@rightkit/release 0.2.164 → 0.2.172

package/sign-dev-artifact.mjs

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+// right-release sign-dev-artifact: Developer ID sign an EXISTING, already-qualified CI dev artifact in place (Orthic-Labs/rightkit#257).
+// It never builds, notarizes, publishes or installs. Steps: verify the artifact's recorded hashes, sign each manifest file with its fixed
+// codesign identifier (mac-sign-core signMacosEntries, the provisioned Developer ID only), verify strictly, read back Identifier and
+// TeamIdentifier, refresh the payload metadata, and write evidence JSON. An optional declarative `refresh` in the sign manifest
+// (dev-artifact-refresh.mjs) recomputes digests recorded in JSON files after the code they describe is signed and before the bundle
+// that contains those files is signed, so that bundle seals their final bytes; the payload metadata refresh then records everything.
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { MacosDevelopmentSigningError, resolveMacosDevelopmentSigning } from "./development-signing.mjs";
+import { SIGN_MANIFEST_SCHEMA, parseSignManifest, signMacosEntries } from "./mac-sign-core.mjs";
+import { fileEvidence } from "./macos-file-evidence.mjs";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+import { SignDevArtifactError, assertInsideOnDisk, contained, fail, toPosix } from "./dev-artifact-support.mjs";
+import { applyRefresh, planRefresh, readRefreshPlan } from "./dev-artifact-refresh.mjs";
+
+export const DEV_ARTIFACT_PAYLOAD_SCHEMA = 1;
+export const DEV_ARTIFACT_EVIDENCE_SCHEMA = 1;
+export const DEFAULT_PAYLOAD_METADATA = "payload.json";
+
+export { SignDevArtifactError };
+
+/**
+ * Sign manifest for this command: `{ schema: 1, entries: [{ file, identifier, entitlements?, options?, hardenedRuntime? }] }`.
+ * `file` is relative to the artifact directory (a loose executable or the installer .app); `identifier` is required on every entry.
+ * Entries sign in the given order, so list nested code before the bundle that contains it. Returns absolute-path entries.
+ */
+export function readDevArtifactSignManifest(file, artifact) {
+  let raw;
+  try { raw = JSON.parse(readFileSync(file, "utf8")); } catch { fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest is not readable JSON: ${file}`); }
+  if (raw?.schema !== SIGN_MANIFEST_SCHEMA || !Array.isArray(raw.entries) || !raw.entries.length) {
+    fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest must be { schema: ${SIGN_MANIFEST_SCHEMA}, entries: [...] } with at least one entry`);
+  }
+  const absolute = raw.entries.map((entry, index) => {
+    if (!entry || typeof entry !== "object") fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest entry ${index} must be an object`);
+    if (entry.identifier === undefined) fail("SIGN_DEV_ARTIFACT_IDENTIFIER_REQUIRED", `sign manifest entry ${index} (${entry.file}) needs a fixed identifier`);
+    return {
+      ...entry,
+      file: contained(artifact, entry.file, `sign manifest entry ${index} file`),
+      ...(entry.entitlements !== undefined ? { entitlements: contained(artifact, entry.entitlements, `sign manifest entry ${index} entitlements`) } : {}),
+    };
+  });
+  const entries = parseSignManifest(JSON.stringify({ schema: SIGN_MANIFEST_SCHEMA, entries: absolute }));
+  const seen = new Set();
+  entries.forEach((entry, index) => {
+    if (seen.has(entry.file)) fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest lists ${entry.file} twice`);
+    seen.add(entry.file);
+    for (const earlier of entries.slice(0, index)) {
+      if (entry.file.startsWith(earlier.file + path.sep)) fail("SIGN_DEV_ARTIFACT_ORDER_INVALID", `${path.relative(artifact, earlier.file)} contains ${path.relative(artifact, entry.file)} but is listed first; sign nested code before its bundle`);
+    }
+  });
+  return entries;
+}
+
+/** The optional declarative `refresh` of the sign manifest (see dev-artifact-refresh.mjs): `{ root, operations }`, absolute paths, validated. */
+export function readDevArtifactRefreshPlan(file, artifact) {
+  let raw;
+  try { raw = JSON.parse(readFileSync(file, "utf8")); } catch { fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest is not readable JSON: ${file}`); }
+  return readRefreshPlan(raw, artifact);
+}
+
+/** Read the artifact's payload metadata `{ schema: 1, files: [{ path, sha256, ... }] }` and verify every recorded hash against disk. */
+export function verifyDevArtifactPayload(artifact, metadataFile) {
+  let metadata;
+  try { metadata = JSON.parse(readFileSync(metadataFile, "utf8")); } catch { fail("SIGN_DEV_ARTIFACT_METADATA_INVALID", `payload metadata is not readable JSON: ${metadataFile}`); }
+  if (metadata?.schema !== DEV_ARTIFACT_PAYLOAD_SCHEMA || !Array.isArray(metadata.files) || !metadata.files.length) {
+    fail("SIGN_DEV_ARTIFACT_METADATA_INVALID", `payload metadata must be { schema: ${DEV_ARTIFACT_PAYLOAD_SCHEMA}, files: [...] } with at least one file: ${metadataFile}`);
+  }
+  const recorded = new Map();
+  for (const item of metadata.files) {
+    if (!/^[0-9a-f]{64}$/.test(item?.sha256 ?? "")) fail("SIGN_DEV_ARTIFACT_METADATA_INVALID", `payload metadata entry ${JSON.stringify(item?.path)} has no sha256`);
+    const absolute = contained(artifact, item.path, "payload metadata path");
+    if (!existsSync(absolute)) fail("SIGN_DEV_ARTIFACT_MISSING", `payload file is missing: ${item.path}`);
+    const actual = fileEvidence(absolute).sha256;
+    if (actual !== item.sha256) fail("SIGN_DEV_ARTIFACT_HASH_MISMATCH", `recorded hash does not match ${item.path}: recorded ${item.sha256}, found ${actual}. Refusing to sign bytes that were not qualified.`);
+    recorded.set(absolute, item);
+  }
+  return { metadata, recorded };
+}
+
+const defaultInspect = (run, env) => (command, args) => {
+  const result = run(command, args, { env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false });
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+  if (result.error || result.status !== 0) fail("SIGN_DEV_ARTIFACT_INSPECT_FAILED", `${command} ${args.join(" ")} failed: ${output.trim() || result.error?.message}`);
+  return output;
+};
+
+/**
+ * Sign an existing dev artifact. Injectable for tests: `resolveSigning`, `signOne`, `inspect`, `evidenceOf`.
+ * Returns the evidence object (also written to `evidencePath`). With `dryRun` only the hash verification and manifest parsing run.
+ */
+export function signDevArtifact({
+  artifact, manifestPath, metadataPath, evidencePath, dryRun = false,
+  env = process.env, run = spawnSync, platform = process.platform,
+  resolveSigning = (options) => resolveMacosDevelopmentSigning(options),
+  signOne = (codesignArgs) => runMacCodesignCommands([codesignArgs], { env, run })[0],
+  inspect = defaultInspect(run, env), evidenceOf = fileEvidence,
+} = {}) {
+  if (!artifact || !manifestPath) fail("SIGN_DEV_ARTIFACT_USAGE", "usage: right-release sign-dev-artifact --artifact <dir> --manifest <sign-manifest.json> [--metadata <payload.json>] [--evidence <path>] [--dry-run]");
+  const root = path.resolve(artifact);
+  if (!existsSync(root)) fail("SIGN_DEV_ARTIFACT_MISSING", `artifact directory does not exist: ${root}`);
+  const metadataFile = path.resolve(metadataPath ?? path.join(root, DEFAULT_PAYLOAD_METADATA));
+  const entries = readDevArtifactSignManifest(path.resolve(manifestPath), root);
+  const refreshPlan = readDevArtifactRefreshPlan(path.resolve(manifestPath), root);
+  const plan = planRefresh(entries, refreshPlan.operations, metadataFile);
+  const before = verifyDevArtifactPayload(root, metadataFile);
+  for (const entry of entries) {
+    if (!existsSync(entry.file)) fail("SIGN_DEV_ARTIFACT_MISSING", `sign manifest file is missing: ${path.relative(root, entry.file)}`);
+    if (!before.recorded.has(entry.file)) fail("SIGN_DEV_ARTIFACT_NOT_RECORDED", `${path.relative(root, entry.file)} is not in the payload metadata, so its hash was never recorded`);
+    if (entry.entitlements && !existsSync(entry.entitlements)) fail("SIGN_DEV_ARTIFACT_MISSING", `entitlements file is missing: ${path.relative(root, entry.entitlements)}`);
+  }
+  if (dryRun) return { schema: DEV_ARTIFACT_EVIDENCE_SCHEMA, dryRun: true, files: entries.map((entry) => ({ path: toPosix(path.relative(root, entry.file)), identifier: entry.identifier })) };
+  if (platform !== "darwin") fail("SIGN_DEV_ARTIFACT_PLATFORM", "sign-dev-artifact must run on macOS");
+  if (!evidencePath) fail("SIGN_DEV_ARTIFACT_USAGE", "--evidence requires a path");
+
+  // Same Developer ID resolution as dev signing: no ad hoc and no Apple Development fallback.
+  const signing = resolveSigning({ root, bundle: root, descriptor: {}, config: {}, env, run });
+  if (signing.adhoc || !/^Developer ID Application:/.test(signing.identity ?? "")) {
+    throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_DEVELOPER_ID_REQUIRED", `sign-dev-artifact needs the provisioned Developer ID Application identity; got ${JSON.stringify(signing.identity)}. There is no ad hoc or Apple Development fallback.`, { identity: signing.identity });
+  }
+  const { identity, teamIdentifier } = signing;
+
+  const sha256Before = new Map(entries.map((entry) => [entry.file, evidenceOf(entry.file).sha256]));
+  // Entries before the refresh sign first, then the declared metadata is recomputed from their final bytes, then the entries that
+  // contain the refreshed files (the wrapper bundle) sign over them. Without a refresh this is one signing pass, as before.
+  const signingOptions = { identity, signOne, inspect, evidence: evidenceOf, bundle: root };
+  // The manifest paths were checked when it was read; check them on disk again right before codesign touches them.
+  const recheck = (list) => {
+    for (const entry of list) {
+      assertInsideOnDisk(root, entry.file, `sign manifest file ${path.relative(root, entry.file)}`);
+      if (entry.entitlements) assertInsideOnDisk(root, entry.entitlements, `entitlements ${path.relative(root, entry.entitlements)}`);
+    }
+    return list;
+  };
+  const signed = plan.before.length ? signMacosEntries(recheck(plan.before), signingOptions) : [];
+  const refreshOps = refreshPlan.operations.length ? applyRefresh(refreshPlan.operations, refreshPlan.root) : [];
+  if (plan.after.length) signed.push(...signMacosEntries(recheck(plan.after), signingOptions));
+  const files = signed.map((record) => {
+    const rel = toPosix(path.relative(root, record.file));
+    const details = inspect("codesign", ["-dvv", record.file]);
+    const team = /^TeamIdentifier=(.+)$/m.exec(details)?.[1]?.trim();
+    const identifier = /^Identifier=(.+)$/m.exec(details)?.[1]?.trim();
+    if (!team || team !== teamIdentifier) fail("SIGN_DEV_ARTIFACT_TEAM_MISMATCH", `${rel}: expected TeamIdentifier=${teamIdentifier}, found ${team ?? "missing"}`);
+    if (!identifier || identifier !== record.identifier) fail("SIGN_DEV_ARTIFACT_IDENTIFIER_MISMATCH", `${rel}: expected Identifier=${record.identifier}, found ${identifier ?? "missing"}`);
+    const requirement = inspect("codesign", ["-d", "-r-", record.file]);
+    const designatedRequirement = /^designated => (.+)$/m.exec(requirement)?.[1]?.trim();
+    if (!designatedRequirement || /\bcdhash\b/.test(designatedRequirement)) fail("SIGN_DEV_ARTIFACT_UNSTABLE_REQUIREMENT", `${rel}: designated requirement ${JSON.stringify(designatedRequirement)} is not identity-based, so privacy grants would not survive a rebuild`);
+    return { path: rel, sha256Before: sha256Before.get(record.file), sha256After: record.after.sha256, identifier, teamIdentifier: team, designatedRequirement };
+  });
+
+  // Refresh the payload metadata: every recorded hash is recomputed (a signed bundle changes its tree digest too).
+  const payloadFiles = before.metadata.files.map((item) => {
+    const evidence = evidenceOf(contained(root, item.path, "payload metadata path"));
+    return { ...item, sha256: evidence.sha256, ...(item.sizeBytes !== undefined ? { sizeBytes: evidence.sizeBytes } : {}) };
+  });
+  const metadata = { ...before.metadata, files: payloadFiles, signing: { contract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, teamIdentifier, signedPaths: files.map((file) => file.path) } };
+  const metadataBefore = evidenceOf(metadataFile).sha256;
+  const staging = `${metadataFile}.signing`;
+  rmSync(staging, { force: true }); // a stale file or planted link is removed itself, never written through
+  writeFileSync(staging, `${JSON.stringify(metadata, null, 2)}\n`, { flag: "wx" });
+  renameSync(staging, metadataFile);
+  verifyDevArtifactPayload(root, metadataFile);
+
+  const result = {
+    schema: DEV_ARTIFACT_EVIDENCE_SCHEMA, signingContract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, teamIdentifier, notarized: false, built: false, published: false,
+    artifact: root, metadata: { path: toPosix(path.relative(root, metadataFile)), sha256Before: metadataBefore, sha256After: evidenceOf(metadataFile).sha256 }, files,
+    ...(refreshOps.length ? { refresh: refreshOps } : {}),
+  };
+  const absoluteEvidence = path.resolve(evidencePath);
+  mkdirSync(path.dirname(absoluteEvidence), { recursive: true });
+  writeFileSync(absoluteEvidence, `${JSON.stringify(result, null, 2)}\n`);
+  return result;
+}
+
+export function main(args = process.argv.slice(2), options = {}) {
+  const take = (flag) => {
+    const index = args.indexOf(flag);
+    if (index < 0) return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) fail("SIGN_DEV_ARTIFACT_USAGE", `${flag} requires a value`);
+    return value;
+  };
+  try {
+    const result = signDevArtifact({
+      artifact: take("--artifact"), manifestPath: take("--manifest"), metadataPath: take("--metadata"), evidencePath: take("--evidence"),
+      dryRun: args.includes("--dry-run"), ...options,
+    });
+    console.log(result.dryRun ? `dry-run: recorded hashes verified; would sign ${result.files.map((file) => file.path).join(", ")}` : `signed ${result.files.length} file(s) as ${result.teamIdentifier}: ${result.files.map((file) => `${file.path} (${file.identifier})`).join(", ")}`);
+  } catch (error) {
+    console.error(`right-release sign-dev-artifact: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) main();

package/stage-binary.mjs

@@ -0,0 +1,60 @@
+import { statSync } from "node:fs";
+import path from "node:path";
+import { replaceFileInPlace } from "./in-place-install.mjs";
+import { resolveTargetRoot } from "./cargo-target.mjs";
+
+/**
+ * A stable staged path for a development or QA binary.
+ *
+ * The build broker writes Cargo output to per-generation folders (`<managed>/rightkit-build-control/ws/<hash>/g/<gen>/...`)
+ * and `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. Those are build output only: their path is not
+ * stable, so NOTHING may run from them. macOS ties privacy grants to the path an app runs from, so a dev or QA binary is
+ * copied in place to `<root>/.rightkit-dev-bin/<triple-or-host>/<name>` (keeping `<name>.previous`) and run from there.
+ */
+export const DEV_STAGE_DIRECTORY = ".rightkit-dev-bin";
+
+export function stagedBinaryPath({ root, name, triple = null }) {
+  if (typeof name !== "string" || !name || name !== path.basename(name) || name === "." || name === "..") throw new Error("staged binary name must be a bare file name");
+  if (triple !== null && !/^[A-Za-z0-9_.-]+$/.test(triple)) throw new Error("staged binary triple is not a safe path segment");
+  return path.join(path.resolve(root), DEV_STAGE_DIRECTORY, triple ?? "host", name);
+}
+
+/** Copy `source` to its stable staged path in place and return that path. Never launches or keeps anything per build. */
+export function stageDevelopmentBinary({ root, source, name = path.basename(source), triple = null }) {
+  const from = path.resolve(root, source);
+  if (!statSync(from).isFile()) throw new Error(`staged binary source is not a file: ${from}`);
+  const destination = stagedBinaryPath({ root, name, triple });
+  replaceFileInPlace(from, destination);
+  return destination;
+}
+
+// The dev and test profiles are written to debug and bench to release (same mapping as development.mjs).
+const profileDirectory = (profile) => (profile === "dev" || profile === "test" ? "debug" : profile === "bench" ? "release" : profile);
+
+/** `{ source }` or `{ manifestPath, bin, targetTriple?, profile? }` (resolved through Cargo's own target directory, broker or not). */
+export function resolveStageSource(entry, { root, resolveTarget = resolveTargetRoot, platform = process.platform } = {}) {
+  if (entry.source) return path.resolve(root, entry.source);
+  if (!entry.manifestPath || !entry.bin) throw new Error("development stage entry needs source, or manifestPath and bin");
+  const target = resolveTarget(path.resolve(root, entry.manifestPath));
+  const file = platform === "win32" ? `${entry.bin}.exe` : entry.bin;
+  return path.join(target, ...(entry.targetTriple ? [entry.targetTriple] : []), profileDirectory(entry.profile ?? "dev"), file);
+}
+
+export function validateStageEntries(entries, label) {
+  if (entries === undefined) return [];
+  if (!Array.isArray(entries)) throw new Error(`${label} must be an array`);
+  for (const [index, entry] of entries.entries()) {
+    if (!entry || typeof entry !== "object" || (!entry.source && !(entry.manifestPath && entry.bin))) throw new Error(`${label}[${index}] needs source, or manifestPath and bin`);
+    if (entry.name !== undefined) stagedBinaryPath({ root: ".", name: entry.name });
+    if (entry.targetTriple !== undefined) stagedBinaryPath({ root: ".", name: "x", triple: entry.targetTriple });
+  }
+  return entries;
+}
+
+export function stageDevelopmentBinaries(entries, { root, platform = process.platform, resolveTarget } = {}) {
+  return entries.map((entry) => {
+    const source = resolveStageSource(entry, { root, platform, resolveTarget });
+    const name = entry.name ?? path.basename(source);
+    return stageDevelopmentBinary({ root, source, name, triple: entry.targetTriple ?? null });
+  });
+}

package/swap-helper-bundle.mjs

@@ -0,0 +1,105 @@
+// The Developer-ID-signed `bin/darwin/rightkit-swap` that @rightkit/release ships (Orthic-Labs/rightkit#258).
+// rightkit-swap is the bin target of crates/rightkit-fs (renamex_np RENAME_SWAP). CI has no Apple signing secrets, so
+// @rightkit/release is published through `right-release publish npm --local` on the Mac, which calls
+// `prepareSwapHelper` before packing. install-app calls `assertShippedSwapHelperSigned` before it trusts the helper.
+import crypto from "node:crypto";
+import nodeFs from "node:fs";
+import path from "node:path";
+import { execFileSync as nodeExecFileSync, spawnSync as nodeSpawnSync } from "./background-process.mjs";
+import { signMacosEntries } from "./mac-sign-core.mjs";
+import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+
+export const SWAP_HELPER_PACKAGE = "@rightkit/release";
+export const SWAP_HELPER_BIN = ["bin", "darwin", "rightkit-swap"];
+export const SWAP_HELPER_RECEIPT = ["bin", "darwin", "rightkit-swap.sign.json"];
+// rightkit-swap is gated on the crate feature "fs" (crates/rightkit-fs/Cargo.toml [[bin]] required-features).
+export const SWAP_HELPER_CARGO_ARGS = ["build", "--release", "-p", "rightkit-fs", "--features", "fs", "--bin", "rightkit-swap"];
+
+/** Typed error. Codes: SWAP_HELPER_BUILD_FAILED, SWAP_HELPER_SIGN_FAILED, SWAP_HELPER_MISSING, SWAP_HELPER_UNSIGNED. */
+export class SwapHelperError extends Error {
+  constructor(code, message) { super(message); this.name = "SwapHelperError"; this.code = code; }
+}
+
+const helperPath = (packageDir) => path.join(packageDir, ...SWAP_HELPER_BIN);
+const receiptPath = (packageDir) => path.join(packageDir, ...SWAP_HELPER_RECEIPT);
+const sha256 = (fs, file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+const tail = (text, lines = 30) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
+
+/** True when `codesign --verify --strict` accepts the file. Only meaningful on macOS. */
+export function isSwapHelperSigned(file, { execFileSync = nodeExecFileSync } = {}) {
+  try { execFileSync("codesign", ["--verify", "--strict", file], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); return true; }
+  catch { return false; }
+}
+
+/**
+ * Local-pack step. darwin: build through the managed cargo wrapper (`run("cargo", ...)` is `rightkit cargo` in
+ * local-publish), copy to <packageDir>/bin/darwin/rightkit-swap, Developer ID sign with the shared identity
+ * resolver and `macCodesignArgs` (--options runtime --timestamp), verify strictly, write a sha256 receipt.
+ * Anywhere else: refuse unless the helper is present and its receipt matches its bytes. Fails closed with SwapHelperError.
+ */
+export function prepareSwapHelper({
+  workspaceRoot, packageDir = path.join(workspaceRoot, "packages", "release"), platform = process.platform, run, env = process.env, fs = nodeFs,
+  resolveIdentity = resolveMacosDeveloperIdIdentity,
+  signOne = (codesignArgs) => runMacCodesignCommands([codesignArgs])[0],
+  // codesign --verify / -dvv write to stderr: return both streams (as sign-dev-artifact defaultInspect does).
+  inspect = (cmd, args) => {
+    const result = nodeSpawnSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+    if (result.error || result.status !== 0) throw new Error(`${cmd} ${args.join(" ")} failed: ${output.trim() || result.error?.message}`);
+    return output;
+  },
+  log = () => {},
+}) {
+  const dest = helperPath(packageDir);
+  if (platform !== "darwin") {
+    let receipt = null;
+    try { receipt = JSON.parse(fs.readFileSync(receiptPath(packageDir), "utf8")); } catch { /* refused below */ }
+    if (!fs.existsSync(dest) || receipt?.schema !== 1 || receipt.sha256 !== sha256(fs, dest)) {
+      throw new SwapHelperError("SWAP_HELPER_MISSING", `${SWAP_HELPER_PACKAGE} must ship a signed ${SWAP_HELPER_BIN.join("/")}; it is absent or unsigned here (${platform}). Run \`right-release publish npm --package ${SWAP_HELPER_PACKAGE} --local\` on the Mac, where the Developer ID identity lives.`);
+    }
+    return { file: dest, signed: true, built: false, identity: receipt.identity ?? null };
+  }
+  const fail = (code, message) => { throw new SwapHelperError(code, message); };
+  const built = run("cargo", SWAP_HELPER_CARGO_ARGS, { cwd: workspaceRoot, env });
+  if (built.error || built.status !== 0) fail("SWAP_HELPER_BUILD_FAILED", `rightkit cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} failed (${built.error?.message ?? `exit ${built.status}`})\n${tail(`${built.stdout ?? ""}\n${built.stderr ?? ""}`)}`);
+  const meta = run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
+  let targetDir;
+  try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
+  if (meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) fail("SWAP_HELPER_BUILD_FAILED", "cannot read the Cargo target directory to find rightkit-swap");
+  // The RustRight broker builds with an explicit --target triple (target/<triple>/release); plain cargo uses target/release.
+  const triple = `${process.arch === "arm64" ? "aarch64" : "x86_64"}-apple-darwin`;
+  const candidates = [path.join(targetDir, triple, "release", "rightkit-swap"), path.join(targetDir, "release", "rightkit-swap")];
+  const built_ = candidates.find((file) => fs.existsSync(file));
+  if (!built_) fail("SWAP_HELPER_BUILD_FAILED", `the build did not produce rightkit-swap (looked in ${candidates.join(", ")})`);
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.rmSync(dest, { force: true });
+  fs.copyFileSync(built_, dest);
+  fs.chmodSync(dest, 0o755);
+  let identity; let records;
+  try {
+    identity = resolveIdentity({ env });
+    // Same Developer ID Application identity, same argv (--force --options runtime --timestamp --sign) and the same strict verify as sign-macos.
+    records = signMacosEntries([{ file: dest, options: [], hardenedRuntime: true }], { identity, signOne, inspect });
+  } catch (error) {
+    fs.rmSync(dest, { force: true });
+    fail("SWAP_HELPER_SIGN_FAILED", `cannot Developer-ID sign ${SWAP_HELPER_BIN.join("/")}: ${error.message}`);
+  }
+  fs.writeFileSync(receiptPath(packageDir), `${JSON.stringify({ schema: 1, sha256: sha256(fs, dest), identity, codesign: records[0]?.codesign ?? "strict-valid" }, null, 2)}\n`);
+  log(`[right-release] signed ${SWAP_HELPER_BIN.join("/")} with ${identity}`);
+  return { file: dest, signed: true, built: true, identity };
+}
+
+/**
+ * Runtime guard (install-app, macOS). A shipped helper that exists must be signed; an unsigned one is a typed error.
+ * A helper that is absent is NOT an error here: install-app keeps its documented journaled two-rename fallback and
+ * emits `swap-fallback` / `replaced {swap}` so the mode that ran is always logged.
+ * @returns {{ present: boolean, file: string|null }}
+ */
+export function assertShippedSwapHelperSigned({ file, fs = nodeFs, execFileSync = nodeExecFileSync } = {}) {
+  if (!file || !fs.existsSync(file)) return { present: false, file: file ?? null };
+  if (!isSwapHelperSigned(file, { execFileSync })) {
+    throw new SwapHelperError("SWAP_HELPER_UNSIGNED", `${file} is not validly code-signed, so the atomic swap helper cannot be trusted. Reinstall @rightkit/release from a build published with \`right-release publish npm --package ${SWAP_HELPER_PACKAGE} --local\` on the Mac (Developer ID signed), or set RIGHTKIT_SWAP to a signed helper.`);
+  }
+  return { present: true, file };
+}

package/templates/cargo-profiles.toml

@@ -0,0 +1,28 @@
+# RightKit standard Cargo profiles for every app workspace (Adrian, 2026-10-16; Astra-reviewed option C).
+# One development profile: Cargo's built-in `dev`, used by build, test, check, clippy and `right-release dev`.
+# `release-iterate` is retired. Panic behaviour is the same in every app: unwind.
+# Copy these tables verbatim into the app's workspace-root Cargo.toml; the RightKit ownership scanner
+# flags any deviation. Keep the app's existing [profile.release] optimization keys, but set panic = "unwind".
+
+[profile.dev]
+opt-level = 1
+debug = "line-tables-only"
+strip = "none"
+debug-assertions = true
+overflow-checks = true
+lto = "off"
+panic = "unwind"
+incremental = true
+codegen-units = 256
+rpath = false
+
+# Dependencies: non-incremental so sccache can cache them across apps.
+[profile.dev.package."*"]
+incremental = false
+codegen-units = 16
+
+# No test-profile overrides: test inherits dev.
+# The retired release-iterate profile must not appear: delete it and its package overrides.
+
+[profile.release]
+panic = "unwind"

package/upload-release.mjs

@@ -14,6 +14,7 @@ let tier = "";
 let repo = "";
 let configName = "right-release.config.mjs";
 let dryRun = false;
+let apply = false;
 
 for (let index = 0; index < args.length; index += 1) {
   const arg = args[index];
@@ -24,10 +25,19 @@ for (let index = 0; index < args.length; index += 1) {
   else if (arg === "--repo") repo = args[++index];
   else if (arg === "--config") configName = args[++index];
   else if (arg === "--dry-run") dryRun = true;
+  else if (arg === "--apply") apply = true;
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
 }
 
+// Android: the Google Play internal track, with its own gate and a dry run by default (android-play-upload.mjs). No tier: the
+// internal track has no patch/update feed.
+if (platform === "android") {
+  const { main } = await import("./android-play-upload.mjs");
+  process.exit(await main({ releaseId, configName, apply, dryRun }));
+}
+if (apply) fail("--apply is Android only; win and mac preview with --dry-run");
+
 // Tier, primary checkout, clean tree, sealed commit, ownership evidence, provider and repository are checked by
 // the gate that `right-release github --release` also uses; nothing below runs until it passes.
 let authority;
@@ -72,7 +82,7 @@ function writeJson(file, value) {
 }
 
 function usage(code) {
-  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update [--config right-release.config.mjs] [--repo owner/repo] [--dry-run]");
+  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update [--config right-release.config.mjs] [--repo owner/repo] [--dry-run]\n       right-release upload --platform android --release <sealed-id> [--config right-release.config.mjs] [--apply]   (Play internal track; dry run unless --apply)");
   process.exit(code);
 }