@rightkit/release 0.2.164 → 0.2.172

package/media-sidecar-catalog.mjs

@@ -0,0 +1,45 @@
+// Find the rightkit-ffmpeg crate (its catalog and notice files) for a release.
+//
+// Order: `mediaSidecar.catalog` in the release config (the crate's catalog/artifacts.json; the crate directory is the
+// catalog's grandparent), otherwise the crate Cargo resolves for the app's native manifest (`cargo metadata --offline`,
+// so the catalog is exactly the one the app was compiled against, at the version in its Cargo.lock).
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { runCargoSync } from "./managed-cargo.mjs";
+
+const invalid = (code, message) => Object.assign(new Error(message), { code });
+
+export function cargoFfmpegCrate(manifestPath, { run = runCargoSync } = {}) {
+  const result = run(["metadata", "--offline", "--format-version", "1", "--manifest-path", manifestPath], {
+    cwd: path.dirname(manifestPath),
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+    windowsHide: true,
+  });
+  if (result.error) throw invalid("MEDIA_SIDECAR_CRATE_NOT_FOUND", `could not run cargo metadata: ${result.error.message}`);
+  if (result.status !== 0) throw invalid("MEDIA_SIDECAR_CRATE_NOT_FOUND", `cargo metadata failed: ${String(result.stderr ?? "").trim()}`);
+  const metadata = JSON.parse(result.stdout);
+  const crates = metadata.packages.filter((pkg) => pkg.name === "rightkit-ffmpeg");
+  if (crates.length !== 1) throw invalid("MEDIA_SIDECAR_CRATE_NOT_FOUND", `the app's dependency graph has ${crates.length} rightkit-ffmpeg packages (expected exactly one)`);
+  return { crateDir: path.dirname(crates[0].manifest_path), crateVersion: crates[0].version };
+}
+
+/** Returns { catalog, catalogBytes, crateDir, crateVersion }. Injectable: read, crateFor. */
+export function loadSidecarCatalog({ config, root, manifestPath, read = readFileSync, crateFor = cargoFfmpegCrate }) {
+  let crateDir;
+  let crateVersion;
+  let catalogPath;
+  if (config.catalog) {
+    catalogPath = path.resolve(root, config.catalog);
+    crateDir = path.dirname(path.dirname(catalogPath));
+  } else {
+    if (!manifestPath) throw invalid("MEDIA_SIDECAR_CRATE_NOT_FOUND", "no mediaSidecar.catalog and no native Cargo manifest to resolve rightkit-ffmpeg from");
+    ({ crateDir, crateVersion } = crateFor(manifestPath));
+    catalogPath = path.join(crateDir, "catalog", "artifacts.json");
+  }
+  let catalogBytes;
+  try { catalogBytes = read(catalogPath); } catch (error) { throw invalid("MEDIA_SIDECAR_CATALOG_INVALID", `cannot read ${catalogPath}: ${error.message}`); }
+  let catalog;
+  try { catalog = JSON.parse(String(catalogBytes)); } catch { throw invalid("MEDIA_SIDECAR_CATALOG_INVALID", `${catalogPath} is not JSON`); }
+  return { catalog, catalogBytes, crateDir, crateVersion };
+}

package/media-sidecar.mjs

@@ -0,0 +1,306 @@
+// Bundle the rightkit-ffmpeg decode sidecar (ffmpeg + ffprobe) into a desktop app and seal its identity.
+//
+//   targets.mac.mediaSidecar = {
+//     arch: "aarch64",                       // catalog arch (default: build host); one arch per build
+//     variant: "decode",                     // catalog variant (default "decode")
+//     tools: ["ffmpeg", "ffprobe"],          // default both
+//     stageDir: "src-tauri/binaries",        // Tauri externalBin directory (default)
+//     bundleDir: "Contents/MacOS",           // mac only: where Tauri puts externalBin (or "Contents/Resources")
+//     notices: { dir: "src-tauri/resources/third-party/ffmpeg", sourceOfferContact: "https://..." },
+//     catalog: "path/to/artifacts.json",     // optional; default: the rightkit-ffmpeg crate Cargo resolves
+//     stage: { cmd: "cargo", args: [...] },  // optional: runs rightkit_ffmpeg::stage_external_bin
+//   }
+//
+// This module owns the config shape, catalog row selection, the notice set, the pre-sign checks and the receipt.
+// It never signs and never hashes the catalog's content digest (the crate's stage_external_bin does that when it
+// copies the binary in); release.mjs signs the files with the app and build-release.mjs seals the receipt.
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, copyFileSync } from "node:fs";
+import path from "node:path";
+
+export const MEDIA_SIDECAR_CONTRACT = "rightkit-ffmpeg-sidecar-v1";
+export const MEDIA_SIDECAR_RECEIPT_NAME = "media-sidecar.json";
+export const MEDIA_SIDECAR_OFFER_NAME = "FFMPEG-SOURCE-OFFER.txt";
+export const MEDIA_SIDECAR_TOOLS = Object.freeze(["ffmpeg", "ffprobe"]);
+
+const PLATFORM_OS = Object.freeze({ mac: "macos", win: "windows", linux: "linux" });
+const ARCHES = new Set(["aarch64", "x86_64"]);
+const SHA256 = /^[0-9a-f]{64}$/;
+const CONFIG_KEYS = new Set(["arch", "variant", "tools", "stageDir", "bundleDir", "notices", "catalog", "stage"]);
+const BUNDLE_DIRS = new Set(["Contents/MacOS", "Contents/Resources"]);
+
+const invalid = (code, message) => Object.assign(new Error(message), { code });
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const sha256Bytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const sha256File = (file) => sha256Bytes(readFileSync(file));
+
+/** Tauri target triple for a catalog os/arch pair (same table as rightkit-ffmpeg `tauri_target_triple`). */
+export function sidecarTargetTriple(os, arch) {
+  const table = {
+    "macos/aarch64": "aarch64-apple-darwin",
+    "macos/x86_64": "x86_64-apple-darwin",
+    "windows/x86_64": "x86_64-pc-windows-msvc",
+    "windows/aarch64": "aarch64-pc-windows-msvc",
+    "linux/x86_64": "x86_64-unknown-linux-gnu",
+    "linux/aarch64": "aarch64-unknown-linux-gnu",
+  };
+  const triple = table[`${os}/${arch}`];
+  if (!triple) throw invalid("MEDIA_SIDECAR_PLATFORM", `no Tauri target triple for ${os}/${arch}`);
+  return triple;
+}
+
+/** `ffmpeg-<triple>[.exe]`: the file Tauri resolves for `externalBin: ["binaries/ffmpeg"]`. */
+export function stagedFileName(tool, os, arch) {
+  return `${tool}-${sidecarTargetTriple(os, arch)}${os === "windows" ? ".exe" : ""}`;
+}
+
+/** The name Tauri gives the binary inside the bundle (no triple). */
+export function bundledFileName(tool, os) {
+  return `${tool}${os === "windows" ? ".exe" : ""}`;
+}
+
+export function hostCatalogArch(nodeArch = process.arch) {
+  return nodeArch === "arm64" ? "aarch64" : nodeArch === "x64" ? "x86_64" : nodeArch;
+}
+
+/**
+ * Validate and normalise `targets.<platform>.mediaSidecar`. Every problem is reported at once.
+ * Returns { os, arch, variant, tools, stageDir, bundleDir, notices: { dir, sourceOfferContact }, catalog?, stage? }.
+ */
+export function validateMediaSidecarConfig(raw, { platform, hostArch = hostCatalogArch() } = {}) {
+  const errors = [];
+  const os = PLATFORM_OS[platform];
+  if (!os) throw invalid("MEDIA_SIDECAR_CONFIG_INVALID", `mediaSidecar is not supported on platform ${JSON.stringify(platform)} (mac, win or linux)`);
+  if (!isObject(raw)) throw invalid("MEDIA_SIDECAR_CONFIG_INVALID", "mediaSidecar must be an object");
+  for (const key of Object.keys(raw)) if (!CONFIG_KEYS.has(key)) errors.push(`unknown key ${JSON.stringify(key)} (allowed: ${[...CONFIG_KEYS].join(", ")})`);
+  const relativePath = (value, label) => {
+    if (typeof value !== "string" || !value.trim()) { errors.push(`${label} must be a non-empty relative path`); return undefined; }
+    const normalized = value.replaceAll("\\", "/");
+    if (path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.split("/").includes("..")) { errors.push(`${label} must be relative and stay inside the app: ${value}`); return undefined; }
+    return normalized.replace(/\/+$/, "");
+  };
+  const arch = raw.arch ?? hostArch;
+  if (!ARCHES.has(arch)) errors.push(`arch must be one of ${[...ARCHES].join(", ")} (one architecture per build): ${JSON.stringify(arch)}`);
+  const variant = raw.variant ?? "decode";
+  if (typeof variant !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(variant)) errors.push(`variant must be a catalog variant slug: ${JSON.stringify(variant)}`);
+  const tools = raw.tools ?? [...MEDIA_SIDECAR_TOOLS];
+  if (!Array.isArray(tools) || !tools.length || new Set(tools).size !== tools.length || tools.some((tool) => !MEDIA_SIDECAR_TOOLS.includes(tool))) {
+    errors.push(`tools must be a non-empty list without duplicates drawn from ${MEDIA_SIDECAR_TOOLS.join(", ")}`);
+  }
+  const stageDir = relativePath(raw.stageDir ?? "src-tauri/binaries", "stageDir");
+  let bundleDir;
+  if (os === "macos") {
+    bundleDir = raw.bundleDir ?? "Contents/MacOS";
+    if (!BUNDLE_DIRS.has(bundleDir)) errors.push(`bundleDir must be ${[...BUNDLE_DIRS].join(" or ")}`);
+  } else if (raw.bundleDir !== undefined) errors.push("bundleDir applies to macOS only");
+  let notices;
+  if (!isObject(raw.notices)) errors.push("notices must be { dir, sourceOfferContact }: the LGPL text and source offer must ship with the app");
+  else {
+    for (const key of Object.keys(raw.notices)) if (!["dir", "sourceOfferContact"].includes(key)) errors.push(`notices: unknown key ${JSON.stringify(key)}`);
+    const dir = relativePath(raw.notices.dir, "notices.dir");
+    const contact = raw.notices.sourceOfferContact;
+    if (typeof contact !== "string" || !/^(https:\/\/\S+|[^\s@]+@[^\s@]+\.[^\s@]+)$/.test(contact)) errors.push("notices.sourceOfferContact must be an https URL or an email address where the source can be requested");
+    if (dir) notices = { dir, sourceOfferContact: contact };
+  }
+  const catalog = raw.catalog === undefined ? undefined : relativePath(raw.catalog, "catalog");
+  let stage;
+  if (raw.stage !== undefined) {
+    if (!isObject(raw.stage) || typeof raw.stage.cmd !== "string" || !raw.stage.cmd || (raw.stage.args !== undefined && !Array.isArray(raw.stage.args))) errors.push("stage must be { cmd, args? }");
+    else stage = raw.stage;
+  }
+  if (errors.length) throw invalid("MEDIA_SIDECAR_CONFIG_INVALID", `invalid mediaSidecar configuration:\n${errors.map((line) => `- ${line}`).join("\n")}`);
+  return { os, arch, variant, tools: [...tools], stageDir, ...(bundleDir ? { bundleDir } : {}), notices, ...(catalog ? { catalog } : {}), ...(stage ? { stage } : {}) };
+}
+
+/** `sign.nestedCode` entries for the macOS bundle: the sidecar executables, hardened runtime, no entitlements. */
+export function mediaSidecarNestedCode(config) {
+  if (config.os !== "macos") return {};
+  return Object.fromEntries(config.tools.map((tool) => [`${config.bundleDir}/${bundledFileName(tool, "macos")}`, { hardenedRuntime: true }]));
+}
+
+/**
+ * Select the one approved catalog row per tool for this variant/os/arch. A missing row, a pending or stale row, or an
+ * approved row without a content digest refuses the release: Linux has no approved row yet, so a Linux plan fails
+ * here with MEDIA_SIDECAR_NO_ROW instead of shipping an unverified binary.
+ */
+export function selectSidecarRows(catalog, config) {
+  if (!isObject(catalog) || !Array.isArray(catalog.artifacts)) throw invalid("MEDIA_SIDECAR_CATALOG_INVALID", "catalog has no artifacts array");
+  return config.tools.map((tool) => {
+    const matches = catalog.artifacts.filter((row) => row.tool === tool && (row.variant ?? "decode") === config.variant
+      && String(row.os).toLowerCase() === config.os && String(row.arch).toLowerCase() === config.arch);
+    const where = `${tool} ${config.variant} ${config.os}/${config.arch}`;
+    if (matches.length === 0) throw invalid("MEDIA_SIDECAR_NO_ROW", `the rightkit-ffmpeg catalog has no ${where} row`);
+    if (matches.length > 1) throw invalid("MEDIA_SIDECAR_AMBIGUOUS_ROW", `the rightkit-ffmpeg catalog has ${matches.length} ${where} rows`);
+    const [row] = matches;
+    if (row.status !== "approved") throw invalid("MEDIA_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} is ${row.status}, not approved`);
+    if (!SHA256.test(row.contentSha256 ?? "")) throw invalid("MEDIA_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} is approved but has no content digest`);
+    if (!Array.isArray(row.attribution?.noticeFiles) || !row.attribution.noticeFiles.length || typeof row.attribution.sourceUrl !== "string") {
+      throw invalid("MEDIA_SIDECAR_NOTICE_MISSING", `the ${where} row ${row.id} lacks notice files or a source URL`);
+    }
+    return row;
+  });
+}
+
+/**
+ * Plan the sidecar for one build. `catalog` is the parsed artifacts.json, `crateDir` the rightkit-ffmpeg crate
+ * directory (notice files are relative to it), `root` the app root.
+ */
+export function planMediaSidecar({ config, catalog, crateDir, crateVersion, catalogBytes, root }) {
+  const rows = selectSidecarRows(catalog, config);
+  const files = rows.map((row) => ({
+    tool: row.tool,
+    artifactId: row.id,
+    version: row.version,
+    contentSha256: row.contentSha256,
+    stagedPath: path.resolve(root, config.stageDir, stagedFileName(row.tool, config.os, config.arch)),
+    bundledName: bundledFileName(row.tool, config.os),
+    ...(config.bundleDir ? { bundlePath: `${config.bundleDir}/${bundledFileName(row.tool, config.os)}` } : {}),
+  }));
+  const noticeSources = new Map();
+  for (const row of rows) for (const notice of row.attribution.noticeFiles) {
+    const normalized = String(notice).replaceAll("\\", "/");
+    if (path.isAbsolute(notice) || normalized.split("/").includes("..")) throw invalid("MEDIA_SIDECAR_NOTICE_MISSING", `notice file path escapes the crate: ${notice}`);
+    noticeSources.set(normalized, path.join(crateDir, ...normalized.split("/")));
+  }
+  const noticeDir = path.resolve(root, config.notices.dir);
+  const notices = [...noticeSources].map(([relative, source]) => ({ source, dest: path.join(noticeDir, path.basename(relative)) }));
+  const names = notices.map((item) => path.basename(item.dest));
+  if (new Set(names).size !== names.length) throw invalid("MEDIA_SIDECAR_NOTICE_MISSING", "two notice files share a basename");
+  return {
+    config,
+    rows,
+    files,
+    notices,
+    offerPath: path.join(noticeDir, MEDIA_SIDECAR_OFFER_NAME),
+    offer: sourceOfferText({ rows, contact: config.notices.sourceOfferContact, crateVersion }),
+    catalog: { crateVersion: crateVersion ?? null, schemaVersion: catalog.schemaVersion ?? null, ...(catalogBytes ? { sha256: sha256Bytes(catalogBytes) } : {}) },
+  };
+}
+
+/** The written LGPL source offer: where the exact FFmpeg source, the build recipe and the licence text are. */
+export function sourceOfferText({ rows, contact, crateVersion }) {
+  const lines = [
+    "FFmpeg source offer",
+    "",
+    "This application includes unmodified FFmpeg programs (ffmpeg and ffprobe) built from the FFmpeg source below. FFmpeg is licensed under the",
+    "GNU Lesser General Public License version 2.1 or later (LGPL-2.1-or-later); the build is configured with --disable-gpl and --disable-nonfree.",
+    "The licence text and build notes are in this folder. You may replace these programs with your own build of the same source.",
+    "",
+    `Source code and build recipe: ${rows[0].attribution.sourceUrl}`,
+    `Build recipes, pinned sources and notes: https://github.com/Orthic-Labs/rightkit/tree/main/crates/rightkit-ffmpeg${crateVersion ? ` (crate rightkit-ffmpeg ${crateVersion}, published on crates.io)` : ""}`,
+    `To request the corresponding source on physical media, or if a link is unavailable, write to: ${contact}`,
+    "",
+    "Programs shipped",
+  ];
+  for (const row of rows) {
+    lines.push(`- ${row.tool} ${row.version} (${row.id})`);
+    lines.push(`  licence: ${row.attribution.licenseSpdx}`);
+    lines.push(`  source: ${row.attribution.sourceUrl}`);
+    lines.push(`  source archive sha256: ${row.sourceSha256}`);
+    lines.push(`  build notes: ${row.attribution.buildProvenance}`);
+    for (const component of row.attribution.components ?? []) lines.push(`  component ${component.name} ${component.version}: ${component.licenseSpdx} (${component.sourceUrl})`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+/** Copy the catalog's notice files and write the source offer into the app's notice directory. Idempotent. */
+export function writeMediaSidecarNotices(plan, { exists = existsSync, mkdir = mkdirSync, copy = copyFileSync, write = writeFileSync } = {}) {
+  for (const { source } of plan.notices) {
+    if (!exists(source)) throw invalid("MEDIA_SIDECAR_NOTICE_MISSING", `notice file not found in the rightkit-ffmpeg crate: ${source}`);
+  }
+  mkdir(path.dirname(plan.offerPath), { recursive: true });
+  for (const { source, dest } of plan.notices) copy(source, dest);
+  write(plan.offerPath, plan.offer);
+  return [...plan.notices.map((item) => item.dest), plan.offerPath];
+}
+
+/** Before signing: every staged binary exists, is a non-empty file, and its hash is recorded. */
+export function verifyStagedSidecars(plan, { exists = existsSync, stat = (file) => statSync(file), hashFile = sha256File } = {}) {
+  return plan.files.map((file) => {
+    if (!exists(file.stagedPath)) throw invalid("MEDIA_SIDECAR_NOT_STAGED", `${file.tool} is not staged: expected ${file.stagedPath} (rightkit_ffmpeg::stage_external_bin writes it; configure mediaSidecar.stage or stage it in prePackage)`);
+    const info = stat(file.stagedPath);
+    if (!info.isFile() || info.size <= 0) throw invalid("MEDIA_SIDECAR_NOT_STAGED", `${file.stagedPath} is not a non-empty file`);
+    return { ...file, preSignSha256: hashFile(file.stagedPath), preSignSizeBytes: info.size };
+  });
+}
+
+/** After signing: the receipt that build-release.mjs seals into the release manifest. `signed` maps tool to { sha256, sizeBytes }. */
+export function buildMediaSidecarReceipt(plan, preSign, signed, { notices = [], hashFile = sha256File, signing } = {}) {
+  const config = plan.config;
+  return {
+    schema: 1,
+    contract: MEDIA_SIDECAR_CONTRACT,
+    variant: config.variant,
+    os: config.os,
+    arch: config.arch,
+    signing: signing ?? (config.os === "macos" ? "developer-id-hardened-runtime" : config.os === "windows" ? "authenticode" : "none"),
+    catalog: plan.catalog,
+    files: preSign.map((file) => {
+      const after = signed[file.tool];
+      if (!after || !SHA256.test(after.sha256 ?? "")) throw invalid("MEDIA_SIDECAR_RECEIPT_INVALID", `no signed digest for ${file.tool}`);
+      return {
+        tool: file.tool,
+        artifactId: file.artifactId,
+        version: file.version,
+        catalogContentSha256: file.contentSha256,
+        preSignSha256: file.preSignSha256,
+        signedSha256: after.sha256,
+        sizeBytes: after.sizeBytes,
+        ...(file.bundlePath ? { bundlePath: file.bundlePath } : { bundledName: file.bundledName }),
+      };
+    }),
+    notices: [...plan.notices.map((item) => item.dest), plan.offerPath].map((file) => ({ name: path.basename(file), sha256: hashFile(file) })),
+    sourceOfferContact: config.notices.sourceOfferContact,
+    ...(notices.length ? { extra: notices } : {}),
+  };
+}
+
+/** Structural check used by the seal and by publication. `expected` optionally pins variant, os and tools. */
+export function validateMediaSidecarReceipt(receipt, expected = {}) {
+  const fail = (message) => { throw invalid("MEDIA_SIDECAR_RECEIPT_INVALID", `media sidecar receipt: ${message}`); };
+  if (!isObject(receipt) || receipt.schema !== 1 || receipt.contract !== MEDIA_SIDECAR_CONTRACT) fail("unrecognized contract");
+  if (!Array.isArray(receipt.files) || !receipt.files.length) fail("no files");
+  for (const file of receipt.files) {
+    if (!MEDIA_SIDECAR_TOOLS.includes(file.tool) || typeof file.artifactId !== "string" || !file.artifactId) fail(`bad file entry ${JSON.stringify(file.tool)}`);
+    for (const key of ["catalogContentSha256", "preSignSha256", "signedSha256"]) if (!SHA256.test(file[key] ?? "")) fail(`${file.tool}.${key} must be a SHA-256`);
+    if (!Number.isSafeInteger(file.sizeBytes) || file.sizeBytes <= 0) fail(`${file.tool}.sizeBytes must be positive`);
+    if (receipt.signing !== "none" && file.preSignSha256 === file.signedSha256) fail(`${file.tool} was not changed by signing`);
+  }
+  if (new Set(receipt.files.map((file) => file.tool)).size !== receipt.files.length) fail("duplicate tool");
+  if (!["developer-id-hardened-runtime", "authenticode", "none"].includes(receipt.signing)) fail("unknown signing mode");
+  if (!Array.isArray(receipt.notices) || !receipt.notices.some((item) => item.name === MEDIA_SIDECAR_OFFER_NAME) || receipt.notices.some((item) => !SHA256.test(item.sha256 ?? ""))) fail("notices must include the source offer with digests");
+  if (!receipt.notices.some((item) => /LGPL/i.test(item.name))) fail("notices must include the LGPL text");
+  if (expected.variant && receipt.variant !== expected.variant) fail(`variant ${receipt.variant} is not ${expected.variant}`);
+  if (expected.os && receipt.os !== expected.os) fail(`os ${receipt.os} is not ${expected.os}`);
+  if (expected.tools && JSON.stringify([...expected.tools].sort()) !== JSON.stringify(receipt.files.map((file) => file.tool).sort())) fail("tools differ from the configuration");
+  return receipt;
+}
+
+/** macOS: the nested signing receipt must show every sidecar signed (strict-valid) with the digest now on disk. */
+export function macSidecarSigningProblems(nestedReceipt, signedFiles) {
+  const problems = [];
+  const byFile = new Map((nestedReceipt?.files ?? []).map((item) => [path.resolve(item.file), item]));
+  for (const { file, sha256 } of signedFiles) {
+    const item = byFile.get(path.resolve(file));
+    if (!item) problems.push(`${file}: not in the nested signing receipt`);
+    else if (item.codesign !== "strict-valid") problems.push(`${file}: codesign is ${item.codesign ?? "missing"}, not strict-valid`);
+    else if (item.after?.sha256 !== sha256) problems.push(`${file}: bytes changed after signing`);
+  }
+  return problems;
+}
+
+export function sidecarFileEvidence(file, { hashFile = sha256File, stat = (item) => statSync(item) } = {}) {
+  return { sha256: hashFile(file), sizeBytes: stat(file).size };
+}
+
+/** Windows: each sidecar's signed digest must be one the raw-EXE signing receipt recorded as Valid after signing. */
+export function windowsSidecarSigningProblems(rawReceipt, receipt) {
+  const problems = [];
+  const signed = new Map((rawReceipt?.files ?? []).map((item) => [item.after?.sha256, item]));
+  for (const file of receipt.files) {
+    const item = signed.get(file.signedSha256);
+    if (!item) problems.push(`${file.tool}: signed digest ${file.signedSha256} is not in the raw-EXE signing receipt`);
+    else if (item.authenticode !== "Valid" || item.timestampPresent !== true) problems.push(`${file.tool}: Authenticode evidence is not Valid with a timestamp`);
+  }
+  return problems;
+}

package/ownership-approval-command.mjs

@@ -1,50 +1,16 @@
 #!/usr/bin/env node
-// Draft/import/verify utilities. Signing is intentionally absent; native prompts own signing.
-import { readFileSync, writeFileSync, realpathSync } from "node:fs";
+// `right-release ownership-approval` is retired (Orthic-Labs/rightkit#262), under the proportional-trust rule, like trust-sync.
+// Ownership exceptions are plain entries in the repository's .rightkit/ownership-exceptions.json, reviewed through git:
+// no drafts, signatures, Touch ID or native helper. The command is a no-op that says so and always succeeds.
+import { realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { createDraft, loadTrustedExternal, policyEntryDigest, validateRecord, verifyException } from "./ownership-approval.mjs";
-import { SCANNER_VERSION } from "./ownership.mjs";
-import manifest from "./rightkit-ownership.json" with { type: "json" };
 
-function arg(args, name) { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; }
-function json(file) { return JSON.parse(readFileSync(path.resolve(file), "utf8")); }
-export function createInstalledDraft(input, { catalog = manifest, scannerVersion = SCANNER_VERSION, now = new Date() } = {}) {
-  const draft = createDraft({ ...input, issued: now.toISOString().slice(0, 10), policyDigest: policyEntryDigest(catalog, input.fingerprint), minimumScannerVersion: scannerVersion, minimumCatalogVersion: catalog.version ?? String(catalog.schema) });
-  const problems = validateRecord(draft);
-  const duration = Date.parse(draft.payload.expires) - Date.parse(draft.payload.issued);
-  if (!(duration > 0 && duration <= 90 * 86400000)) problems.push("draft expiry must be after issued and within 90 days");
-  if (problems.length) throw new Error(problems.join("; "));
-  return draft;
-}
-export function main(args) {
-  if (args.includes("--draft")) {
-    const input = json(arg(args, "--draft"));
-    const draft = createInstalledDraft(input);
-    const out = arg(args, "--out");
-    const data = `${JSON.stringify(draft, null, 2)}\n`;
-    if (out) writeFileSync(path.resolve(out), data, { flag: "wx" }); else process.stdout.write(data);
-    return 0;
-  }
-  if (args.includes("--import")) {
-    const record = json(arg(args, "--import"));
-    const out = arg(args, "--out");
-    if (!out) throw new Error("--import requires --out");
-    writeFileSync(path.resolve(out), `${JSON.stringify(record, null, 2)}\n`, { flag: "wx" });
-    return 0;
-  }
-  if (args.includes("--verify")) {
-    const record = json(arg(args, "--verify"));
-    const context = json(arg(args, "--context"));
-    const loaded = loadTrustedExternal();
-    const result = verifyException(record, { ...context, trust: loaded.trust });
-    process.stdout.write(`${JSON.stringify({ ...result, pending: loaded.pending }, null, 2)}\n`);
-    return result.ok ? 0 : 1;
-  }
-  throw new Error("usage: node ownership-approval-command.mjs --draft input.json [--out draft.json] | --import signed.json --out record.json | --verify signed.json --context scan.json");
+export const OWNERSHIP_APPROVAL_RETIRED = "right-release ownership-approval is retired: signed ownership exceptions (draft, sign, Touch ID and native-helper paths) no longer exist. Edit .rightkit/ownership-exceptions.json directly, with plain entries {capability, package, reason, owner, date}, and review the change through git. `right-release ownership` marks a matching finding excepted and warns about stale entries.";
+
+export function main(_args = [], { print = (line) => process.stdout.write(`${line}\n`) } = {}) {
+  print(`[right-release] ${OWNERSHIP_APPROVAL_RETIRED}`);
+  return 0;
 }
 const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
-if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
-  try { process.exitCode = main(process.argv.slice(2)); }
-  catch (error) { console.error(`[right-release] ownership approval: ${error.message}`); process.exitCode = 1; }
-}
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) process.exitCode = main(process.argv.slice(2));

package/ownership-approval.mjs

@@ -110,7 +110,7 @@ export function occurrenceHash(finding) {
   return sha256({ v: 2, kind, fingerprint: finding.fingerprint, path: finding.file, ecosystem, name: finding.name, alias: finding.alias, section: finding.section, requirement: finding.requirement,
     features: [...new Set(finding.features)].sort(), defaultFeatures: finding.defaultFeatures, source: finding.source, resolvedVersion: finding.resolvedVersion });
 }
-// Schema-v2 envelopes retain source/dependency kinds; lock routes are dependency occurrences.
+// Schema-v2 draft envelopes retain source/dependency kinds; lock routes are dependency occurrences.
 const exceptionOccurrenceKind = (f) => f.kind === "transitive-dependency" ? "dependency" : f.kind ?? (f.ecosystem ? "dependency" : "source");
 function nullableString(value) { return value === null || typeof value === "string" && value.length > 0; }
 function validFingerprint(value) { return typeof value === "string" && /^[a-z0-9][a-z0-9._-]{1,127}$/.test(value) && !HEX.test(value); }
@@ -415,44 +415,5 @@ function signatureProblems(record, trust) {
   }
 }
 
-/** Verify signature, protected enrollment, floor, and exact scan coverage. */
-export function verifyException(record, { repositoryIdentity, catalogDigest, policyDigest, findings, trust, today = new Date().toISOString().slice(0, 10), scannerVersion, catalogVersion } = {}) {
-  const problems = validateRecord(record);
-  if (problems.length) return { ok: false, problems };
-  const r = record.payload;
-  if (!validDate(today)) return { ok: false, problems: ["invalid verification date"] };
-  if (r.issued > today) problems.push("approval issued date is in the future");
-  const duration = Date.parse(`${r.expires}T00:00:00Z`) - Date.parse(`${r.issued}T00:00:00Z`);
-  if (duration <= 0 || duration > 90 * 86400000) problems.push("approval expiry must be after issued and within 90 days");
-  if (r.expires < today) problems.push(`approval expired ${r.expires}`);
-  if (problems.length) return { ok: false, problems };
-  if (!versionAtLeast(scannerVersion, r.minimumScannerVersion)) problems.push("scanner version missing, malformed, or below approval minimum");
-  if (!versionAtLeast(catalogVersion, r.minimumCatalogVersion)) problems.push("catalog version missing, malformed, or below approval minimum");
-  if (!trust) problems.push("pending: external ownership trust is not enrolled");
-  else problems.push(...validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest }).problems);
-  if (problems.length) return { ok: false, problems };
-  if (typeof policyDigest !== "string" || !HEX.test(policyDigest) || r.policyDigest !== policyDigest) return { ok: false, problems: ["ownership fingerprint policy digest missing or changed"] };
-  if (!Array.isArray(findings)) return { ok: false, problems: ["current findings missing or malformed"] };
-  let current;
-  try { current = findings.filter((f) => f.fingerprint === r.fingerprint).map((f) => ({ path: f.file, kind: exceptionOccurrenceKind(f), hash: occurrenceHash(f) })); }
-  catch (error) { return { ok: false, problems: [error.message] }; }
-  for (const item of r.occurrences) if (!current.some((f) => f.path === item.path && f.hash === item.hash && f.kind === item.kind)) problems.push(`baseline occurrence changed or missing: ${item.path} (${item.hash})`);
-  if (problems.length) return { ok: false, problems };
-  const trackingEvidence = sha256({ repositoryIdentity: r.repositoryIdentity, requestId: r.requestId, trackingRef: r.trackingRef });
-  if (!trust.verifiedTrackingEvidence?.includes(trackingEvidence)) problems.push("tracking reference lacks protected verification evidence");
-  let recordIdentity, currentIdentity;
-  try { recordIdentity = canonicalRepositoryIdentity(r.repositoryIdentity); currentIdentity = canonicalRepositoryIdentity(repositoryIdentity); }
-  catch { problems.push("invalid repository identity"); }
-  if (recordIdentity && recordIdentity !== r.repositoryIdentity) problems.push("approval repository identity is not canonical");
-  if (recordIdentity && currentIdentity && recordIdentity !== currentIdentity) problems.push("repository identity changed");
-  const registration = verifyRepositoryRegistration(trust, r.repositoryIdentity, { files: (findings ?? []).map((f) => f.file) });
-  problems.push(...registration.problems);
-  if (record.signature === null) problems.push("unsigned approval record");
-  else if (!problems.length) problems.push(...signatureProblems(record, trust));
-  return { ok: problems.length === 0, problems };
-}
-
-export function signPayloadForNative(record, { keyId, host, signature }) {
-  if (!record?.payload || !signature) throw new Error("native signer must return a signature over displayed approval payload");
-  return { schema: APPROVAL_SCHEMA, payload: record.payload, signature: { keyId, host, value: signature } };
-}
+// Exception records are plain, git-reviewed entries (Orthic-Labs/rightkit#262); verifyException and native signing are retired.
+// signatureProblems stays only as the enrolled-key signature check used by key-log tests.

package/ownership-catalog-config.json

@@ -8,10 +8,11 @@
     { "capability": "text-to-speech", "packages": ["rightkit-tts-qwen", "rightkit-tts-qwen-sys", "rightkit-tts"], "reason": "Speech facade & its QTS inference, safe-wrapper & FFI layers" },
     { "capability": "os-credential-store", "packages": ["rightkit-credentials", "RightKitSwift"], "reason": "Cross-platform Rust & Apple-native Swift credential APIs" },
     { "capability": "desktop-shell", "packages": ["rightkit-tauri-shell", "@rightkit/tauri-shell"], "reason": "Native Tauri shell & typed renderer bridge" },
+    { "capability": "lifecycle-hooks", "packages": ["rightkit-hooks", "@rightkit/hooks"], "reason": "Native Claude Code/Codex hook runtime & its Node pair share one lifecycle-hooks contract" },
     { "capability": "tauri-host-adapters", "packages": ["rightkit-device", "@rightkit/tauri"], "reason": "Native license/device services & renderer command adapters" }
   ],
   "testOwners": [
-    { "path": "crates/rightkit-qa-driver/examples/control-test-app/Cargo.toml", "package": "control-test-app", "reason": "Unpublished desktop-control test fixture" },
+    { "path": "crates/rightkit-qa/examples/control-test-app/Cargo.toml", "package": "control-test-app", "reason": "Unpublished desktop-control test fixture" },
     { "path": "crates/rightkit-tauri-shell/example-app/Cargo.toml", "package": "shell-example-app", "reason": "Unpublished standalone shell demonstration & test host" }
   ]
 }

package/ownership-catalog.mjs

@@ -56,13 +56,15 @@ export function generateOwnershipCatalog(root) {
           if (f.type === "dependency") {
             if (!["cargo", "npm", "swiftpm"].includes(f.ecosystem) || !f.name || /^(@rightkit\/|rightkit-)/.test(f.name)) throw new Error(`ownership: imprecise dependency: ${f.id}`);
           } else if (f.type === "source") {
-            if (!f.codeOnly || !f.extensions?.length) throw new Error(`ownership: source fingerprint must be code & extension scoped: ${f.id}`);
+            // codeOnly: false is explicit opt-in for rules that must see string literals (auth URLs, #279).
+            if (typeof f.codeOnly !== "boolean" || !f.extensions?.length) throw new Error(`ownership: source fingerprint must be code & extension scoped: ${f.id}`);
             new RegExp(f.pattern);
           } else throw new Error(`ownership: unknown fingerprint type: ${f.id}`);
           // A banned dependency blocks regardless of owner qualification: the ban stands even
           // when no replacement is used. It names the authority that imposed it.
           if (f.tier === "block" && f.policy === "banned") {
-            if (f.type !== "dependency" || !f.policyAuthority) throw new Error(`ownership: banned fingerprint needs a dependency & policyAuthority: ${f.id}`);
+            // A banned source rule (e.g. in-app webview sign-in, #279) is allowed: the verdict blocks on policy "banned" for any type.
+            if (!["dependency", "source"].includes(f.type) || !f.policyAuthority) throw new Error(`ownership: banned fingerprint needs a dependency or source rule & policyAuthority: ${f.id}`);
           } else if (f.tier === "block") {
             const published = ownershipAvailability(owner, versions).find((row) => row.state !== "staged-unverified");
             const q = f.qualification;

package/ownership-command.mjs

@@ -101,28 +101,27 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   const result = checked.result;
   if (args.includes("--audit-json")) return printAuditJson(result, print);
   // A refusal names every blocking check on stderr and in the JSON `blocked` field. Advise-tier findings never refuse.
-  const blocked = checked.enrollmentPending || checked.ok ? undefined : blockingChecks(checked);
+  const blocked = checked.ok ? undefined : blockingChecks(checked);
   if (blocked) reportBlocked(blocked, stderr);
   if (args.includes("--json")) {
-    const error = checked.enrollmentPending ? undefined : !checked.floor.ok
+    const error = !checked.floor.ok
       ? { type: "ownership-floor", message: checked.floor.problems.join("; ") }
       : result.coverage.length
         ? { type: "ownership-coverage", message: `${result.coverage.length} ownership coverage gap(s)` }
         : undefined;
-    print(JSON.stringify({ ok: checked.ok, ...(checked.enrollmentPending ? { enrollmentPending: true, warning: checked.warning } : {}), ...(error ? { error } : {}), ...(blocked ? { blocked } : {}), rows: result.rows, violations: result.violations, covered: result.covered, problems: [...result.problems, ...checked.floor.problems], ...(checked.warnings ? { warnings: checked.warnings } : {}), coverage: result.coverage, metadata: result.metadata }, null, 2));
+    print(JSON.stringify({ ok: checked.ok, ...(checked.enrollmentPending ? { enrollmentPending: true, warning: checked.warning } : {}), ...(error ? { error } : {}), ...(blocked ? { blocked } : {}), rows: result.rows, violations: result.violations, covered: result.covered, problems: [...result.problems, ...checked.floor.problems], ...((checked.warnings?.length || result.warnings?.length) ? { warnings: [...(checked.warnings ?? []), ...(result.warnings ?? [])] } : {}), coverage: result.coverage, metadata: result.metadata }, null, 2));
   } else {
     print(`RightKit ownership: ${path.basename(app)}`);
     print(formatTable(result.rows));
     for (const v of result.violations) {
       print(`  OWN COPY ${v.fingerprint} (${v.package}) ${v.file}${v.line ? `:${v.line}` : ""}  ${v.text}`);
     }
-    for (const p of result.problems) print(`  ${checked.enrollmentPending ? "DIAGNOSTIC" : "EXCEPTION"} ${p}`);
+    for (const p of result.problems) print(`  EXCEPTION ${p}`);
     print(verdictLine(checked, result, blocked));
-    for (const warning of checked.warnings ?? []) print(`  WARNING ${warning}`);
+    for (const warning of [...(checked.warnings ?? []), ...(result.warnings ?? [])]) print(`  WARNING ${warning}`);
+    if (checked.enrollmentPending && checked.warning) print(`  ${checked.warning}`);
   }
-  // CI lanes may pass `--advisory-when-pending`: before approval keys are enrolled the scan asserts
-  // nothing, so findings print as diagnostics and the step exits 0. Release lanes never pass it.
-  if (checked.enrollmentPending && args.includes("--advisory-when-pending")) return 0;
+  // `--advisory-when-pending` is accepted and ignored: pending approval enrollment is a warning and never changes the exit code (#262).
   return checked.ok ? 0 : 1;
 }
 
@@ -193,7 +192,6 @@ function tierCounts(violations) {
 
 // The human verdict line. Advise-only results pass and say so; a refusal names its checks.
 function verdictLine(checked, result, blocked) {
-  if (checked.enrollmentPending) return `[right-release] ${checked.warning}`;
   if (checked.ok) {
     const counts = tierCounts(result.violations ?? []);
     return counts.advise

package/ownership-dependency-allowlist.json

@@ -1,6 +1,9 @@
 {
   "schema": 1,
   "global": [
+    "cargo:blake3",
+    "cargo:clap",
+    "cargo:getrandom",
     "npm:@types/node",
     "npm:typescript",
     "npm:vitest"
@@ -786,7 +789,28 @@
     },
     {
       "repositoryIdentity": "https://github.com/bogusyogi/postright",
-      "dependencies": []
+      "dependencies": [
+        "cargo:jiff",
+        "cargo:serde_json",
+        "cargo:tauri",
+        "cargo:tauri-build",
+        "cargo:tauri-plugin-os",
+        "cargo:tauri-plugin-process",
+        "cargo:tauri-plugin-updater",
+        "npm:@tailwindcss/vite",
+        "npm:@tauri-apps/api",
+        "npm:@tauri-apps/cli",
+        "npm:@tauri-apps/plugin-os",
+        "npm:@tauri-apps/plugin-process",
+        "npm:@tauri-apps/plugin-updater",
+        "npm:@types/react",
+        "npm:@types/react-dom",
+        "npm:@vitejs/plugin-react",
+        "npm:react",
+        "npm:react-dom",
+        "npm:tailwindcss",
+        "npm:vite"
+      ]
     },
     {
       "repositoryIdentity": "https://github.com/orthic-labs/cockpit",