@rightkit/release 0.2.138 → 0.2.139

package/README.md

@@ -56,6 +56,16 @@ pnpm add -D @rightkit/release
 pnpm exec right-release deps --check
 ```
 
+## MSIX target and Swift app type
+
+Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (config or target; auto-detected from a `Package.swift` with no Cargo manifest) replaces the cargo/rustc requirement with `swift`, and skips the Rust target-bridge, sccache and Perl checks. Tauri/Rust targets are unchanged. `makeappx` and `signtool` are required only when `targets.win.msix` is configured.
+
+`targets.win` with `signingContract: "windows-msix-signed-v1"` packages an MSIX (schema in `msix-config.mjs`): `prePackage` builds and stages a flat payload (`right-release swift-package windows-stage`), then the msix step runs in the immutable order: verify the declared runtime-DLL inventory and PE import closure (fails closed), sign inner DLLs then EXEs through `sign-windows`, `makeappx pack`, sign the `.msix`, verify the signature and that the signer subject equals `Identity/@Publisher`, write the App Installer route, and write `msix-seal.json`. `msix.virtualization.fileSystemWrite|registryWrite` (`enabled|disabled`) are mandatory and emitted as `desktop6` manifest properties. List the `.msix` under `installer.artifacts` so it seals.
+
+`updater.kind: "appinstaller"` (default remains the Tauri minisign flow) generates `msix.appInstaller.out` (https `uri`/`msixUri`); trust is the MSIX Authenticode signature, so no `.sig` is produced and `publish-update` records the sealed package digest.
+
+macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
+
 ## Known issues
 
 - `smol-toml` is pinned exactly. A consumer that adds another `smol-toml` gets a second copy (npm audit 2026-10-08, release finding).

package/build-release.mjs

@@ -33,6 +33,8 @@ import { brokerManagedHost } from "./cargo-contract.mjs";
 import { resolveReleaseCacheMode } from "./release-cache-mode.mjs";
 import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
+import { collectSwiftToolVersions, planSwiftBuild } from "./swift-build-context.mjs";
+import { packageCommandOptional, requiredBuildExecutables, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, summarizePreBrokerWaits, terminateProcessTree } from "./heavy-command.mjs";
@@ -46,14 +48,14 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // Cached target directories must not outlive changes to these signing helpers.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs", "msix-build.mjs", "msix-plan.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")
   .slice(0, 16);
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
-function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout }) {
+function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
@@ -71,6 +73,8 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     // reject a legitimate resume of an in-flight build.
     version: undefined,
     cargoLockPaths: nativeLayout?.lockCandidates ?? [],
+    projectType: resolveProjectType({ appRoot, config, target }),
+    msix: targetUsesMsix(target),
   });
 }
 
@@ -124,7 +128,7 @@ if (dryRun) {
   const config = (await import(`${pathToFileURL(configPath).href}?dry-run=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   const target = config.targets?.[platform];
-  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  if (!target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
   console.log(`right-release build dry-run: ${config.app} ${config.version} ${platform}`);
   console.log(`config: ${configPath}`);
   console.log(`commit: ${commit}`);
@@ -163,7 +167,8 @@ try {
     fail("app and version must be safe release-id components");
   }
   const target = config.targets?.[platform];
-  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  if (!target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
+  const isSwiftBuild = resolveProjectType({ appRoot, config, target }) === "swiftpm";
   const nativeLayout = resolveNativeCargoLayout({ appRoot, config });
   if (platform === "win" && target.signingContract === "windows-raw-exe-authenticode-before-nsis-v1") {
     assertNsisInPlaceUpgradeContract(appRoot, target.nsisUpgradeContract);
@@ -171,7 +176,7 @@ try {
   const { requiredInputs, buildInputs } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
   const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
-  const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
+  const toolVersions = isSwiftBuild ? collectSwiftToolVersions({ packageManager: config.packageManager, exec: commandOutput }) : collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
   const platformDir = platform === "win" ? "windows" : "mac";
@@ -208,10 +213,12 @@ try {
   // shells take the Cache V2 branch, bridge resolved native target into release cache,
   // and then lose CARGO_TARGET_DIR to the broker's unconditional override — so the
   // app bundle landed in the broker workspace and packaging failed on an empty cache.
-  const managedCargoTarget = brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
-  const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
+  const swiftPlan = isSwiftBuild ? planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions }) : null;
+  // SwiftPM targets have no Cargo manifest: no broker cargo target, no Rust cache identity.
+  const managedCargoTarget = swiftPlan ? swiftPlan.managedCargoTarget : brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
+  const cacheIdentity = swiftPlan ? swiftPlan.identity : resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
-  const cacheModeRequested = resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
+  const cacheModeRequested = swiftPlan ? swiftPlan.cacheMode : resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
   // On a broker-managed host, Cache V2's lease/slot/prune/floor/mark chain is not
   // running against the directory that will actually hold build output — the
   // broker owns CARGO_TARGET_DIR unconditionally (see managedCargoTarget above).
@@ -233,7 +240,7 @@ try {
   // Preflight BEFORE any compile. These preconditions used to be discovered one
   // per build cycle, minutes deep, with errors that named a symptom instead of a
   // cause. Blocking problems stop here, in seconds, naming the fix.
-  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout });
+  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target });
   const preflightBlockers = preflightFailures(preflight);
   if (preflightBlockers.length > 0) {
     fail(`preflight found ${preflightBlockers.length} blocking problem(s):\n${formatPreflight(preflightBlockers)}`);
@@ -252,7 +259,7 @@ try {
   // resolves to MSYS Perl, which cannot configure OpenSSL. Put the real Windows
   // Perl first so the build behaves the same from any shell.
   const pathPrefix = buildPathPrefix({ platform });
-  const env = macosCodesignEnvironment({
+  const baseEnv = macosCodesignEnvironment({
     ...heavyCommandEnvironment(process.env),
     ...releaseEnvironment({ root: vaultRoot, cacheRoot: sharedCacheRoot, platform, architecture: cacheIdentity.architecture, app: config.app, cacheKey, kind: "release", appRoot, mode: cacheMode }),
     ...(pathPrefix ? { PATH: `${pathPrefix}${path.delimiter}${process.env.PATH ?? ""}` } : {}),
@@ -261,6 +268,7 @@ try {
     RIGHTKIT_MANAGED_ROOT: resolveManagedRoot({ env: process.env }),
     RIGHT_RELEASE_ARTIFACT_DIR: resolveArtifactDir({ app: config.app, version: config.version, managedRoot: resolveManagedRoot({ env: process.env }) }),
   });
+  const env = swiftPlan ? swiftPlan.sanitizeEnv(baseEnv) : baseEnv;
   if (managedCargoTarget) {
     for (const name of ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"]) {
       delete env[name];
@@ -302,7 +310,7 @@ try {
   // ownedRoot is the per-app cache parent holding every fingerprint dir, so a
   // link left by an earlier fingerprint is recognised as ours and repointed
   // instead of hard-stopping the build.
-  const targetBridge = createTargetBridge({
+  const targetBridge = swiftPlan ? swiftPlan.targetBridge : createTargetBridge({
     link: targetLink,
     target: managedCargoTarget ?? env.CARGO_TARGET_DIR,
     ownedRoot: path.dirname(managedCargoTarget ?? env.CARGO_TARGET_DIR),
@@ -329,7 +337,7 @@ try {
           const volumes = inspectWriteVolumes({ repoRoot, vaultRoot, cacheRoot: sharedCacheRoot });
           assertWriteVolumeFloors({ volumes, policy, configuredRepoMinimumBytes: Math.max(Number(target.preflight?.minFreeGb ?? 25), 25) * 1024 ** 3 });
         } else assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
-        assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
+        assertExecutables([...requiredBuildExecutables({ projectType: resolveProjectType({ appRoot, config, target }), packageManager: config.packageManager ?? "pnpm", usesPackageManager: Boolean(config.packageManager) || existsSync(path.join(appRoot, "package.json")) }), ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
         for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
         if (buildRoot) mkdirSync(buildRoot, { recursive: true });
@@ -341,7 +349,7 @@ try {
       },
       prepare: async () => {
         throwIfInterrupted();
-        const cacheTarget = managedCargoTarget ?? env.CARGO_TARGET_DIR;
+        const cacheTarget = swiftPlan ? swiftPlan.buildDir : managedCargoTarget ?? env.CARGO_TARGET_DIR;
         mkdirSync(cacheTarget, { recursive: true });
         // Broker-managed hosts route through the same target bridge as shared
         // mode even though cacheMode is forced to "broker" above: the naive
@@ -349,12 +357,13 @@ try {
         // directory, which is exactly the "corruption" misreading that nearly
         // cost ~5.9 GB of warm broker intermediates. The bridge's brokerManaged
         // flag already knows to leave a real directory untouched instead.
-        if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
+        if (swiftPlan) { /* SwiftPM: no Rust target link */ }
+        else if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
         else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
-        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
+        if (resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },
       build: async () => {
         throwIfInterrupted();
@@ -363,9 +372,9 @@ try {
           [WORKER, "--config", configPath, "--platform", platform, "--no-upload", "--resume", ...(resumeFrom ? ["--resume-from", resumeFrom] : []), ...(skipChecks ? ["--skip-checks"] : [])],
           appRoot,
           env,
-          [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          swiftPlan ? swiftPlan.watchDirs : [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
           path.join(stateRoot, "stall-build.log"),
-          { livenessOwnerTimeoutMs: target.package.livenessOwnerTimeoutMs ?? null },
+          { livenessOwnerTimeoutMs: target.package?.livenessOwnerTimeoutMs ?? null },
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -461,7 +470,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
     addSource(resolveArtifactPath(artifact.file), "updater");
-    addSource(resolveArtifactPath(artifact.signature), "updater-signature");
+    if (target.updater?.kind !== "appinstaller") addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
@@ -485,10 +494,10 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   }
   for (const artifact of target.updater?.artifacts ?? []) {
     const source = resolveArtifactPath(artifact.file);
-    const signatureSource = resolveArtifactPath(artifact.signature);
+    const signatureSource = target.updater?.kind === "appinstaller" ? null : resolveArtifactPath(artifact.signature);
     const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
-    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "public", key: patchKey, platform: artifact.platform });
-    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "private", key: artifact.key, platform: artifact.platform });
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "private", key: artifact.key, platform: artifact.platform });
   }
   writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
   const manifest = {

package/cache-policy.mjs

@@ -518,3 +518,17 @@ function isAbsoluteForPlatform(value) { return isWindowsAbsolute(value) || path.
 function resolveForPlatform(value) { return isWindowsAbsolute(value) ? path.win32.resolve(value) : path.posix.resolve(value); }
 function readRustcVerbose() { const result = spawnSync("rustc", ["-vV"], { encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`rustc -vV failed: ${(result.stderr || result.error?.message || `exit ${result.status}`).trim()}`); return result.stdout.trim(); }
 function cargoNativeFeatures(cargoTomlPath) { if (!cargoTomlPath || !existsSync(cargoTomlPath)) return []; return [...readFileSync(cargoTomlPath, "utf8").matchAll(/features\s*=\s*\[([^\]]+)\]/g)].flatMap((match) => match[1].match(/"([^"]+)"/g) ?? []).map((value) => value.slice(1, -1)).filter((value) => /sqlcipher|openssl/i.test(value)); }
+
+/**
+ * SwiftPM counterpart of resolveSharedCacheIdentity: identity is the Swift toolchain, Package.resolved
+ * (dependency pins; absent for dependency-free packages), target architecture and profile. No Rust inputs.
+ */
+export function resolveSwiftCacheIdentity({ swiftVersion, packageResolvedPath, architecture, profile = "release" } = {}) {
+  if (!swiftVersion || !String(swiftVersion).trim()) throw new Error("swift --version did not report a toolchain");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(architecture ?? "")) throw new Error("invalid Swift target architecture");
+  const resolved = packageResolvedPath && existsSync(packageResolvedPath) ? readFileSync(packageResolvedPath, "utf8").replace(/\r\n?/g, "\n") : null;
+  const packageResolvedSha256 = resolved === null ? "none" : sha256(resolved);
+  const swift = String(swiftVersion).trim();
+  return { projectType: "swiftpm", packageResolvedSha256, swift, target: architecture, architecture, profile, features: [],
+    fingerprint: sha256(JSON.stringify({ projectType: "swiftpm", packageResolvedSha256, swift, architecture, profile })).slice(0, 16) };
+}

package/managed-cargo.mjs

@@ -56,7 +56,10 @@ export function runCargoSync(args, options = {}, { platform = process.platform,
     }
     return result;
   }
-  if (platform === 'darwin' || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
+  // The Mac never falls back to direct Cargo, except on GitHub Actions runners, which have no
+  // RightKit runtime and use the toolchain's cargo (release-candidate signing jobs).
+  const hostedCi = env.GITHUB_ACTIONS === 'true' && !managedHost(env);
+  if ((platform === 'darwin' && !hostedCi) || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
   return spawn("cargo", args, options);
 }
 

package/msix-appinstaller.mjs

@@ -0,0 +1,24 @@
+// App Installer (.appinstaller) update route for MSIX packages. Trust comes from the
+// MSIX Authenticode signature (publisher must match the manifest); no separate updater key.
+
+const xml = (value) => String(value).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+const fail = (message) => Object.assign(new Error(message), { code: "APPINSTALLER_INVALID" });
+
+export function generateAppInstaller(o) {
+  const errors = [];
+  for (const key of ["uri", "msixUri"]) { try { if (new URL(o[key]).protocol !== "https:") throw 0; } catch { errors.push(`${key} must be an https URL`); } }
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(o.version ?? "")) errors.push("version must be four numeric parts");
+  if (!["x64", "arm64"].includes(o.architecture)) errors.push("architecture must be x64 or arm64");
+  if (!o.name || !o.publisher) errors.push("name and publisher are required");
+  const hours = o.hoursBetweenUpdateChecks ?? 24;
+  if (!Number.isInteger(hours) || hours < 0 || hours > 255) errors.push("hoursBetweenUpdateChecks must be an integer 0-255");
+  if (errors.length) throw fail(errors.join("; "));
+  return `<?xml version="1.0" encoding="utf-8"?>
+<AppInstaller xmlns="http://schemas.microsoft.com/appx/appinstaller/2018" Version="${xml(o.version)}" Uri="${xml(o.uri)}">
+  <MainPackage Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" Uri="${xml(o.msixUri)}" />
+  <UpdateSettings>
+    <OnLaunch HoursBetweenUpdateChecks="${hours}" ShowPrompt="${o.showPrompt ? "true" : "false"}" UpdateBlocksActivation="${o.updateBlocksActivation ? "true" : "false"}" />
+  </UpdateSettings>
+</AppInstaller>
+`;
+}

package/msix-build.mjs

@@ -9,6 +9,9 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { findWindowsSdkTool } from "./preflight.mjs";
+import { generateAppInstaller } from "./msix-appinstaller.mjs";
+import { assertPublisherMatchesSigner, planMsixSigning, verifyPayloadInventory } from "./msix-plan.mjs";
+import { createHash } from "node:crypto";
 
 const fail = (code, message) => Object.assign(new Error(message), { code });
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -33,17 +36,25 @@ export function generateAppxManifest(o) {
   validateMsixIdentity(o);
   const deps = (o.dependencies ?? []).filter((d) => d.minVersion).map((d) =>
     `    <PackageDependency Name="${xml(d.name)}" MinVersion="${xml(d.minVersion)}" Publisher="${xml(d.publisher ?? "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")}" />`);
-  const a = o.assets ?? {};
+  const v = o.virtualization;
+  for (const key of ["fileSystemWrite", "registryWrite"]) {
+    if (v?.[key] !== undefined && !["enabled", "disabled"].includes(v[key])) throw fail("MSIX_INVALID_IDENTITY", `virtualization.${key} must be "enabled" or "disabled"`);
+  }
+  const virt = v ? [["fileSystemWrite", "FileSystemWriteVirtualization"], ["registryWrite", "RegistryWriteVirtualization"]]
+    .filter(([k]) => v[k]).map(([k, el]) => `\n    <desktop6:${el}>${v[k]}</desktop6:${el}>`).join("") : "";
+  // Opting out of virtualization is a restricted capability.
+  const unvirtualized = v && (v.fileSystemWrite === "disabled" || v.registryWrite === "disabled") ? '\n    <rescap:Capability Name="unvirtualizedResources" />' : "";
   return `<?xml version="1.0" encoding="utf-8"?>
 <Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
          xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
          xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+         xmlns:desktop6="http://schemas.microsoft.com/appx/manifest/desktop/windows10/6"
          IgnorableNamespaces="uap rescap">
   <Identity Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" />
   <Properties>
     <DisplayName>${xml(o.displayName)}</DisplayName>
     <PublisherDisplayName>${xml(o.publisherDisplayName)}</PublisherDisplayName>
-    <Logo>Assets\\StoreLogo.png</Logo>
+    <Logo>Assets\\StoreLogo.png</Logo>${virt}
   </Properties>
   <Dependencies>
     <TargetDeviceFamily Name="Windows.Desktop" MinVersion="${xml(o.minWindowsVersion ?? "10.0.19041.0")}" MaxVersionTested="${xml(o.maxWindowsVersionTested ?? "10.0.26100.0")}" />
@@ -56,7 +67,7 @@ ${deps.join("\n")}${deps.length ? "\n" : ""}  </Dependencies>
     </Application>
   </Applications>
   <Capabilities>
-    <rescap:Capability Name="runFullTrust" />${(o.capabilities ?? []).map((c) => `\n    <Capability Name="${xml(c)}" />`).join("")}
+    <rescap:Capability Name="runFullTrust" />${unvirtualized}${(o.capabilities ?? []).map((c) => `\n    <Capability Name="${xml(c)}" />`).join("")}
   </Capabilities>
 </Package>
 `;
@@ -89,19 +100,30 @@ export function peFilesIn(root) {
   return readdirSync(root).filter((name) => /\.(exe|dll)$/i.test(name)).sort().map((name) => path.join(root, name));
 }
 
+const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+function readSignerSubject(file, run) {
+  const r = run("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${file.replace(/'/g, "''")}').SignerCertificate.Subject`], { encoding: "utf8", windowsHide: true });
+  return r.status === 0 ? String(r.stdout ?? "").trim() : "";
+}
+
 /**
- * Pack + sign. `run` is injectable for tests. Steps:
- *  1 sign every PE file in the root (raw bytes), 2 makeappx pack, 3 sign the .msix, 4 verify.
- * Windows-only unless dryRun.
+ * Pack + sign. `run` is injectable for tests. Ordered per planMsixSigning():
+ *  assemble, verify-inventory, sign-pe (DLLs then EXEs, raw bytes), pack, sign-msix, verify-msix,
+ *  verify-publisher, appinstaller, seal. Windows-only unless dryRun.
+ * options.runtime = { dlls, systemDlls, dependencies } (declared inventory, verified fail-closed);
+ * options.appInstaller = { uri, msixUri, out, ... } generates the update route after the package is signed.
  */
-export function buildMsix({ stageDir, out, workDir, manifest, assets, sign = true, dryRun = false, receiptDir },
-  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)) } = {}) {
+export function buildMsix({ stageDir, out, workDir, manifest, assets, runtime, appInstaller, sign = true, dryRun = false, receiptDir, peReceipt, msixReceipt },
+  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)), readSubject = (file) => readSignerSubject(file, run) } = {}) {
   out = path.resolve(out);
   if (!out.endsWith(".msix")) throw fail("MSIX_INVALID_OPTIONS", "out must end with .msix");
   validateMsixIdentity(manifest);
   workDir = path.resolve(workDir ?? `${out}.root`);
   const receipts = path.resolve(receiptDir ?? path.dirname(out));
-  const steps = ["assemble", ...(sign ? ["sign-pe"] : []), "pack", ...(sign ? ["sign-msix", "verify-msix"] : [])];
+  const planFor = (files) => planMsixSigning({ files, sign, appInstaller: Boolean(appInstaller) });
+  const staged = existsSync(path.resolve(stageDir)) ? readdirSync(path.resolve(stageDir)) : [];
+  const steps = planFor(staged.filter((n) => /\.(exe|dll)$/i.test(n))).map((p) => p.step);
   if (dryRun) { log({ event: "msix-dry-run", out, steps }); return { out, steps, dryRun: true }; }
   if (platform !== "win32") throw fail("MSIX_NATIVE_HOST_REQUIRED", "MSIX packing and signing must run on Windows");
   const makeappx = env.MAKEAPPX_PATH || findTool("makeappx.exe")?.toolPath;
@@ -113,16 +135,30 @@ export function buildMsix({ stageDir, out, workDir, manifest, assets, sign = tru
   };
   const signer = (files, receipt) => checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--receipt", receipt, ...files]);
   const root = assembleMsixRoot({ stageDir, root: workDir, manifest, assets });
+  const inventory = runtime ? verifyPayloadInventory({ root, inventory: runtime, architecture: manifest.architecture }) : null;
   mkdirSync(receipts, { recursive: true });
-  if (sign) signer(peFilesIn(root), path.join(receipts, "msix-pe-sign.receipt.json"));
+  const ordered = planFor(readdirSync(root).filter((n) => /\.(exe|dll)$/i.test(n))).find((p) => p.step === "sign-pe")?.files ?? [];
+  if (sign) signer(ordered.map((f) => path.join(root, path.basename(f))), peReceipt ?? path.join(receipts, "msix-pe-sign.receipt.json"));
   mkdirSync(path.dirname(out), { recursive: true });
   rmSync(out, { force: true });
   checked(makeappx, ["pack", "/d", root, "/p", out, "/o"]);
   if (!existsSync(out) || statSync(out).size === 0) throw fail("MSIX_PACK_EMPTY", `makeappx produced no package: ${out}`);
   if (sign) {
-    signer([out], path.join(receipts, "msix-sign.receipt.json"));
+    signer([out], msixReceipt ?? path.join(receipts, "msix-sign.receipt.json"));
     checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--verify-only", out]);
+    assertPublisherMatchesSigner(manifest.publisher, readSubject(out));
+  }
+  let appInstallerFile = null;
+  if (appInstaller) {
+    appInstallerFile = path.resolve(appInstaller.out);
+    mkdirSync(path.dirname(appInstallerFile), { recursive: true });
+    writeFileSync(appInstallerFile, generateAppInstaller({ ...appInstaller, name: manifest.name, publisher: manifest.publisher, version: manifest.version, architecture: manifest.architecture }));
   }
+  const seal = { schema: 1, msix: { file: out, sha256: sha256(out), sizeBytes: statSync(out).size }, signed: sign, identity: { name: manifest.name, version: manifest.version, publisher: manifest.publisher, architecture: manifest.architecture },
+    payload: readdirSync(root, { recursive: true }).map((n) => String(n).split(path.sep).join("/")).filter((n) => statSync(path.join(root, n)).isFile()).sort().map((n) => ({ name: n, sha256: sha256(path.join(root, n)) })), inventory,
+    appInstaller: appInstallerFile && { file: appInstallerFile, sha256: sha256(appInstallerFile) } };
+  const sealFile = path.join(receipts, "msix-seal.json");
+  writeFileSync(sealFile, `${JSON.stringify(seal, null, 2)}\n`);
   log({ event: "msix-built", out, signed: sign });
-  return { out, steps, root, signed: sign };
+  return { out, steps, root, signed: sign, seal: sealFile, appInstaller: appInstallerFile };
 }

package/msix-config.mjs

@@ -0,0 +1,70 @@
+// `msix` target schema for right-release configs (targets.win.msix) and the
+// `windows-msix-signed-v1` signing contract. Pure validation; no I/O.
+//
+// targets.win = {
+//   signed: true, signingContract: "windows-msix-signed-v1",
+//   projectType: "swiftpm",                      // optional; auto-detected from Package.swift
+//   prePackage: { cmd, args },                   // SwiftPM build + stage (swift-package windows-stage)
+//   msix: {
+//     stageDir, out,                             // flat payload dir produced by prePackage; .msix path
+//     identity: { name, publisher, publisherDisplayName, displayName, description?, version, architecture, executable },
+//     capabilities: ["internetClient"], minWindowsVersion?, maxWindowsVersionTested?,
+//     virtualization: { fileSystemWrite: "enabled|disabled", registryWrite: "enabled|disabled" },  // explicit, required
+//     assets: { storeLogo, square150, square44 },
+//     runtime: { dlls: ["swiftCore.dll", ...], systemDlls?: [], dependencies?: [{ name, minVersion, provides: [] }] },
+//     appInstaller?: { uri, msixUri, out, hoursBetweenUpdateChecks?, showPrompt?, updateBlocksActivation? },
+//   },
+//   updater?: { kind: "tauri" | "appinstaller", artifacts: [...] },   // tauri stays the default
+//   installer: { artifacts: [{ file: "<out>.msix", key }] },
+// }
+
+export const MSIX_SIGNING_CONTRACT = "windows-msix-signed-v1";
+export const UPDATER_KINDS = Object.freeze(["tauri", "appinstaller"]);
+export const VIRTUALIZATION_VALUES = Object.freeze(["enabled", "disabled"]);
+
+export const isMsixTarget = (target) => target?.signingContract === MSIX_SIGNING_CONTRACT;
+export const updaterKind = (target) => target?.updater?.kind ?? "tauri";
+
+const isHttps = (value) => { try { return new URL(value).protocol === "https:"; } catch { return false; } };
+
+/** Returns an array of human-readable problems (empty when valid). */
+export function validateMsixTarget(target, app = "app") {
+  const e = [];
+  const at = (message) => e.push(`${app} win msix: ${message}`);
+  if (!isMsixTarget(target)) at(`signingContract must be ${MSIX_SIGNING_CONTRACT}`);
+  const m = target?.msix;
+  if (!m || typeof m !== "object") { at("msix block is required"); return e; }
+  if (!target.prePackage?.cmd) at("prePackage is required (SwiftPM build + payload staging)");
+  if (target.sign?.prePackageFiles?.length || target.sign?.files?.length) at("omit sign.prePackageFiles/sign.files: the msix step signs payload PE files, then the package");
+  if (!m.stageDir) at("msix.stageDir is required");
+  if (!/\.msix$/i.test(m.out ?? "")) at("msix.out must end with .msix");
+  const id = m.identity ?? {};
+  for (const key of ["name", "publisher", "publisherDisplayName", "displayName", "version", "architecture", "executable"]) if (!id[key]) at(`msix.identity.${key} is required`);
+  const v = m.virtualization ?? {};
+  for (const key of ["fileSystemWrite", "registryWrite"]) {
+    if (!VIRTUALIZATION_VALUES.includes(v[key])) at(`msix.virtualization.${key} must be explicitly "enabled" or "disabled"`);
+  }
+  for (const key of ["storeLogo", "square150", "square44"]) if (!m.assets?.[key]) at(`msix.assets.${key} (PNG) is required`);
+  const dlls = m.runtime?.dlls;
+  if (!Array.isArray(dlls)) at("msix.runtime.dlls (explicit runtime dependency inventory; use [] only for a dependency-free app) is required");
+  else if (dlls.some((d) => !/\.dll$/i.test(d) || /[\\/]/.test(d))) at("msix.runtime.dlls entries must be flat .dll names");
+  const kind = updaterKind(target);
+  if (!UPDATER_KINDS.includes(kind)) at(`updater.kind must be one of ${UPDATER_KINDS.join(", ")}`);
+  if (kind === "appinstaller") {
+    const a = m.appInstaller;
+    if (!a) at("updater.kind appinstaller requires msix.appInstaller");
+    else {
+      if (!isHttps(a.uri)) at("msix.appInstaller.uri must be an https URL");
+      if (!isHttps(a.msixUri)) at("msix.appInstaller.msixUri must be an https URL");
+      if (!/\.appinstaller$/i.test(a.out ?? "")) at("msix.appInstaller.out must end with .appinstaller");
+    }
+  }
+  const outName = String(m.out ?? "").split(/[\\/]/).pop();
+  if (outName && !(target.installer?.artifacts ?? []).some((a) => String(a.file).split(/[\\/]/).pop() === outName)) at("installer.artifacts must list the .msix so it is sealed");
+  return e;
+}
+
+export function assertValidMsixTarget(target, app) {
+  const errors = validateMsixTarget(target, app);
+  if (errors.length) throw Object.assign(new Error(errors.join("; ")), { code: "MSIX_CONFIG_INVALID" });
+}

package/msix-plan.mjs

@@ -0,0 +1,68 @@
+// Pure planning/verification helpers for MSIX packaging: signing order, runtime
+// dependency inventory, publisher/signer match. No signing, no process spawns.
+
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { readPeImports } from "./pe-imports.mjs";
+import { WINDOWS_SYSTEM_DLLS } from "./swift-windows-stage.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const lower = (v) => String(v).toLowerCase();
+const isApiSet = (name) => /^(api|ext)-ms-win-[a-z0-9-]+-l\d+-\d+-\d+\.dll$/.test(name);
+
+/**
+ * Immutable ordering (docs/rules/release-signing.md): inner PE files (DLLs, then EXEs) are signed
+ * before packing, the package is signed after, verification follows, then seal. Returns step list.
+ */
+export function planMsixSigning({ files, sign = true, appInstaller = false }) {
+  const pe = files.filter((f) => /\.(dll|exe)$/i.test(f));
+  const rank = (f) => (/\.dll$/i.test(f) ? 0 : 1);
+  const ordered = [...pe].sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+  return [
+    { step: "assemble" },
+    { step: "verify-inventory" },
+    ...(sign ? [{ step: "sign-pe", files: ordered }] : []),
+    { step: "pack" },
+    ...(sign ? [{ step: "sign-msix" }, { step: "verify-msix" }, { step: "verify-publisher" }] : []),
+    ...(appInstaller ? [{ step: "appinstaller" }] : []),
+    { step: "seal" },
+  ];
+}
+
+/**
+ * Fail closed unless (a) every DLL in the declared inventory is in the payload and (b) every PE in the
+ * payload imports only payload files, Windows system DLLs/API sets, or DLLs provided by a declared
+ * package dependency. Equivalent to `dumpbin /dependents` closure, but host independent.
+ */
+export function verifyPayloadInventory({ root, inventory = {}, architecture }) {
+  const names = readdirSync(root);
+  const present = new Set(names.map(lower));
+  const problems = [];
+  for (const dll of inventory.dlls ?? []) if (!present.has(lower(dll))) problems.push(`declared runtime DLL missing from payload: ${dll}`);
+  const system = new Set([...WINDOWS_SYSTEM_DLLS, ...(inventory.systemDlls ?? [])].map(lower));
+  const provided = new Set((inventory.dependencies ?? []).flatMap((d) => d.provides ?? []).map(lower));
+  const observed = new Set();
+  for (const name of names.filter((n) => /\.(exe|dll)$/i.test(n))) {
+    const info = readPeImports(readFileSync(path.join(root, name)));
+    if (architecture && info.architecture !== architecture) problems.push(`${name} is ${info.architecture}, package is ${architecture}`);
+    for (const dep of [...info.imports, ...info.delayImports]) {
+      const key = lower(dep);
+      observed.add(key);
+      if (!present.has(key) && !system.has(key) && !isApiSet(key) && !provided.has(key)) problems.push(`${name} imports ${dep}, which is neither in the payload, a system DLL, nor provided by a declared dependency`);
+    }
+  }
+  // Declared-but-never-imported DLLs are reported (not fatal): they may be loaded dynamically.
+  const unreferenced = (inventory.dlls ?? []).filter((d) => !observed.has(lower(d)));
+  if (problems.length) throw fail("MSIX_INVENTORY_INCOMPLETE", problems.join("; "));
+  return { dlls: [...(inventory.dlls ?? [])], unreferenced };
+}
+
+const normalizeDn = (dn) => String(dn).split(/,(?=\s*[A-Za-z]+=)/).map((p) => p.trim().replace(/\s*=\s*/, "=")).sort().join(",");
+
+/** The package signer's certificate subject must equal Identity/@Publisher or Windows refuses to install. */
+export function assertPublisherMatchesSigner(publisher, signerSubject) {
+  if (!signerSubject) throw fail("MSIX_PUBLISHER_MISMATCH", "could not read the signer certificate subject from the signed package");
+  if (normalizeDn(publisher) !== normalizeDn(signerSubject)) {
+    throw fail("MSIX_PUBLISHER_MISMATCH", `manifest Publisher "${publisher}" does not equal signer subject "${signerSubject}"; set identity.publisher to the signer subject`);
+  }
+}

package/msix-target.mjs

@@ -0,0 +1,28 @@
+// Map a validated targets.win.msix config block onto buildMsix() options.
+import path from "node:path";
+import { assertValidMsixTarget, updaterKind } from "./msix-config.mjs";
+
+export function msixBuildOptions({ root, target, app, sign = true, dryRun = false, receipts = {} }) {
+  assertValidMsixTarget(target, app);
+  const m = target.msix;
+  const at = (p) => path.resolve(root, p);
+  const manifest = {
+    ...m.identity,
+    capabilities: m.capabilities,
+    dependencies: m.runtime?.dependencies,
+    minWindowsVersion: m.minWindowsVersion,
+    maxWindowsVersionTested: m.maxWindowsVersionTested,
+    virtualization: m.virtualization,
+  };
+  return {
+    stageDir: at(m.stageDir),
+    out: at(m.out),
+    manifest,
+    assets: Object.fromEntries(Object.entries(m.assets).map(([k, v]) => [k, at(v)])),
+    runtime: m.runtime,
+    appInstaller: updaterKind(target) === "appinstaller" ? { ...m.appInstaller, out: at(m.appInstaller.out) } : undefined,
+    sign, dryRun,
+    peReceipt: receipts.pe, msixReceipt: receipts.msix,
+    receiptDir: receipts.dir,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.138",
+  "version": "0.2.139",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/preflight.mjs

@@ -23,6 +23,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
+import { isSwiftProject } from "./project-type.mjs";
 
 export const PREFLIGHT_OK = "ok";
 export const PREFLIGHT_WARN = "warn";
@@ -179,11 +180,24 @@ export function collectPreflight({
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
+  projectType,
+  msix = false,
+  findSdkTool = findWindowsSdkTool,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
+  const swift = isSwiftProject(projectType);
 
-  if (appRoot) {
+  if (swift) {
+    const swiftVersion = versionProbe("swift");
+    checks.push(
+      swiftVersion
+        ? ok("swift", swiftVersion)
+        : fail("swift", "swift was not found on PATH; SwiftPM apps build with the Swift toolchain", "install the pinned Swift toolchain (swift.org / Swift on Windows) and verify: swift --version"),
+    );
+  }
+
+  if (appRoot && !swift) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -225,29 +239,27 @@ export function collectPreflight({
   }
 
   if (windows) {
-    const makeappx = findWindowsSdkTool("makeappx.exe");
-    checks.push(
-      makeappx
-        ? ok("windows-sdk", `makeappx.exe from SDK ${makeappx.version}`)
-        : fail(
-            "windows-sdk",
-            "no makeappx.exe found under any installed Windows 10/11 SDK",
-            "install the Windows SDK, or set MAKEAPPX_PATH to an explicit makeappx.exe",
-          ),
-    );
+    // makeappx/signtool are MSIX requirements; NSIS/portable targets sign through sign-windows.
+    if (msix) {
+      const makeappx = process.env.MAKEAPPX_PATH ? { version: "MAKEAPPX_PATH" } : findSdkTool("makeappx.exe");
+      checks.push(
+        makeappx
+          ? ok("windows-sdk", `makeappx.exe from SDK ${makeappx.version}`)
+          : fail(
+              "windows-sdk",
+              "msix target configured but no makeappx.exe found under any installed Windows 10/11 SDK",
+              "install the Windows SDK, or set MAKEAPPX_PATH to an explicit makeappx.exe",
+            ),
+      );
+    }
 
-    const signtool = findWindowsSdkTool("signtool.exe");
-    checks.push(
-      signtool
-        ? ok("signtool", `signtool.exe from SDK ${signtool.version}`)
-        : warn(
-            "signtool",
-            "no signtool.exe found under any installed Windows SDK",
-            "install the Windows SDK Build Tools, or set AZURE_SIGNTOOL_PATH",
-          ),
-    );
+    const signtool = findSdkTool("signtool.exe");
+    const signtoolMissing = "install the Windows SDK Build Tools, or set AZURE_SIGNTOOL_PATH";
+    if (signtool) checks.push(ok("signtool", `signtool.exe from SDK ${signtool.version}`));
+    else if (msix) checks.push(fail("signtool", "msix target configured but no signtool.exe found under any installed Windows SDK", signtoolMissing));
+    else checks.push(warn("signtool", "no signtool.exe found under any installed Windows SDK", signtoolMissing));
 
-    const vendorsOpenssl = cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
+    const vendorsOpenssl = !swift && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
     if (vendorsOpenssl) {
       const perl = resolveWindowsPerl({ env });
       checks.push(
@@ -262,7 +274,9 @@ export function collectPreflight({
     }
   }
 
-  if (isBrokerManagedHost(env)) {
+  if (swift) {
+    // No Rust compiler cache applies to SwiftPM targets.
+  } else if (isBrokerManagedHost(env)) {
     checks.push(ok("compiler-cache", "broker-managed; compiler-cache selection and status are recorded in build receipts"));
   } else {
     const sccache = versionProbe("sccache");

package/project-type.mjs

@@ -0,0 +1,43 @@
+// Project-type awareness for release preflight: which toolchain a target needs.
+// Pure; filesystem access is injectable. Swift (SwiftPM) apps need `swift`, not
+// cargo/rustc; Tauri/Rust targets keep their existing requirements.
+
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+export const PROJECT_TYPES = Object.freeze(["tauri", "cargo", "swiftpm"]);
+
+/**
+ * Explicit `target.projectType` / `config.projectType` wins. Otherwise a Package.swift with no Cargo
+ * manifest (root or src-tauri) is swiftpm; everything else is tauri/cargo (unchanged behaviour).
+ */
+export function resolveProjectType({ appRoot, config = {}, target = {}, exists = existsSync } = {}) {
+  const explicit = target.projectType ?? config.projectType;
+  if (explicit !== undefined) {
+    if (!PROJECT_TYPES.includes(explicit)) throw Object.assign(new Error(`projectType must be one of ${PROJECT_TYPES.join(", ")}; got ${explicit}`), { code: "PROJECT_TYPE_INVALID" });
+    return explicit;
+  }
+  if (appRoot) {
+    const roots = [appRoot, path.resolve(appRoot, config.workdir ?? ".")];
+    const hasSwift = roots.some((r) => exists(path.join(r, "Package.swift")));
+    const hasCargo = roots.some((r) => exists(path.join(r, "Cargo.toml")) || exists(path.join(r, "src-tauri", "Cargo.toml")));
+    if (hasSwift && !hasCargo) return "swiftpm";
+  }
+  return "tauri";
+}
+
+export const isSwiftProject = (projectType) => projectType === "swiftpm";
+
+/** Executables the build itself needs (the config's own preflight.executables are appended by callers). */
+export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true } = {}) {
+  if (isSwiftProject(projectType)) return ["git", "swift", ...(usesPackageManager && packageManager ? [packageManager] : [])];
+  return ["git", packageManager, "cargo", "rustc"];
+}
+
+/** True when the Windows target packages an MSIX (needs makeappx and signtool). */
+export function targetUsesMsix(target) {
+  return Boolean(target?.msix) || target?.signingContract === "windows-msix-signed-v1";
+}
+
+/** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
+export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/publish-update.mjs

@@ -75,6 +75,12 @@ const artifactFile = (declared) => {
   return artifact.file;
 };
 const verifiedArtifact = (file) => sealed.artifacts.get(path.basename(file));
+// MSIX updates (updater.kind appinstaller) trust the package Authenticode signature (publisher-pinned in
+// the manifest), so no minisign .sig exists; the route records the sealed package digest instead.
+const appInstallerKind = target?.updater?.kind === "appinstaller";
+const signatureFor = (artifact) => appInstallerKind
+  ? `msix-authenticode-sha256:${assertArtifactUnchanged(verifiedArtifact(artifact.file)) && verifiedArtifact(artifact.file).sha256}`
+  : signatureText(artifactFile(artifact.signature));
 const signatureText = (file) => {
   const signature = assertArtifactUnchanged(verifiedArtifact(file)).toString("utf8").trim();
   if (!signature) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", `sealed updater signature is empty: ${file}`);
@@ -89,7 +95,7 @@ function git(args) {
 if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
-if (sealed) for (const artifact of artifacts) signatureText(artifactFile(artifact.signature));
+if (sealed) for (const artifact of artifacts) signatureFor(artifact);
 let releaseToken = null;
 if (!dryRun && (tier === "update" || artifacts.length > 0)) {
   try {
@@ -114,13 +120,13 @@ if (tier === "patch") {
     const installerKey = patchInstallerKey(artifact);
     assertCurrentKey(installerKey, "installer");
     const file = artifactFile(artifact.file);
-    const signatureFile = artifactFile(artifact.signature);
+    if (!appInstallerKind) artifactFile(artifact.signature);
     if (!uploadedKeys.has(installerKey)) {
       console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}`);
       if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installerKey, "public", { cwd: root });
       uploadedKeys.add(installerKey);
     }
-    const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
+    const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
     platforms[artifact.platform] = {
@@ -210,13 +216,13 @@ const uploadedKeys = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = artifactFile(artifact.file);
-  const signatureFile = artifactFile(artifact.signature);
+  if (!appInstallerKind) artifactFile(artifact.signature);
   if (!uploadedKeys.has(artifact.key)) {
     console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`);
     if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), artifact.key, "private", { cwd: root });
     uploadedKeys.add(artifact.key);
   }
-  const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
+  const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
   platforms[artifact.platform] = {

package/release-invocation.mjs

@@ -1,4 +1,5 @@
 import { spawnSync } from "./background-process.mjs";
+import { resolveProjectType } from "./project-type.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
@@ -128,18 +129,19 @@ export function resolveConfiguredBuildInputs(config, target, label = "release co
 }
 
 export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
+  const swift = resolveProjectType({ appRoot, config, target }) === "swiftpm";
   const nativeLayout = resolveNativeCargoLayout({
     appRoot,
     config,
-    requireManifest: true,
-    requireLock: true,
+    requireManifest: !swift,
+    requireLock: !swift,
   });
   const requiredInputs = [
     configPath,
-    path.join(appRoot, "package.json"),
-    path.join(appRoot, "pnpm-lock.yaml"),
-    nativeLayout.manifestPath,
-    nativeLayout.lockPath,
+    ...(swift
+      // SwiftPM: Package.swift is required; Package.resolved and the Node manifests only when they exist.
+      ? [path.join(appRoot, "Package.swift"), ...["Package.resolved", "package.json", "pnpm-lock.yaml"].map((f) => path.join(appRoot, f)).filter((f) => existsSync(f))]
+      : [path.join(appRoot, "package.json"), path.join(appRoot, "pnpm-lock.yaml"), nativeLayout.manifestPath, nativeLayout.lockPath]),
     ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
   ].filter((file, index, files) => files.indexOf(file) === index);
   for (const file of requiredInputs) {

package/release.mjs

@@ -17,6 +17,10 @@ import {
   resolveNativeFinalizerConfig,
   validateNativeFinalizationOutput,
 } from "./native-release-finalization.mjs";
+import { packageCommandOptional, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
+import { MSIX_SIGNING_CONTRACT, assertValidMsixTarget } from "./msix-config.mjs";
+import { buildMsix } from "./msix-build.mjs";
+import { msixBuildOptions } from "./msix-target.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
@@ -118,7 +122,10 @@ const workdir = path.resolve(root, config.workdir ?? ".");
 const nativeLayout = resolveNativeCargoLayout({ appRoot: root, config });
 const nativeAssembly = config.nativeAssembly;
 const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
-await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
+// A SwiftPM app without a package.json has no Node package contract to validate.
+if (!(resolveProjectType({ appRoot: root, config, target: config.targets?.[opts.platform] }) === "swiftpm" && !existsSync(path.join(root, "package.json")))) {
+  await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
+}
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
@@ -131,13 +138,18 @@ if (target.signed !== true) {
 if (opts.platform === "win") {
   const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
   const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
-  if (!isNsis && !isPortable) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT} or ${WINDOWS_PORTABLE_SIGNING_CONTRACT}`);
+  const isMsix = target.signingContract === MSIX_SIGNING_CONTRACT;
+  if (!isNsis && !isPortable && !isMsix) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT}, ${WINDOWS_PORTABLE_SIGNING_CONTRACT} or ${MSIX_SIGNING_CONTRACT}`);
+  if (isMsix) {
+    try { assertValidMsixTarget(target, config.app ?? "app"); } catch (error) { fail(error.message); }
+  } else {
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
   if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
   if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
   if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
   if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
+  }
 }
 if (opts.platform === "mac") {
   if (target.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT) fail(`${config.app ?? "app"} mac must declare signingContract: ${MACOS_PORTABLE_SIGNING_CONTRACT}`);
@@ -150,7 +162,7 @@ if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.pl
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout, projectTarget = config.targets?.[platform] }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -173,6 +185,8 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
     cargoLockPaths,
     nativeLayout: suppliedNativeLayout,
     targetLink: suppliedNativeLayout?.targetLink,
+    projectType: resolveProjectType({ appRoot: root, config, target: projectTarget }),
+    msix: targetUsesMsix(projectTarget),
   });
 }
 
@@ -234,7 +248,7 @@ if (opts.doctor) {
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
-if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (!command && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
   fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
 }
@@ -255,7 +269,17 @@ await runConfiguredChecks({
 
 let nativeFinalization = null;
 let bundleMarkerReceipts = [];
-if (opts.platform === "win") {
+if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT) {
+  // MSIX order: prePackage builds + stages the payload; buildMsix signs inner PE files (DLLs, EXEs),
+  // packs the exact signed bytes, signs the package through sign-windows, verifies signer == Publisher,
+  // writes the App Installer route and the seal record. Never a second signer.
+  await runCommand(target.prePackage, root);
+  const options = msixBuildOptions({ root, target, app: config.app, dryRun: opts.dryRun, receipts: {
+    pe: windowsReceiptPath(root, "raw-exe"), msix: windowsReceiptPath(root, "installer"),
+    dir: path.dirname(windowsReceiptPath(root, "raw-exe")) } });
+  const built = buildMsix(options, { log: (event) => console.log(`right-release: ${JSON.stringify(event)}`) });
+  console.log(`right-release: msix ${built.dryRun ? "dry-run" : "built"} ${options.out}`);
+} else if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
   await runCommand(target.prePackage, root);
   for (const file of rawFiles) await mustExist(file, `missing raw EXE signing artifact: ${file}`);
@@ -300,7 +324,7 @@ if (opts.platform === "win") {
   }
 }
 
-if (opts.platform !== "mac" || runMacPhase("package")) await runCommand(command, root);
+if (command && (opts.platform !== "mac" || runMacPhase("package"))) await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
   await mustExist(resolveReleaseArtifactPath(root, rel), `missing release artifact: ${rel}`);

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.138",
+    "@rightkit/release": "0.2.139",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -168,7 +168,8 @@
       "0.2.134",
       "0.2.135",
       "0.2.136",
-      "0.2.137"
+      "0.2.137",
+      "0.2.138"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -380,7 +381,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.138",
+      "@rightkit/release": "0.2.139",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",

package/swift-build-context.mjs

@@ -0,0 +1,43 @@
+// Everything the sealed `build` path does differently for a SwiftPM target, as pure/stub-friendly
+// functions so build-release.mjs only branches once. Rust-only steps (rustc/cargo probes, Cargo lock
+// identity, broker cargo target, Cache V2 shared Rust cache, target bridge, CARGO/SCCACHE env) are skipped.
+
+import path from "node:path";
+import { resolveSwiftCacheIdentity } from "./cache-policy.mjs";
+
+const RUST_ENV = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "SCCACHE_IGNORE_SERVER_IO_ERROR", "RUSTFLAGS", "RIGHT_RELEASE_CACHE_OWNER"];
+
+export function swiftArchitecture({ target = {}, platform, hostArch = process.arch }) {
+  const arch = target.msix?.identity?.architecture ?? target.architecture ?? (hostArch === "arm64" ? "arm64" : "x64");
+  return platform === "mac" ? (arch === "x64" ? "x86_64" : arch) : arch;
+}
+
+/** exec(cmd, args) -> stdout string. Throws when swift is missing. */
+export function collectSwiftToolVersions({ packageManager, exec, nodeVersion = process.version }) {
+  const swift = exec("swift", ["--version"]).trim();
+  if (!swift) throw new Error("swift --version printed nothing");
+  return { node: nodeVersion, packageManager: packageManager ? `${packageManager} ${exec(packageManager, ["--version"]).trim()}` : null, swift, cargo: null, rustc: null, rustHost: null, sccache: null };
+}
+
+/**
+ * Plan for a swiftpm sealed build: identity, forced non-shared cache mode, no broker cargo target, no target
+ * bridge, a plain build/cache dir under the vault, and an environment with every Rust variable removed.
+ */
+export function planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions, profile = "release", hostArch }) {
+  const architecture = swiftArchitecture({ target, platform, hostArch });
+  const identity = resolveSwiftCacheIdentity({ swiftVersion: toolVersions.swift, packageResolvedPath: path.join(appRoot, "Package.resolved"), architecture, profile: target.profile ?? profile });
+  const buildDir = path.resolve(vaultRoot, "cache", "swift-build", platform, identity.fingerprint);
+  return {
+    identity, architecture, buildDir,
+    cacheMode: "legacy",
+    managedCargoTarget: null,
+    targetBridge: { run: (fn) => fn(), ensure() {} },
+    sanitizeEnv(env) {
+      const next = { ...env };
+      for (const name of RUST_ENV) delete next[name];
+      next.RIGHT_RELEASE_SWIFT_BUILD_DIR = buildDir;
+      return next;
+    },
+    watchDirs: [buildDir, path.join(appRoot, ".build")],
+  };
+}