@rightkit/release 0.2.138 → 0.2.140

package/release.mjs

@@ -17,13 +17,17 @@ import {
   resolveNativeFinalizerConfig,
   validateNativeFinalizationOutput,
 } from "./native-release-finalization.mjs";
+import { packageCommandOptional, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
+import { MSIX_SIGNING_CONTRACT, assertValidMsixTarget } from "./msix-config.mjs";
+import { buildMsix } from "./msix-build.mjs";
+import { msixBuildOptions } from "./msix-target.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 import { signingReceiptPath } from "./signing-receipts.mjs";
-import { validateNotarizationReceipt } from "./macos-notarization.mjs";
+import { notarizeAppBundle, validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { runConfiguredChecks } from "./release-checks.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
@@ -118,7 +122,10 @@ const workdir = path.resolve(root, config.workdir ?? ".");
 const nativeLayout = resolveNativeCargoLayout({ appRoot: root, config });
 const nativeAssembly = config.nativeAssembly;
 const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
-await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
+// A SwiftPM app without a package.json has no Node package contract to validate.
+if (!(resolveProjectType({ appRoot: root, config, target: config.targets?.[opts.platform] }) === "swiftpm" && !existsSync(path.join(root, "package.json")))) {
+  await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
+}
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
@@ -131,26 +138,32 @@ if (target.signed !== true) {
 if (opts.platform === "win") {
   const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
   const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
-  if (!isNsis && !isPortable) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT} or ${WINDOWS_PORTABLE_SIGNING_CONTRACT}`);
+  const isMsix = target.signingContract === MSIX_SIGNING_CONTRACT;
+  if (!isNsis && !isPortable && !isMsix) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT}, ${WINDOWS_PORTABLE_SIGNING_CONTRACT} or ${MSIX_SIGNING_CONTRACT}`);
+  if (isMsix) {
+    try { assertValidMsixTarget(target, config.app ?? "app"); } catch (error) { fail(error.message); }
+  } else {
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
   if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
   if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
   if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
   if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
+  }
 }
 if (opts.platform === "mac") {
   if (target.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT) fail(`${config.app ?? "app"} mac must declare signingContract: ${MACOS_PORTABLE_SIGNING_CONTRACT}`);
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} mac must declare prePackage to materialize Developer ID signing files`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
   if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
+  if (target.notarize.appBeforePackage && !target.notarize.app) fail(`${config.app ?? "app"} mac notarize.appBeforePackage requires notarize.app`);
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout, projectTarget = config.targets?.[platform] }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -173,6 +186,8 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
     cargoLockPaths,
     nativeLayout: suppliedNativeLayout,
     targetLink: suppliedNativeLayout?.targetLink,
+    projectType: resolveProjectType({ appRoot: root, config, target: projectTarget }),
+    msix: targetUsesMsix(projectTarget),
   });
 }
 
@@ -234,7 +249,7 @@ if (opts.doctor) {
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
-if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (!command && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
   fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
 }
@@ -255,7 +270,17 @@ await runConfiguredChecks({
 
 let nativeFinalization = null;
 let bundleMarkerReceipts = [];
-if (opts.platform === "win") {
+if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT) {
+  // MSIX order: prePackage builds + stages the payload; buildMsix signs inner PE files (DLLs, EXEs),
+  // packs the exact signed bytes, signs the package through sign-windows, verifies signer == Publisher,
+  // writes the App Installer route and the seal record. Never a second signer.
+  await runCommand(target.prePackage, root);
+  const options = msixBuildOptions({ root, target, app: config.app, dryRun: opts.dryRun, receipts: {
+    pe: windowsReceiptPath(root, "raw-exe"), msix: windowsReceiptPath(root, "installer"),
+    dir: path.dirname(windowsReceiptPath(root, "raw-exe")) } });
+  const built = buildMsix(options, { log: (event) => console.log(`right-release: ${JSON.stringify(event)}`) });
+  console.log(`right-release: msix ${built.dryRun ? "dry-run" : "built"} ${options.out}`);
+} else if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
   await runCommand(target.prePackage, root);
   for (const file of rawFiles) await mustExist(file, `missing raw EXE signing artifact: ${file}`);
@@ -286,7 +311,11 @@ if (opts.platform === "win") {
   // Resolve after prePackage: with storage governance the artifact may live only in RIGHT_RELEASE_ARTIFACT_DIR.
   const signingFiles = target.sign.prePackageFiles.map((p) => resolveReleaseArtifactPath(root, p));
   for (const file of signingFiles) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
-  if (runMacPhase("sign")) await signMacos(signingFiles, root);
+  if (runMacPhase("sign")) {
+    await signMacos(signingFiles, root);
+    // Opt-in (notarize.appBeforePackage): staple the .app itself before the package step copies it into the DMG.
+    if (target.notarize.appBeforePackage) await notarizeAppBeforePackage(root);
+  }
 } else if (nativeAssembly) {
   if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
   if (nativeFinalizer) {
@@ -300,7 +329,7 @@ if (opts.platform === "win") {
   }
 }
 
-if (opts.platform !== "mac" || runMacPhase("package")) await runCommand(command, root);
+if (command && (opts.platform !== "mac" || runMacPhase("package"))) await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
   await mustExist(resolveReleaseArtifactPath(root, rel), `missing release artifact: ${rel}`);
@@ -373,7 +402,7 @@ releaseLock.release();
 
 function usage(code, message) {
   if (message) console.error(`right-release: ${message}\n`);
-  console.error("usage: node release.mjs --tier patch|update [--config right-release.config.mjs] [--platform mac|win] [--upload|--no-upload] [--install] [--dry-run] [--doctor]");
+  console.error("usage: right-release build --platform mac|win [--config right-release.config.mjs]   (build is tier-neutral; tier applies only to: right-release upload --release <id> --platform mac|win --tier patch|update)");
   process.exit(code);
 }
 
@@ -846,7 +875,8 @@ async function notarizeMacos(archive, root) {
   if (opts.dryRun) args.push("--dry-run");
   args.push("--receipt", receipt);
   if (target.notarize.profile) args.push("--profile", target.notarize.profile);
-  if (target.notarize.app) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
+  // With appBeforePackage the app already carries its own stapled ticket inside the packaged DMG.
+  if (target.notarize.app && !target.notarize.appBeforePackage) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
   args.push(archive);
   if (!opts.dryRun && existsSync(receipt)) unlinkSync(receipt);
   console.log("right-release: notarizing macOS archive");
@@ -854,6 +884,21 @@ async function notarizeMacos(archive, root) {
   if (!opts.dryRun) verifyMacosNotarizationReceipt(receipt, archive);
 }
 
+async function notarizeAppBeforePackage(root) {
+  const app = resolveReleaseArtifactPath(root, target.notarize.app);
+  const receipt = macosReceiptPath(root, "app-notarization");
+  const zip = `${app}.zip`;
+  console.log("right-release: notarizing and stapling macOS app before packaging");
+  if (opts.dryRun) { console.log(`dry-run: notarize app ${app} (zip ${zip}) receipt ${receipt}`); return; }
+  await mustExist(app, `missing macOS app bundle for notarize.app: ${app}`);
+  if (existsSync(receipt)) unlinkSync(receipt);
+  try {
+    notarizeAppBundle({ app, zip, receiptPath: receipt, profile: target.notarize.profile });
+    validateNotarizationReceipt({ receiptPath: receipt, archive: zip });
+  } catch (error) { fail(`app notarization failed: ${error.message}`); }
+  finally { rmSync(zip, { force: true }); }
+}
+
 function macosReceiptPath(root, phase) {
   return signingReceiptPath({ appRoot: root, target, platform: "mac", phase, stateRoot: process.env.RIGHT_RELEASE_STATE_ROOT });
 }

package/rightkit-versions.json

@@ -16,7 +16,7 @@
     "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
     "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.31",
+    "@rightkit/git": "0.2.32",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.138",
+    "@rightkit/release": "0.2.140",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -72,7 +72,8 @@
       "0.2.27",
       "0.2.28",
       "0.2.29",
-      "0.2.30"
+      "0.2.30",
+      "0.2.31"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -168,7 +169,9 @@
       "0.2.134",
       "0.2.135",
       "0.2.136",
-      "0.2.137"
+      "0.2.137",
+      "0.2.138",
+      "0.2.139"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -275,11 +278,11 @@
     "rightkit-framed-sidecar": "0.1.0",
     "rightkit-fs": "0.3.2",
     "rightkit-fsindex": "0.1.0",
-    "rightkit-http": "0.2.2",
+    "rightkit-http": "0.2.4",
     "rightkit-jobs": "0.2.6",
     "rightkit-license": "0.1.3",
     "rightkit-logs": "0.2.0",
-    "rightkit-mcp": "0.5.1",
+    "rightkit-mcp": "0.5.2",
     "rightkit-media": "0.2.4",
     "rightkit-models": "0.2.7",
     "rightkit-oauth": "0.3.0",
@@ -332,11 +335,11 @@
       "rightkit-framed-sidecar": "0.1.0",
       "rightkit-fs": "0.3.2",
       "rightkit-fsindex": "0.1.0",
-      "rightkit-http": "0.2.2",
+      "rightkit-http": "0.2.4",
       "rightkit-jobs": "0.2.6",
       "rightkit-license": "0.1.3",
       "rightkit-logs": "0.2.0",
-      "rightkit-mcp": "0.5.1",
+      "rightkit-mcp": "0.5.2",
       "rightkit-media": "0.2.4",
       "rightkit-models": "0.2.7",
       "rightkit-oauth": "0.3.0",
@@ -367,7 +370,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.31",
+      "@rightkit/git": "0.2.32",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -380,7 +383,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.138",
+      "@rightkit/release": "0.2.140",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -432,7 +435,8 @@
       "0.3.0",
       "0.3.1",
       "0.4.0",
-      "0.5.0"
+      "0.5.0",
+      "0.5.1"
     ],
     "rightkit-media": [
       "0.2.2",
@@ -504,7 +508,9 @@
     "rightkit-http": [
       "0.1.0",
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-fs": [
       "0.1.0",

package/source-gate.mjs

@@ -10,8 +10,29 @@
 // real risk is shipping stale, dirty, or untested source. Distribution trust still
 // comes from OS code signing, notarization, and the Tauri updater key — untouched.
 
+// right-release's own per-platform run lock (`.right-release/locks/*`, every platform) is
+// written before the later clean-tree preflights run. Only untracked files directly in that lock directory are
+// exempt, so repos that do not ignore `.right-release/` still pass, and nothing else in
+// the vault (sealed output, receipts, state) or elsewhere is ever excused.
+const OWN_LOCK_RECORD = /^\?\? (?:[^\0]*\/)?\.right-release\/locks\/[^\0/]+$/;
+
+/** Remove right-release's own untracked lock-file records from NUL-separated porcelain v1 output. */
+export function stripOwnLockRecords(status) {
+  const records = status.split("\0");
+  const kept = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    if (!record) continue;
+    if (OWN_LOCK_RECORD.test(record)) continue;
+    kept.push(record);
+    if (/^[RC]/.test(record) || /^.[RC]/.test(record)) kept.push(records[++index] ?? "");
+  }
+  return kept.length ? `${kept.join("\0")}\0` : "";
+}
+
 export function assertCleanSource({ status, commandId = "release" }) {
   if (typeof status !== "string") throw new Error("release source status is required");
+  status = stripOwnLockRecords(status);
   if (status.length !== 0) {
     const files = status.split("\0").filter(Boolean).map((entry) => entry.slice(3)).slice(0, 10);
     throw new Error(`${commandId} requires a clean working tree; commit or stash first:\n${files.map((file) => `- ${file}`).join("\n")}`);

package/swift-build-context.mjs

@@ -0,0 +1,43 @@
+// Everything the sealed `build` path does differently for a SwiftPM target, as pure/stub-friendly
+// functions so build-release.mjs only branches once. Rust-only steps (rustc/cargo probes, Cargo lock
+// identity, broker cargo target, Cache V2 shared Rust cache, target bridge, CARGO/SCCACHE env) are skipped.
+
+import path from "node:path";
+import { resolveSwiftCacheIdentity } from "./cache-policy.mjs";
+
+const RUST_ENV = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "SCCACHE_IGNORE_SERVER_IO_ERROR", "RUSTFLAGS", "RIGHT_RELEASE_CACHE_OWNER"];
+
+export function swiftArchitecture({ target = {}, platform, hostArch = process.arch }) {
+  const arch = target.msix?.identity?.architecture ?? target.architecture ?? (hostArch === "arm64" ? "arm64" : "x64");
+  return platform === "mac" ? (arch === "x64" ? "x86_64" : arch) : arch;
+}
+
+/** exec(cmd, args) -> stdout string. Throws when swift is missing. */
+export function collectSwiftToolVersions({ packageManager, exec, nodeVersion = process.version }) {
+  const swift = exec("swift", ["--version"]).trim();
+  if (!swift) throw new Error("swift --version printed nothing");
+  return { node: nodeVersion, packageManager: packageManager ? `${packageManager} ${exec(packageManager, ["--version"]).trim()}` : null, swift, cargo: null, rustc: null, rustHost: null, sccache: null };
+}
+
+/**
+ * Plan for a swiftpm sealed build: identity, forced non-shared cache mode, no broker cargo target, no target
+ * bridge, a plain build/cache dir under the vault, and an environment with every Rust variable removed.
+ */
+export function planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions, profile = "release", hostArch }) {
+  const architecture = swiftArchitecture({ target, platform, hostArch });
+  const identity = resolveSwiftCacheIdentity({ swiftVersion: toolVersions.swift, packageResolvedPath: path.join(appRoot, "Package.resolved"), architecture, profile: target.profile ?? profile });
+  const buildDir = path.resolve(vaultRoot, "cache", "swift-build", platform, identity.fingerprint);
+  return {
+    identity, architecture, buildDir,
+    cacheMode: "legacy",
+    managedCargoTarget: null,
+    targetBridge: { run: (fn) => fn(), ensure() {} },
+    sanitizeEnv(env) {
+      const next = { ...env };
+      for (const name of RUST_ENV) delete next[name];
+      next.RIGHT_RELEASE_SWIFT_BUILD_DIR = buildDir;
+      return next;
+    },
+    watchDirs: [buildDir, path.join(appRoot, ".build")],
+  };
+}