@rightkit/release 0.2.153 → 0.2.155

package/cli/right-release.mjs

@@ -86,7 +86,9 @@ if (first === "--version" || first === "-v") {
   run("apple-profile-renew.mjs", args.slice(1));
 } else if (first === "publish") {
   const rest = args.slice(1);
-  if (rest[0] === "cargo") {
+  if ((rest[0] === "cargo" || rest[0] === "npm") && rest.includes("--local")) {
+    run("local-publish.mjs", rest);
+  } else if (rest[0] === "cargo") {
     run("publish-cargo.mjs", rest.slice(1));
   } else if (rest[0] === "npm") {
     run("publication-gate.mjs", rest.slice(1));
@@ -202,6 +204,9 @@ Commands:
                                                       Publish the gated tarball with the Keychain token
                                                       (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
+  publish npm --package @rightkit/<name> --local     Mac-only local publish under the committed local-build grant
+  publish cargo --crate <name> --local               (.rightkit-local-build.json): runs the unit's CI tests, packs, writes darwin-only
+                                                      evidence, then the same publication gate and publisher; refuses without the grant
   publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]
                                                       Check main, a clean tree, and the publication evidence, then tag RightKitSwift at its VERSION on origin
   inventory check [--json] [--warn-only] [--md <file>] [--no-cache]

package/execution-policy.mjs

@@ -41,7 +41,7 @@ export const LOCAL_BUILD_FILE = ".rightkit-local-build.json";
 
 // Adrian's local-build opt-in (2026-10-14): a committed .rightkit-local-build.json naming this exact
 // repository allows local build, test and publish. Mirrors the build-control hook's check.
-function localBuildGranted(root) {
+export function localBuildGranted(root) {
   if (!root) return false;
   try {
     const grant = JSON.parse(readFileSync(path.join(root, LOCAL_BUILD_FILE), "utf8"));

package/local-publish.mjs

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac under
+// Adrian's local-build grant (2026-10-14, committed .rightkit-local-build.json). It does not weaken the
+// publication gate: it runs the unit's own CI tests (ci/gate.config.json, ci/asset-gated.json,
+// scripts/ci/gate.mjs semantics), packs the artifact, writes a schema-1 evidence file with one darwin receipt
+// (hostPolicy "darwin-only"), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
+// (publishGatedTarball for npm, runCargoPublish for cargo). There is no way to skip a test or the evidence.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { runCargoSync } from "./managed-cargo.mjs";
+import { localBuildGranted, LOCAL_BUILD_FILE } from "./execution-policy.mjs";
+import { GATE_SCHEMA, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
+import { runCargoPublish } from "./publish-cargo.mjs";
+import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
+import { readCargoPackage } from "./crate-graph.mjs";
+import { recordPublished } from "./rightkit-sync.mjs";
+
+export const LOCAL_OPERATOR = "agent (local-build grant)";
+export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
+const STEP_TIMEOUT_MS = 30 * 60 * 1000;
+
+export class LocalPublishError extends Error {
+  constructor(message) { super(message); this.name = "LocalPublishError"; }
+}
+const refuse = (message) => { throw new LocalPublishError(message); };
+
+export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
+  const flag = kind === "npm" ? "--package" : "--crate";
+  let unit; let workspace; let local = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--local") local = true;
+    else if (arg === flag) unit = argv[++i];
+    else if (arg === "--workspace") workspace = argv[++i];
+    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --local)`);
+  }
+  if (!local) refuse("--local is required");
+  if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
+  if (kind === "cargo" && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(unit ?? "")) refuse("publish cargo --local requires --crate <name>");
+  return { kind, unit, workspaceRoot: path.resolve(workspace ?? cwd) };
+}
+
+function defaultGit(args, cwd) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) return null;
+  return (result.stdout ?? "").trim();
+}
+
+const defaultReadJson = (file) => { try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; } };
+
+async function defaultRegistryHas({ kind, name, version }) {
+  if (kind === "npm") {
+    const view = spawnSync("npm", ["view", `${name}@${version}`, "version", "--prefer-online", "--registry", "https://registry.npmjs.org/"], { encoding: "utf8", windowsHide: true });
+    const out = `${view.stdout ?? ""}${view.stderr ?? ""}`;
+    if (!view.error && view.status === 0) return (view.stdout ?? "").trim() === version;
+    if (/E404|404 Not Found/i.test(out)) return false;
+    throw new Error(`cannot read the npm registry for ${name}@${version}: ${out.trim().slice(0, 200)}`);
+  }
+  const response = await fetch(cargoIndexUrl(name), { headers: { Accept: "text/plain", "Cache-Control": "no-cache", "User-Agent": "rightkit-release" }, redirect: "error", signal: AbortSignal.timeout(30_000) });
+  if (response.status === 404) return false;
+  if (!response.ok) throw new Error(`crates.io index answered ${response.status} for ${name}`);
+  return (await response.text()).split(/\r?\n/).filter((line) => line.trim()).some((line) => { try { return JSON.parse(line).vers === version; } catch { return false; } });
+}
+
+function defaultRun(command, args, options) {
+  const settings = { encoding: "utf8", maxBuffer: 512 * 1024 * 1024, timeout: STEP_TIMEOUT_MS, windowsHide: true, ...options };
+  return command === "cargo" ? runCargoSync(args, settings) : spawnSync(command, args, settings);
+}
+
+async function defaultLoadWorkspaceModules(workspaceRoot) {
+  const load = (file) => import(pathToFileURL(path.join(workspaceRoot, "scripts", "ci", file)).href);
+  const [results, upload] = await Promise.all([load("test-results.mjs"), load("upload.mjs")]);
+  return { results, checkNpmTarball: upload.checkNpmTarball };
+}
+
+/** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
+export function localTestPlan({ kind, unit, dir, config, manifest }) {
+  if (kind === "npm") {
+    if (!manifest?.scripts?.test) refuse(`${unit} has no test script; --local never publishes an untested package`);
+    return {
+      id: `npm:${dir}`, featureLabels: ["default"],
+      steps: [
+        { command: "pnpm", args: ["-r", "--workspace-concurrency=1", "run", "build"], test: false },
+        { command: "pnpm", args: ["--dir", dir, "run", "test"], test: true },
+      ],
+    };
+  }
+  const entry = config?.rust?.[unit] ?? {};
+  if (entry.os && !entry.os.includes("macos")) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this Mac`);
+  const featureSets = entry.featureSets ?? [[]];
+  const steps = [];
+  for (const features of featureSets) {
+    steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--show-output"], test: true });
+    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
+  }
+  steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
+  return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), steps };
+}
+
+const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
+const tarballName = (name, version) => `${name.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
+const tail = (text, lines = 40) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
+
+export async function runLocalPublish(kind, argv, deps = {}) {
+  const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
+  const { unit, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
+  const platform = deps.platform ?? process.platform;
+  const git = deps.git ?? defaultGit;
+  const readJson = deps.readJson ?? defaultReadJson;
+  const run = deps.run ?? defaultRun;
+
+  // 1. Preconditions, fail closed.
+  if (!(deps.localBuildGranted ?? localBuildGranted)(workspaceRoot)) refuse(`--local needs the local-build grant: a committed ${LOCAL_BUILD_FILE} (allow "build-test-publish") naming this repository at ${workspaceRoot}`);
+  if (platform !== "darwin") refuse(`--local publishes from the Mac only (host policy: darwin-only); this host is ${platform}`);
+  const dir = kind === "npm" ? `packages/${unit.slice("@rightkit/".length)}` : `crates/${unit}`;
+  const unitPath = path.join(workspaceRoot, dir);
+  if (!fs.existsSync(unitPath)) refuse(`unit directory not found: ${unitPath}`);
+  let manifest = null; let version;
+  if (kind === "npm") {
+    manifest = readJson(path.join(unitPath, "package.json")) ?? refuse(`cannot read ${dir}/package.json`);
+    if (manifest.name !== unit) refuse(`${dir}/package.json is ${manifest.name}, not ${unit}`);
+    if (manifest.private === true) refuse(`${unit} is private and is never published`);
+    version = manifest.version;
+  } else {
+    const pkg = (deps.readCargoPackage ?? readCargoPackage)(unitPath);
+    if (pkg.name !== unit) refuse(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crate ${unit}`);
+    version = pkg.version;
+  }
+  if (typeof version !== "string" || !version.trim()) refuse(`${unit} has no literal version`);
+  const head = git(["rev-parse", "HEAD"], workspaceRoot);
+  if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
+  const dirty = git(["status", "--porcelain", "--", dir], workspaceRoot);
+  if (dirty === null) refuse(`cannot read git status for ${dir}`);
+  if (dirty !== "") refuse(`tree is not clean for ${dir}; commit first:\n${dirty}`);
+  if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
+  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, darwin-only policy)`);
+
+  // 2. The unit's own tests, exactly as the CI gate defines them.
+  const gateConfig = readJson(path.join(workspaceRoot, "ci", "gate.config.json")) ?? {};
+  const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
+  const gatedSection = assetGated[kind === "npm" ? "npm" : "crates"] ?? {};
+  const isAssetGated = Object.hasOwn(gatedSection, unit);
+  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest });
+  const modules = await (deps.loadWorkspaceModules ?? defaultLoadWorkspaceModules)(workspaceRoot);
+  const { ResultScanner, TEST_COMMAND, judgeUnit } = modules.results;
+  // Run the unit's tests under hosted-CI conditions: no inherited credentials (a managed host refuses a
+  // token from the environment) and no sibling product checkouts (CI holds rightkit alone).
+  const inherited = Object.fromEntries(Object.entries(deps.env ?? process.env).filter(([key]) => !/(TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)/i.test(key)));
+  const env = { ...inherited, RIGHTKIT_REQUIRE_ASSETS: isAssetGated ? "0" : "1", RIGHTKIT_ISOLATED_CHECKOUT: "1", CARGO_TERM_COLOR: "never" };
+  const steps = [];
+  for (const step of plan.steps) {
+    const commandText = `${step.command} ${step.args.join(" ")}`;
+    log(`[right-release] ${plan.id}: ${commandText}`);
+    const result = run(step.command, step.args, { cwd: workspaceRoot, env });
+    const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
+    if (result.error || result.status !== 0) {
+      steps.push(row);
+      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    }
+    row.ok = true;
+    if (row.isTest) {
+      const out = new ResultScanner(); const err = new ResultScanner();
+      out.push(result.stdout ?? ""); err.push(result.stderr ?? "");
+      const a = out.finish(); const b = err.finish();
+      Object.assign(row, { executed: a.executed + b.executed, failed: a.failed + b.failed, ignored: a.ignored + b.ignored, skipped: a.skipped + b.skipped, binaries: a.binaries + b.binaries });
+    }
+    steps.push(row);
+  }
+  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: [], allowMissingAssets: isAssetGated ? [unit] : [] });
+  if (verdict.status === "fail" || steps.some((s) => s.failed > 0)) refuse(`${plan.id} not qualified: ${verdict.problems.join("; ") || "failed tests reported"}`);
+  if (!(verdict.executed > 0)) refuse(`${plan.id} executed no test`);
+  log(`[right-release] ${plan.id}: ${verdict.executed} passed, 0 failed, ${verdict.skipped} skipped, ${verdict.ignored} ignored${isAssetGated ? " (asset-gated: RIGHTKIT_REQUIRE_ASSETS=0, skips recorded)" : ""}`);
+
+  // 3. Pack the artifact and hash it.
+  const scratch = fs.mkdtempSync(path.join(deps.tmpdir ?? os.tmpdir(), "rk-local-publish-"));
+  const cleanup = () => fs.rmSync(scratch, { recursive: true, force: true });
+  try {
+    let artifactFile; const packCommands = [];
+    if (kind === "npm") {
+      const args = ["--dir", dir, "pack", "--pack-destination", scratch];
+      packCommands.push(`pnpm ${args.join(" ")}`);
+      const packed = run("pnpm", args, { cwd: workspaceRoot, env });
+      if (packed.error || packed.status !== 0) refuse(`pnpm pack failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
+      artifactFile = path.join(scratch, tarballName(unit, version));
+      if (!fs.existsSync(artifactFile)) refuse(`pnpm pack did not produce ${path.basename(artifactFile)}`);
+      const checked = modules.checkNpmTarball({ file: artifactFile, name: unit, version, dir, spawn: deps.spawnSync ?? spawnSync });
+      if (checked.problems.length) refuse(`${unit}: packed tarball refused:\n  - ${checked.problems.join("\n  - ")}`);
+    } else {
+      packCommands.push(`cargo package --locked -p ${unit}`);
+      const packed = run("cargo", ["package", "--locked", "-p", unit], { cwd: workspaceRoot, env });
+      if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
+      packCommands.push("cargo metadata --format-version 1 --no-deps");
+      const meta = run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
+      let targetDir;
+      try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
+      if (meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) refuse("cannot read the Cargo target directory");
+      artifactFile = path.join(targetDir, "package", `${unit}-${version}.crate`);
+      if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
+    }
+    const artifactSha256 = sha256(fs.readFileSync(artifactFile));
+
+    // 4. Evidence in the normal schema, then the EXISTING gate.
+    const commands = [...plan.steps.map((s) => `${s.command} ${s.args.join(" ")}`), ...packCommands];
+    const timestamp = (deps.now ?? (() => new Date().toISOString()))();
+    const evidence = {
+      schema: GATE_SCHEMA, kind, name: unit, version, commit: head, artifactSha256,
+      hostPolicy: "darwin-only", hostPolicyReason: LOCAL_HOST_POLICY_REASON,
+      runs: [{
+        host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
+        command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
+        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored,
+        requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
+        steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
+      }],
+    };
+    const evidencePath = path.resolve(defaultEvidencePath(workspaceRoot, kind, unit));
+    fs.mkdirSync(path.dirname(evidencePath), { recursive: true });
+    fs.writeFileSync(evidencePath, `${JSON.stringify(evidence, null, 2)}\n`);
+    log(`[right-release] wrote ${evidencePath} (artifact sha256 ${artifactSha256})`);
+    const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath };
+    (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { write: (line) => log(line.replace(/\n$/, "")) });
+
+    // 5. The EXISTING publish path.
+    if (kind === "npm") {
+      (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath }, deps.publishDeps ?? {});
+    } else {
+      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath }, undefined, deps.cargoDeps ?? {});
+      (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version });
+    }
+    log(`[right-release] published ${unit}@${version}`);
+    return { kind, name: unit, version, commit: head, artifactSha256, evidencePath };
+  } finally {
+    cleanup();
+  }
+}
+
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  const [kind, ...rest] = process.argv.slice(2);
+  if (kind !== "npm" && kind !== "cargo") { process.stderr.write("right-release publish --local: expected npm or cargo\n"); process.exitCode = 2; }
+  else runLocalPublish(kind, rest).catch((error) => { process.stderr.write(`right-release publish ${kind} --local: ${error.message}\n`); process.exitCode = 1; });
+}

package/msix-build.mjs

@@ -10,6 +10,7 @@ import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { findWindowsSdkTool } from "./preflight.mjs";
 import { generateAppInstaller } from "./msix-appinstaller.mjs";
+import { readMsixSignerSubject } from "./msix-signer.mjs";
 import { assertPublisherMatchesSigner, planMsixSigning, verifyPayloadInventory } from "./msix-plan.mjs";
 import { createHash } from "node:crypto";
 
@@ -102,20 +103,16 @@ export function peFilesIn(root) {
 
 const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
 
-function readSignerSubject(file, run) {
-  const r = run("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${file.replace(/'/g, "''")}').SignerCertificate.Subject`], { encoding: "utf8", windowsHide: true });
-  return r.status === 0 ? String(r.stdout ?? "").trim() : "";
-}
-
 /**
  * Pack + sign. `run` is injectable for tests. Ordered per planMsixSigning():
  *  assemble, verify-inventory, sign-pe (DLLs then EXEs, raw bytes), pack, sign-msix, verify-msix,
  *  verify-publisher, appinstaller, seal. Windows-only unless dryRun.
+ * readSubject(file) defaults to reading AppxSignature.p7x (msix-signer.mjs) and may be overridden.
  * options.runtime = { dlls, systemDlls, dependencies } (declared inventory, verified fail-closed);
  * options.appInstaller = { uri, msixUri, out, ... } generates the update route after the package is signed.
  */
 export function buildMsix({ stageDir, out, workDir, manifest, assets, runtime, appInstaller, sign = true, dryRun = false, receiptDir, peReceipt, msixReceipt },
-  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)), readSubject = (file) => readSignerSubject(file, run) } = {}) {
+  { platform = process.platform, run = spawnSync, findTool = findWindowsSdkTool, env = process.env, log = (e) => console.error(JSON.stringify(e)), readSubject = readMsixSignerSubject } = {}) {
   out = path.resolve(out);
   if (!out.endsWith(".msix")) throw fail("MSIX_INVALID_OPTIONS", "out must end with .msix");
   validateMsixIdentity(manifest);

package/msix-signer.mjs

@@ -0,0 +1,211 @@
+// Default signer-subject reader for .msix / .msixbundle.
+// PowerShell Get-AuthenticodeSignature returns nothing for MSIX on hosted Windows runners, so the subject
+// is read from the package's own AppxSignature.p7x: a "PKCX" magic followed by a PKCS#7 SignedData.
+// Pure Node (node:zlib + node:crypto X509Certificate + a small DER walker); no dependency, any host.
+// The certificate chosen is the one named by SignerInfo issuerAndSerialNumber (or subjectKeyIdentifier),
+// never merely the first certificate. Every failure throws MSIX_PUBLISHER_MISMATCH (fail closed).
+
+import { X509Certificate } from "node:crypto";
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
+import { inflateRawSync } from "node:zlib";
+
+const fail = (message) => Object.assign(new Error(message), { code: "MSIX_PUBLISHER_MISMATCH" });
+const MAX_P7X = 4 * 1024 * 1024;
+const SIGNED_DATA_OID = "1.2.840.113549.1.7.2";
+
+// --- zip container -----------------------------------------------------------------------------
+const u64 = (b, o) => Number(b.readBigUInt64LE(o));
+
+function readAt(fd, position, length) {
+  const buffer = Buffer.alloc(length);
+  let done = 0;
+  while (done < length) {
+    const n = readSync(fd, buffer, done, length - done, position + done);
+    if (n === 0) break;
+    done += n;
+  }
+  return buffer.subarray(0, done);
+}
+
+/** Return the bytes of the named entry of a zip file, or null when absent. */
+export function readZipEntry(file, wanted, { maxBytes = MAX_P7X } = {}) {
+  const fd = openSync(file, "r");
+  try {
+    const size = fstatSync(fd).size;
+    const tailLength = Math.min(size, 22 + 65535);
+    const tail = readAt(fd, size - tailLength, tailLength);
+    let entries; let dirSize; let dirOffset; let found = false;
+    for (let i = tail.length - 22; i >= 0; i -= 1) {
+      if (tail.readUInt32LE(i) !== 0x06054b50) continue;
+      if (i + 22 + tail.readUInt16LE(i + 20) > tail.length) continue;
+      entries = tail.readUInt16LE(i + 10); dirSize = tail.readUInt32LE(i + 12); dirOffset = tail.readUInt32LE(i + 16);
+      if (entries === 0xffff || dirSize === 0xffffffff || dirOffset === 0xffffffff) {
+        const at = size - tailLength + i;
+        const loc = at >= 20 ? readAt(fd, at - 20, 20) : Buffer.alloc(0);
+        if (loc.length < 20 || loc.readUInt32LE(0) !== 0x07064b50) throw new Error("zip64 locator missing");
+        const rec = readAt(fd, u64(loc, 8), 56);
+        if (rec.length < 56 || rec.readUInt32LE(0) !== 0x06064b50) throw new Error("zip64 end record missing");
+        entries = u64(rec, 32); dirSize = u64(rec, 40); dirOffset = u64(rec, 48);
+      }
+      found = true;
+      break;
+    }
+    if (!found) throw new Error("not a zip container (end of central directory not found)");
+    if (dirSize > 256 * 1024 * 1024 || dirOffset + dirSize > size) throw new Error("central directory out of bounds");
+    const dir = readAt(fd, dirOffset, dirSize);
+    if (dir.length !== dirSize) throw new Error("central directory truncated");
+    let at = 0;
+    for (let n = 0; n < entries; n += 1) {
+      if (at + 46 > dir.length || dir.readUInt32LE(at) !== 0x02014b50) throw new Error("bad central directory entry");
+      const flags = dir.readUInt16LE(at + 8); const method = dir.readUInt16LE(at + 10);
+      let compressed = dir.readUInt32LE(at + 20); let uncompressed = dir.readUInt32LE(at + 24);
+      const nameLen = dir.readUInt16LE(at + 28); const extraLen = dir.readUInt16LE(at + 30); const commentLen = dir.readUInt16LE(at + 32);
+      let local = dir.readUInt32LE(at + 42);
+      const end = at + 46 + nameLen + extraLen + commentLen;
+      if (end > dir.length) throw new Error("central directory entry out of bounds");
+      const name = dir.subarray(at + 46, at + 46 + nameLen).toString("utf8");
+      if (name === wanted) {
+        const extra = dir.subarray(at + 46 + nameLen, at + 46 + nameLen + extraLen);
+        for (let e = 0; e + 4 <= extra.length; e += 4 + extra.readUInt16LE(e + 2)) {
+          if (extra.readUInt16LE(e) !== 0x0001) continue;
+          let p = e + 4;
+          if (uncompressed === 0xffffffff) { uncompressed = u64(extra, p); p += 8; }
+          if (compressed === 0xffffffff) { compressed = u64(extra, p); p += 8; }
+          if (local === 0xffffffff) local = u64(extra, p);
+        }
+        if (flags & 1) throw new Error(`${wanted} is encrypted`);
+        if (uncompressed > maxBytes || compressed > maxBytes) throw new Error(`${wanted} larger than ${maxBytes} bytes`);
+        const lh = readAt(fd, local, 30);
+        if (lh.length < 30 || lh.readUInt32LE(0) !== 0x04034b50) throw new Error("bad local header");
+        const start = local + 30 + lh.readUInt16LE(26) + lh.readUInt16LE(28);
+        if (start + compressed > size) throw new Error("entry data out of bounds");
+        const raw = readAt(fd, start, compressed);
+        let data;
+        if (method === 0) data = raw;
+        else if (method === 8) data = inflateRawSync(raw, { maxOutputLength: maxBytes });
+        else throw new Error(`unsupported zip method ${method}`);
+        if (data.length !== uncompressed) throw new Error(`${wanted} length differs from its directory entry`);
+        return data;
+      }
+      at = end;
+    }
+    return null;
+  } finally { closeSync(fd); }
+}
+
+// --- DER ---------------------------------------------------------------------------------------
+/** Read one TLV at `at`; returns { tag, start (of header), body (start), end }. */
+function tlv(buf, at, limit = buf.length) {
+  if (at + 2 > limit) throw new Error("DER truncated");
+  const tag = buf[at]; let len = buf[at + 1]; let body = at + 2;
+  if ((tag & 0x1f) === 0x1f) throw new Error("DER high tag numbers unsupported");
+  if (len & 0x80) {
+    const n = len & 0x7f;
+    if (n === 0) return indefinite(buf, tag, at, limit); // BER indefinite length
+    if (n > 4 || body + n > limit) throw new Error("DER bad length");
+    len = 0;
+    for (let i = 0; i < n; i += 1) len = len * 256 + buf[body + i];
+    body += n;
+  }
+  if (body + len > limit) throw new Error("DER length exceeds container");
+  return { tag, start: at, body, end: body + len };
+}
+
+// BER indefinite-length constructed value: children until 00 00.
+function indefinite(buf, tag, at, limit) {
+  if (!(tag & 0x20)) throw new Error("indefinite length on primitive");
+  const body = at + 2; let p = body;
+  while (true) {
+    if (p + 2 > limit) throw new Error("BER unterminated");
+    if (buf[p] === 0 && buf[p + 1] === 0) return { tag, start: at, body, end: p, tail: p + 2 };
+    p = next(tlv(buf, p, limit));
+  }
+}
+const next = (t) => t.tail ?? t.end;
+const children = (buf, t) => {
+  const out = []; let p = t.body;
+  while (p < t.end) { const c = tlv(buf, p, t.end); out.push(c); p = next(c); }
+  return out;
+};
+const whole = (buf, t) => buf.subarray(t.start, next(t));
+const oid = (buf, t) => {
+  const b = buf.subarray(t.body, t.end); const parts = [Math.floor(b[0] / 40), b[0] % 40]; let v = 0;
+  for (let i = 1; i < b.length; i += 1) { v = v * 128 + (b[i] & 0x7f); if (!(b[i] & 0x80)) { parts.push(v); v = 0; } }
+  return parts.join(".");
+};
+const intHex = (buf, t) => { let h = buf.subarray(t.body, t.end).toString("hex").replace(/^(00)+(?=.)/, ""); return h.toLowerCase(); };
+
+/** Parse PKCS#7 SignedData; return { certificates: [Buffer], signer: { issuer: Buffer, serial: string } | { ski: string } }. */
+export function parseSignedData(der) {
+  const ci = tlv(der, 0);
+  if (ci.tag !== 0x30) throw new Error("ContentInfo is not a SEQUENCE");
+  const [type, content] = children(der, ci);
+  if (!type || type.tag !== 0x06 || oid(der, type) !== SIGNED_DATA_OID) throw new Error("not a PKCS#7 SignedData");
+  if (!content || content.tag !== 0xa0) throw new Error("SignedData content missing");
+  const sd = children(der, content)[0];
+  if (!sd || sd.tag !== 0x30) throw new Error("SignedData is not a SEQUENCE");
+  const parts = children(der, sd);
+  const certsSet = parts.find((p) => p.tag === 0xa0);
+  const signerSet = parts.filter((p) => p.tag === 0x31).at(-1);
+  if (!certsSet) throw new Error("SignedData carries no certificates");
+  if (!signerSet) throw new Error("SignedData carries no SignerInfos");
+  const certificates = children(der, certsSet).filter((c) => c.tag === 0x30).map((c) => Buffer.from(whole(der, c)));
+  const infos = children(der, signerSet);
+  if (infos.length !== 1) throw new Error(`expected exactly one SignerInfo, found ${infos.length}`);
+  const [, sid] = children(der, infos[0]);
+  if (!sid) throw new Error("SignerInfo has no signer identifier");
+  let signer;
+  if (sid.tag === 0x30) {
+    const [issuer, serial] = children(der, sid);
+    signer = { issuer: Buffer.from(whole(der, issuer)), serial: intHex(der, serial) };
+  } else if (sid.tag === 0x80) signer = { ski: Buffer.from(der.subarray(sid.body, sid.end)).toString("hex") };
+  else throw new Error("unsupported SignerInfo signer identifier");
+  return { certificates, signer };
+}
+
+/** TBSCertificate issuer (DER) and serial (hex) of a certificate. */
+function certIdentity(cert) {
+  const [tbs] = children(cert, tlv(cert, 0));
+  const f = children(cert, tbs);
+  const i = f[0].tag === 0xa0 ? 1 : 0; // optional [0] version
+  return { serial: intHex(cert, f[i]), issuer: Buffer.from(whole(cert, f[i + 2])) };
+}
+
+export function signerCertificate(parsed) {
+  const match = parsed.certificates.filter((c) => {
+    try {
+      if (parsed.signer.ski) {
+        const x = new X509Certificate(c);
+        return x.raw && (x.subjectKeyIdentifier ?? "").replace(/:/g, "").toLowerCase() === parsed.signer.ski;
+      }
+      const id = certIdentity(c);
+      return id.serial === parsed.signer.serial && id.issuer.equals(parsed.signer.issuer);
+    } catch { return false; }
+  });
+  if (match.length !== 1) throw new Error(`signer certificate not found in the signature (${match.length} matches)`);
+  return new X509Certificate(match[0]);
+}
+
+// --- subject rendering ---------------------------------------------------------------------------
+const needsQuote = (v) => /[,+"\\<>;=\r\n]/.test(v) || /^[ #]|\s$/.test(v);
+/** Node renders subject as "K=V" lines; join as an RFC 2253-style display string like .NET Subject ("CN=a, O=b"). */
+export function renderSubject(x509) {
+  return String(x509.subject).split("\n").filter(Boolean).map((line) => {
+    const at = line.indexOf("=");
+    const key = line.slice(0, at); const value = line.slice(at + 1);
+    return `${key}=${needsQuote(value) ? `"${value.replace(/"/g, '""')}"` : value}`;
+  }).join(", ");
+}
+
+/** Read the signer certificate subject of a signed .msix / .msixbundle from AppxSignature.p7x. Throws MSIX_PUBLISHER_MISMATCH. */
+export function readMsixSignerSubject(file) {
+  let p7x;
+  try { p7x = readZipEntry(file, "AppxSignature.p7x"); } catch (error) { throw fail(`could not read the signer certificate subject: ${error.message}`); }
+  if (!p7x) throw fail("could not read the signer certificate subject: AppxSignature.p7x is missing (package is unsigned)");
+  try {
+    if (p7x.length < 5 || p7x.subarray(0, 4).toString("latin1") !== "PKCX") throw new Error("AppxSignature.p7x lacks the PKCX header");
+    return renderSubject(signerCertificate(parseSignedData(p7x.subarray(4))));
+  } catch (error) {
+    throw fail(`could not read the signer certificate subject: AppxSignature.p7x unparsable (${error.message})`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.153",
+  "version": "0.2.155",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -27,7 +27,7 @@
     "@rightkit/platform-ui": "0.2.7",
     "@rightkit/qa": "0.4.7",
     "@rightkit/qa-chrome": "0.1.5",
-    "@rightkit/release": "0.2.153",
+    "@rightkit/release": "0.2.155",
     "@rightkit/settings-ui": "0.4.3",
     "@rightkit/tauri": "0.2.0",
     "@rightkit/theme": "0.2.3"