@rightkit/release 0.2.172 → 0.2.174

package/package-recipe-targets.mjs

@@ -0,0 +1,245 @@
+// Declarative package targets (bogusyogi/rightkit#345). `targets.win.winPackage` and `targets.mac.macPackage` replace
+// the per-app NSIS / DMG hook scripts. They expand to the SAME hook shape release.mjs already runs (prePackage,
+// package, sign, notarize, dmg), so every existing gate still applies unchanged: QA-control scans, the bundle
+// marker patch before signing, raw-EXE and installer Authenticode, the NSIS embedding verification, Developer ID
+// signing of the .app and its nested code, app notarization before packing, the signed DMG and its notarization.
+// The standalone recipes (win-package-recipe.mjs, mac-package-recipe.mjs) hold the same steps for direct callers.
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
+
+export class PackageRecipeTargetError extends Error {
+  constructor(message) { super(message); this.name = "PackageRecipeTargetError"; this.code = "RK_PACKAGE_RECIPE_TARGET"; }
+}
+
+const fail = (message) => { throw new PackageRecipeTargetError(message); };
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const rel = (appRoot, file) => path.relative(appRoot, file).split(path.sep).join("/");
+// Tauri never signs or creates updater artifacts here: release.mjs signs, and sign-updater signs the signed bytes.
+const withoutRecipe = (target) => {
+  if (!isObject(target) || !("recipe" in target)) return target;
+  const { recipe: _ignored, ...rest } = target;
+  return rest;
+};
+const QUIET_TAURI_ENV = { TAURI_SIGNING_PRIVATE_KEY: "", TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" };
+const RECIPE_BUILD = fileURLToPath(new URL("./recipe-build.mjs", import.meta.url));
+const PROFILE = /^[a-z][a-z0-9_-]*$/;
+
+function relativeInside(value, label) {
+  if (typeof value !== "string" || !value.trim()) fail(`${label} must be a non-empty relative path`);
+  const normalized = value.replaceAll("\\", "/");
+  if (path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.split("/").includes("..")) fail(`${label} must be relative and stay inside the app: ${value}`);
+  return normalized;
+}
+
+/** `prepare` / `postBuild`: a list of { cmd, args?, cwd? } argv commands (no shell). */
+function commandList(value, label) {
+  if (!Array.isArray(value)) fail(`${label} must be an array of { cmd, args?, cwd? }`);
+  return value.map((item, index) => {
+    const where = `${label}[${index}]`;
+    if (!isObject(item)) fail(`${where} must be an object`);
+    const unknown = Object.keys(item).filter((key) => !["cmd", "args", "cwd"].includes(key));
+    if (unknown.length) fail(`${where} has unknown key(s): ${unknown.join(", ")} (allowed: cmd, args, cwd)`);
+    if (typeof item.cmd !== "string" || !item.cmd.trim()) fail(`${where}.cmd must be a non-empty string`);
+    if (item.args !== undefined && (!Array.isArray(item.args) || item.args.some((arg) => typeof arg !== "string"))) fail(`${where}.args must be a list of strings`);
+    return { cmd: item.cmd, args: [...(item.args ?? [])], ...(item.cwd === undefined ? {} : { cwd: relativeInside(item.cwd, `${where}.cwd`) }) };
+  });
+}
+
+/** The keys shared by winPackage and macPackage: profile, tauriConfig, prepare (and postBuild where allowed). */
+function buildExtras(spec, label, { postBuild }) {
+  if (spec.profile !== undefined && (typeof spec.profile !== "string" || !PROFILE.test(spec.profile))) fail(`${label}.profile must be a Cargo profile name`);
+  const tauriConfig = spec.tauriConfig === undefined ? undefined : relativeInside(spec.tauriConfig, `${label}.tauriConfig`);
+  if (tauriConfig && !/\.json$/i.test(tauriConfig)) fail(`${label}.tauriConfig must be a .json file`);
+  return {
+    profile: spec.profile,
+    tauriConfig,
+    prepare: spec.prepare === undefined ? [] : commandList(spec.prepare, `${label}.prepare`),
+    postBuild: !postBuild || spec.postBuild === undefined ? [] : commandList(spec.postBuild, `${label}.postBuild`),
+  };
+}
+
+/** Tauri v2 passes Cargo flags after `--`; the profile also decides where Tauri looks for the built binary. */
+const profileArgs = (extras) => (extras.profile ? ["--", "--profile", extras.profile] : []);
+/** The build command also takes `--jobs N` (Cargo parallelism), after the same `--`. */
+const buildCargoArgs = (extras, jobs) => {
+  const flags = [...(extras.profile ? ["--profile", extras.profile] : []), ...(jobs ? ["--jobs", String(jobs)] : [])];
+  return flags.length ? ["--", ...flags] : [];
+};
+const configArgs = (extras, appRoot, cwd) => (extras.tauriConfig ? ["--config", path.relative(path.resolve(appRoot, cwd), path.resolve(appRoot, extras.tauriConfig)).split(path.sep).join("/")] : []);
+
+/**
+ * release.mjs runs ONE prePackage command: node recipe-build.mjs runs the built-in cleanup, prepare, the Tauri build,
+ * the artifact stability poll and postBuild in order. `cleanup` and `stability` are recipe-build plan sections.
+ */
+function recipeBuildCommand({ extras, build, env, cleanup, stability, timeoutMs }) {
+  const steps = [
+    ...extras.prepare.map((step) => ({ phase: "prepare", ...step })),
+    { phase: "build", cmd: build.cmd, args: build.args, cwd: build.cwd },
+    ...extras.postBuild.map((step) => ({ phase: "postBuild", ...step })),
+  ];
+  const plan = { version: 1, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}) };
+  return { cmd: process.execPath, args: [RECIPE_BUILD, "--plan", JSON.stringify(plan)], env, ...(timeoutMs ? { timeoutMs } : {}) };
+}
+
+const DEFAULT_WIN_TIMEOUT_MS = 20 * 60 * 1000;
+const positiveInt = (value) => Number.isInteger(value) && value > 0;
+
+/**
+ * Managed Cargo target roots. Artifact paths in a target are declared (and default) under `<cargo dir>/target/...`.
+ * With `cargoTargetRoot` (true: <tauriCwd>/src-tauri/Cargo.toml; or an app-relative Cargo.toml path) or CARGO_TARGET_DIR set
+ * (default manifest), `cargo metadata`'s target_directory is resolved and every declared path under the default
+ * `<cargo dir>/target/` is moved to the real directory. release.mjs needs app-relative paths with no `..`, so a target
+ * directory outside the app fails closed (use RIGHT_RELEASE_ARTIFACT_DIR for copies, see the docs).
+ */
+function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label }) {
+  const explicit = spec.cargoTargetRoot;
+  if (explicit !== undefined && explicit !== true && explicit !== false && typeof explicit !== "string") fail(`${label}.cargoTargetRoot must be true or an app-relative Cargo.toml path`);
+  const envDir = typeof env.CARGO_TARGET_DIR === "string" && env.CARGO_TARGET_DIR.trim() !== "";
+  if (explicit === false || (!explicit && !envDir)) return (declared) => declared;
+  const manifestRel = typeof explicit === "string" ? relativeInside(explicit, `${label}.cargoTargetRoot`) : path.posix.join(cwd === "." ? "" : cwd, "src-tauri", "Cargo.toml");
+  const manifest = path.resolve(appRoot, manifestRel);
+  if (typeof explicit !== "string" && explicit !== true && !existsSync(manifest)) return (declared) => declared;
+  let targetDir;
+  try { targetDir = resolveTargetRoot(manifest); } catch (error) { fail(`${label}: cannot resolve the Cargo target directory (${error.message})`); }
+  const prefix = path.posix.join(path.posix.dirname(manifestRel).replace(/^\.$/, ""), "target");
+  return (declared) => {
+    const normalized = String(declared).replaceAll("\\", "/");
+    if (!normalized.startsWith(`${prefix}/`)) return declared;
+    const moved = path.resolve(targetDir, normalized.slice(prefix.length + 1));
+    const relative = path.relative(appRoot, moved).split(path.sep).join("/");
+    if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative) || /^[A-Za-z]:/.test(relative)) {
+      fail(`${label}: the Cargo target directory ${targetDir} is outside the app, so ${declared} cannot be addressed by an app-relative path; point CARGO_TARGET_DIR inside the app or declare the artifact paths yourself`);
+    }
+    return relative;
+  };
+}
+
+function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability }) {
+  const args = ["exec", "tauri", "build", "--no-bundle", "--target", triple, ...configArgs(extras, appRoot, cwd), ...buildCargoArgs(extras, jobs)];
+  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, timeoutMs });
+}
+
+/** `targets.win.winPackage` → prePackage (`tauri build --no-bundle`) and package (`tauri bundle --bundles nsis`). */
+export function expandWinPackageTarget(target, { appRoot, config = {}, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
+  if (!target?.winPackage) return withoutRecipe(target);
+  if (target.prePackage !== undefined) fail("targets.win.winPackage replaces prePackage; remove the prePackage script");
+  if (target.winPackage.sidecars !== undefined) fail("targets.win.winPackage.sidecars is not supported in a right-release target: declare sidecars through externalBin or mediaSidecar, which release.mjs signs with the raw EXE");
+  if (!isObject(target.winPackage)) fail("targets.win.winPackage must be an object");
+  const { profile: _p, tauriConfig: _t, prepare: _pr, postBuild, jobs, timeoutMs, cleanStale, cargoTargetRoot: _c, ...coreSpec } = target.winPackage;
+  if (postBuild !== undefined) fail("targets.win.winPackage.postBuild is not supported: release.mjs signs the raw EXE between the build and the bundle; use prepare");
+  if (jobs !== undefined && !positiveInt(jobs)) fail("targets.win.winPackage.jobs must be a positive integer (Cargo --jobs)");
+  if (timeoutMs !== undefined && !positiveInt(timeoutMs)) fail("targets.win.winPackage.timeoutMs must be a positive integer (milliseconds)");
+  if (cleanStale !== undefined && typeof cleanStale !== "boolean") fail("targets.win.winPackage.cleanStale must be a boolean");
+  const extras = buildExtras(target.winPackage, "targets.win.winPackage", { postBuild: false });
+  let plan;
+  try { plan = validateWinPackage({ appRoot, config, target: { ...target, winPackage: coreSpec } }); } catch (error) {
+    if (error instanceof WinPackageConfigError) fail(`targets.win.winPackage: ${(error.issues ?? [error.message]).join("; ")}`);
+    throw error;
+  }
+  if (target.signingContract !== undefined && target.signingContract !== "windows-raw-exe-authenticode-before-nsis-v1") fail(`targets.win.winPackage builds an NSIS installer; signingContract must be windows-raw-exe-authenticode-before-nsis-v1, got ${target.signingContract}`);
+  const cwd = rel(plan.appRoot, plan.tauriCwd) || ".";
+  const override = { bundle: { createUpdaterArtifacts: false, windows: { nsis: { installMode: plan.perMachine ? "perMachine" : "currentUser" } } } };
+  const mapPath = targetRootMapper({ spec: target.winPackage, appRoot: plan.appRoot, cwd, env, resolveTargetRoot, label: "targets.win.winPackage" });
+  const rawExe = mapPath(rel(plan.appRoot, plan.rawExe));
+  const installerFile = mapPath(rel(plan.appRoot, plan.installerFile));
+  // Stale outputs are removed before the build, and the raw EXE is polled until it stops changing after it.
+  const cleanup = cleanStale === false ? undefined : { remove: [rawExe, installerFile] };
+  const timeout = timeoutMs ?? DEFAULT_WIN_TIMEOUT_MS;
+  // `recipe` is set only here: a hand-written one is dropped so it can never select a recipe path.
+  const { winPackage, recipe: _ignoredWin, ...rest } = target;
+  return {
+    ...rest,
+    signingContract: "windows-raw-exe-authenticode-before-nsis-v1",
+    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] } }),
+    package: { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", plan.triple, ...configArgs(extras, plan.appRoot, cwd), "--config", JSON.stringify(override), ...profileArgs(extras)], cwd, env: QUIET_TAURI_ENV, timeoutMs: timeout },
+    sign: { ...(target.sign ?? {}), prePackageFiles: [rawExe], files: [installerFile] },
+    recipe: { kind: "winPackage", productName: plan.productName, updater: plan.updater },
+  };
+}
+
+const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot"]);
+const MAC_TRIPLES = ["aarch64-apple-darwin", "x86_64-apple-darwin"];
+const MAC_CLEANUP_KEYS = new Set(["staleApps", "staleDmgVolumes", "lsclean"]);
+
+function macCleanupSpec(value) {
+  if (value === undefined) return {};
+  if (!isObject(value)) fail("targets.mac.macPackage.cleanup must be an object");
+  const unknown = Object.keys(value).filter((key) => !MAC_CLEANUP_KEYS.has(key));
+  if (unknown.length) fail(`targets.mac.macPackage.cleanup has unknown key(s): ${unknown.join(", ")} (allowed: ${[...MAC_CLEANUP_KEYS].join(", ")})`);
+  for (const key of MAC_CLEANUP_KEYS) if (value[key] !== undefined && typeof value[key] !== "boolean") fail(`targets.mac.macPackage.cleanup.${key} must be a boolean`);
+  return value;
+}
+
+/**
+ * `targets.mac.macPackage` → prePackage (`tauri build --bundles app`, universal by default), the .app as the
+ * Developer ID signing set, app notarization before packing, and right-release's own signed DMG from the stapled app.
+ * The app path and DMG path are `notarize.app` and `notarize.file`; DMG branding is `targets.mac.dmg`.
+ * Architecture: `triple` (an explicit arch triple) beats `universal`; `universal: false` means this host's arch.
+ * `cleanup` runs built-in steps in recipe-build before the build (stale DMG volumes, stale .app bundles, lsregister).
+ */
+export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
+  if (!target?.macPackage) return withoutRecipe(target);
+  const spec = target.macPackage;
+  if (!isObject(spec)) fail("targets.mac.macPackage must be an object");
+  const unknown = Object.keys(spec).filter((key) => !MAC_KEYS.has(key));
+  if (unknown.length) fail(`targets.mac.macPackage has unknown key(s): ${unknown.join(", ")} (allowed: ${[...MAC_KEYS].join(", ")})`);
+  if (target.prePackage !== undefined || target.package !== undefined) fail("targets.mac.macPackage replaces prePackage and package; remove both scripts");
+  if (typeof target.notarize?.app !== "string" || !target.notarize.app.endsWith(".app")) fail("targets.mac.macPackage needs notarize.app: the built .app path");
+  if (typeof target.notarize?.file !== "string" || !target.notarize.file.endsWith(".dmg")) fail("targets.mac.macPackage needs notarize.file: the .dmg path right-release builds");
+  if (target.dmg === false) fail("targets.mac.macPackage always builds a DMG; remove dmg: false");
+  if (spec.universal !== undefined && typeof spec.universal !== "boolean") fail("targets.mac.macPackage.universal must be a boolean");
+  if (spec.features !== undefined && (!Array.isArray(spec.features) || spec.features.some((f) => typeof f !== "string" || !/^[A-Za-z0-9_,:-]+$/.test(f)))) fail("targets.mac.macPackage.features must be Cargo feature names");
+  if (spec.triple !== undefined && !MAC_TRIPLES.includes(spec.triple)) fail(`targets.mac.macPackage.triple must be one of ${MAC_TRIPLES.join(", ")}`);
+  const cwd = spec.tauriCwd ?? ".";
+  if (typeof cwd !== "string" || path.isAbsolute(cwd) || cwd.split(/[\\/]/).includes("..")) fail("targets.mac.macPackage.tauriCwd must be a relative path inside the app");
+  const cleanupSpec = macCleanupSpec(spec.cleanup);
+  // Tauri's universal-apple-darwin target builds both slices and lipos them itself.
+  const triple = spec.triple ?? (spec.universal === false ? (process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin") : "universal-apple-darwin");
+  if (spec.triple !== undefined) {
+    const wrong = [...MAC_TRIPLES, "universal-apple-darwin"].find((other) => other !== triple && target.notarize.app.replaceAll("\\", "/").split("/").includes(other));
+    if (wrong) fail(`targets.mac.macPackage.triple is ${triple} but notarize.app is under ${wrong}; the built .app lives in the ${triple} directory`);
+  }
+  const override = { bundle: { createUpdaterArtifacts: false, macOS: { signingIdentity: null } } };
+  const extras = buildExtras(spec, "targets.mac.macPackage", { postBuild: true });
+  const args = ["exec", "tauri", "build", "--target", triple, "--bundles", "app", "--no-sign", ...configArgs(extras, appRoot, cwd), "--config", JSON.stringify(override)];
+  if (spec.features?.length) args.push("--features", spec.features.join(","));
+  args.push(...profileArgs(extras));
+  const mapPath = targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label: "targets.mac.macPackage" });
+  const app = mapPath(target.notarize.app);
+  const entryFile = (entry) => (typeof entry === "string" ? entry : entry?.file);
+  const declaredFiles = target.sign?.prePackageFiles ?? [target.notarize.app];
+  if (!declaredFiles.some((entry) => entryFile(entry) === target.notarize.app)) fail("targets.mac.macPackage: sign.prePackageFiles must include notarize.app");
+  const prePackageFiles = declaredFiles.map((entry) => (typeof entry === "string" ? mapPath(entry) : { ...entry, file: mapPath(entry.file) }));
+  // Built-in cleanup before the build: the bundle dir is where a stale .app lives; DMG volumes are named after the product.
+  const appPosix = app.replaceAll("\\", "/");
+  const productName = path.posix.basename(appPosix, ".app");
+  const volumes = [...new Set([productName, ...(isObject(target.dmg) && typeof target.dmg.volname === "string" ? [target.dmg.volname] : [])])];
+  const cleanup = cleanupSpec.staleApps || cleanupSpec.staleDmgVolumes || cleanupSpec.lsclean
+    ? {
+      ...(cleanupSpec.staleDmgVolumes ? { dmgVolumes: volumes } : {}),
+      ...(cleanupSpec.staleApps || cleanupSpec.lsclean ? { apps: { dir: path.posix.dirname(appPosix), remove: cleanupSpec.staleApps === true, unregister: cleanupSpec.lsclean === true } } : {}),
+    }
+    : undefined;
+  const wrapped = extras.prepare.length || extras.postBuild.length || cleanup;
+  const { macPackage, recipe: _ignoredMac, ...rest } = target;
+  return {
+    ...rest,
+    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
+    sign: { ...(target.sign ?? {}), prePackageFiles },
+    notarize: { ...target.notarize, app, appBeforePackage: true },
+    dmg: isObject(target.dmg) ? target.dmg : {},
+    recipe: { kind: "macPackage", universal: triple === "universal-apple-darwin" },
+  };
+}
+
+/** Expand whichever declarative package key the target carries. */
+export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot }) {
+  const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}) };
+  if (platform === "win") return expandWinPackageTarget(target, { appRoot, config, ...injected });
+  if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config, ...injected });
+  if (target?.winPackage || target?.macPackage) fail(`winPackage / macPackage are not valid on ${platform}`);
+  return target;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.172",
+  "version": "0.2.174",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/portable-development.mjs

@@ -1,15 +1,16 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
+import { stagingPathOf, swapInPlace } from "./in-place-install.mjs";
 
 const CHUNK_BYTES = 1024 * 1024;
 
 /**
  * Install an unsigned development payload in place at the fixed path `<installRoot>/current` (a real directory).
- * No versions/ folder, no digest folder, no symlink or junction. The previous copy is kept once, as
- * `<installRoot>/current.previous` (rename it back to roll back); nothing ever runs from it. A legacy `current`
- * symlink or junction from the old layout is moved aside to `.previous` the same way.
+ * No versions/ folder, no digest folder, no symlink or junction. NO old copy is kept (Orthic-Labs/rightkit#348): the
+ * old `current` is removed and the verified staging copy is renamed over it, and a stale `current.previous` left by an
+ * older RightKit is removed. A failed install leaves `current` absent or partial; reinstall from an older build. A
+ * legacy `current` symlink or junction from the old layout is removed the same way.
  */
 export function installPortableDevelopment(descriptor, { root, platform = process.platform, env = process.env } = {}) {
   const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}
@@ -33,7 +34,6 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     digest = digestTree(source);
     current = path.join(installRoot, "current");
     const staging = stagingPathOf(current);
-    const previous = previousPathOf(current);
     emit("STAGE", { sourceDirectory: source, current, staging, digest });
     if (exists(current) && !fs.lstatSync(current).isDirectory() && !fs.lstatSync(current).isSymbolicLink()) throw new Error(`development current is not a directory; refusing to replace: ${current}`);
 
@@ -49,15 +49,15 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     const sourceEntryDigest = hashFile(sourceEntrypoint);
     let entryDigest;
     swapInPlace({
-      staging, destination: current, previous,
+      staging, destination: current, previous: null,
       verify: (destination) => {
         entryDigest = hashFile(resolveContained(destination, descriptor.entrypoint, "entrypoint"));
         if (entryDigest !== sourceEntryDigest) throw new Error("development entrypoint readback did not match source");
       },
     });
-    emit("ACTIVATE", { current, previous });
-    emit("SUCCEEDED", { installRoot, current, previous, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
-    return { installRoot, current, previous, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
+    emit("ACTIVATE", { current });
+    emit("SUCCEEDED", { installRoot, current, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
+    return { installRoot, current, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
   } catch (error) {
     emit("FAILED", { installRoot: descriptor?.installRoot, current, digest, message: error?.message ?? String(error) });
     throw error;

package/project-type.mjs

@@ -40,4 +40,4 @@ export function targetUsesMsix(target) {
 }
 
 /** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
-export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));
+export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || Boolean(target?.winPackage || target?.macPackage) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/qa-build-features.mjs

@@ -10,6 +10,7 @@
 // Dev builds are unaffected: `development.mjs` never calls this.
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 
 export const FORBIDDEN_FEATURES = Object.freeze(["devtools", "content-devtools", "qa-native", "qa-control", "dev-native", "dev-inspect",
   // Per-app test-automation features (M20 owner gap): HeardRight `qa-shot`/`qa-tools`, ViewRight `dev-control`/`bench-native`.
@@ -206,7 +207,12 @@ export function buildFeatureIssues({ root, commands, devtools, cargoManifest, ma
   let scripts = {};
   try { scripts = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).scripts ?? {}; } catch { /* no package.json */ }
   const issues = [];
-  for (const { label, command } of commands) if (command) issues.push(...commandFeatureIssues(command, { label, scripts, allowDevtools }));
+  for (const { label, command } of commands) {
+    if (!command) continue;
+    // A `node recipe-build.mjs --plan <JSON>` wrapper hides every step's flags in one argument: scan each step too.
+    const expanded = expandRecipeBuildCommands(command, { root });
+    expanded.forEach((part, index) => issues.push(...commandFeatureIssues(part, { label: index === 0 ? label : `${label} -> recipe-build step ${index}`, scripts, allowDevtools })));
+  }
   const { rel } = resolveCargoManifestPath({ root, cargoManifest, manifest });
   if (rel) issues.push(...cargoManifestIssues(readFileSync(path.join(root, rel), "utf8"), rel, { allowDevtools }));
   return issues;