@rightkit/release 0.3.0 → 0.4.0

package/build-release.mjs

@@ -5,7 +5,6 @@ import {
   closeSync,
   copyFileSync,
   existsSync,
-  mkdtempSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -18,8 +17,8 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { tmpdir } from "node:os";
 import path from "node:path";
+import { iosOwnershipScope } from "./ownership-scope.mjs";
 import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
@@ -37,6 +36,7 @@ import { ensureLegacyTargetLink, resolveReleaseCacheMode } from "./release-cache
 import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { collectSwiftToolVersions, planSwiftBuild } from "./swift-build-context.mjs";
+import { planIosNativeBuild, resolveIosBuildContext } from "./ios-build-context.mjs";
 import { packageCommandOptional, requiredBuildExecutables, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
@@ -46,6 +46,15 @@ import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimi
 import { beginArtifactLease, completeArtifactLease, materializeArtifacts, retainArtifacts, resolveArtifactDir, resolveManagedRoot } from "./artifact-storage.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { ANDROID_RECEIPT_NAME, androidSealEntry, validateAndroidTarget, verifyAndroidReceipt } from "./android-release.mjs";
+import { IOS_RECEIPT_NAME, iosSealEntry, verifyIosReceipt } from "./ios-package-recipe.mjs";
+import { expandIosPackageTarget } from "./package-recipe-targets.mjs";
+import { assertUpdaterSignature } from "./github-updater-release.mjs";
+
+// The iOS lane's own packaging code, kept out of the win/mac fingerprint for the same reason as the Android one.
+const IOS_PIPELINE_FINGERPRINT = createHash("sha256")
+  .update(["ios-package-recipe.mjs", "ios-host.mjs"].map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
+  .digest("hex")
+  .slice(0, 16);
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
@@ -66,15 +75,18 @@ const ANDROID_PIPELINE_FINGERPRINT = createHash("sha256")
   .slice(0, 16);
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
-function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target }) {
+function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target, pinnedCargoLocks = [] }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
   } catch {
     version = undefined;
   }
+  // An iOS target is built from its Xcode project and local packages only; the ownership scan covers just those roots.
+  const ownershipScope = platform === "ios" ? iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly: config?.nativeAssembly }) : null;
   return collectPreflight({
     platform,
+    ownershipScope,
     appRoot,
     repoRoot,
     app: config.app,
@@ -83,8 +95,11 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     // collision is already enforced downstream, and duplicating it here would
     // reject a legitimate resume of an in-flight build.
     version: undefined,
-    cargoLockPaths: nativeLayout?.lockCandidates ?? [],
+    cargoLockPaths: [...(nativeLayout?.lockCandidates ?? []), ...pinnedCargoLocks],
     projectType: resolveProjectType({ appRoot, config, target }),
+    // A native iOS app has no broker target or bridge; it still gets the Rust budget and lock checks when it pins a Cargo.lock.
+    rust: Boolean(nativeLayout) || pinnedCargoLocks.length > 0,
+    bridge: Boolean(nativeLayout),
     msix: targetUsesMsix(target),
   });
 }
@@ -109,7 +124,7 @@ for (let i = 0; i < args.length; i += 1) {
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
 }
-if (platform !== "win" && platform !== "mac" && platform !== "android") fail("--platform must be win, mac or android");
+if (platform !== "win" && platform !== "mac" && platform !== "android" && platform !== "ios") fail("--platform must be win, mac, android or ios");
 if (resumeFrom && !["prepackage", "sign", "package", "post-sign", "harden"].includes(resumeFrom)) fail("--resume-from must be prepackage, sign, package, post-sign, or harden");
 
 const configPath = path.resolve(configName);
@@ -141,8 +156,8 @@ if (dryRun) {
   const config = (await import(`${pathToFileURL(configPath).href}?dry-run=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   const target = config.targets?.[platform];
-  // Android builds with target.gradle (validated by release.mjs), not a package command.
-  if (platform !== "android" && !target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
+  // Android builds with target.gradle (validated by release.mjs), not a package command; iOS with targets.ios.iosPackage.
+  if (platform !== "android" && platform !== "ios" && !target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
   console.log(`right-release build dry-run: ${config.app} ${config.version} ${platform}`);
   console.log(`config: ${configPath}`);
   console.log(`commit: ${commit}`);
@@ -166,7 +181,7 @@ try {
   // turn an already-built, signed installer into a needless full rebuild.
   if (!resumeFrom) {
     assertCleanSource({
-      status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]),
+      status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], { trim: false }), // untrimmed: a leading space is the first record's X column (#782)
       commandId: "right-release build",
     });
   }
@@ -181,24 +196,41 @@ try {
     fail("app and version must be safe release-id components");
   }
   const target = config.targets?.[platform];
-  if (platform !== "android" && !target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
+  if (platform !== "android" && platform !== "ios" && !target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
+  // iOS: the same strict validation release.mjs applies; yields the IPA path and the team and bundle id the seal pins.
+  let iosSpec = null;
+  if (platform === "ios") {
+    try { iosSpec = expandIosPackageTarget(target, { appRoot }).recipe?.spec ?? null; } catch (error) { fail(`${config.app} ios ${error.message}`); }
+    if (!iosSpec) fail(`${config.app} ios must declare targets.ios.iosPackage`);
+  }
   // Same validation release.mjs applies; yields the normalised upload-certificate pin and the AAB path.
   let androidTarget = null;
   if (platform === "android") {
     try { androidTarget = validateAndroidTarget(target, { root: appRoot }); } catch (error) { fail(`${config.app} android ${error.message}`); }
   }
   const isSwiftBuild = resolveProjectType({ appRoot, config, target }) === "swiftpm";
-  const nativeLayout = resolveNativeCargoLayout({ appRoot, config });
+  // A native iOS app (xcodegen project; no Rust library unless nativeAssembly.cargoManifest declares one) has no src-tauri and no
+  // declared nativeAssembly manifest: it owns no Cargo layout (null), and every Cargo-derived value below is skipped for it.
+  // The Xcode tools are asserted present, then probed, inside resolveIosBuildContext (a missing tool fails with the normal message).
+  const iosContext = iosSpec !== null
+    ? resolveIosBuildContext({ appRoot, config, target, iosSpec, exec: (cmd, runArgs) => commandOutputAt(cmd, runArgs, appRoot), assertExecutables })
+    : null;
+  const nativeIos = iosContext?.nativeIos ?? false;
+  const nativeLayout = iosContext ? iosContext.nativeLayout : resolveNativeCargoLayout({ appRoot, config });
   if (platform === "win" && target.signingContract === "windows-raw-exe-authenticode-before-nsis-v1") {
     assertNsisInPlaceUpgradeContract(appRoot, target.nsisUpgradeContract);
   }
-  const { requiredInputs, buildInputs } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
+  const { requiredInputs, buildInputs, cargoLockPaths: pinnedCargoLocks } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
   const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
-  const toolVersions = isSwiftBuild ? collectSwiftToolVersions({ packageManager: config.packageManager, exec: commandOutput }) : collectToolVersions(config.packageManager ?? "pnpm");
+  const hasPackageJson = existsSync(path.join(appRoot, "package.json"));
+  // iOS records the Xcode toolchain (and xcodegen when a project.yml is named) beside the Node and Rust tools.
+  const toolVersions = isSwiftBuild ? collectSwiftToolVersions({ packageManager: config.packageManager, exec: commandOutput })
+    : iosContext ? iosContext.toolVersions
+    : collectToolVersions(config.packageManager ?? "pnpm", appRoot);
   const inputHashes = hashInputs(requiredInputs);
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
-  const platformDir = platform === "win" ? "windows" : platform === "android" ? "android" : "mac";
+  const platformDir = platform === "win" ? "windows" : platform === "android" ? "android" : platform === "ios" ? "ios" : "mac";
   const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
   const signingIdentity = platform === "win" ? {
     contract: target.signingContract ?? "<missing>",
@@ -230,17 +262,27 @@ try {
     uploadCertSha256: androidTarget.signing.expectedCertSha256,
     // release.mjs writes the AAB receipt into RIGHT_RELEASE_STATE_ROOT (= stateRoot) as android-aab.json.
     receiptInputs: [path.resolve(stateRoot, ANDROID_RECEIPT_NAME)],
+  } : platform === "ios" ? {
+    contract: "ios-xcodebuild-archive-automatic-v1",
+    pipeline: IOS_PIPELINE_FINGERPRINT,
+    configSha256: hashFile(configPath),
+    // The team and bundle id the IPA receipt must carry; the upload re-checks both from the sealed manifest.
+    teamId: iosSpec.teamId,
+    bundleId: iosSpec.bundleId,
+    // release.mjs writes the IPA receipt into RIGHT_RELEASE_STATE_ROOT (= stateRoot) as ios-archive.json.
+    receiptInputs: [path.resolve(stateRoot, IOS_RECEIPT_NAME)],
   } : null;
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
-  const cargoLock = nativeLayout.lockPath;
-  const cargoToml = nativeLayout.manifestPath;
+  const cargoLock = nativeLayout?.lockPath;
+  const cargoToml = nativeLayout?.manifestPath;
   // A broker-managed host is not identified by RIGHTKIT_BUILD_BROKER_SOCKET alone:
   // that variable is exported by login shells only, while the managed cargo shim is
   // on PATH for every shell. Detecting on the variable alone made agent (non-login)
   // shells take the Cache V2 branch, bridge resolved native target into release cache,
   // and then lose CARGO_TARGET_DIR to the broker's unconditional override — so the
   // app bundle landed in the broker workspace and packaging failed on an empty cache.
-  const swiftPlan = isSwiftBuild ? planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions }) : null;
+  // swiftPlan is the "no Rust host" plan for SwiftPM and for a Cargo-less native iOS app alike: same shape, same skips.
+  const swiftPlan = isSwiftBuild ? planSwiftBuild({ appRoot, vaultRoot, platform, target, toolVersions }) : nativeIos ? planIosNativeBuild({ appRoot, vaultRoot, platform, toolVersions }) : null;
   // SwiftPM targets have no Cargo manifest: no broker cargo target, no Rust cache identity.
   const managedCargoTarget = swiftPlan ? swiftPlan.managedCargoTarget : brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
   const cacheIdentity = swiftPlan ? swiftPlan.identity : resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
@@ -267,7 +309,7 @@ try {
   // Preflight BEFORE any compile. These preconditions used to be discovered one
   // per build cycle, minutes deep, with errors that named a symptom instead of a
   // cause. Blocking problems stop here, in seconds, naming the fix.
-  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target });
+  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target, pinnedCargoLocks });
   const preflightBlockers = preflightFailures(preflight);
   if (preflightBlockers.length > 0) {
     fail(`preflight found ${preflightBlockers.length} blocking problem(s):\n${formatPreflight(preflightBlockers)}`);
@@ -323,6 +365,7 @@ try {
   env.RIGHT_RELEASE_ARTIFACT_DIR = managedArtifactDir;
   const buildRoot = managedCargoTarget ? null : path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
   env.RIGHT_RELEASE_STATE_ROOT = stateRoot;
+  env.RIGHT_RELEASE_VAULT_STATE_ROOT = path.join(vaultRoot, "state");
   const lockPayload = {
     schema: 1,
     releaseId,
@@ -336,7 +379,7 @@ try {
     tools: toolVersions,
     createdAt: new Date().toISOString(),
   };
-  const targetLink = nativeLayout.targetLink;
+  const targetLink = nativeLayout?.targetLink;
   // ownedRoot is the per-app cache parent holding every fingerprint dir, so a
   // link left by an earlier fingerprint is recognised as ours and repointed
   // instead of hard-stopping the build.
@@ -367,7 +410,7 @@ try {
           const volumes = inspectWriteVolumes({ repoRoot, vaultRoot, cacheRoot: sharedCacheRoot });
           assertWriteVolumeFloors({ volumes, policy, configuredRepoMinimumBytes: Math.max(Number(target.preflight?.minFreeGb ?? 25), 25) * 1024 ** 3 });
         } else assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
-        assertExecutables([...requiredBuildExecutables({ projectType: resolveProjectType({ appRoot, config, target }), packageManager: config.packageManager ?? "pnpm", usesPackageManager: Boolean(config.packageManager) || existsSync(path.join(appRoot, "package.json")) }), ...(target.preflight?.executables ?? [])]);
+        assertExecutables([...requiredBuildExecutables({ projectType: resolveProjectType({ appRoot, config, target }), packageManager: config.packageManager ?? "pnpm", usesPackageManager: nativeIos ? hasPackageJson : Boolean(config.packageManager) || hasPackageJson, usesCargo: !nativeIos }), ...(iosContext?.prepareExecutables ?? []), ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
         for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
         if (buildRoot) mkdirSync(buildRoot, { recursive: true });
@@ -394,7 +437,8 @@ try {
           if (linked.action === "refused") fail(linked.reason);
           if (linked.action === "moved-aside") console.error(`[right-release] hosted CI: moved existing ${targetLink} aside to ${linked.aside}`);
         }
-        if (resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
+        // A Cargo-less native iOS app installs Node dependencies only when it has a package.json.
+        if (nativeIos ? hasPackageJson : resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },
       build: async () => {
         throwIfInterrupted();
@@ -409,7 +453,10 @@ try {
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
-        checkpoint(stateRoot, "hardened");
+        // Truthful checkpoint: the worker (release.mjs) runs the hardening scan only when it has scan
+        // targets and fails the whole build when the scan fails, so reaching here with targets means
+        // the scan passed. With no targets the worker ran no scan — never claim "hardened".
+        if (hardeningScanTargets(target).length > 0) checkpoint(stateRoot, "hardened");
       },
       // Product-specific checks that must run after the signed/hardened bytes
       // exist but before they become immutable. This is intentionally a small
@@ -427,7 +474,7 @@ try {
         });
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, managedCargoTarget, androidTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -449,7 +496,14 @@ try {
 }
 
 function hashInputs(files) {
-  return Object.fromEntries(files.map((file) => [path.relative(path.dirname(path.dirname(file)), file), hashFile(file)]));
+  const hashes = {};
+  for (const file of files) {
+    const key = path.relative(path.dirname(path.dirname(file)), file);
+    // Two inputs (an app file and a shared crate's file, say) must never share a key: one would silently replace the other.
+    if (Object.hasOwn(hashes, key)) fail(`release inputs share the hash key ${key}; rename one so every input is sealed`);
+    hashes[key] = hashFile(file);
+  }
+  return hashes;
 }
 
 function hashFile(file) {
@@ -467,7 +521,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot }) {
+function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot }) {
   // Every app's right-release.config.mjs names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
@@ -476,6 +530,7 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
   // own target root instead, or every managed build fails at seal after a
   // full compile, sign, and notarize.
   const targetPrefix = "src-tauri/target/";
+  // A Cargo-less iOS app has no native layout and no managed cargo target: only the default prefix is ever compared.
   const effectiveTargetPrefix = nativeLayout?.targetPrefix ?? targetPrefix;
   const resolveArtifactPath = (file) => {
     const normalized = file.replaceAll(path.win32.sep, "/");
@@ -507,14 +562,28 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
   // updater block: `target.artifacts` entries (paths or { file }) seal with the
   // "portable" role. On android the declared AAB seals with the "aab" role instead.
   const aabSource = platform === "android" ? resolveArtifactPath(androidTarget.aab.file) : null;
+  const ipaSource = platform === "ios" ? resolveArtifactPath(iosSpec.ipa) : null;
   for (const artifact of target.artifacts ?? []) {
     const file = typeof artifact === "string" ? artifact : artifact?.file;
     if (typeof file !== "string" || !file) fail("target.artifacts entries must be paths or { file }");
     const source = resolveArtifactPath(file);
-    addSource(source, source === aabSource ? "aab" : "portable");
+    addSource(source, source === aabSource ? "aab" : source === ipaSource ? "ipa" : "portable");
   }
   if (sources.size === 0) fail(`nothing to seal: declare installer.artifacts, updater.artifacts or artifacts for the ${platform} target`);
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
+  // Every minisign updater requires an explicit trust root & full-byte signature
+  // verification before any seal directory or artifact copy is created.
+  const updaterPublicKey = config.distribution?.updaterPublicKey ?? config.distribution?.updaterPubkey ?? target?.updater?.pubkey ?? target?.updater?.publicKey;
+  if ((target.updater?.artifacts?.length ?? 0) > 0 && target.updater?.kind !== "appinstaller") {
+    if (typeof updaterPublicKey !== "string" || !updaterPublicKey.trim()) fail("updater public key is required to verify updater artifacts before sealing");
+    for (const artifact of target.updater?.artifacts ?? []) {
+      const source = resolveArtifactPath(artifact.file);
+      const signature = readFileSync(resolveArtifactPath(artifact.signature), "utf8").trim();
+      if (!signature) fail(`updater signature is empty, refusing to seal: ${artifact.signature}`);
+      try { assertUpdaterSignature(readFileSync(source), signature, updaterPublicKey, `signature of ${path.basename(artifact.file)}`); }
+      catch (error) { fail(`updater signature rejected at seal: ${error.message}`); }
+    }
+  }
   // Android: the build receipt must describe exactly the AAB being sealed (bytes re-hashed) and its signer must be the pinned
   // upload certificate. Checked before anything is copied, so a mismatch leaves no partial seal.
   let androidReceipt = null;
@@ -525,6 +594,16 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
     try { androidReceipt = verifyAndroidReceipt(receiptPath, aabSource); } catch (error) { fail(`android AAB receipt rejected: ${error.message}`); }
     if (androidReceipt.signer?.certSha256 !== signingIdentity.uploadCertSha256) fail("android AAB receipt signer certificate is not the pinned upload certificate");
   }
+  // iOS: the receipt must describe exactly the IPA being sealed (bytes re-hashed), for the pinned team and bundle id.
+  let iosReceipt = null;
+  if (platform === "ios") {
+    if (!sources.has(ipaSource)) fail("ios seal requires targets.ios.artifacts to list iosPackage.ipa");
+    const [receiptPath] = signingIdentity.receiptInputs;
+    if (!existsSync(receiptPath)) fail(`no signing receipts found to seal; expected at least ${receiptPath}`);
+    try { iosReceipt = verifyIosReceipt(receiptPath, ipaSource); } catch (error) { fail(`ios IPA receipt rejected: ${error.message}`); }
+    if (iosReceipt.teamId !== signingIdentity.teamId || iosReceipt.bundleId !== signingIdentity.bundleId) fail("ios IPA receipt team or bundle id is not the one pinned by the release config");
+    if (iosReceipt.sourceCommit !== commit) fail(`ios IPA receipt was built from ${String(iosReceipt.sourceCommit)}, not the release commit ${commit}`);
+  }
   // rightkit-ffmpeg decode sidecar: release.mjs signed the binaries with the app and wrote media-sidecar.json. The seal
   // refuses a release without it, re-checks its shape against the configuration, and (Windows) that every sidecar's
   // signed digest is one the sealed raw-EXE signing receipt recorded. The hashes then live in the sealed manifest.
@@ -557,6 +636,8 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
     copyFileSync(source, path.join(temp, name));
     files.push(androidReceipt && source === aabSource && name === androidReceipt.file.name
       ? androidSealEntry(androidReceipt)
+      : iosReceipt && source === ipaSource && name === iosReceipt.file.name
+      ? iosSealEntry(iosReceipt)
       : { role: [...roles].sort().join("+"), name, sha256: hashFile(source), sizeBytes: statSync(source).size });
     artifactInputs.push({ source, name });
   }
@@ -575,7 +656,12 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
     routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "public", key: patchKey, platform: artifact.platform });
     routes.update.push({ role: "updater", name: sourceNames.get(source), signature: signatureSource ? sourceNames.get(signatureSource) : undefined, bucket: "private", key: routeKey, platform: artifact.platform });
   }
-  writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
+  // Derived from the worker's actual scan, never asserted unconditionally: release.mjs scans exactly
+  // `target.hardening ?? target.artifacts` and fails the build on scan failure, so a completed build with
+  // targets passed; with no targets no scan ran and the status is "skipped", not passed.
+  const hardeningTargets = hardeningScanTargets(target);
+  const hardeningScanned = hardeningTargets.length > 0;
+  writeJson(path.join(temp, "hardening.json"), { schema: 1, status: hardeningScanned ? "passed" : "skipped", passed: hardeningScanned, checkedAt: new Date().toISOString(), targets: hardeningTargets.length, files: hardeningScanned ? files.map((file) => file.sha256) : [] });
   const manifest = {
     schema: 1,
     releaseId,
@@ -606,7 +692,7 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
     routes,
     inputs: inputHashes,
     tools: toolVersions,
-    checkpoints: ["preflight_complete", "build_complete", "signed", "hardened", "sealed"],
+    checkpoints: ["preflight_complete", "build_complete", "signed", ...(hardeningScanned ? ["hardened"] : []), "sealed"],
     sealedAt: new Date().toISOString(),
   };
   writeJson(path.join(temp, "release-manifest.json"), manifest);
@@ -627,21 +713,26 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, nativeLayo
   else if (retention.removed.length) console.log(`[right-release] artifact retention removed ${retention.removed.join(", ")}`);
 }
 
-function collectToolVersions(packageManager) {
-  const probeDir = mkdtempSync(path.join(tmpdir(), "right-release-tool-probe-"));
-  try {
-    const rustcVerbose = commandOutputAt("rustc", ["-vV"], probeDir);
-    return {
-      node: process.version,
-      packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
-      cargo: commandOutputAt("cargo", ["--version"], probeDir),
-      rustc: rustcVerbose,
-      rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
-      sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
-    };
-  } finally {
-    rmSync(probeDir, { recursive: true, force: true });
-  }
+/** The exact scan-target expression the worker uses (release.mjs: `target.hardening ?? target.artifacts ?? []`).
+ * Recipe expansion in the worker preserves both fields (`...rest`), so the raw config target gives the same list. */
+function hardeningScanTargets(target) {
+  return target?.hardening ?? target?.artifacts ?? [];
+}
+
+// Probes run with cwd = the app root (bogusyogi/rightkit#783): on an agent host `cargo` is the
+// RustRight shim, which refuses any cwd outside a primary checkout, so a $TMPDIR probe dir failed
+// with RK_NOT_PRIMARY_CHECKOUT before the first build step. The app root also makes rustc report
+// the toolchain the app's rust-toolchain.toml selects, which is the one the build uses.
+function collectToolVersions(packageManager, probeDir = process.cwd()) {
+  const rustcVerbose = commandOutputAt("rustc", ["-vV"], probeDir);
+  return {
+    node: process.version,
+    packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
+    cargo: commandOutputAt("cargo", ["--version"], probeDir),
+    rustc: rustcVerbose,
+    rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
+    sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
+  };
 }
 
 async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null, { livenessOwnerTimeoutMs = null } = {}) {
@@ -801,14 +892,14 @@ function commandOutput(cmd, runArgs) {
   }
 }
 
-function git(cwd, runArgs) {
-  return commandOutputAt("git", runArgs, cwd);
+function git(cwd, runArgs, { trim = true } = {}) {
+  return commandOutputAt("git", runArgs, cwd, { trim });
 }
 
-function commandOutputAt(cmd, runArgs, cwd) {
+function commandOutputAt(cmd, runArgs, cwd, { trim = true } = {}) {
   const result = spawnSync(cmd, runArgs, { cwd, encoding: "utf8", windowsHide: true });
   if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
-  return result.stdout.trim();
+  return trim ? result.stdout.trim() : result.stdout;
 }
 
 function runChecked(cmd, runArgs, cwd, env = process.env) {
@@ -843,7 +934,7 @@ function writeJson(file, value) {
 }
 
 function usage(code) {
-  console.log("usage: right-release build --platform win|mac|android [--config right-release.config.mjs] [--dry-run]");
+  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.mjs] [--dry-run]");
   process.exit(code);
 }
 

package/cli/right-release.mjs

@@ -46,6 +46,7 @@ const commands = new Map([
   ["dist-scan", "dist-scan.mjs"],
   ["identity-scan", "packaged-app-identity.mjs"],
   ["apple-profile-create", "apple-profile-create.mjs"],
+  ["ios-credentials", "ios-credentials-command.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -236,6 +237,9 @@ Commands:
                                                       Assert codesign Identifier/Team/cdhash/lipo archs; reject ad-hoc
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
+  upload --platform ios --release <id> [--apply]       Sealed IPA to TestFlight, then the exact build into the beta groups; dry run unless --apply (macOS)
+  ios-credentials store --key-id <KEYID> --issuer <uuid> | check
+                                                      Put the App Store Connect API key (stdin), key id and issuer into the login Keychain once, or check them; never a file (macOS)
   qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa and write the sealed QA receipt (a missing receipt warns and is recorded; it never blocks)
   qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
   publish-update --release <id> --platform mac|win --tier patch|update
@@ -249,8 +253,13 @@ Commands:
                                                       (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish npm --package @rightkit/<name> --local     Mac-only local publish under the committed local-build grant
-  publish cargo --crate <name> --local               (.rightkit-local-build.json): runs the unit's CI tests, packs, writes darwin-only
-                                                      evidence, then the same publication gate and publisher; refuses without the grant
+  publish cargo --crate <name> --local               (.rightkit-local-build.json), on the Mac or Windows: runs the unit's CI tests, packs,
+                                                      writes darwin-only (Mac) or win32-only (Windows) evidence, then the same
+                                                      publication gate and publisher; refuses without the grant
+  publish cargo --crate <name> --local --qualify-only --bundle <new-dir> [--jobs <1-64>]
+                                                      Verify on source host; export crate bytes & gate evidence without uploading
+  publish cargo --crate <name> --from-evidence <gate.json>
+                                                      Reuse exact HEAD/artifact proof on upload host; recheck archive hash & registry bytes
   publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]
                                                       Check main, a clean tree, and the publication evidence, then tag RightKitSwift at its VERSION on origin
   inventory check [--json] [--warn-only] [--md <file>] [--no-cache]

package/codesign-environment.mjs

@@ -4,7 +4,7 @@ import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { detectMacSigningSession } from "./macos-signing-session.mjs";
 import { ensurePrivateDirectory, privatePath } from "./rightkit-signing-agent.mjs";
-import { resolveManagedRoot } from "./artifact-storage.mjs";
+import { canonicalManagedRoot, resolveManagedRoot } from "./artifact-storage.mjs";
 
 const quote = (text) => `'${String(text).replaceAll("'", "'\\''")}'`;
 export function codesignShimScript({ route, node = process.execPath,
@@ -35,7 +35,7 @@ fi
 exec /bin/bash "$@"\n`;
   // Immutable wrappers avoid races between GUI & SSH builds or package versions.
   const identity = createHash("sha256").update(script).update(automationScript).update(bashScript).digest("hex").slice(0, 24);
-  const bin = path.join(resolveManagedRoot({ env }), "signing", "codesign-bin", identity);
+  const bin = path.join(canonicalManagedRoot(resolveManagedRoot({ env })), "signing", "codesign-bin", identity);
   ensurePrivateDirectory(bin, { io });
   const file = path.join(bin, "codesign");
   if (io.existsSync(file)) {