@rightkit/release 0.2.40 → 0.2.42

package/build-release.mjs

@@ -20,9 +20,10 @@ import {
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
+import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
+import { createTargetBridge } from "./target-bridge.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
@@ -79,8 +80,8 @@ try {
   }
   const target = config.targets?.[platform];
   if (!target?.package) fail(`${config.app} has no ${platform} package command`);
-  const requiredInputs = inputPaths(appRoot, configPath, target);
-  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, appRoot, target.buildInputs ?? config.buildInputs, requiredInputs), commit);
+  const { requiredInputs, buildInputs } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
+  const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
@@ -125,8 +126,10 @@ try {
     tools: toolVersions,
     createdAt: new Date().toISOString(),
   };
+  const targetLink = path.join(appRoot, "src-tauri", "target");
+  const targetBridge = createTargetBridge({ link: targetLink, target: env.CARGO_TARGET_DIR });
 
-  const result = await runBuildStateMachine({
+  const result = await targetBridge.run(async () => runBuildStateMachine({
     root: repoRoot,
     app: config.app,
     version: config.version,
@@ -158,9 +161,9 @@ try {
       prepare: async () => {
         throwIfInterrupted();
         const cacheTarget = env.CARGO_TARGET_DIR;
-        const targetLink = path.join(appRoot, "src-tauri", "target");
         mkdirSync(cacheTarget, { recursive: true });
-        if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
+        if (cacheMode === "shared") targetBridge.ensure();
+        else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
@@ -186,7 +189,7 @@ try {
         checkpoint(stateRoot, "sealed");
       },
     },
-  });
+  }));
   if (cacheMode === "shared") {
     const snapshot = inspectCache({ cacheRoot: sharedCacheRoot });
     const plan = planCachePrune({ snapshot, policy: readCachePolicy(process.env), protectedEntryIds: new Set([sharedLayout.id]) });
@@ -200,37 +203,6 @@ try {
   lock.release();
 }
 
-function inputPaths(appRoot, configPath, target) {
-  const candidates = [
-    configPath,
-    path.join(appRoot, "package.json"),
-    path.join(appRoot, "pnpm-lock.yaml"),
-    path.join(appRoot, "src-tauri", "Cargo.toml"),
-    path.join(appRoot, "src-tauri", "Cargo.lock"),
-    ...(target.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file))),
-  ];
-  const required = [...new Set(candidates)];
-  for (const file of required) if (!existsSync(file)) fail(`missing required release input: ${file}`);
-  return required;
-}
-
-function repoBuildInputs(repoRoot, appRoot, configured, requiredInputs) {
-  if (!Array.isArray(configured?.include) || configured.include.length === 0) {
-    fail("release config must declare non-empty buildInputs.include paths");
-  }
-  const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
-  const qualify = (pattern) => path.posix.normalize([appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/"));
-  const required = requiredInputs
-    .map((file) => path.relative(repoRoot, file).replaceAll("\\", "/"))
-    .filter((file) => file && file !== ".." && !file.startsWith("../") && !path.isAbsolute(file));
-  return {
-    include: configured.include.map(qualify),
-    exclude: (configured.exclude ?? []).map(qualify),
-    required,
-    json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
-  };
-}
-
 function hashInputs(files) {
   return Object.fromEntries(files.map((file) => [path.relative(path.dirname(path.dirname(file)), file), hashFile(file)]));
 }
@@ -433,10 +405,6 @@ function killTree(pid) {
   else { try { process.kill(-pid, "SIGTERM"); } catch { try { process.kill(pid, "SIGTERM"); } catch { /* gone */ } } }
 }
 
-function expandEnv(value) {
-  return String(value).replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? "").replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
-}
-
 function writeJson(file, value) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);

package/build-release.test.mjs

@@ -42,3 +42,9 @@ test("dirty release config is rejected before the config module is imported", ()
   assert.ok(guard >= 0, "config cleanliness guard must exist");
   assert.ok(guard < imported, "config cleanliness guard must run before module import");
 });
+
+test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
+  assert.match(source, /createTargetBridge\(\{ link: targetLink, target: env\.CARGO_TARGET_DIR \}\)/);
+  assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
+  assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-invocation.mjs

@@ -25,6 +25,48 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
   if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
 }
 
+export function resolveConfiguredBuildInputs(config, target, label = "release config") {
+  const configured = target?.buildInputs ?? config?.buildInputs;
+  if (!Array.isArray(configured?.include) || configured.include.length === 0) {
+    throw new Error(`${label} must declare non-empty buildInputs.include paths`);
+  }
+  return configured;
+}
+
+export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
+  const requiredInputs = [
+    configPath,
+    path.join(appRoot, "package.json"),
+    path.join(appRoot, "pnpm-lock.yaml"),
+    path.join(appRoot, "src-tauri", "Cargo.toml"),
+    path.join(appRoot, "src-tauri", "Cargo.lock"),
+    ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
+  ].filter((file, index, files) => files.indexOf(file) === index);
+  for (const file of requiredInputs) {
+    if (!existsSync(file)) throw new Error(`missing required release input: ${file}`);
+  }
+
+  const configured = resolveConfiguredBuildInputs(config, target);
+  const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
+  const qualify = (pattern) => path.posix.normalize([
+    appPrefix,
+    pattern.replaceAll("\\", "/").replace(/^\.\//, ""),
+  ].filter(Boolean).join("/"));
+  const required = requiredInputs
+    .map((file) => path.relative(repoRoot, file).replaceAll("\\", "/"))
+    .filter((file) => file && file !== ".." && !file.startsWith("../") && !path.isAbsolute(file));
+
+  return {
+    requiredInputs,
+    buildInputs: {
+      include: configured.include.map(qualify),
+      exclude: (configured.exclude ?? []).map(qualify),
+      required,
+      json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
+    },
+  };
+}
+
 function pathspec(pattern, exclude = false) {
   const normalized = pattern.replaceAll("\\", "/").replace(/^\.\//, "");
   return `:(top,${exclude ? "exclude," : ""}glob)${normalized}`;
@@ -89,3 +131,9 @@ function statusFiles(repoRoot, include, exclude = []) {
   }
   return files;
 }
+
+function expandEnv(value, env) {
+  return String(value)
+    .replace(/%([^%]+)%/g, (_, name) => env[name] ?? "")
+    .replace(/\$\{([^}]+)\}/g, (_, name) => env[name] ?? "");
+}

package/release.mjs

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { access, readFile, readdir } from "node:fs/promises";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
+import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -63,7 +64,20 @@ if (opts.upload) fail("combined build+upload was removed; run right-release buil
 if (opts.tier && !TIERS.has(opts.tier)) usage(2, `invalid --tier: ${opts.tier} (expected patch|update)`);
 const sccacheVersion = assertSharedSccachePrerequisite();
 
-const configPath = path.resolve(opts.config);
+const requestedConfigPath = path.resolve(opts.config);
+const configPath = opts.doctor ? realpathSync(requestedConfigPath) : requestedConfigPath;
+let doctorInvocation;
+if (opts.doctor) {
+  const invocationRoot = path.dirname(configPath);
+  const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
+  assertPrimaryReleaseCheckout(repoRoot);
+  const relativeConfig = path.relative(repoRoot, configPath).replaceAll("\\", "/");
+  if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
+  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
+  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+  if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
+  doctorInvocation = { repoRoot, commit };
+}
 const config = (await import(pathToFileURL(configPath))).default;
 if (!config) usage(2, `config did not export default: ${configPath}`);
 if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<missing>"} (expected 1)`);
@@ -85,6 +99,17 @@ if (opts.platform === "win" && !target.sign?.files?.length) {
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 if (opts.doctor) {
+  const { buildInputs } = resolveReleaseBuildInputs({
+    repoRoot: doctorInvocation.repoRoot,
+    appRoot: root,
+    configPath,
+    config,
+    target,
+  });
+  const dirtyInputs = dirtyBuildInputs(doctorInvocation.repoRoot, buildInputs, doctorInvocation.commit);
+  if (dirtyInputs.length > 0) {
+    fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
+  }
   console.log(`right-release ${VERSION}`);
   console.log(`config: ${configPath}`);
   console.log(`app: ${config.app}`);
@@ -178,6 +203,12 @@ function fail(message) {
   process.exit(1);
 }
 
+function git(cwd, runArgs) {
+  const result = spawnSync("git", runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`git ${runArgs.join(" ")} failed: ${(result.stderr ?? result.stdout ?? "").trim()}`);
+  return result.stdout.trim();
+}
+
 function assertSharedSccachePrerequisite() {
   if (process.env.RIGHT_RELEASE_CACHE_MODE !== "shared") return null;
   const result = spawnSync("sccache", ["--version"], { encoding: "utf8", windowsHide: true });

package/release.test.mjs

@@ -2,14 +2,20 @@ import assert from "node:assert/strict";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import test from "node:test";
 
 const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
+const cli = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
 const versions = JSON.parse(readFileSync(new URL("./rightkit-versions.json", import.meta.url), "utf8"));
+const defaultBuildInputs = { include: ["package.json", "pnpm-lock.yaml", "src-tauri/**"] };
 
-function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest } = {}) {
+function git(cwd, ...args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -40,6 +46,7 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
       checks: [],
       targets: {
         win: {
+          ...(buildInputs ? { buildInputs } : {}),
           signed,
           package: { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
@@ -51,6 +58,12 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
       },
     })};\n`,
   );
+  writeFileSync(path.join(dir, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n", "utf8");
+  const tauriDir = path.join(dir, "src-tauri");
+  mkdirSync(tauriDir, { recursive: true });
+  writeFileSync(path.join(tauriDir, "Cargo.toml"), `[package]\nname = "fixture-tauri"\nversion = "0.0.0"\nedition = "2021"\n[lib]\npath = "lib.rs"\n`, "utf8");
+  writeFileSync(path.join(tauriDir, "Cargo.lock"), "# fixture lock\n", "utf8");
+  writeFileSync(path.join(tauriDir, "lib.rs"), "pub fn fixture() {}\n", "utf8");
   if (cargoManifest) {
     writeFileSync(path.join(dir, "Cargo.toml"), `${cargoManifest}\n[lib]\npath = "fixture.rs"\n`, "utf8");
     writeFileSync(path.join(dir, "fixture.rs"), "", "utf8");
@@ -61,7 +74,6 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
     writeFileSync(path.join(cargoDir, "config.toml"), cargoConfig, "utf8");
   }
   if (repoCargoConfig) {
-    mkdirSync(path.join(fixtureRoot, ".git"), { recursive: true });
     const cargoDir = path.join(fixtureRoot, ".cargo");
     mkdirSync(cargoDir, { recursive: true });
     writeFileSync(path.join(cargoDir, "config.toml"), repoCargoConfig, "utf8");
@@ -71,6 +83,11 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
     mkdirSync(sibling, { recursive: true });
     writeFileSync(path.join(sibling, "Cargo.toml"), siblingCargoManifest, "utf8");
   }
+  git(fixtureRoot, "init", "--initial-branch", "main");
+  git(fixtureRoot, "config", "user.email", "release-test@example.com");
+  git(fixtureRoot, "config", "user.name", "Release Test");
+  git(fixtureRoot, "add", ".");
+  git(fixtureRoot, "commit", "-m", "initial");
   return config;
 }
 
@@ -128,6 +145,12 @@ function runRaw(config, ...args) {
   });
 }
 
+function runDoctor(config, ...args) {
+  return spawnSync(process.execPath, [cli, "doctor", "--config", config, "--platform", "win", ...args], {
+    encoding: "utf8",
+  });
+}
+
 test("accepts a tier-neutral internal build", () => {
   const result = run(fixture());
   assert.equal(result.status, 0, result.stderr);
@@ -204,6 +227,76 @@ test("doctor accepts an exact crates.io RightKit pin with benign Cargo config",
   assert.match(result.stdout, /right-release/);
 });
 
+test("doctor rejects a selected target with missing or empty buildInputs.include", () => {
+  for (const buildInputs of [null, { include: [] }]) {
+    const result = run(fixture({ buildInputs }), "--doctor");
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /non-empty buildInputs\.include paths/i);
+  }
+});
+
+test("doctor passes a clean selected target", () => {
+  const result = runDoctor(fixture());
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /right-release 0\.2\.42/);
+});
+
+test("doctor permits unrelated dirt", () => {
+  const config = fixture();
+  const root = path.dirname(config);
+  mkdirSync(path.join(root, "notes"));
+  writeFileSync(path.join(root, "notes", "scratch.md"), "unrelated\n");
+  const result = run(config, "--doctor");
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test("doctor rejects tracked dirt inside declared buildInputs with the exact path", () => {
+  const config = fixture();
+  writeFileSync(path.join(path.dirname(config), "src-tauri", "lib.rs"), "pub fn changed() {}\n");
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty files can change the packaged app[\s\S]*- src-tauri\/lib\.rs/i);
+});
+
+test("doctor rejects untracked dirt inside declared buildInputs with the exact path", () => {
+  const config = fixture();
+  writeFileSync(path.join(path.dirname(config), "src-tauri", "new-runtime.rs"), "pub fn new_runtime() {}\n");
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty files can change the packaged app[\s\S]*- src-tauri\/new-runtime\.rs/i);
+});
+
+test("doctor rejects dirty required release metadata even when it is not declared", () => {
+  const config = fixture({ buildInputs: { include: ["src-tauri/lib.rs"] } });
+  writeFileSync(path.join(path.dirname(config), "pnpm-lock.yaml"), "lockfileVersion: '9.1'\n");
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty files can change the packaged app[\s\S]*- pnpm-lock\.yaml/i);
+});
+
+test("doctor rejects a dirty release config before importing it", () => {
+  const config = fixture();
+  writeFileSync(config, `${readFileSync(config, "utf8")}\n// dirty config\n`);
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty release config cannot be executed[\s\S]*- right-release\.config\.mjs/i);
+});
+
+test("doctor rejects linked and detached checkouts like build runtime", () => {
+  const primaryConfig = fixture();
+  const primary = path.dirname(primaryConfig);
+  const linked = `${primary}-linked`;
+  git(primary, "worktree", "add", "--detach", linked);
+  const linkedResult = run(path.join(linked, "right-release.config.mjs"), "--doctor");
+  assert.notEqual(linkedResult.status, 0);
+  assert.match(linkedResult.stderr, /must be invoked from the primary Git worktree/i);
+
+  git(primary, "checkout", "--detach");
+  const detachedResult = run(primaryConfig, "--doctor");
+  assert.notEqual(detachedResult.status, 0);
+  assert.match(detachedResult.stderr, /detached HEAD is forbidden/i);
+});
+
 test("doctor scopes Cargo inspection to the configured app inside a monorepo", () => {
   const config = fixture({
     cargoManifest: `[package]\nname = "fixture"\nversion = "0.0.0"\nedition = "2021"\n[dependencies]\nrightkit-license = "=0.1.2"`,

package/right-suite-contract.test.mjs

@@ -11,8 +11,12 @@ import {
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
 import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
+import { resolveConfiguredBuildInputs } from "./release-invocation.mjs";
 
-const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const workspace = path.resolve(
+  process.env.RIGHT_SUITE_CONTRACT_WORKSPACE
+    ?? new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"),
+);
 // The Right Suite web layer's repo + filesystem path is `rightsites` post the 2026-07-15 naming lock;
 // a not-yet-renamed checkout may still have `rightapps`. Resolve whichever exists so the contract
 // passes on both. (The runtime service namespace stays `rightapps` — that is deliberately untouched.)
@@ -59,6 +63,10 @@ function assertMacPackageEntry(packageCommand, scripts, label) {
   assert.doesNotMatch(implementation, /\bpnpm(?:\s+run)?\s+rightkit:package:mac\b/, `${label} rightkit:package:mac must not recurse into itself`);
 }
 
+function assertBuildInputs(config, target, label) {
+  resolveConfiguredBuildInputs(config, target, label);
+}
+
 function resolveCargoVersionContract(versionManifest, canonicalVersions) {
   const consumer = new Map(Object.entries(versionManifest.cargo ?? {}));
   const staged = new Map(Object.entries(versionManifest.stagedCargo ?? {}));
@@ -389,10 +397,20 @@ test("mac release config uses a dedicated non-recursive package entry point", ()
   );
 });
 
+test("every app platform requires effective non-empty build inputs", () => {
+  assert.doesNotThrow(() => assertBuildInputs(
+    { buildInputs: { include: ["src/**"] } },
+    {},
+    "fixture mac",
+  ));
+  assert.throws(() => assertBuildInputs({}, {}, "fixture win"), /fixture win must declare non-empty buildInputs\.include paths/);
+  assert.throws(() => assertBuildInputs({}, { buildInputs: { include: [] } }, "fixture mac"), /fixture mac must declare non-empty buildInputs\.include paths/);
+});
+
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.40");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.42");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -404,8 +422,12 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/license": "0.1.6",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41"],
   });
+  assert.ok(
+    new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.41"),
+    "the previously published @rightkit/release 0.2.41 must remain accepted during the 0.2.42 rollout",
+  );
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),
     "utf8",
@@ -486,6 +508,7 @@ for (const app of apps) {
     assert.ok(config.version);
     for (const platform of ["mac", "win"]) {
       const target = config.targets[platform];
+      assertBuildInputs(config, target, `${app.key} ${platform}`);
       assert.equal(target.signed, true);
       assert.equal(target.upload, undefined, "generic uploads bypass tier manifest routing");
       assert.equal(target.publish.cmd, "right-release");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.40",
+    "@rightkit/release": "0.2.42",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -17,7 +17,7 @@
     "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/target-bridge.mjs

@@ -0,0 +1,119 @@
+import { lstatSync, mkdirSync, realpathSync, symlinkSync, unlinkSync } from "node:fs";
+import path from "node:path";
+
+export function createTargetBridge({
+  link,
+  target,
+  platform = process.platform,
+  lstat = lstatSync,
+  mkdir = mkdirSync,
+  realpath = realpathSync,
+  symlink = symlinkSync,
+  unlink = unlinkSync,
+}) {
+  let acquired = false;
+  let created = false;
+  let ownership = null;
+
+  const bridge = {
+    ensure() {
+      mkdir(target, { recursive: true });
+      let entry = readEntry(link, lstat);
+      if (!entry) {
+        symlink(target, link, platform === "win32" ? "junction" : "dir");
+        entry = lstat(link);
+        if (!entry.isSymbolicLink()) throw new Error(`RightKit target bridge was not created as a symbolic link: ${link}`);
+        if (!sameRealPath(link, target, realpath, platform)) {
+          throw new Error(`RightKit target bridge is not the owned shared cache target after creation: ${link}`);
+        }
+        ownership = entryIdentity(entry);
+        created = true;
+      } else {
+        if (!entry.isSymbolicLink()) throw new Error(`primary checkout target is not a symbolic link; refusing to replace it: ${link}`);
+        if (!sameRealPath(link, target, realpath, platform)) {
+          throw new Error(`primary checkout target is not the owned shared cache target; refusing to replace it: ${link}`);
+        }
+      }
+      acquired = true;
+      return { created, link, target };
+    },
+
+    release() {
+      if (!acquired) return false;
+      if (!ownership) {
+        acquired = false;
+        return false;
+      }
+      const entry = readEntry(link, lstat);
+      if (!entry) {
+        acquired = false;
+        return false;
+      }
+      if (!sameEntry(entry, ownership)) {
+        acquired = false;
+        return false;
+      }
+      let exactOwnedTarget = false;
+      try {
+        exactOwnedTarget = sameRealPath(link, target, realpath, platform);
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+      if (!exactOwnedTarget) {
+        acquired = false;
+        return false;
+      }
+      unlink(link);
+      acquired = false;
+      ownership = null;
+      return true;
+    },
+
+    async run(operation) {
+      let operationError;
+      try {
+        return await operation(bridge);
+      } catch (error) {
+        operationError = error;
+        throw error;
+      } finally {
+        try {
+          bridge.release();
+        } catch (cleanupError) {
+          if (!operationError) throw cleanupError;
+          operationError.cleanupError = cleanupError;
+        }
+      }
+    },
+  };
+
+  return bridge;
+}
+
+function entryIdentity(stats) {
+  return { dev: stats.dev, ino: stats.ino, symbolicLink: stats.isSymbolicLink() };
+}
+
+function sameEntry(stats, expected) {
+  return stats.dev === expected.dev
+    && stats.ino === expected.ino
+    && stats.isSymbolicLink() === expected.symbolicLink
+    && expected.symbolicLink;
+}
+
+function readEntry(file, lstat) {
+  try {
+    return lstat(file);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function sameRealPath(left, right, realpath, platform) {
+  const canonical = (value) => {
+    const resolved = path.normalize(realpath(value));
+    return platform === "win32" ? resolved.toLowerCase() : resolved;
+  };
+  return canonical(left) === canonical(right);
+}

package/target-bridge.test.mjs

@@ -0,0 +1,155 @@
+import assert from "node:assert/strict";
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { createTargetBridge } from "./target-bridge.mjs";
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightkit-target-bridge-"));
+  const target = path.join(root, "shared", "target");
+  const link = path.join(root, "app", "src-tauri", "target");
+  mkdirSync(target, { recursive: true });
+  mkdirSync(path.dirname(link), { recursive: true });
+  writeFileSync(path.join(target, "keep.txt"), "shared-cache\n");
+  return { root, target, link };
+}
+
+test("removes an invocation-created bridge after success without touching the shared target", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  await bridge.run(async () => {
+    bridge.ensure();
+    assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+  });
+  assert.throws(() => lstatSync(fx.link), { code: "ENOENT" });
+  assert.equal(readFileSync(path.join(fx.target, "keep.txt"), "utf8"), "shared-cache\n");
+});
+
+test("removes an invocation-created bridge after the build throws", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  await assert.rejects(
+    bridge.run(async () => {
+      bridge.ensure();
+      throw new Error("package failed");
+    }),
+    /package failed/,
+  );
+  assert.throws(() => lstatSync(fx.link), { code: "ENOENT" });
+});
+
+test("removes an invocation-created bridge after a signal-style abort", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  await assert.rejects(
+    bridge.run(async () => {
+      bridge.ensure();
+      throw new Error("release interrupted by SIGTERM");
+    }),
+    /SIGTERM/,
+  );
+  assert.throws(() => lstatSync(fx.link), { code: "ENOENT" });
+});
+
+test("accepts but preserves a pre-existing exact shared-target bridge", async () => {
+  const fx = fixture();
+  symlinkSync(fx.target, fx.link, process.platform === "win32" ? "junction" : "dir");
+  await createTargetBridge(fx).run(async (bridge) => {
+    assert.deepEqual(bridge.ensure(), { created: false, link: fx.link, target: fx.target });
+  });
+  assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+  assert.equal(readFileSync(path.join(fx.target, "keep.txt"), "utf8"), "shared-cache\n");
+});
+
+test("fails closed when the new bridge is replaced immediately after symlink creation", () => {
+  const fx = fixture();
+  const other = path.join(fx.root, "racing-target");
+  mkdirSync(other);
+  const bridge = createTargetBridge({
+    ...fx,
+    symlink(target, link, type) {
+      symlinkSync(target, link, type);
+      unlinkSync(link);
+      symlinkSync(other, link, type);
+    },
+  });
+  assert.throws(() => bridge.ensure(), /owned shared cache target/i);
+  assert.equal(realpathSync(fx.link), realpathSync(other));
+});
+
+test("fails closed and preserves an unrelated symlink", async () => {
+  const fx = fixture();
+  const other = path.join(fx.root, "other-target");
+  mkdirSync(other);
+  symlinkSync(other, fx.link, process.platform === "win32" ? "junction" : "dir");
+  await assert.rejects(
+    createTargetBridge(fx).run(async (bridge) => bridge.ensure()),
+    /not the owned shared cache target/i,
+  );
+  assert.equal(realpathSync(fx.link), realpathSync(other));
+});
+
+test("preserves a same-target symlink that replaces an acquired bridge", () => {
+  const fx = fixture();
+  let successfulStats = 0;
+  const bridge = createTargetBridge({
+    ...fx,
+    lstat(file) {
+      const stats = lstatSync(file);
+      successfulStats += 1;
+      if (successfulStats === 1) return stats;
+      return { dev: stats.dev, ino: stats.ino + 1, isSymbolicLink: () => stats.isSymbolicLink() };
+    },
+  });
+  bridge.ensure();
+  unlinkSync(fx.link);
+  symlinkSync(fx.target, fx.link, process.platform === "win32" ? "junction" : "dir");
+  assert.equal(bridge.release(), false);
+  assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+});
+
+test("preserves a different-target symlink that replaces an acquired bridge", () => {
+  const fx = fixture();
+  const other = path.join(fx.root, "replacement-target");
+  mkdirSync(other);
+  const bridge = createTargetBridge(fx);
+  bridge.ensure();
+  unlinkSync(fx.link);
+  symlinkSync(other, fx.link, process.platform === "win32" ? "junction" : "dir");
+  assert.equal(bridge.release(), false);
+  assert.equal(realpathSync(fx.link), realpathSync(other));
+});
+
+test("fails closed and preserves a real target directory with user content", async () => {
+  const fx = fixture();
+  mkdirSync(fx.link);
+  writeFileSync(path.join(fx.link, "user.txt"), "keep\n");
+  await assert.rejects(
+    createTargetBridge(fx).run(async (bridge) => bridge.ensure()),
+    /not a symbolic link/i,
+  );
+  assert.equal(readFileSync(path.join(fx.link, "user.txt"), "utf8"), "keep\n");
+});
+
+test("cleanup is idempotent and reports process errors without masking a build failure", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  bridge.ensure();
+  assert.equal(bridge.release(), true);
+  assert.equal(bridge.release(), false);
+
+  const cleanupFailure = new Error("unlink denied");
+  const failing = createTargetBridge({ ...fx, unlink: () => { throw cleanupFailure; } });
+  const buildFailure = new Error("build aborted");
+  await assert.rejects(
+    failing.run(async () => {
+      failing.ensure();
+      throw buildFailure;
+    }),
+    (error) => error === buildFailure && error.cleanupError === cleanupFailure,
+  );
+  assert.equal(lstatSync(fx.link).isSymbolicLink(), true);
+  unlinkSync(fx.link);
+});