@rightkit/release 0.2.149 → 0.2.151

package/README.md

@@ -75,7 +75,9 @@ Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (c
 
 `updater.kind: "appinstaller"` (default remains the Tauri minisign flow) generates `msix.appInstaller.out` (https `uri`/`msixUri`); trust is the MSIX Authenticode signature, so no `.sig` is produced and `publish-update` records the sealed package digest.
 
-Never cancel an MSIX deployment from app or updater code. Cancelling `AddPackageAsync` while it is in `RegistrationChanged` leaves the package `Modified, NeedsRemediation` (0x80073CF8, AppX event 751); the app then cannot activate, so the OnLaunch feed check never runs and cannot self-heal. Measured recovery (SwiftRight SliceApp R5 W08, 2026-10-10): `Add-AppxPackage -AppInstallerFile <feed uri>` restores launch by deploying the feed's newer version, with user data intact; `-RegisterByFamilyName`, `Reset-AppxPackage` and relaunching do not. Recovery when the feed offers no newer version is unverified, so publish the next version to the feed before directing a user to that command.
+Portable macOS targets (`macos-developer-id-notarized-portable-v1`) whose `notarize.file` is an archive of bare executables set `notarize.staple: false`: the archive is notarized (Accepted) and recorded, nothing is stapled. Portable Windows and macOS targets with no installer or updater block seal their archives from `targets.<platform>.artifacts`.
+
+Never cancel an MSIX deployment from app or updater code. Cancelling `AddPackageAsync` while it is in `RegistrationChanged` leaves the package `Modified, NeedsRemediation` (0x80073CF8, AppX event 751); the app then cannot activate, so the OnLaunch feed check never runs and cannot self-heal. Measured recovery (SwiftRight SliceApp R5 W08 tuple 08, 2026-10-10, one run per method, user data intact in every recovering case): Settings › Apps › Advanced options › Repair recovers a feed install (with or without a newer version on the feed) and a path install with no feed; `Add-AppxPackage -Path <same-version .msix>` recovers; `Add-AppxPackage -AppInstallerFile <feed uri>` recovers with or without a newer version on the feed. `Reset-AppxPackage`, `-RegisterByFamilyName`, the platform's own `RegisterByPackageFullName` (runs on every launch attempt, reports success, package stays NeedsRemediation) and relaunching do not. Not measured: Repair with the install source gone.
 
 macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
 

package/build-release.mjs

@@ -477,6 +477,15 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     addSource(resolveArtifactPath(artifact.file), "updater");
     if (target.updater?.kind !== "appinstaller") addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
+  // Portable contracts ship bare archives (zip / tar.gz) with no installer or
+  // updater block: `target.artifacts` entries (paths or { file }) seal with the
+  // "portable" role.
+  for (const artifact of target.artifacts ?? []) {
+    const file = typeof artifact === "string" ? artifact : artifact?.file;
+    if (typeof file !== "string" || !file) fail("target.artifacts entries must be paths or { file }");
+    addSource(resolveArtifactPath(file), "portable");
+  }
+  if (sources.size === 0) fail(`nothing to seal: declare installer.artifacts, updater.artifacts or artifacts for the ${platform} target`);
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
   if (existsSync(temp)) rmSync(temp, { recursive: true, force: true });

package/macos-notarization.mjs

@@ -33,7 +33,12 @@ function fileEvidence(file) {
 
 // DMG/PKG receive their own ticket. For a separately submitted app ZIP,
 // target.notarize.app (CLI --app) identifies the bundle to staple before packaging.
-export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile, app, run = spawnSync, env = process.env, ...agentOptions }) {
+// `staple: false` is for archives of bare Mach-O executables (portable CLIs):
+// the notary ticket is recorded online and nothing can carry a staple, so the
+// receipt records `staplingSkipped` instead of stapling evidence.
+export const STAPLING_SKIPPED_PORTABLE = "portable-executables";
+
+export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile, app, staple = true, run = spawnSync, env = process.env, ...agentOptions }) {
   archive = path.resolve(archive);
   const stapleTargets = /\.(dmg|pkg)$/i.test(archive) ? [archive] : [];
   if (app) {
@@ -41,7 +46,11 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile,
     if (!/\.app$/i.test(bundle)) throw new Error(`notarize.app must name an app bundle: ${bundle}`);
     stapleTargets.push(bundle);
   }
-  if (!stapleTargets.length) throw new Error("notarization archives require notarize.app (or --app) for stapling their app bundle");
+  if (staple === false) {
+    if (stapleTargets.length) throw new Error("notarize.staple: false applies only to archives of bare executables (no .dmg/.pkg archive and no notarize.app)");
+  } else if (!stapleTargets.length) {
+    throw new Error("notarization archives require notarize.app (or --app) for stapling their app bundle, or notarize.staple: false for bare executables");
+  }
   let result, stapling;
   if (detectMacSigningSession({ env, run }).guiRunner) {
     // SSH ignores API credential environment/argv entirely. Only profile name
@@ -64,6 +73,7 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile,
     archive: { file: archive, ...fileEvidence(archive) },
     notarization: { status: result.status, id: result.id ?? result.submissionId ?? null },
     stapling,
+    ...(staple === false ? { staplingSkipped: STAPLING_SKIPPED_PORTABLE } : {}),
   };
   mkdirSync(path.dirname(path.resolve(receiptPath)), { recursive: true });
   writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
@@ -99,6 +109,12 @@ export function validateNotarizationReceipt({ receiptPath, archive, run = spawnS
     || path.resolve(receipt.archive?.file ?? "") !== archive || receipt.archive.sha256 !== fileEvidence(archive).sha256
     || receipt.notarization?.status !== "Accepted") throw new Error(`invalid macOS notarization receipt evidence: ${receiptPath}`);
   const stapling = receipt.stapling;
+  if (receipt.staplingSkipped === STAPLING_SKIPPED_PORTABLE) {
+    if (/\.(dmg|pkg|app)$/i.test(archive) || !Array.isArray(stapling) || stapling.length) {
+      throw new Error(`invalid macOS notarization receipt: stapling may be skipped only for archives of bare executables: ${receiptPath}`);
+    }
+    return receipt;
+  }
   if (!Array.isArray(stapling) || !stapling.length || stapling.some((item) => item.validated !== true || !/\.(dmg|pkg|app)$/i.test(item.file ?? ""))
     || (/\.(dmg|pkg|app)$/i.test(archive) && !stapling.some((item) => path.resolve(item.file) === archive))) {
     throw new Error(`missing macOS stapling evidence: ${receiptPath}; rerun notarization before sealing`);

package/notarize-macos.mjs

@@ -5,14 +5,15 @@ import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
+const noStaple = args.includes("--no-staple");
 const receiptIndex = args.indexOf("--receipt");
 const profileIndex = args.indexOf("--profile");
 const appIndex = args.indexOf("--app");
 const app = appIndex >= 0 ? args[appIndex + 1] : undefined;
 const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
 const profile = profileIndex >= 0 ? args[profileIndex + 1] : undefined;
-const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--profile" && arg !== "--app" && (appIndex < 0 || index !== appIndex + 1) && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
-if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] --receipt <path> [--profile <name>] [--app <bundle>] <archive>");
+const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--no-staple" && arg !== "--receipt" && arg !== "--profile" && arg !== "--app" && (appIndex < 0 || index !== appIndex + 1) && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
+if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] [--no-staple] --receipt <path> [--profile <name>] [--app <bundle>] <archive>");
 if (!receiptPath || receiptPath.startsWith("--")) fail("--receipt requires a path");
 if (appIndex >= 0 && (!app || app.startsWith("--"))) fail("--app requires an app bundle path");
 const archive = path.resolve(archiveArgs[0]);
@@ -23,7 +24,7 @@ if (dryRun) {
 if (process.platform !== "darwin") fail("macOS notarization must run on macOS");
 if (!existsSync(archive)) fail(`missing archive: ${archive}`);
 
-try { notarizeMacosArtifact({ archive, receiptPath, profile, app }); }
+try { notarizeMacosArtifact({ archive, receiptPath, profile, app, staple: noStaple ? false : true }); }
 catch (error) {
   if (error.report) console.error(JSON.stringify(error.report));
   fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.149",
+  "version": "0.2.151",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/publish-swift.mjs

@@ -16,7 +16,10 @@ import { scanCrateForSecrets } from "./publish-cargo.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
 export const DEFAULT_SWIFT_GIT_URL = "https://github.com/bogusyogi/rightkit-swift.git";
-const MIRROR_EXCLUDES = new Set([".build", ".swiftpm", ".git", "Package.resolved", ".DS_Store"]);
+// The mirror must reproduce the verified git subtree exactly (its tree id is
+// compared), so only untracked build state is excluded. Tracked Xcode scheme
+// metadata under .swiftpm ships with the package; SwiftPM consumers ignore it.
+const MIRROR_EXCLUDES = new Set([".build", ".git", "Package.resolved", ".DS_Store"]);
 
 export function parseSwiftPublishArgs(argv, env = process.env) {
   const allowed = new Set(["--repo", "--dry-run", "--allow-dirty", "--evidence", "--workspace"]);
@@ -138,7 +141,10 @@ export function runSwiftPublish(options, execute = spawnSync) {
   const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
   const sourceCommit = gate.evidence?.commit ?? "HEAD";
   const tree = git(["rev-parse", prefix ? `${sourceCommit}:${prefix}` : `${sourceCommit}^{tree}`], packageDir, execute);
-  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: packageDir, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
+  // `git archive` filters by the current subdirectory, so archiving the package
+  // subtree from inside the package yields an empty tar; run it at the toplevel.
+  const toplevel = git(["rev-parse", "--show-toplevel"], packageDir, execute) || packageDir;
+  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: toplevel, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
   if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift source archive creation failed");
   const bytes = Buffer.from(archive.stdout);
   if (gate.ok || !options.dryRun) verifySwiftSourceArchive(bytes, gate.evidence);

package/release.mjs

@@ -160,6 +160,9 @@ if (opts.platform === "mac") {
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
   if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
   if (target.notarize.appBeforePackage && !target.notarize.app) fail(`${config.app ?? "app"} mac notarize.appBeforePackage requires notarize.app`);
+  if (target.notarize.staple === false && (target.notarize.app || /\.(dmg|pkg)$/i.test(target.notarize.file))) {
+    fail(`${config.app ?? "app"} mac notarize.staple: false applies only to an archive of bare executables (no notarize.app, not a .dmg/.pkg)`);
+  }
   const swiftDmgError = swiftMacDmgConfigError({ target, projectType: resolveProjectType({ appRoot: root, config, target }), appName: config.app ?? "app" });
   if (swiftDmgError) fail(swiftDmgError);
 }
@@ -820,9 +823,13 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const allowedRegeneratePermissions = new Set(["contents", "pull-requests"]);
     const devMacSpan = workflow === "ci.yml" ? jobSpan("dev-mac-sign") : null;
     const devMacSource = devMacSpan ? source.slice(devMacSpan.start, devMacSpan.end) : "";
-    const allowedDevMacSecrets = new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD"]);
+    // `mac: "notarize"` additionally allows the notary API key secrets; the
+    // job gate (push to the default branch, release environment) is the same.
+    const allowedDevMacSecrets = manifest?.devArtifact?.mac === "notarize"
+      ? allowedMacosSecrets
+      : new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD"]);
     const protectedDevMacSigning = workflow === "ci.yml"
-      && manifest?.devArtifact?.mac === "sign"
+      && (manifest?.devArtifact?.mac === "sign" || manifest?.devArtifact?.mac === "notarize")
       && /dev-mac-sign:\n(?:    #[^\n]*\n)*    needs: \[ci\]\n    if: \$\{\{ github\.event_name == 'push' && github\.ref_name == github\.event\.repository\.default_branch \}\}\n    environment: /.test(devMacSource);
     const releaseChain = workflow === "release-candidate.yml" ? manifest?.candidate?.releaseChain : undefined;
     const allowedReleaseSecrets = new Set(releaseChain?.publishSecrets ?? []);
@@ -927,6 +934,7 @@ async function notarizeMacos(archive, root) {
   if (opts.dryRun) args.push("--dry-run");
   args.push("--receipt", receipt);
   if (target.notarize.profile) args.push("--profile", target.notarize.profile);
+  if (target.notarize.staple === false) args.push("--no-staple");
   // With appBeforePackage the app already carries its own stapled ticket inside the packaged DMG.
   if (target.notarize.app && !target.notarize.appBeforePackage) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
   args.push(archive);

package/rightkit-versions.json

@@ -13,27 +13,27 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/app-shell": "0.3.0",
+    "@rightkit/app-shell": "0.4.0",
     "@rightkit/ax": "0.2.4",
-    "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.36",
+    "@rightkit/doc-render": "0.1.5",
+    "@rightkit/git": "0.2.37",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.2.0",
     "@rightkit/license": "0.1.8",
     "@rightkit/logs": "0.1.4",
-    "@rightkit/media-ui": "0.3.0",
-    "@rightkit/onboarding": "0.3.0",
-    "@rightkit/pdf-ui": "0.1.2",
+    "@rightkit/media-ui": "0.3.1",
+    "@rightkit/onboarding": "0.3.1",
+    "@rightkit/pdf-ui": "0.1.3",
     "@rightkit/platform-ui": "0.2.0",
-    "@rightkit/qa": "0.4.0",
+    "@rightkit/qa": "0.4.1",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.149",
-    "@rightkit/settings-ui": "0.3.0",
+    "@rightkit/release": "0.2.151",
+    "@rightkit/settings-ui": "0.3.1",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
-    "@rightkit/theme": "0.2.1",
+    "@rightkit/theme": "0.2.2",
     "@rightkit/updates": "0.2.5"
   },
   "legacyNpm": {
@@ -77,7 +77,8 @@
       "0.2.32",
       "0.2.33",
       "0.2.34",
-      "0.2.35"
+      "0.2.35",
+      "0.2.36"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -184,7 +185,9 @@
       "0.2.145",
       "0.2.146",
       "0.2.147",
-      "0.2.148"
+      "0.2.148",
+      "0.2.149",
+      "0.2.150"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -195,12 +198,14 @@
       "0.2.4",
       "0.3.0",
       "0.3.1",
-      "0.3.2"
+      "0.3.2",
+      "0.4.0"
     ],
     "@rightkit/app-shell": [
       "0.1.0",
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.3.0"
     ],
     "@rightkit/media-ui": [
       "0.1.0",
@@ -210,11 +215,13 @@
       "0.2.3",
       "0.2.4",
       "0.2.5",
-      "0.2.6"
+      "0.2.6",
+      "0.3.0"
     ],
     "@rightkit/theme": [
       "0.1.0",
-      "0.2.0"
+      "0.2.0",
+      "0.2.1"
     ],
     "@rightkit/settings-ui": [
       "0.1.0",
@@ -224,20 +231,23 @@
       "0.2.4",
       "0.2.5",
       "0.2.6",
-      "0.2.7"
+      "0.2.7",
+      "0.3.0"
     ],
     "@rightkit/onboarding": [
       "0.1.0",
       "0.2.0",
       "0.2.1",
       "0.2.2",
-      "0.2.3"
+      "0.2.3",
+      "0.3.0"
     ],
     "@rightkit/doc-render": [
       "0.1.0",
       "0.1.1",
       "0.1.2",
-      "0.1.3"
+      "0.1.3",
+      "0.1.4"
     ],
     "@rightkit/platform-ui": [
       "0.1.1",
@@ -245,7 +255,8 @@
     ],
     "@rightkit/pdf-ui": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "@rightkit/qa-chrome": [
       "0.1.0",
@@ -326,13 +337,13 @@
   "swift": {
     "rightkit-swift": {
       "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.1.1"
+      "version": "0.4.0"
     }
   },
   "stagedSwift": {
     "rightkit-swift": {
       "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.3.1"
+      "version": "0.4.0"
     }
   },
   "registry": {
@@ -380,27 +391,27 @@
       "rightkit-watch": "0.3.1"
     },
     "npm": {
-      "@rightkit/app-shell": "0.3.0",
+      "@rightkit/app-shell": "0.4.0",
       "@rightkit/ax": "0.2.4",
-      "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.36",
+      "@rightkit/doc-render": "0.1.5",
+      "@rightkit/git": "0.2.37",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
       "@rightkit/legal-ui": "0.2.0",
       "@rightkit/license": "0.1.8",
       "@rightkit/logs": "0.1.4",
-      "@rightkit/media-ui": "0.3.0",
-      "@rightkit/onboarding": "0.3.0",
-      "@rightkit/pdf-ui": "0.1.2",
+      "@rightkit/media-ui": "0.3.1",
+      "@rightkit/onboarding": "0.3.1",
+      "@rightkit/pdf-ui": "0.1.3",
       "@rightkit/platform-ui": "0.2.0",
-      "@rightkit/qa": "0.4.0",
+      "@rightkit/qa": "0.4.1",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.148",
-      "@rightkit/settings-ui": "0.3.0",
+      "@rightkit/release": "0.2.150",
+      "@rightkit/settings-ui": "0.3.1",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
-      "@rightkit/theme": "0.2.1",
+      "@rightkit/theme": "0.2.2",
       "@rightkit/updates": "0.2.5"
     }
   },