "0.2.30"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -166,7 +167,9 @@
       "0.2.133",
       "0.2.134",
       "0.2.135",
-      "0.2.136"
+      "0.2.136",
+      "0.2.137",
+      "0.2.138"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -283,7 +286,7 @@
     "rightkit-oauth": "0.3.0",
     "rightkit-ocr": "0.1.2",
     "rightkit-ort": "0.2.2",
-    "rightkit-ownership": "0.2.0",
+    "rightkit-ownership": "0.2.1",
     "rightkit-pdf": "0.2.0",
     "rightkit-playback": "0.1.1",
     "rightkit-process": "0.3.3",
@@ -340,7 +343,7 @@
       "rightkit-oauth": "0.3.0",
       "rightkit-ocr": "0.1.2",
       "rightkit-ort": "0.2.2",
-      "rightkit-ownership": "0.2.0",
+      "rightkit-ownership": "0.2.1",
       "rightkit-pdf": "0.2.0",
       "rightkit-playback": "0.1.1",
       "rightkit-process": "0.3.3",
@@ -365,7 +368,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.30",
+      "@rightkit/git": "0.2.31",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -378,7 +381,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.137",
+      "@rightkit/release": "0.2.139",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -387,6 +390,9 @@
     }
   },
   "legacyCargo": {
+    "rightkit-ownership": [
+      "0.2.0"
+    ],
     "rightkit-browser": [
       "0.2.0",
       "0.2.1",

package/swift-build-context.mjs

@@ -0,0 +1,43 @@
+// Everything the sealed `build` path does differently for a SwiftPM target, as pure/stub-friendly
+// functions so build-release.mjs only branches once. Rust-only steps (rustc/cargo probes, Cargo lock
+// identity, broker cargo target, Cache V2 shared Rust cache, target bridge, CARGO/SCCACHE env) are skipped.
+
+import path from "node:path";
+import { resolveSwiftCacheIdentity } from "./cache-policy.mjs";
+
+const RUST_ENV = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "SCCACHE_IGNORE_SERVER_IO_ERROR", "RUSTFLAGS", "RIGHT_RELEASE_CACHE_OWNER"];
+
+export function swiftArchitecture({ target = {}, platform, hostArch = process.arch }) {
+  const arch = target.msix?.identity?.architecture ?? target.architecture ?? (hostArch === "arm64" ? "arm64" : "x64");
+  return platform === "mac" ? (arch === "x64" ? "x86_64" : arch) : arch;
+}
+
+/** exec(cmd, args) -> stdout string. Throws when swift is missing. */
+export function collectSwiftToolVersions({ packageManager, exec, nodeVersion = process.version }) {
+  const swift = exec("swift", ["--version"]).trim();
+  if (!swift) throw new Error("swift --version printed nothing");
+  return { node: nodeVersion, packageManager: packageManager ? `${packageManager} ${exec(packageManager, ["--version"]).trim()}` : null, swift, cargo: null, rustc: null, rustHost: null, sccache: null };
+}
+
+/**
+ * Plan for a swiftpm sealed build: identity, forced non-shared cache mode, no broker cargo target, no target
+ * bridge, a plain build/cache dir under the vault, and an environment with every Rust variable removed.
+ */
+export function planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions, profile = "release", hostArch }) {
+  const architecture = swiftArchitecture({ target, platform, hostArch });
+  const identity = resolveSwiftCacheIdentity({ swiftVersion: toolVersions.swift, packageResolvedPath: path.join(appRoot, "Package.resolved"), architecture, profile: target.profile ?? profile });
+  const buildDir = path.resolve(vaultRoot, "cache", "swift-build", platform, identity.fingerprint);
+  return {
+    identity, architecture, buildDir,
+    cacheMode: "legacy",
+    managedCargoTarget: null,
+    targetBridge: { run: (fn) => fn(), ensure() {} },
+    sanitizeEnv(env) {
+      const next = { ...env };
+      for (const name of RUST_ENV) delete next[name];
+      next.RIGHT_RELEASE_SWIFT_BUILD_DIR = buildDir;
+      return next;
+    },
+    watchDirs: [buildDir, path.join(appRoot, ".build")],
+  };
+}