@rightkit/release 0.2.54 → 0.2.55

package/build-release.mjs

@@ -121,10 +121,17 @@ try {
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
+  const receiptRoot = path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(appRoot, ".right-release", "receipts"));
+  const signingIdentity = platform === "win" ? {
+    contract: target.signingContract ?? "<missing>",
+    configSha256: hashFile(configPath),
+    receiptInputs: ["raw-exe", "installer"].map((phase) => path.join(receiptRoot, `windows-${phase}.json`)),
+  } : null;
+  if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
   const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
-  const cacheKey = cacheIdentity.fingerprint;
+  const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
   const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
   if (cacheMode !== "legacy" && cacheMode !== "shared") fail("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
   const sharedCacheRoot = cacheMode === "shared" ? resolveSharedCacheRoot({ platform, env: process.env }) : undefined;
@@ -179,6 +186,7 @@ try {
     platform,
     cacheKey,
     inputs: inputHashes,
+    signingIdentity,
     tools: toolVersions,
     createdAt: new Date().toISOString(),
   };
@@ -246,7 +254,7 @@ try {
         checkpoint(stateRoot, "hardened");
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
+        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -275,6 +283,10 @@ function hashFile(file) {
   return createHash("sha256").update(readFileSync(file)).digest("hex");
 }
 
+function hashFileText(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+
 function sqlCipherFeatures(text) {
   return [...text.matchAll(/features\s*=\s*\[([^\]]+)\]/g)]
     .flatMap((match) => match[1].match(/"([^"]+)"/g) ?? [])
@@ -282,7 +294,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey }) {
+function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
   const sources = new Map();
   const addSource = (source, role) => {
     const current = sources.get(source) ?? new Set();
@@ -327,6 +339,7 @@ function sealRelease({ configRoot, sealedDir, releaseId, config, target, platfor
     commit,
     platform,
     cacheKey,
+    signing: signingIdentity ? { ...signingIdentity, receipts: signingIdentity.receiptInputs.map((file) => ({ file, sha256: hashFile(file) })) } : null,
     files,
     routes,
     inputs: inputHashes,

package/build-release.test.mjs

@@ -60,3 +60,14 @@ test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", ()
   assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
   assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
 });
+
+test("Windows seal and cache identity bind the signing contract, config, and receipts", () => {
+  assert.match(source, /signingIdentity = platform === "win"/);
+  assert.match(source, /contract: target\.signingContract/);
+  assert.match(source, /configSha256: hashFile\(configPath\)/);
+  assert.match(source, /windows-\$\{phase\}\.json/);
+  assert.match(source, /inputHashes\["\.right-release\/signing-identity\.json"\]/);
+  assert.match(source, /cache: cacheIdentity\.fingerprint, signingIdentity/);
+  assert.match(source, /receipts: signingIdentity\.receiptInputs\.map/);
+  assert.match(readFileSync(new URL("./release.mjs", import.meta.url), "utf8"), /item\.after\?\.sha256 !== currentHashes/);
+});

package/cargo-guard.test.mjs

@@ -48,8 +48,8 @@ test("Cargo guard resolves real Cargo through rustup or explicit override", () =
   const cargo = resolveRealCargo({ env: {}, run: (command, args) => { calls.push([command, args]); return { status: 0, stdout: "/real/cargo\n" }; } });
   assert.equal(cargo, path.resolve("/real/cargo"));
   assert.deepEqual(calls[0][1], ["which", "cargo"]);
-  assert.equal(resolveRealRustc({ env: { RIGHTSUITE_REAL_RUSTC: "/opt/toolchain/rustc" } }), "/opt/toolchain/rustc");
-  assert.equal(resolveRealRustc({ env: {}, run: () => ({ status: 0, stdout: "/real/rustc\n" }) }), "/real/rustc");
+  assert.equal(resolveRealRustc({ env: { RIGHTSUITE_REAL_RUSTC: "/opt/toolchain/rustc" } }), path.resolve("/opt/toolchain/rustc"));
+  assert.equal(resolveRealRustc({ env: {}, run: () => ({ status: 0, stdout: "/real/rustc\n" }) }), path.resolve("/real/rustc"));
 });
 
 function cacheEnv(overrides = {}) {
@@ -81,7 +81,7 @@ test("Cargo guard rejects cache escapes and alternate compiler wrappers", async
 test("Cargo guard routes heavy and light commands without recursion", async () => {
   const calls = [];
   const options = {
-    env: { TEST: "1", RIGHT_RELEASE_CACHE_ROOT: "/cache" },
+    env: { TEST: "1", ...cacheEnv() },
     policyOptions: { exists: () => false },
     resolveCargo: () => "/real/cargo",
     runHeavy: async (args, config) => { calls.push(["heavy", args, config.env]); return 0; },
@@ -90,7 +90,8 @@ test("Cargo guard routes heavy and light commands without recursion", async () =
   assert.equal(await runCargoGuard(["test"], options), 0);
   assert.equal(await runCargoGuard(["fmt", "--check"], options), 0);
   assert.deepEqual(calls[0].slice(0, 2), ["heavy", ["--", "/real/cargo", "test"]]);
-  assert.equal(calls[0][2].CARGO_TARGET_DIR.startsWith("/cache/dev-targets/"), true);
+  const cacheRoot = cacheEnv().RIGHT_RELEASE_CACHE_ROOT ?? path.join(cacheEnv().LOCALAPPDATA, "RightSuite", "Cache", "release");
+  assert.equal(calls[0][2].CARGO_TARGET_DIR.startsWith(path.join(path.resolve(cacheRoot), "dev-targets") + path.sep), true);
   assert.equal(calls[0][2].RUSTC_WRAPPER, "sccache");
   assert.deepEqual(calls[1], ["light", "/real/cargo", ["fmt", "--check"], options.env]);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.54",
+  "version": "0.2.55",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-invocation.test.mjs

@@ -1,14 +1,15 @@
 import assert from "node:assert/strict";
+import path from "node:path";
 import test from "node:test";
 import { resolvePrimaryWorktree } from "./release-invocation.mjs";
 
 test("resolves a submodule primary worktree from core.worktree", () => {
   assert.equal(resolvePrimaryWorktree({
-    repoRoot: "/suite/membrane",
+    repoRoot: path.resolve("/suite/membrane"),
     worktrees: "worktree /suite/.git/modules/membrane\nHEAD abc\n",
     gitDir: "/suite/.git/modules/membrane",
     coreWorktree: "../../../membrane",
-  }), "/suite/membrane");
+  }), path.resolve("/suite/membrane"));
 });
 
 test("preserves an ordinary primary worktree", () => {

package/release.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { access, readFile, readdir } from "node:fs/promises";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -25,6 +26,7 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
 );
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
+const WINDOWS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
 
 const args = process.argv.slice(2);
 const opts = {
@@ -98,6 +100,12 @@ if (target.signed !== true) {
 if (opts.platform === "win" && !target.sign?.files?.length) {
   fail(`${config.app ?? "app"} win must declare sign.files for the signed release pipeline`);
 }
+if (opts.platform === "win") {
+  if (target.signingContract !== WINDOWS_SIGNING_CONTRACT) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_SIGNING_CONTRACT}`);
+  if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
+  if (target.sign?.prePackageFiles?.length !== 1) fail(`${config.app ?? "app"} win must declare exactly one sign.prePackageFiles raw EXE`);
+  if (target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+}
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
  * Assemble preflight inputs from the app's own files. Kept here (not in
@@ -185,6 +193,13 @@ if (!opts.skipChecks) {
   for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
 }
 
+if (opts.platform === "win") {
+  const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
+  await runCommand(target.prePackage, root);
+  for (const file of rawFiles) await mustExist(file, `missing raw EXE signing artifact: ${file}`);
+  await signWindows(rawFiles, "raw-exe", root);
+}
+
 await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
@@ -194,13 +209,14 @@ for (const rel of target.artifacts ?? []) {
 if (opts.platform === "win" && target.sign?.files?.length) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
-  await run("node", [SIGN_WINDOWS, ...(opts.dryRun ? ["--dry-run"] : []), ...files], root);
+  await signWindows(files, "installer", root);
+  if (target.postSign) await runCommand(target.postSign, root);
   const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => path.resolve(root, artifact.file)))];
   if (!updaterFiles.length) fail(`${config.app} win must declare updater.artifacts for post-code-signing minisign`);
   await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
 }
 
-if (target.postSign) {
+if (target.postSign && opts.platform !== "win") {
   await runCommand(target.postSign, root);
 }
 
@@ -377,6 +393,32 @@ function expandEnv(value) {
   return String(value).replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? "");
 }
 
+async function signWindows(files, phase, root) {
+  const args = [SIGN_WINDOWS];
+  const receipt = path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
+  if (opts.dryRun) args.push("--dry-run");
+  else {
+    if (existsSync(receipt)) unlinkSync(receipt);
+    args.push("--receipt", receipt);
+  }
+  console.log(`right-release: signing windows ${phase}`);
+  await run("node", [...args, ...files], root);
+  if (!opts.dryRun) verifyWindowsReceipt(receipt, files, phase);
+}
+
+function verifyWindowsReceipt(receipt, files, phase) {
+  if (!existsSync(receipt)) fail(`missing ${phase} Windows signing receipt: ${receipt}`);
+  let evidence;
+  try { evidence = JSON.parse(readFileSync(receipt, "utf8")); } catch { fail(`invalid ${phase} Windows signing receipt: ${receipt}`); }
+  if (evidence.schema !== 1 || !Array.isArray(evidence.files) || evidence.files.length !== files.length) fail(`ambiguous ${phase} Windows signing receipt: ${receipt}`);
+  const expected = files.map((file) => path.resolve(file)).sort();
+  const actual = evidence.files.map((item) => path.resolve(item.file)).sort();
+  const currentHashes = new Map(files.map((file) => [path.resolve(file), createHash("sha256").update(readFileSync(file)).digest("hex")]));
+  if (JSON.stringify(expected) !== JSON.stringify(actual) || evidence.files.some((item) => item.authenticode !== "Valid" || item.subject !== "CN=Damned Ventures LLC" || item.timestampPresent !== true || item.after?.sha256 !== currentHashes.get(path.resolve(item.file)))) {
+    fail(`invalid ${phase} Windows signing receipt evidence: ${receipt}`);
+  }
+}
+
 function run(cmd, runArgs, cwd, env = {}, options = {}) {
   const printable = `${cmd} ${runArgs.join(" ")}`.trim();
   const releaseEnv = opts.tier ? { RIGHT_RELEASE_TIER: opts.tier } : {};

package/release.test.mjs

@@ -16,7 +16,7 @@ function git(cwd, ...args) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 
-function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
+function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -52,7 +52,7 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
           package: { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
           artifacts: [],
-          ...(platform === "win" ? { sign: { files: ["fixture.exe"] } } : {}),
+          ...(platform === "win" ? { signingContract, prePackage: { cmd: "node", args: ["-e", "process.exit(0)"] }, sign: { prePackageFiles, files: ["fixture.exe"] } } : {}),
           updater: { artifacts: [{ file: "fixture.exe", signature: "fixture.exe.sig", platform: "windows-x86_64", key: "fixture/fixture.exe" }] },
           hardening: [],
         },
@@ -185,6 +185,14 @@ test("rejects targets that do not explicitly declare signed release output", ()
   assert.match(result.stderr, /signed: true/);
 });
 
+test("rejects Windows targets with missing or ambiguous signing configuration", () => {
+  for (const options of [{ signingContract: null }, { prePackageFiles: [] }, { prePackageFiles: ["raw.exe", "other.exe"] }]) {
+    const result = run(fixture(options), "--tier=patch");
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /signingContract|prePackageFiles/i);
+  }
+});
+
 test("rejects Git, path, or link RightKit app dependencies before release work starts", () => {
   const result = run(
     fixture({
@@ -348,13 +356,19 @@ test("combined build and upload is rejected before the package step", () => {
   assert.doesNotMatch(result.stdout, /node -e process\.exit\(0\)/);
 });
 
-test("Windows tier-neutral build signs the installer then minisigns the updater payload", () => {
+test("Windows tier-neutral build builds raw EXE, signs it, bundles, signs installer, then minisigns updater payload", () => {
   const result = run(fixture({ publish: true }));
   assert.equal(result.status, 0, result.stderr);
-  const azureAt = result.stdout.indexOf("sign-windows.mjs");
+  const rawBuildAt = result.stdout.indexOf("node -e");
+  const rawSignAt = result.stdout.indexOf("signing windows raw-exe");
+  const bundleAt = result.stdout.indexOf("node -e", rawSignAt);
+  const installerSignAt = result.stdout.indexOf("signing windows installer");
   const updaterAt = result.stdout.indexOf("sign-updater.mjs");
-  assert.ok(azureAt >= 0, result.stdout);
-  assert.ok(updaterAt > azureAt, result.stdout);
+  assert.ok(rawBuildAt >= 0, result.stdout);
+  assert.ok(rawSignAt > rawBuildAt, result.stdout);
+  assert.ok(bundleAt > rawSignAt, result.stdout);
+  assert.ok(installerSignAt > bundleAt, result.stdout);
+  assert.ok(updaterAt > installerSignAt, result.stdout);
   assert.doesNotMatch(result.stdout, /publish-update\.mjs/);
 });
 

package/right-suite-contract.test.mjs

@@ -450,6 +450,7 @@ test("every app platform requires effective non-empty build inputs", () => {
 
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
+  assert.equal(versions.schema, 2);
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
   assert.equal(versions.npm["@rightkit/release"], "0.2.47");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
@@ -458,23 +459,30 @@ test("RightKit exposes one current version manifest", () => {
   assert.equal(versions.npm["@rightkit/tauri"], "0.1.0");
   assert.equal(versions.npm["@rightkit/updates"], "0.2.3");
   assert.deepEqual(versions.stagedNpm, {
+    "@rightkit/ax": "0.2.0",
+    "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.3.0",
-    "@rightkit/legal-ui": "0.1.0",
+    "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.54",
+    "@rightkit/release": "0.2.55",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53"],
+    "@rightkit/legal-ui": ["0.1.0"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
     "previously published @rightkit/release versions must remain accepted during the 0.2.46 rollout",
   );
-  const licensePackage = JSON.parse(readFileSync(
-    path.join(workspace, "tools/rightkit/packages/license/package.json"),
-    "utf8",
-  ));
-  assert.equal(licensePackage.version, versions.stagedNpm["@rightkit/license"]);
+  for (const [name, version] of Object.entries(versions.stagedNpm)) {
+    const packageName = name.slice("@rightkit/".length);
+    const manifest = JSON.parse(readFileSync(
+      path.join(workspace, "tools/rightkit/packages", packageName, "package.json"),
+      "utf8",
+    ));
+    assert.equal(manifest.name, name);
+    assert.equal(manifest.version, version, `${name} package version must equal stagedNpm`);
+  }
   assert.equal(versions.cargo["rightkit-license"], "0.1.2");
   assert.equal(versions.cargo["rightkit-logs"], "0.1.0");
   assert.equal(versions.cargo["rightkit-tauri"], "0.1.0");
@@ -653,19 +661,15 @@ for (const app of macOnlyApps) {
       args: ["publish-update", "--config", "right-release.config.mjs", "--platform", "mac"],
     });
     const updaters = config.targets.mac.updater.artifacts;
-    assert.deepEqual(
-      updaters.map(({ platform }) => platform).sort(),
-      ["darwin-aarch64", "darwin-x86_64"],
-      `${app.key} universal DMG must serve both Mac architectures`,
-    );
-    const updater = updaters[0];
-    assert.match(updater.file, /\.dmg$/);
-    assert.equal(updater.signature, `${updater.file}.sig`);
-    assert.equal(updater.key, `${app.key}/updates/mac/current/ScreenRight.dmg`);
-    for (const candidate of updaters) {
-      assert.equal(candidate.file, updater.file, `${app.key} updater rows must share one universal DMG`);
-      assert.equal(candidate.signature, updater.signature, `${app.key} updater rows must share one signature`);
-      assert.equal(candidate.key, updater.key, `${app.key} updater rows must share one current R2 object`);
+    assert.equal(updaters.length, 2);
+    assert.deepEqual(updaters.map((updater) => updater.platform).sort(), ["darwin-aarch64", "darwin-x86_64"]);
+    assert.equal(new Set(updaters.map((updater) => updater.file)).size, 1, `${app.key} universal updater must share one DMG`);
+    assert.equal(new Set(updaters.map((updater) => updater.signature)).size, 1, `${app.key} universal updater must share one signature`);
+    assert.equal(new Set(updaters.map((updater) => updater.key)).size, 1, `${app.key} universal updater must share one current R2 object`);
+    for (const updater of updaters) {
+      assert.match(updater.file, /\.dmg$/);
+      assert.equal(updater.signature, `${updater.file}.sig`);
+      assert.equal(updater.key, `${app.key}/updates/mac/current/ScreenRight.dmg`);
     }
     assertBuildInputs(config, config.targets.mac, `${app.key} mac`);
     assertMacPackageEntry(config.targets.mac.package, pkg.scripts, app.key);

package/rightkit-versions.json

@@ -1,5 +1,5 @@
 {
-  "schema": 1,
+  "schema": 2,
   "packageManager": "pnpm@11.18.0",
   "npm": {
     "@rightkit/git": "0.2.0",
@@ -13,13 +13,16 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
+    "@rightkit/ax": "0.2.0",
+    "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.3.0",
-    "@rightkit/legal-ui": "0.1.0",
+    "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.54"
+    "@rightkit/release": "0.2.55"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53"]
+    "@rightkit/legal-ui": ["0.1.0"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/sign-windows.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -19,9 +20,14 @@ const userEnvCache = new Map();
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
 const verifyOnly = args.includes("--verify-only");
-const files = args.filter((arg) => arg !== "--dry-run" && arg !== "--verify-only").map((arg) => path.resolve(arg));
+const receiptIndex = args.indexOf("--receipt");
+const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
+const files = args
+  .filter((arg, index) => arg !== "--dry-run" && arg !== "--verify-only" && arg !== "--receipt" && (receiptIndex < 0 || index !== receiptIndex + 1))
+  .map((arg) => path.resolve(arg));
 
 if (!files.length) fail("usage: node sign-windows.mjs [--dry-run|--verify-only] <file>...");
+if (receiptIndex >= 0 && !receiptPath) fail("--receipt requires a path");
 if (dryRun) {
   console.log(`dry-run: ${verifyOnly ? "Authenticode verification" : "Azure Artifact Signing"} ${files.join(", ")}`);
   process.exit(0);
@@ -33,7 +39,7 @@ const childEnv = signingEnv();
 const signtool = findFirst([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates()]);
 if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
 if (verifyOnly) {
-  for (const file of files) run(signtool, ["verify", "/pa", "/v", file]);
+  for (const file of files) assertVerification(file, run(signtool, ["verify", "/pa", "/v", file]));
   process.exit(0);
 }
 const dlib = findFirst([
@@ -47,14 +53,22 @@ if (!dlib) fail("Azure.CodeSigning.Dlib.dll not found; set AZURE_CODESIGN_DLIB_P
 
 const tempDir = mkdtempSync(path.join(os.tmpdir(), "right-sign-"));
 const metadata = metadataPath(tempDir);
+const evidence = [];
 try {
   for (const file of files) {
+    const before = fileEvidence(file);
     run(signtool, ["sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", "/dlib", dlib, "/dmdf", metadata, file]);
-    run(signtool, ["verify", "/pa", "/v", file]);
+    const verification = assertVerification(file, run(signtool, ["verify", "/pa", "/v", file]));
+    evidence.push({ file, before, after: fileEvidence(file), ...verification });
   }
 } finally {
   rmSync(tempDir, { recursive: true, force: true });
 }
+if (receiptPath) {
+  const absoluteReceipt = path.resolve(receiptPath);
+  mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
+  writeFileSync(absoluteReceipt, `${JSON.stringify({ schema: 1, files: evidence }, null, 2)}\n`);
+}
 
 function metadataPath(dir) {
   const existing = env("AZURE_ARTIFACT_SIGNING_METADATA") || env("AZURE_SIGNING_METADATA");
@@ -128,8 +142,23 @@ function userEnv(name) {
 }
 
 function run(cmd, runArgs) {
-  const result = spawnSync(cmd, runArgs, { env: childEnv, stdio: "inherit" });
+  const result = spawnSync(cmd, runArgs, { env: childEnv, encoding: "utf8", windowsHide: true });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
   if (result.status !== 0) process.exit(result.status ?? 1);
+  return `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+}
+
+function assertVerification(file, output) {
+  if (!/successfully verified/i.test(output)) fail(`Authenticode verification did not report Valid for ${file}`);
+  if (!/^Issued to:\s*Damned Ventures LLC\s*$/im.test(output)) fail(`Authenticode subject must be Damned Ventures LLC for ${file}`);
+  if (!/(?:timestamp|time stamped|timestamped)/i.test(output)) fail(`Authenticode timestamp is missing for ${file}`);
+  return { authenticode: "Valid", subject: "CN=Damned Ventures LLC", timestampPresent: true };
+}
+
+function fileEvidence(file) {
+  const bytes = readFileSync(file);
+  return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
 }
 
 function fail(message) {

package/standalone-clone-evidence.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": 1,
+  "generatedAt": "2026-08-10T04:42:36.444Z",
+  "workRoot": "C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR",
+  "apps": [
+    {
+      "key": "viewright",
+      "remote": "https://github.com/bogusyogi/viewright.git",
+      "appDir": ".",
+      "revision": "21a4171fa8add2d8114bc5f07498b60d7e8eafe5",
+      "packageManager": "pnpm@11.18.0",
+      "clone": {
+        "command": "git clone --depth 1 --single-branch https://github.com/bogusyogi/viewright.git C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright",
+        "status": 0,
+        "stdout": "",
+        "stderr": "Cloning into 'C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright'...\nUpdating files:  91% (1902/2080)\rUpdating files:  92% (1914/2080)\rUpdating files:  93% (1935/2080)\rUpdating files:  94% (1956/2080)\rUpdating files:  95% (1976/2080)\rUpdating files:  96% (1997/2080)\rUpdating files:  97% (2018/2080)\rUpdating files:  98% (2039/2080)\rUpdating files:  99% (2060/2080)\rUpdating files: 100% (2080/2080)\rUpdating files: 100% (2080/2080), done."
+      },
+      "install": {
+        "command": "C:\\nvm4w\\nodejs\\node.exe C:\\nvm4w\\nodejs\\node_modules\\pnpm\\bin\\pnpm.mjs install --frozen-lockfile",
+        "status": 0,
+        "stdout": "✓ Lockfile passes supply-chain policies (verified 8h ago)\nLockfile is up to date, resolution step is skipped\nProgress: resolved 1, reused 0, downloaded 0, added 0\nPackages: +619\n++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\nProgress: resolved 619, reused 0, downloaded 0, added 0\nProgress: resolved 619, reused 60, downloaded 0, added 0\nPackages are hard linked from the content-addressable store to the virtual store.\n  Content-addressable store is at: C:\\Users\\adrds\\AppData\\Local\\pnpm\\store\\v11\n  Virtual store is at:             node_modules/.pnpm\nProgress: resolved 619, reused 573, downloaded 7, added 7\nProgress: resolved 619, reused 574, downloaded 9, added 10\nProgress: resolved 619, reused 574, downloaded 22, added 11\nProgress: resolved 619, reused 574, downloaded 23, added 11\nProgress: resolved 619, reused 574, downloaded 26, added 14\nProgress: resolved 619, reused 574, downloaded 30, added 24\nProgress: resolved 619, reused 574, downloaded 31, added 57\nProgress: resolved 619, reused 574, downloaded 34, added 128\nProgress: resolved 619, reused 574, downloaded 38, added 135\nProgress: resolved 619, reused 574, downloaded 38, added 136\nProgress: resolved 619, reused 574, downloaded 39, added 141\nProgress: resolved 619, reused 574, downloaded 39, added 148\nProgress: resolved 619, reused 574, downloaded 39, added 182\nProgress: resolved 619, reused 574, downloaded 40, added 201\nProgress: resolved 619, reused 574, downloaded 41, added 218\nProgress: resolved 619, reused 574, downloaded 41, added 242\nProgress: resolved 619, reused 574, downloaded 42, added 312\nProgress: resolved 619, reused 574, downloaded 42, added 371\nProgress: resolved 619, reused 574, downloaded 42, added 430\nProgress: resolved 619, reused 574, downloaded 42, added 486\nProgress: resolved 619, reused 574, downloaded 43, added 543\nProgress: resolved 619, reused 574, downloaded 43, added 578\nProgress: resolved 619, reused 574, downloaded 44, added 596\nProgress: resolved 619, reused 574, downloaded 44, added 611\nProgress: resolved 619, reused 574, downloaded 44, added 612\nProgress: resolved 619, reused 574, downloaded 44, added 613\nProgress: resolved 619, reused 574, downloaded 44, added 615\nProgress: resolved 619, reused 574, downloaded 44, added 616\nProgress: resolved 619, reused 574, downloaded 44, added 617\nProgress: resolved 619, reused 574, downloaded 44, added 618\nProgress: resolved 619, reused 574, downloaded 45, added 618\nProgress: resolved 619, reused 574, downloaded 45, added 619\nProgress: resolved 619, reused 574, downloaded 45, added 619, done\n\ndependencies:\n+ @codemirror/autocomplete 6.20.3\n+ @codemirror/commands 6.10.4\n+ @codemirror/lang-html 6.4.11\n+ @codemirror/lang-javascript 6.2.5\n+ @codemirror/lang-markdown 6.5.0\n+ @codemirror/language 6.12.4\n+ @codemirror/lint 6.9.7\n+ @codemirror/search 6.7.1\n+ @codemirror/state 6.7.1\n+ @codemirror/view 6.43.6\n+ @eigenpal/docx-editor-agents @eigenpal/docx-editor-agents@file:vendor/docx-editor/packages/agents(react@19.2.7)\n+ @eigenpal/docx-editor-core @eigenpal/docx-editor-core@file:vendor/docx-editor/packages/core(prosemirror-commands@1.7.1)(prosemirror-dropcursor@1.8.2)(prosemirror-history@1.5.0)(prosemirror-keymap@1.2.3)(prosemirror-model@1.25.10)(prosemirror-state@1.4.4)(prosemirror-tables@1.8.5)(prosemirror-transform@1.12.0)(prosemirror-view@1.42.0)\n+ @eigenpal/docx-editor-i18n @eigenpal/docx-editor-i18n@file:vendor/docx-editor/packages/i18n\n+ @eigenpal/docx-editor-react @eigenpal/docx-editor-react@file:vendor/docx-editor/packages/react(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(prosemirror-commands@1.7.1)(prosemirror-dropcursor@1.8.2)(prosemirror-history@1.5.0)(prosemirror-keymap@1.2.3)(prosemirror-model@1.25.10)(prosemirror-state@1.4.4)(prosemirror-tables@1.8.5)(prosemirror-transform@1.12.0)(prosemirror-view@1.42.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)\n+ @lezer/highlight 1.2.3\n+ @mdx-js/mdx 3.1.1\n+ @phosphor-icons/react 2.1.10\n+ @radix-ui/react-select 2.3.2\n+ @rightkit/legal-ui 0.1.0\n+ @rightkit/license 0.1.6\n+ @rightkit/logs 0.1.3\n+ @rightkit/tauri 0.1.0\n+ @rightkit/updates 0.2.3\n+ @tauri-apps/api 2.11.1\n+ @tauri-apps/plugin-http 2.5.9\n+ @tauri-apps/plugin-process 2.3.1\n+ @tauri-apps/plugin-updater 2.10.1\n+ clsx 2.1.1\n+ docxtemplater 3.69.0\n+ dompurify 3.4.13\n+ fabric 7.4.0\n+ github-slugger 2.0.0\n+ jszip 3.10.1\n+ katex 0.17.0\n+ mermaid 11.16.1\n+ pdfjs-dist 6.2.108\n+ pizzip 3.2.0\n+ prosemirror-commands 1.7.1\n+ prosemirror-dropcursor 1.8.2\n+ prosemirror-history 1.5.0\n+ prosemirror-keymap 1.2.3\n+ prosemirror-model 1.25.10\n+ prosemirror-state 1.4.4\n+ prosemirror-tables 1.8.5\n+ prosemirror-transform 1.12.0\n+ prosemirror-view 1.42.0\n+ react 19.2.7\n+ react-dom 19.2.7\n+ react-image-crop 11.1.2\n+ rehype-stringify 10.0.1\n+ remark-frontmatter 5.0.0\n+ remark-gfm 4.0.1\n+ remark-math 6.0.0\n+ remark-parse 11.0.0\n+ remark-rehype 11.1.2\n+ remark-smartypants 3.0.2\n+ shiki 4.3.1\n+ sonner 2.0.7\n+ sucrase 3.35.1\n+ unified 11.0.5\n+ xml-js 1.6.11\n+ yaml 2.9.0\n\ndevDependencies:\n+ @biomejs/biome 2.5.3\n+ @rightkit/legal 0.3.0\n+ @rightkit/release 0.2.50\n+ @tailwindcss/vite 4.3.2\n+ @tauri-apps/cli 2.11.4\n+ @testing-library/dom 10.4.1\n+ @testing-library/jest-dom 6.9.1\n+ @testing-library/react 16.3.2\n+ @types/mdast 4.0.4\n+ @types/react 19.2.17\n+ @types/react-dom 19.2.3\n+ @types/ws 8.18.1\n+ @vitejs/plugin-react 6.0.3\n+ happy-dom 20.10.6\n+ jscpd 5.0.12\n+ jsdom 29.1.1\n+ knip 6.25.0\n+ tailwindcss 4.3.2\n+ typescript 6.0.3\n+ vite 8.1.4\n+ vitest 4.1.10\n+ ws 8.21.0\n\nDone in 40.8s using pnpm v11.18.0",
+        "stderr": ""
+      },
+      "doctor": {
+        "command": "C:\\nvm4w\\nodejs\\node.exe C:\\nvm4w\\nodejs\\node_modules\\pnpm\\bin\\pnpm.mjs release:doctor",
+        "status": 0,
+        "stdout": "right-release 0.2.50\nconfig: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\right-release.config.mjs\napp: viewright\nplatform: win\ntier: <required for release/publish>\npackageManager: pnpm\nworkdir: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\nhardeningscan: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\node_modules\\.pnpm\\@rightkit+release@0.2.50\\node_modules\\@rightkit\\release\\hardeningscan.mjs\nlegal: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\legal\\legal-manifest.json\nlegalAcceptance: viewright-2026-07-17-v3\nlegalManifestSha256: 035ea7cbd040ef001dbdc1385f114c8bb126178fea9a9f705016a726f96a7830\nsign: src-tauri/target/release/bundle/nsis/ViewRight_0.1.60_x64-setup.exe\npreflight:\n  [ok  ] target-bridge: src-tauri/target is ready for the shared cache bridge\n  [ok  ] version: 0.1.60 is free to build\n  [ok  ] windows-sdk: makeappx.exe from SDK 10.0.26100.0\n  [ok  ] signtool: signtool.exe from SDK 10.0.26100.0\n  [ok  ] sccache: sccache 0.17.0\n  [ok  ] disk: 628.7GB free",
+        "stderr": "$ right-release doctor"
+      }
+    }
+  ]
+}

package/target-bridge.mjs

@@ -168,10 +168,26 @@ function isReclaimableLink(link, ownedRoot, realpath, platform) {
     if (error?.code === "ENOENT") return true;
     throw error;
   }
-  const root = canonical(ownedRoot);
+  const root = canonicalPlannedPath(ownedRoot, realpath, canonical);
   return resolved === root || resolved.startsWith(root.endsWith(path.sep) ? root : `${root}${path.sep}`);
 }
 
+function canonicalPlannedPath(value, realpath, canonical) {
+  let cursor = path.resolve(value);
+  const missing = [];
+  while (true) {
+    try {
+      return canonical(path.join(realpath(cursor), ...missing.reverse()));
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+      const parent = path.dirname(cursor);
+      if (parent === cursor) throw error;
+      missing.push(path.basename(cursor));
+      cursor = parent;
+    }
+  }
+}
+
 function sameRealPath(left, right, realpath, platform) {
   const canonical = (value) => {
     const resolved = path.normalize(realpath(value));