@rightkit/release 0.2.138 → 0.2.140

package/macos-notarization.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
@@ -70,6 +70,26 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile,
   return receipt;
 }
 
+/**
+ * Notarize and staple a signed .app BEFORE it is packaged into a DMG, so a copy dragged out of the
+ * DMG passes `stapler validate` offline. The app is zipped with ditto (notarytool cannot take a bare
+ * bundle), submitted, and its own ticket stapled; the DMG is then notarized and stapled as usual.
+ * The caller removes the zip after validating the receipt, which hashes it. The receipt records the submitted zip; its stapling evidence names the app bundle.
+ */
+export function notarizeAppBundle({ app, receiptPath, profile, authArgs, zip, run = spawnSync, env = process.env, ...agentOptions }) {
+  app = path.resolve(app);
+  if (!/\.app$/i.test(app)) throw new Error(`notarize.app must name an app bundle: ${app}`);
+  zip = path.resolve(zip ?? `${app}.zip`);
+  rmSync(zip, { force: true });
+  checkedDitto(["-c", "-k", "--keepParent", app, zip], run);
+  return notarizeMacosArtifact({ archive: zip, receiptPath, profile, authArgs, app, run, env, ...agentOptions });
+}
+
+function checkedDitto(args, run) {
+  const result = run("/usr/bin/ditto", args, { encoding: "utf8" });
+  if (result.error || result.status !== 0) throw new Error(`ditto failed: ${result.error?.message ?? result.stderr ?? result.stdout ?? result.status}`);
+}
+
 export function validateNotarizationReceipt({ receiptPath, archive, run = spawnSync }) {
   let receipt;
   try { receipt = JSON.parse(readFileSync(receiptPath, "utf8")); }

package/managed-cargo.mjs

@@ -56,7 +56,10 @@ export function runCargoSync(args, options = {}, { platform = process.platform,
     }
     return result;
   }
-  if (platform === 'darwin' || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
+  // The Mac never falls back to direct Cargo, except on GitHub Actions runners, which have no
+  // RightKit runtime and use the toolchain's cargo (release-candidate signing jobs).
+  const hostedCi = env.GITHUB_ACTIONS === 'true' && !managedHost(env);
+  if ((platform === 'darwin' && !hostedCi) || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
   return spawn("cargo", args, options);
 }
 

package/msix-appinstaller.mjs

@@ -0,0 +1,24 @@
+// App Installer (.appinstaller) update route for MSIX packages. Trust comes from the
+// MSIX Authenticode signature (publisher must match the manifest); no separate updater key.
+
+const xml = (value) => String(value).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+const fail = (message) => Object.assign(new Error(message), { code: "APPINSTALLER_INVALID" });
+
+export function generateAppInstaller(o) {
+  const errors = [];
+  for (const key of ["uri", "msixUri"]) { try { if (new URL(o[key]).protocol !== "https:") throw 0; } catch { errors.push(`${key} must be an https URL`); } }
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(o.version ?? "")) errors.push("version must be four numeric parts");
+  if (!["x64", "arm64"].includes(o.architecture)) errors.push("architecture must be x64 or arm64");
+  if (!o.name || !o.publisher) errors.push("name and publisher are required");
+  const hours = o.hoursBetweenUpdateChecks ?? 24;
+  if (!Number.isInteger(hours) || hours < 0 || hours > 255) errors.push("hoursBetweenUpdateChecks must be an integer 0-255");
+  if (errors.length) throw fail(errors.join("; "));
+  return `<?xml version="1.0" encoding="utf-8"?>
+<AppInstaller xmlns="http://schemas.microsoft.com/appx/appinstaller/2018" Version="${xml(o.version)}" Uri="${xml(o.uri)}">
+  <MainPackage Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" Uri="${xml(o.msixUri)}" />
+  <UpdateSettings>
+    <OnLaunch HoursBetweenUpdateChecks="${hours}" ShowPrompt="${o.showPrompt ? "true" : "false"}" UpdateBlocksActivation="${o.updateBlocksActivation ? "true" : "false"}" />
+  </UpdateSettings>
+</AppInstaller>
+`;
+}

package/msix-build.mjs

@@ -9,6 +9,9 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { findWindowsSdkTool } from "./preflight.mjs";
+import { generateAppInstaller } from "./msix-appinstaller.mjs";
+import { assertPublisherMatchesSigner, planMsixSigning, verifyPayloadInventory } from "./msix-plan.mjs";
+import { createHash } from "node:crypto";
 
 const fail = (code, message) => Object.assign(new Error(message), { code });
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -33,17 +36,25 @@ export function generateAppxManifest(o) {
   validateMsixIdentity(o);
   const deps = (o.dependencies ?? []).filter((d) => d.minVersion).map((d) =>
     `    <PackageDependency Name="${xml(d.name)}" MinVersion="${xml(d.minVersion)}" Publisher="${xml(d.publisher ?? "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")}" />`);
-  const a = o.assets ?? {};
+  const v = o.virtualization;
+  for (const key of ["fileSystemWrite", "registryWrite"]) {
+    if (v?.[key] !== undefined && !["enabled", "disabled"].includes(v[key])) throw fail("MSIX_INVALID_IDENTITY", `virtualization.${key} must be "enabled" or "disabled"`);
+  }
+  const virt = v ? [["fileSystemWrite", "FileSystemWriteVirtualization"], ["registryWrite", "RegistryWriteVirtualization"]]
+    .filter(([k]) => v[k]).map(([k, el]) => `\n    <desktop6:${el}>${v[k]}</desktop6:${el}>`).join("") : "";
+  // Opting out of virtualization is a restricted capability.
+  const unvirtualized = v && (v.fileSystemWrite === "disabled" || v.registryWrite === "disabled") ? '\n    <rescap:Capability Name="unvirtualizedResources" />' : "";
   return `<?xml version="1.0" encoding="utf-8"?>
 <Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
          xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
          xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+         xmlns:desktop6="http://schemas.microsoft.com/appx/manifest/desktop/windows10/6"
          IgnorableNamespaces="uap rescap">
   <Identity Name="${xml(o.name)}" Publisher="${xml(o.publisher)}" Version="${xml(o.version)}" ProcessorArchitecture="${o.architecture}" />
   <Properties>
     <DisplayName>${xml(o.displayName)}</DisplayName>
     <PublisherDisplayName>${xml(o.publisherDisplayName)}</PublisherDisplayName>
-    <Logo>Assets\\StoreLogo.png</Logo>
+    <Logo>Assets\\StoreLogo.png</Logo>${virt}
   </Properties>
   <Dependencies>
     <TargetDeviceFamily Name="Windows.Desktop" MinVersion="${xml(o.minWindowsVersion ?? "10.0.19041.0")}" MaxVersionTested="${xml(o.maxWindowsVersionTested ?? "10.0.26100.0")}" />
@@ -56,7 +67,7 @@ ${deps.join("\n")}${deps.length ? "\n" : ""}  </Dependencies>
     </Application>
   </Applications>
   <Capabilities>
-    <rescap:Capability Name="runFullTrust" />${(o.capabilities ?? []).map((c) => `\n    <Capability Name="${xml(c)}" />`).join("")}
+    <rescap:Capability Name="runFullTrust" />${unvirtualized}${(o.capabilities ?? []).map((c) => `\n    <Capability Name="${xml(c)}" />`).join("")}
   </Capabilities>
 </Package>
 `;
@@ -89,19 +100,30 @@ export function peFilesIn(root) {
   return readdirSync(root).filter((name) => /\.(exe|dll)$/i.test(name)).sort().map((name) => path.join(root, name));
 }
 
+const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+function readSignerSubject(file, run) {
+  const r = run("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${file.replace(/'/g, "''")}').SignerCertificate.Subject`], { encoding: "utf8", windowsHide: true });
+  return r.status === 0 ? String(r.stdout ?? "").trim() : "";
+}
+
 /**
- * Pack + sign. `run` is injectable for tests. Steps:
- *  1 sign every PE file in the root (raw bytes), 2 makeappx pack, 3 sign the .msix, 4 verify.
- * Windows-only unless dryRun.
+ * Pack + sign. `run` is injectable for tests. Ordered per planMsixSigning():
+ *  assemble, verify-inventory, sign-pe (DLLs then EXEs, raw bytes), pack, sign-msix, verify-msix,
+ *  verify-publisher, appinstaller, seal. Windows-only unless dryRun.
+ * options.runtime = { dlls, systemDlls, dependencies } (declared inventory, verified fail-closed);
+ * options.appInstaller = { uri, msixUri, out, ... } generates the update route after the package is signed.
  */
-export function buildMsix({ stageDir, out, workDir, manifest, assets, sign = true, dryRun = false, receiptDir },
-  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)) } = {}) {
+export function buildMsix({ stageDir, out, workDir, manifest, assets, runtime, appInstaller, sign = true, dryRun = false, receiptDir, peReceipt, msixReceipt },
+  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)), readSubject = (file) => readSignerSubject(file, run) } = {}) {
   out = path.resolve(out);
   if (!out.endsWith(".msix")) throw fail("MSIX_INVALID_OPTIONS", "out must end with .msix");
   validateMsixIdentity(manifest);
   workDir = path.resolve(workDir ?? `${out}.root`);
   const receipts = path.resolve(receiptDir ?? path.dirname(out));
-  const steps = ["assemble", ...(sign ? ["sign-pe"] : []), "pack", ...(sign ? ["sign-msix", "verify-msix"] : [])];
+  const planFor = (files) => planMsixSigning({ files, sign, appInstaller: Boolean(appInstaller) });
+  const staged = existsSync(path.resolve(stageDir)) ? readdirSync(path.resolve(stageDir)) : [];
+  const steps = planFor(staged.filter((n) => /\.(exe|dll)$/i.test(n))).map((p) => p.step);
   if (dryRun) { log({ event: "msix-dry-run", out, steps }); return { out, steps, dryRun: true }; }
   if (platform !== "win32") throw fail("MSIX_NATIVE_HOST_REQUIRED", "MSIX packing and signing must run on Windows");
   const makeappx = env.MAKEAPPX_PATH || findTool("makeappx.exe")?.toolPath;
@@ -113,16 +135,30 @@ export function buildMsix({ stageDir, out, workDir, manifest, assets, sign = tru
   };
   const signer = (files, receipt) => checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--receipt", receipt, ...files]);
   const root = assembleMsixRoot({ stageDir, root: workDir, manifest, assets });
+  const inventory = runtime ? verifyPayloadInventory({ root, inventory: runtime, architecture: manifest.architecture }) : null;
   mkdirSync(receipts, { recursive: true });
-  if (sign) signer(peFilesIn(root), path.join(receipts, "msix-pe-sign.receipt.json"));
+  const ordered = planFor(readdirSync(root).filter((n) => /\.(exe|dll)$/i.test(n))).find((p) => p.step === "sign-pe")?.files ?? [];
+  if (sign) signer(ordered.map((f) => path.join(root, path.basename(f))), peReceipt ?? path.join(receipts, "msix-pe-sign.receipt.json"));
   mkdirSync(path.dirname(out), { recursive: true });
   rmSync(out, { force: true });
   checked(makeappx, ["pack", "/d", root, "/p", out, "/o"]);
   if (!existsSync(out) || statSync(out).size === 0) throw fail("MSIX_PACK_EMPTY", `makeappx produced no package: ${out}`);
   if (sign) {
-    signer([out], path.join(receipts, "msix-sign.receipt.json"));
+    signer([out], msixReceipt ?? path.join(receipts, "msix-sign.receipt.json"));
     checked(process.execPath, [path.join(here, "sign-windows.mjs"), "--verify-only", out]);
+    assertPublisherMatchesSigner(manifest.publisher, readSubject(out));
+  }
+  let appInstallerFile = null;
+  if (appInstaller) {
+    appInstallerFile = path.resolve(appInstaller.out);
+    mkdirSync(path.dirname(appInstallerFile), { recursive: true });
+    writeFileSync(appInstallerFile, generateAppInstaller({ ...appInstaller, name: manifest.name, publisher: manifest.publisher, version: manifest.version, architecture: manifest.architecture }));
   }
+  const seal = { schema: 1, msix: { file: out, sha256: sha256(out), sizeBytes: statSync(out).size }, signed: sign, identity: { name: manifest.name, version: manifest.version, publisher: manifest.publisher, architecture: manifest.architecture },
+    payload: readdirSync(root, { recursive: true }).map((n) => String(n).split(path.sep).join("/")).filter((n) => statSync(path.join(root, n)).isFile()).sort().map((n) => ({ name: n, sha256: sha256(path.join(root, n)) })), inventory,
+    appInstaller: appInstallerFile && { file: appInstallerFile, sha256: sha256(appInstallerFile) } };
+  const sealFile = path.join(receipts, "msix-seal.json");
+  writeFileSync(sealFile, `${JSON.stringify(seal, null, 2)}\n`);
   log({ event: "msix-built", out, signed: sign });
-  return { out, steps, root, signed: sign };
+  return { out, steps, root, signed: sign, seal: sealFile, appInstaller: appInstallerFile };
 }

package/msix-config.mjs

@@ -0,0 +1,70 @@
+// `msix` target schema for right-release configs (targets.win.msix) and the
+// `windows-msix-signed-v1` signing contract. Pure validation; no I/O.
+//
+// targets.win = {
+//   signed: true, signingContract: "windows-msix-signed-v1",
+//   projectType: "swiftpm",                      // optional; auto-detected from Package.swift
+//   prePackage: { cmd, args },                   // SwiftPM build + stage (swift-package windows-stage)
+//   msix: {
+//     stageDir, out,                             // flat payload dir produced by prePackage; .msix path
+//     identity: { name, publisher, publisherDisplayName, displayName, description?, version, architecture, executable },
+//     capabilities: ["internetClient"], minWindowsVersion?, maxWindowsVersionTested?,
+//     virtualization: { fileSystemWrite: "enabled|disabled", registryWrite: "enabled|disabled" },  // explicit, required
+//     assets: { storeLogo, square150, square44 },
+//     runtime: { dlls: ["swiftCore.dll", ...], systemDlls?: [], dependencies?: [{ name, minVersion, provides: [] }] },
+//     appInstaller?: { uri, msixUri, out, hoursBetweenUpdateChecks?, showPrompt?, updateBlocksActivation? },
+//   },
+//   updater?: { kind: "tauri" | "appinstaller", artifacts: [...] },   // tauri stays the default
+//   installer: { artifacts: [{ file: "<out>.msix", key }] },
+// }
+
+export const MSIX_SIGNING_CONTRACT = "windows-msix-signed-v1";
+export const UPDATER_KINDS = Object.freeze(["tauri", "appinstaller"]);
+export const VIRTUALIZATION_VALUES = Object.freeze(["enabled", "disabled"]);
+
+export const isMsixTarget = (target) => target?.signingContract === MSIX_SIGNING_CONTRACT;
+export const updaterKind = (target) => target?.updater?.kind ?? "tauri";
+
+const isHttps = (value) => { try { return new URL(value).protocol === "https:"; } catch { return false; } };
+
+/** Returns an array of human-readable problems (empty when valid). */
+export function validateMsixTarget(target, app = "app") {
+  const e = [];
+  const at = (message) => e.push(`${app} win msix: ${message}`);
+  if (!isMsixTarget(target)) at(`signingContract must be ${MSIX_SIGNING_CONTRACT}`);
+  const m = target?.msix;
+  if (!m || typeof m !== "object") { at("msix block is required"); return e; }
+  if (!target.prePackage?.cmd) at("prePackage is required (SwiftPM build + payload staging)");
+  if (target.sign?.prePackageFiles?.length || target.sign?.files?.length) at("omit sign.prePackageFiles/sign.files: the msix step signs payload PE files, then the package");
+  if (!m.stageDir) at("msix.stageDir is required");
+  if (!/\.msix$/i.test(m.out ?? "")) at("msix.out must end with .msix");
+  const id = m.identity ?? {};
+  for (const key of ["name", "publisher", "publisherDisplayName", "displayName", "version", "architecture", "executable"]) if (!id[key]) at(`msix.identity.${key} is required`);
+  const v = m.virtualization ?? {};
+  for (const key of ["fileSystemWrite", "registryWrite"]) {
+    if (!VIRTUALIZATION_VALUES.includes(v[key])) at(`msix.virtualization.${key} must be explicitly "enabled" or "disabled"`);
+  }
+  for (const key of ["storeLogo", "square150", "square44"]) if (!m.assets?.[key]) at(`msix.assets.${key} (PNG) is required`);
+  const dlls = m.runtime?.dlls;
+  if (!Array.isArray(dlls)) at("msix.runtime.dlls (explicit runtime dependency inventory; use [] only for a dependency-free app) is required");
+  else if (dlls.some((d) => !/\.dll$/i.test(d) || /[\\/]/.test(d))) at("msix.runtime.dlls entries must be flat .dll names");
+  const kind = updaterKind(target);
+  if (!UPDATER_KINDS.includes(kind)) at(`updater.kind must be one of ${UPDATER_KINDS.join(", ")}`);
+  if (kind === "appinstaller") {
+    const a = m.appInstaller;
+    if (!a) at("updater.kind appinstaller requires msix.appInstaller");
+    else {
+      if (!isHttps(a.uri)) at("msix.appInstaller.uri must be an https URL");
+      if (!isHttps(a.msixUri)) at("msix.appInstaller.msixUri must be an https URL");
+      if (!/\.appinstaller$/i.test(a.out ?? "")) at("msix.appInstaller.out must end with .appinstaller");
+    }
+  }
+  const outName = String(m.out ?? "").split(/[\\/]/).pop();
+  if (outName && !(target.installer?.artifacts ?? []).some((a) => String(a.file).split(/[\\/]/).pop() === outName)) at("installer.artifacts must list the .msix so it is sealed");
+  return e;
+}
+
+export function assertValidMsixTarget(target, app) {
+  const errors = validateMsixTarget(target, app);
+  if (errors.length) throw Object.assign(new Error(errors.join("; ")), { code: "MSIX_CONFIG_INVALID" });
+}

package/msix-plan.mjs

@@ -0,0 +1,68 @@
+// Pure planning/verification helpers for MSIX packaging: signing order, runtime
+// dependency inventory, publisher/signer match. No signing, no process spawns.
+
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { readPeImports } from "./pe-imports.mjs";
+import { WINDOWS_SYSTEM_DLLS } from "./swift-windows-stage.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const lower = (v) => String(v).toLowerCase();
+const isApiSet = (name) => /^(api|ext)-ms-win-[a-z0-9-]+-l\d+-\d+-\d+\.dll$/.test(name);
+
+/**
+ * Immutable ordering (docs/rules/release-signing.md): inner PE files (DLLs, then EXEs) are signed
+ * before packing, the package is signed after, verification follows, then seal. Returns step list.
+ */
+export function planMsixSigning({ files, sign = true, appInstaller = false }) {
+  const pe = files.filter((f) => /\.(dll|exe)$/i.test(f));
+  const rank = (f) => (/\.dll$/i.test(f) ? 0 : 1);
+  const ordered = [...pe].sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+  return [
+    { step: "assemble" },
+    { step: "verify-inventory" },
+    ...(sign ? [{ step: "sign-pe", files: ordered }] : []),
+    { step: "pack" },
+    ...(sign ? [{ step: "sign-msix" }, { step: "verify-msix" }, { step: "verify-publisher" }] : []),
+    ...(appInstaller ? [{ step: "appinstaller" }] : []),
+    { step: "seal" },
+  ];
+}
+
+/**
+ * Fail closed unless (a) every DLL in the declared inventory is in the payload and (b) every PE in the
+ * payload imports only payload files, Windows system DLLs/API sets, or DLLs provided by a declared
+ * package dependency. Equivalent to `dumpbin /dependents` closure, but host independent.
+ */
+export function verifyPayloadInventory({ root, inventory = {}, architecture }) {
+  const names = readdirSync(root);
+  const present = new Set(names.map(lower));
+  const problems = [];
+  for (const dll of inventory.dlls ?? []) if (!present.has(lower(dll))) problems.push(`declared runtime DLL missing from payload: ${dll}`);
+  const system = new Set([...WINDOWS_SYSTEM_DLLS, ...(inventory.systemDlls ?? [])].map(lower));
+  const provided = new Set((inventory.dependencies ?? []).flatMap((d) => d.provides ?? []).map(lower));
+  const observed = new Set();
+  for (const name of names.filter((n) => /\.(exe|dll)$/i.test(n))) {
+    const info = readPeImports(readFileSync(path.join(root, name)));
+    if (architecture && info.architecture !== architecture) problems.push(`${name} is ${info.architecture}, package is ${architecture}`);
+    for (const dep of [...info.imports, ...info.delayImports]) {
+      const key = lower(dep);
+      observed.add(key);
+      if (!present.has(key) && !system.has(key) && !isApiSet(key) && !provided.has(key)) problems.push(`${name} imports ${dep}, which is neither in the payload, a system DLL, nor provided by a declared dependency`);
+    }
+  }
+  // Declared-but-never-imported DLLs are reported (not fatal): they may be loaded dynamically.
+  const unreferenced = (inventory.dlls ?? []).filter((d) => !observed.has(lower(d)));
+  if (problems.length) throw fail("MSIX_INVENTORY_INCOMPLETE", problems.join("; "));
+  return { dlls: [...(inventory.dlls ?? [])], unreferenced };
+}
+
+const normalizeDn = (dn) => String(dn).split(/,(?=\s*[A-Za-z]+=)/).map((p) => p.trim().replace(/\s*=\s*/, "=")).sort().join(",");
+
+/** The package signer's certificate subject must equal Identity/@Publisher or Windows refuses to install. */
+export function assertPublisherMatchesSigner(publisher, signerSubject) {
+  if (!signerSubject) throw fail("MSIX_PUBLISHER_MISMATCH", "could not read the signer certificate subject from the signed package");
+  if (normalizeDn(publisher) !== normalizeDn(signerSubject)) {
+    throw fail("MSIX_PUBLISHER_MISMATCH", `manifest Publisher "${publisher}" does not equal signer subject "${signerSubject}"; set identity.publisher to the signer subject`);
+  }
+}

package/msix-target.mjs

@@ -0,0 +1,28 @@
+// Map a validated targets.win.msix config block onto buildMsix() options.
+import path from "node:path";
+import { assertValidMsixTarget, updaterKind } from "./msix-config.mjs";
+
+export function msixBuildOptions({ root, target, app, sign = true, dryRun = false, receipts = {} }) {
+  assertValidMsixTarget(target, app);
+  const m = target.msix;
+  const at = (p) => path.resolve(root, p);
+  const manifest = {
+    ...m.identity,
+    capabilities: m.capabilities,
+    dependencies: m.runtime?.dependencies,
+    minWindowsVersion: m.minWindowsVersion,
+    maxWindowsVersionTested: m.maxWindowsVersionTested,
+    virtualization: m.virtualization,
+  };
+  return {
+    stageDir: at(m.stageDir),
+    out: at(m.out),
+    manifest,
+    assets: Object.fromEntries(Object.entries(m.assets).map(([k, v]) => [k, at(v)])),
+    runtime: m.runtime,
+    appInstaller: updaterKind(target) === "appinstaller" ? { ...m.appInstaller, out: at(m.appInstaller.out) } : undefined,
+    sign, dryRun,
+    peReceipt: receipts.pe, msixReceipt: receipts.msix,
+    receiptDir: receipts.dir,
+  };
+}

package/ownership.mjs

@@ -234,7 +234,31 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
   return { files, coverage, committed: true, pathPrefix, repositoryFiles, snapshotFiles: new Map(repositoryFiles.map((file) => [file.rel, file])) };
 }
 
+// Blank out Swift `//` and nested `/* */` comments outside string literals, keeping offsets.
+export function stripSwiftComments(text) {
+  const out = text.split("");
+  let quote = false, depth = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (depth) {
+      if (text.startsWith("/*", i)) { depth++; out[i] = out[i + 1] = " "; i++; continue; }
+      if (text.startsWith("*/", i)) { depth--; out[i] = out[i + 1] = " "; i++; continue; }
+      if (text[i] !== "\n") out[i] = " ";
+      continue;
+    }
+    if (quote) {
+      if (text[i] === "\\") { i++; continue; }
+      if (text[i] === '"' || text[i] === "\n") quote = false;
+      continue;
+    }
+    if (text[i] === '"') { quote = true; continue; }
+    if (text.startsWith("//", i)) { for (; i < text.length && text[i] !== "\n"; i++) out[i] = " "; continue; }
+    if (text.startsWith("/*", i)) { depth = 1; out[i] = out[i + 1] = " "; i++; }
+  }
+  return out.join("");
+}
+
 function swiftPackageArguments(text) {
+  text = stripSwiftComments(text);
   const args = [];
   for (const match of text.matchAll(/\.package\s*\(/g)) {
     let at = match.index + match[0].length, start = at, depth = 1, quote = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.138",
+  "version": "0.2.140",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/preflight.mjs

@@ -23,6 +23,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
+import { isSwiftProject } from "./project-type.mjs";
 
 export const PREFLIGHT_OK = "ok";
 export const PREFLIGHT_WARN = "warn";
@@ -179,11 +180,24 @@ export function collectPreflight({
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
+  projectType,
+  msix = false,
+  findSdkTool = findWindowsSdkTool,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
+  const swift = isSwiftProject(projectType);
 
-  if (appRoot) {
+  if (swift) {
+    const swiftVersion = versionProbe("swift");
+    checks.push(
+      swiftVersion
+        ? ok("swift", swiftVersion)
+        : fail("swift", "swift was not found on PATH; SwiftPM apps build with the Swift toolchain", "install the pinned Swift toolchain (swift.org / Swift on Windows) and verify: swift --version"),
+    );
+  }
+
+  if (appRoot && !swift) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -225,29 +239,27 @@ export function collectPreflight({
   }
 
   if (windows) {
-    const makeappx = findWindowsSdkTool("makeappx.exe");
-    checks.push(
-      makeappx
-        ? ok("windows-sdk", `makeappx.exe from SDK ${makeappx.version}`)
-        : fail(
-            "windows-sdk",
-            "no makeappx.exe found under any installed Windows 10/11 SDK",
-            "install the Windows SDK, or set MAKEAPPX_PATH to an explicit makeappx.exe",
-          ),
-    );
+    // makeappx/signtool are MSIX requirements; NSIS/portable targets sign through sign-windows.
+    if (msix) {
+      const makeappx = process.env.MAKEAPPX_PATH ? { version: "MAKEAPPX_PATH" } : findSdkTool("makeappx.exe");
+      checks.push(
+        makeappx
+          ? ok("windows-sdk", `makeappx.exe from SDK ${makeappx.version}`)
+          : fail(
+              "windows-sdk",
+              "msix target configured but no makeappx.exe found under any installed Windows 10/11 SDK",
+              "install the Windows SDK, or set MAKEAPPX_PATH to an explicit makeappx.exe",
+            ),
+      );
+    }
 
-    const signtool = findWindowsSdkTool("signtool.exe");
-    checks.push(
-      signtool
-        ? ok("signtool", `signtool.exe from SDK ${signtool.version}`)
-        : warn(
-            "signtool",
-            "no signtool.exe found under any installed Windows SDK",
-            "install the Windows SDK Build Tools, or set AZURE_SIGNTOOL_PATH",
-          ),
-    );
+    const signtool = findSdkTool("signtool.exe");
+    const signtoolMissing = "install the Windows SDK Build Tools, or set AZURE_SIGNTOOL_PATH";
+    if (signtool) checks.push(ok("signtool", `signtool.exe from SDK ${signtool.version}`));
+    else if (msix) checks.push(fail("signtool", "msix target configured but no signtool.exe found under any installed Windows SDK", signtoolMissing));
+    else checks.push(warn("signtool", "no signtool.exe found under any installed Windows SDK", signtoolMissing));
 
-    const vendorsOpenssl = cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
+    const vendorsOpenssl = !swift && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
     if (vendorsOpenssl) {
       const perl = resolveWindowsPerl({ env });
       checks.push(
@@ -262,7 +274,9 @@ export function collectPreflight({
     }
   }
 
-  if (isBrokerManagedHost(env)) {
+  if (swift) {
+    // No Rust compiler cache applies to SwiftPM targets.
+  } else if (isBrokerManagedHost(env)) {
     checks.push(ok("compiler-cache", "broker-managed; compiler-cache selection and status are recorded in build receipts"));
   } else {
     const sccache = versionProbe("sccache");

package/project-type.mjs

@@ -0,0 +1,43 @@
+// Project-type awareness for release preflight: which toolchain a target needs.
+// Pure; filesystem access is injectable. Swift (SwiftPM) apps need `swift`, not
+// cargo/rustc; Tauri/Rust targets keep their existing requirements.
+
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+export const PROJECT_TYPES = Object.freeze(["tauri", "cargo", "swiftpm"]);
+
+/**
+ * Explicit `target.projectType` / `config.projectType` wins. Otherwise a Package.swift with no Cargo
+ * manifest (root or src-tauri) is swiftpm; everything else is tauri/cargo (unchanged behaviour).
+ */
+export function resolveProjectType({ appRoot, config = {}, target = {}, exists = existsSync } = {}) {
+  const explicit = target.projectType ?? config.projectType;
+  if (explicit !== undefined) {
+    if (!PROJECT_TYPES.includes(explicit)) throw Object.assign(new Error(`projectType must be one of ${PROJECT_TYPES.join(", ")}; got ${explicit}`), { code: "PROJECT_TYPE_INVALID" });
+    return explicit;
+  }
+  if (appRoot) {
+    const roots = [appRoot, path.resolve(appRoot, config.workdir ?? ".")];
+    const hasSwift = roots.some((r) => exists(path.join(r, "Package.swift")));
+    const hasCargo = roots.some((r) => exists(path.join(r, "Cargo.toml")) || exists(path.join(r, "src-tauri", "Cargo.toml")));
+    if (hasSwift && !hasCargo) return "swiftpm";
+  }
+  return "tauri";
+}
+
+export const isSwiftProject = (projectType) => projectType === "swiftpm";
+
+/** Executables the build itself needs (the config's own preflight.executables are appended by callers). */
+export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true } = {}) {
+  if (isSwiftProject(projectType)) return ["git", "swift", ...(usesPackageManager && packageManager ? [packageManager] : [])];
+  return ["git", packageManager, "cargo", "rustc"];
+}
+
+/** True when the Windows target packages an MSIX (needs makeappx and signtool). */
+export function targetUsesMsix(target) {
+  return Boolean(target?.msix) || target?.signingContract === "windows-msix-signed-v1";
+}
+
+/** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
+export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/publish-update.mjs

@@ -75,6 +75,12 @@ const artifactFile = (declared) => {
   return artifact.file;
 };
 const verifiedArtifact = (file) => sealed.artifacts.get(path.basename(file));
+// MSIX updates (updater.kind appinstaller) trust the package Authenticode signature (publisher-pinned in
+// the manifest), so no minisign .sig exists; the route records the sealed package digest instead.
+const appInstallerKind = target?.updater?.kind === "appinstaller";
+const signatureFor = (artifact) => appInstallerKind
+  ? `msix-authenticode-sha256:${assertArtifactUnchanged(verifiedArtifact(artifact.file)) && verifiedArtifact(artifact.file).sha256}`
+  : signatureText(artifactFile(artifact.signature));
 const signatureText = (file) => {
   const signature = assertArtifactUnchanged(verifiedArtifact(file)).toString("utf8").trim();
   if (!signature) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", `sealed updater signature is empty: ${file}`);
@@ -89,7 +95,7 @@ function git(args) {
 if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
-if (sealed) for (const artifact of artifacts) signatureText(artifactFile(artifact.signature));
+if (sealed) for (const artifact of artifacts) signatureFor(artifact);
 let releaseToken = null;
 if (!dryRun && (tier === "update" || artifacts.length > 0)) {
   try {
@@ -114,13 +120,13 @@ if (tier === "patch") {
     const installerKey = patchInstallerKey(artifact);
     assertCurrentKey(installerKey, "installer");
     const file = artifactFile(artifact.file);
-    const signatureFile = artifactFile(artifact.signature);
+    if (!appInstallerKind) artifactFile(artifact.signature);
     if (!uploadedKeys.has(installerKey)) {
       console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}`);
       if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installerKey, "public", { cwd: root });
       uploadedKeys.add(installerKey);
     }
-    const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
+    const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
     platforms[artifact.platform] = {
@@ -210,13 +216,13 @@ const uploadedKeys = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = artifactFile(artifact.file);
-  const signatureFile = artifactFile(artifact.signature);
+  if (!appInstallerKind) artifactFile(artifact.signature);
   if (!uploadedKeys.has(artifact.key)) {
     console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`);
     if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), artifact.key, "private", { cwd: root });
     uploadedKeys.add(artifact.key);
   }
-  const signature = dryRun ? `<signature:${artifact.signature}>` : signatureText(signatureFile);
+  const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
   platforms[artifact.platform] = {

package/release-invocation.mjs

@@ -1,4 +1,5 @@
 import { spawnSync } from "./background-process.mjs";
+import { resolveProjectType } from "./project-type.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
@@ -128,18 +129,19 @@ export function resolveConfiguredBuildInputs(config, target, label = "release co
 }
 
 export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
+  const swift = resolveProjectType({ appRoot, config, target }) === "swiftpm";
   const nativeLayout = resolveNativeCargoLayout({
     appRoot,
     config,
-    requireManifest: true,
-    requireLock: true,
+    requireManifest: !swift,
+    requireLock: !swift,
   });
   const requiredInputs = [
     configPath,
-    path.join(appRoot, "package.json"),
-    path.join(appRoot, "pnpm-lock.yaml"),
-    nativeLayout.manifestPath,
-    nativeLayout.lockPath,
+    ...(swift
+      // SwiftPM: Package.swift is required; Package.resolved and the Node manifests only when they exist.
+      ? [path.join(appRoot, "Package.swift"), ...["Package.resolved", "package.json", "pnpm-lock.yaml"].map((f) => path.join(appRoot, f)).filter((f) => existsSync(f))]
+      : [path.join(appRoot, "package.json"), path.join(appRoot, "pnpm-lock.yaml"), nativeLayout.manifestPath, nativeLayout.lockPath]),
     ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
   ].filter((file, index, files) => files.indexOf(file) === index);
   for (const file of requiredInputs) {