@rightkit/release 0.2.150 → 0.2.151

package/README.md

@@ -75,7 +75,9 @@ Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (c
 
 `updater.kind: "appinstaller"` (default remains the Tauri minisign flow) generates `msix.appInstaller.out` (https `uri`/`msixUri`); trust is the MSIX Authenticode signature, so no `.sig` is produced and `publish-update` records the sealed package digest.
 
-Never cancel an MSIX deployment from app or updater code. Cancelling `AddPackageAsync` while it is in `RegistrationChanged` leaves the package `Modified, NeedsRemediation` (0x80073CF8, AppX event 751); the app then cannot activate, so the OnLaunch feed check never runs and cannot self-heal. Measured recovery (SwiftRight SliceApp R5 W08, 2026-10-10): `Add-AppxPackage -AppInstallerFile <feed uri>` restores launch by deploying the feed's newer version, with user data intact; `-RegisterByFamilyName`, `Reset-AppxPackage` and relaunching do not. Recovery when the feed offers no newer version is unverified, so publish the next version to the feed before directing a user to that command.
+Portable macOS targets (`macos-developer-id-notarized-portable-v1`) whose `notarize.file` is an archive of bare executables set `notarize.staple: false`: the archive is notarized (Accepted) and recorded, nothing is stapled. Portable Windows and macOS targets with no installer or updater block seal their archives from `targets.<platform>.artifacts`.
+
+Never cancel an MSIX deployment from app or updater code. Cancelling `AddPackageAsync` while it is in `RegistrationChanged` leaves the package `Modified, NeedsRemediation` (0x80073CF8, AppX event 751); the app then cannot activate, so the OnLaunch feed check never runs and cannot self-heal. Measured recovery (SwiftRight SliceApp R5 W08 tuple 08, 2026-10-10, one run per method, user data intact in every recovering case): Settings › Apps › Advanced options › Repair recovers a feed install (with or without a newer version on the feed) and a path install with no feed; `Add-AppxPackage -Path <same-version .msix>` recovers; `Add-AppxPackage -AppInstallerFile <feed uri>` recovers with or without a newer version on the feed. `Reset-AppxPackage`, `-RegisterByFamilyName`, the platform's own `RegisterByPackageFullName` (runs on every launch attempt, reports success, package stays NeedsRemediation) and relaunching do not. Not measured: Repair with the install source gone.
 
 macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
 

package/build-release.mjs

@@ -477,6 +477,15 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     addSource(resolveArtifactPath(artifact.file), "updater");
     if (target.updater?.kind !== "appinstaller") addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
+  // Portable contracts ship bare archives (zip / tar.gz) with no installer or
+  // updater block: `target.artifacts` entries (paths or { file }) seal with the
+  // "portable" role.
+  for (const artifact of target.artifacts ?? []) {
+    const file = typeof artifact === "string" ? artifact : artifact?.file;
+    if (typeof file !== "string" || !file) fail("target.artifacts entries must be paths or { file }");
+    addSource(resolveArtifactPath(file), "portable");
+  }
+  if (sources.size === 0) fail(`nothing to seal: declare installer.artifacts, updater.artifacts or artifacts for the ${platform} target`);
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
   if (existsSync(temp)) rmSync(temp, { recursive: true, force: true });

package/macos-notarization.mjs

@@ -33,7 +33,12 @@ function fileEvidence(file) {
 
 // DMG/PKG receive their own ticket. For a separately submitted app ZIP,
 // target.notarize.app (CLI --app) identifies the bundle to staple before packaging.
-export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile, app, run = spawnSync, env = process.env, ...agentOptions }) {
+// `staple: false` is for archives of bare Mach-O executables (portable CLIs):
+// the notary ticket is recorded online and nothing can carry a staple, so the
+// receipt records `staplingSkipped` instead of stapling evidence.
+export const STAPLING_SKIPPED_PORTABLE = "portable-executables";
+
+export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile, app, staple = true, run = spawnSync, env = process.env, ...agentOptions }) {
   archive = path.resolve(archive);
   const stapleTargets = /\.(dmg|pkg)$/i.test(archive) ? [archive] : [];
   if (app) {
@@ -41,7 +46,11 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile,
     if (!/\.app$/i.test(bundle)) throw new Error(`notarize.app must name an app bundle: ${bundle}`);
     stapleTargets.push(bundle);
   }
-  if (!stapleTargets.length) throw new Error("notarization archives require notarize.app (or --app) for stapling their app bundle");
+  if (staple === false) {
+    if (stapleTargets.length) throw new Error("notarize.staple: false applies only to archives of bare executables (no .dmg/.pkg archive and no notarize.app)");
+  } else if (!stapleTargets.length) {
+    throw new Error("notarization archives require notarize.app (or --app) for stapling their app bundle, or notarize.staple: false for bare executables");
+  }
   let result, stapling;
   if (detectMacSigningSession({ env, run }).guiRunner) {
     // SSH ignores API credential environment/argv entirely. Only profile name
@@ -64,6 +73,7 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile,
     archive: { file: archive, ...fileEvidence(archive) },
     notarization: { status: result.status, id: result.id ?? result.submissionId ?? null },
     stapling,
+    ...(staple === false ? { staplingSkipped: STAPLING_SKIPPED_PORTABLE } : {}),
   };
   mkdirSync(path.dirname(path.resolve(receiptPath)), { recursive: true });
   writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
@@ -99,6 +109,12 @@ export function validateNotarizationReceipt({ receiptPath, archive, run = spawnS
     || path.resolve(receipt.archive?.file ?? "") !== archive || receipt.archive.sha256 !== fileEvidence(archive).sha256
     || receipt.notarization?.status !== "Accepted") throw new Error(`invalid macOS notarization receipt evidence: ${receiptPath}`);
   const stapling = receipt.stapling;
+  if (receipt.staplingSkipped === STAPLING_SKIPPED_PORTABLE) {
+    if (/\.(dmg|pkg|app)$/i.test(archive) || !Array.isArray(stapling) || stapling.length) {
+      throw new Error(`invalid macOS notarization receipt: stapling may be skipped only for archives of bare executables: ${receiptPath}`);
+    }
+    return receipt;
+  }
   if (!Array.isArray(stapling) || !stapling.length || stapling.some((item) => item.validated !== true || !/\.(dmg|pkg|app)$/i.test(item.file ?? ""))
     || (/\.(dmg|pkg|app)$/i.test(archive) && !stapling.some((item) => path.resolve(item.file) === archive))) {
     throw new Error(`missing macOS stapling evidence: ${receiptPath}; rerun notarization before sealing`);

package/notarize-macos.mjs

@@ -5,14 +5,15 @@ import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
+const noStaple = args.includes("--no-staple");
 const receiptIndex = args.indexOf("--receipt");
 const profileIndex = args.indexOf("--profile");
 const appIndex = args.indexOf("--app");
 const app = appIndex >= 0 ? args[appIndex + 1] : undefined;
 const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
 const profile = profileIndex >= 0 ? args[profileIndex + 1] : undefined;
-const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--profile" && arg !== "--app" && (appIndex < 0 || index !== appIndex + 1) && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
-if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] --receipt <path> [--profile <name>] [--app <bundle>] <archive>");
+const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--no-staple" && arg !== "--receipt" && arg !== "--profile" && arg !== "--app" && (appIndex < 0 || index !== appIndex + 1) && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
+if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] [--no-staple] --receipt <path> [--profile <name>] [--app <bundle>] <archive>");
 if (!receiptPath || receiptPath.startsWith("--")) fail("--receipt requires a path");
 if (appIndex >= 0 && (!app || app.startsWith("--"))) fail("--app requires an app bundle path");
 const archive = path.resolve(archiveArgs[0]);
@@ -23,7 +24,7 @@ if (dryRun) {
 if (process.platform !== "darwin") fail("macOS notarization must run on macOS");
 if (!existsSync(archive)) fail(`missing archive: ${archive}`);
 
-try { notarizeMacosArtifact({ archive, receiptPath, profile, app }); }
+try { notarizeMacosArtifact({ archive, receiptPath, profile, app, staple: noStaple ? false : true }); }
 catch (error) {
   if (error.report) console.error(JSON.stringify(error.report));
   fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.150",
+  "version": "0.2.151",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -160,6 +160,9 @@ if (opts.platform === "mac") {
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
   if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
   if (target.notarize.appBeforePackage && !target.notarize.app) fail(`${config.app ?? "app"} mac notarize.appBeforePackage requires notarize.app`);
+  if (target.notarize.staple === false && (target.notarize.app || /\.(dmg|pkg)$/i.test(target.notarize.file))) {
+    fail(`${config.app ?? "app"} mac notarize.staple: false applies only to an archive of bare executables (no notarize.app, not a .dmg/.pkg)`);
+  }
   const swiftDmgError = swiftMacDmgConfigError({ target, projectType: resolveProjectType({ appRoot: root, config, target }), appName: config.app ?? "app" });
   if (swiftDmgError) fail(swiftDmgError);
 }
@@ -931,6 +934,7 @@ async function notarizeMacos(archive, root) {
   if (opts.dryRun) args.push("--dry-run");
   args.push("--receipt", receipt);
   if (target.notarize.profile) args.push("--profile", target.notarize.profile);
+  if (target.notarize.staple === false) args.push("--no-staple");
   // With appBeforePackage the app already carries its own stapled ticket inside the packaged DMG.
   if (target.notarize.app && !target.notarize.appBeforePackage) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
   args.push(archive);

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.1",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.150",
+    "@rightkit/release": "0.2.151",
     "@rightkit/settings-ui": "0.3.1",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -186,7 +186,8 @@
       "0.2.146",
       "0.2.147",
       "0.2.148",
-      "0.2.149"
+      "0.2.149",
+      "0.2.150"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -390,9 +391,9 @@
       "rightkit-watch": "0.3.1"
     },
     "npm": {
-      "@rightkit/app-shell": "0.3.0",
+      "@rightkit/app-shell": "0.4.0",
       "@rightkit/ax": "0.2.4",
-      "@rightkit/doc-render": "0.1.4",
+      "@rightkit/doc-render": "0.1.5",
       "@rightkit/git": "0.2.37",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
@@ -400,17 +401,17 @@
       "@rightkit/legal-ui": "0.2.0",
       "@rightkit/license": "0.1.8",
       "@rightkit/logs": "0.1.4",
-      "@rightkit/media-ui": "0.3.0",
-      "@rightkit/onboarding": "0.3.0",
-      "@rightkit/pdf-ui": "0.1.2",
+      "@rightkit/media-ui": "0.3.1",
+      "@rightkit/onboarding": "0.3.1",
+      "@rightkit/pdf-ui": "0.1.3",
       "@rightkit/platform-ui": "0.2.0",
-      "@rightkit/qa": "0.4.0",
+      "@rightkit/qa": "0.4.1",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.149",
-      "@rightkit/settings-ui": "0.3.0",
+      "@rightkit/release": "0.2.150",
+      "@rightkit/settings-ui": "0.3.1",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
-      "@rightkit/theme": "0.2.1",
+      "@rightkit/theme": "0.2.2",
       "@rightkit/updates": "0.2.5"
     }
   },