@rightkit/release 0.2.172 → 0.2.173

package/bin/darwin/rightkit-swap.sign.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "sha256": "68f8aba2f5ecbaa120e948619f10a90d27fc7b701271e9382a412c7c07aca781",
+  "sha256": "c6b47bc1767d45fc9a72a401a258d5f645a0c54185f2bf2b6c51634cff7c8d6b",
   "identity": "Developer ID Application: Adrian D'souza (6KLGD3LLKF)",
   "codesign": "strict-valid"
 }

package/cli/right-release.mjs

@@ -21,6 +21,7 @@ const commands = new Map([
   ["sign-dev-artifact", "sign-dev-artifact.mjs"],
   ["sign-candidate", "sign-candidate.mjs"],
   ["engine-locate", "engine-locator.mjs"],
+  ["stage-sidecar", "stage-sidecar-command.mjs"],
   ["signing-agent", "signing-agent-command.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
@@ -181,6 +182,7 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
+  stage-sidecar [--config <file>] [--target <triple>] [--json]  Stage declarative sidecars into src-tauri/binaries (Tauri externalBin naming)
   dmg build --app <.app> --out <dmg> --volname <name> [--background <png>] [--spec <appdmg.json>]
             [--icon-size N] [--app-position x,y] [--applications-position x,y] [--window w,h] [--window-position x,y]
                                                       Build branded UDZO image without Finder

package/development.mjs

@@ -13,6 +13,7 @@ import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.m
 import { stageDevelopmentBinaries, validateStageEntries } from "./stage-binary.mjs";
 import { assertStableDesignatedRequirement, readBundleExecutable, requestedCiAdhocSigning, signMacosDevelopmentBundle } from "./development-signing.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
+import { installTauriDevId, resolveTauriDevIdDescriptor, TAURI_DEVID_KIND } from "./install-tauri-devid.mjs";
 import { androidDevelopmentNdkCommand, androidDevelopmentSerial, installAndroidDevelopment, validateAndroidDevelopment } from "./android-dev.mjs";
 
 // One standard Cargo profile for every app (templates/cargo-profiles.toml): Cargo's built-in `dev`.
@@ -70,6 +71,10 @@ export function validateDevelopmentConfig(config, platform, { root = process.cwd
     for (const key of ["sourceDirectory", "entrypoint"]) {
       if (typeof descriptor[key] !== "string" || !descriptor[key] || path.isAbsolute(descriptor[key]) || path.win32.isAbsolute(descriptor[key]) || descriptor[key].split(/[\\/]/).includes("..")) throw new Error(`portable development ${key} must be a contained relative path`);
     }
+  } else if (target.install?.kind === TAURI_DEVID_KIND) {
+    if (platform !== "mac") throw new Error(`the ${TAURI_DEVID_KIND} development installer is for --platform mac`);
+    resolveTauriDevIdDescriptor(target.install, { appRoot: root });
+    if (!target.install.targetTriple && !target.install.bundleDirectory) throw new Error(`development.targets.${platform}.install requires targetTriple (or bundleDirectory) to find the built .app`);
   } else if (target.install?.kind === "adb") {
     if (platform !== "android") throw new Error("the adb development installer is for --platform android");
   } else if (target.install) throw new Error(`unsupported development installer kind: ${target.install.kind}`);
@@ -94,6 +99,7 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   const childEnv = codesignEnvironment(developmentEnvironment(env));
   // One lease spans every managed request this run makes, so a broker cutover cannot land between them.
   const lease = acquireManagedRunLease({ command: `right-release dev --platform ${platform}`, env });
+  let releaseLease = true;
   try {
     const startedMs = Date.now();
     // Android: cargo-ndk (Cargo dev profile) fills the generated jniLibs, then the Gradle debug build packages it.
@@ -104,9 +110,17 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
     const staged = target.stage?.length ? stageDevelopmentBinaries(target.stage, { root, platform: platform === "win" ? "win32" : process.platform }) : [];
     for (const file of staged) console.log(`right-release dev: staged ${file}`);
     if (buildOnly || !target.install) return { built: true, installed: false, ...(staged.length ? { staged } : {}) };
+    if (target.install.kind === TAURI_DEVID_KIND) {
+      // installTauriDevId is async: the lease is held until it settles, so a broker cutover cannot land mid-install.
+      const built = resolveTauriArtifact(target.install, { root, platform, env: childEnv });
+      releaseLease = false;
+      return installTauriDevId({ appRoot: root, config: target.install, built, env: childEnv })
+        .then((outcome) => ({ built: true, installed: true, ...(staged.length ? { staged } : {}), devid: outcome }))
+        .finally(() => lease.release());
+    }
     const signing = install(target.install, { root, platform, config, env: childEnv, run, sinceMs: startedMs, serial });
     return { built: true, installed: true, ...(staged.length ? { staged } : {}), ...(platform === "mac" && target.install.kind === "tauri" ? { signing } : {}) };
-  } finally { lease.release(); }
+  } finally { if (releaseLease) lease.release(); }
 }
 
 export function assertNativeDevelopmentHost(platform, host = process.platform) {
@@ -341,7 +355,7 @@ export async function main(args = process.argv.slice(2)) {
   if (pathKey) process.env[pathKey] = safeEnv[pathKey] ?? process.env[pathKey];
   const loaded = await import(pathToFileURL(absoluteConfig));
   const config = loaded.default ?? loaded.config ?? loaded;
-  const result = runDevelopment({ root: path.dirname(absoluteConfig), platform, config, dryRun, buildOnly, serial });
+  const result = await runDevelopment({ root: path.dirname(absoluteConfig), platform, config, dryRun, buildOnly, serial });
   if (dryRun) console.log(JSON.stringify(result.plan, null, 2));
   return result;
 }

package/install-tauri-devid.mjs

@@ -0,0 +1,172 @@
+// `install.kind: "tauri-devid"`: install a freshly built Tauri .app at ONE fixed path, signed with the stable
+// Developer ID, so macOS privacy grants (TCC) and Keychain code requirements survive every rebuild.
+//
+// Pipeline (installTauriDevId): copy the built .app to a private staging copy -> sign nested code, then the app,
+// with the stable Developer ID (signMacosDevelopmentBundle) -> assert the designated requirement equals the
+// installed copy's (assertStableDesignatedRequirement) -> install at the fixed path keeping `<dest>.previous`
+// (installApp, dev mode) -> verify the installed copy; any verify failure restores `.previous`.
+// resetTauriDevId restores `.previous` or removes the install, only when asked.
+//
+// Every external call (copy, sign, run, install, file system) is injectable through `deps`; the defaults are the
+// real RightKit pieces. macOS paths are POSIX, so this module uses path.posix throughout.
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { assertStableDesignatedRequirement, signMacosDevelopmentBundle } from "./development-signing.mjs";
+import { installApp } from "./install-app.mjs";
+import { previousPathOf } from "./in-place-install.mjs";
+
+export const TAURI_DEVID_KIND = "tauri-devid";
+
+export class TauriDevIdError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "TauriDevIdError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+
+const P = path.posix;
+const absolute = (appRoot, value) => (P.isAbsolute(value) ? P.normalize(value) : P.join(appRoot, value));
+const text = (result) => `${result?.stdout ?? ""}\n${result?.stderr ?? ""}`.trim();
+
+/** Real implementations of every external call. Tests replace any of them. */
+export function defaultDeps() {
+  return {
+    run: spawnSync,
+    sign: signMacosDevelopmentBundle,
+    assertRequirement: assertStableDesignatedRequirement,
+    installApp,
+    exists: existsSync,
+    makeTemp: () => mkdtempSync(P.join(os.tmpdir(), "rightkit-tauri-devid-")),
+    copyApp: (from, to) => cpSync(from, to, { recursive: true, verbatimSymlinks: true }),
+    rename: renameSync,
+    remove: (target) => rmSync(target, { recursive: true, force: true }),
+    readFile: readFileSync,
+    log: (line) => console.log(line),
+  };
+}
+
+/** The `tauri-devid` descriptor, validated. Accepts the config root or the descriptor itself. */
+export function resolveTauriDevIdDescriptor(config, { appRoot = "" } = {}) {
+  const descriptor = config?.development?.targets?.mac?.install ?? config;
+  if (!descriptor || descriptor.kind !== TAURI_DEVID_KIND) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `development.targets.mac.install.kind must be "${TAURI_DEVID_KIND}"`);
+  if (typeof descriptor.productName !== "string" || !descriptor.productName) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.productName is required");
+  if (typeof descriptor.destination !== "string" || !P.isAbsolute(descriptor.destination) || !descriptor.destination.endsWith(".app") || descriptor.destination.split("/").includes("..")) {
+    throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.destination must be an absolute /…/<Product>.app path (the one fixed install path, for example /Applications/<Product>.app)");
+  }
+  if (descriptor.signing !== undefined) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `install.signing is not allowed for ${TAURI_DEVID_KIND}: ad hoc signing changes every build and resets privacy grants`);
+  const binaries = descriptor.verifyBinaries ?? [];
+  if (!Array.isArray(binaries) || binaries.some((item) => typeof item !== "string" || !item || P.isAbsolute(item) || item.split("/").includes(".."))) {
+    throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.verifyBinaries must be relative paths inside the app, for example Contents/MacOS/<name>");
+  }
+  return { ...descriptor, destination: P.normalize(descriptor.destination), verifyBinaries: binaries, appRoot };
+}
+
+const builtPathOf = (built, appRoot) => {
+  const value = typeof built === "string" ? built : built?.app;
+  if (typeof value !== "string" || !value.replace(/\/+$/, "").endsWith(".app")) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", "built must be the path of the built .app (a string, or { app })");
+  return absolute(appRoot, value.replace(/\/+$/, ""));
+};
+
+const digestOf = (deps, file) => createHash("sha256").update(deps.readFile(file)).digest("hex");
+
+/** Put `.previous` back at the fixed path. Renames only; the bad copy is removed last. */
+function restorePrevious(destination, deps) {
+  const previous = previousPathOf(destination);
+  if (!deps.exists(previous)) throw new TauriDevIdError("TAURI_DEVID_NO_PREVIOUS", `no rollback copy at ${previous}`);
+  const aside = `${destination}.reset`;
+  deps.remove(aside);
+  const hadCurrent = deps.exists(destination);
+  if (hadCurrent) deps.rename(destination, aside);
+  try { deps.rename(previous, destination); }
+  catch (error) { if (hadCurrent) deps.rename(aside, destination); throw error; }
+  deps.remove(aside);
+  return { destination, restoredFrom: previous };
+}
+
+function verifyInstalled({ appRoot, destination, staged, expectedRequirement, binaries, env, deps }) {
+  const strict = deps.run("codesign", ["--verify", "--strict", "--deep", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  if (strict.error || strict.status !== 0) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} failed codesign --verify --strict --deep: ${strict.error?.message ?? text(strict)}`);
+  const display = deps.run("codesign", ["--display", "-r-", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  const actual = /^designated => (.+)$/m.exec(text(display))?.[1]?.trim();
+  if (display.status !== 0 || actual !== expectedRequirement) {
+    throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} designated requirement ${JSON.stringify(actual)} is not the signed ${JSON.stringify(expectedRequirement)}`, { installedRequirement: actual, designatedRequirement: expectedRequirement });
+  }
+  for (const binary of binaries) {
+    let want; let got;
+    try { want = digestOf(deps, P.join(staged, binary)); got = digestOf(deps, P.join(destination, binary)); }
+    catch (error) { throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `cannot read ${binary} to verify the install: ${error.message}`); }
+    if (want !== got) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${binary} does not match the signed staged copy`);
+  }
+}
+
+/**
+ * @param {{appRoot: string, config: object, built: string|{app: string}, deps?: object, env?: object}} options
+ * `config` is the app's release config (development.targets.mac.install is the `tauri-devid` descriptor).
+ * @returns {Promise<{installed: string, previous: string|null, designatedRequirement: string, identity: string, teamIdentifier: string, signing: object}>}
+ */
+export async function installTauriDevId({ appRoot, config, built, deps = {}, env = {} }) {
+  const d = { ...defaultDeps(), ...deps };
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot });
+  const destination = descriptor.destination;
+  const source = builtPathOf(built, appRoot);
+  if (!d.exists(source)) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", `built app not found: ${source}`);
+  const name = P.basename(destination);
+  const tempRoot = d.makeTemp();
+  // The staging copy carries the final bundle name so installApp installs <dest dir>/<name> without renaming.
+  const staged = P.join(tempRoot, name);
+  try {
+    d.copyApp(source, staged);
+    // 1. Sign: nested code first, then the app, with the stable Developer ID (development-signing orders it deepest first).
+    const signing = await d.sign({ root: appRoot, bundle: staged, descriptor, config, env });
+    if (signing.adhoc || !signing.designatedRequirement) throw new TauriDevIdError("TAURI_DEVID_SIGNING_UNSTABLE", `signing produced no stable Developer ID designated requirement for ${staged}; refusing to install`);
+    // 2. Same identity as the installed copy, or fail: a changed designated requirement resets every privacy grant.
+    if (d.exists(destination)) await d.assertRequirement({ root: appRoot, installed: destination, expected: signing.designatedRequirement, env, run: d.run });
+    // 3. Install at the fixed path; the replaced copy stays as <dest>.previous.
+    const outcome = await d.installApp({ app: staged, dev: true, dest: P.dirname(destination), appName: name, bundleId: descriptor.bundleId ?? null, relaunch: null }, { env });
+    // 4. Verify the installed copy; a failure puts .previous back (or removes a first install) so the path is never left broken.
+    try {
+      verifyInstalled({ appRoot, destination, staged, expectedRequirement: signing.designatedRequirement, binaries: descriptor.verifyBinaries, env, deps: d });
+    } catch (error) {
+      let rolledBack = "none";
+      if (outcome?.previous && d.exists(previousPathOf(destination))) { restorePrevious(destination, d); rolledBack = "restored-previous"; }
+      else { d.remove(destination); rolledBack = "removed-first-install"; }
+      error.rolledBack = rolledBack;
+      throw error;
+    }
+    d.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; designated=${signing.designatedRequirement}`);
+    return { installed: destination, previous: outcome?.previous ?? null, designatedRequirement: signing.designatedRequirement, identity: signing.identity, teamIdentifier: signing.teamIdentifier, signing };
+  } finally { d.remove(tempRoot); }
+}
+
+/**
+ * Deliberate reset of a fixed install. mode "restore" (default) makes `.previous` the install again; mode "remove"
+ * deletes the install and its `.previous` (and, with `resetPrivacy`, runs `tccutil reset All <bundleId>`).
+ * Quit the app first; nothing here kills processes.
+ */
+export async function resetTauriDevId({ appRoot, config, mode = "restore", resetPrivacy = false, deps = {}, env = {} }) {
+  const d = { ...defaultDeps(), ...deps };
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot });
+  const destination = descriptor.destination;
+  if (mode === "restore") {
+    const result = restorePrevious(destination, d);
+    d.log(`right-release dev: restored ${destination} from ${result.restoredFrom}`);
+    return { mode, ...result };
+  }
+  if (mode !== "remove") throw new TauriDevIdError("TAURI_DEVID_RESET_MODE_INVALID", `mode must be "restore" or "remove", got ${JSON.stringify(mode)}`);
+  d.remove(destination);
+  d.remove(previousPathOf(destination));
+  let privacyReset = false;
+  if (resetPrivacy) {
+    if (!descriptor.bundleId) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "resetPrivacy requires install.bundleId");
+    const reset = d.run("tccutil", ["reset", "All", descriptor.bundleId], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+    if (reset.error || reset.status !== 0) throw new TauriDevIdError("TAURI_DEVID_RESET_FAILED", `tccutil reset failed: ${reset.error?.message ?? text(reset)}`);
+    privacyReset = true;
+  }
+  d.log(`right-release dev: removed ${destination}${privacyReset ? " and reset its privacy grants" : ""}`);
+  return { mode, destination, removed: true, privacyReset };
+}

package/inventory-check.mjs

@@ -24,7 +24,7 @@ const CACHE_TTL_MS = 60 * 60 * 1000;
 const CONCURRENCY = 8;
 const REQUEST_TIMEOUT_MS = 15_000;
 const CRATES_API_INTERVAL_MS = 1000;
-const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/Orthic-Labs/rightkit)";
+const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/rightkit)";
 const EXCLUDED_PREFIX = "build-control-";
 const OWNER_PROBE_CRATE = "rightkit-fs";
 const EXTRA_ACCOUNT_CRATES = Object.freeze([]);

package/mac-package-recipe.mjs

@@ -0,0 +1,304 @@
+// Declarative macOS packaging recipe (bogusyogi/rightkit#345). A mac target that sets `macPackage` and has no
+// `prePackage` / `package` hook scripts is packaged by this module instead of a per-app mac-dmg.mjs:
+//
+//   1. universal check   every Mach-O (main executable + nested) must hold x86_64 and arm64 (macPackage.universal)
+//   2. sign nested code  Developer ID, hardened runtime, no entitlements, deepest first
+//   3. sign the app      Developer ID, hardened runtime, optional entitlements
+//   4. build the DMG     branded, from the signed app (dmg-build)
+//   5. sign the DMG      Developer ID with a secure timestamp (no hardened runtime, as for a disk image)
+//   6. notarize + staple the DMG and the app (macos-notarization), when macPackage.notarize
+//   7. updater tarball   tar.gz of the stapled app's Contents + the updater signature, when macPackage.updater
+//
+// Every external effect is injectable through `deps`; nothing here reads the host unless a default is used.
+// Fails closed: every problem throws MacPackageRecipeError, and a failure after the DMG exists removes the
+// half-processed DMG / updater files so a later seal cannot pick up an artifact that skipped a step.
+import * as nodeFs from "node:fs";
+import path from "node:path";
+import { buildDmg } from "./dmg-build.mjs";
+import { spawnSync } from "./background-process.mjs";
+import { signMacosEntries } from "./mac-sign-core.mjs";
+import { mainExecutableName } from "./mac-bundle-signing.mjs";
+import { notarizeMacosArtifact } from "./macos-notarization.mjs";
+import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
+import { runMacCodesignCommands, signMacUpdaterFiles } from "./macos-signing-session.mjs";
+import { discoverNestedCode } from "./swift-mac-app.mjs";
+
+/**
+ * Typed error. Codes: MAC_PACKAGE_CONFIG_INVALID, MAC_PACKAGE_HOST_UNSUPPORTED, MAC_PACKAGE_INPUT_MISSING,
+ * MAC_PACKAGE_UNIVERSAL_FAILED, MAC_PACKAGE_SIGN_FAILED, MAC_PACKAGE_DMG_FAILED, MAC_PACKAGE_NOTARIZE_FAILED,
+ * MAC_PACKAGE_UPDATER_FAILED.
+ */
+export class MacPackageRecipeError extends Error {
+  constructor(code, message, options) { super(message, options); this.name = "MacPackageRecipeError"; this.code = code; }
+}
+
+export const MAC_PACKAGE_STEPS = Object.freeze(["universal", "sign-nested", "sign-app", "dmg", "sign-dmg", "notarize", "updater"]);
+const UNIVERSAL_ARCHS = ["x86_64", "arm64"];
+const MACPACKAGE_KEYS = ["universal", "dmg", "notarize", "updater", "nested", "entitlements"];
+const DMG_KEYS = ["name", "background", "windowSize", "iconPositions"];
+const ICON_KEYS = ["app", "applications"];
+
+const invalid = (message) => new MacPackageRecipeError("MAC_PACKAGE_CONFIG_INVALID", `macPackage: ${message}`);
+const isPlainObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const rejectUnknown = (object, allowed, label) => {
+  const unknown = Object.keys(object).filter((key) => !allowed.includes(key));
+  if (unknown.length) throw invalid(`${label} has unknown key(s): ${unknown.join(", ")} (allowed: ${allowed.join(", ")})`);
+};
+const integerPair = (value, label, min) => {
+  if (!Array.isArray(value) || value.length !== 2 || value.some((n) => !Number.isInteger(n) || n < min || n > 32767)) {
+    throw invalid(`${label} must be [x, y] integers ${min}..32767`);
+  }
+  return [...value];
+};
+const requireBoolean = (value, label) => {
+  if (typeof value !== "boolean") throw invalid(`${label} is required and must be true or false`);
+  return value;
+};
+
+/** A bundle-relative glob: forward slashes only, no `..`, no absolute path, only `*`, `**` and `?` wildcards. */
+function validateGlob(pattern, label) {
+  if (typeof pattern !== "string" || !pattern.trim()) throw invalid(`${label} must be a non-empty string`);
+  if (pattern.startsWith("/") || /^[A-Za-z]:/.test(pattern) || pattern.includes("\\")) throw invalid(`${label} must be a bundle-relative path with forward slashes: ${pattern}`);
+  if (/[[\]{}()!]/.test(pattern)) throw invalid(`${label} supports only *, ** and ? wildcards: ${pattern}`);
+  const segments = pattern.split("/");
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw invalid(`${label} must not contain empty, '.' or '..' segments: ${pattern}`);
+  if (segments.some((segment) => segment.includes("**") && segment !== "**")) throw invalid(`${label}: '**' must be a whole path segment: ${pattern}`);
+  return pattern;
+}
+
+/** Strictly validate and normalize a `macPackage` value. Unknown keys, wrong types and missing fields throw. */
+export function validateMacPackageConfig(macPackage) {
+  if (!isPlainObject(macPackage)) throw invalid("must be an object");
+  rejectUnknown(macPackage, MACPACKAGE_KEYS, "macPackage");
+  const universal = macPackage.universal === undefined ? false : requireBoolean(macPackage.universal, "universal");
+  const notarize = requireBoolean(macPackage.notarize, "notarize");
+  const updater = requireBoolean(macPackage.updater, "updater");
+  const dmg = macPackage.dmg;
+  if (!isPlainObject(dmg)) throw invalid("dmg is required and must be an object");
+  rejectUnknown(dmg, DMG_KEYS, "dmg");
+  if (typeof dmg.name !== "string" || !dmg.name.trim() || /[\0\r\n/:]/.test(dmg.name) || Buffer.byteLength(dmg.name) > 255) {
+    throw invalid("dmg.name must be a non-empty volume name without NUL, CR, LF, '/' or ':'");
+  }
+  const normalized = { name: dmg.name };
+  if (dmg.background !== undefined) {
+    if (typeof dmg.background !== "string" || !/\.(png|tiff?)$/i.test(dmg.background)) throw invalid("dmg.background must be a path to a PNG or TIFF file");
+    normalized.background = dmg.background;
+  }
+  if (dmg.windowSize !== undefined) normalized.windowSize = integerPair(dmg.windowSize, "dmg.windowSize", 1);
+  if (dmg.iconPositions !== undefined) {
+    if (!isPlainObject(dmg.iconPositions)) throw invalid("dmg.iconPositions must be an object with app and/or applications");
+    rejectUnknown(dmg.iconPositions, ICON_KEYS, "dmg.iconPositions");
+    normalized.iconPositions = Object.fromEntries(Object.entries(dmg.iconPositions).map(([key, value]) => [key, integerPair(value, `dmg.iconPositions.${key}`, 0)]));
+  }
+  let nested = [];
+  if (macPackage.nested !== undefined) {
+    if (!Array.isArray(macPackage.nested) || !macPackage.nested.length) throw invalid("nested must be a non-empty array of bundle-relative globs");
+    nested = macPackage.nested.map((pattern, index) => validateGlob(pattern, `nested[${index}]`));
+    if (new Set(nested).size !== nested.length) throw invalid("nested globs must be unique");
+  }
+  if (macPackage.entitlements !== undefined && (typeof macPackage.entitlements !== "string" || !macPackage.entitlements.trim())) throw invalid("entitlements must be a path string");
+  return { universal, dmg: normalized, notarize, updater, nested, ...(macPackage.entitlements ? { entitlements: macPackage.entitlements } : {}) };
+}
+
+/**
+ * Validate the mac target around `macPackage`: the declarative recipe and the hook scripts are mutually exclusive, and the
+ * app / DMG paths come from the existing `notarize.app` and `notarize.file` fields so there is one source of truth.
+ */
+export function validateMacPackageTarget(target) {
+  if (!isPlainObject(target)) throw invalid("the mac target must be an object");
+  if (target.prePackage !== undefined || target.package !== undefined) throw invalid("a target with macPackage must not also declare prePackage or package; delete the hook scripts");
+  if (target.dmg !== undefined) throw invalid("a target with macPackage must not also declare targets.mac.dmg; use macPackage.dmg");
+  const recipe = validateMacPackageConfig(target.macPackage);
+  const app = target.notarize?.app;
+  const file = target.notarize?.file;
+  if (typeof app !== "string" || !/\.app\/?$/.test(app)) throw invalid("notarize.app must name the .app bundle the recipe signs and packs");
+  if (typeof file !== "string" || !/\.dmg$/i.test(file)) throw invalid("notarize.file must name the .dmg the recipe produces");
+  return { recipe, app, dmgFile: file };
+}
+
+/** Bundle-relative glob to RegExp; `**` spans path segments, `*` and `?` stay inside one. */
+export function globToRegExp(pattern) {
+  const segments = pattern.split("/");
+  const body = segments.map((segment, index) => {
+    const last = index === segments.length - 1;
+    if (segment === "**") return last ? ".+" : "(?:[^/]+/)*";
+    return `${segment.replace(/[.+^$|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}${last ? "" : "/"}`;
+  }).join("");
+  return new RegExp(`^${body}$`);
+}
+
+function listTree(root, fs) {
+  const found = [];
+  const walk = (dir, prefix) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+      found.push(relative);
+      if (entry.isDirectory() && !entry.isSymbolicLink()) walk(path.join(dir, entry.name), relative);
+    }
+  };
+  walk(root, "");
+  return found;
+}
+
+const depth = (file) => file.split(/[\\/]/).length;
+const tail = (text, lines = 20) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
+
+const defaultInspect = (cmd, args) => {
+  const result = spawnSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+  if (result.error || result.status !== 0) throw new Error(`${cmd} ${args.join(" ")} failed: ${output.trim() || result.error?.message}`);
+  return output;
+};
+
+/**
+ * Run the declarative mac package recipe. Returns { steps, app, dmg, updater, receipt, signing } where `steps` lists the
+ * steps that actually ran, in order. Throws MacPackageRecipeError on the first failure.
+ *
+ * deps (all optional): platform, env, fs, resolveArtifact(root, p), resolveIdentity({env}), signOne(codesignArgs),
+ * inspect(cmd, args) -> output, evidence(file), hashFile(file), discover(app, mainName), mainName(app),
+ * listFiles(dir) -> bundle-relative posix paths, buildDmg(options), notarize(options), run(cmd, args, opts),
+ * signUpdater(files, options), receiptPath, log(event).
+ */
+export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} }) {
+  const { recipe, app: declaredApp, dmgFile } = validateMacPackageTarget(target);
+  const {
+    platform = process.platform, env = process.env, fs = nodeFs,
+    resolveArtifact = (root, p) => path.resolve(root, p),
+    resolveIdentity = resolveMacosDeveloperIdIdentity,
+    signOne = (codesignArgs) => runMacCodesignCommands([codesignArgs], { env })[0],
+    inspect = defaultInspect, evidence, hashFile,
+    discover = discoverNestedCode, mainName = mainExecutableName,
+    listFiles = (dir) => listTree(dir, fs),
+    buildDmg: build = buildDmg, notarize = notarizeMacosArtifact,
+    run = spawnSync, signUpdater = (files, options) => signMacUpdaterFiles(files, options),
+    log = () => {},
+  } = deps;
+  const appName = config.app ?? path.basename(appRoot ?? ".");
+  if (typeof appRoot !== "string" || !path.isAbsolute(appRoot)) throw invalid("appRoot must be an absolute path");
+  if (platform !== "darwin") throw new MacPackageRecipeError("MAC_PACKAGE_HOST_UNSUPPORTED", `macPackage signs and notarizes on macOS only (host: ${platform})`);
+
+  const app = path.resolve(resolveArtifact(appRoot, declaredApp));
+  const dmg = path.resolve(resolveArtifact(appRoot, dmgFile));
+  const updater = `${app}.tar.gz`;
+  const receiptPath = deps.receiptPath ?? path.join(path.resolve(env.RIGHT_RELEASE_STATE_ROOT ?? path.join(appRoot, ".right-release"), "receipts"), `${appName}-mac-notarization.json`);
+  const missing = (what, file) => new MacPackageRecipeError("MAC_PACKAGE_INPUT_MISSING", `${what} not found: ${file}`);
+  const wrap = (code, step, error) => (error instanceof MacPackageRecipeError ? error
+    : new MacPackageRecipeError(code, `macPackage ${step} failed: ${error?.message ?? error}`, { cause: error }));
+
+  // Resolve every input before any effect so a typo cannot leave a half-signed app.
+  if (!fs.existsSync(app)) throw missing("app bundle", app);
+  const infoPlist = path.join(app, "Contents", "Info.plist");
+  if (!fs.existsSync(infoPlist)) throw missing("Contents/Info.plist in the app bundle", infoPlist);
+  const entitlements = recipe.entitlements ? path.resolve(appRoot, recipe.entitlements) : undefined;
+  if (entitlements && !fs.existsSync(entitlements)) throw missing("entitlements file", entitlements);
+  const background = recipe.dmg.background ? path.resolve(appRoot, recipe.dmg.background) : undefined;
+  if (background && !fs.existsSync(background)) throw missing("dmg.background file", background);
+
+  const executable = mainName(app);
+  const mainBinary = path.join(app, "Contents", "MacOS", executable);
+  const nestedSet = new Set(discover(app, executable).map((file) => path.resolve(file)));
+  if (recipe.nested.length) {
+    const tree = listFiles(app);
+    for (const pattern of recipe.nested) {
+      const matcher = globToRegExp(pattern);
+      const hits = tree.filter((relative) => matcher.test(relative));
+      if (!hits.length) throw new MacPackageRecipeError("MAC_PACKAGE_INPUT_MISSING", `macPackage.nested glob matched nothing inside ${path.basename(app)}: ${pattern}`);
+      for (const hit of hits) nestedSet.add(path.resolve(app, hit));
+    }
+  }
+  nestedSet.delete(mainBinary);
+  nestedSet.delete(app);
+  // Inside-out: a path nested deeper is always signed before the code that contains it.
+  const nested = [...nestedSet].sort((a, b) => depth(b) - depth(a));
+
+  const steps = [];
+  const record = (step) => { steps.push(step); log({ event: "mac-package-step", step, app: appName }); };
+  const signOptions = { signOne, inspect, ...(evidence ? { evidence } : {}), ...(hashFile ? { hashFile } : {}) };
+  let signing = [];
+  let receipt;
+  let updaterFiles = [];
+  try {
+    // 1) universal: verify every Mach-O holds both architectures. A thin slice makes the whole app Intel- or
+    //    Apple-Silicon-only, which compiles, signs and notarizes fine and then fails on half the users' Macs.
+    if (recipe.universal) {
+      const archsOf = (file) => String(inspect("lipo", ["-archs", file])).trim().split(/\s+/);
+      const assertFat = (file) => {
+        const archs = archsOf(file);
+        const lacking = UNIVERSAL_ARCHS.filter((arch) => !archs.includes(arch));
+        if (lacking.length) throw new Error(`${path.relative(app, file)} is not universal (has: ${archs.join(" ")}; missing: ${lacking.join(" ")})`);
+      };
+      try {
+        assertFat(mainBinary); // an unreadable main executable is a failure, not a skip
+        for (const file of nested) {
+          let isFile = false;
+          try { isFile = fs.statSync(file).isFile(); } catch { /* absent: signing reports it */ }
+          if (!isFile) continue; // code bundles are covered by the Mach-O files inside them
+          try { archsOf(file); } catch { continue; } // lipo rejects non-Mach-O files (scripts, resources matched by a glob)
+          assertFat(file);
+        }
+      } catch (error) { throw wrap("MAC_PACKAGE_UNIVERSAL_FAILED", "universal check", error); }
+      record("universal");
+    }
+
+    // 2-3) sign nested code, then the app. One identity for the whole run.
+    let identity;
+    try { identity = resolveIdentity({ env }); } catch (error) { throw wrap("MAC_PACKAGE_SIGN_FAILED", "identity lookup", error); }
+    if (typeof identity !== "string" || !identity.trim()) throw new MacPackageRecipeError("MAC_PACKAGE_SIGN_FAILED", "macPackage signing identity is empty");
+    if (nested.length) {
+      try { signing.push(...signMacosEntries(nested.map((file) => ({ file, hardenedRuntime: true, options: [] })), { identity, ...signOptions })); }
+      catch (error) { throw wrap("MAC_PACKAGE_SIGN_FAILED", "nested code signing", error); }
+      record("sign-nested");
+    }
+    try { signing.push(...signMacosEntries([{ file: app, hardenedRuntime: true, options: [], ...(entitlements ? { entitlements } : {}) }], { identity, ...signOptions })); }
+    catch (error) { throw wrap("MAC_PACKAGE_SIGN_FAILED", "app signing", error); }
+    record("sign-app");
+
+    // 4) branded DMG from the signed app.
+    fs.rmSync(dmg, { force: true });
+    try {
+      build({
+        app, out: dmg, volname: recipe.dmg.name,
+        ...(background ? { background } : {}),
+        ...(recipe.dmg.windowSize ? { window: recipe.dmg.windowSize } : {}),
+        ...(recipe.dmg.iconPositions?.app ? { appPosition: recipe.dmg.iconPositions.app } : {}),
+        ...(recipe.dmg.iconPositions?.applications ? { applicationsPosition: recipe.dmg.iconPositions.applications } : {}),
+      });
+    } catch (error) { throw wrap("MAC_PACKAGE_DMG_FAILED", "DMG build", error); }
+    if (!fs.existsSync(dmg)) throw new MacPackageRecipeError("MAC_PACKAGE_DMG_FAILED", `DMG build reported success but ${dmg} does not exist`);
+    record("dmg");
+
+    // 5) sign the DMG: secure timestamp, no hardened runtime (a disk image has none).
+    try { signing.push(...signMacosEntries([{ file: dmg, hardenedRuntime: false, options: [] }], { identity, ...signOptions })); }
+    catch (error) { throw wrap("MAC_PACKAGE_SIGN_FAILED", "DMG signing", error); }
+    record("sign-dmg");
+
+    // 6) notarize + staple. The DMG submission covers the app inside it; the app is stapled too so the updater tarball carries the ticket.
+    if (recipe.notarize) {
+      try { receipt = notarize({ archive: dmg, app, receiptPath, env, run }); }
+      catch (error) { throw wrap("MAC_PACKAGE_NOTARIZE_FAILED", "notarization", error); }
+      if (!receipt || receipt.notarization?.status !== "Accepted") throw new MacPackageRecipeError("MAC_PACKAGE_NOTARIZE_FAILED", `macPackage notarization did not report Accepted for ${dmg}`);
+      record("notarize");
+    }
+
+    // 7) updater tarball from the final (stapled) app, then its signature.
+    if (recipe.updater) {
+      updaterFiles = [updater, `${updater}.sig`];
+      for (const file of updaterFiles) fs.rmSync(file, { force: true });
+      // bsdtar otherwise serializes extended attributes as AppleDouble `._*` entries, which Tauri's extractor writes
+      // into the bundle and invalidates the seal. The explicit App.app/ directory entry is omitted for the same extractor.
+      let packed;
+      try { packed = run("tar", ["-czf", updater, "-C", path.dirname(app), path.join(path.basename(app), "Contents")], { cwd: appRoot, env: { ...env, COPYFILE_DISABLE: "1" }, encoding: "utf8", stdio: "pipe" }); }
+      catch (error) { throw wrap("MAC_PACKAGE_UPDATER_FAILED", "updater tar", error); }
+      if (!packed || packed.error || packed.status !== 0) throw new MacPackageRecipeError("MAC_PACKAGE_UPDATER_FAILED", `macPackage updater tar failed: ${packed?.error?.message ?? (tail(packed?.stderr) || packed?.status)}`);
+      try { signUpdater([updater], { cwd: appRoot, env }); }
+      catch (error) { throw wrap("MAC_PACKAGE_UPDATER_FAILED", "updater signing", error); }
+      for (const file of updaterFiles) if (!fs.existsSync(file)) throw missing("updater artifact", file);
+      record("updater");
+    }
+  } catch (error) {
+    // Fail closed: never leave a DMG or updater that skipped a step where the seal can find it.
+    for (const file of [dmg, ...updaterFiles]) { try { fs.rmSync(file, { force: true }); } catch { /* best effort */ } }
+    throw error;
+  }
+  return { steps, app, dmg, updater: recipe.updater ? updater : null, receipt: receipt ?? null, receiptPath: receipt ? receiptPath : null, signing };
+}

package/media-sidecar.mjs

@@ -187,7 +187,7 @@ export function sourceOfferText({ rows, contact, crateVersion }) {
     "The licence text and build notes are in this folder. You may replace these programs with your own build of the same source.",
     "",
     `Source code and build recipe: ${rows[0].attribution.sourceUrl}`,
-    `Build recipes, pinned sources and notes: https://github.com/Orthic-Labs/rightkit/tree/main/crates/rightkit-ffmpeg${crateVersion ? ` (crate rightkit-ffmpeg ${crateVersion}, published on crates.io)` : ""}`,
+    `Build recipes, pinned sources and notes: https://github.com/bogusyogi/rightkit/tree/main/crates/rightkit-ffmpeg${crateVersion ? ` (crate rightkit-ffmpeg ${crateVersion}, published on crates.io)` : ""}`,
     `To request the corresponding source on physical media, or if a link is unavailable, write to: ${contact}`,
     "",
     "Programs shipped",