@rightkit/release 0.2.173 → 0.2.174

package/mac-signing-matrix.mjs

@@ -11,7 +11,7 @@
 // inside-out plan. It never runs codesign: sign-macos.mjs (via mac-sign-core.mjs) executes the plan.
 import { existsSync, lstatSync, openSync, closeSync, readSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
-import { expandMacSigningEntries, mainExecutableName } from "./mac-bundle-signing.mjs";
+import { expandMacSigningEntries, mainExecutableName, resolveNestedSigningSettings } from "./mac-bundle-signing.mjs";
 
 const invalid = (message) => Object.assign(new Error(message), { code: "MAC_SIGN_CONFIG_INVALID" });
 
@@ -85,11 +85,57 @@ function validateNestedKey(key) {
   return null;
 }
 
+// Per-path nested signing maps: `sign.identifiers`, `sign.identifierTemplate` and an object-valued `sign.entitlements`.
+// Same strictness as the per-item settings above: reverse-DNS identifiers, contained relative plist paths that exist.
+function validateNestedSigningMaps(sign, { root, errors, isFile }) {
+  const declared = {};
+  const check = (map, label, value) => {
+    if (!isPlainObject(map)) { errors.push(`${label} must be an object mapping bundle-relative paths or globs to values`); return; }
+    for (const [key, raw] of Object.entries(map)) {
+      const entry = `${label}[${JSON.stringify(key)}]`;
+      if (!key.trim() || key !== key.trim() || key.includes("\0") || key.includes("\\") || path.posix.isAbsolute(key) || /^[A-Za-z]:/.test(key) || key.split("/").includes("..")) {
+        errors.push(`${entry}: key must be a bundle-relative path (no "..", no absolute path, "/" separators)`);
+      }
+      value(raw, entry);
+    }
+  };
+  if (sign.identifiers !== undefined) {
+    check(sign.identifiers, "sign.identifiers", (raw, entry) => {
+      if (typeof raw !== "string" || !IDENTIFIER_PATTERN.test(raw)) errors.push(`${entry} must be 1-255 characters of letters, digits, '.' and '-', starting with a letter or digit`);
+    });
+    declared.identifiers = sign.identifiers;
+  }
+  if (sign.identifierTemplate !== undefined) {
+    const template = sign.identifierTemplate;
+    if (typeof template !== "string" || !template) errors.push("sign.identifierTemplate must be a non-empty string such as \"<bundleId>.runtime.<relpath>\"");
+    else if (!/^[A-Za-z0-9.-]*$/.test(template.replace(/<[^<>]*>/g, ""))) errors.push("sign.identifierTemplate literal text may only contain letters, digits, '.' and '-' around <bundleId>, <relpath> and <basename>");
+    else declared.identifierTemplate = template;
+  }
+  if (isPlainObject(sign.entitlements)) {
+    check(sign.entitlements, "sign.entitlements", (raw, entry) => {
+      if (typeof raw !== "string" || !raw.trim()) { errors.push(`${entry} must be a non-empty path string`); return; }
+      if (path.isAbsolute(raw) || /^[A-Za-z]:/.test(raw) || raw.includes("\0")) { errors.push(`${entry} must be relative to the release config directory: ${raw}`); return; }
+      const resolved = path.resolve(root, raw);
+      const relative = path.relative(root, resolved);
+      if (relative.startsWith("..") || path.isAbsolute(relative)) errors.push(`${entry} must stay inside the release config directory: ${raw}`);
+      else if (!isFile(resolved)) errors.push(`${entry} entitlements file not found: ${raw}`);
+      else if (!looksLikePlist(resolved)) errors.push(`${entry} is not a property list (expected an XML or binary plist): ${raw}`);
+    });
+    declared.entitlements = sign.entitlements;
+  }
+  if (errors.length || !Object.keys(declared).length) return undefined;
+  // Delegate key globs and template tokens to the shared resolver so release and development read them identically.
+  try { resolveNestedSigningSettings([], { app: "x.app", sign: declared, bundleId: "a.b", root, exists: () => true }); }
+  catch (error) { errors.push(error.message); return undefined; }
+  return declared;
+}
+
 /**
  * Validate and normalize `sign` for a macOS target. Collects every problem, then throws one
- * MAC_SIGN_CONFIG_INVALID error. Returns { entries, nestedCode } where
- *   entries:    [{ file, identifier?, entitlements?: absolute, options: [] }]   (file stays as declared)
- *   nestedCode: [{ key, identifier?, entitlements?: absolute, options: [] }]
+ * MAC_SIGN_CONFIG_INVALID error. Returns { entries, nestedCode, nestedSigning? } where
+ *   entries:       [{ file, identifier?, entitlements?: absolute, options: [] }]   (file stays as declared)
+ *   nestedCode:    [{ key, identifier?, entitlements?: absolute, options: [] }]
+ *   nestedSigning: { identifiers?, identifierTemplate?, entitlements? } as declared; present only when one is declared
  * Injectable: isFile.
  */
 export function validateMacSigningConfig(sign, { root, isFile = (file) => existsSync(file) && statSync(file).isFile() } = {}) {
@@ -136,8 +182,10 @@ export function validateMacSigningConfig(sign, { root, isFile = (file) => exists
       }
     }
   }
+  const nestedSigning = validateNestedSigningMaps(sign, context);
+  if (nestedSigning && !entries.some((entry) => /\.app\/?$/.test(entry.file))) errors.push("sign.identifiers, sign.identifierTemplate and per-path sign.entitlements need a .app entry in sign.prePackageFiles to resolve their paths against");
   if (errors.length) throw invalid(`invalid macOS signing configuration:\n${errors.map((line) => `- ${line}`).join("\n")}`);
-  return { entries, nestedCode };
+  return { entries, nestedCode, ...(nestedSigning ? { nestedSigning } : {}) };
 }
 
 /** True when an entry or nested item carries anything beyond the default (hardened runtime, no entitlements). */
@@ -154,7 +202,7 @@ const depth = (file) => file.split(path.sep).length;
  * a nestedCode path is missing, is a symlink, escapes the bundle, or names the bundle's main executable.
  * Injectable: expand, lstat, realpath, mainName.
  */
-export function planMacSigning({ entries, nestedCode = [], expand = expandMacSigningEntries, lstat = lstatSync, realpath = realpathSync, mainName = mainExecutableName }) {
+export function planMacSigning({ entries, nestedCode = [], nestedSigning, root, resolveSettings = resolveNestedSigningSettings, expand = expandMacSigningEntries, lstat = lstatSync, realpath = realpathSync, mainName = mainExecutableName }) {
   const { nested: discovered } = expand(entries.map((entry) => entry.file));
   const byPath = new Map(discovered.map((file) => [file, { file, options: [] }]));
   if (nestedCode.length) {
@@ -174,6 +222,25 @@ export function planMacSigning({ entries, nestedCode = [], expand = expandMacSig
       byPath.set(file, { file, ...(item.identifier ? { identifier: item.identifier } : {}), ...(item.entitlements ? { entitlements: item.entitlements } : {}), options: item.options });
     }
   }
+  // Per-path maps (sign.identifiers / identifierTemplate / per-path sign.entitlements) fill in only what a nestedCode item left
+  // unset. Nothing declared: this block is skipped and the items stay exactly as discovered.
+  if (nestedSigning && Object.keys(nestedSigning).length) {
+    const apps = entries.map((entry) => entry.file).filter((file) => /\.app\/?$/.test(file)).map((file) => file.replace(/\/+$/, ""));
+    for (const app of apps) {
+      const own = [...byPath.values()].filter((item) => item.file.startsWith(app + path.sep) || item.file.startsWith(`${app}/`));
+      let settings;
+      try { settings = resolveSettings(own.map((item) => item.file), { app, sign: nestedSigning, root: root ?? process.cwd() }); }
+      catch (error) { throw invalid(error.message); }
+      for (const item of own) {
+        const found = settings.get(item.file);
+        if (!found) continue;
+        const identifier = item.identifier ?? found.identifier;
+        if (identifier !== undefined && !IDENTIFIER_PATTERN.test(identifier)) throw invalid(`signing identifier for ${path.relative(app, item.file)} must be letters, digits, '.' and '-': ${JSON.stringify(identifier)}`);
+        const entitlements = item.entitlements ?? found.entitlements;
+        byPath.set(item.file, { ...item, ...(identifier !== undefined ? { identifier } : {}), ...(entitlements ? { entitlements } : {}) });
+      }
+    }
+  }
   const nested = [...byPath.values()].sort((a, b) => depth(b.file) - depth(a.file) || a.file.localeCompare(b.file));
   return { nested, top: entries };
 }

package/macos-signing-session.mjs

@@ -5,7 +5,7 @@ import { spawnSync } from "./background-process.mjs";
 
 import { requestSigningAgentSync, validateNotaryAgentReport } from "./signing-agent-client.mjs";
 import { installSigningAgent, requireMacGuiSession } from "./signing-agent-install.mjs";
-import { signingAgentPaths, defaultSigningRoots, ensurePrivateDirectory, privatePath, within, NOTARIZATION_TIMEOUT_MS, MAX_NOTARIZATION_TIMEOUT_MS } from "./rightkit-signing-agent.mjs";
+import { signingAgentPaths, defaultSigningRoots, ensurePrivateDirectory, privatePath, within, NOTARIZATION_TIMEOUT_MS, MAX_NOTARIZATION_TIMEOUT_MS, AGENT_IDENTIFIER_PATTERN, CODESIGN_IDENTIFIER_SCHEMA } from "./rightkit-signing-agent.mjs";
 import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
 
 export class MacSigningSessionError extends Error {
@@ -48,11 +48,13 @@ export function codesignAgentItems(commands) {
       else if (option === "--timestamp" && item.timestamp === undefined) item.timestamp = true;
       else if (option === "--options" && args[i + 1] === "runtime" && item.runtime === undefined) { item.runtime = true; i++; }
       else if (option === "--sign" && item.identity === undefined) item.identity = args[++i];
+      else if (option === "--identifier" && item.identifier === undefined) item.identifier = args[++i];
       else if (option === "--entitlements" && item.entitlements === undefined) item.entitlements = args[++i];
       else if (option === "--preserve-metadata=entitlements" && item.preserveEntitlements === undefined) item.preserveEntitlements = true;
       else throw new TypeError(`Unsupported agent codesign option: ${option}`);
     }
     item.path = args.at(-1);
+    if (item.identifier !== undefined && !AGENT_IDENTIFIER_PATTERN.test(item.identifier)) throw new TypeError("Agent signing requires a reverse-DNS codesign identifier");
     if (!item.identity || item.identity === "-" || !path.isAbsolute(item.path ?? "")
       || (item.entitlements !== undefined && !path.isAbsolute(item.entitlements))) throw new TypeError("Agent signing requires real identity & absolute paths");
     return item;
@@ -76,6 +78,8 @@ export function runMacGuiSigning({ kind, commands, files, cwd = process.cwd(), e
   try {
     if (kind === "codesign") {
       plan.items = codesignAgentItems(commands);
+      // Only a request that carries a typed identifier uses schema 2; every other codesign request stays schema 1.
+      if (plan.items.some((item) => item.identifier !== undefined)) plan.schema = CODESIGN_IDENTIFIER_SCHEMA;
       // Development signing generates entitlements in TMPDIR. Copy only those
       // plist bytes into managed private staging, never broaden signing roots.
       for (const item of plan.items) {
@@ -99,7 +103,13 @@ export function runMacGuiSigning({ kind, commands, files, cwd = process.cwd(), e
     let report;
     try { report = request(plan, clientOptions); }
     catch (error) {
-      if (error.code !== "MAC_SIGNING_AGENT_UNAVAILABLE") throw error;
+      let missing = error.code === "MAC_SIGNING_AGENT_UNAVAILABLE";
+      // An installed agent that predates typed identifiers refuses schema 2: upgrade it once, never loop on a rejected request.
+      if (!missing && plan.schema === CODESIGN_IDENTIFIER_SCHEMA && error.code === "MAC_SIGNING_AGENT_PROTOCOL") {
+        const health = request({ schema: 1, type: "health" }, { home, timeoutMs: 1500 });
+        missing = !health.capabilities?.includes("codesign-identifier");
+      }
+      if (!missing) throw error;
       requireMacGuiSession({ run, uid });
       install({ home, username, uid, run, io, managedRoot: env.RIGHTKIT_MANAGED_ROOT });
       report = request(plan, clientOptions); // One install attempt, one retry.

package/package-recipe-targets.mjs

@@ -4,7 +4,10 @@
 // marker patch before signing, raw-EXE and installer Authenticode, the NSIS embedding verification, Developer ID
 // signing of the .app and its nested code, app notarization before packing, the signed DMG and its notarization.
 // The standalone recipes (win-package-recipe.mjs, mac-package-recipe.mjs) hold the same steps for direct callers.
+import { existsSync } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
 
 export class PackageRecipeTargetError extends Error {
@@ -21,40 +24,163 @@ const withoutRecipe = (target) => {
   return rest;
 };
 const QUIET_TAURI_ENV = { TAURI_SIGNING_PRIVATE_KEY: "", TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" };
+const RECIPE_BUILD = fileURLToPath(new URL("./recipe-build.mjs", import.meta.url));
+const PROFILE = /^[a-z][a-z0-9_-]*$/;
+
+function relativeInside(value, label) {
+  if (typeof value !== "string" || !value.trim()) fail(`${label} must be a non-empty relative path`);
+  const normalized = value.replaceAll("\\", "/");
+  if (path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.split("/").includes("..")) fail(`${label} must be relative and stay inside the app: ${value}`);
+  return normalized;
+}
+
+/** `prepare` / `postBuild`: a list of { cmd, args?, cwd? } argv commands (no shell). */
+function commandList(value, label) {
+  if (!Array.isArray(value)) fail(`${label} must be an array of { cmd, args?, cwd? }`);
+  return value.map((item, index) => {
+    const where = `${label}[${index}]`;
+    if (!isObject(item)) fail(`${where} must be an object`);
+    const unknown = Object.keys(item).filter((key) => !["cmd", "args", "cwd"].includes(key));
+    if (unknown.length) fail(`${where} has unknown key(s): ${unknown.join(", ")} (allowed: cmd, args, cwd)`);
+    if (typeof item.cmd !== "string" || !item.cmd.trim()) fail(`${where}.cmd must be a non-empty string`);
+    if (item.args !== undefined && (!Array.isArray(item.args) || item.args.some((arg) => typeof arg !== "string"))) fail(`${where}.args must be a list of strings`);
+    return { cmd: item.cmd, args: [...(item.args ?? [])], ...(item.cwd === undefined ? {} : { cwd: relativeInside(item.cwd, `${where}.cwd`) }) };
+  });
+}
+
+/** The keys shared by winPackage and macPackage: profile, tauriConfig, prepare (and postBuild where allowed). */
+function buildExtras(spec, label, { postBuild }) {
+  if (spec.profile !== undefined && (typeof spec.profile !== "string" || !PROFILE.test(spec.profile))) fail(`${label}.profile must be a Cargo profile name`);
+  const tauriConfig = spec.tauriConfig === undefined ? undefined : relativeInside(spec.tauriConfig, `${label}.tauriConfig`);
+  if (tauriConfig && !/\.json$/i.test(tauriConfig)) fail(`${label}.tauriConfig must be a .json file`);
+  return {
+    profile: spec.profile,
+    tauriConfig,
+    prepare: spec.prepare === undefined ? [] : commandList(spec.prepare, `${label}.prepare`),
+    postBuild: !postBuild || spec.postBuild === undefined ? [] : commandList(spec.postBuild, `${label}.postBuild`),
+  };
+}
+
+/** Tauri v2 passes Cargo flags after `--`; the profile also decides where Tauri looks for the built binary. */
+const profileArgs = (extras) => (extras.profile ? ["--", "--profile", extras.profile] : []);
+/** The build command also takes `--jobs N` (Cargo parallelism), after the same `--`. */
+const buildCargoArgs = (extras, jobs) => {
+  const flags = [...(extras.profile ? ["--profile", extras.profile] : []), ...(jobs ? ["--jobs", String(jobs)] : [])];
+  return flags.length ? ["--", ...flags] : [];
+};
+const configArgs = (extras, appRoot, cwd) => (extras.tauriConfig ? ["--config", path.relative(path.resolve(appRoot, cwd), path.resolve(appRoot, extras.tauriConfig)).split(path.sep).join("/")] : []);
+
+/**
+ * release.mjs runs ONE prePackage command: node recipe-build.mjs runs the built-in cleanup, prepare, the Tauri build,
+ * the artifact stability poll and postBuild in order. `cleanup` and `stability` are recipe-build plan sections.
+ */
+function recipeBuildCommand({ extras, build, env, cleanup, stability, timeoutMs }) {
+  const steps = [
+    ...extras.prepare.map((step) => ({ phase: "prepare", ...step })),
+    { phase: "build", cmd: build.cmd, args: build.args, cwd: build.cwd },
+    ...extras.postBuild.map((step) => ({ phase: "postBuild", ...step })),
+  ];
+  const plan = { version: 1, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}) };
+  return { cmd: process.execPath, args: [RECIPE_BUILD, "--plan", JSON.stringify(plan)], env, ...(timeoutMs ? { timeoutMs } : {}) };
+}
+
+const DEFAULT_WIN_TIMEOUT_MS = 20 * 60 * 1000;
+const positiveInt = (value) => Number.isInteger(value) && value > 0;
+
+/**
+ * Managed Cargo target roots. Artifact paths in a target are declared (and default) under `<cargo dir>/target/...`.
+ * With `cargoTargetRoot` (true: <tauriCwd>/src-tauri/Cargo.toml; or an app-relative Cargo.toml path) or CARGO_TARGET_DIR set
+ * (default manifest), `cargo metadata`'s target_directory is resolved and every declared path under the default
+ * `<cargo dir>/target/` is moved to the real directory. release.mjs needs app-relative paths with no `..`, so a target
+ * directory outside the app fails closed (use RIGHT_RELEASE_ARTIFACT_DIR for copies, see the docs).
+ */
+function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label }) {
+  const explicit = spec.cargoTargetRoot;
+  if (explicit !== undefined && explicit !== true && explicit !== false && typeof explicit !== "string") fail(`${label}.cargoTargetRoot must be true or an app-relative Cargo.toml path`);
+  const envDir = typeof env.CARGO_TARGET_DIR === "string" && env.CARGO_TARGET_DIR.trim() !== "";
+  if (explicit === false || (!explicit && !envDir)) return (declared) => declared;
+  const manifestRel = typeof explicit === "string" ? relativeInside(explicit, `${label}.cargoTargetRoot`) : path.posix.join(cwd === "." ? "" : cwd, "src-tauri", "Cargo.toml");
+  const manifest = path.resolve(appRoot, manifestRel);
+  if (typeof explicit !== "string" && explicit !== true && !existsSync(manifest)) return (declared) => declared;
+  let targetDir;
+  try { targetDir = resolveTargetRoot(manifest); } catch (error) { fail(`${label}: cannot resolve the Cargo target directory (${error.message})`); }
+  const prefix = path.posix.join(path.posix.dirname(manifestRel).replace(/^\.$/, ""), "target");
+  return (declared) => {
+    const normalized = String(declared).replaceAll("\\", "/");
+    if (!normalized.startsWith(`${prefix}/`)) return declared;
+    const moved = path.resolve(targetDir, normalized.slice(prefix.length + 1));
+    const relative = path.relative(appRoot, moved).split(path.sep).join("/");
+    if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative) || /^[A-Za-z]:/.test(relative)) {
+      fail(`${label}: the Cargo target directory ${targetDir} is outside the app, so ${declared} cannot be addressed by an app-relative path; point CARGO_TARGET_DIR inside the app or declare the artifact paths yourself`);
+    }
+    return relative;
+  };
+}
+
+function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability }) {
+  const args = ["exec", "tauri", "build", "--no-bundle", "--target", triple, ...configArgs(extras, appRoot, cwd), ...buildCargoArgs(extras, jobs)];
+  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, timeoutMs });
+}
 
 /** `targets.win.winPackage` → prePackage (`tauri build --no-bundle`) and package (`tauri bundle --bundles nsis`). */
-export function expandWinPackageTarget(target, { appRoot, config = {} }) {
+export function expandWinPackageTarget(target, { appRoot, config = {}, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
   if (!target?.winPackage) return withoutRecipe(target);
   if (target.prePackage !== undefined) fail("targets.win.winPackage replaces prePackage; remove the prePackage script");
   if (target.winPackage.sidecars !== undefined) fail("targets.win.winPackage.sidecars is not supported in a right-release target: declare sidecars through externalBin or mediaSidecar, which release.mjs signs with the raw EXE");
+  if (!isObject(target.winPackage)) fail("targets.win.winPackage must be an object");
+  const { profile: _p, tauriConfig: _t, prepare: _pr, postBuild, jobs, timeoutMs, cleanStale, cargoTargetRoot: _c, ...coreSpec } = target.winPackage;
+  if (postBuild !== undefined) fail("targets.win.winPackage.postBuild is not supported: release.mjs signs the raw EXE between the build and the bundle; use prepare");
+  if (jobs !== undefined && !positiveInt(jobs)) fail("targets.win.winPackage.jobs must be a positive integer (Cargo --jobs)");
+  if (timeoutMs !== undefined && !positiveInt(timeoutMs)) fail("targets.win.winPackage.timeoutMs must be a positive integer (milliseconds)");
+  if (cleanStale !== undefined && typeof cleanStale !== "boolean") fail("targets.win.winPackage.cleanStale must be a boolean");
+  const extras = buildExtras(target.winPackage, "targets.win.winPackage", { postBuild: false });
   let plan;
-  try { plan = validateWinPackage({ appRoot, config, target }); } catch (error) {
+  try { plan = validateWinPackage({ appRoot, config, target: { ...target, winPackage: coreSpec } }); } catch (error) {
     if (error instanceof WinPackageConfigError) fail(`targets.win.winPackage: ${(error.issues ?? [error.message]).join("; ")}`);
     throw error;
   }
   if (target.signingContract !== undefined && target.signingContract !== "windows-raw-exe-authenticode-before-nsis-v1") fail(`targets.win.winPackage builds an NSIS installer; signingContract must be windows-raw-exe-authenticode-before-nsis-v1, got ${target.signingContract}`);
   const cwd = rel(plan.appRoot, plan.tauriCwd) || ".";
   const override = { bundle: { createUpdaterArtifacts: false, windows: { nsis: { installMode: plan.perMachine ? "perMachine" : "currentUser" } } } };
+  const mapPath = targetRootMapper({ spec: target.winPackage, appRoot: plan.appRoot, cwd, env, resolveTargetRoot, label: "targets.win.winPackage" });
+  const rawExe = mapPath(rel(plan.appRoot, plan.rawExe));
+  const installerFile = mapPath(rel(plan.appRoot, plan.installerFile));
+  // Stale outputs are removed before the build, and the raw EXE is polled until it stops changing after it.
+  const cleanup = cleanStale === false ? undefined : { remove: [rawExe, installerFile] };
+  const timeout = timeoutMs ?? DEFAULT_WIN_TIMEOUT_MS;
   // `recipe` is set only here: a hand-written one is dropped so it can never select a recipe path.
   const { winPackage, recipe: _ignoredWin, ...rest } = target;
   return {
     ...rest,
     signingContract: "windows-raw-exe-authenticode-before-nsis-v1",
-    prePackage: { cmd: "pnpm", args: ["exec", "tauri", "build", "--no-bundle", "--target", plan.triple], cwd, env: QUIET_TAURI_ENV },
-    package: { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", plan.triple, "--config", JSON.stringify(override)], cwd, env: QUIET_TAURI_ENV },
-    sign: { ...(target.sign ?? {}), prePackageFiles: [rel(plan.appRoot, plan.rawExe)], files: [rel(plan.appRoot, plan.installerFile)] },
+    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] } }),
+    package: { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", plan.triple, ...configArgs(extras, plan.appRoot, cwd), "--config", JSON.stringify(override), ...profileArgs(extras)], cwd, env: QUIET_TAURI_ENV, timeoutMs: timeout },
+    sign: { ...(target.sign ?? {}), prePackageFiles: [rawExe], files: [installerFile] },
     recipe: { kind: "winPackage", productName: plan.productName, updater: plan.updater },
   };
 }
 
-const MAC_KEYS = new Set(["universal", "tauriCwd", "features"]);
+const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot"]);
+const MAC_TRIPLES = ["aarch64-apple-darwin", "x86_64-apple-darwin"];
+const MAC_CLEANUP_KEYS = new Set(["staleApps", "staleDmgVolumes", "lsclean"]);
+
+function macCleanupSpec(value) {
+  if (value === undefined) return {};
+  if (!isObject(value)) fail("targets.mac.macPackage.cleanup must be an object");
+  const unknown = Object.keys(value).filter((key) => !MAC_CLEANUP_KEYS.has(key));
+  if (unknown.length) fail(`targets.mac.macPackage.cleanup has unknown key(s): ${unknown.join(", ")} (allowed: ${[...MAC_CLEANUP_KEYS].join(", ")})`);
+  for (const key of MAC_CLEANUP_KEYS) if (value[key] !== undefined && typeof value[key] !== "boolean") fail(`targets.mac.macPackage.cleanup.${key} must be a boolean`);
+  return value;
+}
 
 /**
  * `targets.mac.macPackage` → prePackage (`tauri build --bundles app`, universal by default), the .app as the
  * Developer ID signing set, app notarization before packing, and right-release's own signed DMG from the stapled app.
  * The app path and DMG path are `notarize.app` and `notarize.file`; DMG branding is `targets.mac.dmg`.
+ * Architecture: `triple` (an explicit arch triple) beats `universal`; `universal: false` means this host's arch.
+ * `cleanup` runs built-in steps in recipe-build before the build (stale DMG volumes, stale .app bundles, lsregister).
  */
-export function expandMacPackageTarget(target, { appRoot }) {
+export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
   if (!target?.macPackage) return withoutRecipe(target);
   const spec = target.macPackage;
   if (!isObject(spec)) fail("targets.mac.macPackage must be an object");
@@ -66,30 +192,54 @@ export function expandMacPackageTarget(target, { appRoot }) {
   if (target.dmg === false) fail("targets.mac.macPackage always builds a DMG; remove dmg: false");
   if (spec.universal !== undefined && typeof spec.universal !== "boolean") fail("targets.mac.macPackage.universal must be a boolean");
   if (spec.features !== undefined && (!Array.isArray(spec.features) || spec.features.some((f) => typeof f !== "string" || !/^[A-Za-z0-9_,:-]+$/.test(f)))) fail("targets.mac.macPackage.features must be Cargo feature names");
+  if (spec.triple !== undefined && !MAC_TRIPLES.includes(spec.triple)) fail(`targets.mac.macPackage.triple must be one of ${MAC_TRIPLES.join(", ")}`);
   const cwd = spec.tauriCwd ?? ".";
   if (typeof cwd !== "string" || path.isAbsolute(cwd) || cwd.split(/[\\/]/).includes("..")) fail("targets.mac.macPackage.tauriCwd must be a relative path inside the app");
+  const cleanupSpec = macCleanupSpec(spec.cleanup);
   // Tauri's universal-apple-darwin target builds both slices and lipos them itself.
-  const triple = spec.universal === false ? (process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin") : "universal-apple-darwin";
+  const triple = spec.triple ?? (spec.universal === false ? (process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin") : "universal-apple-darwin");
+  if (spec.triple !== undefined) {
+    const wrong = [...MAC_TRIPLES, "universal-apple-darwin"].find((other) => other !== triple && target.notarize.app.replaceAll("\\", "/").split("/").includes(other));
+    if (wrong) fail(`targets.mac.macPackage.triple is ${triple} but notarize.app is under ${wrong}; the built .app lives in the ${triple} directory`);
+  }
   const override = { bundle: { createUpdaterArtifacts: false, macOS: { signingIdentity: null } } };
-  const args = ["exec", "tauri", "build", "--target", triple, "--bundles", "app", "--no-sign", "--config", JSON.stringify(override)];
+  const extras = buildExtras(spec, "targets.mac.macPackage", { postBuild: true });
+  const args = ["exec", "tauri", "build", "--target", triple, "--bundles", "app", "--no-sign", ...configArgs(extras, appRoot, cwd), "--config", JSON.stringify(override)];
   if (spec.features?.length) args.push("--features", spec.features.join(","));
-  const prePackageFiles = target.sign?.prePackageFiles ?? [target.notarize.app];
-  if (!prePackageFiles.some((entry) => (typeof entry === "string" ? entry : entry?.file) === target.notarize.app)) fail("targets.mac.macPackage: sign.prePackageFiles must include notarize.app");
+  args.push(...profileArgs(extras));
+  const mapPath = targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label: "targets.mac.macPackage" });
+  const app = mapPath(target.notarize.app);
+  const entryFile = (entry) => (typeof entry === "string" ? entry : entry?.file);
+  const declaredFiles = target.sign?.prePackageFiles ?? [target.notarize.app];
+  if (!declaredFiles.some((entry) => entryFile(entry) === target.notarize.app)) fail("targets.mac.macPackage: sign.prePackageFiles must include notarize.app");
+  const prePackageFiles = declaredFiles.map((entry) => (typeof entry === "string" ? mapPath(entry) : { ...entry, file: mapPath(entry.file) }));
+  // Built-in cleanup before the build: the bundle dir is where a stale .app lives; DMG volumes are named after the product.
+  const appPosix = app.replaceAll("\\", "/");
+  const productName = path.posix.basename(appPosix, ".app");
+  const volumes = [...new Set([productName, ...(isObject(target.dmg) && typeof target.dmg.volname === "string" ? [target.dmg.volname] : [])])];
+  const cleanup = cleanupSpec.staleApps || cleanupSpec.staleDmgVolumes || cleanupSpec.lsclean
+    ? {
+      ...(cleanupSpec.staleDmgVolumes ? { dmgVolumes: volumes } : {}),
+      ...(cleanupSpec.staleApps || cleanupSpec.lsclean ? { apps: { dir: path.posix.dirname(appPosix), remove: cleanupSpec.staleApps === true, unregister: cleanupSpec.lsclean === true } } : {}),
+    }
+    : undefined;
+  const wrapped = extras.prepare.length || extras.postBuild.length || cleanup;
   const { macPackage, recipe: _ignoredMac, ...rest } = target;
   return {
     ...rest,
-    prePackage: { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
+    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
     sign: { ...(target.sign ?? {}), prePackageFiles },
-    notarize: { ...target.notarize, appBeforePackage: true },
+    notarize: { ...target.notarize, app, appBeforePackage: true },
     dmg: isObject(target.dmg) ? target.dmg : {},
     recipe: { kind: "macPackage", universal: triple === "universal-apple-darwin" },
   };
 }
 
 /** Expand whichever declarative package key the target carries. */
-export function expandPackageRecipeTarget(target, { platform, appRoot, config }) {
-  if (platform === "win") return expandWinPackageTarget(target, { appRoot, config });
-  if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config });
+export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot }) {
+  const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}) };
+  if (platform === "win") return expandWinPackageTarget(target, { appRoot, config, ...injected });
+  if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config, ...injected });
   if (target?.winPackage || target?.macPackage) fail(`winPackage / macPackage are not valid on ${platform}`);
   return target;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.173",
+  "version": "0.2.174",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/portable-development.mjs

@@ -1,15 +1,16 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
+import { stagingPathOf, swapInPlace } from "./in-place-install.mjs";
 
 const CHUNK_BYTES = 1024 * 1024;
 
 /**
  * Install an unsigned development payload in place at the fixed path `<installRoot>/current` (a real directory).
- * No versions/ folder, no digest folder, no symlink or junction. The previous copy is kept once, as
- * `<installRoot>/current.previous` (rename it back to roll back); nothing ever runs from it. A legacy `current`
- * symlink or junction from the old layout is moved aside to `.previous` the same way.
+ * No versions/ folder, no digest folder, no symlink or junction. NO old copy is kept (Orthic-Labs/rightkit#348): the
+ * old `current` is removed and the verified staging copy is renamed over it, and a stale `current.previous` left by an
+ * older RightKit is removed. A failed install leaves `current` absent or partial; reinstall from an older build. A
+ * legacy `current` symlink or junction from the old layout is removed the same way.
  */
 export function installPortableDevelopment(descriptor, { root, platform = process.platform, env = process.env } = {}) {
   const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}
@@ -33,7 +34,6 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     digest = digestTree(source);
     current = path.join(installRoot, "current");
     const staging = stagingPathOf(current);
-    const previous = previousPathOf(current);
     emit("STAGE", { sourceDirectory: source, current, staging, digest });
     if (exists(current) && !fs.lstatSync(current).isDirectory() && !fs.lstatSync(current).isSymbolicLink()) throw new Error(`development current is not a directory; refusing to replace: ${current}`);
 
@@ -49,15 +49,15 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     const sourceEntryDigest = hashFile(sourceEntrypoint);
     let entryDigest;
     swapInPlace({
-      staging, destination: current, previous,
+      staging, destination: current, previous: null,
       verify: (destination) => {
         entryDigest = hashFile(resolveContained(destination, descriptor.entrypoint, "entrypoint"));
         if (entryDigest !== sourceEntryDigest) throw new Error("development entrypoint readback did not match source");
       },
     });
-    emit("ACTIVATE", { current, previous });
-    emit("SUCCEEDED", { installRoot, current, previous, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
-    return { installRoot, current, previous, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
+    emit("ACTIVATE", { current });
+    emit("SUCCEEDED", { installRoot, current, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
+    return { installRoot, current, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
   } catch (error) {
     emit("FAILED", { installRoot: descriptor?.installRoot, current, digest, message: error?.message ?? String(error) });
     throw error;

package/qa-build-features.mjs

@@ -10,6 +10,7 @@
 // Dev builds are unaffected: `development.mjs` never calls this.
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 
 export const FORBIDDEN_FEATURES = Object.freeze(["devtools", "content-devtools", "qa-native", "qa-control", "dev-native", "dev-inspect",
   // Per-app test-automation features (M20 owner gap): HeardRight `qa-shot`/`qa-tools`, ViewRight `dev-control`/`bench-native`.
@@ -206,7 +207,12 @@ export function buildFeatureIssues({ root, commands, devtools, cargoManifest, ma
   let scripts = {};
   try { scripts = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).scripts ?? {}; } catch { /* no package.json */ }
   const issues = [];
-  for (const { label, command } of commands) if (command) issues.push(...commandFeatureIssues(command, { label, scripts, allowDevtools }));
+  for (const { label, command } of commands) {
+    if (!command) continue;
+    // A `node recipe-build.mjs --plan <JSON>` wrapper hides every step's flags in one argument: scan each step too.
+    const expanded = expandRecipeBuildCommands(command, { root });
+    expanded.forEach((part, index) => issues.push(...commandFeatureIssues(part, { label: index === 0 ? label : `${label} -> recipe-build step ${index}`, scripts, allowDevtools })));
+  }
   const { rel } = resolveCargoManifestPath({ root, cargoManifest, manifest });
   if (rel) issues.push(...cargoManifestIssues(readFileSync(path.join(root, rel), "utf8"), rel, { allowDevtools }));
   return issues;