@rightkit/release 0.2.57 → 0.2.59

package/addon-command.mjs

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { addonManifestSha256, addonRoutes, canonicalAddonManifest, createAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
+import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { assertCleanSource } from "./source-gate.mjs";
+
+const ROOT = path.dirname(fileURLToPath(import.meta.url));
+const SIGN_WINDOWS = path.join(ROOT, "sign-windows.mjs");
+const HARDEN = path.join(ROOT, "hardeningscan.mjs");
+const [operation, ...args] = process.argv.slice(2);
+const options = parse(args);
+if (!new Set(["doctor", "build", "upload", "adopt"]).has(operation)) usage(2);
+if (!new Set(["mac", "win"]).has(options.platform)) fail("--platform must be mac or win");
+
+if (operation === "adopt") await adopt(options);
+else {
+  if (!options.config) fail("--config is required");
+  const configPath = path.resolve(options.config);
+  const root = path.dirname(configPath);
+  const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+  assertPrimaryReleaseCheckout(repoRoot);
+  const config = (await import(`${pathToFileURL(configPath).href}?addon=${Date.now()}`)).default;
+  if (operation === "doctor") doctor({ config, configPath, root, repoRoot, options });
+  else if (operation === "build") await build({ config, configPath, root, repoRoot, options });
+  else await upload({ config, root, repoRoot, options });
+}
+
+function doctor({ config, configPath, root, repoRoot, options }) {
+  validateAddonConfig(config, { root, platform: options.platform, allowMissingExecutables: true });
+  console.log(`right-release addon doctor: ${config.addon} ${config.version} ${options.platform}`);
+  console.log(`config: ${configPath}`);
+  console.log(`repo: ${repoRoot}`);
+}
+
+async function build({ config, configPath, root, repoRoot, options }) {
+  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
+  const { target } = validateAddonConfig(config, { root, platform: options.platform, allowMissingExecutables: true });
+  if (options.dryRun) {
+    console.log(`right-release addon build dry-run: ${config.addon} ${config.version} ${options.platform}`);
+    console.log(`config: ${configPath}`);
+    console.log(`commit: ${commit}`);
+    console.log(`would run: ${target.build.cmd} ${target.build.args.join(" ")}`);
+    return;
+  }
+  assertCleanSource({ status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release addon build" });
+  run(target.build.cmd, target.build.args, root);
+  const signing = signExecutableRoles(config, root, options.platform);
+  const manifest = createAddonManifest({ config, root, platform: options.platform, commit, signing });
+  const digest = addonManifestSha256(manifest);
+  const sealed = path.join(repoRoot, ".right-release", "addons", config.addon, config.version, commit.slice(0, 8), options.platform);
+  if (existsSync(sealed)) fail(`add-on seal already exists: ${sealed}`);
+  const temp = `${sealed}.tmp-${process.pid}`;
+  mkdirSync(temp, { recursive: true });
+  for (const file of config.targets[options.platform].files ?? config.files) copyFileSync(path.resolve(root, file.source), path.join(temp, file.name));
+  writeFileSync(path.join(temp, "addon-manifest.json"), canonicalAddonManifest(manifest));
+  run(process.execPath, [HARDEN, ...manifest.files.map((file) => path.join(temp, file.name))], root);
+  mkdirSync(path.dirname(sealed), { recursive: true });
+  renameSync(temp, sealed);
+  console.log(`right-release addon build: sealed ${sealed}`);
+  console.log(`manifestSha256: ${digest}`);
+}
+
+function signExecutableRoles(config, root, platform) {
+  const files = config.targets[platform].files ?? config.files;
+  const executable = files.filter((file) => file.executable === true);
+  if (platform === "win") run(process.execPath, [SIGN_WINDOWS, ...executable.map((file) => path.resolve(root, file.source))], root);
+  else for (const file of executable) {
+    const absolute = path.resolve(root, file.source);
+    run("codesign", ["--force", "--options", "runtime", "--sign", "Developer ID Application", absolute], root);
+    const output = command("codesign", ["-dv", "--verbose=4", absolute], root);
+    if (!new RegExp(`TeamIdentifier=${config.targets.mac.signing.teamId}`).test(output)) fail(`codesign team mismatch: ${file.name}`);
+    run("codesign", ["--verify", "--strict", "--verbose=2", absolute], root);
+  }
+  return Object.fromEntries(executable.map((file) => [file.role, { contract: config.targets[platform].signing.contract, status: "verified" }]));
+}
+
+async function upload({ config, root, repoRoot, options }) {
+  if (config.distribution?.provider === "github-releases") fail("this add-on publishes with right-release github --addon <config> --platform <platform>");
+  if (!new Set(["patch", "update"]).has(options.tier)) fail("add-on upload requires --tier patch|update");
+  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
+  const sealed = path.join(repoRoot, ".right-release", "addons", config.addon, config.version, commit.slice(0, 8), options.platform);
+  const manifest = JSON.parse(readFileSync(path.join(sealed, "addon-manifest.json"), "utf8"));
+  validateAddonManifest(manifest);
+  const routes = addonRoutes(manifest);
+  if (options.dryRun) {
+    for (const route of routes) console.log(`would upload ${route.key}${route.manifest ? " (last)" : ""}`);
+    return;
+  }
+  if (!process.env.CLOUDFLARE_API_TOKEN) fail("CLOUDFLARE_API_TOKEN is required before R2 mutation");
+  for (const route of routes) {
+    const source = route.manifest ? path.join(sealed, "addon-manifest.json") : path.join(sealed, route.name);
+    await putImmutable({ source, route, repoRoot });
+  }
+  console.log(`right-release addon upload: verified ${config.addon} ${options.platform} tier=${options.tier}`);
+}
+
+async function putImmutable({ source, route, repoRoot }) {
+  const target = `rightapps-downloads/${route.key}`;
+  const temp = path.join(os.tmpdir(), `right-addon-r2-${process.pid}-${createHash("sha256").update(route.key).digest("hex").slice(0, 12)}`);
+  const existing = wrangler(["r2", "object", "get", target, "--file", temp, "--remote"], repoRoot);
+  if (existing.status === 0) {
+    const actual = sha256(temp); rmSync(temp, { force: true });
+    if (actual !== route.sha256) fail(`immutable object exists with different bytes: ${route.key}`);
+    return;
+  }
+  if (!/not found|does not exist|404/i.test(`${existing.stdout}\n${existing.stderr}`)) fail(`cannot inspect immutable object: ${route.key}`);
+  const uploaded = wrangler(["r2", "object", "put", target, "--file", source, "--remote"], repoRoot);
+  if (uploaded.status !== 0) fail(`immutable upload failed: ${route.key}`);
+}
+
+async function adopt(options) {
+  if (!options.lock || !options.output) fail("adopt requires --lock and --output");
+  const lockPath = path.resolve(options.lock);
+  const lock = JSON.parse(readFileSync(lockPath, "utf8"));
+  const entry = lock.targets?.[options.platform] ?? lock[options.platform];
+  if (!entry?.manifestSha256 || !entry?.manifestUrl) fail("add-on lock needs platform manifestUrl and manifestSha256");
+  const temporary = options.source ? null : mkdtempSync(path.join(os.tmpdir(), "right-addon-adopt-"));
+  const source = options.source ? path.resolve(options.source) : temporary;
+  if (!options.source) await downloadImmutableAddOn(entry.manifestUrl, source);
+  const manifest = JSON.parse(readFileSync(path.join(source, "addon-manifest.json"), "utf8"));
+  validateAddonManifest(manifest);
+  if (addonManifestSha256(manifest) !== entry.manifestSha256) fail("add-on lock manifest SHA mismatch");
+  if (!immutableAddonManifestUrl(manifest, entry.manifestUrl, entry.manifestSha256)) fail("add-on lock manifestUrl is not immutable");
+  const output = path.resolve(options.output);
+  const destination = path.join(output, manifest.addon);
+  const stage = `${destination}.tmp-${process.pid}`;
+  const adoptedFiles = [];
+  rmSync(stage, { recursive: true, force: true }); mkdirSync(stage, { recursive: true });
+  for (const file of manifest.files) {
+    const sourceFile = path.join(source, file.name);
+    if (!existsSync(sourceFile) || statSync(sourceFile).size !== file.sizeBytes || sha256(sourceFile) !== file.sha256) fail(`add-on file verification failed: ${file.name}`);
+    verifyAdoptedSignature({ file, sourceFile, platform: manifest.platform, sourceFixture: Boolean(options.source) });
+    const subdir = file.role === "command" || file.role === "service" ? "bin" : file.role === "icon" || LEGAL(file.role) ? "resources" : "resources";
+    mkdirSync(path.join(stage, subdir), { recursive: true });
+    const installed = path.join(stage, subdir, file.name);
+    copyFileSync(sourceFile, installed);
+    // Tauri resolves externalBin artifacts by Rust target triple. Keep the
+    // portable role name too, then provide the required target-qualified alias.
+    if (file.role === "command" || file.role === "service") {
+      const base = file.name.replace(/\.exe$/i, "");
+      const suffix = manifest.platform === "win" ? `${base}-${manifest.targetTriple}.exe` : `${base}-${manifest.targetTriple}`;
+      const alias = path.join(stage, "bin", suffix);
+      copyFileSync(sourceFile, alias);
+      const adoptedSha256 = sha256(alias);
+      if (adoptedSha256 !== file.sha256) fail(`adopted alias hash mismatch: ${file.name}`);
+      adoptedFiles.push({ role: file.role, name: file.name, sealedSha256: file.sha256, adoptedName: `bin/${suffix}`, adoptedSha256 });
+    }
+  }
+  copyFileSync(path.join(source, "addon-manifest.json"), path.join(stage, "addon-manifest.json"));
+  // Directory rename is atomic on one filesystem. Move any previous add-on
+  // aside first, restore it if replacement fails, then clean it only after the
+  // new verified tree is in place.
+  const previous = `${destination}.previous-${process.pid}`;
+  mkdirSync(output, { recursive: true });
+  if (existsSync(destination)) renameSync(destination, previous);
+  try {
+    renameSync(stage, destination);
+  } catch (error) {
+    if (existsSync(previous)) renameSync(previous, destination);
+    throw error;
+  }
+  rmSync(previous, { recursive: true, force: true });
+  if (temporary) rmSync(temporary, { recursive: true, force: true });
+  const repoRoot = git(path.dirname(lockPath), ["rev-parse", "--show-toplevel"]);
+  const receipt = path.join(repoRoot, ".right-release", "addons", "adoptions", `${manifest.addon}-${manifest.platform}.json`);
+  mkdirSync(path.dirname(receipt), { recursive: true });
+  writeFileSync(receipt, `${JSON.stringify({ schema: 1, addon: manifest.addon, platform: manifest.platform, manifestSha256: entry.manifestSha256, manifestUrl: entry.manifestUrl, output: destination, files: adoptedFiles, adoptedAt: new Date().toISOString() }, null, 2)}\n`);
+  console.log(`right-release addon adopt: ${destination}`);
+  console.log(`receipt: ${receipt}`);
+}
+
+function verifyAdoptedSignature({ file, sourceFile, platform, sourceFixture }) {
+  if (!file.executable) return;
+  if (file.signing.contract === "test-fixture-v1" && sourceFixture && process.env.RIGHT_RELEASE_TEST_FIXTURE === "1") return;
+  if (platform === "mac") {
+    if (file.signing.contract !== "apple-developer-id-executable-v1") fail(`unexpected mac signing contract: ${file.name}`);
+    const output = command("codesign", ["-dv", "--verbose=4", sourceFile], path.dirname(sourceFile));
+    if (!/TeamIdentifier=6KLGD3LLKF/.test(output)) fail(`codesign team mismatch: ${file.name}`);
+    run("codesign", ["--verify", "--strict", "--verbose=2", sourceFile], path.dirname(sourceFile));
+  } else {
+    if (file.signing.contract !== "azure-artifact-signing-v1") fail(`unexpected Windows signing contract: ${file.name}`);
+    run(process.execPath, [SIGN_WINDOWS, "--verify-only", sourceFile], path.dirname(sourceFile));
+  }
+}
+
+function LEGAL(role) { return new Set(["license", "eula", "privacy", "third-party-notices"]).has(role); }
+function parse(args) { const value = { platform: process.platform === "win32" ? "win" : "mac", dryRun: false }; for (let i = 0; i < args.length; i += 1) { const key = args[i]; if (key === "--dry-run") value.dryRun = true; else if (["--config", "--platform", "--tier", "--lock", "--output", "--source"].includes(key)) value[key.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase())] = args[++i]; else fail(`unknown argument: ${key}`); } return value; }
+function git(cwd, args) { return command("git", args, cwd).trim(); }
+function command(cmd, args, cwd) { const result = spawnSync(cmd, args, { cwd, encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`${cmd} ${args.join(" ")} failed: ${result.stderr || result.stdout}`); return `${result.stdout ?? ""}${result.stderr ?? ""}`; }
+function run(cmd, args, cwd) { command(cmd, args, cwd); }
+function wrangler(args, cwd) { return spawnSync("pnpm", ["dlx", "wrangler@4", ...args], { cwd, encoding: "utf8", windowsHide: true }); }
+function sha256(file) { return createHash("sha256").update(readFileSync(file)).digest("hex"); }
+function usage(code) { console.log("usage: right-release addon doctor|build|upload|adopt --platform mac|win ..."); process.exit(code); }
+function fail(message) { console.error(`right-release addon: ${message}`); process.exit(1); }

package/addon-command.test.mjs

@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import test from "node:test";
+import { createAddonManifest, addonManifestSha256, canonicalAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl } from "./addon-contract.mjs";
+
+const command = fileURLToPath(new URL("./addon-command.mjs", import.meta.url));
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-command-"));
+  mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
+  for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
+  writeFileSync(path.join(root, "assets", "tab.png"), "icon");
+  const files = [["command", "membrane", "out/membrane", true], ["service", "crypt-service", "out/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
+  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
+  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
+  return root;
+}
+test("add-on dry-run creates no release state and never executes build", () => {
+  const root = fixture(); const result = spawnSync(process.execPath, [command, "build", "--config", "right-addon.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr); assert.match(result.stdout, /would run: false/); assert.equal(existsSync(path.join(root, ".right-release")), false);
+});
+
+test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
+  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
+  const sealed = path.join(root, "sealed"); mkdirSync(sealed);
+  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
+  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
+  const digest = addonManifestSha256(manifest); const lock = path.join(root, "membrane.lock.json"); writeFileSync(lock, JSON.stringify({ targets: { mac: { manifestUrl: `https://example.test/membrane/addons/mac/sha256/${digest}/addon-manifest.json`, manifestSha256: digest } } }));
+  const output = path.join(root, "addons"); const unsigned = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", `${output}-unsigned`, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "" } });
+  assert.notEqual(unsigned.status, 0); assert.match(unsigned.stderr, /unexpected mac signing contract/);
+  const result = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", output, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "1" } });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(readFileSync(path.join(output, "membrane", "bin", "membrane-aarch64-apple-darwin"), "utf8"), "command");
+  assert.equal(readFileSync(path.join(output, "membrane", "resources", "LICENSE"), "utf8"), "LICENSE");
+  const receipt = JSON.parse(readFileSync(path.join(root, ".right-release", "addons", "adoptions", "membrane-mac.json"), "utf8"));
+  assert.equal(receipt.manifestSha256, digest);
+  assert.deepEqual(receipt.files.map((file) => [file.role, file.sealedSha256, file.adoptedSha256]), [["command", manifest.files.find((file) => file.role === "command").sha256, manifest.files.find((file) => file.role === "command").sha256], ["service", manifest.files.find((file) => file.role === "service").sha256, manifest.files.find((file) => file.role === "service").sha256]]);
+});
+
+test("remote downloader accepts only immutable manifest plus file routes", async () => {
+  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
+  const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
+  const destination = path.join(root, "remote"); mkdirSync(destination);
+  await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
+  assert.equal(readFileSync(path.join(destination, "crypt-service"), "utf8"), "service");
+  assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
+});

package/addon-contract.mjs

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const ROLES = new Set(["command", "service", "icon", "license", "eula", "privacy", "third-party-notices"]);
+const LEGAL_ROLES = new Set(["license", "eula", "privacy", "third-party-notices"]);
+const PLATFORM = new Set(["mac", "win"]);
+const GITHUB_REPOSITORY = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+
+export function validateAddonConfig(config, { root, platform, allowMissingExecutables = false }) {
+  if (!PLATFORM.has(platform)) throw new Error("add-on platform must be mac or win");
+  if (!config || config.schema !== 1 || config.kind !== "headless-addon") throw new Error("add-on config must use schema 1 headless-addon");
+  for (const key of ["addon", "version", "packageManager"]) if (typeof config[key] !== "string" || !SAFE_NAME.test(config[key])) throw new Error(`unsafe add-on ${key}`);
+  if (!Array.isArray(config.checks)) throw new Error("add-on checks must be an array");
+  if (config.distribution && (config.distribution.provider !== "github-releases" || !GITHUB_REPOSITORY.test(config.distribution.repository ?? ""))) throw new Error("add-on distribution must name a GitHub Releases repository");
+  validateBuildInputs(config.buildInputs);
+  const target = config.targets?.[platform];
+  if (!target?.targetTriple || !target?.build?.cmd || !Array.isArray(target.build.args)) throw new Error(`add-on ${platform} target requires targetTriple and build command`);
+  if (!target.signing?.contract) throw new Error(`add-on ${platform} target requires signing contract`);
+  if (platform === "mac" && target.signing.contract === "apple-developer-id-executable-v1" && !/^[A-Z0-9]{10}$/.test(target.signing.teamId ?? "")) throw new Error("mac add-on requires Developer ID teamId");
+  const files = resolveAddonFiles(config, root, platform);
+  const seenRoles = new Set();
+  const seenNames = new Set();
+  for (const file of files) {
+    if (!ROLES.has(file.role) || seenRoles.has(file.role)) throw new Error(`duplicate or unsafe add-on role: ${file.role}`);
+    if (!SAFE_NAME.test(file.name) || file.name.includes("..")) throw new Error(`unsafe add-on file name: ${file.name}`);
+    if (path.isAbsolute(file.source) || file.source.split(/[\\/]/).includes("..")) throw new Error(`unsafe add-on source: ${file.source}`);
+    if (seenNames.has(file.name)) throw new Error(`duplicate add-on file name: ${file.name}`);
+    if (!existsSync(path.resolve(root, file.source)) && !(allowMissingExecutables && file.executable === true)) throw new Error(`missing add-on file: ${file.source}`);
+    seenRoles.add(file.role); seenNames.add(file.name);
+  }
+  for (const role of ["command", "service", "icon", ...LEGAL_ROLES]) if (!seenRoles.has(role)) throw new Error(`missing required add-on role: ${role}`);
+  return { target, files };
+}
+
+export function resolveAddonFiles(config, root, platform) {
+  const configured = config.targets?.[platform]?.files ?? config.files;
+  if (!Array.isArray(configured)) throw new Error("add-on config requires files with role, name, and source");
+  return configured.map((file) => ({ ...file, executable: file.executable === true, source: String(file.source ?? "") }));
+}
+
+export function createAddonManifest({ config, root, platform, commit, signedAt = new Date().toISOString(), signing = {} }) {
+  const { target, files } = validateAddonConfig(config, { root, platform });
+  if (!/^[0-9a-f]{40}$/i.test(commit)) throw new Error("add-on commit must be a full Git SHA");
+  const manifestFiles = files.map((file) => {
+    const source = path.resolve(root, file.source);
+    const executable = file.executable === true;
+    if ((file.role === "command" || file.role === "service") && !executable) throw new Error(`executable role must declare executable: ${file.role}`);
+    const signature = signing[file.role] ?? (executable ? { contract: target.signing.contract, status: "verified" } : null);
+    if (executable && (!signature || signature.status !== "verified")) throw new Error(`unsigned executable role: ${file.role}`);
+    return { role: file.role, name: file.name, sha256: sha256(source), sizeBytes: statSync(source).size, executable, signing: signature };
+  });
+  const manifest = { schema: 1, kind: "headless-addon", addon: config.addon, version: config.version, commit, platform, targetTriple: target.targetTriple, consumer: config.consumer, files: manifestFiles, signedAt };
+  validateAddonManifest(manifest);
+  return manifest;
+}
+
+export function validateAddonManifest(manifest) {
+  const expected = ["schema", "kind", "addon", "version", "commit", "platform", "targetTriple", "consumer", "files", "signedAt"];
+  assertExactKeys(manifest, expected, "add-on manifest");
+  if (manifest.schema !== 1 || manifest.kind !== "headless-addon" || !SAFE_NAME.test(manifest.addon) || !SAFE_NAME.test(manifest.version)) throw new Error("invalid add-on manifest identity");
+  if (!PLATFORM.has(manifest.platform) || !/^[0-9a-f]{40}$/i.test(manifest.commit) || !Array.isArray(manifest.files)) throw new Error("invalid add-on manifest platform or files");
+  const roles = new Set(); const names = new Set();
+  for (const file of manifest.files) {
+    assertExactKeys(file, ["role", "name", "sha256", "sizeBytes", "executable", "signing"], "add-on file");
+    if (!ROLES.has(file.role) || roles.has(file.role) || !SAFE_NAME.test(file.name) || names.has(file.name)) throw new Error("duplicate or unsafe add-on manifest file");
+    if (!/^[0-9a-f]{64}$/i.test(file.sha256) || !Number.isSafeInteger(file.sizeBytes) || file.sizeBytes < 0 || typeof file.executable !== "boolean") throw new Error("invalid add-on file integrity");
+    if (file.executable && (!file.signing || file.signing.status !== "verified")) throw new Error(`unsigned executable role: ${file.role}`);
+    roles.add(file.role); names.add(file.name);
+  }
+  for (const role of ["command", "service", "icon", ...LEGAL_ROLES]) if (!roles.has(role)) throw new Error(`missing required add-on role: ${role}`);
+  return manifest;
+}
+
+export function canonicalAddonManifest(manifest) { validateAddonManifest(manifest); return `${JSON.stringify(manifest)}\n`; }
+export function addonManifestSha256(manifest) { return createHash("sha256").update(canonicalAddonManifest(manifest)).digest("hex"); }
+export function addonRoutes(manifest) {
+  const digest = addonManifestSha256(manifest);
+  const root = `${manifest.addon}/addons/${manifest.platform}/sha256/${digest}`;
+  return [...manifest.files.map((file) => ({ name: file.name, key: `${root}/${file.name}`, sha256: file.sha256, manifest: false })), { name: "addon-manifest.json", key: `${root}/addon-manifest.json`, sha256: digest, manifest: true }];
+}
+
+export function immutableAddonManifestUrl(manifest, manifestUrl, digest = addonManifestSha256(manifest)) {
+  if (/[?#]/.test(manifestUrl)) return false;
+  const r2Suffix = `/${manifest.addon}/addons/${manifest.platform}/sha256/${digest}/addon-manifest.json`;
+  const githubTag = `addon-${manifest.addon}-v${manifest.version}-${manifest.platform}-sha256-${digest}`;
+  const githubSuffix = `/releases/download/${githubTag}/addon-manifest.json`;
+  return manifestUrl.endsWith(r2Suffix) || (/^https:\/\/github\.com\//.test(manifestUrl) && manifestUrl.endsWith(githubSuffix));
+}
+
+export async function downloadImmutableAddOn(manifestUrl, destination, { fetchImpl = fetch } = {}) {
+  if (!/^https:\/\//.test(manifestUrl) || !manifestUrl.endsWith("/addon-manifest.json") || /[?#]/.test(manifestUrl)) throw new Error("add-on lock manifestUrl must be an immutable HTTPS manifest URL");
+  const download = async (url, file) => {
+    const response = await fetchImpl(url, { cache: "no-store" });
+    if (!response.ok) throw new Error(`immutable add-on download failed: ${response.status} ${url}`);
+    writeFileSync(file, Buffer.from(await response.arrayBuffer()));
+  };
+  await download(manifestUrl, path.join(destination, "addon-manifest.json"));
+  const manifest = JSON.parse(readFileSync(path.join(destination, "addon-manifest.json"), "utf8"));
+  validateAddonManifest(manifest);
+  const base = manifestUrl.slice(0, -"addon-manifest.json".length);
+  for (const file of manifest.files) await download(`${base}${encodeURIComponent(file.name)}`, path.join(destination, file.name));
+}
+
+function validateBuildInputs(inputs) {
+  if (!Array.isArray(inputs?.include) || !inputs.include.length || inputs.include.some((entry) => typeof entry !== "string" || path.isAbsolute(entry) || entry.split(/[\\/]/).includes(".."))) throw new Error("add-on buildInputs.include must be safe and non-empty");
+}
+function sha256(file) { return createHash("sha256").update(readFileSync(file)).digest("hex"); }
+function assertExactKeys(value, keys, label) { if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join("\0") !== [...keys].sort().join("\0")) throw new Error(`${label} has unsupported fields`); }

package/addon-contract.test.mjs

@@ -0,0 +1,48 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
+  mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
+  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/crypt-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
+  const files = [
+    ["command", "membrane", "bin/membrane", true], ["service", "crypt-service", "bin/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
+    ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
+  ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
+  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
+}
+
+test("add-on manifest has portable immutable identity and routes", () => {
+  const { root, config } = fixture();
+  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
+  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "a".repeat(40), signedAt: "2026-08-11T00:00:00.000Z", signing });
+  assert.deepEqual(Object.keys(manifest), ["schema", "kind", "addon", "version", "commit", "platform", "targetTriple", "consumer", "files", "signedAt"]);
+  const digest = addonManifestSha256(manifest); const routes = addonRoutes(manifest);
+  assert.equal(routes.at(-1).manifest, true);
+  assert.match(routes[0].key, new RegExp(`^membrane/addons/mac/sha256/${digest}/`));
+  assert.ok(routes.slice(0, -1).every((route) => !route.manifest));
+});
+
+test("add-on contract rejects unsafe, incomplete, duplicate, and unsigned inputs", () => {
+  const { root, config } = fixture();
+  const broken = structuredClone(config); broken.targets.mac.files[0].source = "../escape";
+  assert.throws(() => validateAddonConfig(broken, { root, platform: "mac" }), /unsafe add-on source/);
+  const duplicate = structuredClone(config); duplicate.targets.mac.files[1].role = "command";
+  assert.throws(() => validateAddonConfig(duplicate, { root, platform: "mac" }), /duplicate/);
+  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
+  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "b".repeat(40), signing });
+  manifest.files.find((file) => file.role === "command").signing = null;
+  assert.throws(() => validateAddonManifest(manifest), /unsigned executable/);
+});
+
+test("manifest excludes source and mutable transport fields", () => {
+  const { root, config } = fixture();
+  const manifest = createAddonManifest({ config, root, platform: "win", commit: "c".repeat(40), signing: { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } } });
+  const text = JSON.stringify(manifest);
+  assert.doesNotMatch(text, /source|path|url|token/i);
+  assert.equal(readFileSync(path.join(root, "bin", "membrane"), "utf8"), "membrane");
+});

package/build-release.mjs

@@ -99,6 +99,23 @@ let cacheLease;
 let heavySlot;
 let interrupted;
 
+// A dry-run is an inspection contract, not a partial build. It must finish
+// before locks, cache directories, receipts, dependency installation, or any
+// child build/sign process can exist.
+if (dryRun) {
+  const commit = git(invocationRoot, ["rev-parse", "HEAD"]);
+  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+  if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
+  const config = (await import(`${pathToFileURL(configPath).href}?dry-run=${commit}`)).default;
+  if (!config?.app || !config?.version) fail("release config must expose app and version");
+  const target = config.targets?.[platform];
+  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  console.log(`right-release build dry-run: ${config.app} ${config.version} ${platform}`);
+  console.log(`config: ${configPath}`);
+  console.log(`commit: ${commit}`);
+  process.exit(0);
+}
+
 for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
   process.once(signal, () => {
     if (child?.pid) killTree(child.pid);

package/build-release.test.mjs

@@ -1,10 +1,24 @@
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import os from "node:os";
 import path from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
 
 const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
+const build = path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs");
+
+test("general build dry-run is filesystem-pure and never starts its package command", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-build-dry-run-"));
+  writeFileSync(path.join(root, "right-release.config.mjs"), "export default { app: 'fixture', version: '1.0.0', targets: { mac: { package: { cmd: 'false' } } } };\n");
+  for (const args of [["init", "--initial-branch", "main"], ["config", "user.email", "test@example.com"], ["config", "user.name", "Test"], ["add", "."], ["commit", "-m", "init"]]) execFileSync("git", args, { cwd: root });
+  const before = readdirSync(root).sort();
+  const result = spawnSync(process.execPath, [build, "--config", "right-release.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /build dry-run/);
+  assert.deepEqual(readdirSync(root).sort(), before);
+});
 
 test("macOS and Windows builds default to Cache V2 while explicit legacy mode remains available", () => {
   assert.match(source, /assertCleanSource/);

package/cargo-contract.mjs

@@ -85,6 +85,15 @@ function readCargoManifestDependencies(manifestPath, cargoHome, label) {
       windowsHide: true,
     },
   );
+  if (result.error) {
+    // spawnSync failed to launch the process at all (no exit code, no stderr) -
+    // a missing/unspawnable binary, not cargo rejecting the manifest. Reporting
+    // this as a version-contract violation sent a real diagnosis (a Windows
+    // rustup-proxy binary that can't be spawned from a non-console session)
+    // down the wrong path: it read as "fix your Cargo.toml" instead of "cargo
+    // could not be launched here".
+    throw new Error(`${label} could not launch ${cargoExecutable()} to read Cargo metadata: ${result.error.message}`);
+  }
   if (result.status !== 0) {
     throw new Error(`${label} Cargo metadata rejected manifest; RightKit dependencies must use exact crates.io versions: ${String(result.stderr ?? "").trim()}`);
   }

package/cli/right-release.mjs

@@ -61,6 +61,8 @@ if (first === "--version" || first === "-v") {
     process.exit(2);
   }
   run("model-promote.mjs", rest.slice(1));
+} else if (first === "addon") {
+  run("addon-command.mjs", args.slice(1));
 } else if (first === "lsclean") {
   runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
 } else if (first === "generate-dmg-background") {
@@ -133,6 +135,7 @@ Commands:
   publish swift [--scope <s>] [--url <u>] [--dry-run] Test, archive, scan, and publish RightKitSwift to a Swift registry
   model promote --authority heardright --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
+  addon doctor|build|upload|adopt <options>           Manage a signed headless add-on
   doctor [--platform mac|win]                        Inspect one app's release config
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories

package/github-release.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
+import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 
 const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
@@ -37,24 +38,69 @@ export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stat
       `Build commit: \`${sealed.manifest.commit}\``,
       `SHA-256: \`${installers[0].sha256}\``,
     ].join("\n"),
+    notesFile: path.join(releaseState, "release-notes.md"),
+  };
+}
+
+export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoRoot, platform, repo }) {
+  if (platform !== "mac" && platform !== "win") throw new Error("platform must be mac or win");
+  if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
+  validateAddonConfig(config, { root: configRoot, platform, allowMissingExecutables: true });
+  const commit = runCommand("git", ["rev-parse", "HEAD"], { cwd: repoRoot });
+  const sealedDir = path.join(repoRoot, ".right-release", "addons", config.addon, config.version, commit.slice(0, 8), platform);
+  const manifestPath = path.join(sealedDir, "addon-manifest.json");
+  if (!existsSync(manifestPath)) throw new Error(`sealed add-on manifest not found: ${manifestPath}`);
+  const manifest = validateAddonManifest(JSON.parse(readFileSync(manifestPath, "utf8")));
+  if (manifest.addon !== config.addon || manifest.version !== config.version || manifest.platform !== platform || manifest.commit !== commit) throw new Error("sealed add-on identity mismatch");
+  const assets = manifest.files.map((file) => {
+    const asset = path.join(sealedDir, file.name);
+    if (!existsSync(asset) || statSync(asset).size !== file.sizeBytes || sha256(asset) !== file.sha256) throw new Error(`sealed add-on file mismatch: ${file.name}`);
+    return asset;
+  });
+  const digest = addonManifestSha256(manifest);
+  const tag = `addon-${manifest.addon}-v${manifest.version}-${platform}-sha256-${digest}`;
+  const stateDir = path.join(repoRoot, ".right-release", "state", "addons", manifest.addon, manifest.version, commit.slice(0, 8), platform, "github");
+  mkdirSync(stateDir, { recursive: true });
+  return {
+    kind: "addon", manifest, manifestPath, sealedDir, assets: [...assets, manifestPath], tag,
+    title: `${manifest.addon} ${manifest.version} ${platform} add-on`,
+    notes: [`Signed ${platform === "mac" ? "macOS" : "Windows"} add-on component set.`, "", `Build commit: \`${manifest.commit}\``, `Manifest SHA-256: \`${digest}\``].join("\n"),
+    notesFile: path.join(stateDir, "release-notes.md"),
+    manifestUrl: `https://github.com/${repo}/releases/download/${tag}/addon-manifest.json`,
   };
 }
 
 export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand } = {}) {
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
   if (visibility.visibility !== "PUBLIC") throw new Error(`GitHub releases require a public repository: ${repo}`);
-  verifyPlatformTrust(plan);
+  if (plan.kind === "addon") verifyAddonTrust(plan);
+  else verifyPlatformTrust(plan);
   const existing = run("gh", ["release", "view", plan.tag, "--repo", repo, "--json", "tagName"], { allowFailure: true });
-  if (dryRun) return { status: existing.ok ? "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
+  if (dryRun) return { status: existing.ok ? plan.kind === "addon" ? "would-verify" : "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
+  if (plan.kind === "addon" && existing.ok) {
+    for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
+    return { status: "already-verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
+  }
   if (!existing.ok) {
-    const notesFile = `${plan.assets[1]}.notes.md`;
+    const notesFile = plan.notesFile;
     writeFileSync(notesFile, `${plan.notes}\n`);
     run("gh", ["release", "create", plan.tag, "--repo", repo, "--title", plan.title, "--notes-file", notesFile]);
     rmSync(notesFile, { force: true });
   }
   run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo, "--clobber"]);
   for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
-  return { status: "verified", tag: plan.tag, assets: plan.assets };
+  return { status: "verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
+}
+
+function verifyAddonTrust(plan) {
+  for (const file of plan.manifest.files.filter((entry) => entry.executable)) {
+    const executable = path.join(plan.sealedDir, file.name);
+    if (plan.manifest.platform === "mac") {
+      const output = runCombined("codesign", ["-dv", "--verbose=4", executable]);
+      if (!/TeamIdentifier=6KLGD3LLKF/.test(output)) throw new Error(`codesign team mismatch: ${file.name}`);
+      runCommand("codesign", ["--verify", "--strict", "--verbose=2", executable]);
+    } else runCommand(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), "sign-windows.mjs"), "--verify-only", executable]);
+  }
 }
 
 function verifyPlatformTrust(plan) {
@@ -77,8 +123,8 @@ function sha256(file) {
   return createHash("sha256").update(readFileSync(file)).digest("hex");
 }
 
-function runCommand(command, args, { allowFailure = false } = {}) {
-  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+function runCommand(command, args, { allowFailure = false, cwd } = {}) {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8", windowsHide: true });
   const output = result.stdout?.trim() ?? "";
   if (result.status !== 0) {
     if (allowFailure) return { ok: false, output, error: result.stderr?.trim() ?? "" };
@@ -87,25 +133,43 @@ function runCommand(command, args, { allowFailure = false } = {}) {
   return allowFailure ? { ok: true, output } : output;
 }
 
+function runCombined(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed: ${result.stderr?.trim() || `exit ${result.status}`}`);
+  return `${result.stdout ?? ""}${result.stderr ?? ""}`;
+}
+
 function usage(code) {
-  console.log("usage: right-release github --release <sealed-id> --platform mac|win --repo owner/repo [--dry-run]");
+  console.log("usage: right-release github (--release <sealed-id> | --addon <config>) --platform mac|win [--repo owner/repo] [--dry-run]");
   process.exit(code);
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
   const args = process.argv.slice(2);
-  const options = { platform: process.platform === "win32" ? "win" : "mac", releaseId: "", repo: "", dryRun: false };
+  const options = { platform: process.platform === "win32" ? "win" : "mac", releaseId: "", addon: "", repo: "", dryRun: false };
   for (let index = 0; index < args.length; index += 1) {
     if (args[index] === "--platform") options.platform = args[++index];
     else if (args[index] === "--release") options.releaseId = args[++index];
+    else if (args[index] === "--addon") options.addon = args[++index];
     else if (args[index] === "--repo") options.repo = args[++index];
     else if (args[index] === "--dry-run") options.dryRun = true;
     else if (args[index] === "-h" || args[index] === "--help") usage(0);
     else throw new Error(`unknown argument: ${args[index]}`);
   }
-  if (!options.releaseId || !options.repo) usage(2);
+  if (Boolean(options.releaseId) === Boolean(options.addon)) usage(2);
   const repoRoot = runCommand("git", ["rev-parse", "--show-toplevel"]);
-  const plan = prepareGitHubRelease({ repoRoot, ...options });
+  let plan;
+  if (options.addon) {
+    const configPath = path.resolve(options.addon);
+    const config = (await import(`${pathToFileURL(configPath).href}?github=${Date.now()}`)).default;
+    options.repo ||= config.distribution?.repository ?? "";
+    if (config.distribution?.provider !== "github-releases") throw new Error("add-on config must select github-releases distribution");
+    plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
+  } else {
+    if (!options.repo) usage(2);
+    plan = prepareGitHubRelease({ repoRoot, ...options });
+  }
   const result = publishGitHubRelease(plan, options);
   console.log(`right-release github: ${result.status} ${result.tag}`);
+  if (result.manifestUrl) console.log(`manifestUrl: ${result.manifestUrl}`);
 }

package/github-release.test.mjs

@@ -4,7 +4,9 @@ import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
-import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
+import { execFileSync } from "node:child_process";
+import { canonicalAddonManifest, createAddonManifest } from "./addon-contract.mjs";
+import { prepareGitHubAddonRelease, prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
 
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 
@@ -22,6 +24,24 @@ function fixture() {
   return { root, releaseId };
 }
 
+function addonFixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
+  mkdirSync(path.join(root, "out"));
+  for (const [name, bytes] of [["membrane", "command"], ["crypt-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
+  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
+  execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
+  execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
+  writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
+  const files = [["command", "membrane", true], ["service", "crypt-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
+  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "orthic-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
+  const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+  const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
+  const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });
+  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, "out", file.name)));
+  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
+  return { root, config };
+}
+
 test("GitHub plan derives tag, notes, installer, manifest & checksums only from sealed bytes", () => {
   const fx = fixture();
   const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
@@ -44,3 +64,26 @@ test("dry-run checks public visibility without creating or uploading a release",
   assert.equal(publishGitHubRelease(plan, { repo: "Orthic-Labs/CutRight", dryRun: true, run }).status, "would-create");
   assert.equal(calls.length, 2);
 });
+
+test("GitHub add-on plan uses a content-addressed platform tag and manifest URL", () => {
+  const fx = addonFixture();
+  const plan = prepareGitHubAddonRelease({ repoRoot: fx.root, config: fx.config, platform: "win", repo: "Orthic-Labs/Membrane" });
+  assert.match(plan.tag, /^addon-membrane-v0\.1\.0-win-sha256-[0-9a-f]{64}$/);
+  assert.equal(plan.assets.at(-1), plan.manifestPath);
+  assert.equal(plan.manifestUrl, `https://github.com/Orthic-Labs/Membrane/releases/download/${plan.tag}/addon-manifest.json`);
+});
+
+test("existing GitHub add-on release is verified without upload mutation", () => {
+  const asset = path.join(mkdtempSync(path.join(os.tmpdir(), "right-release-existing-")), "addon-manifest.json"); writeFileSync(asset, "sealed");
+  const calls = [];
+  const run = (_command, args, options = {}) => {
+    calls.push(args);
+    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
+    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: true } : "";
+    if (args[0] === "release" && args[1] === "download") { mkdirSync(args[args.indexOf("--dir") + 1], { recursive: true }); writeFileSync(path.join(args[args.indexOf("--dir") + 1], path.basename(asset)), "sealed"); return ""; }
+    throw new Error(`unexpected mutation: ${args.join(" ")}`);
+  };
+  const result = publishGitHubRelease({ kind: "addon", manifest: { files: [] }, sealedDir: path.dirname(asset), tag: "immutable", assets: [asset], manifestUrl: "https://example.test/manifest" }, { repo: "Orthic-Labs/Membrane", run });
+  assert.equal(result.status, "already-verified");
+  assert.equal(calls.some((args) => args[0] === "release" && args[1] === "upload"), false);
+});

package/package.json

@@ -1,32 +1,31 @@
-{
-  "name": "@rightkit/release",
-  "version": "0.2.57",
-  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
-  "type": "module",
-  "bin": {
-    "right-release": "cli/right-release.mjs"
-  },
-  "files": [
-    "cli",
-    "*.mjs",
-    "*.json",
-    "*.sh",
-    "*.py"
-  ],
-  "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  },
-  "publishConfig": {
-    "registry": "https://registry.npmjs.org/",
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
-    "directory": "tools/rightkit/packages/release"
-  },
-  "packageManager": "pnpm@11.18.0"
-}
+{
+  "name": "@rightkit/release",
+  "version": "0.2.59",
+  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
+  "type": "module",
+  "bin": {
+    "right-release": "cli/right-release.mjs"
+  },
+  "files": [
+    "cli",
+    "*.mjs",
+    "*.json",
+    "*.sh",
+    "*.py"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adrdsouza/claude.git",
+    "directory": "tools/rightkit/packages/release"
+  },
+  "scripts": {
+    "test": "node --test *.test.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  }
+}

package/release-state.mjs

@@ -93,6 +93,7 @@ export function verifySealedRelease(sealedDir) {
   if (!existsSync(manifestPath)) throw new Error(`sealed manifest missing: ${manifestPath}`);
   const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
   if (manifest.schema !== 1) throw new Error(`unsupported sealed manifest schema: ${manifest.schema}`);
+  if (manifest.kind != null && typeof manifest.kind !== "string") throw new Error("sealed manifest kind must be a string when present");
   if (!manifest.checkpoints?.includes("sealed")) throw new Error("release is not sealed");
   for (const item of manifest.files ?? []) {
     const file = path.join(sealedDir, item.name);

package/right-suite-contract.test.mjs

@@ -464,7 +464,7 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.57",
+    "@rightkit/release": "0.2.59",
     "@rightkit/qa": "0.2.0",
   });
   assert.deepEqual(versions.legacyNpm, {

package/rightkit-versions.json

@@ -1,67 +1,67 @@
-{
-  "schema": 2,
-  "packageManager": "pnpm@11.18.0",
-  "npm": {
-    "@rightkit/git": "0.2.0",
-    "@rightkit/legal": "0.2.0",
-    "@rightkit/license": "0.1.5",
-    "@rightkit/logs": "0.1.3",
-    "@rightkit/platform-ui": "0.1.0",
-    "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.47",
-    "@rightkit/tauri": "0.1.0",
-    "@rightkit/updates": "0.2.3"
-  },
-  "stagedNpm": {
-    "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/legal": "0.3.0",
-    "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.57",
-    "@rightkit/qa": "0.2.0"
-  },
-  "legacyNpm": {
-    "@rightkit/legal-ui": [
-      "0.1.0"
-    ],
-    "@rightkit/release": [
-      "0.2.22",
-      "0.2.29",
-      "0.2.30",
-      "0.2.31",
-      "0.2.41",
-      "0.2.42",
-      "0.2.43",
-      "0.2.44",
-      "0.2.45",
-      "0.2.46",
-      "0.2.49",
-      "0.2.50",
-      "0.2.51",
-      "0.2.53",
-      "0.2.54",
-      "0.2.55",
-      "0.2.56"
-    ],
-    "@rightkit/qa": [
-      "0.1.0"
-    ]
-  },
-  "cargo": {
-    "rightkit-license": "0.1.2",
-    "rightkit-logs": "0.1.0",
-    "rightkit-process": "0.1.0",
-    "rightkit-tauri": "0.1.0"
-  },
-  "stagedCargo": {
-    "rightkit-license": "0.1.3",
-    "rightkit-tauri": "0.1.1"
-  },
-  "swift": {
-    "rightkit-swift": {
-      "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.1.0"
-    }
-  }
-}
+{
+  "schema": 2,
+  "packageManager": "pnpm@11.18.0",
+  "npm": {
+    "@rightkit/git": "0.2.0",
+    "@rightkit/legal": "0.2.0",
+    "@rightkit/license": "0.1.5",
+    "@rightkit/logs": "0.1.3",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.47",
+    "@rightkit/tauri": "0.1.0",
+    "@rightkit/updates": "0.2.3"
+  },
+  "stagedNpm": {
+    "@rightkit/ax": "0.2.0",
+    "@rightkit/git": "0.2.0",
+    "@rightkit/legal": "0.3.0",
+    "@rightkit/legal-ui": "0.1.1",
+    "@rightkit/license": "0.1.6",
+    "@rightkit/release": "0.2.59",
+    "@rightkit/qa": "0.2.0"
+  },
+  "legacyNpm": {
+    "@rightkit/legal-ui": [
+      "0.1.0"
+    ],
+    "@rightkit/release": [
+      "0.2.22",
+      "0.2.29",
+      "0.2.30",
+      "0.2.31",
+      "0.2.41",
+      "0.2.42",
+      "0.2.43",
+      "0.2.44",
+      "0.2.45",
+      "0.2.46",
+      "0.2.49",
+      "0.2.50",
+      "0.2.51",
+      "0.2.53",
+      "0.2.54",
+      "0.2.55",
+      "0.2.56"
+    ],
+    "@rightkit/qa": [
+      "0.1.0"
+    ]
+  },
+  "cargo": {
+    "rightkit-license": "0.1.2",
+    "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
+    "rightkit-tauri": "0.1.0"
+  },
+  "stagedCargo": {
+    "rightkit-license": "0.1.3",
+    "rightkit-tauri": "0.1.1"
+  },
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.0"
+    }
+  }
+}

package/standalone-clone-evidence.json

@@ -1,32 +0,0 @@
-{
-  "schemaVersion": 1,
-  "generatedAt": "2026-08-10T04:42:36.444Z",
-  "workRoot": "C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR",
-  "apps": [
-    {
-      "key": "viewright",
-      "remote": "https://github.com/bogusyogi/viewright.git",
-      "appDir": ".",
-      "revision": "21a4171fa8add2d8114bc5f07498b60d7e8eafe5",
-      "packageManager": "pnpm@11.18.0",
-      "clone": {
-        "command": "git clone --depth 1 --single-branch https://github.com/bogusyogi/viewright.git C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright",
-        "status": 0,
-        "stdout": "",
-        "stderr": "Cloning into 'C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright'...\nUpdating files:  91% (1902/2080)\rUpdating files:  92% (1914/2080)\rUpdating files:  93% (1935/2080)\rUpdating files:  94% (1956/2080)\rUpdating files:  95% (1976/2080)\rUpdating files:  96% (1997/2080)\rUpdating files:  97% (2018/2080)\rUpdating files:  98% (2039/2080)\rUpdating files:  99% (2060/2080)\rUpdating files: 100% (2080/2080)\rUpdating files: 100% (2080/2080), done."
-      },
-      "install": {
-        "command": "C:\\nvm4w\\nodejs\\node.exe C:\\nvm4w\\nodejs\\node_modules\\pnpm\\bin\\pnpm.mjs install --frozen-lockfile",
-        "status": 0,
-        "stdout": "✓ Lockfile passes supply-chain policies (verified 8h ago)\nLockfile is up to date, resolution step is skipped\nProgress: resolved 1, reused 0, downloaded 0, added 0\nPackages: +619\n++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\nProgress: resolved 619, reused 0, downloaded 0, added 0\nProgress: resolved 619, reused 60, downloaded 0, added 0\nPackages are hard linked from the content-addressable store to the virtual store.\n  Content-addressable store is at: C:\\Users\\adrds\\AppData\\Local\\pnpm\\store\\v11\n  Virtual store is at:             node_modules/.pnpm\nProgress: resolved 619, reused 573, downloaded 7, added 7\nProgress: resolved 619, reused 574, downloaded 9, added 10\nProgress: resolved 619, reused 574, downloaded 22, added 11\nProgress: resolved 619, reused 574, downloaded 23, added 11\nProgress: resolved 619, reused 574, downloaded 26, added 14\nProgress: resolved 619, reused 574, downloaded 30, added 24\nProgress: resolved 619, reused 574, downloaded 31, added 57\nProgress: resolved 619, reused 574, downloaded 34, added 128\nProgress: resolved 619, reused 574, downloaded 38, added 135\nProgress: resolved 619, reused 574, downloaded 38, added 136\nProgress: resolved 619, reused 574, downloaded 39, added 141\nProgress: resolved 619, reused 574, downloaded 39, added 148\nProgress: resolved 619, reused 574, downloaded 39, added 182\nProgress: resolved 619, reused 574, downloaded 40, added 201\nProgress: resolved 619, reused 574, downloaded 41, added 218\nProgress: resolved 619, reused 574, downloaded 41, added 242\nProgress: resolved 619, reused 574, downloaded 42, added 312\nProgress: resolved 619, reused 574, downloaded 42, added 371\nProgress: resolved 619, reused 574, downloaded 42, added 430\nProgress: resolved 619, reused 574, downloaded 42, added 486\nProgress: resolved 619, reused 574, downloaded 43, added 543\nProgress: resolved 619, reused 574, downloaded 43, added 578\nProgress: resolved 619, reused 574, downloaded 44, added 596\nProgress: resolved 619, reused 574, downloaded 44, added 611\nProgress: resolved 619, reused 574, downloaded 44, added 612\nProgress: resolved 619, reused 574, downloaded 44, added 613\nProgress: resolved 619, reused 574, downloaded 44, added 615\nProgress: resolved 619, reused 574, downloaded 44, added 616\nProgress: resolved 619, reused 574, downloaded 44, added 617\nProgress: resolved 619, reused 574, downloaded 44, added 618\nProgress: resolved 619, reused 574, downloaded 45, added 618\nProgress: resolved 619, reused 574, downloaded 45, added 619\nProgress: resolved 619, reused 574, downloaded 45, added 619, done\n\ndependencies:\n+ @codemirror/autocomplete 6.20.3\n+ @codemirror/commands 6.10.4\n+ @codemirror/lang-html 6.4.11\n+ @codemirror/lang-javascript 6.2.5\n+ @codemirror/lang-markdown 6.5.0\n+ @codemirror/language 6.12.4\n+ @codemirror/lint 6.9.7\n+ @codemirror/search 6.7.1\n+ @codemirror/state 6.7.1\n+ @codemirror/view 6.43.6\n+ @eigenpal/docx-editor-agents @eigenpal/docx-editor-agents@file:vendor/docx-editor/packages/agents(react@19.2.7)\n+ @eigenpal/docx-editor-core @eigenpal/docx-editor-core@file:vendor/docx-editor/packages/core(prosemirror-commands@1.7.1)(prosemirror-dropcursor@1.8.2)(prosemirror-history@1.5.0)(prosemirror-keymap@1.2.3)(prosemirror-model@1.25.10)(prosemirror-state@1.4.4)(prosemirror-tables@1.8.5)(prosemirror-transform@1.12.0)(prosemirror-view@1.42.0)\n+ @eigenpal/docx-editor-i18n @eigenpal/docx-editor-i18n@file:vendor/docx-editor/packages/i18n\n+ @eigenpal/docx-editor-react @eigenpal/docx-editor-react@file:vendor/docx-editor/packages/react(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(prosemirror-commands@1.7.1)(prosemirror-dropcursor@1.8.2)(prosemirror-history@1.5.0)(prosemirror-keymap@1.2.3)(prosemirror-model@1.25.10)(prosemirror-state@1.4.4)(prosemirror-tables@1.8.5)(prosemirror-transform@1.12.0)(prosemirror-view@1.42.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)\n+ @lezer/highlight 1.2.3\n+ @mdx-js/mdx 3.1.1\n+ @phosphor-icons/react 2.1.10\n+ @radix-ui/react-select 2.3.2\n+ @rightkit/legal-ui 0.1.0\n+ @rightkit/license 0.1.6\n+ @rightkit/logs 0.1.3\n+ @rightkit/tauri 0.1.0\n+ @rightkit/updates 0.2.3\n+ @tauri-apps/api 2.11.1\n+ @tauri-apps/plugin-http 2.5.9\n+ @tauri-apps/plugin-process 2.3.1\n+ @tauri-apps/plugin-updater 2.10.1\n+ clsx 2.1.1\n+ docxtemplater 3.69.0\n+ dompurify 3.4.13\n+ fabric 7.4.0\n+ github-slugger 2.0.0\n+ jszip 3.10.1\n+ katex 0.17.0\n+ mermaid 11.16.1\n+ pdfjs-dist 6.2.108\n+ pizzip 3.2.0\n+ prosemirror-commands 1.7.1\n+ prosemirror-dropcursor 1.8.2\n+ prosemirror-history 1.5.0\n+ prosemirror-keymap 1.2.3\n+ prosemirror-model 1.25.10\n+ prosemirror-state 1.4.4\n+ prosemirror-tables 1.8.5\n+ prosemirror-transform 1.12.0\n+ prosemirror-view 1.42.0\n+ react 19.2.7\n+ react-dom 19.2.7\n+ react-image-crop 11.1.2\n+ rehype-stringify 10.0.1\n+ remark-frontmatter 5.0.0\n+ remark-gfm 4.0.1\n+ remark-math 6.0.0\n+ remark-parse 11.0.0\n+ remark-rehype 11.1.2\n+ remark-smartypants 3.0.2\n+ shiki 4.3.1\n+ sonner 2.0.7\n+ sucrase 3.35.1\n+ unified 11.0.5\n+ xml-js 1.6.11\n+ yaml 2.9.0\n\ndevDependencies:\n+ @biomejs/biome 2.5.3\n+ @rightkit/legal 0.3.0\n+ @rightkit/release 0.2.50\n+ @tailwindcss/vite 4.3.2\n+ @tauri-apps/cli 2.11.4\n+ @testing-library/dom 10.4.1\n+ @testing-library/jest-dom 6.9.1\n+ @testing-library/react 16.3.2\n+ @types/mdast 4.0.4\n+ @types/react 19.2.17\n+ @types/react-dom 19.2.3\n+ @types/ws 8.18.1\n+ @vitejs/plugin-react 6.0.3\n+ happy-dom 20.10.6\n+ jscpd 5.0.12\n+ jsdom 29.1.1\n+ knip 6.25.0\n+ tailwindcss 4.3.2\n+ typescript 6.0.3\n+ vite 8.1.4\n+ vitest 4.1.10\n+ ws 8.21.0\n\nDone in 40.8s using pnpm v11.18.0",
-        "stderr": ""
-      },
-      "doctor": {
-        "command": "C:\\nvm4w\\nodejs\\node.exe C:\\nvm4w\\nodejs\\node_modules\\pnpm\\bin\\pnpm.mjs release:doctor",
-        "status": 0,
-        "stdout": "right-release 0.2.50\nconfig: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\right-release.config.mjs\napp: viewright\nplatform: win\ntier: <required for release/publish>\npackageManager: pnpm\nworkdir: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\nhardeningscan: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\node_modules\\.pnpm\\@rightkit+release@0.2.50\\node_modules\\@rightkit\\release\\hardeningscan.mjs\nlegal: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\legal\\legal-manifest.json\nlegalAcceptance: viewright-2026-07-17-v3\nlegalManifestSha256: 035ea7cbd040ef001dbdc1385f114c8bb126178fea9a9f705016a726f96a7830\nsign: src-tauri/target/release/bundle/nsis/ViewRight_0.1.60_x64-setup.exe\npreflight:\n  [ok  ] target-bridge: src-tauri/target is ready for the shared cache bridge\n  [ok  ] version: 0.1.60 is free to build\n  [ok  ] windows-sdk: makeappx.exe from SDK 10.0.26100.0\n  [ok  ] signtool: signtool.exe from SDK 10.0.26100.0\n  [ok  ] sccache: sccache 0.17.0\n  [ok  ] disk: 628.7GB free",
-        "stderr": "$ right-release doctor"
-      }
-    }
-  ]
-}