@rightkit/release 0.2.143 → 0.2.145

package/ownership-policy-bundle.mjs

@@ -0,0 +1,155 @@
+// Protected policy bundle: one digest over everything that decides ownership enforcement, so editing the
+// scanner/verifier code (or the allowlist/registry) while keeping the catalog cannot weaken enforcement.
+// Trust-sync pins the bundle into protected trust; release/admission gates refuse when the running bundle differs.
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { canonicalJson } from "./ownership-approval.mjs";
+import { ALLOWLIST_FILE, diffAllowlists, validateAllowlist } from "./ownership-dependency-allowlist.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const MODULE_SPECIFIERS = /^\s*(?:import|export)\s[^'";]*?from\s*['"]([^'"]+)['"]|^\s*import\s*['"]([^'"]+)['"]/gm;
+const HEX = /^[a-f0-9]{64}$/;
+export const POLICY_BUNDLE_SCHEMA = 1;
+const CATALOG_FILE = "rightkit-ownership.json";
+const REGISTRY_FILE = "ownership-repositories.json";
+// Step 4: the release QA requirement floor is protected like the catalog. Dropping a required check changes the digest.
+export const QA_FLOOR_FILE = "release-qa-floor.json";
+// Modules that make or carry enforcement decisions. Their import closure is pinned.
+export const POLICY_BUNDLE_ENTRYPOINTS = Object.freeze([
+  "ownership-scan-worker.mjs", "ownership-evidence.mjs", "ownership-verdict.mjs", "ownership-admission.mjs",
+  "ownership-staged.mjs", "ownership-hooks.mjs", "ownership-key-trust.mjs", "release-qa-receipt.mjs",
+]);
+// Data files are pinned through their own digests, not as source files.
+const DATA_FILES = new Set([CATALOG_FILE, REGISTRY_FILE, ALLOWLIST_FILE, QA_FLOOR_FILE]);
+
+const sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const canonicalDigest = (value) => sha256Hex(canonicalJson(value));
+// Normalize CRLF so a checkout's line-ending policy does not change the digest.
+const textDigest = (bytes) => sha256Hex(Buffer.from(bytes.toString("utf8").replace(/\r\n/g, "\n")));
+
+function sourceName(file, dir) {
+  const relative = path.relative(dir, file).split(path.sep).join("/");
+  if (!relative.startsWith("../")) return relative;
+  const dependency = /^.*node_modules\/((?:@[^/]+\/)?[^/]+)\/(.+)$/.exec(file.split(path.sep).join("/"));
+  return dependency ? `node_modules/${dependency[1]}/${dependency[2]}` : relative;
+}
+
+const closureCache = new Map();
+/** Import closure of the enforcement entrypoints as [{ path, sha256 }] sorted by path. */
+export function scannerSourceFiles({ dir = here, entrypoints = POLICY_BUNDLE_ENTRYPOINTS } = {}) {
+  const key = `${dir}\0${entrypoints.join("\0")}`;
+  if (closureCache.has(key)) return closureCache.get(key);
+  const files = new Map(), queue = entrypoints.map((name) => path.join(dir, name));
+  while (queue.length) {
+    const file = queue.shift();
+    if (files.has(file)) continue;
+    let bytes;
+    try { bytes = readFileSync(file); } catch (error) { if (error.code === "ENOENT" && !file.startsWith(dir)) continue; throw error; }
+    files.set(file, file.endsWith(".json") ? sha256Hex(Buffer.from(canonicalJson(JSON.parse(bytes.toString("utf8"))))) : textDigest(bytes));
+    if (!/\.(?:mjs|js|cjs)$/.test(file)) continue;
+    for (const match of bytes.toString("utf8").matchAll(MODULE_SPECIFIERS)) {
+      const specifier = match[1] ?? match[2];
+      if (specifier.startsWith("node:")) continue;
+      try { queue.push(specifier.startsWith(".") ? path.resolve(path.dirname(file), specifier) : createRequire(file).resolve(specifier)); }
+      catch { queue.push(path.resolve(path.dirname(file), specifier)); }
+    }
+  }
+  const result = [...files].map(([file, digest]) => ({ path: sourceName(file, dir), sha256: digest }))
+    .filter((entry) => !DATA_FILES.has(entry.path)).sort((a, b) => a.path.localeCompare(b.path));
+  closureCache.set(key, result);
+  return result;
+}
+
+function readJsonOrNull(file) {
+  try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; }
+}
+
+/**
+ * @param {{ dir?: string, manifest?: object, registry?: object|null, allowlist?: object|null, qaFloor?: object|null, scannerVersion: string, files?: Array<{path:string,sha256:string}> }} input
+ * Missing registry/allowlist digest as null; the digest still binds that absence.
+ */
+export function computePolicyBundle({ dir = here, manifest, registry, allowlist, qaFloor, scannerVersion, files } = {}) {
+  if (!/^\d+(?:\.\d+)*$/.test(String(scannerVersion ?? ""))) throw new Error("policy bundle requires a scanner version");
+  const catalog = manifest ?? readJsonOrNull(path.join(dir, CATALOG_FILE));
+  if (!catalog) throw new Error("policy bundle requires the ownership catalog");
+  const registryValue = registry === undefined ? readJsonOrNull(path.join(dir, REGISTRY_FILE)) : registry;
+  const allowlistValue = allowlist === undefined ? readJsonOrNull(path.join(dir, ALLOWLIST_FILE)) : allowlist;
+  const qaFloorValue = qaFloor === undefined ? readJsonOrNull(path.join(dir, QA_FLOOR_FILE)) : qaFloor;
+  const parts = {
+    schema: POLICY_BUNDLE_SCHEMA,
+    scannerVersion: String(scannerVersion),
+    catalogDigest: canonicalDigest(catalog),
+    registryDigest: registryValue === null ? null : canonicalDigest(registryValue),
+    allowlistDigest: allowlistValue === null ? null : canonicalDigest(allowlistValue),
+    qaFloorDigest: qaFloorValue === null ? null : canonicalDigest(qaFloorValue),
+    files: files ?? scannerSourceFiles({ dir }),
+  };
+  return { ...parts, digest: canonicalDigest(parts) };
+}
+
+/** Running bundle for the code that is executing now. */
+export function runningPolicyBundle({ scannerVersion, manifest, dir = here, ...rest } = {}) {
+  return computePolicyBundle({ dir, scannerVersion, manifest, ...rest });
+}
+
+export function validatePolicyBundle(bundle) {
+  const problems = [];
+  if (!bundle || typeof bundle !== "object" || Array.isArray(bundle)) return { ok: false, problems: ["policy bundle must be an object"] };
+  if (bundle.schema !== POLICY_BUNDLE_SCHEMA) problems.push("policy bundle schema is unsupported");
+  if (!HEX.test(bundle.digest ?? "")) problems.push("policy bundle digest is malformed");
+  if (!/^\d+(?:\.\d+)*$/.test(bundle.scannerVersion ?? "")) problems.push("policy bundle scanner version is malformed");
+  for (const key of ["catalogDigest"]) if (!HEX.test(bundle[key] ?? "")) problems.push(`policy bundle ${key} is malformed`);
+  for (const key of ["registryDigest", "allowlistDigest"]) if (bundle[key] !== null && !HEX.test(bundle[key] ?? "")) problems.push(`policy bundle ${key} is malformed`);
+  // Bundles pinned before step 4 carry no qaFloorDigest; they stay well-formed but can never match a running bundle.
+  if (bundle.qaFloorDigest !== undefined && bundle.qaFloorDigest !== null && !HEX.test(bundle.qaFloorDigest)) problems.push("policy bundle qaFloorDigest is malformed");
+  if (!Array.isArray(bundle.files) || bundle.files.some((file) => !file || typeof file.path !== "string" || !HEX.test(file.sha256 ?? ""))) problems.push("policy bundle file list is malformed");
+  else {
+    const { digest, ...parts } = bundle;
+    if (HEX.test(digest ?? "") && canonicalDigest(parts) !== digest) problems.push("policy bundle digest does not match its contents");
+  }
+  return { ok: problems.length === 0, problems };
+}
+
+/** Semantic diff of two bundles (the previous one may be null/absent). */
+export function diffPolicyBundles(before, after) {
+  const prior = new Map((before?.files ?? []).map((file) => [file.path, file.sha256]));
+  const current = new Map((after?.files ?? []).map((file) => [file.path, file.sha256]));
+  return {
+    filesAdded: [...current.keys()].filter((p) => !prior.has(p)).sort(),
+    filesRemoved: [...prior.keys()].filter((p) => !current.has(p)).sort(),
+    filesChanged: [...current.keys()].filter((p) => prior.has(p) && prior.get(p) !== current.get(p)).sort(),
+    scannerVersion: before?.scannerVersion !== after?.scannerVersion ? { from: before?.scannerVersion ?? null, to: after?.scannerVersion ?? null } : null,
+    catalogChanged: before?.catalogDigest !== after?.catalogDigest,
+    registryChanged: before?.registryDigest !== after?.registryDigest,
+    allowlistChanged: before?.allowlistDigest !== after?.allowlistDigest,
+    qaFloorChanged: (before?.qaFloorDigest ?? null) !== (after?.qaFloorDigest ?? null),
+  };
+}
+
+/**
+ * Host-independent fingerprint of protected trust for cross-host comparison (`ownership trust-compare`).
+ * Excludes only the per-host key-authority checkout path; every other field, including the pinned policy
+ * bundle and dependency allowlist, must be identical on two hosts that synced the same release.
+ */
+export function trustComparison(trust) {
+  if (!trust || typeof trust !== "object") throw new Error("no protected trust to compare");
+  const { keyAuthority, ...rest } = trust;
+  const comparable = { ...rest, ...(keyAuthority ? { keyAuthority: { repositoryIdentity: keyAuthority.repositoryIdentity } } : {}) };
+  return {
+    digest: canonicalDigest(comparable),
+    components: {
+      policyBundle: trust.policyBundle?.digest ?? null,
+      dependencyAllowlist: trust.dependencyAllowlist ? canonicalDigest(trust.dependencyAllowlist) : null,
+      repositories: canonicalDigest(trust.repositories ?? []),
+      minimumCatalogDigest: trust.minimumCatalogDigest ?? null,
+      minimumScannerVersion: trust.minimumScannerVersion ?? null,
+      keyCheckpoint: trust.keyCheckpoint ?? null,
+      rootFingerprint: trust.rootFingerprint ?? null,
+    },
+  };
+}
+
+export { diffAllowlists, validateAllowlist };

package/ownership-report-command.mjs

@@ -7,7 +7,7 @@ import { OWNERSHIP_APPS, formatOwnershipJson, buildOwnershipReport, renderOwners
 import { MANIFEST_FILE } from "./ownership.mjs";
 
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
-const defaultWorkspace = path.resolve(packageRoot, "../../../..");
+const defaultWorkspace = path.resolve(packageRoot, "../../..");
 const MAX_SCAN_OUTPUT_BYTES = 32 * 1024 * 1024;
 const flag = (args, name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
 

package/ownership-trust-summary.mjs

@@ -0,0 +1,119 @@
+// Human-readable summary of what a protected ownership trust update will change. It runs the SAME pure
+// functions the elevated child runs (prepare -> registry merge -> floor raise) over the exact request
+// bytes about to be installed, so the approval dialog describes the real change.
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { canonicalJson } from "./ownership-approval.mjs";
+import { verifyKeyLog } from "./ownership-key-log.mjs";
+import { diffAllowlists } from "./ownership-dependency-allowlist.mjs";
+import { diffPolicyBundles } from "./ownership-policy-bundle.mjs";
+import { installedPolicyInputs, mergeRepositoriesFromInstalledRelease, prepareTrustUpdate, raiseFloorsToInstalledRelease } from "./ownership-key-trust.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const short = (hex, n = 12) => (typeof hex === "string" && hex ? hex.replace(/^(?:win-|mac-)/i, "").slice(0, n) : "none");
+const repoName = (identity) => String(identity).replace(/^https:\/\/github\.com\//i, "");
+const diffSets = (before, after) => ({ added: [...after].filter((x) => !before.has(x)).sort(), removed: [...before].filter((x) => !after.has(x)).sort() });
+
+const NAME_LIMIT = 12;
+const names = (list) => list.length > NAME_LIMIT ? `${list.slice(0, NAME_LIMIT).join(", ")}, +${list.length - NAME_LIMIT} more` : list.join(", ");
+
+/** Semantic description of a policy-bundle change: scanner files, allowlist entries, registry and catalog digests. */
+function policyLines(existing, next) {
+  const before = existing?.policyBundle, after = next.policyBundle;
+  const lines = [];
+  if (!after) { if (before) lines.push("Policy bundle: no longer pinned by this update"); return lines; }
+  const bundle = diffPolicyBundles(before, after);
+  if (!before) lines.push(`Policy bundle: unpinned -> ${short(after.digest, 12)} (pins ${after.files.length} scanner source files, scanner ${after.scannerVersion}, catalog, repository registry and dependency allowlist; enforced by release gates from now on)`);
+  else if (before.digest !== after.digest) lines.push(`Policy bundle: ${short(before.digest, 12)} -> ${short(after.digest, 12)}`);
+  else return lines;
+  if (before) {
+    if (bundle.scannerVersion) lines.push(`  scanner version: ${bundle.scannerVersion.from ?? "none"} -> ${bundle.scannerVersion.to}`);
+    if (bundle.filesChanged.length) lines.push(`  scanner/verifier files changed (${bundle.filesChanged.length}): ${names(bundle.filesChanged)}`);
+    if (bundle.filesAdded.length) lines.push(`  scanner/verifier files added (${bundle.filesAdded.length}): ${names(bundle.filesAdded)}`);
+    if (bundle.filesRemoved.length) lines.push(`  scanner/verifier files removed (${bundle.filesRemoved.length}): ${names(bundle.filesRemoved)}`);
+    if (bundle.catalogChanged) lines.push("  catalog contents changed");
+    if (bundle.registryChanged) lines.push("  repository registry file changed");
+  }
+  const allow = diffAllowlists(existing?.dependencyAllowlist ?? null, next.dependencyAllowlist ?? null);
+  if (!before && next.dependencyAllowlist) {
+    const total = (next.dependencyAllowlist.repositories ?? []).reduce((n, r) => n + (r.dependencies?.length ?? 0), 0);
+    lines.push(`  dependency allowlist: ${next.dependencyAllowlist.global.length} global + ${total} per-repository entries across ${next.dependencyAllowlist.repositories.length} repositories (first activation; review the file in packages/release)`);
+  } else if (allow.changed) {
+    if (allow.global.added.length) lines.push(`  allowlist global added (${allow.global.added.length}): ${names(allow.global.added)}`);
+    if (allow.global.removed.length) lines.push(`  allowlist global removed (${allow.global.removed.length}): ${names(allow.global.removed)}`);
+    for (const repo of allow.repositories) {
+      const label = repoName(repo.repositoryIdentity);
+      if (repo.baseline === "added") lines.push(`  allowlist baseline added for ${label} (${repo.added.length} entries)`);
+      else if (repo.baseline === "removed") lines.push(`  allowlist baseline removed for ${label}`);
+      if (repo.baseline !== "changed") continue;
+      if (repo.added.length) lines.push(`  allowlist ${label} added (${repo.added.length}): ${names(repo.added)}`);
+      if (repo.removed.length) lines.push(`  allowlist ${label} removed (${repo.removed.length}): ${names(repo.removed)}`);
+    }
+  }
+  return lines;
+}
+
+function readInstalledManifest() { return JSON.parse(readFileSync(path.join(here, "rightkit-ownership.json"), "utf8")); }
+
+function keysAt(log, rootFingerprint, sequence) {
+  const events = log.events.slice(0, Math.max(0, sequence) + 1);
+  const state = verifyKeyLog({ schema: 1, events }, { rootFingerprint });
+  return new Map((state.ok ? state.keys : []).map((k) => [k.keyId, k]));
+}
+
+/**
+ * @param {{ existing: object, requestBytes: Buffer|string, manifest?: object, registry?: object, scannerVersion?: string }} input
+ * @returns {{ changed: boolean, lines: string[], payloadDigest: string, next: object }}
+ */
+export function summarizeTrustChange({ existing, requestBytes, manifest, registry, scannerVersion, policy }) {
+  const bytes = Buffer.from(requestBytes);
+  const payloadDigest = createHash("sha256").update(bytes).digest("hex");
+  const request = JSON.parse(bytes.toString("utf8"));
+  const catalog = manifest ?? readInstalledManifest();
+  const prepared = prepareTrustUpdate(existing, request);
+  const merged = mergeRepositoriesFromInstalledRelease(prepared, { firstInstall: existing == null, ...(registry ? { registry } : {}) });
+  const next = raiseFloorsToInstalledRelease(merged.trust, { manifest: catalog, ...(scannerVersion ? { scannerVersion } : {}), ...(policy || registry ? { policy: policy ?? { ...installedPolicyInputs(), registry } } : {}) });
+  const changed = canonicalJson(existing ?? null) !== canonicalJson(next);
+  const lines = [];
+  if (!changed) return { changed, lines: ["Ownership trust already current."], payloadDigest, next };
+
+  const repos = diffSets(new Set((existing?.repositories ?? []).map((r) => r.repositoryIdentity)), new Set(next.repositories.map((r) => r.repositoryIdentity)));
+  if (repos.added.length) lines.push(`Repositories added (${repos.added.length}): ${repos.added.map(repoName).join(", ")}`);
+  if (repos.removed.length) lines.push(`Repositories removed (${repos.removed.length}): ${repos.removed.map(repoName).join(", ")}`);
+  for (const w of merged.warnings) lines.push(`Warning: ${w.message}`);
+
+  const caps = Array.isArray(catalog.capabilities) ? catalog.capabilities : [];
+  const fingerprints = caps.reduce((n, c) => n + (Array.isArray(c.fingerprints) ? c.fingerprints.length : 0), 0);
+  const oldDigest = existing?.minimumCatalogDigest;
+  if (oldDigest !== next.minimumCatalogDigest || existing?.minimumCatalogVersion !== next.minimumCatalogVersion) {
+    lines.push(`Catalog: v${existing?.minimumCatalogVersion ?? "none"} ${short(oldDigest, 8)} -> v${next.minimumCatalogVersion} ${short(next.minimumCatalogDigest, 8)} (${caps.length} capabilities, ${fingerprints} fingerprints; previous catalog contents are not stored, so per-capability diffs are unavailable)`);
+  }
+  lines.push(...policyLines(existing, next));
+  if (existing?.minimumScannerVersion !== next.minimumScannerVersion) lines.push(`Scanner floor: ${existing?.minimumScannerVersion ?? "none"} -> ${next.minimumScannerVersion}`);
+
+  const oldSeq = existing?.keyCheckpoint?.sequence ?? -1;
+  const newSeq = next.keyCheckpoint.sequence;
+  if (oldSeq !== newSeq || existing?.keyCheckpoint?.head !== next.keyCheckpoint.head) {
+    lines.push(`Key log sequence: ${oldSeq < 0 ? "none" : oldSeq} -> ${newSeq}`);
+    const rootFingerprint = request.rootFingerprint;
+    const before = oldSeq < 0 ? new Map() : keysAt(request.log, rootFingerprint, oldSeq);
+    const after = keysAt(request.log, rootFingerprint, newSeq);
+    const fmt = (k) => `${short(k.keyId)} (${k.platform ?? "unknown host"})`;
+    const added = [...after.values()].filter((k) => !before.has(k.keyId));
+    const revoked = [...before.values()].filter((k) => !after.has(k.keyId));
+    if (added.length) lines.push(`Approval keys added: ${added.map(fmt).join(", ")}`);
+    if (revoked.length) lines.push(`Approval keys revoked: ${revoked.map(fmt).join(", ")}`);
+    if (!added.length && !revoked.length) lines.push("Approval keys: no change in active keys");
+  }
+  lines.push(`Payload SHA-256: ${short(payloadDigest, 16)}`);
+  return { changed, lines, payloadDigest, next };
+}
+
+/** Parse + verify the pinned request file, then summarize exactly those bytes. */
+export function summarizeRequestFile({ file, digest, existing, ...rest }) {
+  const bytes = readFileSync(file);
+  if (createHash("sha256").update(bytes).digest("hex") !== digest) throw new Error("trust request bytes do not match pinned SHA-256; refusing to summarize");
+  return summarizeTrustChange({ existing, requestBytes: bytes, ...rest });
+}

package/ownership-windows-presence.mjs

@@ -0,0 +1,171 @@
+// Human-presence gate for the Windows protected trust update. It runs INSIDE the elevated updater, so it
+// cannot be skipped by invoking the updater directly from an already-elevated (e.g. SSH) process: such a
+// process has no interactive desktop and no way to answer a password prompt for the signed-in user.
+//
+// Primary check: Windows Hello user presence (UserConsentVerifier: PIN, fingerprint, face or password, whatever the
+// user signs in with), shown owned by a foreground window. Fallback when Hello is not available: the system
+// credential dialog plus LogonUser (password-only sign-in).
+//
+// Why not UAC alone: UAC is not a human gate when the machine elevates silently (ConsentPromptBehaviorAdmin=0),
+// and an elevated process can launch further elevated processes with no prompt at all. Verifying the signed-in
+// user's password via the system credential dialog needs a secret and a person at the screen, and needs no new
+// infrastructure. Approval is affirmative-only: the script prints a per-run token on the single success path
+// and the caller accepts nothing else (kill, timeout, cancel, error and empty output all mean "no").
+import { randomBytes } from "node:crypto";
+import { spawnSync, windowsPowerShellEnvironment } from "./background-process.mjs";
+
+const POWERSHELL = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+export const PRESENCE_TITLE = "RightKit ownership trust-sync - confirm it is you";
+export const PRESENCE_APPROVE_PREFIX = "RK_PRESENCE_VERIFIED:";
+export const PRESENCE_TIMEOUT_MS = 5 * 60 * 1000;
+
+const psq = (value) => `'${String(value).replaceAll("'", "''")}'`;
+
+const CSHARP = `
+using System; using System.Runtime.InteropServices; using System.Text;
+public static class RkPresence {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] public struct CREDUI_INFO { public int cbSize; public IntPtr hwndParent; public string pszMessageText; public string pszCaptionText; public IntPtr hbmBanner; }
+  [DllImport("credui.dll", CharSet=CharSet.Unicode)] static extern int CredUIPromptForWindowsCredentials(ref CREDUI_INFO ui, int authError, ref uint authPackage, IntPtr inBuf, uint inSize, out IntPtr outBuf, out uint outSize, ref bool save, int flags);
+  [DllImport("credui.dll", CharSet=CharSet.Unicode)] static extern bool CredUnPackAuthenticationBufferW(int flags, IntPtr buf, uint size, StringBuilder user, ref int userLen, StringBuilder domain, ref int domLen, StringBuilder pass, ref int passLen);
+  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)] static extern bool LogonUserW(string user, string domain, string pass, int type, int provider, out IntPtr token);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr h);
+  [DllImport("ole32.dll")] static extern void CoTaskMemFree(IntPtr p);
+  [ComImport, Guid("39E050C3-4E74-441A-8DC0-B81104DF949C"), InterfaceType(ComInterfaceType.InterfaceIsIInspectable)]
+  interface IUserConsentVerifierInterop { [PreserveSig] int RequestVerificationForWindowAsync(IntPtr appWindow, IntPtr message, [In] ref Guid riid, out IntPtr op); }
+  [DllImport("combase.dll")] static extern int RoGetActivationFactory(IntPtr cls, [In] ref Guid iid, out IntPtr factory);
+  [DllImport("combase.dll", CharSet=CharSet.Unicode)] static extern int WindowsCreateString(string s, int len, out IntPtr h);
+  [DllImport("combase.dll")] static extern int WindowsDeleteString(IntPtr h);
+  [DllImport("user32.dll")] static extern bool SetForegroundWindow(IntPtr h);
+  [DllImport("user32.dll")] static extern void keybd_event(byte vk, byte scan, int flags, UIntPtr extra);
+  // Raw IAsyncOperation pointer for a Hello request owned by hwnd (so the dialog opens in front of it), or Zero on failure.
+  public static IntPtr RequestForWindow(IntPtr hwnd, string message, Guid riid) {
+    IntPtr cls = IntPtr.Zero, msg = IntPtr.Zero, fac = IntPtr.Zero;
+    try {
+      string name = "Windows.Security.Credentials.UI.UserConsentVerifier";
+      if (WindowsCreateString(name, name.Length, out cls) != 0) return IntPtr.Zero;
+      Guid iid = typeof(IUserConsentVerifierInterop).GUID;
+      if (RoGetActivationFactory(cls, ref iid, out fac) != 0 || fac == IntPtr.Zero) return IntPtr.Zero;
+      if (WindowsCreateString(message, message.Length, out msg) != 0) return IntPtr.Zero;
+      IUserConsentVerifierInterop f = (IUserConsentVerifierInterop)Marshal.GetObjectForIUnknown(fac);
+      IntPtr op; int rc = f.RequestVerificationForWindowAsync(hwnd, msg, ref riid, out op);
+      return rc == 0 ? op : IntPtr.Zero;
+    } finally {
+      if (msg != IntPtr.Zero) WindowsDeleteString(msg);
+      if (cls != IntPtr.Zero) WindowsDeleteString(cls);
+      if (fac != IntPtr.Zero) Marshal.Release(fac);
+    }
+  }
+  // Best-effort foreground grab: a synthetic Alt press lets SetForegroundWindow succeed from a freshly launched elevated process.
+  public static void Foreground(IntPtr h) { keybd_event(0x12, 0, 0, UIntPtr.Zero); keybd_event(0x12, 0, 2, UIntPtr.Zero); SetForegroundWindow(h); }
+  // Returns the verified "DOMAIN\\\\user" or null. Three attempts; Cancel ends immediately.
+  public static string Verify(string message, string caption) {
+    int authError = 0;
+    for (int attempt = 0; attempt < 3; attempt++) {
+      CREDUI_INFO ui = new CREDUI_INFO(); ui.cbSize = Marshal.SizeOf(typeof(CREDUI_INFO)); ui.pszMessageText = message; ui.pszCaptionText = caption;
+      uint pkg = 0; IntPtr outBuf; uint outSize; bool save = false;
+      int rc = CredUIPromptForWindowsCredentials(ref ui, authError, ref pkg, IntPtr.Zero, 0, out outBuf, out outSize, ref save, 0x200);
+      if (rc != 0) return null;
+      StringBuilder u = new StringBuilder(513), d = new StringBuilder(257), p = new StringBuilder(513);
+      int ul = u.Capacity, dl = d.Capacity, pl = p.Capacity;
+      bool ok = CredUnPackAuthenticationBufferW(0, outBuf, outSize, u, ref ul, d, ref dl, p, ref pl);
+      byte[] zero = new byte[outSize]; Marshal.Copy(zero, 0, outBuf, (int)outSize); CoTaskMemFree(outBuf);
+      if (!ok) return null;
+      IntPtr token;
+      string dom = d.Length > 0 ? d.ToString() : ".";
+      bool logon = LogonUserW(u.ToString(), dom, p.ToString(), 2, 0, out token);
+      p.Clear();
+      if (logon) { CloseHandle(token); return (d.Length > 0 ? d.ToString() + "\\\\" : "") + u.ToString(); }
+      authError = 1326;
+    }
+    return null;
+  }
+}`;
+
+/**
+ * PowerShell run in the interactive desktop session. Prints the per-run token only after Windows Hello reports Verified
+ * (or, when Hello is unavailable, after a verified password for the signed-in user). Exit codes: 0 approved, 1 denied
+ * (cancel, busy, not configured, retries exhausted, wrong user), 2 error, 3 non-interactive.
+ */
+export function buildPresenceScript(summary, nonce, helloMessage = presenceHelloMessage(summary)) {
+  const clean = (v) => String(v).replaceAll("\0", "");
+  return [
+    "$ErrorActionPreference='Stop'",
+    "try {",
+    // Not interactive (session 0, SSH, service) => no human can be present: refuse before any prompt.
+    "if (-not [Environment]::UserInteractive) { exit 3 }",
+    "if ([System.Diagnostics.Process]::GetCurrentProcess().SessionId -eq 0) { exit 3 }",
+    "$console=(Get-CimInstance -ClassName Win32_ComputerSystem).UserName; if (-not $console) { exit 3 }",
+    "$consoleSid=(New-Object Security.Principal.NTAccount($console)).Translate([Security.Principal.SecurityIdentifier]).Value",
+    `Add-Type -TypeDefinition @'${CSHARP}\n'@`,
+    "Add-Type -AssemblyName System.Windows.Forms",
+    "Add-Type -AssemblyName System.Runtime.WindowsRuntime",
+    "[void][Windows.Security.Credentials.UI.UserConsentVerifier,Windows.Security.Credentials.UI,ContentType=WindowsRuntime]",
+    "[void][Windows.Security.Credentials.UI.UserConsentVerifierAvailability,Windows.Security.Credentials.UI,ContentType=WindowsRuntime]",
+    "[void][Windows.Security.Credentials.UI.UserConsentVerificationResult,Windows.Security.Credentials.UI,ContentType=WindowsRuntime]",
+    "[void][Windows.Foundation.IAsyncOperation`1,Windows.Foundation,ContentType=WindowsRuntime]",
+    "$asTask=@([System.WindowsRuntimeSystemExtensions].GetMethods()|Where-Object{ $_.Name -eq 'AsTask' -and $_.GetParameters().Count -eq 1 -and $_.GetParameters()[0].ParameterType.Name -eq 'IAsyncOperation`1' })[0]",
+    "function Await($op,$type){ $t=$asTask.MakeGenericMethod($type).Invoke($null,[object[]]@($op)); [void]$t.Wait(); $t.Result }",
+    // Hello availability; any failure to ask means "not available" and drops to the password path.
+    "$avail='Error'; try { $avail=[string](Await ([Windows.Security.Credentials.UI.UserConsentVerifier]::CheckAvailabilityAsync()) ([Windows.Security.Credentials.UI.UserConsentVerifierAvailability])) } catch { $avail='Error' }",
+    "if ($avail -eq 'Available') {",
+    // The verifying user is the elevated process identity; it must be the signed-in console user.
+    "  if ([Security.Principal.WindowsIdentity]::GetCurrent().User.Value -ne $consoleSid) { exit 1 }",
+    `  $msg=${psq(clean(helloMessage))}`,
+    "  $rtype=[Windows.Security.Credentials.UI.UserConsentVerificationResult]",
+    // Owner window: a tiny topmost form forced to the foreground so the Hello dialog opens in front, not behind.
+    "  $form=New-Object Windows.Forms.Form; $form.TopMost=$true; $form.ShowInTaskbar=$false; $form.FormBorderStyle='None'; $form.StartPosition='CenterScreen'; $form.Opacity=0.01; $form.Size=New-Object Drawing.Size(2,2)",
+    "  $form.Show(); $form.Activate(); [RkPresence]::Foreground($form.Handle)",
+    "  $res=$null",
+    "  try {",
+    "    $iid=([Windows.Foundation.IAsyncOperation`1].MakeGenericType($rtype)).GUID",
+    "    $ptr=[RkPresence]::RequestForWindow($form.Handle,$msg,$iid)",
+    "    if ($ptr -ne [IntPtr]::Zero) { $res=[string](Await ([Runtime.InteropServices.Marshal]::GetObjectForIUnknown($ptr)) $rtype) }",
+    "  } catch { $res=$null }",
+    // Owner-window request failed to start: plain request (no owner) is still better than no Hello.
+    "  if ($null -eq $res) { try { $res=[string](Await ([Windows.Security.Credentials.UI.UserConsentVerifier]::RequestVerificationAsync($msg)) $rtype) } catch { $form.Close(); exit 2 } }",
+    "  $form.Close()",
+    "  if ($res -ne 'Verified') { exit 1 }",
+    "} else {",
+    `  $who=[RkPresence]::Verify(${psq(clean(summary))}, ${psq(PRESENCE_TITLE)})`,
+    "  if (-not $who) { exit 1 }",
+    // The verified account must be the signed-in console user, not just any account whose password is known.
+    "  $a=(New-Object Security.Principal.NTAccount($who)).Translate([Security.Principal.SecurityIdentifier]).Value",
+    "  if ($a -ne $consoleSid) { exit 1 }",
+    "}",
+    `[Console]::Out.WriteLine(${psq(`${PRESENCE_APPROVE_PREFIX}${nonce}`)}); exit 0`,
+    "} catch { exit 2 }",
+  ].join("\n");
+}
+
+/** One-line message for the Windows Hello dialog: the catalog/key/repository lines of the summary, bounded. */
+export function presenceHelloMessage(summary) {
+  const lines = String(summary).split(/\r?\n/).slice(1, 4).map((l) => l.trim()).filter(Boolean);
+  return `RightKit ownership trust-sync: ${lines.join("; ")}`.slice(0, 200);
+}
+
+/** Compact, bounded description of the change for the credential dialog. */
+export function presenceSummary({ existing, next }) {
+  const keys = (t) => t?.keyCheckpoint?.sequence ?? "none";
+  const digest = (t) => String(t?.minimumCatalogDigest ?? "none").slice(0, 8);
+  return [
+    "RightKit will update the protected ownership trust on this computer.",
+    `Catalog: ${digest(existing)} -> ${digest(next)}`,
+    `Key log sequence: ${keys(existing)} -> ${keys(next)}`,
+    `Repositories: ${existing?.repositories?.length ?? 0} -> ${next?.repositories?.length ?? 0}`,
+    "Approve with Windows Hello (or your Windows password). Cancel to refuse.",
+  ].join("\n").slice(0, 900);
+}
+
+/**
+ * Throws unless a human verified their presence (Windows Hello, else password) on this machine's desktop for exactly this run.
+ * Affirmative-only: exit 0 AND the exact per-run token on stdout; kill, timeout, spawn error and anything else deny.
+ */
+export function requireWindowsPresence({ summary, run = spawnSync, nonce = randomBytes(16).toString("hex"), timeoutMs = PRESENCE_TIMEOUT_MS } = {}) {
+  const script = buildPresenceScript(summary, nonce);
+  const r = run(POWERSHELL, ["-NoProfile", "-Sta", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+    encoding: "utf8", windowsHide: false, timeout: timeoutMs, killSignal: "SIGKILL", env: windowsPowerShellEnvironment(),
+  });
+  const approved = r && !r.error && r.status === 0 && String(r.stdout ?? "").split(/\r?\n/).includes(`${PRESENCE_APPROVE_PREFIX}${nonce}`);
+  if (!approved) throw Object.assign(new Error("RK_OWNERSHIP_PRESENCE_DENIED: the signed-in user did not verify their presence (Windows Hello or password) at the desktop; trust was not changed"), { code: "RK_OWNERSHIP_PRESENCE_DENIED" });
+  return true;
+}

package/ownership.mjs

@@ -6,6 +6,8 @@ import installedManifest from "./rightkit-ownership.json" with { type: "json" };
 import { parse as parseToml } from "smol-toml";
 import { sourceNonCode } from "./ownership-source.mjs";
 import { OWNERSHIP_LOCKFILES, transitiveDependencies } from "./ownership-lockfiles.mjs";
+import { ALLOWLIST_FILE, ALLOWLIST_FINDING_ID, evaluateDependency, sourceKind, validateAllowlist } from "./ownership-dependency-allowlist.mjs";
+import { fileURLToPath } from "node:url";
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { acquireCommittedSource, committedSourceDataForInternalUse } from "./committed-source.mjs";
@@ -537,7 +539,7 @@ function trustedProvenance(appRoot, inventory, trust, repositoryIdentity, covera
   return { excluded, classifications };
 }
 
-function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), trust, repositoryIdentity, repositoryRoot = appRoot, pathPrefix = "" } = {}) {
+function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), trust, repositoryIdentity, repositoryRoot = appRoot, pathPrefix = "", allowlistPolicy = null } = {}) {
   const findings = [], coverage = [...inventory.coverage], deps = dependenciesFromInventory(appRoot, inventory), contentDigests = [...(deps.contentDigests ?? [])];
   const catalogOwners = new Set(manifest.capabilities.map((entry) => entry.package));
   coverage.push(...(deps.coverage ?? []));
@@ -550,6 +552,19 @@ function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), t
       pushDependency(c, f, d);
     }
   }
+  if (allowlistPolicy && repositoryIdentity) {
+    // Default-deny: a direct dependency that is not a RightKit package, not a first-party path dependency, and
+    // not in the repository baseline or global list is a finding. Block-tier catalog dependencies are reported by
+    // their own (always blocking) fingerprints above, so allowlisting can never relax them.
+    const owners = [...catalogOwners, ...(manifest.internalOwners ?? []).map((owner) => typeof owner === "string" ? owner : owner.package)];
+    const blocked = new Set(manifest.capabilities.flatMap((c) => c.fingerprints.filter((f) => f.type === "dependency" && findingPolicy(c, f).tier === "block").map((f) => `${f.ecosystem}:${f.name}`)));
+    for (const d of deps) {
+      if (blocked.has(`${d.ecosystem}:${d.name}`) || evaluateDependency(allowlistPolicy.allowlist, repositoryIdentity, { ecosystem: d.ecosystem, name: d.name, kind: sourceKind(d.source) }, { owners }).allowed) continue;
+      findings.push({ fingerprint: ALLOWLIST_FINDING_ID, capability: "dependency-allowlist", package: "RightKit dependency allowlist", tier: allowlistPolicy.tier, file: d.file, line: 0, kind: "dependency", ecosystem: d.ecosystem, name: d.name,
+        alias: d.alias, section: d.section, requirement: d.requirement, features: d.features, defaultFeatures: d.defaultFeatures, local: d.local, source: d.source, resolvedVersion: d.resolvedVersion,
+        text: `${d.ecosystem} dependency ${d.name} is not in ${ALLOWLIST_FILE}; propose it there and Adrian activates it via trust-sync`, provenance: d.source });
+    }
+  }
   const blockRules = manifest.capabilities.flatMap((c) => c.fingerprints.filter((f) => f.type === "dependency" && findingPolicy(c, f).tier === "block").map((f) => ({ c, f })));
   const transitiveOwners = new Set([...catalogOwners, ...(manifest.internalOwners ?? []).map((owner) => typeof owner === "string" ? owner : owner.package)]);
   const transitive = transitiveDependencies(appRoot, inventory, deps.manifests, transitiveOwners, coverage, contentDigests, blockRules.map(({ f }) => `${f.ecosystem}:${f.name}`));
@@ -578,6 +593,24 @@ function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), t
   return { findings, coverage, deps, contentDigests, provenance: provenance.classifications };
 }
 
+const shippedAllowlistFile = path.join(path.dirname(fileURLToPath(import.meta.url)), ALLOWLIST_FILE);
+function shippedAllowlist() {
+  try { const parsed = JSON.parse(readFileSync(shippedAllowlistFile, "utf8")); return validateAllowlist(parsed).ok ? parsed : null; } catch { return null; }
+}
+/**
+ * Which allowlist applies and how hard. The protected trust copy (activated by trust-sync) governs every repository
+ * registered in trust and blocks. Before trust-sync, or while approval enrollment is pending, the shipped proposal
+ * is advisory and only for repositories it has a baseline for.
+ */
+export function dependencyAllowlistPolicy(trust, repositoryIdentity, { pending = false, shipped } = {}) {
+  if (!repositoryIdentity) return null;
+  const trusted = trust?.dependencyAllowlist && validateAllowlist(trust.dependencyAllowlist).ok ? trust.dependencyAllowlist : null;
+  if (trusted && trust.repositories?.some((entry) => entry.repositoryIdentity === repositoryIdentity)) return { allowlist: trusted, tier: pending ? "advise" : "block", source: "protected-trust" };
+  const proposal = shipped === undefined ? shippedAllowlist() : shipped;
+  if (proposal?.repositories?.some((entry) => entry.repositoryIdentity === repositoryIdentity)) return { allowlist: proposal, tier: "advise", source: "shipped-proposal" };
+  return null;
+}
+
 function trustForScan(options = {}) {
   if (options.trust !== undefined) return options.trust?.trust ?? options.trust;
   try { return loadTrustedExternal().trust; } catch { return null; }
@@ -610,7 +643,7 @@ function scanAppInternal(appRoot, manifest, options, readAuthority) {
   const repositoryIdentity = repositoryIdentityFor(appRoot);
   const authority = initialTrust?.keyAuthority ? resolveSharedAuthority(initialTrust, readAuthority) : resolveRepositoryKeyLog(initialTrust, location.root, repositoryIdentity, readAuthority);
   const trust = authority.trust;
-  const result = scanInternal(appRoot, manifest, { inventory: fileInventory(appRoot, trust, location.prefix, location.root), trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix });
+  const result = scanInternal(appRoot, manifest, { inventory: fileInventory(appRoot, trust, location.prefix, location.root), trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, options.trust), shipped: options.shippedAllowlist }) });
   Object.defineProperty(result.findings, "coverage", { value: result.coverage, enumerable: false });
   Object.defineProperty(result.findings, "metadata", { value: { ...scanMetadata(appRoot, manifest, result.coverage, result.contentDigests, repositoryIdentity, location.commit), pathBase: location.pathBase, pathPrefix: location.prefix, provenance: result.provenance, ...Object.fromEntries(Object.entries(authority).filter(([key]) => key !== "trust")) }, enumerable: false });
   return result.findings;
@@ -702,12 +735,12 @@ function checkAppInternal(appRoot, manifest, options, readAuthority) {
   const resolved = initialTrust?.keyAuthority ? resolveSharedAuthority(initialTrust, readAuthority) : resolveRepositoryKeyLog(initialTrust, repositoryLocation.root, repositoryIdentity, readAuthority);
   const trust = resolved.trust;
   const location = repositoryLocation;
-  const scanned = scanInternal(appRoot, manifest, { inventory: fileInventory(appRoot, trust, location.prefix, location.root), trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix });
-  const metadata = { ...scanMetadata(appRoot, manifest, scanned.coverage, scanned.contentDigests, repositoryIdentity, location.commit), pathBase: location.pathBase, pathPrefix: location.prefix, provenance: scanned.provenance, ...Object.fromEntries(Object.entries(resolved).filter(([key]) => key !== "trust")) };
-  if (trust?.rootFingerprint && Array.isArray(trust.ownershipKeys) && !trust.ownershipKeys.length) throw new Error("protected ownership key log has no active approval keys");
   const enrollment = trust?.rootFingerprint
     ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined;
+  const scanned = scanInternal(appRoot, manifest, { inventory: fileInventory(appRoot, trust, location.prefix, location.root), trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, enrollment), shipped: options.shippedAllowlist }) });
+  const metadata = { ...scanMetadata(appRoot, manifest, scanned.coverage, scanned.contentDigests, repositoryIdentity, location.commit), pathBase: location.pathBase, pathPrefix: location.prefix, provenance: scanned.provenance, ...Object.fromEntries(Object.entries(resolved).filter(([key]) => key !== "trust")) };
+  if (trust?.rootFingerprint && Array.isArray(trust.ownershipKeys) && !trust.ownershipKeys.length) throw new Error("protected ownership key log has no active approval keys");
   const result = evaluate(scanned.findings, loadExceptions(appRoot), { ...options, manifest, trust, trustEnrollment: enrollment, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
@@ -754,7 +787,10 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
   if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
     inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
   }
-  const scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix });
+  const committedEnrollment = trust?.rootFingerprint
+    ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
+    : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined;
+  const scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
   const exceptionPath = [location.prefix.replace(/\/$/, ""), EXCEPTIONS_FILE.split(path.sep).join("/")].filter(Boolean).join("/");
   const exceptionObject = committed.entries.find((entry) => entry.rel === exceptionPath);
   const exceptionEntry = exceptionObject?.bytes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.143",
+  "version": "0.2.145",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/pe-imports.mjs

@@ -55,5 +55,7 @@ export function readPeImports(bytes) {
       delayImports.add(cstring(name));
     }
   }
-  return { machine, architecture: PE_MACHINES[machine] ?? `0x${machine.toString(16)}`, imports: [...imports], delayImports: [...delayImports] };
+  // Optional header Subsystem is at offset 68 in both PE32 and PE32+ (2 = WINDOWS_GUI, 3 = WINDOWS_CUI).
+  const subsystem = buf.readUInt16LE(optional + 68);
+  return { machine, architecture: PE_MACHINES[machine] ?? `0x${machine.toString(16)}`, subsystem, imports: [...imports], delayImports: [...delayImports] };
 }

package/protected-credentials.mjs

@@ -15,6 +15,7 @@ export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 // from the release config or environment, and the .p8 is read from its file.
 export const PROTECTED_SECRETS = Object.freeze({
   "cloudflare-api-token": { label: "Cloudflare API token", keychain: "rightkit-cloudflare-api-token", file: "cloudflare-api-token.token" },
+  "qa-receipt-key": { label: "RightKit QA receipt key", keychain: null, file: "qa-receipt-key.token", darwinFile: true },
 });
 
 export class ProtectedSecretMissingError extends Error {
@@ -35,6 +36,7 @@ export class ProtectedSecretMissingError extends Error {
 export function protectedSecretStoreCommand(name, platform = process.platform) {
   const spec = PROTECTED_SECRETS[name];
   if (!spec) throw new Error(`unknown protected secret: ${name}`);
+  if (platform === "darwin" && spec.darwinFile) return null;
   if (platform === "darwin") return `security add-generic-password -a "$USER" -s ${spec.keychain} -U -w`;
   if (platform === "win32") {
     return `powershell -NoProfile -Command "$s = Read-Host -AsSecureString '${spec.label}'; $d = Join-Path $env:APPDATA 'RightKit'; New-Item -ItemType Directory -Force -Path $d | Out-Null; [IO.File]::WriteAllText((Join-Path $d '${spec.file}'), [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($s)))"`;
@@ -61,6 +63,8 @@ function readProtectedFile(file) {
   }
 }
 
+export const darwinKeyFile = (env, spec) => path.join(env.HOME || os.homedir(), "Library", "Application Support", "RightKit", spec.file);
+
 // The store is injectable so tests can use fakes without touching a real
 // Keychain or the Windows profile directory.
 export function createCredentialStore({
@@ -76,7 +80,8 @@ export function createCredentialStore({
       const spec = PROTECTED_SECRETS[name];
       let value;
       if (platform === "darwin") {
-        value = readKeychain({ service: spec.keychain, account: env.USER || os.userInfo().username });
+        // Receipt MAC keys are provisioned by right-release itself as a 0600 file, never from the Keychain.
+        value = spec.darwinFile ? readFile(darwinKeyFile(env, spec)) : readKeychain({ service: spec.keychain, account: env.USER || os.userInfo().username });
       } else if (platform === "win32") {
         const appData = env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
         value = readFile(path.win32.join(appData, "RightKit", spec.file));