@rightkit/release 0.2.174 → 0.4.0

package/release-switch-scan.mjs

@@ -36,7 +36,7 @@
 //         "channel": "env",                               // env | argv | settings | preference | frontend
 //         "anchor": "src/test_mode.rs:97",                // where it is read (informational)
 //         "compiledOut": "feature:test-mode",             // required for S1-S4: feature:<name> | cfg:test |
-//                                                         // cfg:debug_assertions (read exists only there)
+//                                                         // cfg:debug_assertions | swift:DEBUG (read exists only there)
 //         "valueType": "bool",                            // required for S6: bool | int | enum
 //         "userGesture": true,                            // required for S5: chosen by a user gesture
 //         "note": "free text" } ],
@@ -54,7 +54,8 @@ const CHUNK = 4 * 1024 * 1024;
 const FORBIDDEN_CLASSES = new Set(["S1", "S2", "S3", "S4"]);
 const CLASSES = new Set(["S1", "S2", "S3", "S4", "S5", "S6"]);
 const CHANNELS = new Set(["env", "argv", "settings", "preference", "frontend"]);
-const COMPILED_OUT = /^(feature:[A-Za-z0-9_-]+|cfg:test|cfg:debug_assertions)$/;
+// `swift:DEBUG`: the read sits inside `#if DEBUG`, which an Xcode Release configuration compiles out.
+const COMPILED_OUT = /^(feature:[A-Za-z0-9_-]+|cfg:test|cfg:debug_assertions|swift:DEBUG)$/;
 
 export const REGISTRY = JSON.parse(readFileSync(new URL("./release-switch-registry.json", import.meta.url), "utf8"));
 
@@ -64,12 +65,13 @@ export const REGISTRY = JSON.parse(readFileSync(new URL("./release-switch-regist
 // `cargo tree -e features` lines look like: `├── rightkit-daemon feature "test-mode"` (possibly `(*)` suffixed).
 const FEATURE_LINE = /^[\s│├└─|`+\\-]*([A-Za-z0-9_][A-Za-z0-9_-]*)(?: v[^\s]+)? feature "([^"]+)"/;
 
-export function featureClosureFindings(treeText, { forbidden = REGISTRY.forbiddenFeatures } = {}) {
+export function featureClosureFindings(treeText, { forbidden = [...REGISTRY.forbiddenFeatures, ...REGISTRY.conditionalForbiddenFeatures["content-only"]], allowDevtools = false } = {}) {
   const deny = new Set(forbidden);
   const findings = []; const seen = new Set();
   for (const line of String(treeText).split(/\r?\n/)) {
     const m = FEATURE_LINE.exec(line);
-    if (!m || !deny.has(m[2])) continue;
+    if (!m || (!deny.has(m[2]) && !deny.has(`${m[1]}/${m[2]}`))) continue;
+    if (allowDevtools && REGISTRY.conditionalForbiddenFeatures["content-only"].includes(m[2])) continue;
     const id = `forbidden-feature ${m[2]}`;
     const key = `${m[1]}/${m[2]}`;
     if (seen.has(key)) continue;
@@ -120,7 +122,13 @@ function readPackageScripts(root) {
 // skip is `rust === false` (releaseSwitches.rust: false, an explicit "this app has no Rust") and only when no candidate
 // manifest exists. Returns { treeText, manifest } or { skipped: <reason> }. Throws when cargo fails: the caller fails closed.
 // `run` is injectable for tests: (command, args, options) => { status, stdout, stderr, error }.
-export function resolveFeatureClosure({ root, manifest, cargoManifest, rust, features = [], scripts, triple, commandTexts = [], run = spawnSync } = {}) {
+export function resolveFeatureClosure(options = {}) {
+  return resolveCargoTree(options);
+}
+
+/** Shared Cargo tree resolver; keeps each build command's feature selection separate. */
+export function resolveCargoTree({ root, manifest, cargoManifest, rust, features = [], scripts, triple, commandTexts = [],
+  edges = "features,no-dev", prefix, noDefaultFeatures = false, label = "feature closure", run = spawnSync } = {}) {
   const { rel, declared, candidates } = resolveCargoManifestPath({ root, cargoManifest, manifest });
   if (!rel) {
     if (rust === false) return { skipped: "releaseSwitches.rust is false: the app declares no Rust" };
@@ -129,7 +137,8 @@ export function resolveFeatureClosure({ root, manifest, cargoManifest, rust, fea
   if (declared.length && !declared.some((c) => existsSync(path.join(root, c)))) {
     throw new Error(`release-switch-manifest-missing: declared manifest ${declared.join(", ")} does not exist under ${root}`);
   }
-  const baseArgs = ["tree", "-e", "features,no-dev", "--locked", "--manifest-path", path.join(root, rel), "--target", triple || "all"];
+  const baseArgs = ["tree", "--color", "never", "-e", edges, "--locked", "--manifest-path", path.join(root, rel), "--target", triple || "all"];
+  if (prefix) baseArgs.push("--prefix", prefix);
   const pkgScripts = scripts ?? readPackageScripts(root);
   // One cargo tree per distinct (features, no-default-features, manifest) combination, one combination per build command
   // (flags gathered over the command and the package.json scripts it runs). A `--no-default-features` in one command never
@@ -143,30 +152,33 @@ export function resolveFeatureClosure({ root, manifest, cargoManifest, rust, fea
       if (script && depth < 3 && Object.hasOwn(pkgScripts, script) && !seen.has(script)) expand(String(pkgScripts[script]), depth + 1, new Set([...seen, script]));
     };
     expand(text, 0, new Set());
-    let noDefault = false;
+    let noDefault = noDefaultFeatures;
+    let allFeatures = false;
     const enabled = [...features];
     for (const t of expanded) {
       const tokens = commandTokens(t);
       if (tokens.includes("--no-default-features")) noDefault = true;
+      if (tokens.includes("--all-features")) allFeatures = true;
       enabled.push(...featuresInTokens(tokens).enabled);
     }
     const list = [...new Set(enabled)].sort();
-    combos.set(`${rel}|${noDefault}|${list.join(",")}`, { noDefault, list });
+    combos.set(`${rel}|${noDefault}|${allFeatures}|${list.join(",")}`, { noDefault, allFeatures, list });
   };
   const texts = commandTexts.filter(Boolean);
   if (texts.length === 0) comboFor("");
   for (const text of texts) comboFor(text);
   const trees = [];
-  for (const { noDefault, list } of combos.values()) {
+  for (const { noDefault, allFeatures, list } of combos.values()) {
     const args = [...baseArgs];
     if (noDefault) args.push("--no-default-features");
+    if (allFeatures) args.push("--all-features");
     if (list.length) args.push("--features", list.join(","));
     const result = run("cargo", args, { cwd: root, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (result.error || result.status !== 0) {
-      throw new Error(`feature closure: \`cargo ${args.join(" ")}\` failed (${result.error?.message ?? `exit ${result.status}`}): ${String(result.stderr ?? "").trim().slice(0, 600)}. The resolved feature graph is the authoritative test-mode check, so a release cannot continue without it.`);
+      throw new Error(`${label}: \`cargo ${args.join(" ")}\` failed (${result.error?.message ?? `exit ${result.status}`}): ${String(result.stderr ?? "").trim().slice(0, 600)}. The resolved feature graph is the authoritative test-mode check, so a release cannot continue without it.`);
     }
     const out = String(result.stdout ?? "");
-    if (!out.trim()) throw new Error("feature closure: `cargo tree` printed nothing; cannot verify");
+    if (!out.trim()) throw new Error(`${label}: \`cargo tree\` printed nothing; cannot verify`);
     trees.push(out);
   }
   const treeText = trees.join("\n");
@@ -181,7 +193,7 @@ export function inventoryDenyNames(inventoryText) {
 }
 
 // Findings for a build command (`--features test-mode`, `-F`, `--all-features`, ...). Uses the existing tokenizer.
-export function commandSwitchFindings(argv, { forbidden = REGISTRY.forbiddenFeatures } = {}) {
+export function commandSwitchFindings(argv, { forbidden = [...REGISTRY.forbiddenFeatures, ...REGISTRY.conditionalForbiddenFeatures["content-only"]], allowDevtools = false } = {}) {
   const deny = new Set(forbidden);
   const tokens = argv;
   const enabled = []; let all = false;
@@ -196,7 +208,8 @@ export function commandSwitchFindings(argv, { forbidden = REGISTRY.forbiddenFeat
   const findings = [];
   for (const item of enabled) {
     const name = item.includes("/") ? item.slice(item.lastIndexOf("/") + 1) : item;
-    if (deny.has(name)) findings.push({ layer: "feature-closure", rule: `forbidden-feature ${name}`, file: "<command>", reason: `forbidden-feature ${name}: build command enables \`${item}\`` });
+    if (allowDevtools && REGISTRY.conditionalForbiddenFeatures["content-only"].includes(name)) continue;
+    if (deny.has(name) || deny.has(item.replace("?/", "/"))) findings.push({ layer: "feature-closure", rule: `forbidden-feature ${name}`, file: "<command>", reason: `forbidden-feature ${name}: build command enables \`${item}\`` });
   }
   if (all) findings.push({ layer: "feature-closure", rule: "forbidden-feature all-features", file: "<command>", reason: "forbidden-feature all-features: build command enables every feature, including test-mode" });
   return findings;
@@ -208,7 +221,7 @@ export function commandSwitchFindings(argv, { forbidden = REGISTRY.forbiddenFeat
 export function parseInventory(text, label = "switches.json") {
   const issues = [];
   let doc;
-  try { doc = JSON.parse(text); } catch (error) { return { doc: null, issues: [{ rule: "inventory-invalid", file: label, reason: `inventory-invalid: ${label} is not valid JSON (${error.message})` }] }; }
+  try { doc = JSON.parse(text); } catch (error) { return { doc: null, issues: [{ layer: "inventory", rule: "inventory-invalid", file: label, reason: `inventory-invalid: ${label} is not valid JSON (${error.message})` }] }; }
   const bad = (reason) => issues.push({ layer: "inventory", rule: "inventory-invalid", file: label, reason: `inventory-invalid: ${reason}` });
   if (doc?.schema !== 1) bad("`schema` must be 1");
   if (typeof doc?.app !== "string" || !doc.app) bad("`app` must be a non-empty string");
@@ -223,7 +236,7 @@ export function parseInventory(text, label = "switches.json") {
     if (!CHANNELS.has(entry.channel)) bad(`${where}: \`channel\` must be one of ${[...CHANNELS].join(", ")}`);
     if (FORBIDDEN_CLASSES.has(entry.class)) {
       if (typeof entry.compiledOut !== "string" || !COMPILED_OUT.test(entry.compiledOut)) {
-        issues.push({ layer: "inventory", rule: "not-compiled-out", file: label, reason: `not-compiled-out: ${where} is class ${entry.class} and must declare \`compiledOut\` as feature:<name>, cfg:test or cfg:debug_assertions (release builds may not contain it)` });
+        issues.push({ layer: "inventory", rule: "not-compiled-out", file: label, reason: `not-compiled-out: ${where} is class ${entry.class} and must declare \`compiledOut\` as feature:<name>, cfg:test, cfg:debug_assertions or swift:DEBUG (release builds may not contain it)` });
       }
     } else if (entry.class === "S6") {
       if (!["bool", "int", "enum"].includes(entry.valueType)) bad(`${where}: class S6 needs a bounded \`valueType\` (bool, int or enum)`);
@@ -235,13 +248,20 @@ export function parseInventory(text, label = "switches.json") {
 }
 
 const SOURCE_EXT = new Set([".rs", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".jsx", ".vue", ".svelte", ".swift", ".c", ".cc", ".cpp", ".h", ".m", ".mm"]);
-const SKIP_DIRS = new Set(["node_modules", "target", "dist", "build", ".git", "tests", "__tests__", "benches", "examples", "fixtures", "test", "coverage", ".vite"]);
+// Build output and fetched dependencies, never app source: the release recipe's own .right-release/ (Xcode DerivedData, whose
+// SourcePackages/checkouts holds whole dependency repositories), SwiftPM's .build and .swiftpm, and Xcode DerivedData anywhere.
+const SKIP_DIRS = new Set(["node_modules", "target", "dist", "build", ".git", "tests", "__tests__", "benches", "examples", "fixtures", "test", "coverage", ".vite", ".right-release", "deriveddata", "sourcepackages", ".build", ".swiftpm"]);
+// Swift/Xcode test bundles are capitalised (`Tests`, `UITests`, `<App>Tests`, `<App>UITests`): they are test code too.
+const skipDir = (name) => SKIP_DIRS.has(name.toLowerCase()) || /(?:^|[a-z0-9])(?:UI)?Tests$/.test(name);
 const TEST_FILE = /(\.test\.|\.spec\.|_tests?\.rs$|^tests?\.rs$)/;
 
+const CARGO_COMPILE_TIME = /\b(?:option_)?env!\(\s*"([^"]+)"/g;
+// Variables Cargo sets for every build script and crate compilation (the Cargo book, "Environment variables Cargo sets for crates").
+const CARGO_SET = /^(CARGO|CARGO_(PKG_[A-Z_]+|MANIFEST_DIR|MANIFEST_PATH|CRATE_NAME|BIN_NAME|BIN_EXE_[A-Za-z0-9_-]+|PRIMARY_PACKAGE|TARGET_TMPDIR|RUSTC_CURRENT_DIR)|OUT_DIR)$/;
 // Reads of a literal name; group 1 is the name.
 const LITERAL_READS = [
   /\b(?:std::)?env::var(?:_os)?\(\s*"([^"]+)"\s*\)/g,
-  /\b(?:option_)?env!\(\s*"([^"]+)"/g,
+  CARGO_COMPILE_TIME,
   /\bgetenv\(\s*"([^"]+)"\s*\)/g,
   /process\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
   /process\.env\[\s*["']([^"']+)["']\s*\]/g,
@@ -277,7 +297,7 @@ function* walkSource(root) {
     for (const entry of entries) {
       const full = path.join(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
-      if (entry.isDirectory()) { if (!SKIP_DIRS.has(entry.name)) stack.push(full); continue; }
+      if (entry.isDirectory()) { if (!skipDir(entry.name)) stack.push(full); continue; }
       if (entry.isFile() && SOURCE_EXT.has(path.extname(entry.name)) && !TEST_FILE.test(entry.name)) yield full;
     }
   }
@@ -286,7 +306,7 @@ function* walkSource(root) {
 function lineOf(text, index) { let n = 1; for (let i = 0; i < index; i += 1) if (text.charCodeAt(i) === 10) n += 1; return n; }
 
 // inventoryText: contents of switches.json. Returns findings only.
-export function sourceSwitchFindings({ sourceRoot, inventoryText, inventoryLabel = "switches.json", extraDeny = [] }) {
+export function sourceSwitchFindings({ sourceRoot, sourceRoots, inventoryText, inventoryLabel = "switches.json", extraDeny = [] }) {
   const { doc, issues } = parseInventory(inventoryText, inventoryLabel);
   const findings = [...issues];
   if (!doc || !Array.isArray(doc.switches)) return findings;
@@ -294,7 +314,9 @@ export function sourceSwitchFindings({ sourceRoot, inventoryText, inventoryLabel
   const dynamicAllowed = new Set((doc.dynamicReads ?? []).map((d) => path.normalize(d.file)));
   const reads = new Set();
   const denyFlags = [...REGISTRY.denyNames, ...extraDeny.map((n) => ({ name: typeof n === "string" ? n : n.name }))].map((d) => d.name).filter((n) => n.startsWith("-"));
-  for (const file of walkSource(sourceRoot)) {
+  // `sourceRoots` (absolute directories) narrows the walk to what a target compiles; paths stay relative to `sourceRoot`.
+  const walkRoots = Array.isArray(sourceRoots) && sourceRoots.length ? sourceRoots : [sourceRoot];
+  for (const file of walkRoots.flatMap((walkRoot) => [...walkSource(walkRoot)])) {
     let text;
     try { text = readFileSync(file, "utf8"); } catch { continue; }
     const rel = path.relative(sourceRoot, file);
@@ -304,6 +326,9 @@ export function sourceSwitchFindings({ sourceRoot, inventoryText, inventoryLabel
       for (let m = pattern.exec(text); m; m = pattern.exec(text)) {
         const name = m[1];
         if (JS_BUILTINS.has(name) && /\.(ts|tsx|js|mjs|cjs|jsx|vue|svelte)$/.test(file)) continue;
+        // `env!`/`option_env!` of a name Cargo itself sets at compile time (CARGO_PKG_VERSION, CARGO_MANIFEST_DIR, ...) is
+        // not a switch: no caller can choose it. Any other compile-time name is still a read the builder could set.
+        if (pattern === CARGO_COMPILE_TIME && CARGO_SET.test(name)) continue;
         reads.add(name);
         if (!registered.has(name)) findings.push({ layer: "inventory", rule: "unregistered-read", file: `${rel}:${lineOf(text, m.index)}`, reason: `unregistered-read: \`${name}\` is read here but is not listed in ${inventoryLabel}` });
       }
@@ -420,18 +445,18 @@ export function scanSwitchPaths(paths, { denyMap = denyNamesFor() } = {}) {
 // Every layer is optional input; a layer given no input is skipped, except that `requireBinary` fails a scan that
 // found no native binary. `bypass: ["feature-closure"]` exists only for the negative fixtures that prove the binary
 // layer independently; release.mjs never passes it.
-export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, inventoryText, binaryPaths = [], appForbid = [], requireBinary = true, bypass = [], remoteHost } = {}) {
+export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, sourceRoots, inventoryText, binaryPaths = [], appForbid = [], requireBinary = true, bypass = [], remoteHost, devtools } = {}) {
   const findings = [];
   const bypassed = new Set(bypass);
   const denyMap = denyNamesFor({ appForbid: [...appForbid, ...(inventoryText != null ? inventoryDenyNames(inventoryText) : [])] });
   if (!bypassed.has("feature-closure")) {
     if (treeText != null) {
-      findings.push(...featureClosureFindings(treeText));
+      findings.push(...featureClosureFindings(treeText, { allowDevtools: devtools?.mode === "content-only" }));
       findings.push(...remoteServiceFindings(treeText, { remoteHost }));
     }
-    for (const argv of commands) findings.push(...commandSwitchFindings(argv));
+    for (const argv of commands) findings.push(...commandSwitchFindings(argv, { allowDevtools: devtools?.mode === "content-only" }));
   }
-  if (sourceRoot && inventoryText != null) findings.push(...sourceSwitchFindings({ sourceRoot, inventoryText, extraDeny: appForbid }));
+  if (sourceRoot && inventoryText != null) findings.push(...sourceSwitchFindings({ sourceRoot, sourceRoots, inventoryText, extraDeny: appForbid }));
   let receipt = { files: [], binaries: 0 };
   if (binaryPaths.length) {
     const scanned = scanSwitchPaths(binaryPaths, { denyMap });
@@ -450,3 +475,16 @@ export function assertNoReleaseSwitches(input, label = "release") {
     + "Build release and update tiers without the `test-mode` feature, and register every environment read in the app's switches.json.",
   );
 }
+
+/** Local (path) packages in a `cargo tree` text under `root`: the directories of crates a target actually compiles. */
+export function localCrateDirsFromTree(treeText, root) {
+  const dirs = new Set();
+  const base = path.resolve(root);
+  // `name v1 (/abs/path)` and `name v1 (proc-macro) (/abs/path)`; a bare `(*)` or `(proc-macro)` is a marker, not a path.
+  for (const m of String(treeText ?? "").matchAll(/ v\S+(?: \(proc-macro\))? \(([^)]+)\)/g)) {
+    if (!path.isAbsolute(m[1])) continue;
+    const dir = path.resolve(m[1]);
+    if (dir === base || dir.startsWith(base + path.sep)) dirs.add(dir);
+  }
+  return [...dirs].sort();
+}

package/release.mjs

@@ -11,8 +11,8 @@ import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertCargoProfileContract } from "./cargo-profile-contract.mjs";
 import { assertQaAdoption, assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
-import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import { assertNativeIosPrepareHasManifest, assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { declaredCargoManifest, hasDefaultTauriManifest, resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import {
   canonicalPackageIdentity,
   createNativeFinalizationReceipt,
@@ -45,11 +45,15 @@ import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { assertNoQaControl, assertNoWebBundleMocks } from "./qa-control-scan.mjs";
+import { assertReleaseDependencies } from "./release-dependencies.mjs";
 import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
 import { expandRecipeBuildCommands } from "./recipe-build.mjs";
-import { assertNoReleaseSwitches, commandTokens, resolveFeatureClosure } from "./release-switch-scan.mjs";
+import { assertNoReleaseSwitches, commandTokens, localCrateDirsFromTree, resolveFeatureClosure } from "./release-switch-scan.mjs";
+import { iosOwnershipScope } from "./ownership-scope.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { runAndroidRelease, validateAndroidTarget } from "./android-release.mjs";
+import { runIosPackageRecipe } from "./ios-package-recipe.mjs";
+import { releaseSwitchInputs } from "./ios-build-context.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -179,11 +183,14 @@ const SUPERSEDE_JOB_HEAD = /^\n  supersede:\n    needs: \[private-repo-guard\]\n
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
-const nativeLayout = resolveNativeCargoLayout({ appRoot: root, config });
+// A native iOS app (xcodegen project; Rust built by iosPackage.prepare) with no src-tauri and no declared nativeAssembly
+// manifest owns no Cargo layout: null, so the Cargo-derived preflight, sweep and package-contract steps are skipped for it.
+const nativeIos = opts.platform === "ios" && !hasDefaultTauriManifest({ appRoot: root });
+const nativeLayout = nativeIos ? null : resolveNativeCargoLayout({ appRoot: root, config });
 const nativeAssembly = config.nativeAssembly;
 const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
-// A SwiftPM app without a package.json has no Node package contract to validate.
-if (!(resolveProjectType({ appRoot: root, config, target: config.targets?.[opts.platform] }) === "swiftpm" && !existsSync(path.join(root, "package.json")))) {
+// A SwiftPM app or a native iOS app without a package.json has no Node package contract to validate.
+if (!((nativeIos || resolveProjectType({ appRoot: root, config, target: config.targets?.[opts.platform] }) === "swiftpm") && !existsSync(path.join(root, "package.json")))) {
   await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
 }
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
@@ -256,12 +263,18 @@ let androidTarget; // validated Android AAB target (android only; see android-re
 if (opts.platform === "android") {
   try { androidTarget = validateAndroidTarget(target, { root }); } catch (error) { fail(`${config.app ?? "app"} android ${error.message}`); }
 }
+let iosSpec; // validated iOS iosPackage spec (ios only; package-recipe-targets.mjs expands targets.ios, ios-package-recipe.mjs runs it)
+if (opts.platform === "ios") {
+  if (target.recipe?.kind !== "iosPackage") fail(`${config.app ?? "app"} ios must declare targets.ios.iosPackage; there is no hand-written iOS package script`);
+  iosSpec = target.recipe.spec;
+  if (nativeIos) { try { assertNativeIosPrepareHasManifest(iosSpec, config, root); } catch (error) { fail(`${config.app ?? "app"} ios ${error.message}`); } }
+}
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout, projectTarget = config.targets?.[platform] }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout, projectTarget = config.targets?.[platform], pinnedCargoLocks = [] }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -272,6 +285,7 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
   // them means the build needs a real Windows Perl.
   const cargoLockPaths = [
     ...(suppliedNativeLayout?.lockCandidates ?? []),
+    ...pinnedCargoLocks,
     ...(config.cargoLocks ?? []).map((entry) => path.resolve(root, entry)),
   ].filter((entry, index, entries) => entries.indexOf(entry) === index);
   return collectPreflight({
@@ -285,12 +299,14 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
     nativeLayout: suppliedNativeLayout,
     targetLink: suppliedNativeLayout?.targetLink,
     projectType: resolveProjectType({ appRoot: root, config, target: projectTarget }),
+    rust: Boolean(suppliedNativeLayout) || pinnedCargoLocks.length > 0,
+    bridge: Boolean(suppliedNativeLayout),
     msix: targetUsesMsix(projectTarget),
   });
 }
 
 if (opts.doctor) {
-  const { buildInputs, nativeLayout: resolvedNativeLayout } = resolveReleaseBuildInputs({
+  const { buildInputs, nativeLayout: resolvedNativeLayout, cargoLockPaths: pinnedCargoLocks } = resolveReleaseBuildInputs({
     repoRoot: doctorInvocation.repoRoot,
     appRoot: root,
     configPath,
@@ -334,7 +350,7 @@ if (opts.doctor) {
 
   // Config above, MACHINE below. Printing config never told anyone whether this
   // box could finish a build; these checks do.
-  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform, nativeLayout: resolvedNativeLayout });
+  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform, nativeLayout: resolvedNativeLayout, pinnedCargoLocks });
   console.log("preflight:");
   console.log(formatPreflight(checks));
   const failures = preflightFailures(checks);
@@ -349,10 +365,15 @@ let prePackScanned = false; // set once a pre-pack payload scan has seen a nativ
 // or app Cargo manifest enables devtools, qa-native, qa-control or dev-native (also in --dry-run).
 // DevTools: refused for every app except an allow-listed one that declares `devtools: "content-only"` (devtools-policy.mjs).
 let devtoolsAllowance = { mode: "denied" };
+// The Rust a build compiles is checked from the manifest it compiles: targets.<os>.cargoManifest, else the declared
+// nativeAssembly.cargoManifest. iosPackage.prepare commands run cargo for a native iOS app, so they are scanned like any build command.
+const switchInputs = releaseSwitchInputs({ appRoot: root, config, target, prepare: iosSpec?.prepare ?? [], nativeIos });
+if (switchInputs.problems.length) fail(`${config.app ?? "app"} ios release-switch scan cannot see what is built:\n- ${switchInputs.problems.join("\n- ")}`);
 try {
   devtoolsAllowance = resolveDevtoolsAllowance({ config, root });
   if (devtoolsAllowance.mode === "content-only") console.log(`right-release: devtools allowance recorded: ${JSON.stringify(devtoolsEvidence(devtoolsAllowance))}`);
-  assertNoForbiddenBuildFeatures({ root, tier: "release/update", devtools: devtoolsAllowance, cargoManifest: target.cargoManifest, manifest: config.releaseSwitches?.manifest, commands: [
+  assertNoForbiddenBuildFeatures({ root, tier: "release/update", devtools: devtoolsAllowance, cargoManifest: switchInputs.cargoManifest, manifest: config.releaseSwitches?.manifest, commands: [
+    ...switchInputs.commands,
     { label: "target.prePackage", command: target.prePackage },
     { label: "target.package", command: target.package },
     { label: "nativeAssembly.packageHook", command: nativeAssembly?.packageHook },
@@ -373,16 +394,18 @@ const releaseSwitchInventoryText = existsSync(releaseSwitchInventoryPath) ? read
 try {
   // A `node recipe-build.mjs --plan <JSON>` prePackage hides each step's `--features` in one argument: the closure and the
   // command token scan see every prepare / build / postBuild step (a plan that cannot be read or validated fails closed).
-  const closureCommands = [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, ...commandList(target.postSign), target.gradle].filter(Boolean).flatMap((c) => expandRecipeBuildCommands(c, { root }));
+  const closureCommands = [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, ...commandList(target.postSign), target.gradle, ...switchInputs.cargoCommands].filter(Boolean).flatMap((c) => expandRecipeBuildCommands(c, { root }));
+  assertReleaseDependencies({ root, config, target, commands: closureCommands });
   let treeText;
   try {
     const closure = resolveFeatureClosure({
       root,
       manifest: config.releaseSwitches?.manifest,
-      cargoManifest: target.cargoManifest,
+      cargoManifest: switchInputs.cargoManifest,
       rust: config.releaseSwitches?.rust,
       features: config.releaseSwitches?.features ?? [],
-      triple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
+      // iOS ships one device triple; "all" is refused by the build broker and would pull in desktop-only targets.
+      triple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? (opts.platform === "ios" ? "aarch64-apple-ios" : undefined),
       commandTexts: closureCommands,
     });
     if (closure.skipped) console.log(`right-release: feature closure skipped (${closure.skipped})`);
@@ -392,9 +415,26 @@ try {
     console.log(`right-release: dry run: ${error.message}`);
   }
   // remoteHost: rightkit-daemon `remote` is refused in the closure unless the app declares releaseSwitches.remoteHost: true.
-  const closureInput = { treeText, remoteHost: config.releaseSwitches?.remoteHost, commands: closureCommands.map((c) => commandTokens(c)) };
+  const closureInput = { treeText, devtools: devtoolsAllowance, remoteHost: config.releaseSwitches?.remoteHost, commands: closureCommands.map((c) => commandTokens(c)) };
   if (releaseSwitchInventoryText != null) {
-    assertNoReleaseSwitches({ ...closureInput, sourceRoot: root, inventoryText: releaseSwitchInventoryText, appForbid: config.releaseSwitches?.forbid ?? [] }, "source switch inventory");
+    // iOS: only what the iPhone app compiles — the Xcode project and its local packages, plus the local crates in the
+    // resolved aarch64-apple-ios cargo graph (feature-aware, unlike the ownership closure). Other targets walk the app root.
+    let sourceRoots;
+    if (opts.platform === "ios") {
+      const repoTop = git(root, ["rev-parse", "--show-toplevel"]);
+      // Swift side only: the Rust side is the resolved cargo graph below. The ownership scope also folds in the whole
+      // nativeAssembly workspace, which would scan crates (desktop tools, the TUI) the iPhone never links.
+      const swiftSide = (iosOwnershipScope({ repoRoot: repoTop, appRoot: root, target: config.targets?.ios }) ?? []).filter((dir) => dir !== ".rightkit").map((dir) => path.join(repoTop, dir));
+      sourceRoots = [...new Set([...swiftSide, ...localCrateDirsFromTree(treeText, repoTop)])].sort();
+      // A prepare step can stage sources from anywhere (a web bundle, a generated resource) into the app; its working directory must be
+      // inside the scanned roots, or the release fails instead of shipping what the scan never saw. Add the directory to ownershipScope.
+      for (const step of config.targets?.ios?.iosPackage?.prepare ?? []) {
+        const cwd = path.resolve(root, step?.cwd ?? ".");
+        if (!sourceRoots.some((dir) => cwd === dir || cwd.startsWith(dir + path.sep))) throw new Error(`source switch inventory: targets.ios.iosPackage.prepare runs in ${path.relative(repoTop, cwd) || "."}, outside the iOS scan roots (${sourceRoots.map((dir) => path.relative(repoTop, dir) || ".").join(", ")}); list that directory in targets.ios.ownershipScope`);
+      }
+      console.log(`right-release: source switch scan (ios): ${sourceRoots.map((dir) => path.relative(repoTop, dir) || ".").join(", ")}`);
+    }
+    assertNoReleaseSwitches({ ...closureInput, sourceRoot: root, sourceRoots, inventoryText: releaseSwitchInventoryText, appForbid: config.releaseSwitches?.forbid ?? [] }, "source switch inventory");
   } else if (treeText != null || closureInput.commands.length) {
     assertNoReleaseSwitches({ ...closureInput, appForbid: config.releaseSwitches?.forbid ?? [] }, "feature closure");
   }
@@ -406,7 +446,7 @@ try {
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
-if (!command && opts.platform !== "android" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (!command && opts.platform !== "android" && opts.platform !== "ios" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
   fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
 }
@@ -522,6 +562,16 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
     receiptDir: path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts")),
     allowContentOnlyDevtools: devtoolsAllowance.mode === "content-only",
   });
+} else if (opts.platform === "ios") {
+  // Archive and export with Xcode automatic signing in the GUI session, then the IPA verification and the receipt (macOS only;
+  // --dry-run prints the plan anywhere). Upload is a separate command: `right-release upload --platform ios`.
+  await runIosPackageRecipe({
+    root, app: config.app ?? path.basename(root), spec: iosSpec, dryRun: opts.dryRun,
+    receiptDir: path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts")),
+    scanFiles: (label, files, scanOptions) => assertNoQaControlBinaries(label, files, scanOptions),
+    // The build number counter outlives every release id: it lives in the vault state root that right-release build exports.
+    ...(process.env.RIGHT_RELEASE_VAULT_STATE_ROOT ? { counterDir: path.join(path.resolve(process.env.RIGHT_RELEASE_VAULT_STATE_ROOT), "ios-build-numbers") } : {}),
+  });
 } else if (nativeAssembly) {
   if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
   if (nativeFinalizer) {
@@ -645,7 +695,7 @@ function assertNoQaControlBinaries(label, files, { requireBinary = false, prePac
   try {
     const stats = assertNoQaControl(files, label, { requireBinary, allowContentOnlyDevtools: devtoolsAllowance.mode === "content-only" });
     // D4 binary layer, same inputs: no test-mode marker and no S1-S4 selector name in any native binary.
-    assertNoReleaseSwitches({ binaryPaths: files, inventoryText: releaseSwitchInventoryText ?? undefined, appForbid: config.releaseSwitches?.forbid ?? [], requireBinary: false }, `${label} (release switches)`);
+    assertNoReleaseSwitches({ binaryPaths: files, devtools: devtoolsAllowance, inventoryText: releaseSwitchInventoryText ?? undefined, appForbid: config.releaseSwitches?.forbid ?? [], requireBinary: false }, `${label} (release switches)`);
     if (prePack && stats.binaries > 0) prePackScanned = true;
     for (const opaque of stats.opaque) {
       console.log(`right-release: ${label}: ${opaque.kind.toUpperCase()} payload is compressed and cannot be scanned (${opaque.file}); the raw payload was scanned before packing`);
@@ -906,6 +956,8 @@ function hasNativeTargetSpecificPrePackage(target, packageHook) {
 // publish so it cannot race an artifact, and is best-effort: a missing
 // cargo-sweep or a sweep failure must never fail a release.
 function sweepStaleRustArtifacts() {
+  // No Cargo host, nothing of ours to sweep.
+  if (!nativeLayout) return;
   const candidates = [...new Set([root, workdir, nativeLayout.manifestDir, nativeLayout.workspaceRoot])];
   const projects = candidates.filter((dir) => existsSync(path.join(dir, "target")));
   for (const dir of projects) {
@@ -1132,9 +1184,13 @@ function signExistingRefusal(source) {
 // The renderer comes from this monorepo's own packages/ci when present, else from the repository's installed @rightkit/ci; with
 // neither the file is refused, because an unverifiable sign-existing.yml must not be accepted.
 async function loadRightKitCiRenderer(root) {
-  const candidates = [pathToFileURL(fileURLToPath(new URL("../ci/sync.mjs", import.meta.url))).href];
+  return (await loadRightKitCiModule(root, "sync.mjs", "renderLanes"))?.renderLanes ?? null;
+}
+
+async function loadRightKitCiModule(root, file, exportName) {
+  const candidates = [pathToFileURL(fileURLToPath(new URL(`../ci/${file}`, import.meta.url))).href];
   try {
-    candidates.push(pathToFileURL(createRequire(path.join(root, "package.json")).resolve("@rightkit/ci/sync.mjs")).href);
+    candidates.push(pathToFileURL(createRequire(path.join(root, "package.json")).resolve(`@rightkit/ci/${file}`)).href);
   } catch {
     // not installed in the repository; the sibling candidate may still apply
   }
@@ -1142,7 +1198,7 @@ async function loadRightKitCiRenderer(root) {
     try {
       if (href.startsWith("file:") && !existsSync(fileURLToPath(href))) continue;
       const loaded = await import(href);
-      if (typeof loaded.renderLanes === "function") return loaded.renderLanes;
+      if (typeof loaded[exportName] === "function") return loaded;
     } catch {
       // try the next candidate
     }
@@ -1165,6 +1221,57 @@ async function signExistingRenderRefusal(root, manifest, source) {
 }
 
 
+// `workflows` block entries render from code, so they are admitted only when the block passes @rightkit/ci's own
+// validateWorkflows and each file is byte-for-byte the @rightkit/ci render. With no resolvable @rightkit/ci they are refused.
+async function validateDeclaredWorkflowBlock(root, appName, manifest, declaredFiles) {
+  const validator = (await loadRightKitCiModule(root, "workflows.mjs", "validateWorkflows"))?.validateWorkflows;
+  const renderLanes = await loadRightKitCiRenderer(root);
+  if (!validator || !renderLanes) fail(`${appName} right-git-ci-only policy cannot verify .rightgit.json workflows: @rightkit/ci is not available (install @rightkit/ci as a devDependency)`);
+  const errors = [];
+  validator(manifest, errors);
+  if (errors.length > 0) fail(`${appName} right-git-ci-only policy refuses the .rightgit.json workflows block: ${errors.join("; ")}`);
+  let rendered;
+  try {
+    rendered = renderLanes(manifest, root);
+  } catch (error) {
+    fail(`${appName} right-git-ci-only policy cannot render the .rightgit.json workflows block: ${error.message}`);
+  }
+  for (const file of declaredFiles) {
+    const expected = rendered.find((entry) => entry.filename === file)?.content;
+    const actual = await readFile(path.join(root, ".github", "workflows", file), "utf8");
+    if (typeof expected !== "string" || actual.replace(/\r\n?/g, "\n") !== expected.replace(/\r\n?/g, "\n")) {
+      fail(`${appName} ${file} is not byte-for-byte the @rightkit/ci render of its .rightgit.json workflows entry (run right-git sync)`);
+    }
+  }
+}
+
+// Structural backstop for declared workflows (after render equality): the one top-level permissions block is exactly
+// `contents: read`, no other permissions key exists, no secrets reference, every `uses:` is commit-pinned, and every
+// checkout step sets persist-credentials: false. Steps are split on step-list indentation, not matched as free text.
+function declaredWorkflowPolicyRefusal(appName, workflow, source) {
+  const refuse = (why) => fail(`${appName} right-git managed ${workflow} violates the declared-workflow policy: ${why}`);
+  const lines = source.replace(/\r\n?/g, "\n").split("\n");
+  const permissionsAt = lines.flatMap((line, i) => (/^\s*permissions\s*:/.test(line) ? [i] : []));
+  if (permissionsAt.length !== 1 || lines[permissionsAt[0]] !== "permissions:" || lines[permissionsAt[0] + 1] !== "  contents: read" || /^ {2,}\S/.test(lines[permissionsAt[0] + 2] ?? "")) refuse("permissions must be exactly one top-level `contents: read`");
+  if (/\bsecrets\b/i.test(source)) refuse("it references the secrets context");
+  let step = null;
+  const steps = [];
+  for (const line of lines) {
+    if (/^ {6}- /.test(line)) { step = [line]; steps.push(step); }
+    else if (step && (/^ {7,}\S/.test(line) || line === "")) step.push(line);
+    else step = null;
+  }
+  for (const body of steps) {
+    const uses = /^ {6}- uses: (\S+)|^ {8}uses: (\S+)/m.exec(body.join("\n"));
+    if (!uses) continue;
+    const ref = uses[1] ?? uses[2];
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+@[0-9a-f]{40}$/.test(ref)) refuse(`action ${ref} is not commit-pinned`);
+    if (/^actions\/checkout@/.test(ref) && !body.some((line) => /^ {10}persist-credentials: false\s*$/.test(line))) refuse("a checkout step does not set persist-credentials: false");
+    if (body.some((line) => /persist-credentials:\s*true/.test(line))) refuse("persist-credentials: true");
+  }
+  if (/^\s*(?:- )?uses:/m.test(lines.filter((l) => !steps.some((b) => b.includes(l))).join("\n"))) refuse("a uses: sits outside a step list");
+}
+
 async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
@@ -1188,15 +1295,29 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     || lanes.some((lane) => !safeLanes.has(lane))) {
     fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from [${[...safeLanes].map((lane) => `"${lane}"`).join(", ")}] and including "ci" or "swift-check"`);
   }
-  const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
+  // Workflows declared under the manifest's `workflows` block (@rightkit/ci workflows.mjs: explicit `file`,
+  // else `<name>.yml`) are managed files too, in addition to the lane files.
+  const declaredWorkflows = manifest?.workflows;
+  if (declaredWorkflows !== undefined && (declaredWorkflows === null || typeof declaredWorkflows !== "object" || Array.isArray(declaredWorkflows))) {
+    fail(`${appName} right-git-ci-only policy requires .rightgit.json workflows to be an object`);
+  }
+  const declaredFiles = Object.entries(declaredWorkflows ?? {}).map(([name, config]) => {
+    if (config === null || typeof config !== "object" || Array.isArray(config)) fail(`${appName} right-git-ci-only policy requires .rightgit.json workflows.${name} to be an object`);
+    const file = typeof config?.file === "string" ? config.file : `${name}.yml`;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,60}\.yml$/.test(file)) fail(`${appName} right-git-ci-only policy refuses workflow file name ${JSON.stringify(file)} declared by .rightgit.json`);
+    return file;
+  });
+  const expectedWorkflows = [...new Set([...lanes.map((lane) => `${lane}.yml`), ...declaredFiles])].sort();
   if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
     fail(`${appName} right-git-ci-only policy requires workflows declared by .rightgit.json; expected ${expectedWorkflows.join(", ")}, got: ${workflows.join(", ")}`);
   }
+  if (declaredFiles.length > 0) await validateDeclaredWorkflowBlock(root, appName, manifest, declaredFiles);
   for (const workflow of expectedWorkflows) {
     const source = await readFile(path.join(root, ".github", "workflows", workflow), "utf8");
     if (!source.startsWith("# Managed by right-git")) {
       fail(`${appName} ${workflow} is not marked as right-git managed`);
     }
+    if (declaredFiles.includes(workflow)) declaredWorkflowPolicyRefusal(appName, workflow, source);
     const jobSpan = (jobName) => {
       const marker = `\n  ${jobName}:\n`;
       const start = source.indexOf(marker);
@@ -1361,6 +1482,8 @@ function expandEnv(value) {
 // notices and the source offer, optionally run the app's stage command, and (before signing) check the staged files.
 async function prepareMediaSidecar(root, { stage = true } = {}) {
   if (!mediaSidecarConfig) return null;
+  // Unreachable for iOS (mediaSidecar is mac and win only, refused above); a Cargo-less layout must still never be dereferenced.
+  if (!nativeLayout) fail(`${config.app ?? "app"} ${opts.platform} mediaSidecar needs a native Cargo manifest to read the sidecar catalog, and this app has none`);
   let plan;
   try {
     const loaded = loadSidecarCatalog({ config: mediaSidecarConfig, root, manifestPath: nativeLayout.manifestPath });