@rightkit/release 0.2.137 → 0.2.139

package/swift-mac-app.mjs

@@ -0,0 +1,146 @@
+// Assemble a macOS .app bundle from a SwiftPM executable, then sign (and
+// optionally notarize) it through the existing RightKit signers. Signing is
+// inside-out: nested code first (no entitlements), then the bundle. This module
+// owns bundle assembly only; sign-macos.mjs and notarize-macos.mjs own signing.
+
+import { cpSync, existsSync, mkdirSync, openSync, readSync, closeSync, readdirSync, rmSync, statSync, writeFileSync, lstatSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const here = path.dirname(fileURLToPath(import.meta.url));
+const xml = (v) => String(v).replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" })[c]);
+
+function plistValue(value, indent) {
+  const pad = "\t".repeat(indent);
+  if (typeof value === "string") return `${pad}<string>${xml(value)}</string>`;
+  if (typeof value === "boolean") return `${pad}<${value}/>`;
+  if (Number.isInteger(value)) return `${pad}<integer>${value}</integer>`;
+  if (typeof value === "number") return `${pad}<real>${value}</real>`;
+  if (Array.isArray(value)) return `${pad}<array>\n${value.map((v) => plistValue(v, indent + 1)).join("\n")}\n${pad}</array>`;
+  if (value && typeof value === "object") {
+    const rows = Object.keys(value).sort().map((k) => `${pad}\t<key>${xml(k)}</key>\n${plistValue(value[k], indent + 1)}`);
+    return `${pad}<dict>\n${rows.join("\n")}\n${pad}</dict>`;
+  }
+  throw fail("MAC_APP_PLIST", `unsupported plist value: ${value}`);
+}
+
+export function generateInfoPlist(o) {
+  const errors = [];
+  if (!/^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(o.name ?? "")) errors.push("name must be a simple bundle name");
+  if (!/^[A-Za-z0-9.-]+\.[A-Za-z0-9.-]+$/.test(o.bundleId ?? "")) errors.push("bundleId must be reverse-DNS");
+  if (!/^\d+(\.\d+){0,2}$/.test(o.version ?? "")) errors.push("version must be 1-3 numeric parts");
+  if (!/^\d+(\.\d+){0,2}$/.test(o.build ?? o.version ?? "")) errors.push("build must be 1-3 numeric parts");
+  if (!o.executable || /[\\/]/.test(o.executable)) errors.push("executable must be a flat file name");
+  if (errors.length) throw fail("MAC_APP_INVALID", errors.join("; "));
+  const info = {
+    CFBundleDevelopmentRegion: "en", CFBundleExecutable: o.executable, CFBundleIdentifier: o.bundleId,
+    CFBundleInfoDictionaryVersion: "6.0", CFBundleName: o.name, CFBundleDisplayName: o.displayName ?? o.name,
+    CFBundlePackageType: "APPL", CFBundleShortVersionString: o.version, CFBundleVersion: o.build ?? o.version,
+    LSMinimumSystemVersion: o.minimumSystemVersion ?? "14.0", NSHighResolutionCapable: true, NSPrincipalClass: "NSApplication",
+    ...(o.iconFile ? { CFBundleIconFile: path.basename(o.iconFile) } : {}),
+    ...(o.infoPlistExtra ?? {}),
+  };
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n${plistValue(info, 0)}\n</plist>\n`;
+}
+
+const MACHO = new Set([0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe, 0xbebafeca]);
+function isMachO(file) {
+  const fd = openSync(file, "r"); const b = Buffer.alloc(4);
+  try { return readSync(fd, b, 0, 4, 0) === 4 && MACHO.has(b.readUInt32BE(0)); } finally { closeSync(fd); }
+}
+const BUNDLE_DIR = /\.(framework|app|xpc|bundle|appex)$/;
+
+/** Nested code to sign before the app: Mach-O files and code bundles, deepest first. Main executable excluded. */
+export function discoverNestedCode(app, mainName) {
+  const main = path.join(app, "Contents", "MacOS");
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk(full);
+        if (/\.framework$/.test(entry.name) || (BUNDLE_DIR.test(entry.name) && existsSync(path.join(full, "Contents")))) found.push(full);
+      } else if (entry.isFile() && full !== main && !full.startsWith(main + path.sep) && isMachO(full)) found.push(full);
+    }
+  };
+  for (const sub of ["Contents/Frameworks", "Contents/Resources", "Contents/PlugIns", "Contents/XPCServices", "Contents/Helpers", "Contents/Library"]) {
+    const dir = path.join(app, sub);
+    if (existsSync(dir)) walk(dir);
+  }
+  const mainDir = path.join(app, "Contents", "MacOS");
+  for (const entry of readdirSync(mainDir)) { /* helpers beside main: sign them too */
+    const full = path.join(mainDir, entry);
+    if (entry !== mainName && lstatSync(full).isFile() && isMachO(full)) found.push(full);
+  }
+  const depth = (p) => p.split(path.sep).length;
+  return [...new Set(found)].sort((a, b) => depth(b) - depth(a) || a.localeCompare(b));
+}
+
+/**
+ * Assemble `<out>/<name>.app`. options: { executable (SwiftPM binary), name, bundleId, version, build,
+ * resources[] (files/dirs, e.g. SwiftPM *.bundle, copied into Contents/Resources), frameworks[] (dylibs/.frameworks
+ * copied into Contents/Frameworks), iconFile, infoPlistExtra, out }.
+ */
+export function assembleMacApp(o, { run = spawnSync, platform = process.platform } = {}) {
+  const exe = path.resolve(o.executable ?? "");
+  if (!existsSync(exe) || !statSync(exe).isFile()) throw fail("MAC_APP_INVALID", `executable not found: ${exe}`);
+  const execName = o.executableName ?? path.basename(exe);
+  const app = path.join(path.resolve(o.out), `${o.name}.app`);
+  const plist = generateInfoPlist({ ...o, executable: execName });
+  rmSync(app, { recursive: true, force: true });
+  const contents = path.join(app, "Contents");
+  for (const dir of ["MacOS", "Resources", ...(o.frameworks?.length ? ["Frameworks"] : [])]) mkdirSync(path.join(contents, dir), { recursive: true });
+  cpSync(exe, path.join(contents, "MacOS", execName)); chmodSync(path.join(contents, "MacOS", execName), 0o755);
+  const copyInto = (list, sub) => {
+    for (const item of list ?? []) {
+      const source = path.resolve(item);
+      if (!existsSync(source)) throw fail("MAC_APP_INVALID", `missing input: ${source}`);
+      cpSync(source, path.join(contents, sub, path.basename(source)), { recursive: true, verbatimSymlinks: true });
+    }
+  };
+  copyInto(o.resources, "Resources"); copyInto(o.frameworks, "Frameworks");
+  if (o.iconFile) copyInto([o.iconFile], "Resources");
+  writeFileSync(path.join(contents, "Info.plist"), plist);
+  writeFileSync(path.join(contents, "PkgInfo"), "APPL????");
+  if (o.frameworks?.length && platform === "darwin") {
+    // SwiftPM binaries do not search Contents/Frameworks by default.
+    const probe = run("otool", ["-l", path.join(contents, "MacOS", execName)], { encoding: "utf8" });
+    if (!probe.error && !/@executable_path\/\.\.\/Frameworks/.test(probe.stdout ?? "")) {
+      const r = run("install_name_tool", ["-add_rpath", "@executable_path/../Frameworks", path.join(contents, "MacOS", execName)], { encoding: "utf8" });
+      if (r.error || r.status !== 0) throw fail("MAC_APP_RPATH", `install_name_tool failed: ${r.error?.message ?? r.stderr}`);
+    }
+  }
+  return { app, nested: discoverNestedCode(app, execName), executable: execName };
+}
+
+/** Sign inside-out through sign-macos.mjs, then optionally notarize via notarize-macos.mjs. */
+export function signAndNotarizeMacApp({ app, nested, entitlements, receiptDir, notarize = false, profile, dryRun = false },
+  { run = spawnSync, platform = process.platform, log = (e) => console.error(JSON.stringify(e)) } = {}) {
+  const plan = [];
+  const node = (script, args) => { plan.push([script, ...args]); return args; };
+  const receipts = path.resolve(receiptDir);
+  const dry = dryRun ? ["--dry-run"] : [];
+  if (!dryRun && platform !== "darwin") throw fail("MAC_APP_NATIVE_HOST_REQUIRED", "macOS signing and notarization must run on macOS");
+  const calls = [];
+  if (nested.length) calls.push(["sign-macos.mjs", [...dry, "--receipt", path.join(receipts, "app-nested-sign.receipt.json"), ...nested]]);
+  calls.push(["sign-macos.mjs", [...dry, "--receipt", path.join(receipts, "app-sign.receipt.json"), ...(entitlements ? ["--entitlements", path.resolve(entitlements)] : []), app]]);
+  let zip;
+  if (notarize) {
+    zip = `${app}.zip`;
+    calls.push(["__ditto__", ["-c", "-k", "--keepParent", app, zip]]);
+    calls.push(["notarize-macos.mjs", [...dry, "--receipt", path.join(receipts, "app-notarize.receipt.json"), ...(profile ? ["--profile", profile] : []), "--app", app, zip]]);
+  }
+  if (!dryRun) mkdirSync(receipts, { recursive: true });
+  for (const [script, args] of calls) {
+    node(script, args);
+    if (dryRun && script === "__ditto__") continue;
+    const r = script === "__ditto__" ? run("/usr/bin/ditto", args, { encoding: "utf8" })
+      : run(process.execPath, [path.join(here, script), ...args], { encoding: "utf8" });
+    if (r.error || r.status !== 0) throw fail("MAC_APP_COMMAND_FAILED", `${script} failed: ${r.error?.message ?? r.stderr ?? r.stdout ?? r.status}`);
+    log({ event: "mac-app-step", script, ok: true });
+  }
+  return { plan, zip };
+}

package/swift-package-command.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// right-release swift-package <windows-stage|msix|mac-app|doctor> --config <swift-package.json> [options]
+//
+// One product config (schema 1) drives all three steps; paths resolve against the config file.
+// Build-only: nothing here uploads or publishes.
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { assembleMacApp, signAndNotarizeMacApp } from "./swift-mac-app.mjs";
+import { buildMsix } from "./msix-build.mjs";
+import { stageSwiftWindows } from "./swift-windows-stage.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+
+export function loadSwiftPackageConfig(file) {
+  const configPath = path.resolve(file ?? "");
+  if (!existsSync(configPath)) throw fail("SWIFT_PACKAGE_CONFIG", `config not found: ${configPath}`);
+  let config;
+  try { config = JSON.parse(readFileSync(configPath, "utf8")); } catch (e) { throw fail("SWIFT_PACKAGE_CONFIG", `invalid JSON: ${e.message}`); }
+  if (config.schema !== 1) throw fail("SWIFT_PACKAGE_CONFIG", "config.schema must be 1");
+  if (!config.name || !config.version) throw fail("SWIFT_PACKAGE_CONFIG", "config.name and config.version are required");
+  return { config, base: path.dirname(configPath) };
+}
+
+const rel = (base, value) => (value == null ? value : path.resolve(base, value));
+const relList = (base, list) => (list ?? []).map((v) => rel(base, v));
+
+export function windowsStageOptions({ config, base }) {
+  const w = config.windows;
+  if (!w?.exe || !w?.out) throw fail("SWIFT_PACKAGE_CONFIG", "windows.exe and windows.out are required");
+  return { exe: rel(base, w.exe), out: rel(base, w.stageDir ?? `${w.out}.stage`), searchDirs: relList(base, w.searchDirs),
+    include: relList(base, w.include), systemDlls: w.systemDlls, dependencies: w.dependencies, architecture: w.architecture };
+}
+
+export function msixOptions({ config, base }, staged) {
+  const w = config.windows;
+  const manifest = { name: w.packageName ?? config.name, version: w.msixVersion ?? `${config.version.replace(/^(\d+\.\d+\.\d+).*$/, "$1")}.0`,
+    architecture: staged.architecture, publisher: w.publisher, publisherDisplayName: w.publisherDisplayName,
+    displayName: config.displayName ?? config.name, description: config.description, executable: staged.exe,
+    dependencies: w.dependencies, capabilities: w.capabilities, minWindowsVersion: w.minWindowsVersion };
+  const assets = Object.fromEntries(Object.entries(w.assets ?? {}).map(([k, v]) => [k, rel(base, v)]));
+  return { manifest, assets, out: rel(base, w.out), stageDir: staged.out };
+}
+
+export function macOptions({ config, base }) {
+  const m = config.mac;
+  if (!m?.executable || !m?.bundleId || !m?.out) throw fail("SWIFT_PACKAGE_CONFIG", "mac.executable, mac.bundleId and mac.out are required");
+  return { executable: rel(base, m.executable), name: m.appName ?? config.displayName ?? config.name, displayName: config.displayName, bundleId: m.bundleId,
+    version: config.version, build: m.build, minimumSystemVersion: m.minimumSystemVersion, resources: relList(base, m.resources),
+    frameworks: relList(base, m.frameworks), iconFile: rel(base, m.iconFile), infoPlistExtra: m.infoPlist, out: rel(base, m.out) };
+}
+
+export async function main(argv, deps = {}) {
+  const [command, ...rest] = argv;
+  const flag = (name) => { const i = rest.indexOf(name); return i >= 0 ? rest[i + 1] : undefined; };
+  const has = (name) => rest.includes(name);
+  const log = deps.log ?? ((v) => console.log(JSON.stringify(v, null, 2)));
+  if (!["windows-stage", "msix", "mac-app"].includes(command)) {
+    throw fail("SWIFT_PACKAGE_USAGE", "usage: swift-package <windows-stage|msix|mac-app> --config <file> [--dry-run] [--no-sign] [--notarize]");
+  }
+  const loaded = loadSwiftPackageConfig(flag("--config"));
+  if (command === "windows-stage") return log(stageSwiftWindows(windowsStageOptions(loaded)));
+  if (command === "msix") {
+    const staged = stageSwiftWindows(windowsStageOptions(loaded));
+    const options = msixOptions(loaded, staged);
+    return log(buildMsix({ ...options, sign: !has("--no-sign"), dryRun: has("--dry-run") }, deps.msix));
+  }
+  const options = macOptions(loaded);
+  const assembled = assembleMacApp(options, deps.mac);
+  const out = { app: assembled.app, nested: assembled.nested };
+  if (has("--sign") || has("--notarize")) {
+    out.signing = signAndNotarizeMacApp({ app: assembled.app, nested: assembled.nested,
+      entitlements: rel(loaded.base, loaded.config.mac.entitlements), receiptDir: path.join(options.out, "receipts"),
+      notarize: has("--notarize"), profile: flag("--profile"), dryRun: has("--dry-run") }, deps.mac);
+  }
+  return log(out);
+}
+
+const self = (file) => { try { return path.resolve(file) === fileURLToPath(import.meta.url); } catch { return false; } };
+if (process.argv[1] && self(process.argv[1])) {
+  main(process.argv.slice(2)).catch((error) => {
+    console.error(`right-release swift-package: [${error.code ?? "SWIFT_PACKAGE_FAILED"}] ${error.message}`);
+    process.exitCode = error.code === "SWIFT_PACKAGE_USAGE" ? 2 : 1;
+  });
+}

package/swift-windows-stage.mjs

@@ -0,0 +1,103 @@
+// Stage a SwiftPM-built Windows app for packaging: copy the executable and every
+// app-local DLL it needs (transitively) into one flat directory, and fail closed
+// on any dependency that is neither staged, a Windows system DLL, nor provided by
+// a declared package dependency. Runs on any host (pure file + PE parsing).
+
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { readPeImports } from "./pe-imports.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+
+// Windows-owned DLLs present on every supported install. Anything else must ship.
+export const WINDOWS_SYSTEM_DLLS = Object.freeze([
+  "kernel32.dll", "kernelbase.dll", "ntdll.dll", "user32.dll", "gdi32.dll", "gdi32full.dll", "advapi32.dll", "shell32.dll",
+  "shlwapi.dll", "ole32.dll", "oleaut32.dll", "combase.dll", "rpcrt4.dll", "sechost.dll", "ws2_32.dll", "wsock32.dll",
+  "mswsock.dll", "iphlpapi.dll", "bcrypt.dll", "bcryptprimitives.dll", "ncrypt.dll", "crypt32.dll", "secur32.dll", "wintrust.dll",
+  "userenv.dll", "version.dll", "winmm.dll", "comctl32.dll", "comdlg32.dll", "imm32.dll", "uxtheme.dll", "dwmapi.dll",
+  "d2d1.dll", "d3d11.dll", "d3d12.dll", "dxgi.dll", "dwrite.dll", "dcomp.dll", "uiautomationcore.dll", "propsys.dll",
+  "msctf.dll", "setupapi.dll", "cfgmgr32.dll", "shcore.dll", "powrprof.dll", "psapi.dll", "dbghelp.dll", "wldap32.dll",
+  "normaliz.dll", "netapi32.dll", "winhttp.dll", "wininet.dll", "ucrtbase.dll", "msvcrt.dll", "oleacc.dll", "avrt.dll",
+  "mf.dll", "mfplat.dll", "dnsapi.dll", "wtsapi32.dll", "winspool.drv", "ntmarta.dll", "dxcore.dll", "windows.ui.dll", "cabinet.dll",
+]);
+
+const isApiSet = (name) => /^(api|ext)-ms-win-[a-z0-9-]+-l\d+-\d+-\d+\.dll$/.test(name);
+const lower = (value) => String(value).toLowerCase();
+const isPe = (file) => /\.(exe|dll)$/i.test(file);
+const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+function findInDirs(name, dirs) {
+  for (const dir of dirs) {
+    if (!existsSync(dir)) continue;
+    const match = readdirSync(dir).find((entry) => lower(entry) === lower(name));
+    if (match) return path.join(dir, match);
+  }
+  return null;
+}
+
+/**
+ * options: { exe, out, searchDirs[], include[] (extra files copied verbatim),
+ *   systemDlls[] (extra allowed), dependencies[{ name, provides[] }], architecture }
+ * Returns a manifest; throws SWIFT_STAGE_UNRESOLVED listing every missing DLL.
+ */
+export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], systemDlls = [], dependencies = [], architecture, clean = true } = {}) {
+  if (!exe || !out) throw fail("SWIFT_STAGE_OPTIONS", "exe and out are required");
+  exe = path.resolve(exe); out = path.resolve(out);
+  if (!/\.exe$/i.test(exe) || !existsSync(exe) || !statSync(exe).isFile()) throw fail("SWIFT_STAGE_OPTIONS", `exe must be an existing .exe: ${exe}`);
+  const dirs = [path.dirname(exe), ...searchDirs.map((dir) => path.resolve(dir))];
+  const system = new Set([...WINDOWS_SYSTEM_DLLS, ...systemDlls].map(lower));
+  const provided = new Map();
+  for (const dep of dependencies) for (const dll of dep.provides ?? []) provided.set(lower(dll), dep.name);
+  if (clean) rmSync(out, { recursive: true, force: true });
+  mkdirSync(out, { recursive: true });
+
+  const staged = new Map(); // lower name -> { file(source), name }
+  const queue = [{ name: path.basename(exe), source: exe, from: "<root>" }];
+  const missing = new Map(); // lower name -> importers
+  const seenSystem = new Set(), seenProvided = new Map();
+  let arch = architecture;
+  const extra = include.map((file) => path.resolve(file));
+  for (const file of extra) {
+    if (!existsSync(file) || !statSync(file).isFile()) throw fail("SWIFT_STAGE_OPTIONS", `include file missing: ${file}`);
+    queue.push({ name: path.basename(file), source: file, from: "<include>" });
+  }
+  while (queue.length) {
+    const item = queue.shift();
+    const key = lower(item.name);
+    if (staged.has(key)) continue;
+    staged.set(key, item);
+    if (!isPe(item.name)) continue;
+    const info = readPeImports(readFileSync(item.source));
+    if (!["x64", "arm64"].includes(info.architecture)) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture}; only x64 and arm64 are supported`);
+    arch ??= info.architecture;
+    if (info.architecture !== arch) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture} but package architecture is ${arch}`);
+    for (const dep of [...info.imports, ...info.delayImports]) {
+      const dk = lower(dep);
+      if (staged.has(dk)) continue;
+      const found = findInDirs(dep, dirs);
+      if (found) { queue.push({ name: path.basename(found), source: found, from: item.name }); continue; }
+      if (isApiSet(dk) || system.has(dk)) { seenSystem.add(dk); continue; }
+      if (provided.has(dk)) { seenProvided.set(dk, provided.get(dk)); continue; }
+      if (!missing.has(dk)) missing.set(dk, new Set());
+      missing.get(dk).add(item.name);
+    }
+  }
+  if (missing.size) {
+    const detail = [...missing].map(([dll, by]) => `${dll} (needed by ${[...by].join(", ")})`).join("; ");
+    throw fail("SWIFT_STAGE_UNRESOLVED", `unresolved DLL dependencies: ${detail}. Add the directory to searchDirs, stage it via include, or declare a package dependency that provides it`);
+  }
+  const files = [];
+  for (const [, item] of [...staged].sort(([a], [b]) => a.localeCompare(b))) {
+    const target = path.join(out, item.name);
+    copyFileSync(item.source, target);
+    files.push({ name: item.name, source: item.source, sha256: sha256(target), sizeBytes: statSync(target).size, requiredBy: item.from, pe: isPe(item.name) });
+  }
+  const manifest = {
+    schema: 1, architecture: arch, exe: path.basename(exe), out, files,
+    systemDlls: [...seenSystem].sort(),
+    providedByDependencies: Object.fromEntries([...seenProvided].sort()),
+  };
+  writeFileSync(`${out}.stage.json`, `${JSON.stringify(manifest, null, 2)}\n`);
+  return manifest;
+}