@rightkit/release 0.2.138 → 0.2.140

package/README.md

@@ -35,6 +35,8 @@ right-release install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id d
 
 It mounts the image read-only and hidden (`-nobrowse`), verifies the app (`codesign --verify --deep --strict`, `spctl --assess`, `stapler validate`, bundle id, and Team ID against the installed copy; a Team ID change is refused) before touching the installed copy, quits the running instance with SIGTERM (15 s, then SIGKILL), moves the old bundle to `~/.Trash/<App> <timestamp>.app`, copies the new one with `ditto` (restoring the old bundle on failure), re-verifies, and relaunches only if it was running or `--relaunch` is given, using `open -g -j -b` (background, hidden, never activated). `--json` emits one lifecycle event per line (`start`, `verified`, `quit`, `replaced`, `relaunched`, `done`/`failed`). Win32 exits with "not implemented on win32". Exit codes: 0 ok, 1 failed, 2 usage, 3 unsupported platform.
 
+Development builds (from `@rightkit/git` `devArtifact`, Developer ID-signed but not notarized) install with `--dev` and exactly one of `--dmg`, `--zip <path.zip>` (extracted with `ditto -x -k`), or `--app <path.app>`: `right-release install-app --dev --zip dev-mac.zip`. `--dev` still requires `codesign --verify --deep --strict`, a Team ID, no Team ID change, and a bundle-id match; it skips only `spctl` and `stapler`, removes `com.apple.quarantine` from the new bundle only, prints `DEV BUILD (not notarized)`, and sets `dev: true` on every JSON event.
+
 ## Entry points
 
 Bin: `right-release` (`cli/right-release.mjs`). The package has no `exports` map. The CLI is the supported surface.
@@ -56,6 +58,20 @@ pnpm add -D @rightkit/release
 pnpm exec right-release deps --check
 ```
 
+## MSIX target and Swift app type
+
+Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (config or target; auto-detected from a `Package.swift` with no Cargo manifest) replaces the cargo/rustc requirement with `swift`, and skips the Rust target-bridge, sccache and Perl checks. Tauri/Rust targets are unchanged. `makeappx` and `signtool` are required only when `targets.win.msix` is configured.
+
+`targets.win` with `signingContract: "windows-msix-signed-v1"` packages an MSIX (schema in `msix-config.mjs`): `prePackage` builds and stages a flat payload (`right-release swift-package windows-stage`), then the msix step runs in the immutable order: verify the declared runtime-DLL inventory and PE import closure (fails closed), sign inner DLLs then EXEs through `sign-windows`, `makeappx pack`, sign the `.msix`, verify the signature and that the signer subject equals `Identity/@Publisher`, write the App Installer route, and write `msix-seal.json`. `msix.virtualization.fileSystemWrite|registryWrite` (`enabled|disabled`) are mandatory and emitted as `desktop6` manifest properties. List the `.msix` under `installer.artifacts` so it seals.
+
+`updater.kind: "appinstaller"` (default remains the Tauri minisign flow) generates `msix.appInstaller.out` (https `uri`/`msixUri`); trust is the MSIX Authenticode signature, so no `.sig` is produced and `publish-update` records the sealed package digest.
+
+macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
+
+Build a SwiftPM app with `right-release build --platform mac|win` (add `--config <path>` when the config is not `right-release.config.mjs`). Build is tier-neutral and never uploads, so it rejects `--tier` and takes no `--upload`/`--no-upload`; the old `release --tier patch --no-upload` form no longer works. Pick the tier only at upload: `right-release upload --release <sealed-id> --platform mac|win --tier patch|update`.
+
+Set `targets.mac.notarize.appBeforePackage: true` (with `notarize.app` naming the `.app`) to notarize and staple the app itself right after signing and before the package step copies it into the DMG, so an app copied out of the DMG passes `stapler validate` offline. The DMG named by `notarize.file` is still notarized and stapled afterward; the app ticket receipt is `macos-app-notarization.json`. Without the flag, behavior is unchanged.
+
 ## Known issues
 
 - `smol-toml` is pinned exactly. A consumer that adds another `smol-toml` gets a second copy (npm audit 2026-10-08, release finding).

package/build-release.mjs

@@ -33,6 +33,8 @@ import { brokerManagedHost } from "./cargo-contract.mjs";
 import { resolveReleaseCacheMode } from "./release-cache-mode.mjs";
 import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
+import { collectSwiftToolVersions, planSwiftBuild } from "./swift-build-context.mjs";
+import { packageCommandOptional, requiredBuildExecutables, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, summarizePreBrokerWaits, terminateProcessTree } from "./heavy-command.mjs";
@@ -46,14 +48,14 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // Cached target directories must not outlive changes to these signing helpers.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs", "msix-build.mjs", "msix-plan.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")
   .slice(0, 16);
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
-function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout }) {
+function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
@@ -71,6 +73,8 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     // reject a legitimate resume of an in-flight build.
     version: undefined,
     cargoLockPaths: nativeLayout?.lockCandidates ?? [],
+    projectType: resolveProjectType({ appRoot, config, target }),
+    msix: targetUsesMsix(target),
   });
 }
 
@@ -124,7 +128,7 @@ if (dryRun) {
   const config = (await import(`${pathToFileURL(configPath).href}?dry-run=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   const target = config.targets?.[platform];
-  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  if (!target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
   console.log(`right-release build dry-run: ${config.app} ${config.version} ${platform}`);
   console.log(`config: ${configPath}`);
   console.log(`commit: ${commit}`);
@@ -163,7 +167,8 @@ try {
     fail("app and version must be safe release-id components");
   }
   const target = config.targets?.[platform];
-  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  if (!target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
+  const isSwiftBuild = resolveProjectType({ appRoot, config, target }) === "swiftpm";
   const nativeLayout = resolveNativeCargoLayout({ appRoot, config });
   if (platform === "win" && target.signingContract === "windows-raw-exe-authenticode-before-nsis-v1") {
     assertNsisInPlaceUpgradeContract(appRoot, target.nsisUpgradeContract);
@@ -171,7 +176,7 @@ try {
   const { requiredInputs, buildInputs } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
   const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
-  const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
+  const toolVersions = isSwiftBuild ? collectSwiftToolVersions({ packageManager: config.packageManager, exec: commandOutput }) : collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
   const platformDir = platform === "win" ? "windows" : "mac";
@@ -208,10 +213,12 @@ try {
   // shells take the Cache V2 branch, bridge resolved native target into release cache,
   // and then lose CARGO_TARGET_DIR to the broker's unconditional override — so the
   // app bundle landed in the broker workspace and packaging failed on an empty cache.
-  const managedCargoTarget = brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
-  const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
+  const swiftPlan = isSwiftBuild ? planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions }) : null;
+  // SwiftPM targets have no Cargo manifest: no broker cargo target, no Rust cache identity.
+  const managedCargoTarget = swiftPlan ? swiftPlan.managedCargoTarget : brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
+  const cacheIdentity = swiftPlan ? swiftPlan.identity : resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
-  const cacheModeRequested = resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
+  const cacheModeRequested = swiftPlan ? swiftPlan.cacheMode : resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
   // On a broker-managed host, Cache V2's lease/slot/prune/floor/mark chain is not
   // running against the directory that will actually hold build output — the
   // broker owns CARGO_TARGET_DIR unconditionally (see managedCargoTarget above).
@@ -233,7 +240,7 @@ try {
   // Preflight BEFORE any compile. These preconditions used to be discovered one
   // per build cycle, minutes deep, with errors that named a symptom instead of a
   // cause. Blocking problems stop here, in seconds, naming the fix.
-  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout });
+  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target });
   const preflightBlockers = preflightFailures(preflight);
   if (preflightBlockers.length > 0) {
     fail(`preflight found ${preflightBlockers.length} blocking problem(s):\n${formatPreflight(preflightBlockers)}`);
@@ -252,7 +259,7 @@ try {
   // resolves to MSYS Perl, which cannot configure OpenSSL. Put the real Windows
   // Perl first so the build behaves the same from any shell.
   const pathPrefix = buildPathPrefix({ platform });
-  const env = macosCodesignEnvironment({
+  const baseEnv = macosCodesignEnvironment({
     ...heavyCommandEnvironment(process.env),
     ...releaseEnvironment({ root: vaultRoot, cacheRoot: sharedCacheRoot, platform, architecture: cacheIdentity.architecture, app: config.app, cacheKey, kind: "release", appRoot, mode: cacheMode }),
     ...(pathPrefix ? { PATH: `${pathPrefix}${path.delimiter}${process.env.PATH ?? ""}` } : {}),
@@ -261,6 +268,7 @@ try {
     RIGHTKIT_MANAGED_ROOT: resolveManagedRoot({ env: process.env }),
     RIGHT_RELEASE_ARTIFACT_DIR: resolveArtifactDir({ app: config.app, version: config.version, managedRoot: resolveManagedRoot({ env: process.env }) }),
   });
+  const env = swiftPlan ? swiftPlan.sanitizeEnv(baseEnv) : baseEnv;
   if (managedCargoTarget) {
     for (const name of ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"]) {
       delete env[name];
@@ -302,7 +310,7 @@ try {
   // ownedRoot is the per-app cache parent holding every fingerprint dir, so a
   // link left by an earlier fingerprint is recognised as ours and repointed
   // instead of hard-stopping the build.
-  const targetBridge = createTargetBridge({
+  const targetBridge = swiftPlan ? swiftPlan.targetBridge : createTargetBridge({
     link: targetLink,
     target: managedCargoTarget ?? env.CARGO_TARGET_DIR,
     ownedRoot: path.dirname(managedCargoTarget ?? env.CARGO_TARGET_DIR),
@@ -329,7 +337,7 @@ try {
           const volumes = inspectWriteVolumes({ repoRoot, vaultRoot, cacheRoot: sharedCacheRoot });
           assertWriteVolumeFloors({ volumes, policy, configuredRepoMinimumBytes: Math.max(Number(target.preflight?.minFreeGb ?? 25), 25) * 1024 ** 3 });
         } else assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
-        assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
+        assertExecutables([...requiredBuildExecutables({ projectType: resolveProjectType({ appRoot, config, target }), packageManager: config.packageManager ?? "pnpm", usesPackageManager: Boolean(config.packageManager) || existsSync(path.join(appRoot, "package.json")) }), ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
         for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
         if (buildRoot) mkdirSync(buildRoot, { recursive: true });
@@ -341,7 +349,7 @@ try {
       },
       prepare: async () => {
         throwIfInterrupted();
-        const cacheTarget = managedCargoTarget ?? env.CARGO_TARGET_DIR;
+        const cacheTarget = swiftPlan ? swiftPlan.buildDir : managedCargoTarget ?? env.CARGO_TARGET_DIR;
         mkdirSync(cacheTarget, { recursive: true });
         // Broker-managed hosts route through the same target bridge as shared
         // mode even though cacheMode is forced to "broker" above: the naive
@@ -349,12 +357,13 @@ try {
         // directory, which is exactly the "corruption" misreading that nearly
         // cost ~5.9 GB of warm broker intermediates. The bridge's brokerManaged
         // flag already knows to leave a real directory untouched instead.
-        if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
+        if (swiftPlan) { /* SwiftPM: no Rust target link */ }
+        else if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
         else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
-        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
+        if (resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },
       build: async () => {
         throwIfInterrupted();
@@ -363,9 +372,9 @@ try {
           [WORKER, "--config", configPath, "--platform", platform, "--no-upload", "--resume", ...(resumeFrom ? ["--resume-from", resumeFrom] : []), ...(skipChecks ? ["--skip-checks"] : [])],
           appRoot,
           env,
-          [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          swiftPlan ? swiftPlan.watchDirs : [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
           path.join(stateRoot, "stall-build.log"),
-          { livenessOwnerTimeoutMs: target.package.livenessOwnerTimeoutMs ?? null },
+          { livenessOwnerTimeoutMs: target.package?.livenessOwnerTimeoutMs ?? null },
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -461,7 +470,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
     addSource(resolveArtifactPath(artifact.file), "updater");
-    addSource(resolveArtifactPath(artifact.signature), "updater-signature");
+    if (target.updater?.kind !== "appinstaller") addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
@@ -485,10 +494,10 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
   }
   for (const artifact of target.updater?.artifacts ?? []) {
     const source = resolveArtifactPath(artifact.file);
-    const signatureSource = resolveArtifactPath(artifact.signature);
+    const signatureSource = target.updater?.kind === "appinstaller" ? null : resolveArtifactPath(artifact.signature);
     const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
-    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "public", key: patchKey, platform: artifact.platform });
-    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "private", key: artifact.key, platform: artifact.platform });
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "private", key: artifact.key, platform: artifact.platform });
   }
   writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
   const manifest = {

package/cache-policy.mjs

@@ -518,3 +518,17 @@ function isAbsoluteForPlatform(value) { return isWindowsAbsolute(value) || path.
 function resolveForPlatform(value) { return isWindowsAbsolute(value) ? path.win32.resolve(value) : path.posix.resolve(value); }
 function readRustcVerbose() { const result = spawnSync("rustc", ["-vV"], { encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`rustc -vV failed: ${(result.stderr || result.error?.message || `exit ${result.status}`).trim()}`); return result.stdout.trim(); }
 function cargoNativeFeatures(cargoTomlPath) { if (!cargoTomlPath || !existsSync(cargoTomlPath)) return []; return [...readFileSync(cargoTomlPath, "utf8").matchAll(/features\s*=\s*\[([^\]]+)\]/g)].flatMap((match) => match[1].match(/"([^"]+)"/g) ?? []).map((value) => value.slice(1, -1)).filter((value) => /sqlcipher|openssl/i.test(value)); }
+
+/**
+ * SwiftPM counterpart of resolveSharedCacheIdentity: identity is the Swift toolchain, Package.resolved
+ * (dependency pins; absent for dependency-free packages), target architecture and profile. No Rust inputs.
+ */
+export function resolveSwiftCacheIdentity({ swiftVersion, packageResolvedPath, architecture, profile = "release" } = {}) {
+  if (!swiftVersion || !String(swiftVersion).trim()) throw new Error("swift --version did not report a toolchain");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(architecture ?? "")) throw new Error("invalid Swift target architecture");
+  const resolved = packageResolvedPath && existsSync(packageResolvedPath) ? readFileSync(packageResolvedPath, "utf8").replace(/\r\n?/g, "\n") : null;
+  const packageResolvedSha256 = resolved === null ? "none" : sha256(resolved);
+  const swift = String(swiftVersion).trim();
+  return { projectType: "swiftpm", packageResolvedSha256, swift, target: architecture, architecture, profile, features: [],
+    fingerprint: sha256(JSON.stringify({ projectType: "swiftpm", packageResolvedSha256, swift, architecture, profile })).slice(0, 16) };
+}

package/committed-source.mjs

@@ -1,3 +1,4 @@
+import { stripOwnLockRecords } from "./source-gate.mjs";
 import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
@@ -193,7 +194,7 @@ export function assertCommittedCheckoutClean(root, { expectedCommit, expectedTre
   const output = runGit(path.resolve(root), ["status", "--porcelain=v1", "-z", "--untracked-files=all"], {
     encoding: "buffer", maxBuffer: MAX_TREE_BYTES, timeout: COMMAND_TIMEOUT_MS, runner, env: gitEnv(),
   });
-  if (output.length) throw new CommittedSourceIncompleteError("committed ownership: protected release checkout has tracked or untracked changes");
+  if (stripOwnLockRecords(Buffer.from(output).toString("utf8")).length) throw new CommittedSourceIncompleteError("committed ownership: protected release checkout has tracked or untracked changes");
   return true;
 }
 

package/dmg-build.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { backgroundAlias, dmgDSStore } from "./dmg-layout.mjs";
+import { detachWithRetrySync } from "./hdiutil-detach.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
 
 const fail = (code, message) => Object.assign(new Error(message), { code });
@@ -17,7 +18,7 @@ const pair = (value, label, positive = false) => {
 export function buildDmg({ app, out, volname, background, iconSize = 128, appPosition = [158, 231],
   applicationsPosition = [492, 231], window = [660, 400], volumeIcon } = {},
 { platform = process.platform, run = spawnSync, makeAlias = backgroundAlias,
-  log = (event) => console.error(JSON.stringify(event)) } = {}) {
+  log = (event) => console.error(JSON.stringify(event)), sleep } = {}) {
   if (platform !== "darwin") throw fail("DMG_NATIVE_HOST_REQUIRED", "DMG creation requires macOS");
   if (!app || !out || !volname) throw fail("DMG_INVALID_OPTIONS", "--app, --out & --volname are required");
   app = path.resolve(app); out = path.resolve(out);
@@ -55,6 +56,12 @@ export function buildDmg({ app, out, volname, background, iconSize = 128, appPos
     if (result.error || result.status !== 0) throw fail("DMG_COMMAND_FAILED", `${tool} ${args[0]} failed: ${result.error?.message ?? result.stderr ?? result.status}`);
     return result;
   };
+  // Detach flakes with "Resource busy": bounded retry with backoff, then -force as the last resort.
+  const detach = () => {
+    const outcome = detachWithRetrySync({ mount, log, ...(sleep ? { sleep } : {}),
+      detach: (args) => run("/usr/bin/hdiutil", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], shell: false, timeout: 300000 }) });
+    if (!outcome.ok) throw fail("DMG_COMMAND_FAILED", `hdiutil detach failed after ${outcome.attempts} tries and -force: ${outcome.result?.error?.message ?? outcome.result?.stderr ?? outcome.result?.status}`);
+  };
   log({ event: "dmg-build-started", app, out, volname });
   try {
     mkdirSync(stage); mkdirSync(mount);
@@ -78,7 +85,7 @@ export function buildDmg({ app, out, volname, background, iconSize = 128, appPos
     const alias = relative ? makeAlias({ mount, volname, relative }) : undefined;
     writeFileSync(path.join(mount, ".DS_Store"), dmgDSStore({ appName: path.basename(app), iconSize,
       appPosition, applicationsPosition, window, alias }));
-    command("/usr/bin/hdiutil", ["detach", mount]); attached = false;
+    detach(); attached = false;
     command("/usr/bin/hdiutil", ["convert", rw, "-format", "UDZO", "-imagekey", "zlib-level=9", "-o", compressed]);
     command("/usr/bin/hdiutil", ["verify", compressed]);
     renameSync(compressed, out);
@@ -89,7 +96,7 @@ export function buildDmg({ app, out, volname, background, iconSize = 128, appPos
     throw error;
   } finally {
     if (attached || attaching) {
-      try { command("/usr/bin/hdiutil", ["detach", "-force", mount]); attached = false; attaching = false; }
+      try { detach(); attached = false; attaching = false; }
       catch (error) { log({ event: "dmg-cleanup-failed", mount, work, message: error.message }); }
     }
     // Never recurse through a mount that failed to detach.

package/hdiutil-detach.mjs

@@ -0,0 +1,42 @@
+// Bounded detach for hdiutil mounts. Spotlight, Finder, and quick-look helpers can hold a freshly
+// written volume for a moment, so a first `hdiutil detach` regularly fails with "Resource busy".
+// Retry a fixed number of times with exponential backoff, then fall back to `-force` once.
+
+export const DETACH_TRIES = 5;
+export const DETACH_BACKOFF_MS = Object.freeze([500, 1000, 2000, 4000]);
+
+const blockingSleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const describe = (result) => String(result?.error?.message ?? result?.stderr ?? result?.status ?? "failed").trim();
+
+/**
+ * Synchronous. `detach(args)` runs `hdiutil <args>` and returns `{ status, stderr?, error? }`.
+ * Returns `{ ok, attempts, forced }`; throws only through the caller when `ok` is false.
+ */
+export function detachWithRetrySync({ detach, mount, sleep = blockingSleep, log = () => {}, tries = DETACH_TRIES, backoffMs = DETACH_BACKOFF_MS }) {
+  let last;
+  for (let attempt = 1; attempt <= tries; attempt += 1) {
+    last = detach(["detach", mount]);
+    if (!last?.error && last?.status === 0) return { ok: true, attempts: attempt, forced: false, result: last };
+    const wait = backoffMs[Math.min(attempt - 1, backoffMs.length - 1)];
+    log({ event: "hdiutil-detach-retry", mount, attempt, of: tries, retryInMs: attempt < tries ? wait : 0, message: describe(last) });
+    if (attempt < tries) sleep(wait);
+  }
+  log({ event: "hdiutil-detach-force", mount, message: describe(last) });
+  const forced = detach(["detach", "-force", mount]);
+  return { ok: !forced?.error && forced?.status === 0, attempts: tries, forced: true, result: forced };
+}
+
+/** Async twin for promise-based runners: `detach(args)` resolves on success and rejects on failure. */
+export async function detachWithRetry({ detach, mount, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), log = () => {}, tries = DETACH_TRIES, backoffMs = DETACH_BACKOFF_MS }) {
+  let last;
+  for (let attempt = 1; attempt <= tries; attempt += 1) {
+    try { await detach(["detach", mount]); return { ok: true, attempts: attempt, forced: false }; }
+    catch (error) { last = error; }
+    const wait = backoffMs[Math.min(attempt - 1, backoffMs.length - 1)];
+    log({ event: "hdiutil-detach-retry", mount, attempt, of: tries, retryInMs: attempt < tries ? wait : 0, message: String(last?.message ?? last) });
+    if (attempt < tries) await sleep(wait);
+  }
+  log({ event: "hdiutil-detach-force", mount, message: String(last?.message ?? last) });
+  try { await detach(["detach", "-force", mount]); return { ok: true, attempts: tries, forced: true }; }
+  catch (error) { return { ok: false, attempts: tries, forced: true, error }; }
+}

package/install-app.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
-// Sanctioned, non-intrusive local app install from a signed DMG (macOS).
+// Sanctioned, non-intrusive local app install from a signed DMG (macOS); --dev also accepts a
+// Developer ID-signed, not-notarized zip or .app.
 // Never uses a shell, osascript, AppleEvents, or foreground activation.
 import { execFile as nodeExecFile } from "./background-process.mjs";
+import { detachWithRetry } from "./hdiutil-detach.mjs";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -17,11 +19,11 @@ export class InstallAppError extends Error {
   }
 }
 
-const VALUE_FLAGS = new Set(["--dmg", "--app-name", "--bundle-id", "--dest"]);
-const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json"]);
+const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest"]);
+const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json", "--dev"]);
 
 export function parseArgs(argv) {
-  const opts = { dmg: null, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false };
+  const opts = { dmg: null, zip: null, app: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     if (VALUE_FLAGS.has(flag)) {
@@ -29,25 +31,35 @@ export function parseArgs(argv) {
       if (value === undefined || value.startsWith("--")) throw new InstallAppError("usage", `${flag} requires a value`);
       i += 1;
       if (flag === "--dmg") opts.dmg = value;
+      else if (flag === "--zip") opts.zip = value;
+      else if (flag === "--app") opts.app = value;
       else if (flag === "--app-name") opts.appName = value;
       else if (flag === "--bundle-id") opts.bundleId = value;
       else opts.dest = value;
     } else if (BOOL_FLAGS.has(flag)) {
       if (flag === "--json") opts.json = true;
+      else if (flag === "--dev") opts.dev = true;
       else opts.relaunch = flag === "--relaunch";
     } else {
       throw new InstallAppError("usage", `unknown argument: ${flag}`);
     }
   }
   if (argv.includes("--relaunch") && argv.includes("--no-relaunch")) throw new InstallAppError("usage", "--relaunch and --no-relaunch are mutually exclusive");
-  if (!opts.dmg) throw new InstallAppError("usage", "--dmg <path.dmg> is required");
-  if (!opts.dmg.toLowerCase().endsWith(".dmg")) throw new InstallAppError("usage", "--dmg must name a .dmg file");
+  const inputs = [opts.dmg, opts.zip, opts.app].filter((v) => v !== null).length;
+  if (inputs === 0) throw new InstallAppError("usage", opts.dev ? "one of --dmg <path.dmg>, --zip <path.zip>, or --app <path.app> is required" : "--dmg <path.dmg> is required");
+  if (inputs > 1) throw new InstallAppError("usage", "--dmg, --zip, and --app are mutually exclusive");
+  if ((opts.zip !== null || opts.app !== null) && !opts.dev) throw new InstallAppError("usage", "--zip and --app require --dev (only DMGs are installable as release builds)");
+  if (opts.dmg !== null && !opts.dmg.toLowerCase().endsWith(".dmg")) throw new InstallAppError("usage", "--dmg must name a .dmg file");
+  if (opts.zip !== null && !opts.zip.toLowerCase().endsWith(".zip")) throw new InstallAppError("usage", "--zip must name a .zip file");
+  if (opts.app !== null && !opts.app.replace(/\/+$/, "").toLowerCase().endsWith(".app")) throw new InstallAppError("usage", "--app must name a .app bundle");
   if (opts.appName !== null && (!/^[^/\0]+\.app$/.test(opts.appName) || opts.appName === ".app" || opts.appName.includes(".."))) {
     throw new InstallAppError("usage", "--app-name must be a bare bundle name ending in .app");
   }
   if (opts.bundleId !== null && !/^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(opts.bundleId)) throw new InstallAppError("usage", "--bundle-id is not a valid bundle identifier");
   if (!path.isAbsolute(opts.dest)) opts.dest = path.resolve(opts.dest);
-  opts.dmg = path.resolve(opts.dmg);
+  if (opts.dmg !== null) opts.dmg = path.resolve(opts.dmg);
+  if (opts.zip !== null) opts.zip = path.resolve(opts.zip);
+  if (opts.app !== null) opts.app = path.resolve(opts.app);
   return opts;
 }
 
@@ -164,9 +176,11 @@ export async function installApp(opts, deps = {}) {
     emit = () => {},
     tmpdir = os.tmpdir(),
   } = deps;
-  const event = (name, data = {}) => emit({ event: name, ...data });
+  const dev = opts.dev === true;
+  const event = (name, data = {}) => emit({ event: name, ...(dev ? { dev: true } : {}), ...data });
   const run = (cmd, args) => execFile(cmd, args);
   let mountRoot = null;
+  let extractRoot = null;
   let mounted = false;
   let mountPoint = null;
   let failedStage = "start";
@@ -174,51 +188,74 @@ export async function installApp(opts, deps = {}) {
   const detach = async () => {
     if (!mounted) return;
     mounted = false;
-    try { await run("/usr/bin/hdiutil", ["detach", mountPoint]); }
-    catch { try { await run("/usr/bin/hdiutil", ["detach", "-force", mountPoint]); } catch { /* best effort */ } }
+    await detachWithRetry({ mount: mountPoint, log: (e) => event(e.event, e), sleep, detach: (args) => run("/usr/bin/hdiutil", args) });
     try { fsImpl.rmSync(mountRoot, { recursive: true, force: true }); } catch { /* best effort */ }
   };
+  const cleanupExtract = () => {
+    if (!extractRoot) return;
+    try { fsImpl.rmSync(extractRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    extractRoot = null;
+  };
 
   try {
     if (platform !== "darwin") throw new InstallAppError("unsupported", `install-app is not implemented on ${platform}`);
-    event("start", { dmg: opts.dmg, dest: opts.dest });
-    if (!fsImpl.existsSync(opts.dmg)) throw new InstallAppError("dmg-missing", `DMG not found: ${opts.dmg}`);
+    const inputPath = opts.dmg ?? opts.zip ?? opts.app;
+    const inputKind = opts.dmg ? "dmg" : opts.zip ? "zip" : "app";
+    event("start", { [inputKind]: inputPath, dest: opts.dest });
+    if (dev) event("dev-build", { note: "DEV BUILD (not notarized)" });
+    if (!fsImpl.existsSync(inputPath)) throw new InstallAppError(`${inputKind}-missing`, `${inputKind.toUpperCase()} not found: ${inputPath}`);
     if (!fsImpl.existsSync(opts.dest)) throw new InstallAppError("dest-missing", `destination not found: ${opts.dest}`);
 
-    failedStage = "attach";
-    mountRoot = fsImpl.mkdtempSync(path.join(tmpdir, "right-install-app-"));
-    const attached = await run("/usr/bin/hdiutil", ["attach", "-nobrowse", "-readonly", "-noautoopen", "-mountrandom", mountRoot, "-plist", opts.dmg]);
-    const mounts = mountPointsFromAttach(attached.stdout);
-    if (mounts.length === 0) throw new InstallAppError("attach", "DMG attached but exposed no mount point");
-    mountPoint = mounts[0];
-    mounted = true;
-
     let sourceApp = null;
-    for (const mp of mounts) {
-      const apps = fsImpl.readdirSync(mp).filter((n) => n.endsWith(".app"));
-      if (opts.appName) { if (apps.includes(opts.appName)) { sourceApp = path.join(mp, opts.appName); break; } }
-      else if (apps.length === 1) { sourceApp = path.join(mp, apps[0]); break; }
-      else if (apps.length > 1) throw new InstallAppError("ambiguous-app", `DMG contains multiple apps (${apps.join(", ")}); pass --app-name`);
+    const pickApp = (dir, label) => {
+      const apps = fsImpl.readdirSync(dir).filter((n) => n.endsWith(".app"));
+      if (opts.appName) return apps.includes(opts.appName) ? path.join(dir, opts.appName) : null;
+      if (apps.length === 1) return path.join(dir, apps[0]);
+      if (apps.length > 1) throw new InstallAppError("ambiguous-app", `${label} contains multiple apps (${apps.join(", ")}); pass --app-name`);
+      return null;
+    };
+    if (opts.dmg) {
+      failedStage = "attach";
+      mountRoot = fsImpl.mkdtempSync(path.join(tmpdir, "right-install-app-"));
+      const attached = await run("/usr/bin/hdiutil", ["attach", "-nobrowse", "-readonly", "-noautoopen", "-mountrandom", mountRoot, "-plist", opts.dmg]);
+      const mounts = mountPointsFromAttach(attached.stdout);
+      if (mounts.length === 0) throw new InstallAppError("attach", "DMG attached but exposed no mount point");
+      mountPoint = mounts[0];
+      mounted = true;
+      for (const mp of mounts) {
+        sourceApp = pickApp(mp, "DMG");
+        if (sourceApp) break;
+      }
+      if (!sourceApp) throw new InstallAppError("app-not-found", opts.appName ? `${opts.appName} not found in DMG` : "no .app found in DMG");
+    } else if (opts.zip) {
+      failedStage = "extract";
+      extractRoot = fsImpl.mkdtempSync(path.join(tmpdir, "right-install-app-zip-"));
+      try { await run("/usr/bin/ditto", ["-x", "-k", opts.zip, extractRoot]); }
+      catch (error) { throw new InstallAppError("zip-extract", `ditto -x -k failed for ${opts.zip}: ${errText(error)}`); }
+      sourceApp = pickApp(extractRoot, "zip");
+      if (!sourceApp) throw new InstallAppError("app-not-found", opts.appName ? `${opts.appName} not found in zip` : "no .app found in zip");
+    } else {
+      sourceApp = opts.app.replace(/\/+$/, "");
+      if (opts.appName && path.basename(sourceApp) !== opts.appName) throw new InstallAppError("app-not-found", `--app is ${path.basename(sourceApp)}, not ${opts.appName}`);
     }
-    if (!sourceApp) throw new InstallAppError("app-not-found", opts.appName ? `${opts.appName} not found in DMG` : "no .app found in DMG");
     const appName = path.basename(sourceApp);
     const installed = path.join(opts.dest, appName);
     const hadInstalled = fsImpl.existsSync(installed);
 
     // Verify the mounted app before touching anything installed.
     failedStage = "verify";
-    const newTeam = await verifyBundle(run, sourceApp, { assess: true, staple: true });
+    const { team: newTeam, ticket } = await verifyBundle(run, sourceApp, { assess: !dev, staple: !dev, dmg: opts.dmg });
     const newBundleId = await readBundleId(run, sourceApp);
-    if (opts.bundleId && newBundleId !== opts.bundleId) throw new InstallAppError("bundle-id-mismatch", `DMG app bundle id ${newBundleId} != --bundle-id ${opts.bundleId}`);
+    if (opts.bundleId && newBundleId !== opts.bundleId) throw new InstallAppError("bundle-id-mismatch", `${inputKind.toUpperCase()} app bundle id ${newBundleId} != --bundle-id ${opts.bundleId}`);
     let installedTeam = null;
     if (hadInstalled) {
       const installedBundleId = await readBundleId(run, installed);
-      if (installedBundleId !== newBundleId) throw new InstallAppError("bundle-id-mismatch", `DMG app bundle id ${newBundleId} != installed bundle id ${installedBundleId}`);
+      if (installedBundleId !== newBundleId) throw new InstallAppError("bundle-id-mismatch", `${inputKind.toUpperCase()} app bundle id ${newBundleId} != installed bundle id ${installedBundleId}`);
       try { installedTeam = await teamIdOf(run, installed); } catch { installedTeam = null; }
-      if (installedTeam && installedTeam !== newTeam) throw new InstallAppError("team-id-changed", `refusing team change: installed ${installedTeam}, DMG ${newTeam}`);
+      if (installedTeam && installedTeam !== newTeam) throw new InstallAppError("team-id-changed", `refusing team change: installed ${installedTeam}, ${inputKind.toUpperCase()} ${newTeam}`);
     }
     const bundleId = opts.bundleId || newBundleId;
-    event("verified", { app: appName, bundleId, teamId: newTeam, replacing: hadInstalled });
+    event("verified", { app: appName, bundleId, teamId: newTeam, replacing: hadInstalled, ...(ticket ? { ticket } : {}) });
 
     // Quit running instance without UI.
     failedStage = "quit";
@@ -244,11 +281,17 @@ export async function installApp(opts, deps = {}) {
       throw new InstallAppError("ditto-failed", `ditto failed (${errText(error)}); ${trashed ? (restored ? "previous app restored" : `RESTORE FAILED, previous app is at ${trashed}`) : "no previous app to restore"}`);
     }
     event("replaced", { installed, previous: trashed });
+    // Dev builds are not notarized: clear quarantine on the NEW bundle only so Gatekeeper does not block it.
+    if (dev) {
+      try { await run("/usr/bin/xattr", ["-dr", "com.apple.quarantine", installed]); }
+      catch (error) { event("quarantine-clear-failed", { installed, reason: errText(error) }); }
+    }
     await detach();
+    cleanupExtract();
 
     // Re-verify installed copy.
     failedStage = "reverify";
-    await verifyBundle(run, installed, { assess: true, staple: false });
+    await verifyBundle(run, installed, { assess: !dev, staple: false });
 
     // Relaunch hidden and in the background only.
     const relaunch = opts.relaunch === null ? wasRunning : opts.relaunch;
@@ -257,7 +300,7 @@ export async function installApp(opts, deps = {}) {
       await run("/usr/bin/open", ["-g", "-j", "-b", bundleId]);
       event("relaunched", { bundleId });
     }
-    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, relaunched: relaunch };
+    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
     event("done", result);
     return result;
   } catch (error) {
@@ -267,10 +310,11 @@ export async function installApp(opts, deps = {}) {
     throw error;
   } finally {
     await detach();
+    cleanupExtract();
   }
 }
 
-async function verifyBundle(run, app, { assess, staple }) {
+async function verifyBundle(run, app, { assess, staple, dmg = null }) {
   const step = async (code, cmd, args) => {
     try { return await run(cmd, args); }
     catch (error) { throw new InstallAppError(code, `${code} failed for ${app}: ${errText(error)}`); }
@@ -280,8 +324,23 @@ async function verifyBundle(run, app, { assess, staple }) {
   if (!team) throw new InstallAppError("team-id-missing", `${app} has no Team ID (ad-hoc or unsigned)`);
   await step("codesign-requirement", "/usr/bin/codesign", ["-dr", "-", app]);
   if (assess) await step("spctl-assess", "/usr/sbin/spctl", ["--assess", "--type", "execute", app]);
-  if (staple) await step("stapler-validate", "/usr/bin/xcrun", ["stapler", "validate", app]);
-  return team;
+  let ticket = null;
+  if (staple) {
+    try { await run("/usr/bin/xcrun", ["stapler", "validate", app]); ticket = "app-ticket"; }
+    catch (error) {
+      if (!dmg) throw new InstallAppError("stapler-validate", `stapler-validate failed for ${app}: ${errText(error)}`);
+      // Standard Tauri flow: the DMG carries the notarization ticket, not the app. Accept only when the
+      // stapled DMG validates, its primary signature is accepted, and Gatekeeper reports the app Notarized Developer ID.
+      await step("stapler-validate", "/usr/bin/xcrun", ["stapler", "validate", dmg]);
+      await step("spctl-dmg", "/usr/sbin/spctl", ["-a", "-t", "open", "--context", "context:primary-signature", dmg]);
+      const assessed = await step("spctl-notarized", "/usr/sbin/spctl", ["-a", "-t", "exec", "-vv", app]);
+      if (!/Notarized Developer ID/.test(`${assessed?.stderr || ""}\n${assessed?.stdout || ""}`)) {
+        throw new InstallAppError("spctl-notarized", `spctl-notarized failed for ${app}: not accepted as Notarized Developer ID`);
+      }
+      ticket = "dmg-ticket";
+    }
+  }
+  return { team, ticket };
 }
 
 async function teamIdOf(run, app) {
@@ -336,13 +395,15 @@ export async function main(argv = process.argv.slice(2), io = {}) {
   try { opts = parseArgs(argv); }
   catch (error) {
     stderr(`right-release install-app: ${error.message}`);
-    stderr("usage: right-release install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
+    stderr("usage: right-release install-app (--dmg <path.dmg> | --dev (--zip <path.zip> | --app <path.app> | --dmg <path.dmg>)) [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
+    stderr("  --dev installs a Developer ID-signed, NOT notarized build (skips spctl/stapler, clears quarantine on the new bundle).");
     return 2;
   }
   const emit = (e) => {
     if (opts.json) { stdout(JSON.stringify({ schema: 1, ts: new Date().toISOString(), ...e })); return; }
     const { event, ...rest } = e;
     if (event === "failed") stderr(`install-app: failed at ${rest.stage}: ${rest.reason}`);
+    else if (event === "dev-build") stdout(`install-app: ${rest.note}`);
     else stdout(`install-app: ${event}${Object.keys(rest).length ? ` ${JSON.stringify(rest)}` : ""}`);
   };
   try {