@rightkit/release 0.2.174 → 0.4.0

package/macho-approval-hash.mjs

@@ -0,0 +1,181 @@
+// Signing-independent approval hashes for staged prebuilt binaries (Orthic-Labs/rightkit#490).
+//
+// `raw-sha256`                        the sha256 of the file bytes (Windows and Linux binaries).
+// `macho-codesign-strip-linkedit-v1`  the sha256 of a thin little-endian 64-bit Mach-O after its code signature is removed:
+//                                      LC_CODE_SIGNATURE and the trailing signature blob are gone, the __LINKEDIT filesize is
+//                                      whatever `codesign --remove-signature` leaves, and the __LINKEDIT vmsize is normalised to
+//                                      the page-rounded filesize, so a signed and an unsigned copy of the same build hash alike.
+//
+// This is the algorithm GenRight's `local-image-approval-hash.mjs` recorded as `approval_hash_algorithm` in its runtime
+// manifest, moved here so apps stop carrying it. Every layout surprise (a fat or big-endian file, a duplicate or non-terminal
+// signature, a load command that changed, padding that is not zero) is a typed refusal, never a guess. The signature is removed
+// from a private copy with `/usr/bin/codesign --remove-signature`; the input file is never modified. macOS only for Mach-O.
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, lstatSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+
+export const APPROVAL_RAW_SHA256 = "raw-sha256";
+export const APPROVAL_MACHO_STRIP_LINKEDIT_V1 = "macho-codesign-strip-linkedit-v1";
+export const APPROVAL_ALGORITHMS = Object.freeze([APPROVAL_RAW_SHA256, APPROVAL_MACHO_STRIP_LINKEDIT_V1]);
+
+const LC_CODE_SIGNATURE = 0x1d;
+const LC_SEGMENT_64 = 0x19;
+const MH_MAGIC_64 = 0xfeedfacf;
+const CPU_TYPE_X86_64 = 0x01000007;
+const CPU_TYPE_ARM64 = 0x0100000c;
+
+export class ApprovalHashError extends Error {
+  constructor(code, message) { super(message); this.name = "ApprovalHashError"; this.code = code; }
+}
+const fail = (message, code = "APPROVAL_HASH_INVALID_MACHO") => { throw new ApprovalHashError(code, `backend integrity: ${message}`); };
+
+/** Parse a thin 64-bit little-endian Mach-O. Exported for tests. */
+export function parseMachO(bytes) {
+  if (bytes.length < 32 || bytes.readUInt32LE(0) !== MH_MAGIC_64) fail("only little-endian 64-bit thin Mach-O is supported");
+  const cpuType = bytes.readUInt32LE(4);
+  if (![CPU_TYPE_X86_64, CPU_TYPE_ARM64].includes(cpuType)) fail("unsupported Mach-O CPU type");
+  const ncmds = bytes.readUInt32LE(16);
+  const sizeofcmds = bytes.readUInt32LE(20);
+  const commandEnd = 32 + sizeofcmds;
+  if (ncmds > 65_536 || commandEnd > bytes.length || sizeofcmds > bytes.length / 2) fail("invalid Mach-O load command table");
+  let cursor = 32;
+  let signature = null;
+  let linkedit = null;
+  const normalizedCommands = [];
+  for (let index = 0; index < ncmds; index += 1) {
+    if (cursor + 8 > commandEnd) fail("truncated Mach-O load command");
+    const command = bytes.readUInt32LE(cursor);
+    const commandSize = bytes.readUInt32LE(cursor + 4);
+    if (commandSize < 8 || commandSize % 4 !== 0 || cursor + commandSize > commandEnd) fail("invalid Mach-O load command size");
+    const commandBytes = Buffer.from(bytes.subarray(cursor, cursor + commandSize));
+    if (command === LC_CODE_SIGNATURE) {
+      if (commandSize !== 16 || signature) fail("invalid duplicate code signature command");
+      const offset = bytes.readUInt32LE(cursor + 8);
+      const size = bytes.readUInt32LE(cursor + 12);
+      if (!size || offset + size > bytes.length) fail("invalid code signature extent");
+      signature = { offset, size };
+    } else if (command === LC_SEGMENT_64) {
+      if (commandSize < 72) fail("truncated Mach-O segment command");
+      const sectionCount = commandBytes.readUInt32LE(64);
+      if (sectionCount > 65_536 || 72 + sectionCount * 80 > commandSize) fail("invalid Mach-O segment sections");
+      const segmentName = commandBytes.subarray(8, 24).toString("utf8").replace(/\0.*$/s, "");
+      if (segmentName === "__LINKEDIT") {
+        if (linkedit) fail("duplicate __LINKEDIT segment");
+        const vmsize = commandBytes.readBigUInt64LE(32);
+        const fileoff = commandBytes.readBigUInt64LE(40);
+        const filesize = commandBytes.readBigUInt64LE(48);
+        if (fileoff + filesize > BigInt(bytes.length) || vmsize < filesize) fail("invalid __LINKEDIT extent");
+        // vmsize and filesize legitimately differ after the signature is removed: they are normalised, never compared raw.
+        commandBytes.fill(0, 32, 40);
+        commandBytes.fill(0, 48, 56);
+        linkedit = { fileoff, filesize, vmsize, vmsizeOffset: cursor + 32 };
+      }
+    }
+    if (command !== LC_CODE_SIGNATURE) normalizedCommands.push(commandBytes);
+    cursor += commandSize;
+  }
+  if (cursor !== commandEnd) fail("load commands do not fill declared table");
+  if (!linkedit) fail("missing __LINKEDIT segment");
+  if (signature && (BigInt(signature.offset) < linkedit.fileoff
+      || signature.offset + signature.size !== bytes.length
+      || linkedit.fileoff + linkedit.filesize !== BigInt(bytes.length))) {
+    fail("signature is not terminal __LINKEDIT data");
+  }
+  return { bytes, cpuType, ncmds, sizeofcmds, signature, linkedit, normalizedCommands };
+}
+
+/**
+ * Every byte outside the explicitly permitted ranges must be identical between the captured original and the stripped copy.
+ * Permitted: header ncmds/sizeofcmds (checked by the caller), the load-command table (compared command by command, with only
+ * the signature command removed and __LINKEDIT vmsize/filesize normalised), the zeroed tail the shorter table leaves, and the
+ * signature blob plus its alignment padding at the end of __LINKEDIT. Code, data and all __LINKEDIT content before the
+ * signature are compared byte for byte.
+ */
+function assertOnlySignatureDiffers(before, after) {
+  const a = before.bytes;
+  const b = after.bytes;
+  if (!before.signature) {
+    if (a.length !== b.length || !a.equals(b)) fail("unsigned Mach-O changed during normalization");
+    return;
+  }
+  const same = (from, to, label) => {
+    if (from === to) return;
+    if (!a.subarray(from, to).equals(b.subarray(from, to))) fail(`signature removal changed ${label}`);
+  };
+  const beforeTable = 32 + before.sizeofcmds;
+  const afterTable = 32 + after.sizeofcmds;
+  same(0, 16, "Mach-O header");
+  same(24, 32, "Mach-O header");
+  if (b.subarray(afterTable, beforeTable).some((byte) => byte !== 0)) fail("signature removal left nonzero bytes after the load commands");
+  const keptEnd = Number(after.linkedit.fileoff + after.linkedit.filesize);
+  if (b.length !== keptEnd) fail("stripped Mach-O does not end at __LINKEDIT");
+  same(beforeTable, keptEnd, "executable or data bytes");
+}
+
+/**
+ * The approval digest of an already-unsigned copy and its signed original: verifies that signature removal changed
+ * nothing but the signature, then hashes the unsigned bytes with the normalised __LINKEDIT vmsize. Exported for tests.
+ */
+export function machoApprovalDigest(beforeBytes, afterBytes) {
+  const before = parseMachO(beforeBytes);
+  const after = parseMachO(Buffer.from(afterBytes));
+  if (after.signature) fail("signature remains after normalization");
+  if (before.signature && (before.ncmds !== after.ncmds + 1 || before.sizeofcmds !== after.sizeofcmds + 16)) fail("signature removal changed Mach-O command layout");
+  if (before.signature) {
+    const beforeLinkeditEnd = before.linkedit.fileoff + before.linkedit.filesize;
+    const afterLinkeditEnd = after.linkedit.fileoff + after.linkedit.filesize;
+    const removedPadding = BigInt(before.signature.offset) - afterLinkeditEnd;
+    if (beforeLinkeditEnd !== BigInt(before.signature.offset + before.signature.size)
+      || after.linkedit.fileoff !== before.linkedit.fileoff
+      || afterLinkeditEnd > BigInt(before.signature.offset)
+      || removedPadding < 0n || removedPadding > 15n
+      || BigInt(after.bytes.length) !== afterLinkeditEnd) {
+      fail("code signature is outside trailing __LINKEDIT data");
+    }
+    const start = Number(afterLinkeditEnd);
+    const end = before.signature.offset;
+    if (before.bytes.subarray(start, end).some((byte) => byte !== 0)) fail("nonzero alignment padding before code signature");
+  }
+  assertOnlySignatureDiffers(before, after);
+  if (before.normalizedCommands.length !== after.normalizedCommands.length
+    || before.normalizedCommands.some((command, index) => !command.equals(after.normalizedCommands[index]))) {
+    fail("signature removal changed non-signature load commands");
+  }
+  const pageSize = before.cpuType === CPU_TYPE_ARM64 ? 16n * 1024n : 4096n;
+  const roundedSize = ((after.linkedit.filesize + pageSize - 1n) / pageSize) * pageSize;
+  if (after.linkedit.vmsize < roundedSize) fail("invalid __LINKEDIT virtual size");
+  after.bytes.writeBigUInt64LE(roundedSize, after.linkedit.vmsizeOffset);
+  return createHash("sha256").update(after.bytes).digest("hex");
+}
+
+/** Default signature removal: `/usr/bin/codesign --remove-signature <copy>` (macOS only). */
+function removeSignatureWithCodesign(copy) {
+  const result = spawnSync("/usr/bin/codesign", ["--remove-signature", copy], { stdio: "ignore", timeout: 15_000, windowsHide: true });
+  if (result.error || result.status !== 0) throw new ApprovalHashError("APPROVAL_HASH_CODESIGN_FAILED", `backend integrity: codesign normalization failed (${result.error?.message ?? result.status})`);
+}
+
+/**
+ * The approval digest of `file` under `algorithm`. `removeSignature(copyPath)` is injectable for tests and for hosts that
+ * strip signatures another way; the default needs macOS. The input file is never modified.
+ */
+export function approvalDigest(file, algorithm, { platform = process.platform, removeSignature = removeSignatureWithCodesign, tmpdir = os.tmpdir() } = {}) {
+  if (algorithm === APPROVAL_RAW_SHA256) return createHash("sha256").update(readFileSync(file)).digest("hex");
+  if (algorithm !== APPROVAL_MACHO_STRIP_LINKEDIT_V1) throw new ApprovalHashError("APPROVAL_HASH_ALGORITHM_UNKNOWN", `unknown approval hash algorithm ${JSON.stringify(algorithm)} (supported: ${APPROVAL_ALGORITHMS.join(", ")})`);
+  if (platform !== "darwin") throw new ApprovalHashError("APPROVAL_HASH_HOST_UNSUPPORTED", `${APPROVAL_MACHO_STRIP_LINKEDIT_V1} needs macOS (codesign); this host is ${platform}`);
+  if (!lstatSync(file).isFile()) fail("expected regular Mach-O file");
+  const original = readFileSync(file);
+  const before = parseMachO(original);
+  const directory = mkdtempSync(path.join(tmpdir, `rightkit-macho-${process.pid}-${randomBytes(8).toString("hex")}-`), { mode: 0o700 });
+  const copy = path.join(directory, "binary");
+  try {
+    // The copy is written from the captured bytes, never re-read from the path, so the validated snapshot is the one stripped.
+    writeFileSync(copy, original, { mode: 0o700 });
+    chmodSync(copy, 0o700);
+    if (before.signature) removeSignature(copy);
+    return machoApprovalDigest(original, readFileSync(copy));
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}

package/managed-cargo.mjs

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
+import { spawn as spawnProcess, spawnSync } from "./background-process.mjs";
 
 export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
   const roots = managedControlCandidates({ env, platform });
@@ -18,6 +18,14 @@ export function managedRuntimeClient(env = process.env, platform = process.platf
     const client = path.posix.join(env.HOME || homedir(), 'Library', 'Application Support', 'RustRight', 'runtime', 'rustright');
     if (exists(client)) return client;
   }
+  // RustRight's own install on Windows (2026-10-18 cutover): the runtime moved out of the control root to
+  // <drive>\.rustright\runtime, beside the control root's drive, and runtime-current was retired.
+  if (platform === 'win32') {
+    for (const root of roots) {
+      const client = path.win32.join(path.win32.parse(root).root, '.rustright', 'runtime', 'rustright.exe');
+      if (exists(client)) return client;
+    }
+  }
   return undefined;
 }
 
@@ -72,3 +80,51 @@ export function runCargoSync(args, options = {}, { platform = process.platform,
 function unavailable(message) {
   return { status: null, stdout: "", stderr: message, error: Object.assign(new Error(message), { code: 'RK_BROKER_UNAVAILABLE' }) };
 }
+
+/**
+ * Async `spawnSync` look-alike for the batch publisher: runs the command through the release spawn boundary
+ * (background-process.mjs), collects stdout and stderr, and resolves `{ status, signal, stdout, stderr, error }`.
+ * It never rejects: a spawn failure, a timeout or an exceeded `maxBuffer` resolves with `error` set, which is
+ * exactly how callers already read a failed `spawnSync`.
+ */
+export function spawnCollect(command, args, options = {}, { spawnAsync = spawnProcess } = {}) {
+  const { timeout, maxBuffer = 512 * 1024 * 1024, encoding: _encoding, stdio: _stdio, ...rest } = options;
+  return new Promise((resolve) => {
+    let child;
+    try { child = spawnAsync(command, args, { ...rest, stdio: ["ignore", "pipe", "pipe"] }); } catch (error) { resolve({ status: null, signal: null, stdout: "", stderr: "", error }); return; }
+    const out = []; const err = [];
+    let size = 0; let settled = false; let timer; let failure;
+    const finish = (result) => { if (settled) return; settled = true; clearTimeout(timer); resolve(result); };
+    const take = (chunks) => (chunk) => {
+      size += chunk.length;
+      if (size > maxBuffer) { failure ??= new Error(`output exceeded maxBuffer (${maxBuffer} bytes)`); child.kill("SIGKILL"); return; }
+      chunks.push(chunk);
+    };
+    child.stdout.on("data", take(out));
+    child.stderr.on("data", take(err));
+    child.on("error", (error) => finish({ status: null, signal: null, stdout: "", stderr: "", error }));
+    child.on("close", (status, signal) => finish({
+      status, signal, stdout: Buffer.concat(out).toString("utf8"), stderr: Buffer.concat(err).toString("utf8"), error: failure,
+    }));
+    if (timeout) timer = setTimeout(() => { failure ??= new Error(`timed out after ${timeout}ms`); child.kill("SIGKILL"); }, timeout);
+  });
+}
+
+/**
+ * Async twin of `runCargoSync`: the same client, broker-socket and darwin-never-direct selection (it asks
+ * `runCargoSync` to choose, with a spawn that only records the invocation), then runs the chosen invocation
+ * without blocking the event loop so independent crates can publish concurrently. The broker still
+ * serializes the builds themselves.
+ */
+export async function runCargoAsync(args, options = {}, deps = {}) {
+  const { spawnAsync = spawnCollect, ...syncDeps } = deps;
+  let chosen;
+  const probe = runCargoSync(args, options, { ...syncDeps, spawn: (command, commandArgs, commandOptions) => { chosen = { command, args: commandArgs, options: commandOptions }; return { status: 0, stdout: "", stderr: "" }; } });
+  if (!chosen) return probe;
+  const result = await spawnAsync(chosen.command, chosen.args, chosen.options);
+  const platform = syncDeps.platform ?? process.platform;
+  if (platform === 'darwin' && result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) {
+    return { ...result, error: unavailable(String(result.stderr).trim()).error };
+  }
+  return result;
+}

package/media-sidecar.mjs

@@ -3,6 +3,7 @@
 //   targets.mac.mediaSidecar = {
 //     arch: "aarch64",                       // catalog arch (default: build host); one arch per build
 //     variant: "decode",                     // catalog variant (default "decode")
+//     variants: { ffmpeg: "export-ass" },    // optional per-tool variant override (a tool not named uses `variant`)
 //     tools: ["ffmpeg", "ffprobe"],          // default both
 //     stageDir: "src-tauri/binaries",        // Tauri externalBin directory (default)
 //     bundleDir: "Contents/MacOS",           // mac only: where Tauri puts externalBin (or "Contents/Resources")
@@ -26,7 +27,7 @@ export const MEDIA_SIDECAR_TOOLS = Object.freeze(["ffmpeg", "ffprobe"]);
 const PLATFORM_OS = Object.freeze({ mac: "macos", win: "windows", linux: "linux" });
 const ARCHES = new Set(["aarch64", "x86_64"]);
 const SHA256 = /^[0-9a-f]{64}$/;
-const CONFIG_KEYS = new Set(["arch", "variant", "tools", "stageDir", "bundleDir", "notices", "catalog", "stage"]);
+const CONFIG_KEYS = new Set(["arch", "variant", "variants", "tools", "stageDir", "bundleDir", "notices", "catalog", "stage"]);
 const BUNDLE_DIRS = new Set(["Contents/MacOS", "Contents/Resources"]);
 
 const invalid = (code, message) => Object.assign(new Error(message), { code });
@@ -87,6 +88,18 @@ export function validateMediaSidecarConfig(raw, { platform, hostArch = hostCatal
   if (!Array.isArray(tools) || !tools.length || new Set(tools).size !== tools.length || tools.some((tool) => !MEDIA_SIDECAR_TOOLS.includes(tool))) {
     errors.push(`tools must be a non-empty list without duplicates drawn from ${MEDIA_SIDECAR_TOOLS.join(", ")}`);
   }
+  // One entry may mix variants (for example the export-ass ffmpeg with the decode ffprobe): `variants` maps a tool to its variant.
+  let variants;
+  if (raw.variants !== undefined) {
+    if (!isObject(raw.variants) || !Object.keys(raw.variants).length) errors.push("variants must be an object mapping a tool to a catalog variant slug");
+    else {
+      for (const [tool, slug] of Object.entries(raw.variants)) {
+        if (!MEDIA_SIDECAR_TOOLS.includes(tool) || (Array.isArray(tools) && !tools.includes(tool))) errors.push(`variants.${tool}: not one of the configured tools`);
+        if (typeof slug !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) errors.push(`variants.${tool} must be a catalog variant slug: ${JSON.stringify(slug)}`);
+      }
+      variants = { ...raw.variants };
+    }
+  }
   const stageDir = relativePath(raw.stageDir ?? "src-tauri/binaries", "stageDir");
   let bundleDir;
   if (os === "macos") {
@@ -109,7 +122,7 @@ export function validateMediaSidecarConfig(raw, { platform, hostArch = hostCatal
     else stage = raw.stage;
   }
   if (errors.length) throw invalid("MEDIA_SIDECAR_CONFIG_INVALID", `invalid mediaSidecar configuration:\n${errors.map((line) => `- ${line}`).join("\n")}`);
-  return { os, arch, variant, tools: [...tools], stageDir, ...(bundleDir ? { bundleDir } : {}), notices, ...(catalog ? { catalog } : {}), ...(stage ? { stage } : {}) };
+  return { os, arch, variant, ...(variants ? { variants } : {}), tools: [...tools], stageDir, ...(bundleDir ? { bundleDir } : {}), notices, ...(catalog ? { catalog } : {}), ...(stage ? { stage } : {}) };
 }
 
 /** `sign.nestedCode` entries for the macOS bundle: the sidecar executables, hardened runtime, no entitlements. */
@@ -126,9 +139,10 @@ export function mediaSidecarNestedCode(config) {
 export function selectSidecarRows(catalog, config) {
   if (!isObject(catalog) || !Array.isArray(catalog.artifacts)) throw invalid("MEDIA_SIDECAR_CATALOG_INVALID", "catalog has no artifacts array");
   return config.tools.map((tool) => {
-    const matches = catalog.artifacts.filter((row) => row.tool === tool && (row.variant ?? "decode") === config.variant
+    const variant = config.variants?.[tool] ?? config.variant;
+    const matches = catalog.artifacts.filter((row) => row.tool === tool && (row.variant ?? "decode") === variant
       && String(row.os).toLowerCase() === config.os && String(row.arch).toLowerCase() === config.arch);
-    const where = `${tool} ${config.variant} ${config.os}/${config.arch}`;
+    const where = `${tool} ${variant} ${config.os}/${config.arch}`;
     if (matches.length === 0) throw invalid("MEDIA_SIDECAR_NO_ROW", `the rightkit-ffmpeg catalog has no ${where} row`);
     if (matches.length > 1) throw invalid("MEDIA_SIDECAR_AMBIGUOUS_ROW", `the rightkit-ffmpeg catalog has ${matches.length} ${where} rows`);
     const [row] = matches;
@@ -152,6 +166,7 @@ export function planMediaSidecar({ config, catalog, crateDir, crateVersion, cata
     artifactId: row.id,
     version: row.version,
     contentSha256: row.contentSha256,
+    ...(config.variants ? { variant: row.variant ?? "decode" } : {}),
     stagedPath: path.resolve(root, config.stageDir, stagedFileName(row.tool, config.os, config.arch)),
     bundledName: bundledFileName(row.tool, config.os),
     ...(config.bundleDir ? { bundlePath: `${config.bundleDir}/${bundledFileName(row.tool, config.os)}` } : {}),
@@ -242,6 +257,7 @@ export function buildMediaSidecarReceipt(plan, preSign, signed, { notices = [],
         tool: file.tool,
         artifactId: file.artifactId,
         version: file.version,
+        ...(file.variant ? { variant: file.variant } : {}),
         catalogContentSha256: file.contentSha256,
         preSignSha256: file.preSignSha256,
         signedSha256: after.sha256,

package/mirror-root-artifact.mjs

@@ -1,11 +1,25 @@
 #!/usr/bin/env node
-import { copyFileSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
+// Two forms:
+//   right-release mirror-root-artifact --file <artifact> --package-root <dir> [--name <filename>]
+//   right-release mirror-root-artifact --config <right-release.config.mjs> --platform mac|win [--package-root <dir>]
+// The config form mirrors every entry of `targets.<platform>.mirror`, a list of `"<app-relative file>"` or
+// `{ file, name?, pruneSuffix? }`. `pruneSuffix` (for example "-setup.exe") then removes the other files with that suffix
+// from the managed directory, so it holds exactly the current artifact. Run it as `targets.<platform>.postSign`.
+// Output goes only to RIGHT_RELEASE_ARTIFACT_DIR (outside the repository); it never writes into the repository root.
+import { configuredManagedRootSpellings } from "./artifact-storage.mjs";
+import { copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import { execFileSync } from "./background-process.mjs";
 import path from "node:path";
+import { pathToFileURL } from "node:url";
 
 const args = parseArgs(process.argv.slice(2));
-if (!args.file || !args.packageRoot) {
-  console.error("Usage: right-release mirror-root-artifact --file <artifact> --package-root <dir> [--name <filename>]");
+const usage = "Usage: right-release mirror-root-artifact (--file <artifact> --package-root <dir> [--name <filename>] | --config <file> --platform mac|win [--package-root <dir>])";
+if (!args.config && (!args.file || !args.packageRoot)) {
+  console.error(usage);
+  process.exit(2);
+}
+if (args.config && (!args.platform || args.file)) {
+  console.error(usage);
   process.exit(2);
 }
 if (!process.env.RIGHT_RELEASE_ARTIFACT_DIR) {
@@ -13,33 +27,68 @@ if (!process.env.RIGHT_RELEASE_ARTIFACT_DIR) {
   process.exit(2);
 }
 
-const packageRoot = realpathSync(path.resolve(args.packageRoot));
-const source = path.resolve(packageRoot, args.file);
-const name = args.name || path.basename(source);
+let entries;
+let rootArg = args.packageRoot;
+if (args.config) {
+  const configPath = path.resolve(args.config);
+  const loaded = await import(pathToFileURL(configPath).href);
+  const config = loaded.default ?? loaded.config ?? loaded;
+  const declared = config?.targets?.[args.platform]?.mirror;
+  if (!Array.isArray(declared) || declared.length === 0) {
+    console.error(`right-release mirror-root-artifact: targets.${args.platform}.mirror declares no files in ${args.config}`);
+    process.exit(2);
+  }
+  entries = declared.map((item) => (typeof item === "string" ? { file: item } : item));
+  for (const entry of entries) {
+    const unknown = entry && typeof entry === "object" ? Object.keys(entry).filter((key) => !["file", "name", "pruneSuffix"].includes(key)) : ["(not an object)"];
+    if (typeof entry?.file !== "string" || !entry.file.trim() || unknown.length || path.isAbsolute(entry.file) || entry.file.replaceAll("\\", "/").split("/").includes("..")) {
+      console.error(`right-release mirror-root-artifact: each mirror entry is an app-relative file or { file, name?, pruneSuffix? }: ${JSON.stringify(entry)}`);
+      process.exit(2);
+    }
+  }
+  rootArg ??= path.dirname(configPath);
+} else {
+  entries = [{ file: args.file, name: args.name }];
+}
+
+const packageRoot = realpathSync(path.resolve(rootArg));
 const managedOutput = path.resolve(process.env.RIGHT_RELEASE_ARTIFACT_DIR);
 const repoRoot = path.resolve(git(packageRoot, "rev-parse", "--show-toplevel"));
 if (inside(managedOutput, repoRoot)) {
   console.error(`right-release mirror-root-artifact: managed output must be outside repository: ${managedOutput}`);
   process.exit(2);
 }
-if (name !== path.basename(name) || !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(name)) {
-  console.error(`right-release mirror-root-artifact: unsafe artifact name: ${name}`);
-  process.exit(2);
-}
-assertSafePath(source);
-if (!statSync(source).isFile()) {
-  console.error(`right-release mirror-root-artifact: source is not a regular file: ${source}`);
-  process.exit(2);
-}
-const destinations = new Set([path.join(managedOutput, name)]);
+const safeName = (name) => name === path.basename(name) && /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(name);
 
-for (const destination of destinations) {
-  if (path.resolve(destination) === source) continue;
-  atomicCopy(source, destination);
+for (const entry of entries) {
+  const source = path.resolve(packageRoot, entry.file);
+  const name = entry.name || path.basename(source);
+  if (!safeName(name)) {
+    console.error(`right-release mirror-root-artifact: unsafe artifact name: ${name}`);
+    process.exit(2);
+  }
+  if (entry.pruneSuffix !== undefined && (typeof entry.pruneSuffix !== "string" || !/^[A-Za-z0-9._+-]{1,40}$/.test(entry.pruneSuffix) || !name.endsWith(entry.pruneSuffix))) {
+    console.error(`right-release mirror-root-artifact: pruneSuffix must be a plain suffix of the artifact name: ${entry.pruneSuffix}`);
+    process.exit(2);
+  }
+  assertSafePath(source);
+  if (!statSync(source).isFile()) {
+    console.error(`right-release mirror-root-artifact: source is not a regular file: ${source}`);
+    process.exit(2);
+  }
+  const destination = path.join(managedOutput, name);
+  if (path.resolve(destination) !== source) atomicCopy(source, destination);
+  if (entry.pruneSuffix) {
+    for (const stale of readdirSync(managedOutput)) {
+      if (stale !== name && stale.endsWith(entry.pruneSuffix) && safeName(stale)) {
+        assertSafePath(path.join(managedOutput, stale));
+        rmSync(path.join(managedOutput, stale), { force: true });
+      }
+    }
+  }
+  console.log(`right-release: managed artifact -> ${destination}`);
 }
 
-console.log(`right-release: managed artifact -> ${[...destinations][0]}`);
-
 function git(cwd, ...commandArgs) {
   return execFileSync("git", commandArgs, { cwd, encoding: "utf8" }).trim();
 }
@@ -65,11 +114,14 @@ function atomicCopy(from, to) {
 function assertSafePath(target) {
   const absolute = path.resolve(target);
   const root = path.parse(absolute).root;
+  // Only the configured managed root itself may be a symlink (same rule as artifact-storage assertSafeMutation).
+  const managedRoots = configuredManagedRootSpellings();
+  const configured = (candidate) => managedRoots.has(process.platform === "win32" ? path.resolve(candidate).toLowerCase() : path.resolve(candidate));
   let cursor = root;
   for (const segment of path.relative(root, absolute).split(path.sep).filter(Boolean)) {
     cursor = path.join(cursor, segment);
     try {
-      if (lstatSync(cursor).isSymbolicLink()) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
+      if (lstatSync(cursor).isSymbolicLink() && !configured(cursor)) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }

package/native-cargo-layout.mjs

@@ -18,6 +18,8 @@ export function resolveNativeCargoLayout({
   read = (file) => readFileSync(file, "utf8"),
   requireManifest = false,
   requireLock = false,
+  // The repository the app lives in. A manifest outside the app searches for its workspace only up to this directory.
+  repoRoot,
 } = {}) {
   if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
   const resolvedAppRoot = path.resolve(appRoot);
@@ -31,7 +33,7 @@ export function resolveNativeCargoLayout({
   const explicitWorkspace = nativeAssembly?.workspaceRoot ?? nativeAssembly?.cargoWorkspaceRoot;
   const workspaceRoot = explicitWorkspace
     ? normalizeWorkspaceRoot(resolveDeclaredPath(resolvedAppRoot, explicitWorkspace), exists)
-    : discoverWorkspaceRoot({ appRoot: resolvedAppRoot, manifestPath, manifestDir, manifestText, exists, read });
+    : discoverWorkspaceRoot({ appRoot: resolvedAppRoot, manifestPath, manifestDir, manifestText, exists, read, repoRoot: repoRoot ? path.resolve(repoRoot) : undefined });
 
   const lock = resolveCargoLock({
     appRoot: resolvedAppRoot,
@@ -84,6 +86,28 @@ export function resolveNativeCargoLayout({
   return layout;
 }
 
+/**
+ * True when the app has a native Cargo manifest the release must hash and build against: the config declares one
+ * (nativeAssembly.cargoManifest / manifest) or the historical src-tauri/Cargo.toml exists. A native iOS app (xcodegen
+ * project, Rust static library built by iosPackage.prepare) has neither, and then owns no Cargo layout at all.
+ */
+export function nativeCargoDeclared({ appRoot, config, nativeAssembly = config?.nativeAssembly, exists = existsSync } = {}) {
+  if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
+  if (nativeAssembly?.cargoManifest ?? nativeAssembly?.manifest) return true;
+  return exists(path.resolve(appRoot, DEFAULT_MANIFEST));
+}
+
+/** The manifest nativeAssembly names, if any (a path relative to the app root, or absolute). */
+export function declaredCargoManifest(config, nativeAssembly = config?.nativeAssembly) {
+  return nativeAssembly?.cargoManifest ?? nativeAssembly?.manifest;
+}
+
+/** True when the historical Tauri host manifest exists. */
+export function hasDefaultTauriManifest({ appRoot, exists = existsSync } = {}) {
+  if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
+  return exists(path.resolve(appRoot, DEFAULT_MANIFEST));
+}
+
 export const resolveCargoLayout = resolveNativeCargoLayout;
 export const resolveNativeCargoManifest = resolveNativeCargoLayout;
 export const resolveCargoManifest = resolveNativeCargoLayout;
@@ -160,20 +184,29 @@ function resolveCargoLock({ appRoot, manifestPath, manifestDir, workspaceRoot, n
   return { path: found, source: found ? orderedSources[candidates.indexOf(found)] : undefined, candidates };
 }
 
-function discoverWorkspaceRoot({ appRoot, manifestPath, manifestDir, manifestText, exists, read }) {
+function discoverWorkspaceRoot({ appRoot, manifestPath, manifestDir, manifestText, exists, read, repoRoot }) {
   const parsed = parseCargoManifest(manifestText);
   const declaredWorkspace = parsed.workspacePath ?? parsed.packageWorkspace;
   if (declaredWorkspace) {
     return normalizeWorkspaceRoot(resolveDeclaredPath(manifestDir, declaredWorkspace), exists);
   }
   if (parsed.hasWorkspace) return manifestDir;
+  // A manifest inside the app searches up to the app root (unchanged); one outside it (a shared crates/ tree) searches up to the
+  // nearest directory that contains both, which is where its workspace and Cargo.lock live.
+  // Only a caller that names the repository opts in to the climb above the app (native iOS); every other caller keeps the
+  // exact historical search, which never leaves the app root.
+  let boundary = appRoot;
+  if (repoRoot && !isWithin(appRoot, manifestDir)) {
+    boundary = commonAncestor(appRoot, manifestDir);
+    if (!isWithin(repoRoot, boundary)) boundary = repoRoot;
+  }
   let current = manifestDir;
   for (;;) {
     const candidate = path.join(current, "Cargo.toml");
     if (candidate !== manifestPath && exists(candidate) && parseCargoManifest(readIfPresent(candidate, exists, read)).hasWorkspace) return current;
-    if (current === appRoot) break;
+    if (current === boundary) break;
     const parent = path.dirname(current);
-    if (parent === current || !isWithin(appRoot, parent)) break;
+    if (parent === current || !isWithin(boundary, parent)) break;
     current = parent;
   }
   return manifestDir;
@@ -231,6 +264,16 @@ function readIfPresent(file, exists, read) {
   try { return exists(file) ? read(file) : ""; } catch { return ""; }
 }
 
+function commonAncestor(left, right) {
+  let current = path.resolve(left);
+  while (!isWithin(current, path.resolve(right))) {
+    const parent = path.dirname(current);
+    if (parent === current) return current;
+    current = parent;
+  }
+  return current;
+}
+
 function isWithin(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));