@rightkit/release 0.2.151 → 0.2.153

package/release.mjs

@@ -21,6 +21,7 @@ import { packageCommandOptional, resolveProjectType, targetUsesMsix } from "./pr
 import { MSIX_SIGNING_CONTRACT, assertValidMsixTarget } from "./msix-config.mjs";
 import { buildMsix } from "./msix-build.mjs";
 import { msixBuildOptions } from "./msix-target.mjs";
+import { rightKitVersionAllowed } from "./rightkit-version-policy.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
@@ -30,12 +31,17 @@ import { signingReceiptPath } from "./signing-receipts.mjs";
 import { notarizeAppBundle, validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { fileEvidence } from "./macos-file-evidence.mjs";
-import { expandMacSigningEntries } from "./mac-bundle-signing.mjs";
+import { readDmgSpec } from "./dmg-spec.mjs";
+import { hasNonDefaultSettings, matrixReceiptProblems, planMacSigning, validateMacSigningConfig } from "./mac-signing-matrix.mjs";
 import { buildStapledSwiftMacDmg, swiftMacDmgConfigError, swiftMacDmgPlan } from "./swift-mac-dmg.mjs";
 import { runConfiguredChecks } from "./release-checks.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
+import { assertNoQaControl, assertNoWebBundleMocks } from "./qa-control-scan.mjs";
+import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
+import { assertNoReleaseSwitches, commandTokens, resolveFeatureClosure } from "./release-switch-scan.mjs";
+import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -51,6 +57,7 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
   RIGHTKIT_VERSIONS.npm,
   RIGHTKIT_VERSIONS.stagedNpm,
   RIGHTKIT_VERSIONS.legacyNpm,
+  RIGHTKIT_VERSIONS.registry?.npm,
 );
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo, RIGHTKIT_VERSIONS.legacyCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
@@ -58,6 +65,35 @@ const WINDOWS_NSIS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-
 const WINDOWS_PORTABLE_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-portable-v1";
 const DEFAULT_NOTARIZATION_TIMEOUT_MS = 30 * 60 * 1000;
 
+// Apple Developer ID and notary secrets: the only secrets the signing jobs of the managed release chain
+// (macos-sign, and dev-mac-sign when devArtifact.mac is "notarize") may reference.
+const APPLE_RELEASE_SECRETS = ["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD", "APPLE_API_KEY_BASE64", "APPLE_API_KEY", "APPLE_API_ISSUER"];
+// Package-manager publication tokens of the managed publish-package-managers lane.
+const PACKAGE_MANAGER_PUBLISH_SECRETS = ["HOMEBREW_TAP_TOKEN", "WINGET_CREATE_GITHUB_TOKEN"];
+
+// @rightkit/ci `swift.privatePackages` (0.2.41) renders one configure step and one cleanup step, with the
+// token passed through step `env` as `RIGHT_GIT_PRIVATE_TOKEN_<n>: ${{ secrets.<NAME> }}`, into exactly these
+// workflow/job pairs. Nothing else may reference the declared secret: not another job of these workflows, not
+// package-smoke, publish-npm or publish-package-managers, and not a signing, qualification or publish job.
+const SWIFT_PRIVATE_STEP_NAMES = new Set(["Configure private Swift package access", "Remove private Swift package access"]);
+const SWIFT_PRIVATE_ANY_PROFILE = { only: "any profile", allows: () => true };
+const SWIFT_PRIVATE_NODE_PROFILE = { only: "the node profile", allows: (manifest) => (manifest?.profile ?? "node") === "node" };
+const SWIFT_PRIVATE_PARALLEL_DEV_MAC = {
+  only: "profile rust-hybrid with devArtifact.parallel and a devArtifact.mac of sign, notarize or unsigned",
+  allows: (manifest) => manifest?.profile === "rust-hybrid"
+    && manifest?.devArtifact?.parallel === true
+    && ["sign", "notarize", "unsigned"].includes(manifest.devArtifact.mac),
+};
+const SWIFT_PRIVATE_JOBS = new Map([
+  ["ci.yml", new Map([["ci", SWIFT_PRIVATE_ANY_PROFILE], ["dev-artifact-mac", SWIFT_PRIVATE_PARALLEL_DEV_MAC], ["test", SWIFT_PRIVATE_NODE_PROFILE]])],
+  ["qualification.yml", new Map([["qualification", SWIFT_PRIVATE_ANY_PROFILE]])],
+  ["release-candidate.yml", new Map([["candidate", SWIFT_PRIVATE_ANY_PROFILE]])],
+  ["regenerate.yml", new Map([["regenerate", SWIFT_PRIVATE_ANY_PROFILE]])],
+]);
+// release-candidate.yml and regenerate.yml are dispatch lanes by design. In ci.yml and qualification.yml a
+// workflow_dispatch trigger would let a manual run of any ref reach the credential.
+const SWIFT_PRIVATE_DISPATCH_WORKFLOWS = new Set(["release-candidate.yml", "regenerate.yml"]);
+
 const args = process.argv.slice(2);
 const opts = {
   config: "right-release.config.mjs",
@@ -103,7 +139,8 @@ if (opts.resumeFrom && !MAC_RESUME_PHASES.includes(opts.resumeFrom)) usage(2, `i
 const sccacheVersion = assertSharedSccachePrerequisite();
 
 const requestedConfigPath = path.resolve(opts.config);
-const configPath = opts.doctor ? realpathSync(requestedConfigPath) : requestedConfigPath;
+// Native: expands a Windows short name (RUNNER~1), so the path compares with Git's long root below.
+const configPath = opts.doctor ? realpathSync.native(requestedConfigPath) : requestedConfigPath;
 let doctorInvocation;
 if (opts.doctor) {
   const invocationRoot = path.dirname(configPath);
@@ -138,6 +175,7 @@ const legalContract = config.legal
 if (target.signed !== true) {
   fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
 }
+let macSigning; // validated macOS sign.prePackageFiles / sign.nestedCode (mac only)
 if (opts.platform === "win") {
   const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
   const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
@@ -148,6 +186,7 @@ if (opts.platform === "win") {
   } else {
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
+  if (target.sign.prePackageFiles.some((file) => typeof file !== "string") || target.sign.nestedCode !== undefined) fail(`${config.app ?? "app"} win sign.prePackageFiles entries must be path strings; object entries and sign.nestedCode are macOS-only`);
   if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
   if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
   if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
@@ -158,6 +197,7 @@ if (opts.platform === "mac") {
   if (target.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT) fail(`${config.app ?? "app"} mac must declare signingContract: ${MACOS_PORTABLE_SIGNING_CONTRACT}`);
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} mac must declare prePackage to materialize Developer ID signing files`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
+  try { macSigning = validateMacSigningConfig(target.sign, { root }); } catch (error) { fail(`${config.app ?? "app"} mac ${error.message}`); }
   if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
   if (target.notarize.appBeforePackage && !target.notarize.app) fail(`${config.app ?? "app"} mac notarize.appBeforePackage requires notarize.app`);
   if (target.notarize.staple === false && (target.notarize.app || /\.(dmg|pkg)$/i.test(target.notarize.file))) {
@@ -165,6 +205,13 @@ if (opts.platform === "mac") {
   }
   const swiftDmgError = swiftMacDmgConfigError({ target, projectType: resolveProjectType({ appRoot: root, config, target }), appName: config.app ?? "app" });
   if (swiftDmgError) fail(swiftDmgError);
+  if (target.dmg && typeof target.dmg === "object" && target.dmg.spec !== undefined) {
+    try {
+      if (typeof target.dmg.spec !== "string" || !target.dmg.spec) throw new Error("dmg.spec must be a path string");
+      const specOptions = readDmgSpec(path.resolve(root, target.dmg.spec), { app: target.notarize.app });
+      for (const asset of [specOptions.background, specOptions.volumeIcon]) if (asset && !existsSync(asset)) throw new Error(`referenced file not found: ${asset}`);
+    } catch (error) { fail(`${config.app ?? "app"} mac targets.mac.dmg.spec: ${error.message}`); }
+  }
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
@@ -254,6 +301,61 @@ if (opts.doctor) {
   process.exit(0);
 }
 
+let prePackScanned = false; // set once a pre-pack payload scan has seen a native binary
+// Source-level layer of "no test-automation surface ships": refuse a release or update build whose build command
+// or app Cargo manifest enables devtools, qa-native, qa-control or dev-native (also in --dry-run).
+// DevTools: refused for every app except an allow-listed one that declares `devtools: "content-only"` (devtools-policy.mjs).
+let devtoolsAllowance = { mode: "denied" };
+try {
+  devtoolsAllowance = resolveDevtoolsAllowance({ config, root });
+  if (devtoolsAllowance.mode === "content-only") console.log(`right-release: devtools allowance recorded: ${JSON.stringify(devtoolsEvidence(devtoolsAllowance))}`);
+  assertNoForbiddenBuildFeatures({ root, tier: "release/update", devtools: devtoolsAllowance, cargoManifest: target.cargoManifest, manifest: config.releaseSwitches?.manifest, commands: [
+    { label: "target.prePackage", command: target.prePackage },
+    { label: "target.package", command: target.package },
+    { label: "nativeAssembly.packageHook", command: nativeAssembly?.packageHook },
+    { label: "nativeAssembly.finalizer", command: nativeFinalizer },
+    { label: "target.postSign", command: target.postSign },
+  ] });
+} catch (error) { fail(error.message); }
+
+// D4 (M21/M23) source layer: every environment/argument read in app source is registered in the app's switches.json and
+// every S1-S4 selector is compiled out of release. The inventory is `config.releaseSwitches.inventory` (relative to the
+// app root) or `switches.json`; a release without one fails (a dry run only checks one that exists).
+// The resolved feature graph (`cargo tree -e features`) is the AUTHORITATIVE test-mode check: it runs here, in the app
+// repository, for the release target, and a release that cannot run it fails (a dry run reports and continues).
+// The binary marker/name scan below is secondary evidence.
+const releaseSwitchInventoryPath = path.resolve(root, config.releaseSwitches?.inventory ?? "switches.json");
+const releaseSwitchInventoryText = existsSync(releaseSwitchInventoryPath) ? readFileSync(releaseSwitchInventoryPath, "utf8") : null;
+try {
+  let treeText;
+  try {
+    const closure = resolveFeatureClosure({
+      root,
+      manifest: config.releaseSwitches?.manifest,
+      cargoManifest: target.cargoManifest,
+      rust: config.releaseSwitches?.rust,
+      features: config.releaseSwitches?.features ?? [],
+      triple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
+      commandTexts: [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, target.postSign],
+    });
+    if (closure.skipped) console.log(`right-release: feature closure skipped (${closure.skipped})`);
+    else treeText = closure.treeText;
+  } catch (error) {
+    if (!opts.dryRun) throw error;
+    console.log(`right-release: dry run: ${error.message}`);
+  }
+  // remoteHost: rightkit-daemon `remote` is refused in the closure unless the app declares releaseSwitches.remoteHost: true.
+  const closureInput = { treeText, remoteHost: config.releaseSwitches?.remoteHost, commands: [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, target.postSign].filter(Boolean).map((c) => commandTokens(c)) };
+  if (releaseSwitchInventoryText != null) {
+    assertNoReleaseSwitches({ ...closureInput, sourceRoot: root, inventoryText: releaseSwitchInventoryText, appForbid: config.releaseSwitches?.forbid ?? [] }, "source switch inventory");
+  } else if (treeText != null || closureInput.commands.length) {
+    assertNoReleaseSwitches({ ...closureInput, appForbid: config.releaseSwitches?.forbid ?? [] }, "feature closure");
+  }
+  if (releaseSwitchInventoryText == null && !opts.dryRun) {
+    throw new Error(`source switch inventory: ${path.relative(root, releaseSwitchInventoryPath) || releaseSwitchInventoryPath} is missing; a release build needs the app's switches.json (see packages/release/README.md, "switches.json")`);
+  }
+} catch (error) { fail(error.message); }
+
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
@@ -283,15 +385,21 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   // packs the exact signed bytes, signs the package through sign-windows, verifies signer == Publisher,
   // writes the App Installer route and the seal record. Never a second signer.
   await runCommand(target.prePackage, root);
+  // Raw payload scan BEFORE the package is packed (a packed MSIX is only readable through its ZIP directory).
+  assertNoQaControlBinaries("msix staged payload", [path.resolve(root, target.msix.stageDir)], { requireBinary: true, prePack: true });
   const options = msixBuildOptions({ root, target, app: config.app, dryRun: opts.dryRun, receipts: {
     pe: windowsReceiptPath(root, "raw-exe"), msix: windowsReceiptPath(root, "installer"),
     dir: path.dirname(windowsReceiptPath(root, "raw-exe")) } });
   const built = buildMsix(options, { log: (event) => console.log(`right-release: ${JSON.stringify(event)}`) });
   console.log(`right-release: msix ${built.dryRun ? "dry-run" : "built"} ${options.out}`);
+  // Second layer: read the finished package through its ZIP central directory (stored and deflate entries).
+  if (!built.dryRun) assertNoQaControlBinaries("msix package", [options.out], { requireBinary: true });
 } else if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
   await runCommand(target.prePackage, root);
   for (const file of rawFiles) await mustExist(file, `missing raw EXE signing artifact: ${file}`);
+  // Before signing and packaging: the raw EXE is uncompressed, so a QA control server is visible here.
+  assertNoQaControlBinaries("windows raw EXE", rawFiles, { requireBinary: true, prePack: true });
   // The marker must reach its FINAL value before signing. Tauri rewrites it during
   // bundling, and doing that to signed bytes invalidates Authenticode — the exact
   // defect that shipped invalid binaries. Idempotent, so an app that still patches
@@ -317,10 +425,17 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
 } else if (opts.platform === "mac") {
   if (runMacPhase("prepackage")) await runCommand(target.prePackage, root);
   // Resolve after prePackage: with storage governance the artifact may live only in RIGHT_RELEASE_ARTIFACT_DIR.
-  const signingFiles = target.sign.prePackageFiles.map((p) => resolveReleaseArtifactPath(root, p));
-  for (const file of signingFiles) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
+  const signingEntries = macSigning.entries.map((entry) => ({ ...entry, file: resolveReleaseArtifactPath(root, entry.file) }));
+  for (const { file } of signingEntries) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
+  assertNoQaControlBinaries("macOS signing set", signingEntries.map(({ file }) => file), { requireBinary: true, prePack: true });
+  // The DMG is built from the .app (notarize.app / the signing set); a compressed DMG cannot be scanned afterwards.
+  if (target.notarize.app) {
+    const stagedApp = resolveReleaseArtifactPath(root, target.notarize.app);
+    await mustExist(stagedApp, `missing macOS app to be packed into the DMG: ${stagedApp}`);
+    assertNoQaControlBinaries("macOS app staged for the DMG", [stagedApp], { requireBinary: true, prePack: true });
+  }
   if (runMacPhase("sign")) {
-    await signMacos(signingFiles, root);
+    await signMacos(signingEntries, root, "signing", macSigning.nestedCode);
     // Opt-in (notarize.appBeforePackage): staple the .app itself before the package step copies it into the DMG.
     if (target.notarize.appBeforePackage) await notarizeAppBeforePackage(root);
   }
@@ -337,15 +452,23 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   }
 }
 
+// Extra files or directories the app declares (for example the unpacked bundle or a staged payload).
+assertNoQaControlBinaries("target.qaControlScan", (target.qaControlScan ?? []).map((p) => resolveReleaseArtifactPath(root, p)), { requireBinary: (target.qaControlScan ?? []).length > 0, prePack: true });
+
+// Frontend bundle: no browser-QA mock may ship. Read-only, so it also runs under --dry-run (against a dist that already exists).
+assertNoWebBundleMocksInFrontend("pre-package", { required: false });
+
 if (opts.platform === "mac" && runMacPhase("package")) {
   // SwiftPM + appBeforePackage: the .app is stapled by now, so right-release packs it into the DMG itself.
   const swiftDmg = swiftMacDmgPlan({ target, projectType: resolveProjectType({ appRoot: root, config, target }), appName: config.app ?? path.basename(root), resolve: (p) => resolveReleaseArtifactPath(root, p) });
   if (swiftDmg) {
     if (opts.dryRun) console.log(`dry-run: build DMG ${swiftDmg.out} from stapled app ${swiftDmg.app}, then sign it`);
-    else await buildStapledSwiftMacDmg(swiftDmg, { remove: (file) => rmSync(file, { force: true }), signDmg: (dmg) => signMacos([dmg], root, "dmg-signing") });
+    else await buildStapledSwiftMacDmg(swiftDmg, { remove: (file) => rmSync(file, { force: true }), signDmg: (dmg) => signMacos([{ file: dmg, options: [] }], root, "dmg-signing") });
   }
 }
 if (command && (opts.platform !== "mac" || runMacPhase("package"))) await runCommand(command, root);
+// The package command builds the frontend; a real run must now find and clean it.
+assertNoWebBundleMocksInFrontend("post-package", { required: !opts.dryRun });
 
 for (const rel of target.artifacts ?? []) {
   await mustExist(resolveReleaseArtifactPath(root, rel), `missing release artifact: ${rel}`);
@@ -364,7 +487,7 @@ if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_C
   if (target.postSign) await runCommand(target.postSign, root);
   const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => resolveReleaseArtifactPath(root, artifact.file)))];
   if (!updaterFiles.length) fail(`${config.app} win must declare updater.artifacts for post-code-signing minisign`);
-  await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
+  await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...(target.updater?.keyFile ? ["--key-file", String(target.updater.keyFile)] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
 }
 
 if (target.postSign && opts.platform !== "win" && (opts.platform !== "mac" || runMacPhase("post-sign"))) {
@@ -387,6 +510,10 @@ if (opts.platform !== "mac" || runMacPhase("harden")) {
       hardeningEvidence = path.join(receiptRoot, opts.platform + "-hardening-evidence.json");
       materializeHardeningEvidence({ root, allowances: target.hardeningAllowances, outputPath: hardeningEvidence });
     }
+    // Fail closed: the installer itself (NSIS LZMA, compressed DMG) cannot be read, so the raw/staged payload must
+    // have been scanned before packing. Inputs that are only ZIP containers (MSIX) are scanned in place.
+    if (!opts.dryRun && !prePackScanned) fail("no pre-pack payload scan ran for this release (raw EXE, staged payload or .app); an installer cannot be scanned after packing");
+    assertNoQaControlBinaries("hardening targets", scanTargets.map((p) => resolveReleaseArtifactPath(root, p)));
     await run("node", [
       HARDENING_SCAN,
       ...(hardeningEvidence ? ["--allow-evidence", hardeningEvidence] : []),
@@ -425,6 +552,51 @@ function usage(code, message) {
 // Product package scripts may emit final installer bytes directly into the
 // managed artifact directory. Keep legacy target-relative paths working while
 // preferring managed output when the local path does not exist.
+// Release and update builds never contain the QA control server (rightkit-qa-driver `qa-control`).
+// The development lane (development.mjs) does not run this file and is allowed to contain it.
+// `requireBinary`: an input holding no native binary (missing or empty staging dir) is a failure, not a pass.
+// `prePack`: marks that the raw payload was scanned before packing. What stays unscannable after packing
+// (NSIS LZMA payload, compressed DMG) is logged so the release record says so.
+function assertNoQaControlBinaries(label, files, { requireBinary = false, prePack = false } = {}) {
+  if (opts.dryRun || files.length === 0) return;
+  try {
+    const stats = assertNoQaControl(files, label, { requireBinary, allowContentOnlyDevtools: devtoolsAllowance.mode === "content-only" });
+    // D4 binary layer, same inputs: no test-mode marker and no S1-S4 selector name in any native binary.
+    assertNoReleaseSwitches({ binaryPaths: files, inventoryText: releaseSwitchInventoryText ?? undefined, appForbid: config.releaseSwitches?.forbid ?? [], requireBinary: false }, `${label} (release switches)`);
+    if (prePack && stats.binaries > 0) prePackScanned = true;
+    for (const opaque of stats.opaque) {
+      console.log(`right-release: ${label}: ${opaque.kind.toUpperCase()} payload is compressed and cannot be scanned (${opaque.file}); the raw payload was scanned before packing`);
+    }
+  } catch (error) {
+    fail(error.message);
+  }
+}
+
+// Frontend dist directories to scan: `target.webBundleScan` (explicit, relative to the app root) or, when absent, the
+// Tauri `build.frontendDist` / `build.distDir` of src-tauri/tauri.conf.json. A URL (dev server) is not a bundle.
+function frontendBundleDirs() {
+  if (Array.isArray(target.webBundleScan)) return target.webBundleScan.map((p) => path.resolve(root, p));
+  const confPath = path.join(root, "src-tauri", "tauri.conf.json");
+  if (!existsSync(confPath)) return [];
+  try {
+    const build = JSON.parse(readFileSync(confPath, "utf8")).build ?? {};
+    const dist = build.frontendDist ?? build.distDir;
+    if (typeof dist !== "string" || /^[a-z][a-z0-9+.-]*:\/\//i.test(dist)) return [];
+    return [path.resolve(root, "src-tauri", dist)];
+  } catch (error) { fail(`src-tauri/tauri.conf.json is unreadable, so the frontend bundle cannot be located for the mock scan: ${error.message}`); }
+}
+
+function assertNoWebBundleMocksInFrontend(phase, { required }) {
+  const dirs = frontendBundleDirs() ?? [];
+  const present = dirs.filter((dir) => existsSync(dir));
+  if (!required && present.length === 0) return;
+  if (dirs.length === 0) return;
+  try {
+    const { files } = assertNoWebBundleMocks(required ? dirs : present, `${phase} frontend bundle`, { requireFiles: true });
+    console.log(`right-release: ${phase} frontend bundle: ${files} web file(s) scanned, no browser-QA mock marker`);
+  } catch (error) { fail(error.message); }
+}
+
 function resolveReleaseArtifactPath(root, declared) {
   const local = path.resolve(root, declared);
   if (existsSync(local)) return local;
@@ -723,16 +895,105 @@ async function validateRightKitPackageContract(root, appName, hostedWorkflows) {
       fail(`${appName ?? pkg.name ?? "app"} ${name} must come from the published npm package, not ${specifier}`);
     }
     const allowed = RIGHTKIT_ALLOWED.get(name);
-    if (allowed && !allowed.has(specifier)) {
+    if (allowed && !rightKitVersionAllowed(allowed, specifier)) {
       fail(`${appName ?? pkg.name ?? "app"} ${name} must be one of ${[...allowed].join(", ")}, got ${specifier}`);
     }
   }
   const releaseAllowed = RIGHTKIT_ALLOWED.get("@rightkit/release");
-  if (!releaseAllowed?.has(pkg.devDependencies?.["@rightkit/release"])) {
+  if (!releaseAllowed || !rightKitVersionAllowed(releaseAllowed, pkg.devDependencies?.["@rightkit/release"])) {
     fail(`${appName ?? pkg.name ?? "app"} must depend on a supported @rightkit/release version in devDependencies`);
   }
 }
 
+// The top-level `on:` block(s) of a workflow: the `on` line and every indented, blank or comment line after it.
+function workflowTriggerBlocks(source) {
+  const lines = source.split("\n");
+  const blocks = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    if (!/^(?:on|"on"|'on')[ \t]*:/.test(lines[index])) continue;
+    let end = index + 1;
+    while (end < lines.length && (lines[end] === "" || /^[\s#]/.test(lines[end]))) end += 1;
+    blocks.push(lines.slice(index, end).join("\n"));
+  }
+  return blocks;
+}
+
+// The job of a managed workflow that holds `index` ({ name, start }), or null when the offset sits outside every job.
+function workflowJobAt(source, index) {
+  const marker = "\njobs:\n";
+  const jobsAt = source.indexOf(marker);
+  if (jobsAt < 0) return null;
+  const bodyStart = jobsAt + marker.length;
+  const unindented = /^[^\s#]/m.exec(source.slice(bodyStart));
+  const bodyEnd = unindented ? bodyStart + unindented.index : source.length;
+  if (index < bodyStart || index >= bodyEnd) return null;
+  let job = null;
+  for (const header of source.slice(bodyStart, bodyEnd).matchAll(/^ {2}(?![\s#])([^\n]*)$/gm)) {
+    const start = bodyStart + header.index;
+    if (start > index) break;
+    const key = /^(?:"([^"\n]*)"|'([^'\n]*)'|([^\s:"'][^\s:]*))[ \t]*:/.exec(header[1]);
+    job = { name: key ? (key[1] ?? key[2] ?? key[3]) : header[1], start };
+  }
+  return job;
+}
+
+// Why a `secrets.<name>` reference at `index` is not the declared swift.privatePackages credential in its
+// exact rendered place, or null when it is. Callers handle the signing and publish allowances first.
+function swiftPrivateSecretRefusal({ source, workflow, manifest, lanes, name, index }) {
+  const refuse = (reason) => `secrets.${name}: ${reason}`;
+  const entries = manifest?.swift?.privatePackages;
+  const declared = Array.isArray(entries)
+    && entries.length > 0
+    && entries.every((entry) => typeof entry?.secret === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,99}$/.test(entry.secret) && !/^github_/i.test(entry.secret));
+  if (!declared || !entries.some((entry) => entry.secret === name)) {
+    return refuse(Array.isArray(entries) && entries.length > 0
+      ? "not an allowed release secret and not declared in .rightgit.json swift.privatePackages"
+      : "not an allowed release secret for this workflow");
+  }
+  const publishSecrets = manifest?.candidate?.releaseChain?.publishSecrets;
+  const reserved = new Set([...APPLE_RELEASE_SECRETS, ...PACKAGE_MANAGER_PUBLISH_SECRETS, ...(Array.isArray(publishSecrets) ? publishSecrets : [])]);
+  const collisions = entries.map((entry) => entry.secret).filter((secret) => reserved.has(secret));
+  if (collisions.length > 0) {
+    return refuse(`.rightgit.json swift.privatePackages declares a signing or publishing secret name (${collisions.join(", ")})`);
+  }
+  const jobs = SWIFT_PRIVATE_JOBS.get(workflow);
+  if (!jobs) return refuse(`swift.privatePackages credentials are never rendered into ${workflow}`);
+  const lane = workflow.replace(/\.yml$/, "");
+  if (!lanes.includes(lane)) return refuse(`lane ${lane} is not listed in .rightgit.json`);
+  if (manifest?.devArtifact?.dispatch === true) return refuse("devArtifact.dispatch is true");
+  const triggerBlocks = workflowTriggerBlocks(source);
+  if (triggerBlocks.length === 0) return refuse(`${workflow} has no on: block to check its triggers`);
+  const untrusted = /\b(pull_request_target|workflow_run)\b/.exec(triggerBlocks.join("\n"));
+  if (untrusted) return refuse(`${workflow} is triggered by ${untrusted[1]}`);
+  if (!SWIFT_PRIVATE_DISPATCH_WORKFLOWS.has(workflow) && /workflow_dispatch/.test(source)) {
+    return refuse(`${workflow} has a workflow_dispatch trigger`);
+  }
+  const job = workflowJobAt(source, index);
+  if (!job) return refuse(`reference sits outside every job of ${workflow}`);
+  const rule = jobs.get(job.name);
+  if (!rule) return refuse(`job '${job.name}' of ${workflow} may not hold the swift.privatePackages credential (allowed: ${[...jobs.keys()].join(", ")})`);
+  if (!rule.allows(manifest)) return refuse(`job '${job.name}' of ${workflow} is rendered only for ${rule.only}`);
+  const lineStart = source.lastIndexOf("\n", index) + 1;
+  const lineEnd = source.indexOf("\n", index);
+  const line = source.slice(lineStart, lineEnd < 0 ? source.length : lineEnd);
+  const envLine = /^ {10}RIGHT_GIT_PRIVATE_TOKEN_(0|[1-9]\d*): \$\{\{ secrets\.([A-Za-z0-9_]+) \}\}$/.exec(line);
+  if (!envLine || envLine[2] !== name || entries[Number(envLine[1])]?.secret !== name) {
+    return refuse("not a RIGHT_GIT_PRIVATE_TOKEN_<n> env line naming entry <n> of swift.privatePackages");
+  }
+  // The owning step is the nearest preceding step line (`      - ...`) of the same job, and the line must
+  // sit in that step's own `env:` block.
+  const beforeLine = source.slice(job.start, lineStart);
+  const owner = [...beforeLine.matchAll(/^ {6}- [^\n]*$/gm)].at(-1);
+  const ownerName = /^ {6}- name: (.+)$/.exec(owner?.[0] ?? "")?.[1];
+  const sinceOwner = owner ? beforeLine.slice(owner.index).split("\n") : [];
+  let header = sinceOwner.length - 1;
+  while (header >= 0 && (sinceOwner[header] === "" || /^ {10}/.test(sinceOwner[header]))) header -= 1;
+  if (!SWIFT_PRIVATE_STEP_NAMES.has(ownerName) || sinceOwner[header] !== "        env:") {
+    return refuse('not in the env of the "Configure private Swift package access" or "Remove private Swift package access" step');
+  }
+  return null;
+}
+
 async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
@@ -745,7 +1006,7 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
   }
   const lanes = manifest?.lanes;
-  // Mirrors the `lanes` enum in @rightkit/git manifest.schema.json.
+  // Mirrors the `lanes` enum in @rightkit/ci manifest.schema.json.
   const safeLanes = new Set(["ci", "qualification", "package-smoke", "release-candidate", "publish-npm", "publish-package-managers", "regenerate"]);
   if (manifest?.schemaVersion !== 1
     || manifest?.compile !== "github-actions-only"
@@ -775,7 +1036,7 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     };
     const inside = (index, span) => span && index >= span.start && index < span.end;
     const requestedSecrets = [...source.matchAll(/\bsecrets\.([A-Z0-9_]+)/gi)].map((match) => ({ name: match[1], index: match.index }));
-    const allowedMacosSecrets = new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD", "APPLE_API_KEY_BASE64", "APPLE_API_KEY", "APPLE_API_ISSUER"]);
+    const allowedMacosSecrets = new Set(APPLE_RELEASE_SECRETS);
     const windowsSpan = jobSpan("windows-sign");
     const macosSpan = jobSpan("macos-sign");
     const publishSpan = jobSpan("publish");
@@ -802,10 +1063,10 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const protectedMacosSigning = workflow === "release-candidate.yml"
       && manifest?.candidate?.signMacos === true
       && (legacySigningGate("macos-sign").test(macosSource) || admittedSigningGate("macos-sign").test(macosSource));
-    // @rightkit/git `devArtifact.mac: "sign"` renders a `dev-mac-sign` job into
+    // @rightkit/ci `devArtifact.mac: "sign"` renders a `dev-mac-sign` job into
     // the managed ci.yml: push to the default branch only, release environment,
     // Developer ID certificate secrets only (no notarization keys).
-    // @rightkit/git `regenerate` lane: manual-only, opens a pull request from a
+    // @rightkit/ci `regenerate` lane: manual-only, opens a pull request from a
     // right-git/regenerate-<run> branch and never writes to the default branch.
     // `contents: write` and `pull-requests: write` are accepted only inside that
     // job, only when the manifest declares `regenerate`, and only when the
@@ -831,6 +1092,8 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const protectedDevMacSigning = workflow === "ci.yml"
       && (manifest?.devArtifact?.mac === "sign" || manifest?.devArtifact?.mac === "notarize")
       && /dev-mac-sign:\n(?:    #[^\n]*\n)*    needs: \[ci\]\n    if: \$\{\{ github\.event_name == 'push' && github\.ref_name == github\.event\.repository\.default_branch \}\}\n    environment: /.test(devMacSource);
+    // @rightkit/ci `swift.privatePackages` credential: allowed only in the workflow/job pairs and on the
+    // env lines listed with SWIFT_PRIVATE_JOBS; swiftPrivateSecretRefusal explains every other reference.
     const releaseChain = workflow === "release-candidate.yml" ? manifest?.candidate?.releaseChain : undefined;
     const allowedReleaseSecrets = new Set(releaseChain?.publishSecrets ?? []);
     const writePermissions = [...source.matchAll(/^\s*(actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/gmi)].map((match) => ({ name: match[1].toLowerCase(), index: match.index }));
@@ -847,6 +1110,14 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const protectedReleasePublish = releaseChain
       && (legacyReleasePublishGate || admittedReleasePublishGate)
       && /\n    permissions:\n      contents: write\n/.test(publishSource);
+    // A secret reference is refused unless a signing or publish allowance above covers it or it is the
+    // declared swift.privatePackages credential in its exact rendered place.
+    const refusedSecrets = requestedSecrets
+      .filter(({ name, index }) => !(protectedMacosSigning && inside(index, macosSpan) && allowedMacosSecrets.has(name))
+        && !(protectedDevMacSigning && inside(index, devMacSpan) && allowedDevMacSecrets.has(name))
+        && !(protectedReleasePublish && inside(index, publishSpan) && allowedReleaseSecrets.has(name)))
+      .map(({ name, index }) => swiftPrivateSecretRefusal({ source, workflow, manifest, lanes, name, index }))
+      .filter((reason) => reason !== null);
     if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
       || writePermissions.some(({ name, index }) => {
         if (protectedRegenerate && inside(index, regenerateSpan) && allowedRegeneratePermissions.has(name)) return false;
@@ -856,20 +1127,21 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
       })
       || /pull_request_target\s*:/i.test(source)
       || /\bsecrets\s*\[/i.test(source)
-      || requestedSecrets.some(({ name, index }) => !(protectedMacosSigning && inside(index, macosSpan) && allowedMacosSecrets.has(name))
-        && !(protectedDevMacSigning && inside(index, devMacSpan) && allowedDevMacSecrets.has(name))
-        && !(protectedReleasePublish && inside(index, publishSpan) && allowedReleaseSecrets.has(name)))) {
-      fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
+      || refusedSecrets.length > 0) {
+      const reasons = [...new Set(refusedSecrets)];
+      const detail = reasons.length > 10 ? [...reasons.slice(0, 10), `${reasons.length - 10} more`] : reasons;
+      fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets${detail.length > 0 ? `: ${detail.join("; ")}` : ""}`);
     }
   }
 }
 
-function buildAllowedVersions(published = {}, staged = {}, legacy = {}) {
+function buildAllowedVersions(published = {}, staged = {}, legacy = {}, registry = {}) {
   const allowed = new Map();
   for (const [name, value] of [
     ...Object.entries(published),
     ...Object.entries(staged),
     ...Object.entries(legacy),
+    ...Object.entries(registry),
   ]) {
     const versions = allowed.get(name) ?? new Set();
     for (const version of Array.isArray(value) ? value : [value]) versions.add(version);
@@ -908,24 +1180,37 @@ function windowsReceiptPath(root, phase) {
   return signingReceiptPath({ appRoot: root, target, platform: "win", phase, stateRoot: process.env.RIGHT_RELEASE_STATE_ROOT });
 }
 
-async function signMacos(files, root, phase = "signing") {
+// A signing step with per-file settings (entitlements, codesign options) goes to sign-macos.mjs as a manifest;
+// a step with only defaults keeps the historical positional invocation.
+function macSignInvocation(items, receiptPath, extra = []) {
+  if (opts.dryRun || !items.some(hasNonDefaultSettings)) return [SIGN_MACOS, ...extra, "--receipt", receiptPath, ...items.map((item) => item.file)];
+  const manifest = path.resolve(path.dirname(receiptPath), `${path.basename(receiptPath, ".json")}.manifest.json`);
+  mkdirSync(path.dirname(manifest), { recursive: true });
+  writeFileSync(manifest, `${JSON.stringify({ schema: 1, entries: items.map((item) => ({ file: item.file, ...(item.entitlements ? { entitlements: item.entitlements } : {}), options: item.options ?? [] })) }, null, 2)}\n`);
+  return [SIGN_MACOS, ...extra, "--receipt", receiptPath, "--manifest", manifest];
+}
+
+async function signMacos(entries, root, phase = "signing", nestedCode = []) {
+  const files = entries.map((entry) => entry.file);
   const receipt = phase === "signing" ? macosReceiptPath(root, "signing") : path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `macos-${phase}.json`);
-  // Directory entries (.app bundles): nested code first, no entitlements, then the bundle itself.
+  // Directory entries (.app bundles): nested code first (default settings unless sign.nestedCode names it), then the bundle itself.
   let nested = [];
-  try { ({ nested } = opts.dryRun ? { nested: [] } : expandMacSigningEntries(files)); } catch (error) { fail(error.message); }
+  try { ({ nested } = opts.dryRun ? { nested: [] } : planMacSigning({ entries, nestedCode })); } catch (error) { fail(error.message); }
+  if (opts.dryRun && (nestedCode.length || entries.some(hasNonDefaultSettings))) {
+    console.log(`right-release: dry-run: per-file signing matrix (${nestedCode.length} nestedCode rule(s), ${entries.filter(hasNonDefaultSettings).length} entry setting(s)); nested code is resolved against the built bundle at sign time`);
+  }
   if (nested.length) {
     const nestedReceipt = path.resolve(path.dirname(receipt), `macos-${phase}-nested.json`);
     if (existsSync(nestedReceipt)) unlinkSync(nestedReceipt);
     console.log(`right-release: signing ${nested.length} nested code item(s) inside-out`);
-    await run("node", [SIGN_MACOS, "--receipt", nestedReceipt, ...nested], root);
+    await run("node", macSignInvocation(nested, nestedReceipt), root);
+    verifyMacosSigningSettings(nestedReceipt, nested);
   }
-  const args = [SIGN_MACOS];
-  if (opts.dryRun) args.push("--dry-run");
-  args.push("--receipt", receipt, ...files);
+  const args = macSignInvocation(entries, receipt, opts.dryRun ? ["--dry-run"] : []);
   if (!opts.dryRun && existsSync(receipt)) unlinkSync(receipt);
   console.log("right-release: signing macOS Developer ID files");
   await run("node", args, root);
-  if (!opts.dryRun) verifyMacosSigningReceipt(receipt, files);
+  if (!opts.dryRun) { verifyMacosSigningReceipt(receipt, files); verifyMacosSigningSettings(receipt, entries); }
 }
 
 async function notarizeMacos(archive, root) {
@@ -977,6 +1262,15 @@ function verifyMacosSigningReceipt(receipt, files) {
     || evidence.files.some((item) => item.codesign !== "strict-valid" || item.identity !== expectedIdentity || item.timestampPresent !== true || item.after?.sha256 !== hashes.get(path.resolve(item.file)))) fail(`invalid macOS Developer ID signing receipt evidence: ${receipt}`);
 }
 
+// The receipt must record the entitlements digest and codesign options the plan asked for.
+function verifyMacosSigningSettings(receipt, items) {
+  if (!items.some(hasNonDefaultSettings)) return;
+  let evidence;
+  try { evidence = JSON.parse(readFileSync(receipt, "utf8")); } catch { fail(`invalid macOS Developer ID signing receipt: ${receipt}`); }
+  const problems = matrixReceiptProblems(evidence.files, items, (file) => fileEvidence(file).sha256);
+  if (problems.length) fail(`macOS signing receipt does not match the signing matrix (${receipt}):\n${problems.map((line) => `- ${line}`).join("\n")}`);
+}
+
 function verifyMacosNotarizationReceipt(receipt, archive) {
   try { validateNotarizationReceipt({ receiptPath: receipt, archive }); }
   catch (error) { fail(error.message); }

package/renamed-away.mjs

@@ -0,0 +1,29 @@
+// Crates renamed in the owner naming batch (2026-10-14). The old names stay in `cargo` as published history that apps
+// still pin until they migrate, but the tree has only the new directory and the old name is never staged again.
+// Remove an entry here when the last app pin moves and `cargo` drops the old name.
+export const RENAMED_AWAY = new Map([
+  ["rightkit-shell", "rightkit-tauri-shell"],
+  ["rightkit-tauri", "rightkit-device"],
+  ["rightkit-control", "rightkit-qa-driver"],
+  ["rightkit-jobs", "rightkit-job-queue"],
+  ["rightkit-process", "rightkit-child-process"],
+  ["rightkit-framed-sidecar", "rightkit-sidecar"],
+  ["rightkit-secrets", "rightkit-credentials"],
+  ["rightkit-settings", "rightkit-app-settings"],
+  ["rightkit-ort", "rightkit-onnx"],
+  ["rightkit-media", "rightkit-ffmpeg"],
+  ["rightkit-watch", "rightkit-file-watch"],
+  ["rightkit-scenario", "rightkit-workflow"],
+  ["rightkit-qts", "rightkit-tts-qwen"],
+  ["rightkit-qts-ggml-sys", "rightkit-tts-qwen-sys"],
+  ["rightkit-qts-ggml", null],
+]);
+
+// npm packages renamed in the same batch. Old names stay in rightkit-versions.json (npm/stagedNpm/legacyNpm) as
+// published history that apps still pin; the tree has only the successor directory.
+export const RENAMED_AWAY_NPM = new Map([
+  ["@rightkit/git", "@rightkit/ci"],
+  ["@rightkit/updates", "@rightkit/app-update"],
+  ["@rightkit/shell", "@rightkit/tauri-shell"],
+  ["@rightkit/app-shell", "@rightkit/react-shell"],
+]);