@rightkit/release 0.2.151 → 0.2.154

package/publication-gate.mjs

@@ -17,6 +17,9 @@ export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
 // Swift packages (RightKitSwift) are Apple-only; Windows cannot run them.
 export const requiredHosts = (kind) => (kind === "swift" ? Object.freeze(["darwin"]) : REQUIRED_HOSTS);
 const SHA = /^[0-9a-f]{40}$/;
+// The one definition of a recorded darwin-only host policy (release evidence and the runtime budget gate share it).
+export const isDarwinOnlyPolicy = (source) => source?.hostPolicy === "darwin-only"
+  && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
 
 export function defaultEvidencePath(workspaceRoot, kind, name) {
   return path.join(workspaceRoot, "release-evidence", "gate", `${kind}-${name.replace(/^@/, "").replace("/", "-")}.json`);
@@ -28,6 +31,40 @@ function defaultGit(args, cwd) {
   return (result.stdout ?? "").trim();
 }
 
+// Explains a receipt commit that is not the publishing HEAD. The gate still refuses it (exact-commit rule,
+// docs/RIGHTKIT-SHARED-PACKAGES.md "Publication gate" rule 1); this only says whether the receipt is an
+// ancestor with an unchanged unit path (re-qualify by re-running on HEAD) or unrelated/changed.
+function describeCommitMismatch(evidenceCommit, head, packagePath, git) {
+  const known = git(["cat-file", "-t", evidenceCommit], packagePath);
+  if (known !== "commit") return "receipt commit is not a commit object in this repository";
+  // `merge-base --is-ancestor` prints nothing: "" means ancestor, null (non-zero exit) means not.
+  const ancestor = git(["merge-base", "--is-ancestor", evidenceCommit, head], packagePath) !== null;
+  const relation = ancestor ? git(["rev-list", "--count", `${evidenceCommit}..${head}`], packagePath) : null;
+  const changed = git(["diff", "--name-only", evidenceCommit, head, "--", "."], packagePath);
+  const parts = [];
+  parts.push(ancestor ? `receipt commit is an ancestor, ${relation ?? "?"} commit(s) behind HEAD` : "receipt commit is not an ancestor of HEAD");
+  if (changed === null) parts.push("cannot diff the unit path");
+  else parts.push(changed === "" ? "unit path unchanged since the receipt (re-run the host runs on HEAD to re-qualify)" : `unit path changed since the receipt: ${changed.split("\n").slice(0, 5).join(", ")}`);
+  return parts.join("; ");
+}
+
+// Names of the fields of one host run that do not qualify (empty when the run qualifies). Every run binds to
+// the same unit, commit and artifact: commit, host arch, feature set and artifactSha256 equal to the evidence.
+function invalidRunFields(run, evidence) {
+  const bad = [];
+  const text = (value) => typeof value === "string" && value.trim() !== "";
+  if (run.commit !== evidence.commit) bad.push(`commit (must equal ${evidence.commit})`);
+  if (!text(run.host?.arch)) bad.push("host.arch");
+  if (!(Array.isArray(run.features) && run.features.length > 0 && run.features.every(text))) bad.push("features");
+  if (run.artifactSha256 !== evidence.artifactSha256) bad.push("artifactSha256 (must equal the evidence hash)");
+  if (!text(run.command)) bad.push("command");
+  if (!text(run.operator)) bad.push("operator");
+  if (!text(run.timestamp)) bad.push("timestamp");
+  if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
+  if (run.failed !== 0) bad.push("failed (must be 0)");
+  return bad;
+}
+
 // Returns { ok, missing[] }. Pure apart from the injected git/readFile.
 export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
   const missing = [];
@@ -43,25 +80,27 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
   if (evidence) {
     if (evidence.schema !== GATE_SCHEMA) missing.push(`evidence schema must be ${GATE_SCHEMA}`);
     if (evidence.kind !== kind || evidence.name !== name) missing.push(`evidence is for ${evidence.kind}:${evidence.name}, expected ${kind}:${name}`);
-    if (version && evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
+    // A missing publishing version must refuse: a skipped comparison would qualify any evidence version.
+    if (typeof version !== "string" || version.trim() === "") missing.push("publishing version is unknown (manifest has no literal version), cannot bind the receipt to it");
+    else if (evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
     if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
-    else if (head && evidence.commit !== head) missing.push(`evidence commit ${evidence.commit} != current HEAD ${head}`);
+    else if (head && evidence.commit !== head) {
+      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
+    }
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
     // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
     // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
     // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    const darwinOnly = (kind === "npm" || kind === "cargo") && evidence.hostPolicy === "darwin-only"
-      && typeof evidence.hostPolicyReason === "string" && evidence.hostPolicyReason.trim() !== "";
+    const darwinOnly = (kind === "npm" || kind === "cargo") && isDarwinOnlyPolicy(evidence);
     for (const host of darwinOnly ? ["darwin"] : requiredHosts(kind)) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
-      const good = matching.some((run) => run.commit === evidence.commit
-        && Number.isInteger(run.passed) && run.passed > 0 && run.failed === 0
-        && typeof run.command === "string" && run.command.trim()
-        && typeof run.operator === "string" && run.operator.trim()
-        && typeof run.timestamp === "string" && run.timestamp.trim());
-      if (!good) missing.push(`${label} run receipt must name commit ${evidence.commit}, command, operator, timestamp, passed>0 and failed=0`);
+      // Every run on the host must qualify: a failing run is not masked by a passing run beside it.
+      matching.forEach((run, index) => {
+        const fields = invalidRunFields(run, evidence);
+        if (fields.length) missing.push(`${label} run receipt ${index} invalid: ${fields.join(", ")}`);
+      });
     }
     if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
   }

package/publish-cargo.mjs

@@ -7,6 +7,9 @@ import { runCargoSync } from "./managed-cargo.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
 import { recordPublished } from "./rightkit-sync.mjs";
+import { readCargoPackage } from "./crate-graph.mjs";
+import { runtimeBudgetCheck, RUNTIME_BUDGET_CODE } from "./runtime-budgets.mjs";
+import { formatPreflight, PREFLIGHT_FAIL } from "./preflight.mjs";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
 const SECRET_PATTERNS = [
@@ -46,6 +49,9 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
   if (allowDirty) packageArgs.push("--allow-dirty");
   const plan = [
     { label: "secret scan", internal: "secret-scan", crateDir },
+    // Runtime-budget crates (runtime-budgets.mjs) must carry a measured runtime-budget.json for this
+    // version on every required host. Dry-run reports the check; a real publish refuses it.
+    { label: "runtime budget", internal: "runtime-budget", crate, crateDir },
     { label: "format", command: "cargo", args: ["fmt", "-p", crate, "--check"] },
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
@@ -91,7 +97,11 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
   const manifest = path.join(crateDir, "Cargo.toml");
   if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
-  const cargoVersion = fs.readFileSync(manifest, "utf8").match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+  // Parsed, not pattern-matched: `version.workspace = true` resolves through the workspace root, and a
+  // manifest whose [package].name is not the requested crate is refused before anything else runs.
+  const pkg = readCargoPackage(crateDir);
+  if (pkg.name !== options.crate) throw new Error(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crate ${options.crate}`);
+  const cargoVersion = pkg.version ?? undefined;
   const gateOptions = {
     kind: "cargo", name: options.crate, version: cargoVersion, packagePath: crateDir,
     evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(options.workspaceRoot, "cargo", options.crate)),
@@ -110,6 +120,16 @@ export async function runCargoPublish(options, execute = (_command, args, settin
       if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
       continue;
     }
+    if (step.internal === "runtime-budget") {
+      const check = runtimeBudgetCheck({ crate: options.crate, crateDir, version: cargoVersion, evidence: gate.evidence ?? undefined });
+      if (check) process.stdout.write(`${formatPreflight([check])}\n`);
+      if (check?.status === PREFLIGHT_FAIL && !options.dryRun) {
+        const error = new Error(`runtime budget refused: ${check.detail}. Fix: ${check.fix}`);
+        error.code = RUNTIME_BUDGET_CODE;
+        throw error;
+      }
+      continue;
+    }
     if (step.internal === "verify-archive") {
       // Revalidate source/evidence after packaging; preserve that exact evidence object.
       const current = (deps.enforceGate ?? enforcePublicationGate)(gateOptions);

package/publish-swift.mjs

@@ -1,129 +1,73 @@
-// Publish RightKitSwift by the ONE Swift distribution contract: a git repository pinned by URL +
-// exact version tag (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). Gates, in order:
-// secret scan -> swift test -> release build -> mirror tree into a git checkout + tag ->
-// FRESH CONSUMER RESOLUTION (a throwaway app pins the tag with `exact:` and runs
-// `swift package resolve`) -> push. A dry-run performs everything except the push, so a green
-// dry-run proves the mirror layout, the tag, and clean consumer resolution -- not just that tests passed.
-// swift-tools is macOS/Linux only, so the plan builder, arg parser, and version check are
-// pure and unit-tested on any OS (publish-swift.test.mjs); the swift steps run where swift exists.
+// Publish RightKitSwift by the ONE Swift distribution contract: a plain semver git tag on this
+// repository (github.com/Orthic-Labs/rightkit), resolved by apps through the root Package.swift
+// (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). There is no mirror and no second repository.
+//
+// `right-release publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]` verifies, in order:
+//   1. VERSION (swift/RightKitSwift/VERSION) is plain semver (X.Y.Z, no "v", no prerelease);
+//   2. the checkout is on main, has a clean tree, and HEAD is reachable from origin/main;
+//   3. the root Package.swift and the nested manifest agree (scripts/swift-root-manifest.test.mjs);
+//   4. the tag <VERSION> exists neither locally nor on origin;
+//   5. the publication gate evidence is bound to HEAD and to the package tree at HEAD;
+// then creates the tag on HEAD and pushes it:
+//   git tag <VERSION> <HEAD sha>
+//   git push origin refs/tags/<VERSION>:refs/tags/<VERSION>
+// A dry-run performs every check and prints those commands without running them.
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { digestBytes } from "./publication-artifacts.mjs";
-import { scanCrateForSecrets } from "./publish-cargo.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
-export const DEFAULT_SWIFT_GIT_URL = "https://github.com/bogusyogi/rightkit-swift.git";
-// The mirror must reproduce the verified git subtree exactly (its tree id is
-// compared), so only untracked build state is excluded. Tracked Xcode scheme
-// metadata under .swiftpm ships with the package; SwiftPM consumers ignore it.
-const MIRROR_EXCLUDES = new Set([".build", ".git", "Package.resolved", ".DS_Store"]);
+export const SWIFT_DISTRIBUTION_URL = "https://github.com/Orthic-Labs/rightkit";
+const DRIFT_TEST = path.join("scripts", "swift-root-manifest.test.mjs");
 
-export function parseSwiftPublishArgs(argv, env = process.env) {
-  const allowed = new Set(["--repo", "--dry-run", "--allow-dirty", "--evidence", "--workspace"]);
-  let repo = env.RIGHTKIT_SWIFT_GIT_URL ?? DEFAULT_SWIFT_GIT_URL;
+export function parseSwiftPublishArgs(argv) {
+  const allowed = new Set(["--dry-run", "--evidence", "--workspace"]);
   let dryRun = false;
-  let allowDirty = false;
   let evidence;
   let workspace;
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!allowed.has(arg)) throw new Error(`unexpected argument: ${arg}`);
-    if (arg === "--dry-run") dryRun = true;
-    else if (arg === "--allow-dirty") allowDirty = true;
-    else {
-      const value = argv[(index += 1)];
-      if (value === undefined) throw new Error(`${arg} needs a value`);
-      if (arg === "--evidence") evidence = value;
-      else if (arg === "--workspace") workspace = value;
-      else repo = value;
-    }
+    if (arg === "--dry-run") { dryRun = true; continue; }
+    const value = argv[(index += 1)];
+    if (value === undefined) throw new Error(`${arg} needs a value`);
+    if (arg === "--evidence") evidence = value;
+    else workspace = value;
   }
-  if (!/^(https:\/\/|git@|ssh:\/\/|file:\/\/)/.test(repo)) throw new Error(`invalid swift git url: ${repo}`);
-  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
-  return { repo, dryRun, allowDirty, evidence, workspace };
+  return { dryRun, evidence, workspace };
 }
 
-// The VERSION file is the single source of truth; Package.swift must name the package and the
-// version must be a clean semver so the registry archive is reproducible.
+// VERSION is the single source of truth; the tag is exactly its text.
 export function readPackageIdentity(packageDir) {
   const manifest = path.join(packageDir, "Package.swift");
   if (!fs.existsSync(manifest)) throw new Error(`Package.swift not found: ${manifest}`);
   const versionFile = path.join(packageDir, "VERSION");
   if (!fs.existsSync(versionFile)) throw new Error(`VERSION not found: ${versionFile}`);
   const version = fs.readFileSync(versionFile, "utf8").trim();
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
-    throw new Error(`VERSION is not clean semver: "${version}"`);
-  }
+  if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error(`VERSION is not plain semver (X.Y.Z): "${version}"`);
   const nameMatch = fs.readFileSync(manifest, "utf8").match(/name:\s*"([^"]+)"/);
   if (!nameMatch) throw new Error("could not read package name from Package.swift");
   return { name: nameMatch[1], version };
 }
 
-export function buildSwiftPublishPlan({ packageDir, name, version, repo, dryRun }) {
-  const plan = [
-    { label: "secret scan", internal: "secret-scan" },
-    { label: "tests", command: "swift", args: ["test", "--package-path", packageDir] },
-    { label: "release build", command: "swift", args: ["build", "-c", "release", "--package-path", packageDir] },
-    // Dry-run mirrors into a fresh local repo; a real publish clones the distribution repo first.
-    { label: "mirror and tag", internal: "mirror", tag: version, repo: dryRun ? null : repo },
-    { label: "fresh consumer resolution (exact pin)", internal: "consume", tag: version, name },
+// The exact commands a real publish runs after every check passes.
+export function swiftTagCommands(version, sha) {
+  return [
+    ["git", ["tag", version, sha]],
+    ["git", ["push", "origin", `refs/tags/${version}:refs/tags/${version}`]],
   ];
-  if (!dryRun) plan.push({ label: "git push (branch and tag)", internal: "push", tag: version, repo });
-  return plan;
 }
 
-function git(args, cwd, execute = spawnSync) {
+function git(args, cwd, execute) {
   const result = execute("git", args, { cwd, encoding: "utf8", windowsHide: true });
   if (result.error) throw result.error;
   if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
   return (result.stdout ?? "").trim();
 }
 
-function copyTree(from, to) {
-  fs.mkdirSync(to, { recursive: true });
-  for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
-    if (MIRROR_EXCLUDES.has(entry.name)) continue;
-    const source = path.join(from, entry.name);
-    const target = path.join(to, entry.name);
-    if (entry.isDirectory()) copyTree(source, target);
-    else if (entry.isFile()) { fs.copyFileSync(source, target); fs.chmodSync(target, fs.statSync(source).mode & 0o777); }
-    else throw new Error(`unsupported Swift source entry: ${entry.name}`);
-  }
-}
-
-function mirrorAndTag(step, packageDir, work, execute) {
-  const mirror = path.join(work, "rightkit-swift"); // SwiftPM names the package by repo directory
-  if (step.repo) git(["clone", step.repo, mirror], work, execute);
-  else { fs.mkdirSync(mirror, { recursive: true }); git(["init", "-q", "-b", "main"], mirror, execute); }
-  for (const entry of fs.readdirSync(mirror)) if (entry !== ".git") fs.rmSync(path.join(mirror, entry), { recursive: true, force: true });
-  copyTree(packageDir, mirror);
-  git(["add", "-A"], mirror, execute);
-  git(["-c", "user.email=release@rightsuite.invalid", "-c", "user.name=right-release", "commit", "-q", "--allow-empty", "-m", `RightKitSwift ${step.tag}`], mirror, execute);
-  if (git(["tag", "-l", step.tag], mirror, execute) !== "") throw new Error(`tag ${step.tag} already exists: bump VERSION`);
-  git(["tag", step.tag], mirror, execute);
-  return mirror;
-}
-
-function consumeFresh(step, mirror, work, execute) {
-  const app = path.join(work, "consumer");
-  fs.mkdirSync(path.join(app, "Sources", "App"), { recursive: true });
-  fs.writeFileSync(path.join(app, "Package.swift"), [
-    "// swift-tools-version: 6.0", "import PackageDescription", "let package = Package(",
-    '  name: "App", platforms: [.iOS(.v17), .macOS(.v14)],',
-    `  dependencies: [.package(url: "file://${mirror}", exact: "${step.tag}")],`,
-    '  targets: [.target(name: "App", dependencies: [.product(name: "RightKitStore", package: "rightkit-swift")])]', ")", "",
-  ].join("\n"));
-  fs.writeFileSync(path.join(app, "Sources", "App", "App.swift"), "import RightKitStore\npublic let ok = true\n");
-  const result = execute("swift", ["package", "resolve"], { cwd: app, encoding: "utf8", windowsHide: true, stdio: "inherit" });
-  if (result.error || result.status !== 0) throw new Error("fresh consumer resolution failed");
-  const pins = fs.readFileSync(path.join(app, "Package.resolved"), "utf8");
-  if (!pins.includes(`"version" : "${step.tag}"`)) throw new Error(`consumer did not resolve exact tag ${step.tag}`);
-}
-
-// Evidence binds this exact git-archive command, rooted at the package tree.
+// Evidence binds this exact git-archive of the package tree at HEAD.
 export function verifySwiftSourceArchive(bytes, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.artifactSha256 ?? "")) throw new Error("Swift source archive hash evidence is required");
   if (digestBytes(bytes) !== evidence.artifactSha256) throw new Error("Swift source archive sha256 does not match evidence artifactSha256");
@@ -133,70 +77,63 @@ export function verifySwiftSourceArchive(bytes, evidence) {
 export function runSwiftPublish(options, execute = spawnSync) {
   const packageDir = options.packageDir;
   const { name, version } = readPackageIdentity(packageDir);
+  const toplevel = git(["rev-parse", "--show-toplevel"], packageDir, execute);
+  const out = (message) => process.stdout.write(`[right-release] swift ${message}\n`);
+
+  const branch = git(["symbolic-ref", "--short", "-q", "HEAD"], toplevel, execute);
+  if (branch !== "main") throw new Error(`publish swift runs only on main (current: ${branch || "detached HEAD"})`);
+  if (git(["status", "--porcelain", "--untracked-files=normal"], toplevel, execute) !== "") throw new Error("working tree is not clean: commit or remove changes before tagging");
+  git(["fetch", "--quiet", "origin", "main"], toplevel, execute);
+  const sha = git(["rev-parse", "HEAD"], toplevel, execute);
+  const ancestor = execute("git", ["merge-base", "--is-ancestor", sha, "origin/main"], { cwd: toplevel, encoding: "utf8", windowsHide: true });
+  if (ancestor.error) throw ancestor.error;
+  if (ancestor.status !== 0) throw new Error(`HEAD ${sha} is not on origin/main: push it and let CI pass first`);
+  out("branch, clean tree, HEAD on origin/main: ok");
+
+  const drift = execute(process.execPath, ["--test", DRIFT_TEST], { cwd: toplevel, encoding: "utf8", windowsHide: true });
+  if (drift.error) throw drift.error;
+  if (drift.status !== 0) throw new Error(`root Package.swift drifted from swift/RightKitSwift/Package.swift:\n${drift.stdout ?? ""}${drift.stderr ?? ""}`);
+  out("root manifest matches nested manifest: ok");
+
+  if (git(["tag", "-l", version], toplevel, execute) !== "") throw new Error(`tag ${version} already exists locally: bump VERSION`);
+  if (git(["ls-remote", "--tags", "origin", `refs/tags/${version}`], toplevel, execute) !== "") throw new Error(`tag ${version} already exists on origin: bump VERSION`);
+  out(`tag ${version} is free: ok`);
+
   const workspaceRoot = path.resolve(options.workspace ?? path.join(packageDir, "..", ".."));
   const gate = enforcePublicationGate({
     kind: "swift", name, version, packagePath: packageDir,
     evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(workspaceRoot, "swift", name)),
   }, { dryRun: options.dryRun });
-  const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
-  const sourceCommit = gate.evidence?.commit ?? "HEAD";
-  const tree = git(["rev-parse", prefix ? `${sourceCommit}:${prefix}` : `${sourceCommit}^{tree}`], packageDir, execute);
-  // `git archive` filters by the current subdirectory, so archiving the package
-  // subtree from inside the package yields an empty tar; run it at the toplevel.
-  const toplevel = git(["rev-parse", "--show-toplevel"], packageDir, execute) || packageDir;
-  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: toplevel, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
-  if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift source archive creation failed");
-  const bytes = Buffer.from(archive.stdout);
-  if (gate.ok || !options.dryRun) verifySwiftSourceArchive(bytes, gate.evidence);
-  const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
-  const work = fs.mkdtempSync(path.join(os.tmpdir(), "rightkit-swift-publish-"));
-  let mirror = null;
-  let sealedCommit;
-  const snapshot = path.join(work, "source");
-  fs.mkdirSync(snapshot);
-  try {
-    const extracted = execute("tar", ["-xf", "-", "-C", snapshot], { input: bytes, windowsHide: true });
-    if (extracted.error || extracted.status !== 0) throw new Error("Swift source archive extraction failed");
-    const identity = readPackageIdentity(snapshot);
-    if (identity.name !== name || identity.version !== version) throw new Error("Swift source archive identity mismatch");
-    for (const step of plan) {
-      process.stdout.write(`[right-release] swift ${step.label}\n`);
-      if (step.internal === "secret-scan") {
-        const violations = scanCrateForSecrets(snapshot);
-        if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
-        continue;
-      }
-      if (step.internal === "mirror") { mirror = mirrorAndTag(step, snapshot, work, execute);
-        if (git(["rev-parse", `${step.tag}^{tree}`], mirror, execute) !== tree) throw new Error("Swift mirror differs from verified source archive");
-        sealedCommit = git(["rev-parse", step.tag], mirror, execute);
-        continue; }
-      if (step.internal === "consume") { consumeFresh(step, mirror, work, execute); continue; }
-      if (step.internal === "push") {
-        if (git(["rev-parse", `${sealedCommit}^{tree}`], mirror, execute) !== tree || git(["rev-parse", step.tag], mirror, execute) !== sealedCommit) throw new Error("Swift publication tag changed after verification");
-        const branch = git(["symbolic-ref", "--short", "HEAD"], mirror, execute);
-        git(["push", "--atomic", "origin", `${sealedCommit}:refs/heads/${branch}`, `${sealedCommit}:refs/tags/${step.tag}`], mirror, execute);
-        continue;
-      }
-      const result = execute(step.command, step.args.map((arg) => arg === packageDir ? snapshot : arg), { cwd: snapshot, encoding: "utf8", windowsHide: true, stdio: "inherit" });
-      if (result.error) {
-        if (result.error.code === "ENOENT") {
-          throw new Error(`${step.command} not found -- run publish swift on macOS/Linux with the Swift toolchain installed`);
-        }
-        throw result.error;
-      }
-      if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
-    }
-  } finally {
-    fs.rmSync(work, { recursive: true, force: true });
+  if (gate.ok) {
+    if (gate.evidence?.commit !== sha) throw new Error(`publication evidence commit ${gate.evidence?.commit} is not HEAD ${sha}`);
+    const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
+    const tree = git(["rev-parse", prefix ? `${sha}:${prefix}` : `${sha}^{tree}`], packageDir, execute);
+    // `git archive` filters by the current subdirectory, so archive the tree id from the toplevel.
+    const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: toplevel, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
+    if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift package tree archive creation failed");
+    verifySwiftSourceArchive(Buffer.from(archive.stdout), gate.evidence);
+  }
+
+  const commands = swiftTagCommands(version, sha);
+  if (options.dryRun) {
+    for (const [command, args] of commands) out(`dry-run would run: ${command} ${args.join(" ")}`);
+    return { name, version, commit: sha, published: false };
   }
-  return { name, version, published: !options.dryRun };
+  const [tagCommand, pushCommand] = commands;
+  git(tagCommand[1], toplevel, execute);
+  try { git(pushCommand[1], toplevel, execute); }
+  catch (error) { git(["tag", "-d", version], toplevel, execute); throw error; }
+  const remote = git(["ls-remote", "--tags", "origin", `refs/tags/${version}`], toplevel, execute);
+  if (!remote.startsWith(sha)) throw new Error(`origin does not show tag ${version} at ${sha}`);
+  out(`tagged ${version} at ${sha} on ${SWIFT_DISTRIBUTION_URL}`);
+  return { name, version, commit: sha, published: true };
 }
 
 const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
 if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const options = parseSwiftPublishArgs(process.argv.slice(2));
-    const packageDir = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "../../swift/RightKitSwift");
+    const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../swift/RightKitSwift");
     runSwiftPublish({ ...options, packageDir });
   } catch (error) {
     process.stderr.write(`${error.message}\n`);

package/publish-update.mjs

@@ -114,6 +114,7 @@ if (!dryRun && (tier === "update" || artifacts.length > 0)) {
 if (tier === "patch") {
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
+    assertVersionedKey(installer.versionedKey);
     artifactFile(installer.file);
   }
   const platforms = {};
@@ -161,6 +162,13 @@ if (tier === "patch") {
       ...metadata,
       updaterSignature: null,
     });
+    // The versioned copy is the App Installer install source: Windows repairs by re-adding from the URI the
+    // package came from, so it must outlive the version that replaces it.
+    if (installer.versionedKey && !uploadedKeys.has(installer.versionedKey)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.versionedKey}`);
+      if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installer.versionedKey, "public", { cwd: root });
+      uploadedKeys.add(installer.versionedKey);
+    }
   }
   if (!artifacts.length) {
     console.log(`${dryRun ? "[dry-run] " : ""}NO patch updater artifacts; skipping patch manifest registration`);
@@ -169,9 +177,10 @@ if (tier === "patch") {
       platform: platform === "mac" ? "mac" : "windows",
       dryRun,
       keep: {
-        public: installers.map((artifact) => artifact.key),
+        public: installerKeepKeys(),
         private: target.updater.artifacts.map((artifact) => artifact.key),
       },
+      retainPreviousVersions: installers.some((artifact) => artifact.versionedKey) ? 1 : 0,
     });
     if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
     process.exit(0);
@@ -207,9 +216,10 @@ if (tier === "patch") {
     platform: platform === "mac" ? "mac" : "windows",
     dryRun,
     keep: {
-      public: [...installers.map((artifact) => artifact.key), ...registrations.keys()],
+      public: [...installerKeepKeys(), ...registrations.keys()],
       private: [],
     },
+    retainPreviousVersions: installers.some((artifact) => artifact.versionedKey) ? 1 : 0,
   });
   if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
   process.exit(0);
@@ -311,6 +321,18 @@ function assertCurrentKey(key, kind) {
   }
 }
 
+// Current + versioned installer keys: both stay public so the old install source is never deleted.
+function installerKeepKeys() {
+  return installers.flatMap((artifact) => [artifact.key, ...(artifact.versionedKey ? [artifact.versionedKey] : [])]);
+}
+
+function assertVersionedKey(key) {
+  if (key === undefined) return;
+  if (!/\/installers\/(?:mac|windows)\/versions\/[^/]+\/[^/]+$/.test(key)) {
+    fail(`installer versionedKey must be <app>/installers/<os>/versions/<version>/<file>, got: ${key}`);
+  }
+}
+
 function patchInstallerKey(artifact) {
   if (artifact.patchKey) return artifact.patchKey;
   if (!artifact.key.includes("/updates/")) fail(`patch updater key must be convertible to installers/current, got: ${artifact.key}`);