@rightkit/release 0.2.47 → 0.2.48

package/build-release.mjs

@@ -28,7 +28,7 @@ import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
-function buildPreflight({ config, appRoot, repoRoot, platform }) {
+function buildPreflight({ config, configPath, appRoot, repoRoot, platform }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
@@ -40,6 +40,7 @@ function buildPreflight({ config, appRoot, repoRoot, platform }) {
     appRoot,
     repoRoot,
     app: config.app,
+    configPath,
     // The version check is the doctor's job: by the time `build` runs, seal
     // collision is already enforced downstream, and duplicating it here would
     // reject a legitimate resume of an in-flight build.
@@ -127,7 +128,7 @@ try {
   // Preflight BEFORE any compile. These preconditions used to be discovered one
   // per build cycle, minutes deep, with errors that named a symptom instead of a
   // cause. Blocking problems stop here, in seconds, naming the fix.
-  const preflight = buildPreflight({ config, appRoot, repoRoot: layout.repoRoot, platform });
+  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform });
   const preflightBlockers = preflightFailures(preflight);
   if (preflightBlockers.length > 0) {
     fail(`preflight found ${preflightBlockers.length} blocking problem(s):\n${formatPreflight(preflightBlockers)}`);

package/cache-policy.mjs

@@ -21,7 +21,7 @@ import { spawnSync } from "node:child_process";
 
 export const CACHE_SCHEMA = 1;
 export const DEFAULT_TARGET_MAX_BYTES = 12 * 1024 ** 3;
-export const DEFAULT_SCCACHE_MAX_BYTES = 8 * 1024 ** 3;
+export const DEFAULT_SCCACHE_MAX_BYTES = 32 * 1024 ** 3;
 export const DEFAULT_DESIRED_FREE_BYTES = 60 * 1024 ** 3;
 export const DEFAULT_HARD_FREE_BYTES = 25 * 1024 ** 3;
 // Any build holds release -> suite slot -> GC -> entry lease; prune holds only GC.
@@ -35,7 +35,9 @@ export function resolveSharedCacheRoot({ platform = process.platform, env = proc
     if (!isAbsoluteForPlatform(override, platform)) throw new Error("RIGHT_RELEASE_CACHE_ROOT must be an absolute path");
     return resolveForPlatform(override, platform);
   }
-  if (platform === "darwin" || platform === "mac") return path.posix.join(home, "Library", "Caches", "RightSuite", "release");
+  if (platform === "darwin" || platform === "mac") {
+    throw new Error("RIGHT_RELEASE_CACHE_ROOT is required on macOS; set it to external storage");
+  }
   if (platform === "win32" || platform === "win") {
     const local = env.LOCALAPPDATA;
     if (!local || !isAbsoluteForPlatform(local, platform)) throw new Error("LOCALAPPDATA must be an absolute path for the RightSuite cache");
@@ -92,10 +94,41 @@ export function resolveSharedCacheIdentity({ cargoLockPath, cargoTomlPath, rustc
   const target = targetTriple || host;
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(target)) throw new Error("invalid Cargo target triple");
   const architecture = target.split("-")[0];
-  const cargoLockSha256 = cargoLockPath && existsSync(cargoLockPath) ? createHash("sha256").update(readFileSync(cargoLockPath)).digest("hex") : "none";
+  const cargoLock = cargoLockPath && existsSync(cargoLockPath) ? readFileSync(cargoLockPath, "utf8") : null;
+  const cargoLockSha256 = cargoLock === null ? "none" : sha256(cargoLock);
+  const cargoBuildGraphSha256 = cargoLock === null ? "none" : sha256(normalizeCargoLockForCache(cargoLock));
   const nativeFeatures = features ?? cargoNativeFeatures(cargoTomlPath);
-  const payload = JSON.stringify({ cargoLockSha256, rustc, target, architecture, profile, features: [...nativeFeatures].sort() });
-  return { cargoLockSha256, rustc, target, architecture, profile, features: [...nativeFeatures].sort(), fingerprint: createHash("sha256").update(payload).digest("hex").slice(0, 16) };
+  const payload = JSON.stringify({ cargoBuildGraphSha256, rustc, target, architecture, profile, features: [...nativeFeatures].sort() });
+  return { cargoLockSha256, cargoBuildGraphSha256, rustc, target, architecture, profile, features: [...nativeFeatures].sort(), fingerprint: sha256(payload).slice(0, 16) };
+}
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+/**
+ * Cargo invalidates local crates from their manifests and sources inside a
+ * reused target directory. Their package version is release metadata, not a
+ * dependency artifact identity. Registry and Git packages retain every byte,
+ * including source, version, and checksum.
+ */
+function normalizeCargoLockForCache(source) {
+  const lines = String(source).replace(/\r\n?/g, "\n").split("\n");
+  const normalized = [];
+  for (let start = 0; start < lines.length;) {
+    if (lines[start].trim() !== "[[package]]") {
+      normalized.push(lines[start]);
+      start += 1;
+      continue;
+    }
+    let end = start + 1;
+    while (end < lines.length && lines[end].trim() !== "[[package]]") end += 1;
+    const block = lines.slice(start, end);
+    const external = block.some((line) => /^\s*(?:source|checksum)\s*=/.test(line));
+    normalized.push(...(external ? block : block.filter((line) => !/^\s*version\s*=/.test(line))));
+    start = end;
+  }
+  return normalized.join("\n");
 }
 
 export function ensureCacheEntry({ layout, metadata = {}, now = new Date() } = {}) {

package/cache-policy.test.mjs

@@ -57,7 +57,7 @@ function migrationFixture() {
 }
 
 test("cache roots are platform-native and overrides must be absolute", () => {
-  assert.equal(resolveSharedCacheRoot({ platform: "mac", home: "/Users/test", env: {} }), "/Users/test/Library/Caches/RightSuite/release");
+  assert.throws(() => resolveSharedCacheRoot({ platform: "mac", home: "/Users/test", env: {} }), /RIGHT_RELEASE_CACHE_ROOT is required/);
   assert.equal(resolveSharedCacheRoot({ platform: "win", env: { LOCALAPPDATA: "C:/Users/test/AppData/Local" } }), "C:\\Users\\test\\AppData\\Local\\RightSuite\\Cache\\release");
   assert.equal(resolveSharedCacheRoot({ platform: "linux", home: "/home/test", xdgCacheHome: "/tmp/xdg", env: {} }), "/tmp/xdg/rightsuite/release");
   assert.equal(resolveSharedCacheRoot({ platform: "mac", env: { RIGHT_RELEASE_CACHE_ROOT: "/tmp/cache" } }), "/tmp/cache");
@@ -119,6 +119,21 @@ test("build and migration derive identical native-feature cache fingerprints", (
   assert.notEqual(build.fingerprint, resolveSharedCacheIdentity({ ...inputs, features: [] }).fingerprint);
 });
 
+test("cache identity ignores local workspace version bumps but keeps registry dependency identity", () => {
+  const base = root();
+  const cargoLock = path.join(base, "Cargo.lock");
+  mkdirSync(base, { recursive: true });
+  const lock = (appVersion, depVersion, checksum) => `version = 4\n\n[[package]]\nname = "fixture"\nversion = "${appVersion}"\ndependencies = [\n "serde",\n]\n\n[[package]]\nname = "serde"\nversion = "${depVersion}"\nsource = "registry+https://github.com/rust-lang/crates.io-index"\nchecksum = "${checksum}"\n`;
+  const inputs = { cargoLockPath: cargoLock, rustcVerbose: "rustc 1.91.0\nhost: aarch64-apple-darwin", targetTriple: "aarch64-apple-darwin" };
+
+  writeFileSync(cargoLock, lock("1.0.0", "1.0.0", "aaa"));
+  const original = resolveSharedCacheIdentity(inputs);
+  writeFileSync(cargoLock, lock("1.0.1", "1.0.0", "aaa"));
+  assert.equal(resolveSharedCacheIdentity(inputs).fingerprint, original.fingerprint);
+  writeFileSync(cargoLock, lock("1.0.1", "1.0.1", "bbb"));
+  assert.notEqual(resolveSharedCacheIdentity(inputs).fingerprint, original.fingerprint);
+});
+
 test("migration moves an actual src-tauri target symlink and keeps dry-run physically pure", () => {
   const fixture = migrationFixture();
   const preview = migrateLegacyCache({ ...fixture, dryRun: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.47",
+  "version": "0.2.48",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/preflight.mjs

@@ -18,7 +18,7 @@
 //    certs on purpose and timestamps the signature, so "expires in 2 days" is
 //    the healthy state, not a problem.)
 
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
@@ -86,7 +86,7 @@ export function resolveWindowsPerl({
 } = {}) {
   const explicit = [env.OPENSSL_SRC_PERL, env.PERL].filter(Boolean);
   for (const candidate of [...explicit, ...candidates]) {
-    if (exists(candidate)) return { perlPath: candidate, dir: path.dirname(candidate) };
+    if (exists(candidate)) return { perlPath: candidate, dir: path.win32.dirname(candidate) };
   }
   return null;
 }
@@ -167,6 +167,7 @@ export function collectPreflight({
   repoRoot,
   app,
   version,
+  configPath,
   cargoLockPaths = [],
   minFreeGb = 25,
   env = process.env,
@@ -174,6 +175,25 @@ export function collectPreflight({
   const checks = [];
   const windows = platform === "win" || platform === "win32";
 
+  if (appRoot) {
+    const target = path.join(appRoot, "src-tauri", "target");
+    let entry = null;
+    try {
+      entry = lstatSync(target);
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+    checks.push(
+      !entry || entry.isSymbolicLink()
+        ? ok("target-bridge", entry ? "src-tauri/target is a symbolic link" : "src-tauri/target is ready for the shared cache bridge")
+        : fail(
+            "target-bridge",
+            `${target} is a real directory; bridge setup will refuse it`,
+            `run right-release cache migrate --config ${JSON.stringify(configPath ?? path.join(appRoot, "right-release.config.mjs"))} --dry-run, then repeat with --apply before building`,
+          ),
+    );
+  }
+
   if (version && app && repoRoot) {
     const sealedDir = path.join(repoRoot, ".right-release", "sealed");
     const sealed = nextFreeVersion(sealedDir, app, version);

package/release-state.mjs

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import path from "node:path";
-import { DEFAULT_SCCACHE_MAX_BYTES, resolveCacheLayout } from "./cache-policy.mjs";
+import { readCachePolicy, resolveCacheLayout } from "./cache-policy.mjs";
 
 export function cacheFingerprint({ cargoLockSha256, rustc, target, architecture, features = [] }) {
   const payload = JSON.stringify({
@@ -61,17 +61,18 @@ export function watchProgress(paths, onProgress) {
   };
 }
 
-export function releaseEnvironment({ root, cacheRoot, platform, architecture, app, cacheKey, kind = "release", appRoot, mode = "legacy" }) {
+export function releaseEnvironment({ root, cacheRoot, platform, architecture, app, cacheKey, kind = "release", appRoot, mode = "legacy", env = process.env }) {
   if (kind !== "release" && kind !== "test") throw new Error(`invalid target kind: ${kind}`);
   if (mode !== "legacy" && mode !== "shared") throw new Error(`invalid cache mode: ${mode}`);
   if (mode === "shared") {
     if (!cacheRoot || !platform || !architecture || !app || !cacheKey || !appRoot) throw new Error("shared release environment requires cacheRoot, platform, architecture, app, cacheKey, and appRoot");
     const layout = resolveCacheLayout({ cacheRoot, platform, architecture, app, fingerprint: cacheKey, kind });
+    const policy = readCachePolicy(env);
     return {
       CARGO_TARGET_DIR: layout.targetDir,
       CARGO_HOME: layout.cargoHome,
       SCCACHE_DIR: layout.sccacheDir,
-      SCCACHE_CACHE_SIZE: `${DEFAULT_SCCACHE_MAX_BYTES / 1024 ** 3}G`,
+      SCCACHE_CACHE_SIZE: `${policy.sccacheMaxBytes / 1024 ** 3}G`,
       SCCACHE_BASEDIRS: [path.resolve(root), path.resolve(appRoot)].join(path.delimiter),
       RUSTC_WRAPPER: "sccache",
       RIGHT_RELEASE_CACHE_OWNER: "rightkit-v2",

package/release-state.test.mjs

@@ -63,6 +63,22 @@ test("shared release environment is isolated from the app vault", () => {
   assert.match(env.CARGO_TARGET_DIR, /RightSuite[\\/]release[\\/]targets[\\/]mac[\\/]fixture[\\/]abcdef0123456789$/);
   assert.match(env.CARGO_HOME, /RightSuite[\\/]release[\\/]cargo-home$/);
   assert.equal(env.RIGHT_RELEASE_CACHE_OWNER, "rightkit-v2");
+  assert.equal(env.SCCACHE_CACHE_SIZE, "32G");
+});
+
+test("shared release environment honors the cache policy override", () => {
+  const env = releaseEnvironment({
+    root: "/suite/.right-release",
+    cacheRoot: "/cache",
+    platform: "mac",
+    architecture: "aarch64",
+    app: "fixture",
+    appRoot: "/suite/fixture",
+    cacheKey: "abcdef0123456789",
+    mode: "shared",
+    env: { RIGHT_RELEASE_SCCACHE_MAX_BYTES: String(48 * 1024 ** 3) },
+  });
+  assert.equal(env.SCCACHE_CACHE_SIZE, "48G");
 });
 
 function sha256(value) {

package/release.mjs

@@ -103,7 +103,7 @@ if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.pl
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, root, repoRoot, platform }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -123,6 +123,7 @@ function releasePreflight({ config, root, repoRoot, platform }) {
     repoRoot,
     app: config.app,
     version,
+    configPath,
     cargoLockPaths,
   });
 }
@@ -158,7 +159,7 @@ if (opts.doctor) {
 
   // Config above, MACHINE below. Printing config never told anyone whether this
   // box could finish a build; these checks do.
-  const checks = releasePreflight({ config, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform });
+  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform });
   console.log("preflight:");
   console.log(formatPreflight(checks));
   const failures = preflightFailures(checks);

package/release.test.mjs

@@ -10,12 +10,13 @@ const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
 const cli = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
 const versions = JSON.parse(readFileSync(new URL("./rightkit-versions.json", import.meta.url), "utf8"));
 const defaultBuildInputs = { include: ["package.json", "pnpm-lock.yaml", "src-tauri/**"] };
+const hostPlatform = process.platform === "darwin" ? "mac" : process.platform === "win32" ? "win" : process.platform;
 
 function git(cwd, ...args) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 
-function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs } = {}) {
+function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -25,7 +26,7 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
     JSON.stringify(
       packageJson ?? {
         name: "fixture",
-        scripts: { "release:patch:win": "right-release --platform win --tier patch" },
+        scripts: { [`release:patch:${platform}`]: `right-release --platform ${platform} --tier patch` },
         packageManager: versions.packageManager,
         dependencies: {
           "@rightkit/license": versions.npm["@rightkit/license"],
@@ -45,13 +46,13 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
       packageManager: "pnpm",
       checks: [],
       targets: {
-        win: {
+        [platform]: {
           ...(buildInputs ? { buildInputs } : {}),
           signed,
           package: { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
           artifacts: [],
-          sign: { files: ["fixture.exe"] },
+          ...(platform === "win" ? { sign: { files: ["fixture.exe"] } } : {}),
           updater: { artifacts: [{ file: "fixture.exe", signature: "fixture.exe.sig", platform: "windows-x86_64", key: "fixture/fixture.exe" }] },
           hardening: [],
         },
@@ -146,7 +147,7 @@ function runRaw(config, ...args) {
 }
 
 function runDoctor(config, ...args) {
-  return spawnSync(process.execPath, [cli, "doctor", "--config", config, "--platform", "win", ...args], {
+  return spawnSync(process.execPath, [cli, "doctor", "--config", config, "--platform", hostPlatform, ...args], {
     encoding: "utf8",
   });
 }
@@ -219,10 +220,11 @@ test("rejects hosted workflow files before release work starts", () => {
 
 test("doctor accepts an exact crates.io RightKit pin with benign Cargo config", () => {
   const config = fixture({
+    platform: hostPlatform,
     cargoManifest: `[package]\nname = "fixture"\nversion = "0.0.0"\nedition = "2021"\n[dependencies]\nrightkit-license = "=0.1.2"`,
     cargoConfig: `[net]\nretry = 2\n[registries.private]\nindex = "https://example.test/index"`,
   });
-  const result = run(config, "--doctor");
+  const result = runDoctor(config);
   assert.equal(result.status, 0, result.stderr);
   assert.match(result.stdout, /right-release/);
 });
@@ -236,7 +238,7 @@ test("doctor rejects a selected target with missing or empty buildInputs.include
 });
 
 test("doctor passes a clean selected target", () => {
-  const result = runDoctor(fixture());
+  const result = runDoctor(fixture({ platform: hostPlatform }));
   assert.equal(result.status, 0, result.stderr);
   // Derived from the version manifest, not hardcoded: a literal here has to be
   // hand-edited on every bump and fails the suite when someone forgets.
@@ -244,12 +246,20 @@ test("doctor passes a clean selected target", () => {
   assert.match(result.stdout, new RegExp(`right-release ${expected.replace(/\./g, "\\.")}`));
 });
 
+test("doctor rejects a real src-tauri target before release work", () => {
+  const config = fixture({ platform: hostPlatform });
+  mkdirSync(path.join(path.dirname(config), "src-tauri", "target"));
+  const result = runDoctor(config);
+  assert.notEqual(result.status, 0);
+  assert.match(`${result.stdout}\n${result.stderr}`, /target-bridge[\s\S]*real directory[\s\S]*cache migrate/i);
+});
+
 test("doctor permits unrelated dirt", () => {
-  const config = fixture();
+  const config = fixture({ platform: hostPlatform });
   const root = path.dirname(config);
   mkdirSync(path.join(root, "notes"));
   writeFileSync(path.join(root, "notes", "scratch.md"), "unrelated\n");
-  const result = run(config, "--doctor");
+  const result = runDoctor(config);
   assert.equal(result.status, 0, result.stderr);
 });
 
@@ -302,11 +312,12 @@ test("doctor rejects linked and detached checkouts like build runtime", () => {
 
 test("doctor scopes Cargo inspection to the configured app inside a monorepo", () => {
   const config = fixture({
+    platform: hostPlatform,
     cargoManifest: `[package]\nname = "fixture"\nversion = "0.0.0"\nedition = "2021"\n[dependencies]\nrightkit-license = "=0.1.2"`,
     repoCargoConfig: `[net]\nretry = 2`,
     siblingCargoManifest: `[package]\nname = "archived-copy"\nversion = "0.0.0"\n[dependencies]\nrightkit-license = { path = "../../rightkit-license" }`,
   });
-  const result = run(config, "--doctor");
+  const result = runDoctor(config);
   assert.equal(result.status, 0, result.stderr);
 });
 

package/right-suite-contract.test.mjs

@@ -442,6 +442,7 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
+    "@rightkit/release": "0.2.48",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46"],
@@ -499,7 +500,14 @@ for (const app of apps) {
       );
       if (allowed.size) assert.ok(allowed.has(specifier), `${app.key} ${name} must match a published rollout version`);
     }
-    assert.equal(pkg.packageManager, versions.packageManager);
+    const releaseVersion = pkg.devDependencies?.["@rightkit/release"];
+    const acceptedPackageManagers = releaseVersion === versions.stagedNpm?.["@rightkit/release"]
+      ? [versions.packageManager]
+      : [versions.packageManager, "pnpm@11.12.0"];
+    assert.ok(
+      acceptedPackageManagers.includes(pkg.packageManager),
+      `${app.key} packageManager must match its @rightkit/release rollout lane`,
+    );
     assert.ok(
       new Set([
         versions.npm["@rightkit/release"],

package/rightkit-versions.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "packageManager": "pnpm@11.12.0",
+  "packageManager": "pnpm@11.17.0",
   "npm": {
     "@rightkit/legal": "0.2.0",
     "@rightkit/license": "0.1.5",
@@ -14,7 +14,8 @@
   "stagedNpm": {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
-    "@rightkit/license": "0.1.6"
+    "@rightkit/license": "0.1.6",
+    "@rightkit/release": "0.2.48"
   },
   "legacyNpm": {
     "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46"]

package/standalone-clone-verify.test.mjs

@@ -22,7 +22,7 @@ test("standalone verifier clones, installs, doctors from a nested app root, and
   writeFileSync(path.join(source, "apps", "desktop", "package.json"), JSON.stringify({
     name: "standalone-fixture",
     private: true,
-    packageManager: "pnpm@11.12.0",
+    packageManager: "pnpm@11.17.0",
     scripts: { "release:doctor": "node doctor.mjs" },
   }), "utf8");
   writeFileSync(path.join(source, "apps", "desktop", "pnpm-lock.yaml"), "lockfileVersion: '9.0'\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\nimporters:\n  .: {}\n", "utf8");

package/target-bridge.mjs

@@ -27,8 +27,29 @@ export function createTargetBridge({
 
   const bridge = {
     ensure() {
-      mkdir(target, { recursive: true });
       let entry = readEntry(link, lstat);
+      if (entry && !entry.isSymbolicLink()) {
+        throw new Error(
+          `primary checkout target is not a symbolic link; refusing to replace it: ${link}\n` +
+            `  It is a real directory holding build output. Run right-release cache migrate before building.`,
+        );
+      }
+      let pointsAtTarget = false;
+      if (entry) {
+        try {
+          pointsAtTarget = sameRealPath(link, target, realpath, platform);
+        } catch (error) {
+          if (error?.code !== "ENOENT") throw error;
+        }
+        if (!pointsAtTarget && !isReclaimableLink(link, ownedRoot, realpath, platform)) {
+          throw new Error(
+            `primary checkout target is not the owned shared cache target; refusing to replace it: ${link}\n` +
+              `  It is a symlink pointing outside this app's release cache, so it was not created by RightKit.\n` +
+              `  Repoint or remove it yourself, then re-run.`,
+          );
+        }
+      }
+      mkdir(target, { recursive: true });
       if (!entry) {
         symlink(target, link, platform === "win32" ? "junction" : "dir");
         entry = lstat(link);
@@ -39,40 +60,17 @@ export function createTargetBridge({
         ownership = entryIdentity(entry);
         created = true;
       } else {
-        if (!entry.isSymbolicLink()) {
-          throw new Error(
-            `primary checkout target is not a symbolic link; refusing to replace it: ${link}\n` +
-              `  It is a real directory holding build output. Delete it yourself if that output is disposable, then re-run.`,
-          );
-        }
-        // A dangling link (its cache entry was pruned) makes realpath throw, so
-        // this comparison must tolerate ENOENT rather than crash before the
-        // reclaim path below gets a chance to handle exactly that case.
-        let pointsAtTarget = false;
-        try {
-          pointsAtTarget = sameRealPath(link, target, realpath, platform);
-        } catch (error) {
-          if (error?.code !== "ENOENT") throw error;
-        }
         if (!pointsAtTarget) {
           // Stale link from an earlier fingerprint, or one whose cache entry a
           // prune already removed. Both are ours to repoint.
-          if (isReclaimableLink(link, ownedRoot, realpath, platform)) {
-            unlink(link);
-            symlink(target, link, platform === "win32" ? "junction" : "dir");
-            entry = lstat(link);
-            if (!sameRealPath(link, target, realpath, platform)) {
-              throw new Error(`RightKit target bridge did not repoint to the owned shared cache target: ${link}`);
-            }
-            ownership = entryIdentity(entry);
-            created = true;
-          } else {
-            throw new Error(
-              `primary checkout target is not the owned shared cache target; refusing to replace it: ${link}\n` +
-                `  It is a symlink pointing outside this app's release cache, so it was not created by RightKit.\n` +
-                `  Repoint or remove it yourself, then re-run.`,
-            );
+          unlink(link);
+          symlink(target, link, platform === "win32" ? "junction" : "dir");
+          entry = lstat(link);
+          if (!sameRealPath(link, target, realpath, platform)) {
+            throw new Error(`RightKit target bridge did not repoint to the owned shared cache target: ${link}`);
           }
+          ownership = entryIdentity(entry);
+          created = true;
         }
       }
       acquired = true;

package/target-bridge.test.mjs

@@ -133,6 +133,16 @@ test("fails closed and preserves a real target directory with user content", asy
   assert.equal(readFileSync(path.join(fx.link, "user.txt"), "utf8"), "keep\n");
 });
 
+test("rejecting a real target does not create the shared cache destination", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightkit-target-bridge-pure-"));
+  const target = path.join(root, "shared", "target");
+  const link = path.join(root, "app", "src-tauri", "target");
+  mkdirSync(link, { recursive: true });
+
+  assert.throws(() => createTargetBridge({ link, target }).ensure(), /not a symbolic link/i);
+  assert.equal(existsSync(target), false);
+});
+
 test("cleanup is idempotent and reports process errors without masking a build failure", async () => {
   const fx = fixture();
   const bridge = createTargetBridge(fx);
@@ -185,6 +195,7 @@ test("a link pointing outside the owned root is still refused", () => {
 
   const bridge = createTargetBridge({ link, target: newTarget, ownedRoot });
   assert.throws(() => bridge.ensure(), /refusing to replace it/);
+  assert.equal(existsSync(newTarget), false);
   assert.equal(realpathSync(link), realpathSync(foreign));
   rmSync(dir, { recursive: true, force: true });
 });