@rightkit/release 0.2.174 → 0.4.0

package/ownership-scope.mjs

@@ -0,0 +1,94 @@
+// Ownership scan scope for a target that builds from only part of its repository (iOS).
+// A scope is a sorted, de-duplicated list of repository-relative directory roots. Only committed files under those roots
+// are inventoried; the exceptions file under `.rightkit` is always read. Sealed ownership evidence records the scope and
+// upload-time verification re-derives it from the config, so the scope cannot be narrowed after the build.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+export const OWNERSHIP_SCOPE_ALWAYS = ".rightkit";
+
+/** Normalize and validate repository-relative scope roots; throws a clear error for absolute, escaping, or missing roots. */
+export function normalizeScopeRoots(roots, { repoRoot, label = "ownershipScope" } = {}) {
+  if (!Array.isArray(roots)) throw new Error(`${label} must be an array of repository-relative directories`);
+  const out = new Set();
+  for (const raw of roots) {
+    if (typeof raw !== "string" || !raw.trim()) throw new Error(`${label} entries must be non-empty strings`);
+    const slashed = raw.replaceAll("\\", "/");
+    if (path.posix.isAbsolute(slashed) || path.win32.isAbsolute(raw) || /^[A-Za-z]:/.test(slashed)) throw new Error(`${label} entry ${raw} must be repository-relative, not absolute`);
+    const normal = path.posix.normalize(slashed).replace(/\/+$/, "");
+    if (normal === ".." || normal.startsWith("../")) throw new Error(`${label} entry ${raw} escapes the repository`);
+    if (normal === "." || normal === "") throw new Error(`${label} entry ${raw} is the whole repository; omit the scope instead`);
+    if (repoRoot) {
+      const absolute = path.join(repoRoot, ...normal.split("/"));
+      let directory = false;
+      try { directory = existsSync(absolute) && statSync(absolute).isDirectory(); } catch { directory = false; }
+      if (!directory) throw new Error(`${label} entry ${raw} is not an existing directory in the repository`);
+    }
+    out.add(normal);
+  }
+  return [...out];
+}
+
+/** Local SwiftPM package directories named by `path:` inside the `packages:` section of an XcodeGen project.yml. */
+export function projectYmlLocalPackagePaths(text) {
+  const lines = String(text).split(/\r?\n/);
+  const paths = [];
+  let inPackages = false;
+  for (const line of lines) {
+    if (/^\s*(#.*)?$/.test(line)) continue;
+    if (/^\S/.test(line)) { inPackages = /^packages:\s*(#.*)?$/.test(line); continue; }
+    if (!inPackages) continue;
+    const match = /(?:^|[\s{,])path:\s*(?:"([^"]*)"|'([^']*)'|([^\s,}#]+))/.exec(line);
+    if (match) paths.push(match[1] ?? match[2] ?? match[3]);
+  }
+  return paths;
+}
+
+/**
+ * Scan scope of an iOS target: the Xcode project directory, each local SwiftPM package its project.yml references,
+ * `.rightkit` (exceptions), the native Rust assembly (`nativeAssembly.workspaceRoot` and the directory of its cargo manifest,
+ * which is compiled into the IPA), and `targets.ios.ownershipScope` additions. Accepts the raw or the expanded target.
+ * The scan itself closes this scope under local path dependencies of the in-scope manifests (see ownership.mjs).
+ * A native assembly rooted at the repository root is ignored (it would make the scope the whole repository).
+ * Returns null when the target has no iosPackage (nothing to scope from).
+ */
+export function iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly }) {
+  const spec = target?.recipe?.kind === "iosPackage" ? target.recipe.spec : target?.iosPackage;
+  if (!spec || typeof spec !== "object") return null;
+  const toRepo = (absolute) => {
+    const relative = path.relative(repoRoot, absolute).split(path.sep).join("/");
+    if (relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) throw new Error(`ios ownership scope: ${absolute} is outside the repository`);
+    return relative || ".";
+  };
+  const specFile = spec.projectSpec ?? spec.project;
+  if (typeof specFile !== "string") throw new Error("ios ownership scope: iosPackage.project or projectSpec is required");
+  const specDir = path.resolve(appRoot, path.posix.dirname(specFile.replaceAll("\\", "/")));
+  const roots = [];
+  const projectDir = toRepo(specDir);
+  if (projectDir === ".") throw new Error("ios ownership scope: the Xcode project sits at the repository root, so there is no narrower scope; declare the project in a subdirectory");
+  roots.push(projectDir);
+  if (spec.projectSpec) {
+    const ymlPath = path.resolve(appRoot, spec.projectSpec);
+    if (existsSync(ymlPath)) {
+      for (const local of projectYmlLocalPackagePaths(readFileSync(ymlPath, "utf8"))) roots.push(toRepo(path.resolve(specDir, local)));
+    }
+  }
+  const native = nativeAssembly && typeof nativeAssembly === "object" ? nativeAssembly : null;
+  const nativeDirs = [native?.workspaceRoot ?? native?.cargoWorkspaceRoot, (native?.cargoManifest ?? native?.manifest) ? path.dirname(native.cargoManifest ?? native.manifest) : undefined].filter((value) => typeof value === "string" && value);
+  for (const dir of nativeDirs) {
+    const nativeRoot = toRepo(path.resolve(appRoot, dir));
+    // A native assembly at the repository root is the app's own (usually desktop) workspace; folding it in would widen the
+    // scope to the whole repository, so it adds nothing. The scan's path-dependency closure still follows the in-scope manifests.
+    if (nativeRoot !== ".") roots.push(nativeRoot);
+  }
+  const extra = target.ownershipScope;
+  if (extra !== undefined) roots.push(...normalizeScopeRoots(extra, { repoRoot, label: "targets.ios.ownershipScope" }));
+  const checked = normalizeScopeRoots(roots.filter((root) => root !== OWNERSHIP_SCOPE_ALWAYS), { repoRoot, label: "ios ownership scope" });
+  return [...new Set([...checked, OWNERSHIP_SCOPE_ALWAYS])].sort();
+}
+
+/** Repository-relative file or directory under any scope root (null scope = everything). */
+export function inOwnershipScope(scope, rel) {
+  if (!scope) return true;
+  return scope.some((root) => rel === root || rel.startsWith(`${root}/`));
+}

package/ownership.mjs

@@ -12,6 +12,7 @@ import { createHash } from "node:crypto";
 import { acquireCommittedSource, committedSourceDataForInternalUse } from "./committed-source.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { gitListedInventory } from "./ownership-git-inventory.mjs";
+import { inOwnershipScope } from "./ownership-scope.mjs";
 import os from "node:os";
 import path from "node:path";
 
@@ -156,7 +157,31 @@ function resolveLocalPath(root, sourceFile, pathValue, coverage, display, invent
   } catch { coverage.push({ path: display, status: "unscanned", reason: `${reasonPrefix}-path-unresolved${detail ? `:${detail}` : ""}` }); }
 }
 
-function parseCargo(parsed, file, out, workspace, root, coverage, inventory) {
+// A Git dependency pinned by a full 40-hex `rev` is immutable. When its URL is third-party it is equivalent to a registry
+// dependency and is not a gap (Orthic-Labs/rightkit#677). A first-party URL (Orthic-Labs, bogusyogi, or an org listed in
+// ownership-repositories.json) stays an unscanned fatal gap because first-party code must be scanned. A branch, a tag, a
+// short rev or no rev is always an unscanned coverage gap.
+const FULL_GIT_REV = /^[0-9a-f]{40}$/i;
+export const PINNED_GIT_DEPENDENCY = "pinned-git-dependency";
+const FIRST_PARTY_GIT_ORGS = new Set(["github.com/orthic-labs", "github.com/bogusyogi"]);
+const gitHostOrg = (url) => {
+  const text = String(url).trim();
+  const match = /^(?:[a-z][a-z0-9+.-]*:\/\/)?(?:[^@/\s]+@)?([^/:\s]+)[/:]+([^/\s]+)/i.exec(text);
+  return match ? `${match[1]}/${match[2]}`.toLowerCase() : null;
+};
+let configuredFirstParty;
+function firstPartyGitOrgs() {
+  if (configuredFirstParty) return configuredFirstParty;
+  const orgs = new Set(FIRST_PARTY_GIT_ORGS);
+  try {
+    const config = JSON.parse(readFileSync(new URL("./ownership-repositories.json", import.meta.url), "utf8"));
+    for (const repo of config.repositories ?? []) { const key = gitHostOrg(repo.repositoryIdentity ?? ""); if (key) orgs.add(key); }
+  } catch { /* the built-in first-party orgs still apply */ }
+  return (configuredFirstParty = orgs);
+}
+export const isFirstPartyGitUrl = (url) => { const key = gitHostOrg(url); return key === null || firstPartyGitOrgs().has(key); };
+
+function parseCargo(parsed, file, out, workspace, root, coverage, inventory, covered = []) {
   const pathSpec = (pathValue, sourceFile, display) => {
     resolveLocalPath(root, sourceFile, pathValue, coverage, display, inventory);
   };
@@ -176,7 +201,15 @@ function parseCargo(parsed, file, out, workspace, root, coverage, inventory) {
       if (!raw || typeof raw !== "string" && (typeof raw !== "object" || Array.isArray(raw)) || features.some((x) => typeof x !== "string") || requirement !== null && typeof requirement !== "string") throw new Error(`malformed dependency declaration: ${alias}`);
       addDependency(out, "cargo", name, file, { alias: name === alias ? null : alias, section: `${prefix}${section}`, requirement, features, defaultFeatures: spec["default-features"] ?? inherited["default-features"] ?? null, source, resolvedVersion: null, local: !!pathValue || !!git });
       if (pathValue) pathSpec(pathValue, spec.path ? file : path.posix.join(workspace.dir ?? ".", "Cargo.toml"), file);
-      if (git) coverage.push({ path: file, status: "unscanned", reason: `git-dependency-source:${name}` });
+      if (git) {
+        const rev = spec.rev ?? inherited.rev;
+        const moving = [spec.branch, inherited.branch, spec.tag, inherited.tag].some((value) => value !== undefined);
+        if (typeof git === "string" && typeof rev === "string" && FULL_GIT_REV.test(rev) && !moving && !isFirstPartyGitUrl(git)) {
+          // Immutable third-party source, not a gap: kept out of `coverage` (every coverage row blocks the gate) and reported on
+          // `deps.covered`. `scanned: false` records that the source is pinned, not examined.
+          covered.push({ path: file, status: PINNED_GIT_DEPENDENCY, reason: `git-dependency-source:${name}`, fingerprint: `${git}@${rev.toLowerCase()}`, scanned: false });
+        } else coverage.push({ path: file, status: "unscanned", reason: `git-dependency-source:${name}` });
+      }
     }
     for (const [target, value] of Object.entries(table.target ?? {})) addTable(value, `${prefix}target.'${target}'.`);
   };
@@ -208,14 +241,40 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   return listedCoverage(inventory);
 }
 
-function committedFileInventory(appRoot, trust, pathPrefix, committed) {
+// A scoped scan also reads the workspace/lockfile authorities that sit in an ancestor directory of a scope root
+// (a root Cargo.toml / Cargo.lock / lockfile resolves a member crate's inherited fields and lock graph), so a member
+// of a larger workspace is judged against the same lockfile as in a whole-repository scan.
+function inScopeOrAuthority(scope, rel) {
+  if (inOwnershipScope(scope, rel)) return true;
+  const dir = path.posix.dirname(rel);
+  return ["Cargo.toml", "Cargo.lock", "package.json", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel))
+    && scope.some((root) => dir === "." || root === dir || root.startsWith(`${dir}/`));
+}
+
+// Directories named by local path dependencies of in-scope manifests that are not yet in scope. A target that is not a
+// directory of the committed tree is left to resolveLocalPath, which records a blocking coverage gap for it.
+function localDependencyRoots(deps, scope, entries) {
+  const roots = new Set();
+  for (const dep of deps) {
+    if (!dep.local || typeof dep.source !== "string" || !dep.source.startsWith("path:")) continue;
+    const value = dep.source.slice(5);
+    if (!value || value.startsWith("workspace:") || path.posix.isAbsolute(value) || path.win32.isAbsolute(value) || value.includes("\\")) continue;
+    const relative = path.posix.normalize(path.posix.join(path.posix.dirname(dep.file), value)).replace(/\/$/, "");
+    if (relative === "." || relative === ".." || relative.startsWith("../") || inOwnershipScope(scope, relative)) continue;
+    if (entries.some((entry) => entry.rel.startsWith(`${relative}/`))) roots.add(relative);
+  }
+  return [...roots];
+}
+
+function committedFileInventory(appRoot, trust, pathPrefix, committed, scope = null) {
   const prefix = pathPrefix ? `${pathPrefix.replace(/\/$/, "")}/` : "";
   const repositoryFiles = committed.entries.filter((entry) => entry.type === "blob").map((entry) => ({ rel: entry.rel, size: entry.size, bytes: entry.bytes, mode: entry.mode }));
-  const files = [], coverage = committed.coverage.filter((entry) => !prefix || entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: prefix ? entry.path.slice(prefix.length) : entry.path }));
+  const files = [], coverage = committed.coverage.filter((entry) => (!prefix || entry.path.startsWith(prefix)) && inScopeOrAuthority(scope, entry.path)).map((entry) => ({ ...entry, path: prefix ? entry.path.slice(prefix.length) : entry.path }));
   const protectedPaths = new Set((trust?.provenance ?? []).flatMap((record) => record.paths ?? []));
   const reportedOpaque = new Set(), reportedNodeModules = new Set();
   for (const entry of committed.entries) {
     if (prefix && !entry.rel.startsWith(prefix)) continue;
+    if (!inScopeOrAuthority(scope, entry.rel)) continue;
     const rel = prefix ? entry.rel.slice(prefix.length) : entry.rel;
     if (!rel) continue;
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
@@ -375,7 +434,7 @@ function resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDi
 }
 
 function dependenciesFromInventory(appRoot, inventory) {
-  const deps = [], coverage = [], contentDigests = [];
+  const deps = [], coverage = [], contentDigests = [], covered = [];
   // Workspace inheritance is loaded before member manifests.
   const manifestNames = new Set(["Cargo.toml", "package.json", "Package.swift"]);
   const manifests = inventory.files.filter((x) => manifestNames.has(path.posix.basename(x.rel)));
@@ -419,7 +478,7 @@ function dependenciesFromInventory(appRoot, inventory) {
     if (base === "Cargo.toml") {
       const dir = path.posix.dirname(rel);
       const workspace = workspaces.filter((x) => x.dir === "." || dir === x.dir || dir.startsWith(`${x.dir}/`)).sort((a, b) => b.dir.length - a.dir.length)[0] ?? { dir: ".", deps: {} };
-      try { parseCargo(parseToml(text), rel, deps, workspace, appRoot, coverage, inventory); }
+      try { parseCargo(parseToml(text), rel, deps, workspace, appRoot, coverage, inventory, covered); }
       catch { coverage.push({ path: rel, status: "unscanned", reason: "invalid-cargo-toml" }); }
     }
     else if (base === "package.json") {
@@ -453,6 +512,7 @@ function dependenciesFromInventory(appRoot, inventory) {
   resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDigests);
   Object.defineProperty(deps, "coverage", { value: coverage, enumerable: false });
   Object.defineProperty(deps, "contentDigests", { value: contentDigests, enumerable: false });
+  Object.defineProperty(deps, "covered", { value: covered, enumerable: false });
   Object.defineProperty(deps, "manifests", { value: files, enumerable: false });
   return deps;
 }
@@ -801,14 +861,28 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     keyCheckpoint = resolved.checkpoint;
   }
   const location = { root: committed.repositoryRoot, prefix: pathPrefix, pathBase: "repository" };
-  const inventory = committedFileInventory(appRoot, trust, location.prefix, committed);
-  if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
-    inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
-  }
+  const declaredScope = options.scope ?? null;
   const committedEnrollment = trust?.rootFingerprint
     ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined;
-  const scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
+  // The scope is closed under local path dependencies: a path dependency of an in-scope manifest that lands in an
+  // out-of-scope directory adds that directory to the scope and the scan repeats, so compiled-in code is never skipped.
+  let scope = declaredScope ? [...declaredScope] : null;
+  let inventory, scanned;
+  for (let round = 0; ; round += 1) {
+    inventory = committedFileInventory(appRoot, trust, location.prefix, committed, scope);
+    if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
+      inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
+    }
+    scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
+    if (!scope) break;
+    const added = localDependencyRoots(scanned.deps, scope, committed.entries);
+    if (!added.length) break;
+    if (round >= 64) throw new Error("committed ownership: scan scope did not converge under local path dependencies");
+    scope = [...new Set([...scope, ...added])].sort();
+  }
+  // Provenance and lockfile diagnostics are computed beside the inventory; a scoped scan reports only gaps under its scope.
+  if (scope) scanned.coverage = scanned.coverage.filter((entry) => typeof entry.path !== "string" || entry.path === "." || inScopeOrAuthority(scope, entry.path));
   const exceptionPath = [location.prefix.replace(/\/$/, ""), EXCEPTIONS_FILE.split(path.sep).join("/")].filter(Boolean).join("/");
   const exceptionObject = committed.entries.find((entry) => entry.rel === exceptionPath);
   const exceptionEntry = exceptionObject?.bytes;
@@ -823,6 +897,7 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     scannedAt: new Date().toISOString(), catalogDigest: catalogDigest(manifest), catalogVersion: manifest.version ?? String(manifest.schema ?? "1"),
     scannerVersion: SCANNER_VERSION, contentDigests: scanned.contentDigests, coverage: scanned.coverage,
     pathBase: location.pathBase, pathPrefix: location.prefix, provenance: scanned.provenance, exceptionDigest,
+    ...(scope ? { ownershipScopeClosed: scope } : {}),
     source: "committed-git-tree", ...(keyLogDigest ? { keyLogDigest, keyCheckpoint, rootFingerprint: trust.rootFingerprint, ...(keyAuthorityBinding ? { keyAuthority: keyAuthorityBinding } : {}) } : {}),
   };
   const result = evaluate(scanned.findings, exceptions, { ...options, manifest, trust, trustEnrollment: trust?.rootFingerprint

package/package-recipe-targets.mjs

@@ -9,6 +9,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
+import { IOS_SIGNING_CONTRACT, IosPackageError, validateIosPackageConfig } from "./ios-package-recipe.mjs";
+import { IosUploadError, validateIosDistribution } from "./ios-upload.mjs";
 
 export class PackageRecipeTargetError extends Error {
   constructor(message) { super(message); this.name = "PackageRecipeTargetError"; this.code = "RK_PACKAGE_RECIPE_TARGET"; }
@@ -25,6 +27,7 @@ const withoutRecipe = (target) => {
 };
 const QUIET_TAURI_ENV = { TAURI_SIGNING_PRIVATE_KEY: "", TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" };
 const RECIPE_BUILD = fileURLToPath(new URL("./recipe-build.mjs", import.meta.url));
+const CREATE_MAC_UPDATER = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url));
 const PROFILE = /^[a-z][a-z0-9_-]*$/;
 
 function relativeInside(value, label) {
@@ -160,7 +163,7 @@ export function expandWinPackageTarget(target, { appRoot, config = {}, env = pro
   };
 }
 
-const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot"]);
+const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot", "updater"]);
 const MAC_TRIPLES = ["aarch64-apple-darwin", "x86_64-apple-darwin"];
 const MAC_CLEANUP_KEYS = new Set(["staleApps", "staleDmgVolumes", "lsclean"]);
 
@@ -179,6 +182,8 @@ function macCleanupSpec(value) {
  * The app path and DMG path are `notarize.app` and `notarize.file`; DMG branding is `targets.mac.dmg`.
  * Architecture: `triple` (an explicit arch triple) beats `universal`; `universal: false` means this host's arch.
  * `cleanup` runs built-in steps in recipe-build before the build (stale DMG volumes, stale .app bundles, lsregister).
+ * `updater: true | "<app-relative .tar.gz>"` emits the Tauri updater tarball and its signature from the signed, stapled .app:
+ * it prepends a `create-mac-updater` command to `postSign` (default output `<App>.app.tar.gz` beside the app's working root).
  */
 export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
   if (!target?.macPackage) return withoutRecipe(target);
@@ -196,6 +201,8 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   const cwd = spec.tauriCwd ?? ".";
   if (typeof cwd !== "string" || path.isAbsolute(cwd) || cwd.split(/[\\/]/).includes("..")) fail("targets.mac.macPackage.tauriCwd must be a relative path inside the app");
   const cleanupSpec = macCleanupSpec(spec.cleanup);
+  if (spec.updater !== undefined && spec.updater !== true && spec.updater !== false && typeof spec.updater !== "string") fail("targets.mac.macPackage.updater must be true or an app-relative .tar.gz path");
+  if (typeof spec.updater === "string" && !/\.tar\.gz$/i.test(relativeInside(spec.updater, "targets.mac.macPackage.updater"))) fail("targets.mac.macPackage.updater must end in .tar.gz");
   // Tauri's universal-apple-darwin target builds both slices and lipos them itself.
   const triple = spec.triple ?? (spec.universal === false ? (process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin") : "universal-apple-darwin");
   if (spec.triple !== undefined) {
@@ -225,8 +232,17 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
     : undefined;
   const wrapped = extras.prepare.length || extras.postBuild.length || cleanup;
   const { macPackage, recipe: _ignoredMac, ...rest } = target;
+  // The updater tarball is made from the signed .app, so it runs in postSign, ahead of any postSign the app declares.
+  const updaterOutput = spec.updater === true ? `${productName}.app.tar.gz` : typeof spec.updater === "string" ? relativeInside(spec.updater, "targets.mac.macPackage.updater") : undefined;
+  const postSign = updaterOutput === undefined ? {} : {
+    postSign: [
+      { cmd: process.execPath, args: [CREATE_MAC_UPDATER, "--app", app, "--output", updaterOutput] },
+      ...(target.postSign === undefined ? [] : Array.isArray(target.postSign) ? target.postSign : [target.postSign]),
+    ],
+  };
   return {
     ...rest,
+    ...postSign,
     prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
     sign: { ...(target.sign ?? {}), prePackageFiles },
     notarize: { ...target.notarize, app, appBeforePackage: true },
@@ -235,11 +251,49 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   };
 }
 
+const IOS_TARGET_KEYS = new Set(["signed", "signingContract", "iosPackage", "artifacts", "hardening", "hardeningAllowances", "qaControlScan", "publishBlocked", "distribution", "ownershipScope", "cargoManifest", "cargoTarget", "recipe"]);
+
+/**
+ * `targets.ios.iosPackage` (bogusyogi/rightkit#349) is validated strictly and kept as `recipe: { kind: "iosPackage", spec }`.
+ * Unlike macPackage there is no hook to expand into: xcodebuild archive and export run in ios-package-recipe.mjs (macOS only),
+ * which release.mjs calls like the Android lane. The target may carry only the keys in IOS_TARGET_KEYS: a hand-written
+ * prePackage / package / sign / notarize / gradle script, or an App Store Connect credential, is refused.
+ * `artifacts` must list the .ipa so the IPA is checked and sealed. `distribution` (the App Store Connect target of an app that
+ * also ships desktop) is validated here exactly as the upload validates it, so a credential in it fails the build.
+ */
+export function expandIosPackageTarget(target, { appRoot: _appRoot } = {}) {
+  if (!isObject(target) || target.iosPackage === undefined) return withoutRecipe(target);
+  const unknown = Object.keys(target).filter((key) => !IOS_TARGET_KEYS.has(key));
+  if (unknown.length) fail(`targets.ios has unknown key(s): ${unknown.join(", ")} (allowed: ${[...IOS_TARGET_KEYS].filter((key) => key !== "recipe").join(", ")}); the iOS recipe replaces prePackage, package, sign and notarize scripts, and App Store Connect credentials never belong in a target`);
+  if (target.distribution !== undefined) {
+    try { validateIosDistribution(target.distribution); } catch (error) {
+      if (error instanceof IosUploadError) fail(`targets.ios.${error.message.replace(/^\[[A-Z0-9_]+\] /, "")}`);
+      throw error;
+    }
+  }
+  if (target.ownershipScope !== undefined && (!Array.isArray(target.ownershipScope) || target.ownershipScope.some((entry) => typeof entry !== "string" || !entry.trim()))) fail("targets.ios.ownershipScope must be an array of repository-relative directory strings");
+  // The Rust the app links (for the feature-closure scan): an app-relative Cargo.toml and its iPhone triple.
+  if (target.cargoManifest !== undefined && (typeof target.cargoManifest !== "string" || !target.cargoManifest.endsWith("Cargo.toml"))) fail("targets.ios.cargoManifest must be an app-relative path to a Cargo.toml");
+  if (target.cargoTarget !== undefined && !/^aarch64-apple-ios(-sim)?$/.test(target.cargoTarget)) fail("targets.ios.cargoTarget must be aarch64-apple-ios or aarch64-apple-ios-sim");
+  if (target.signed !== true) fail("targets.ios must declare signed: true");
+  if (target.signingContract !== undefined && target.signingContract !== IOS_SIGNING_CONTRACT) fail(`targets.ios.iosPackage signs with Xcode automatic signing; signingContract must be ${IOS_SIGNING_CONTRACT}, got ${target.signingContract}`);
+  let spec;
+  try { spec = validateIosPackageConfig(target.iosPackage); } catch (error) {
+    if (error instanceof IosPackageError) fail(`targets.ios.${error.message}`);
+    throw error;
+  }
+  const declared = (target.artifacts ?? []).map((artifact) => String(typeof artifact === "string" ? artifact : artifact?.file).replaceAll("\\", "/").replace(/^\.\//, ""));
+  if (!declared.includes(spec.ipa)) fail("targets.ios.artifacts must list iosPackage.ipa so the IPA is checked and sealed");
+  const { iosPackage, recipe: _ignored, ...rest } = target;
+  return { ...rest, signingContract: IOS_SIGNING_CONTRACT, recipe: { kind: "iosPackage", spec } };
+}
+
 /** Expand whichever declarative package key the target carries. */
 export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot }) {
   const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}) };
   if (platform === "win") return expandWinPackageTarget(target, { appRoot, config, ...injected });
   if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config, ...injected });
-  if (target?.winPackage || target?.macPackage) fail(`winPackage / macPackage are not valid on ${platform}`);
+  if (platform === "ios") return expandIosPackageTarget(target, { appRoot });
+  if (target?.winPackage || target?.macPackage || target?.iosPackage) fail(`winPackage / macPackage / iosPackage are not valid on ${platform}`);
   return target;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.174",
+  "version": "0.4.0",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/pe-content.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// Signature-independent PE content digest and import-closure check (bogusyogi/rightkit#445).
+//   right-release pe digest <file> [--algorithm sha256|sha384|sha512] [--json]
+//   right-release pe imports <file> [--allow <dll[,dll...]>]... [--allow-file <path>] [--json]
+// Pure Buffer parsing, so both run on any host. The digest follows the Authenticode image hash: the CheckSum field,
+// the Certificate Table directory entry and the certificate data itself are excluded, so re-signing or timestamping
+// a binary never changes it.
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { readPeImports } from "./pe-imports.mjs";
+
+const ALGORITHMS = new Set(["sha256", "sha384", "sha512"]);
+function fail(message, code = "PE_INVALID") { throw Object.assign(new Error(message), { code }); }
+
+function layout(buf) {
+  if (buf.length < 0x40 || buf.readUInt16LE(0) !== 0x5a4d) fail("not a PE file (missing MZ)");
+  const pe = buf.readUInt32LE(0x3c);
+  if (pe + 24 > buf.length || buf.readUInt32LE(pe) !== 0x00004550) fail("not a PE file (missing PE signature)");
+  const sectionCount = buf.readUInt16LE(pe + 6);
+  const optionalSize = buf.readUInt16LE(pe + 20);
+  const optional = pe + 24;
+  const magic = buf.readUInt16LE(optional);
+  if (magic !== 0x20b && magic !== 0x10b) fail("unsupported PE optional header");
+  const directories = optional + (magic === 0x20b ? 112 : 96);
+  const numberOfDirectories = buf.readUInt32LE(directories - 4);
+  const checksumAt = optional + 64;
+  const sizeOfHeaders = buf.readUInt32LE(optional + 60);
+  const certEntryAt = directories + 4 * 8;
+  const hasCert = numberOfDirectories > 4;
+  if (checksumAt + 4 > buf.length || sizeOfHeaders > buf.length || (hasCert && certEntryAt + 8 > buf.length)) fail("truncated PE headers");
+  const sectionsAt = optional + optionalSize;
+  const sections = [];
+  for (let i = 0; i < sectionCount; i++) {
+    const at = sectionsAt + i * 40;
+    if (at + 40 > buf.length) fail("truncated PE section table");
+    const rawSize = buf.readUInt32LE(at + 16);
+    const rawPtr = buf.readUInt32LE(at + 20);
+    if (rawSize > 0 && rawPtr + rawSize > buf.length) fail("PE section extends past the end of the file");
+    sections.push({ rawSize, rawPtr });
+  }
+  // The certificate table directory holds a FILE OFFSET (not an RVA).
+  const cert = hasCert ? { offset: buf.readUInt32LE(certEntryAt), size: buf.readUInt32LE(certEntryAt + 4) } : { offset: 0, size: 0 };
+  if (cert.size === 0 && cert.offset !== 0) fail("PE certificate table has an offset but no size");
+  if (cert.size > 0) {
+    if (cert.offset + cert.size > buf.length) fail("PE certificate table extends past the end of the file");
+    // The certificate table must be the terminal region: bytes after it would otherwise escape the digest.
+    if (cert.offset + cert.size !== buf.length) fail("PE certificate table is not the terminal region of the file (bytes follow it)");
+    if (cert.offset < sizeOfHeaders) fail("PE certificate table overlaps the headers");
+    for (const s of sections) if (s.rawSize > 0 && s.rawPtr + s.rawSize > cert.offset) fail("PE certificate table overlaps a section");
+  }
+  return { checksumAt, sizeOfHeaders, certEntryAt, hasCert, sections, cert };
+}
+
+/** Authenticode-style SHA-2 digest of a PE image, independent of its signature, timestamp and CheckSum. */
+export function peContentDigest(bytes, { algorithm = "sha256" } = {}) {
+  if (!ALGORITHMS.has(algorithm)) fail(`unsupported digest algorithm: ${algorithm}`, "PE_USAGE");
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  const l = layout(buf);
+  const hash = createHash(algorithm);
+  hash.update(buf.subarray(0, l.checksumAt));
+  if (l.hasCert) {
+    hash.update(buf.subarray(l.checksumAt + 4, l.certEntryAt));
+    hash.update(buf.subarray(l.certEntryAt + 8, l.sizeOfHeaders));
+  } else {
+    hash.update(buf.subarray(l.checksumAt + 4, l.sizeOfHeaders));
+  }
+  // Every byte after the headers up to the certificate table (or end of file) is hashed: sections, inter-section gaps and overlay.
+  const trailEnd = l.cert.size > 0 ? l.cert.offset : buf.length;
+  if (trailEnd > l.sizeOfHeaders) hash.update(buf.subarray(l.sizeOfHeaders, trailEnd));
+  return hash.digest("hex");
+}
+
+const normalize = (name) => String(name).trim().toLowerCase();
+
+function allowMatcher(allowed) {
+  const entries = allowed.map(normalize).filter(Boolean);
+  return (dll) => entries.some((entry) => (entry.endsWith("*") ? dll.startsWith(entry.slice(0, -1)) : dll === entry));
+}
+
+/**
+ * Check that every DLL a PE imports (regular and delay-load) is in `allowedDlls`. Names compare case-insensitively;
+ * a trailing `*` allows a prefix (`api-ms-win-*`). An empty allow list refuses every import.
+ * @returns {{ok: boolean, architecture: string, imports: string[], delayImports: string[], unexpected: string[]}}
+ */
+export function verifyImportClosure(bytes, allowedDlls) {
+  if (!Array.isArray(allowedDlls)) fail("allowedDlls must be an array", "PE_USAGE");
+  const info = readPeImports(bytes);
+  const allowed = allowMatcher(allowedDlls);
+  const all = [...new Set([...info.imports, ...info.delayImports].map(normalize))].sort();
+  const unexpected = all.filter((dll) => !allowed(dll));
+  return { ok: unexpected.length === 0, architecture: info.architecture, imports: info.imports, delayImports: info.delayImports, unexpected };
+}
+
+const USAGE = "usage: right-release pe digest <file> [--algorithm sha256|sha384|sha512] [--json] | pe imports <file> [--allow dll,...] [--allow-file <path>] [--json]";
+
+function parseArgs(argv) {
+  const [sub, file, ...rest] = argv;
+  const opts = { sub, file, algorithm: "sha256", allow: [], json: false };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--json") opts.json = true;
+    else if (["--algorithm", "--allow", "--allow-file"].includes(arg)) {
+      const value = rest[++i];
+      if (value === undefined || value.startsWith("--")) fail(`${arg} needs a value`, "PE_USAGE");
+      if (arg === "--algorithm") opts.algorithm = value;
+      else if (arg === "--allow") opts.allow.push(...value.split(","));
+      else opts.allow.push(...readFileSync(value, "utf8").split(/\r?\n/).map((l) => l.replace(/#.*/, "").trim()).filter(Boolean));
+    } else fail(`unknown pe argument: ${arg}`, "PE_USAGE");
+  }
+  if (!["digest", "imports"].includes(sub) || !file) fail(USAGE, "PE_USAGE");
+  return opts;
+}
+
+export function main(argv = process.argv.slice(2), out = console) {
+  let opts;
+  try { opts = parseArgs(argv); } catch (error) { out.error(error.message); return 2; }
+  try {
+    const bytes = readFileSync(opts.file);
+    if (opts.sub === "digest") {
+      const digest = peContentDigest(bytes, { algorithm: opts.algorithm });
+      out.log(opts.json ? JSON.stringify({ file: opts.file, algorithm: opts.algorithm, digest }) : `${opts.algorithm}:${digest}`);
+      return 0;
+    }
+    const result = verifyImportClosure(bytes, opts.allow);
+    out.log(opts.json ? JSON.stringify({ file: opts.file, ...result }) : [`${opts.file} (${result.architecture})`, ...result.imports.map((d) => `  import ${d}`), ...result.delayImports.map((d) => `  delay-import ${d}`), ...result.unexpected.map((d) => `  UNEXPECTED ${d}`)].join("\n"));
+    return result.ok ? 0 : 1;
+  } catch (error) {
+    out.error(error.message);
+    return error.code === "PE_USAGE" ? 2 : 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exit(main());

package/preflight.mjs

@@ -192,15 +192,22 @@ export function collectPreflight({
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
+  ownershipScope = null,
   runtimeBudgetAdoption = appRuntimeBudgetAdoptionCheck,
   freeDisk = freeDiskGb,
   projectType,
+  // false for a native iOS app with no Cargo host: no target bridge, Rust compiler cache or Rust budget adoption applies.
+  rust = true,
+  // false skips only the target bridge and the sccache check (a native iOS app that pins a Cargo.lock has no broker target).
+  bridge = true,
   msix = false,
   findSdkTool = findWindowsSdkTool,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
   const swift = isSwiftProject(projectType);
+  const noRust = swift || !rust;
+  const noBridge = noRust || !bridge;
 
   if (swift) {
     const swiftVersion = versionProbe("swift");
@@ -211,7 +218,7 @@ export function collectPreflight({
     );
   }
 
-  if (appRoot && !swift) {
+  if (appRoot && !noBridge) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -273,7 +280,7 @@ export function collectPreflight({
     else if (msix) checks.push(fail("signtool", "msix target configured but no signtool.exe found under any installed Windows SDK", signtoolMissing));
     else checks.push(warn("signtool", "no signtool.exe found under any installed Windows SDK", signtoolMissing));
 
-    const vendorsOpenssl = !swift && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
+    const vendorsOpenssl = !noRust && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
     if (vendorsOpenssl) {
       const perl = resolveWindowsPerl({ env });
       checks.push(
@@ -288,8 +295,8 @@ export function collectPreflight({
     }
   }
 
-  if (swift) {
-    // No Rust compiler cache applies to SwiftPM targets.
+  if (noBridge) {
+    // No Rust compiler cache applies to SwiftPM targets or to a native iOS app without a Cargo host.
   } else if (isBrokerManagedHost(env)) {
     checks.push(ok("compiler-cache", "broker-managed; compiler-cache selection and status are recorded in build receipts"));
   } else {
@@ -321,7 +328,7 @@ export function collectPreflight({
   }
 
   // Held-resource crates are proven at adoption: an app that links one needs its own installed measurement.
-  if (appRoot && !swift) {
+  if (appRoot && !noRust) {
     const adoption = runtimeBudgetAdoption({ appRoot, app, version, cargoLockPaths });
     if (adoption) checks.push(adoption);
   }
@@ -329,7 +336,7 @@ export function collectPreflight({
   if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
     const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
-    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, evidenceFactory: ownershipEvidenceFactory }));
+    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory }));
   }
 
   return checks;
@@ -338,7 +345,7 @@ export function collectPreflight({
 /** Release-blocking: the app keeps no unexcepted copy of a RightKit-owned capability. */
 export function ownershipCheck(repoRoot, options = {}) {
   let checked;
-  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot); }
+  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot, options.scope ?? null); }
   catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
   const { result, evidence, floor } = checked;
   if (checked.ok) {

package/project-type.mjs

@@ -29,7 +29,9 @@ export function resolveProjectType({ appRoot, config = {}, target = {}, exists =
 export const isSwiftProject = (projectType) => projectType === "swiftpm";
 
 /** Executables the build itself needs (the config's own preflight.executables are appended by callers). */
-export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true } = {}) {
+export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true, usesCargo = true } = {}) {
+  // A native iOS app with no Cargo host: git, plus the package manager only when the app has a package.json (xcodebuild/xcodegen are the recipe's own preflight).
+  if (!usesCargo && !isSwiftProject(projectType)) return ["git", ...(usesPackageManager && packageManager ? [packageManager] : [])];
   if (isSwiftProject(projectType)) return ["git", "swift", ...(usesPackageManager && packageManager ? [packageManager] : [])];
   return ["git", packageManager, "cargo", "rustc"];
 }