@rightkit/release 0.2.174 → 0.4.0

package/qa-contract.mjs

@@ -106,6 +106,33 @@ export function qaManifests(appRoot, { readdir = readdirSync } = {}) {
   return found.sort();
 }
 
+/**
+ * Native Apple UI-test targets under `appRoot`: an XcodeGen `project.yml` target of `type: bundle.ui-testing`,
+ * or an `.xcodeproj` whose `project.pbxproj` declares `com.apple.product-type.bundle.ui-testing`. An XCUITest
+ * target is the QA lane of a native iOS or macOS app, which has no package.json or Cargo.toml to pin RightKit QA in.
+ */
+export function nativeAppleUiTestLanes(appRoot, { readdir = readdirSync, readFile = readFileSync } = {}) {
+  const lanes = [];
+  const read = (file) => { try { return readFile(file, "utf8"); } catch { return ""; } };
+  const visit = (dir, depth) => {
+    let entries;
+    try { entries = readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      const relative = path.relative(appRoot, full).split(path.sep).join("/");
+      if (entry.isDirectory()) {
+        if (entry.name.endsWith(".xcodeproj")) {
+          if (read(path.join(full, "project.pbxproj")).includes("com.apple.product-type.bundle.ui-testing")) lanes.push(`native XCUITest lane (${relative})`);
+        } else if (depth < MAX_DEPTH && !SKIP_DIRS.test(entry.name) && relative !== "rightkit" && relative !== "tools/rightkit") visit(full, depth + 1);
+      } else if (entry.name === "project.yml" && /^\s*type:\s*bundle\.ui-testing\s*$/m.test(read(full))) {
+        lanes.push(`native XCUITest lane (${relative})`);
+      }
+    }
+  };
+  visit(appRoot, 0);
+  return [...new Set(lanes)].sort();
+}
+
 /** `[dependencies]`-style section header that holds dependencies (including target-specific ones). */
 const DEPENDENCY_HEADER = /^\[\s*(?:target\.[^\]]+\.)?(?:dev-|build-)?dependencies\s*\]/;
 const DEPENDENCY_TABLE_HEADER = /^\[\s*(?:target\.[^\]]+\.)?(?:dev-|build-)?dependencies\.([A-Za-z0-9_-]+)\s*\]/;
@@ -215,11 +242,12 @@ export function evaluateQaAdoption({ appRoot, repoRoot, app }, deps = {}) {
   }
   const label = app ?? "this app";
   const adopted = [...new Set(pins.filter((pin) => pin.name === NPM_QA || pin.name === CARGO_QA).map((pin) => pin.name))];
-  const lane = exists(path.join(appRoot, "right-qa.config.mjs")) ? ["native wdio lane (right-qa.config.mjs)", ...adopted] : adopted;
+  const nativeApple = deps.nativeAppleLanes ?? nativeAppleUiTestLanes(appRoot, deps);
+  const lane = [...(exists(path.join(appRoot, "right-qa.config.mjs")) ? ["native wdio lane (right-qa.config.mjs)"] : []), ...nativeApple, ...adopted];
   const refusals = [];
   const warnings = [];
   if (lane.length === 0) {
-    refusals.push(`RightKit QA is mandatory for every Orthic Labs app, and ${label} has no QA lane: no right-qa.config.mjs, no ${NPM_QA} in a package.json, no ${CARGO_QA} in a Cargo.toml${unreadable.length ? ` (unreadable: ${unreadable.join("; ")})` : ""}. Adopt it: add ${NPM_QA} to devDependencies (plus ${NPM_QA_CHROME} for a web UI) and/or ${CARGO_QA} to Cargo.toml [dev-dependencies], add the rightkit-qa floor run (smoke.launch, journey), see docs/ADOPTION.md, then run: node rightkit-drift.mjs --apply. Only a repository that is not an app is exempt (${QA_EXEMPTIONS_FILE}); an app cannot opt out`);
+    refusals.push(`RightKit QA is mandatory for every Orthic Labs app, and ${label} has no QA lane: no right-qa.config.mjs, no XCUITest target, no ${NPM_QA} in a package.json, no ${CARGO_QA} in a Cargo.toml${unreadable.length ? ` (unreadable: ${unreadable.join("; ")})` : ""}. Adopt it: add ${NPM_QA} to devDependencies (plus ${NPM_QA_CHROME} for a web UI) and/or ${CARGO_QA} to Cargo.toml [dev-dependencies], add the rightkit-qa floor run (smoke.launch, journey), see docs/ADOPTION.md, then run: node rightkit-drift.mjs --apply. Only a repository that is not an app is exempt (${QA_EXEMPTIONS_FILE}); an app cannot opt out`);
   }
   const lagging = pins
     .map((pin) => ({ ...pin, latest: pin.version && latestFor(versions, pin.ecosystem, pin.name) }))

package/qa-control-scan.mjs

@@ -379,6 +379,10 @@ export function assertNoQaControl(paths, label = "release", { requireBinary = fa
 // string that survives minification (an identifier that is also a string literal, a file/chunk name, a protocol or
 // a build-flag name). Source maps are scanned too: a map that names qaMock.ts proves the module was bundled.
 export const WEB_MOCK_MARKERS = Object.freeze([
+  { id: "platform-qa-selector", pattern: /__RIGHTKIT_QA_PLATFORM__/ },
+  { id: "platform-qa-environment", pattern: /\bRIGHTKIT_QA_PLATFORM\b/ },
+  { id: "platform-qa-entry", pattern: /(?:bootstrapQaPlatform|resolveQaPlatform|configureQaPlatform|@rightkit\/platform-ui\/qa)/ },
+
   { id: "browser-qa-fake", pattern: /browser-qa-fake/ },
   { id: "browser-mock-api", pattern: /browser-mock-api/ },
   { id: "browser-qa-mock-scheme", pattern: /browser-qa-mock:/ },

package/release-dependencies-command.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { assertReleaseDependencies } from "./release-dependencies.mjs";
+import { nodeHostTriple } from "./stage-sidecar-command.mjs";
+import { expandPackageRecipeTarget } from "./package-recipe-targets.mjs";
+
+/** Standalone policy check: host target by default, all declared release targets on request. */
+export async function main(argv, { cwd = process.cwd(), platform = process.platform, arch = process.arch, run } = {}) {
+  let configPath = "right-release.config.mjs", selected, allTargets = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (["--config", "--platform"].includes(arg)) {
+      const value = argv[++i];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} needs a value`);
+      if (arg === "--config") configPath = value; else selected = value;
+    } else if (arg === "--all-targets") allTargets = true;
+    else throw new Error(`unknown check-release-dependencies argument: ${arg}`);
+  }
+  if (allTargets && selected) throw new Error("use --platform or --all-targets");
+  const file = path.resolve(cwd, configPath);
+  const root = path.dirname(file);
+  const config = (await import(pathToFileURL(file).href)).default;
+  if (config?.releaseDependencies === undefined) throw new Error("check-release-dependencies requires releaseDependencies in config");
+  const host = { darwin: "mac", win32: "win", linux: "linux" }[platform];
+  const platforms = allTargets ? Object.keys(config.targets ?? {}) : [selected ?? host];
+  if (!platforms.length) throw new Error("no release targets declared");
+  const results = [];
+  for (const name of platforms) {
+    let target = config.targets?.[name];
+    if (!name || !target) throw new Error(`no release target for ${name ?? platform}; use --platform or --all-targets`);
+    target = expandPackageRecipeTarget(target, { platform: name, appRoot: root, config });
+    if (name !== host && !(target.cargoTarget ?? target.targetTriple ?? target.rustTarget)) throw new Error(`${name} must declare cargoTarget, targetTriple or rustTarget`);
+    if (!allTargets && !selected) target = { ...target, cargoTarget: nodeHostTriple(platform, arch) };
+    results.push(assertReleaseDependencies({ root, config, target, run }));
+  }
+  return results;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  main(process.argv.slice(2)).then((results) => console.log(JSON.stringify(results, null, 2))).catch((error) => {
+    console.error(`right-release check-release-dependencies: ${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/release-dependencies.mjs

@@ -0,0 +1,60 @@
+// App-specific release dependency policy. Development builds never call this gate.
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { resolveCargoTree } from "./release-switch-scan.mjs";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
+import { nodeHostTriple } from "./stage-sidecar-command.mjs";
+import { resolveNativeFinalizerConfig } from "./native-release-finalization.mjs";
+
+function crateNames(names) {
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !/^[A-Za-z0-9_][A-Za-z0-9_-]*$/.test(name))) {
+    throw new TypeError("releaseDependencies.forbiddenCrates must be an array of exact Cargo package names");
+  }
+  return [...new Set(names)];
+}
+
+/** Exact package matches from `cargo tree -e normal --prefix none`, deduplicated across versions. */
+export function forbiddenCrateFindings(treeText, forbiddenCrates) {
+  const denied = new Set(crateNames(forbiddenCrates));
+  const found = new Set();
+  for (const line of String(treeText).split(/\r?\n/)) {
+    const match = line.match(/^([A-Za-z0-9_][A-Za-z0-9_-]*) v\d[^\s]*(?:\s|$)/);
+    if (match && denied.has(match[1])) found.add(match[1]);
+  }
+  return [...found].sort();
+}
+
+/**
+ * Enforce config.releaseDependencies for one release target before packaging.
+ * `commands` may supply already-expanded release hooks; `run` injects the Cargo runner for tests.
+ * Returns { skipped } without Cargo when no policy is declared, else { manifest, target, trees, forbiddenCrates }.
+ * Cargo errors, empty output, invalid policy & forbidden packages throw; dry runs obey this gate too.
+ */
+export function assertReleaseDependencies({ root, config = {}, target = {}, commands, run } = {}) {
+  const policy = config.releaseDependencies;
+  if (policy === undefined) return { skipped: "no releaseDependencies policy" };
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) throw new TypeError("releaseDependencies must be an object");
+  const forbiddenCrates = crateNames(policy.forbiddenCrates);
+  if (policy.features !== undefined && (!Array.isArray(policy.features) || policy.features.some((feature) => typeof feature !== "string" || !feature.trim() || feature.startsWith("-")))) {
+    throw new TypeError("releaseDependencies.features must be an array of Cargo feature names");
+  }
+  if (policy.noDefaultFeatures !== undefined && typeof policy.noDefaultFeatures !== "boolean") throw new TypeError("releaseDependencies.noDefaultFeatures must be boolean");
+  const manifest = policy.manifest ?? target.cargoManifest ?? config.releaseSwitches?.manifest ?? config.nativeAssembly?.cargoManifest ?? config.nativeAssembly?.manifest;
+  if (manifest !== undefined && (typeof manifest !== "string" || !manifest || !existsSync(path.resolve(root, manifest)))) {
+    throw new Error(`release dependencies: declared Cargo manifest does not exist: ${manifest}`);
+  }
+  const triple = target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? nodeHostTriple();
+  const commandList = (value) => value == null ? [] : Array.isArray(value) ? value : [value];
+  const hooks = commands ?? [target.prePackage, target.package, config.nativeAssembly?.packageHook,
+    resolveNativeFinalizerConfig(config.nativeAssembly), ...commandList(target.postSign), target.gradle].filter(Boolean);
+  const closure = resolveCargoTree({
+    root, manifest: manifest === undefined ? undefined : path.relative(root, path.resolve(root, manifest)), features: [...(config.releaseSwitches?.features ?? []), ...(policy.features ?? [])],
+    noDefaultFeatures: policy.noDefaultFeatures ?? false,
+    triple, commandTexts: hooks.flatMap((command) => expandRecipeBuildCommands(command, { root })),
+    edges: "normal", prefix: "none", label: "release dependencies", run,
+  });
+  if (!/^[A-Za-z0-9_][A-Za-z0-9_-]* v\d[^\s]*(?:\s|$)/m.test(closure.treeText)) throw new Error("release dependencies: cargo tree returned no package records");
+  const found = forbiddenCrateFindings(closure.treeText, forbiddenCrates);
+  if (found.length) throw new Error(found.map((crate) => `FAIL: ${crate} is in the release dependency tree (${triple})`).join("\n"));
+  return { manifest: closure.manifest, target: triple, trees: closure.trees.length, forbiddenCrates };
+}

package/release-invocation.mjs

@@ -2,7 +2,7 @@ import { spawnSync } from "./background-process.mjs";
 import { resolveProjectType } from "./project-type.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import { declaredCargoManifest, hasDefaultTauriManifest, resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 
 function git(cwd, args) {
   const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
@@ -129,20 +129,128 @@ export function resolveConfiguredBuildInputs(config, target, label = "release co
   return configured;
 }
 
+/** The validated or raw iOS package spec of a target (`targets.ios.iosPackage`, or the recipe the build expands it to). */
+export function iosPackageSpecOf(target) {
+  if (target?.recipe?.kind === "iosPackage") return target.recipe.spec ?? {};
+  if (target?.iosPackage && typeof target.iosPackage === "object") return target.iosPackage;
+  return null;
+}
+
+/**
+ * Native iOS mode: an iOS target with iosPackage and no src-tauri/Cargo.toml (a declared nativeAssembly.cargoManifest does not
+ * leave it). The app is an xcodegen project built by xcodebuild, not a Tauri host: no broker target, no target bridge, no
+ * Tauri layout. A declared manifest only pins its Cargo.toml and Cargo.lock as inputs; iosPackage.prepare runs the cargo build.
+ * An iOS app that has src-tauri/Cargo.toml (Pulse) keeps the Cargo-backed behaviour exactly.
+ */
+export function isNativeIosTarget({ appRoot, target, exists } = {}) {
+  return iosPackageSpecOf(target) !== null && !hasDefaultTauriManifest({ appRoot, exists });
+}
+
+/**
+ * prepare commands exist to build the app's Rust static library. Without a declared nativeAssembly.cargoManifest the release
+ * would hash and seal none of that Rust source graph, so a native iOS target may not carry them.
+ */
+export function assertNativeIosPrepareHasManifest(iosSpec, config, appRoot) {
+  if (declaredCargoManifest(config)) {
+    const problems = nativeIosPrepareProblems({ appRoot, config, prepare: iosSpec?.prepare ?? [] });
+    if (problems.length) throw new Error(`iosPackage.prepare must be only bare cargo commands when a Rust manifest is declared; express the Rust build as cargo commands in prepare (no node, scripts, pnpm, python, rustup run, +toolchain or other manifest-path), so the features it enables can be checked and the release pins exactly the manifest it builds:\n- ${problems.join("\n- ")}`);
+    return;
+  }
+  if (Array.isArray(iosSpec?.prepare) && iosSpec.prepare.length > 0) {
+    throw new Error("targets.ios.iosPackage.prepare builds a Rust library but no Cargo manifest is declared; declare nativeAssembly.cargoManifest (and keep its Cargo.lock beside it, or name it with nativeAssembly.cargoLockPath) so the Rust manifest and lock are pinned as required release inputs");
+  }
+}
+
+const FEATURE_FLAGS = new Set(["--features", "-F", "--feature"]);
+// The only cargo subcommands a native iOS prepare may run: each takes --features and builds exactly one manifest. xtask, aliases
+// (which .cargo/config.toml can point anywhere) and cargo-<custom> subcommands are opaque to the feature scan.
+const PREPARE_SUBCOMMANDS = new Set(["build", "rustc", "check"]);
+
+/**
+ * With a declared Rust manifest, every prepare command is a bare `cargo`: nothing else can be scanned for the features it enables
+ * or be trusted to build only the manifest the release pins. Returns the reasons a command is refused (empty when all are fine).
+ */
+export function nativeIosPrepareProblems({ appRoot, config, prepare = [] }) {
+  const declared = declaredCargoManifest(config);
+  if (!declared) return [];
+  const manifest = path.resolve(appRoot, declared);
+  const problems = [];
+  prepare.forEach((command, index) => {
+    const where = `targets.ios.iosPackage.prepare[${index}] (${command?.cmd})`;
+    if (command?.cmd !== "cargo") { problems.push(`${where} is not a bare cargo command`); return; }
+    const args = (command.args ?? []).map(String);
+    if (args[0]?.startsWith("+")) problems.push(`${where} selects a toolchain with ${args[0]}`);
+    else if (!PREPARE_SUBCOMMANDS.has(args[0])) problems.push(`${where} runs cargo ${args[0] ?? "(no subcommand)"}; only cargo build, rustc and check are allowed (no xtask, alias or cargo-<custom> subcommand)`);
+    const cwd = path.resolve(appRoot, command.cwd ?? ".");
+    let manifestPathSeen = false;
+    args.forEach((arg, position) => {
+      if (arg === "--config" || arg.startsWith("--config=")) problems.push(`${where} passes ${arg.split("=")[0]}, which can change what cargo builds`);
+      if (arg === "-Z" || /^-Z.+/.test(arg)) problems.push(`${where} passes the unstable flag ${arg.split("=")[0]}`);
+      if (arg === "--target-dir" || arg.startsWith("--target-dir=")) problems.push(`${where} passes --target-dir; build output goes where the release expects it`);
+      const pathValue = arg === "--manifest-path" ? args[position + 1] : arg.startsWith("--manifest-path=") ? arg.slice("--manifest-path=".length) : undefined;
+      if (pathValue !== undefined) manifestPathSeen = true;
+      if (pathValue !== undefined && path.relative(path.resolve(cwd, pathValue), manifest) !== "") problems.push(`${where} builds ${pathValue}, not the declared manifest ${declared}`);
+      const featureValue = FEATURE_FLAGS.has(arg) ? args[position + 1] : arg.startsWith("--features=") ? arg.slice("--features=".length) : /^-F.+/.test(arg) ? arg.slice(2) : undefined;
+      if (featureValue !== undefined && /[$%`]/.test(featureValue)) problems.push(`${where} selects features from a variable (${arg}); the Cargo features it enables cannot be determined`);
+    });
+    // No cwd fallback: cargo would otherwise build whatever Cargo.toml the working directory holds.
+    if (!manifestPathSeen) problems.push(`${where} has no --manifest-path; pass --manifest-path ${declared} so it builds exactly the declared manifest`);
+    // The lock is hashed before prepare runs; without --locked cargo may rewrite it and build different dependencies.
+    if (!args.some((arg) => arg === "--locked" || arg === "--frozen")) problems.push(`${where} has no --locked; pass --locked so cargo builds exactly the pinned Cargo.lock`);
+  });
+  return problems;
+}
+
+/** The repo-relative-to-app Package.resolved an iosPackage with trusted Swift macros/plugins pins, or null when it trusts none. */
+export function iosTrustPackageResolved(iosSpec) {
+  const listed = (value) => Array.isArray(value) && value.length > 0;
+  if (!listed(iosSpec?.trustedSwiftMacros) && !listed(iosSpec?.trustedSwiftPlugins)) return null;
+  if (typeof iosSpec.packageResolved === "string" && iosSpec.packageResolved) return iosSpec.packageResolved;
+  if (typeof iosSpec.project !== "string" || !iosSpec.project) return null;
+  return path.posix.join(iosSpec.project.replaceAll("\\", "/"), "project.xcworkspace", "xcshareddata", "swiftpm", "Package.resolved");
+}
+
+const outside = (root, file) => { const relative = path.relative(root, file); return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative); };
+
 export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
   const swift = resolveProjectType({ appRoot, config, target }) === "swiftpm";
-  const nativeLayout = resolveNativeCargoLayout({
-    appRoot,
-    config,
-    requireManifest: !swift,
-    requireLock: !swift,
-  });
+  const iosSpec = iosPackageSpecOf(target);
+  const nativeIos = !swift && isNativeIosTarget({ appRoot, target });
+  if (nativeIos) assertNativeIosPrepareHasManifest(iosSpec, config, appRoot);
+  // Native iOS: a declared manifest is resolved only to pin its Cargo.toml and lock (refused when there is no lock, or when
+  // either lies outside the repository). The returned layout is null, so no consumer links a broker target or bridges a cargo target.
+  const declaredManifest = nativeIos ? declaredCargoManifest(config) : undefined;
+  if (declaredManifest && outside(repoRoot, path.resolve(appRoot, declaredManifest))) throw new Error(`declared Cargo manifest ${declaredManifest} is outside the repository ${repoRoot}; a release pins only sources it can seal`);
+  const pinnedLayout = nativeIos
+    ? (declaredManifest ? resolveNativeCargoLayout({ appRoot, config, requireManifest: true, requireLock: true, repoRoot }) : null)
+    : resolveNativeCargoLayout({
+      appRoot,
+      config,
+      requireManifest: !swift,
+      requireLock: !swift,
+    });
+  if (nativeIos && pinnedLayout && outside(repoRoot, pinnedLayout.lockPath)) throw new Error(`Cargo.lock ${pinnedLayout.lockPath} is outside the repository ${repoRoot}; a release pins only sources it can seal`);
+  const nativeLayout = nativeIos ? null : pinnedLayout;
+  const optionalIfPresent = (names) => names.map((f) => path.join(appRoot, f)).filter((f) => existsSync(f));
+  // The xcodegen spec is an input whenever iosPackage names one (a declared-but-missing spec is refused below).
+  // Only native iOS mode: an iOS app with src-tauri keeps exactly its pre-existing input set.
+  const iosProjectSpec = nativeIos && typeof iosSpec?.projectSpec === "string" && iosSpec.projectSpec ? [path.resolve(appRoot, iosSpec.projectSpec)] : [];
+  // Reviewed Swift macro/plugin trust (iosPackage.trustedSwiftMacros / trustedSwiftPlugins): the Package.resolved holding the pins is a
+  // required, hashed, git-tracked release input on both iOS paths (native and src-tauri). Without a list nothing is added.
+  const packageResolvedInput = iosTrustPackageResolved(iosSpec);
+  if (packageResolvedInput && outside(repoRoot, path.resolve(appRoot, packageResolvedInput))) throw new Error(`Package.resolved ${packageResolvedInput} is outside the repository ${repoRoot}; a release pins only sources it can seal`);
+  const iosPackageResolved = packageResolvedInput ? [path.resolve(appRoot, packageResolvedInput)] : [];
   const requiredInputs = [
     configPath,
     ...(swift
       // SwiftPM: Package.swift is required; Package.resolved and the Node manifests only when they exist.
-      ? [path.join(appRoot, "Package.swift"), ...["Package.resolved", "package.json", "pnpm-lock.yaml"].map((f) => path.join(appRoot, f)).filter((f) => existsSync(f))]
+      ? [path.join(appRoot, "Package.swift"), ...optionalIfPresent(["Package.resolved", "package.json", "pnpm-lock.yaml"])]
+      : nativeIos
+      // Native iOS: package.json and pnpm-lock.yaml only when the app has them, plus the declared Cargo manifest and its lock.
+      ? [...optionalIfPresent(["package.json", "pnpm-lock.yaml"]), ...(pinnedLayout ? [pinnedLayout.manifestPath, pinnedLayout.lockPath] : [])]
       : [path.join(appRoot, "package.json"), path.join(appRoot, "pnpm-lock.yaml"), nativeLayout.manifestPath, nativeLayout.lockPath]),
+    ...iosProjectSpec,
+    ...iosPackageResolved,
     ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
   ].filter((file, index, files) => files.indexOf(file) === index);
   for (const file of requiredInputs) {
@@ -162,6 +270,8 @@ export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, confi
   return {
     requiredInputs,
     nativeLayout,
+    // The Cargo.lock a native iOS app pins (its layout is null by design); preflight checks it like any other lock.
+    cargoLockPaths: nativeIos && pinnedLayout ? [pinnedLayout.lockPath] : [],
     buildInputs: {
       include: configured.include.map(qualify),
       exclude: (configured.exclude ?? []).map(qualify),

package/release-switch-registry.json

@@ -1,33 +1,132 @@
 {
   "schema": 1,
   "owner": "rightkit-daemon::mode (D4, ratified)",
-  "forbiddenFeatures": ["test-mode", "qa-native", "dev-native", "qa-control", "dev-inspect"],
+  "forbiddenFeatures": [
+    "test-mode",
+    "qa-native",
+    "dev-native",
+    "qa-control",
+    "dev-inspect",
+    "testing",
+    "test-seams",
+    "isolated-test-keychain",
+    "demo",
+    "dev-overrides",
+    "qa-probes",
+    "dev-worker-override",
+    "qa-shot",
+    "qa-tools",
+    "dev-control",
+    "bench-native",
+    "rightkit-qa/control"
+  ],
   "testModeMarker": "RIGHTKIT-TEST-MODE-COMPILED",
   "denyNames": [
-    { "name": "RIGHTKIT_QA_NATIVE", "class": "S1" },
-    { "name": "RIGHTKIT_QA_HIDDEN", "class": "S1" },
-    { "name": "RIGHTKIT_QA_DATA_DIR", "class": "S4" },
-    { "name": "RIGHTKIT_QA_BACKGROUND", "class": "S1" },
-    { "name": "RIGHTKIT_UNDER_TEST", "class": "S1" },
-    { "name": "RIGHTKIT_SUITE_ROOT", "class": "S4" },
-    { "name": "RIGHT_SUITE_DIR", "class": "S4" },
-    { "name": "ORTHIC_SHARED_DIR", "class": "S4" },
-    { "name": "RIGHTKIT_CONTROL_SERVICE", "class": "S3" },
-    { "name": "HEARDRIGHT_ENGINE_TEST_MODE", "class": "S1" },
-    { "name": "HR_APP_DATA_DIR", "class": "S4" },
-    { "name": "MAILRIGHT_DATA_DIR", "class": "S4" },
-    { "name": "MAILRIGHT_EMBED_MODEL_DIR", "class": "S3" },
-    { "name": "MAILRIGHT_ONNXRUNTIME_DYLIB", "class": "S3" },
-    { "name": "CUTRIGHT_DATA_DIR", "class": "S4" },
-    { "name": "GENRIGHT_QA", "class": "S1" },
-    { "name": "GENRIGHT_APP_DATA", "class": "S4" },
-    { "name": "GENRIGHT_SD_SERVER", "class": "S3" },
-    { "name": "CODERIGHT_HOME", "class": "S4" },
-    { "name": "POSTRIGHT_ROLE=daemon-dev", "class": "S1" },
-    { "name": "RIGHTAPP_ENGINE_BIN", "class": "S3" },
-    { "name": "LIGHTCRAFT_SAM3_DIR", "class": "S3" },
-    { "name": "LIGHTCRAFT_DEVICE_ROOTS", "class": "S3" },
-    { "name": "--qa", "class": "S1" },
-    { "name": "--demo", "class": "S1" }
-  ]
+    {
+      "name": "RIGHTKIT_QA_NATIVE",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_QA_HIDDEN",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_QA_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "RIGHTKIT_QA_BACKGROUND",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_UNDER_TEST",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_SUITE_ROOT",
+      "class": "S4"
+    },
+    {
+      "name": "RIGHT_SUITE_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "ORTHIC_SHARED_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "RIGHTKIT_CONTROL_SERVICE",
+      "class": "S3"
+    },
+    {
+      "name": "HEARDRIGHT_ENGINE_TEST_MODE",
+      "class": "S1"
+    },
+    {
+      "name": "HR_APP_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "MAILRIGHT_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "MAILRIGHT_EMBED_MODEL_DIR",
+      "class": "S3"
+    },
+    {
+      "name": "MAILRIGHT_ONNXRUNTIME_DYLIB",
+      "class": "S3"
+    },
+    {
+      "name": "CUTRIGHT_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "GENRIGHT_QA",
+      "class": "S1"
+    },
+    {
+      "name": "GENRIGHT_APP_DATA",
+      "class": "S4"
+    },
+    {
+      "name": "GENRIGHT_SD_SERVER",
+      "class": "S3"
+    },
+    {
+      "name": "CODERIGHT_HOME",
+      "class": "S4"
+    },
+    {
+      "name": "POSTRIGHT_ROLE=daemon-dev",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTAPP_ENGINE_BIN",
+      "class": "S3"
+    },
+    {
+      "name": "LIGHTCRAFT_SAM3_DIR",
+      "class": "S3"
+    },
+    {
+      "name": "LIGHTCRAFT_DEVICE_ROOTS",
+      "class": "S3"
+    },
+    {
+      "name": "--qa",
+      "class": "S1"
+    },
+    {
+      "name": "--demo",
+      "class": "S1"
+    }
+  ],
+  "conditionalForbiddenFeatures": {
+    "content-only": [
+      "devtools",
+      "content-devtools"
+    ]
+  }
 }