@rightkit/release 0.2.165 → 0.2.173

package/ownership.mjs

@@ -1,8 +1,7 @@
 // RightKit ownership scan. Public exports retain the original findings-array API.
 import { isBlockingFinding } from "./ownership-verdict.mjs";
 import { spawnSync } from "./background-process.mjs";
-import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, policyEntryDigest, resolveKeyLogTrust, sha256, verifyException, verifyProtectedProvenance } from "./ownership-approval.mjs";
-import installedManifest from "./rightkit-ownership.json" with { type: "json" };
+import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, resolveKeyLogTrust, sha256, verifyProtectedProvenance } from "./ownership-approval.mjs";
 import { parse as parseToml } from "smol-toml";
 import { sourceNonCode } from "./ownership-source.mjs";
 import { OWNERSHIP_LOCKFILES, transitiveDependencies } from "./ownership-lockfiles.mjs";
@@ -40,12 +39,20 @@ function sourceMatchers(manifest) {
     const flags = [...new Set(`m${sources.map(({ re }) => re.flags.replace(/[gy]/g, "")).join("")}`)].join("");
     prefilter = new RegExp(sources.map(({ f }) => `(?:${f.pattern})`).join("|") || "(?!)", flags);
   } catch { prefilter = /[\s\S]/; }
-  const matchers = { digest, sources, prefilter };
+  // `excludePaths` (exact files or directory prefixes) keeps a source rule off the paths that
+  // hold its own positive samples, such as the scanner's fixtures.
+  const excluded = new Map(sources.filter(({ f }) => f.excludePaths?.length).map(({ f }) => [f.id, f.excludePaths]));
+  const matchers = { digest, sources, prefilter, excluded };
   catalogCache.set(digest, matchers);
   if (catalogCache.size > 8) catalogCache.delete(catalogCache.keys().next().value);
   return matchers;
 }
 
+function sourceExcluded(matchers, id, rel) {
+  const paths = matchers.excluded?.get(id);
+  return Boolean(paths?.some((p) => rel === p || rel.startsWith(p.endsWith("/") ? p : `${p}/`)));
+}
+
 function sourceFindings(file, matchers) {
   const ext = path.posix.extname(file.rel).toLowerCase();
   const key = `${matchers.digest}:${ext}:${file.cacheKey ?? inputDigest(file)}`;
@@ -194,7 +201,7 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   const inventory = gitListedInventory(appRoot, {
     repositoryRoot,
     protectedPaths: [...protectedPaths],
-    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
+    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
     maxFileBytes: (rel) => CODE_EXT.has(path.posix.extname(rel).toLowerCase()) || protectedPaths.has(rel) ? 2 * 1024 * 1024 : 64 * 1024 * 1024,
   });
   for (const item of inventory.coverage) if (item.reason === "file-over-size-limit") item.reason = protectedPaths.has(item.path) ? "protected-provenance-file-over-2MiB" : CODE_EXT.has(path.posix.extname(item.path).toLowerCase()) ? "source-file-over-2MiB" : "manifest-file-over-64MiB";
@@ -214,7 +221,7 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
     if (entry.mode === "160000" || entry.type === "commit") { coverage.push({ path: rel, status: "unscanned", reason: "committed-gitlink" }); continue; }
     if (entry.type !== "blob") { coverage.push({ path: rel, status: "unscanned", reason: "committed-unsupported-entry" }); continue; }
-    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
+    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
     const bytes = relevant ? entry.bytes : undefined;
     if (relevant && !bytes) coverage.push({ path: rel, status: "unscanned", reason: "committed-blob-unavailable" });
     const isExceptionFile = path.posix.basename(rel) === "ownership-exceptions.json";
@@ -579,7 +586,7 @@ function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), t
     }
     if (size > 2 * 1024 * 1024) { coverage.push({ path: rel, status: "unscanned", reason: "source-file-over-2MiB" }); continue; }
     contentDigests.push({ path: rel, digest: inputDigest(file) });
-    for (const finding of sourceFindings(file, matchers)) findings.push({ ...finding, file: rel });
+    for (const finding of sourceFindings(file, matchers)) if (!sourceExcluded(matchers, finding.fingerprint, rel)) findings.push({ ...finding, file: rel });
   }
   if (pathPrefix) {
     const prefix = (p) => p === "." ? pathPrefix.slice(0, -1) : `${pathPrefix}${p}`;
@@ -675,31 +682,42 @@ function enrollmentPending(trust, state) {
 function findingPolicy(c, f) {
   return { tier: f.tier ?? c.tier ?? "block", ...(f.policy ? { policy: f.policy } : {}) };
 }
+/**
+ * Plain exception entries (Orthic-Labs/rightkit#262), reviewed through git, no signatures:
+ * { capability, package (alias: crate), reason, owner, date }, optional narrowing { fingerprint, path }.
+ * An entry marks every finding of that capability/package (and fingerprint/path when given) `excepted`;
+ * an entry that matches no finding is reported as a stale warning; a malformed or legacy signed entry is a problem.
+ */
+export function validateExceptionEntry(entry) {
+  const problems = [];
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return ["not an object"];
+  if (entry.payload || entry.signature !== undefined || entry.schema !== undefined) return ["legacy signed exception record; replace it with a plain entry {capability, package, reason, owner, date}"];
+  for (const key of ["capability", "reason", "owner"]) if (typeof entry[key] !== "string" || !entry[key].trim()) problems.push(`missing ${key}`);
+  const owner = entry.package ?? entry.crate;
+  if (typeof owner !== "string" || !owner.trim()) problems.push("missing package (crate or package)");
+  if (typeof entry.date !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry.date) || Number.isNaN(Date.parse(`${entry.date}T00:00:00Z`))) problems.push("date must be YYYY-MM-DD");
+  for (const key of ["fingerprint", "path"]) if (entry[key] !== undefined && (typeof entry[key] !== "string" || !entry[key])) problems.push(`${key} must be a non-empty string when present`);
+  return problems;
+}
+export function exceptionMatches(entry, finding) {
+  const owner = entry.package ?? entry.crate;
+  if (finding.capability !== entry.capability || finding.package !== owner) return false;
+  if (entry.fingerprint !== undefined && finding.fingerprint !== entry.fingerprint) return false;
+  if (entry.path !== undefined && !(finding.file === entry.path || finding.file?.startsWith(`${entry.path.replace(/\/$/, "")}/`))) return false;
+  return true;
+}
 export function evaluate(findings, exceptions, options = {}) {
-  const today = options.today ?? new Date().toISOString().slice(0, 10), problems = [], covered = [], violations = [], warnings = [];
-  const metadata = options.metadata ?? findings.metadata ?? {};
-  const catalogDigest = metadata.catalogDigest ?? options.catalogDigest ?? "";
-  const identity = options.repositoryIdentity ?? metadata.repositoryIdentity ?? "";
+  const problems = [], covered = [], violations = [], warnings = [];
   for (const e of exceptions) {
-    const p = e?.payload ?? e ?? {};
-    const where = `exception #${e?.index} (${p.fingerprint ?? "?"})`;
-    const missing = ["fingerprint", "occurrences", "policyDigest", "minimumScannerVersion", "minimumCatalogVersion", "issued", "reason", "owner", "expires", "requestId"].filter((k) => !p[k] || (Array.isArray(p[k]) && !p[k].length));
-    if (missing.length) { problems.push(`${where}: missing ${missing.join(", ")}`); continue; }
-    const approvedBy = e.approvedBy ?? p.approvedBy;
-    if (approvedBy !== undefined && approvedBy !== "Adrian") { problems.push(`${where}: approvedBy must be Adrian`); continue; }
-    if (!/^\d{4}-\d{2}-\d{2}$/.test(p.expires) || Number.isNaN(Date.parse(`${p.expires}T00:00:00Z`)) || p.expires < today) { problems.push(`${where}: invalid or expired expires date`); continue; }
-    if (!p.trackingRef || typeof p.trackingRef !== "object" || !p.trackingRef.verified || !/^https:\/\//.test(p.trackingRef.url ?? "") || !p.trackingRef.id) { problems.push(`${where}: tracking must be a verified RightKit request reference`); continue; }
-    let policyDigest;
-    try { policyDigest = policyEntryDigest(options.manifest ?? installedManifest, p.fingerprint); } catch (error) { problems.push(`${where}: ${error.message}`); continue; }
-    const { index, ...record } = e;
-    const verification = verifyException(record, { repositoryIdentity: identity, catalogDigest, policyDigest, findings, trust: options.trust, today, scannerVersion: options.scannerVersion ?? metadata.scannerVersion ?? SCANNER_VERSION, catalogVersion: options.catalogVersion ?? metadata.catalogVersion });
-    if (!verification?.ok) { problems.push(`${where}: signature verification failed${verification?.problems?.length ? ` (${verification.problems.join("; ")})` : ""}`); continue; }
-    const matching = findings.filter((f) => f.fingerprint === p.fingerprint && p.occurrences.some((item) => item.path === f.file && item.hash === occurrenceHash(f)));
-    if (!matching.length) { problems.push(`${where}: stale, matches no signed occurrence`); continue; }
-    for (const f of matching) covered.push({ ...f, occurrenceHash: occurrenceHash(f), exception: e });
+    const where = `exception #${e?.index} (${e?.capability ?? "?"}/${e?.package ?? e?.crate ?? "?"})`;
+    const invalid = validateExceptionEntry(e);
+    if (invalid.length) { problems.push(`${where}: ${invalid.join("; ")}`); continue; }
+    const matching = findings.filter((f) => exceptionMatches(e, f));
+    if (!matching.length) { warnings.push(`${where}: stale, matches no current finding (remove it from the exceptions file)`); continue; }
+    for (const f of matching) if (!covered.some((x) => x.occurrenceHash === occurrenceHash(f))) covered.push({ ...f, occurrenceHash: occurrenceHash(f), exception: e });
   }
   const pending = enrollmentPending(options.trust, options.trustEnrollment);
-  if (pending) warnings.push("approval enrollment pending; detected findings remain open backlog requests until distinct Windows & macOS keys are enrolled");
+  if (pending) warnings.push("approval enrollment pending (warning only): exceptions are plain git-reviewed entries and no scan result depends on enrolled approval keys");
   for (const f of findings) if (!covered.some((x) => x.occurrenceHash === occurrenceHash(f))) violations.push({ ...f, occurrenceHash: occurrenceHash(f) });
   return { violations, covered, problems, warnings, enrollmentPending: pending };
 }
@@ -744,7 +762,7 @@ function checkAppInternal(appRoot, manifest, options, readAuthority) {
   const result = evaluate(scanned.findings, loadExceptions(appRoot), { ...options, manifest, trust, trustEnrollment: enrollment, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
-  return { ok: !result.enrollmentPending && !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
+  return { ok: !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
 }
 
 function checkCommitted(appRoot, manifest, options, acquire, readAuthority = readCommittedKeyAuthority) {
@@ -812,7 +830,7 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
-  return { ok: !result.enrollmentPending && !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
+  return { ok: !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
 }
 
 /** Protected production scan: acquire and inspect exact HEAD blobs without reading checkout contents. */

package/package-recipe-targets.mjs

@@ -0,0 +1,95 @@
+// Declarative package targets (bogusyogi/rightkit#345). `targets.win.winPackage` and `targets.mac.macPackage` replace
+// the per-app NSIS / DMG hook scripts. They expand to the SAME hook shape release.mjs already runs (prePackage,
+// package, sign, notarize, dmg), so every existing gate still applies unchanged: QA-control scans, the bundle
+// marker patch before signing, raw-EXE and installer Authenticode, the NSIS embedding verification, Developer ID
+// signing of the .app and its nested code, app notarization before packing, the signed DMG and its notarization.
+// The standalone recipes (win-package-recipe.mjs, mac-package-recipe.mjs) hold the same steps for direct callers.
+import path from "node:path";
+import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
+
+export class PackageRecipeTargetError extends Error {
+  constructor(message) { super(message); this.name = "PackageRecipeTargetError"; this.code = "RK_PACKAGE_RECIPE_TARGET"; }
+}
+
+const fail = (message) => { throw new PackageRecipeTargetError(message); };
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const rel = (appRoot, file) => path.relative(appRoot, file).split(path.sep).join("/");
+// Tauri never signs or creates updater artifacts here: release.mjs signs, and sign-updater signs the signed bytes.
+const withoutRecipe = (target) => {
+  if (!isObject(target) || !("recipe" in target)) return target;
+  const { recipe: _ignored, ...rest } = target;
+  return rest;
+};
+const QUIET_TAURI_ENV = { TAURI_SIGNING_PRIVATE_KEY: "", TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" };
+
+/** `targets.win.winPackage` → prePackage (`tauri build --no-bundle`) and package (`tauri bundle --bundles nsis`). */
+export function expandWinPackageTarget(target, { appRoot, config = {} }) {
+  if (!target?.winPackage) return withoutRecipe(target);
+  if (target.prePackage !== undefined) fail("targets.win.winPackage replaces prePackage; remove the prePackage script");
+  if (target.winPackage.sidecars !== undefined) fail("targets.win.winPackage.sidecars is not supported in a right-release target: declare sidecars through externalBin or mediaSidecar, which release.mjs signs with the raw EXE");
+  let plan;
+  try { plan = validateWinPackage({ appRoot, config, target }); } catch (error) {
+    if (error instanceof WinPackageConfigError) fail(`targets.win.winPackage: ${(error.issues ?? [error.message]).join("; ")}`);
+    throw error;
+  }
+  if (target.signingContract !== undefined && target.signingContract !== "windows-raw-exe-authenticode-before-nsis-v1") fail(`targets.win.winPackage builds an NSIS installer; signingContract must be windows-raw-exe-authenticode-before-nsis-v1, got ${target.signingContract}`);
+  const cwd = rel(plan.appRoot, plan.tauriCwd) || ".";
+  const override = { bundle: { createUpdaterArtifacts: false, windows: { nsis: { installMode: plan.perMachine ? "perMachine" : "currentUser" } } } };
+  // `recipe` is set only here: a hand-written one is dropped so it can never select a recipe path.
+  const { winPackage, recipe: _ignoredWin, ...rest } = target;
+  return {
+    ...rest,
+    signingContract: "windows-raw-exe-authenticode-before-nsis-v1",
+    prePackage: { cmd: "pnpm", args: ["exec", "tauri", "build", "--no-bundle", "--target", plan.triple], cwd, env: QUIET_TAURI_ENV },
+    package: { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", plan.triple, "--config", JSON.stringify(override)], cwd, env: QUIET_TAURI_ENV },
+    sign: { ...(target.sign ?? {}), prePackageFiles: [rel(plan.appRoot, plan.rawExe)], files: [rel(plan.appRoot, plan.installerFile)] },
+    recipe: { kind: "winPackage", productName: plan.productName, updater: plan.updater },
+  };
+}
+
+const MAC_KEYS = new Set(["universal", "tauriCwd", "features"]);
+
+/**
+ * `targets.mac.macPackage` → prePackage (`tauri build --bundles app`, universal by default), the .app as the
+ * Developer ID signing set, app notarization before packing, and right-release's own signed DMG from the stapled app.
+ * The app path and DMG path are `notarize.app` and `notarize.file`; DMG branding is `targets.mac.dmg`.
+ */
+export function expandMacPackageTarget(target, { appRoot }) {
+  if (!target?.macPackage) return withoutRecipe(target);
+  const spec = target.macPackage;
+  if (!isObject(spec)) fail("targets.mac.macPackage must be an object");
+  const unknown = Object.keys(spec).filter((key) => !MAC_KEYS.has(key));
+  if (unknown.length) fail(`targets.mac.macPackage has unknown key(s): ${unknown.join(", ")} (allowed: ${[...MAC_KEYS].join(", ")})`);
+  if (target.prePackage !== undefined || target.package !== undefined) fail("targets.mac.macPackage replaces prePackage and package; remove both scripts");
+  if (typeof target.notarize?.app !== "string" || !target.notarize.app.endsWith(".app")) fail("targets.mac.macPackage needs notarize.app: the built .app path");
+  if (typeof target.notarize?.file !== "string" || !target.notarize.file.endsWith(".dmg")) fail("targets.mac.macPackage needs notarize.file: the .dmg path right-release builds");
+  if (target.dmg === false) fail("targets.mac.macPackage always builds a DMG; remove dmg: false");
+  if (spec.universal !== undefined && typeof spec.universal !== "boolean") fail("targets.mac.macPackage.universal must be a boolean");
+  if (spec.features !== undefined && (!Array.isArray(spec.features) || spec.features.some((f) => typeof f !== "string" || !/^[A-Za-z0-9_,:-]+$/.test(f)))) fail("targets.mac.macPackage.features must be Cargo feature names");
+  const cwd = spec.tauriCwd ?? ".";
+  if (typeof cwd !== "string" || path.isAbsolute(cwd) || cwd.split(/[\\/]/).includes("..")) fail("targets.mac.macPackage.tauriCwd must be a relative path inside the app");
+  // Tauri's universal-apple-darwin target builds both slices and lipos them itself.
+  const triple = spec.universal === false ? (process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin") : "universal-apple-darwin";
+  const override = { bundle: { createUpdaterArtifacts: false, macOS: { signingIdentity: null } } };
+  const args = ["exec", "tauri", "build", "--target", triple, "--bundles", "app", "--no-sign", "--config", JSON.stringify(override)];
+  if (spec.features?.length) args.push("--features", spec.features.join(","));
+  const prePackageFiles = target.sign?.prePackageFiles ?? [target.notarize.app];
+  if (!prePackageFiles.some((entry) => (typeof entry === "string" ? entry : entry?.file) === target.notarize.app)) fail("targets.mac.macPackage: sign.prePackageFiles must include notarize.app");
+  const { macPackage, recipe: _ignoredMac, ...rest } = target;
+  return {
+    ...rest,
+    prePackage: { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
+    sign: { ...(target.sign ?? {}), prePackageFiles },
+    notarize: { ...target.notarize, appBeforePackage: true },
+    dmg: isObject(target.dmg) ? target.dmg : {},
+    recipe: { kind: "macPackage", universal: triple === "universal-apple-darwin" },
+  };
+}
+
+/** Expand whichever declarative package key the target carries. */
+export function expandPackageRecipeTarget(target, { platform, appRoot, config }) {
+  if (platform === "win") return expandWinPackageTarget(target, { appRoot, config });
+  if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config });
+  if (target?.winPackage || target?.macPackage) fail(`winPackage / macPackage are not valid on ${platform}`);
+  return target;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.165",
+  "version": "0.2.173",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -18,10 +18,13 @@
   },
   "files": [
     "cli",
+    "bin",
+    "templates",
     "*.mjs",
     "*.json",
     "*.sh",
     "msix-repair-guard.ps1",
+    "bin/darwin/rightkit-swap",
     "*.py",
     "LICENSE-MIT",
     "LICENSE-APACHE",
@@ -35,14 +38,14 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Orthic-Labs/rightkit.git",
+    "url": "git+https://github.com/bogusyogi/rightkit.git",
     "directory": "packages/release"
   },
   "dependencies": {
-    "smol-toml": "1.9.0"
+    "smol-toml": "1.9.1"
   },
   "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test": "node --import ./test-support/broker-guard.mjs --test --test-concurrency=1 --test-force-exit *.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "test:signer:windows": "node sign-release-manifest.integration.mjs",
     "doctor:all": "node --test right-suite-contract.test.mjs",

package/portable-development.mjs

@@ -1,16 +1,19 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { spawnSync } from "./background-process.mjs";
+import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
 
 const CHUNK_BYTES = 1024 * 1024;
 
-/** Install an unsigned development payload through an owned, versioned `current` pointer. */
+/**
+ * Install an unsigned development payload in place at the fixed path `<installRoot>/current` (a real directory).
+ * No versions/ folder, no digest folder, no symlink or junction. The previous copy is kept once, as
+ * `<installRoot>/current.previous` (rename it back to roll back); nothing ever runs from it. A legacy `current`
+ * symlink or junction from the old layout is moved aside to `.previous` the same way.
+ */
 export function installPortableDevelopment(descriptor, { root, platform = process.platform, env = process.env } = {}) {
-  const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}\n`);
-  let backup = null;
-  let switched = false;
-  let versionRoot;
+  const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}
+`);
   let digest;
   let current;
   try {
@@ -27,110 +30,40 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     const sourceEntrypoint = resolveContained(source, descriptor.entrypoint, "entrypoint");
     const sourceEntrypointInfo = fs.lstatSync(sourceEntrypoint);
     if (!sourceEntrypointInfo.isFile() || sourceEntrypointInfo.isSymbolicLink()) throw new Error("development entrypoint must be a regular file inside sourceDirectory");
-    const sourceDigest = digestTree(source);
-    digest = sourceDigest;
-    versionRoot = path.join(installRoot, "versions", `dev-${digest}`);
+    digest = digestTree(source);
     current = path.join(installRoot, "current");
-    emit("STAGE", { sourceDirectory: source, versionRoot, digest });
-
-    fs.mkdirSync(path.dirname(versionRoot), { recursive: true });
-    if (exists(versionRoot)) {
-      if (digestTree(versionRoot) !== digest) throw new Error(`development version digest collision: ${versionRoot}`);
-    } else {
-      const staging = path.join(path.dirname(versionRoot), `.stage-${process.pid}-${randomSuffix()}`);
-      try {
-        copyTree(source, staging);
-        if (digestTree(staging) !== digest) throw new Error("staged development payload did not match source digest");
-        fs.renameSync(staging, versionRoot);
-      } catch (error) {
-        removeIfExists(staging);
-        throw error;
-      }
-    }
+    const staging = stagingPathOf(current);
+    const previous = previousPathOf(current);
+    emit("STAGE", { sourceDirectory: source, current, staging, digest });
+    if (exists(current) && !fs.lstatSync(current).isDirectory() && !fs.lstatSync(current).isSymbolicLink()) throw new Error(`development current is not a directory; refusing to replace: ${current}`);
 
-    validateCurrent(current, installRoot, platform);
-    if (exists(current)) {
-      backup = path.join(installRoot, `.current-backup-${process.pid}-${randomSuffix()}`);
-      fs.renameSync(current, backup);
-    }
+    fs.mkdirSync(installRoot, { recursive: true });
+    removeIfExists(staging);
     try {
-      fs.symlinkSync(versionRoot, current, platform === "win32" ? "junction" : "dir");
-      switched = true;
-      emit("ACTIVATE", { current, versionRoot });
-      const activeRoot = fs.realpathSync(current);
-      if (!samePath(activeRoot, fs.realpathSync(versionRoot), platform)) throw new Error("development current pointer did not resolve to staged version");
-      const entrypoint = resolveContained(versionRoot, descriptor.entrypoint, "entrypoint");
-      const entryDigest = hashFile(entrypoint);
-      if (entryDigest !== hashFile(path.join(source, descriptor.entrypoint))) throw new Error("development entrypoint readback did not match source");
-      if (backup) removeIfExists(backup);
-      emit("PRUNE", pruneDevelopmentVersions(installRoot, versionRoot, { platform }));
-      emit("SUCCEEDED", { installRoot, current, versionRoot, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
-      return { installRoot, current, versionRoot, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
+      copyTree(source, staging);
+      if (digestTree(staging) !== digest) throw new Error("staged development payload did not match source digest");
     } catch (error) {
-      if (switched) removeIfExists(current);
-      if (backup && exists(backup)) fs.renameSync(backup, current);
+      removeIfExists(staging);
       throw error;
     }
+    const sourceEntryDigest = hashFile(sourceEntrypoint);
+    let entryDigest;
+    swapInPlace({
+      staging, destination: current, previous,
+      verify: (destination) => {
+        entryDigest = hashFile(resolveContained(destination, descriptor.entrypoint, "entrypoint"));
+        if (entryDigest !== sourceEntryDigest) throw new Error("development entrypoint readback did not match source");
+      },
+    });
+    emit("ACTIVATE", { current, previous });
+    emit("SUCCEEDED", { installRoot, current, previous, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
+    return { installRoot, current, previous, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
   } catch (error) {
-    emit("FAILED", { installRoot: descriptor?.installRoot, versionRoot, digest, message: error?.message ?? String(error) });
+    emit("FAILED", { installRoot: descriptor?.installRoot, current, digest, message: error?.message ?? String(error) });
     throw error;
   }
 }
 
-/**
- * Development installs keep only the active version: dev builds are rebuilt from source, so there is
- * no rollback copy. A version a running process still uses is skipped and removed by the next
- * install. Never throws: a prune problem must not fail an install that already activated.
- */
-export function pruneDevelopmentVersions(installRoot, keepRoot, { platform = process.platform, runningExecutables = null } = {}) {
-  const versionsRoot = path.join(installRoot, "versions");
-  const removed = []; const skipped = []; let reclaimedBytes = 0;
-  let running = null;
-  const inUse = (dir) => {
-    if (platform === "win32") return false; // Windows: a loaded image or DLL makes the rename below fail.
-    running ??= runningExecutables ?? listRunningExecutables();
-    return running.some((exe) => isWithin(dir, exe, platform));
-  };
-  const candidates = [];
-  for (const [dir, pattern] of [[versionsRoot, /^(dev-[0-9a-f]+|\.stage-.+|\.prune-.+)$/], [installRoot, /^\.(current-backup|prune)-.+$/]]) {
-    let names = [];
-    try { names = fs.readdirSync(dir); } catch { continue; }
-    for (const name of names) if (pattern.test(name)) candidates.push(path.join(dir, name));
-  }
-  for (const candidate of candidates) {
-    if (samePath(candidate, keepRoot, platform)) continue;
-    if (path.basename(candidate).includes(`-${process.pid}-`)) continue; // this process's own stage/backup
-    try {
-      if (inUse(candidate)) { skipped.push({ path: candidate, reason: "in-use" }); continue; }
-      const bytes = treeBytes(candidate);
-      // Rename first: on Windows this fails while any file inside is loaded, so a running version is skipped whole.
-      const doomed = path.basename(candidate).startsWith(".prune-") ? candidate : path.join(path.dirname(candidate), `.prune-${randomSuffix()}`);
-      if (doomed !== candidate) fs.renameSync(candidate, doomed);
-      fs.rmSync(doomed, { recursive: true, force: true });
-      removed.push(candidate); reclaimedBytes += bytes;
-    } catch (error) {
-      skipped.push({ path: candidate, reason: error?.code ?? error?.message ?? String(error) });
-    }
-  }
-  return { kept: keepRoot, removed: removed.length, skipped, reclaimedBytes };
-}
-
-function listRunningExecutables() {
-  const result = spawnSync("ps", ["-axo", "comm="], { encoding: "utf8" });
-  return result.status === 0 ? result.stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => path.isAbsolute(line)) : [];
-}
-
-function treeBytes(target) {
-  let total = 0;
-  const stat = fs.lstatSync(target);
-  if (!stat.isDirectory()) return stat.size;
-  for (const entry of fs.readdirSync(target, { withFileTypes: true })) {
-    const child = path.join(target, entry.name);
-    total += entry.isDirectory() && !entry.isSymbolicLink() ? treeBytes(child) : fs.lstatSync(child).size;
-  }
-  return total;
-}
-
 function validateDescriptor(descriptor, root, platform) {
   if (!descriptor || descriptor.kind !== "portable" || descriptor.activation?.kind !== "current") throw new Error("unsupported portable development descriptor");
   if (typeof root !== "string" || !path.isAbsolute(root)) throw new Error("repository root must be absolute");
@@ -214,24 +147,8 @@ function copyTree(source, target) {
   }
 }
 
-function validateCurrent(current, installRoot, platform) {
-  if (!exists(current)) return;
-  const stat = fs.lstatSync(current);
-  if (!stat.isSymbolicLink()) throw new Error(`development current pointer is not a symlink or junction; refusing to replace: ${current}`);
-  let target;
-  try { target = fs.realpathSync(current); } catch (error) { throw new Error(`development current pointer is dangling or unreadable: ${current}`, { cause: error }); }
-  const versionsRoot = path.join(installRoot, "versions");
-  const versionName = path.basename(target);
-  if (!isWithin(fs.realpathSync(installRoot), target, platform)
-    || !samePath(path.dirname(target), fs.realpathSync(versionsRoot), platform)
-    || !versionName || versionName === "." || versionName === "..") {
-    throw new Error(`development current pointer does not resolve to an owned version: ${current}`);
-  }
-}
-
 function removeIfExists(target) {
   if (!exists(target)) return;
   fs.rmSync(target, { recursive: true, force: true });
 }
 
-function randomSuffix() { return `${Date.now()}-${Math.random().toString(16).slice(2)}`; }

package/preflight.mjs

@@ -341,13 +341,11 @@ export function ownershipCheck(repoRoot, options = {}) {
   try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot); }
   catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
   const { result, evidence, floor } = checked;
-  if (checked.enrollmentPending) {
-    const diagnostics = [...(result.problems ?? []), ...(result.violations ?? []).map((entry) => `${entry.fingerprint} at ${entry.file}${entry.line ? `:${entry.line}` : ""}`)];
-    return { ...warn("ownership", `${checked.warning}${diagnostics.length ? `; ${diagnostics.length} diagnostic finding/problem(s) retained` : ""}`, null), evidence, diagnostics, result, floor };
-  }
   if (checked.ok) {
     const excepted = result.covered.length;
-    return { ...ok("ownership", excepted ? `no unapproved copies (${excepted} signed findings)` : "no copies of RightKit-owned capabilities"), evidence };
+    const detail = excepted ? `no unapproved copies (${excepted} excepted findings)` : "no copies of RightKit-owned capabilities";
+    // Pending approval enrollment is a warning only (#262); real findings still fail below.
+    return checked.enrollmentPending ? { ...warn("ownership", `${detail}; ${checked.warning}`, null), evidence, result, floor } : { ...ok("ownership", detail), evidence };
   }
   const first = result.violations[0];
   const detail = !floor.ok
@@ -355,7 +353,7 @@ export function ownershipCheck(repoRoot, options = {}) {
     : first
       ? `${result.violations.length} own cop${result.violations.length === 1 ? "y" : "ies"} of RightKit capabilities, e.g. ${first.fingerprint} at ${first.file}${first.line ? `:${first.line}` : ""}`
       : result.problems[0] ?? result.coverage[0]?.reason ?? "ownership scan incomplete";
-  return { ...fail("ownership", detail, "run: right-release ownership (move to RightKit, or request a signed, dated exception)"), evidence };
+  return { ...fail("ownership", detail, "run: right-release ownership (move to RightKit, or add a dated entry to the repo exceptions file)"), evidence };
 }
 
 export function formatPreflight(checks) {

package/project-type.mjs

@@ -40,4 +40,4 @@ export function targetUsesMsix(target) {
 }
 
 /** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
-export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));
+export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || Boolean(target?.winPackage || target?.macPackage) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/publication-artifacts.mjs

@@ -3,6 +3,7 @@ import { readFileSync, statSync, openSync, fstatSync, readSync, closeSync } from
 import path from "node:path";
 import { verifySealedRelease } from "./release-state.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
+import { validateMediaSidecarReceipt } from "./media-sidecar.mjs";
 
 export class PublicationError extends Error {
   constructor(code, message) { super(`[${code}] ${message}`); this.name = "PublicationError"; this.code = code; }
@@ -55,15 +56,25 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!ownership.ok || manifest.ownershipEvidence?.commit !== commit) throw new PublicationError("PUBLICATION_OWNERSHIP_INVALID", `sealed ownership evidence rejected: ${ownership.reason ?? "commit mismatch"}`);
   if (!manifest.checkpoints?.includes("signed") || !manifest.checkpoints?.includes("hardened")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "signed & hardened seal checkpoints are required");
   if (configPath && digestBytes(readFileSync(configPath)) !== manifest.signing?.configSha256) throw new PublicationError("PUBLICATION_POLICY_MISMATCH", "release config differs from sealed signing policy");
+  if (manifest.mediaSidecars !== undefined) {
+    try { validateMediaSidecarReceipt(manifest.mediaSidecars); }
+    catch (error) { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", error.message); }
+  }
   const receipts = manifest.signing?.receipts;
   if (!Array.isArray(receipts) || !receipts.length) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed signing receipts are required");
   let notarized = false;
   let signed = false;
+  let androidVerified = false;
   for (const receipt of receipts) {
     const artifact = readVerifiedArtifact(path.resolve(appRoot, receipt.file), receipt);
     let value;
     try { value = JSON.parse(artifact.bytes); } catch { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "invalid sealed signing receipt"); }
     if (value.schema !== 1) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "malformed sealed signing receipt");
+    if (value.contract !== undefined) {
+      verifyAndroidPublicationReceipt(value, manifest, platform);
+      androidVerified = true; signed = true;
+      continue;
+    }
     if (Array.isArray(value.files)) {
       if (!value.files.length || value.files.some((item) => !/^[a-f0-9]{64}$/.test(item.after?.sha256 ?? "") || item.timestampPresent !== true
         || (platform === "win" ? item.authenticode !== "Valid" || item.subject !== "CN=Damned Ventures LLC" : item.codesign !== "strict-valid" || item.identity !== value.identity))) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "sealed signature verification evidence rejected");
@@ -81,6 +92,7 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   }
   if (!signed) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed native signing evidence is required");
   if (platform === "mac" && !notarized) throw new PublicationError("PUBLICATION_NOTARIZATION_MISSING", "sealed notarization evidence is required");
+  if (platform === "android" && !androidVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed android AAB upload-key receipt is required");
   const artifacts = new Map();
   for (const entry of manifest.files ?? []) {
     if (typeof entry.name !== "string" || path.basename(entry.name) !== entry.name || artifacts.has(entry.name)) throw new PublicationError("PUBLICATION_SEAL_INVALID", "unsafe or duplicate sealed artifact name");
@@ -90,6 +102,28 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   return { ...sealed, artifacts };
 }
 
+// Android AAB receipt (android-release.mjs: contract "android-aab-upload-key-v1"). The receipt was already read from the
+// manifest's signing.receipts and hash-verified by the caller; here it must describe exactly the sealed "aab" file and be
+// signed by the pinned upload certificate. Fails closed with a specific message on any mismatch.
+const ANDROID_RECEIPT_CONTRACT = "android-aab-upload-key-v1";
+function verifyAndroidPublicationReceipt(value, manifest, platform) {
+  const invalid = (message) => { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", message); };
+  if (value.contract !== ANDROID_RECEIPT_CONTRACT) invalid(`unrecognized signing receipt contract: ${JSON.stringify(value.contract)}`);
+  if (platform !== "android" || manifest.platform !== "android") invalid("android AAB receipt in a non-android release");
+  const signer = value.signer?.certSha256;
+  if (!/^[a-f0-9]{64}$/.test(signer ?? "")) invalid("android AAB receipt has no signer certificate sha256");
+  if (value.signer.debugCertificate === true || /Android Debug/i.test(String(value.signer.subject ?? ""))) invalid("android AAB receipt is signed with the Android debug certificate");
+  const pinned = manifest.signing?.uploadCertSha256;
+  if (!/^[a-f0-9]{64}$/.test(pinned ?? "")) invalid("sealed signing policy has no pinned android upload certificate");
+  if (signer !== pinned) invalid("android AAB signer certificate is not the pinned upload certificate");
+  const aabs = (manifest.files ?? []).filter((entry) => entry.role === "aab");
+  if (aabs.length !== 1) invalid(aabs.length ? "sealed release has more than one aab entry" : "sealed release has no aab entry");
+  const [aab] = aabs;
+  if (!/^[a-f0-9]{64}$/.test(value.file?.sha256 ?? "") || value.file.sha256 !== aab.sha256) invalid("android AAB receipt sha256 differs from the sealed aab entry");
+  if (!Number.isInteger(value.file.sizeBytes) || value.file.sizeBytes !== aab.sizeBytes) invalid("android AAB receipt size differs from the sealed aab entry");
+  if (value.file.name !== aab.name) invalid("android AAB receipt names a different file than the sealed aab entry");
+}
+
 // Bounded memory for large artifacts. Transport must read back against this digest.
 export function verifyArtifactFile(file, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "")) throw new PublicationError("PUBLICATION_SEAL_INVALID", "publication hash evidence is required");