@rightkit/release 0.4.0 → 0.4.1

package/publication-gate.mjs

@@ -8,7 +8,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { recordPublished, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { fileURLToPath } from "node:url";
 import { digestBytes, readVerifiedArtifact } from "./publication-artifacts.mjs";
 
@@ -93,6 +93,27 @@ export function batchReceiptProblems(batch, evidence, tree) {
   return problems;
 }
 
+/**
+ * Feature sets of this crate that a batch receipt did NOT lint (0.4.1 review A2). Batch mode lints each crate's tested
+ * feature sets in shared `-p a -p b` runs, so a receipt from before every set was linted (0.4.0: first set only)
+ * still satisfies `batchReceiptProblems`, which accepts any ONE clippy row covering the crate. Replay therefore
+ * needs one passing row per feature set: bound to the evidence commit and the batch tree, naming the crate (`-p <crate>`
+ * and `crates`), and ending `--no-deps --all-targets <features> -- -D warnings`. `featureSets` is the crate's
+ * `ci/gate.config.json` list (`[[]]` when unset). Returns the missing sets as argument arrays.
+ */
+export function batchClippyMissingFeatureSets(batch, evidence, featureSets) {
+  const rows = (Array.isArray(batch?.checks) ? batch.checks : []).filter((row) => row?.name === "clippy" && row.ok === true
+    && row.commit === evidence.commit && row.tree === batch.tree && Array.isArray(row.crates) && row.crates.includes(evidence.name) && text(row.command));
+  const sets = (Array.isArray(featureSets) && featureSets.length ? featureSets : [[]]).map((set) => (Array.isArray(set) ? set : []));
+  return sets.filter((features) => {
+    const tail = ` --no-deps --all-targets${features.length ? ` ${features.join(" ")}` : ""} -- -D warnings`;
+    return !rows.some((row) => {
+      const words = row.command.split(" ");
+      return row.command.endsWith(tail) && words.some((word, index) => word === "-p" && words[index + 1] === evidence.name);
+    });
+  });
+}
+
 /**
  * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
  * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
@@ -137,40 +158,44 @@ function invalidRunFields(run, evidence, tree) {
   return bad;
 }
 
-// Returns { ok, missing[] }. Pure apart from the injected git/readFile.
-export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+function gateResult(missing, evidence) {
+  const result = { ok: missing.length === 0, missing };
+  Object.defineProperty(result, "evidence", { value: evidence });
+  return Object.freeze(result);
+}
+
+/** Validate supplied evidence against caller-authenticated source identity, without reading Git or files.
+ * The caller owns authentication of expected.commit/tree and requiredHosts (for example, committed CI policy).
+ * Evidence cannot relax host requirements: only an explicit, nonempty subset supplied by the caller can.
+ * This proves receipt contents only; it makes no claim about working-tree cleanliness or receipt provenance. */
+export function validatePublicationEvidence({ expected = {}, evidence, artifactBytes }) {
+  const { kind, name, version, commit, tree } = expected;
   const missing = [];
-  const head = git(["rev-parse", "HEAD"], packagePath);
-  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
-  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
-  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
-  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
-  let evidence = null;
-  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
-    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  if (!["npm", "cargo", "swift"].includes(kind)) missing.push("expected kind must be npm, cargo or swift");
+  if (!text(name)) missing.push("expected name must be nonempty");
+  if (!SHA.test(String(commit ?? ""))) missing.push("expected commit is not a full 40-character SHA");
+  const defaults = requiredHosts(kind);
+  let hosts = defaults;
+  if (expected.requiredHosts !== undefined) {
+    const requested = expected.requiredHosts;
+    if (!(Array.isArray(requested) && requested.length > 0 && new Set(requested).size === requested.length
+      && Array.from(requested).every((host) => defaults.includes(host)))) {
+      missing.push(`expected requiredHosts must be a nonempty unique subset of ${defaults.join(", ")}`);
+    } else hosts = requested;
   }
-  if (evidence) {
+  if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) {
+    missing.push("gate evidence must be an object");
+  } else {
     if (evidence.schema !== GATE_SCHEMA) missing.push(`evidence schema must be ${GATE_SCHEMA}`);
     if (evidence.kind !== kind || evidence.name !== name) missing.push(`evidence is for ${evidence.kind}:${evidence.name}, expected ${kind}:${name}`);
     // A missing publishing version must refuse: a skipped comparison would qualify any evidence version.
     if (typeof version !== "string" || version.trim() === "") missing.push("publishing version is unknown (manifest has no literal version), cannot bind the receipt to it");
     else if (evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
     if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
-    else if (head && evidence.commit !== head) {
-      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
-    }
+    else if (SHA.test(String(commit ?? "")) && evidence.commit !== commit) missing.push(`evidence commit ${evidence.commit} != expected commit ${commit}`);
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
-    // A batch receipt is bound to the HEAD tree as well as the commit; read it only when a run carries one.
-    // `tree ?? null` below makes an unreadable tree fail the comparison (null never equals a 40-hex tree).
-    const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
-    if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
-    // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
-    // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
-    // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    // A crate published from the Windows host under the local-build grant records the symmetric
-    // hostPolicy "win32-only" + reason, and then the one required receipt is the Windows run.
-    const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
-    for (const host of singleHost ? [singleHost] : requiredHosts(kind)) {
+    if (runs.some((run) => run?.batch !== undefined) && !SHA.test(String(tree ?? ""))) missing.push("expected tree is not a full 40-character SHA for batch evidence");
+    for (const host of hosts) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
@@ -183,9 +208,34 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
     if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
   }
   if (artifactBytes !== undefined && evidence && digestBytes(artifactBytes) !== evidence.artifactSha256) missing.push("artifact sha256 does not match evidence artifactSha256");
-  const result = { ok: missing.length === 0, missing };
-  Object.defineProperty(result, "evidence", { value: evidence });
-  return Object.freeze(result);
+  return gateResult(missing, evidence);
+}
+
+// Acquire local source identity and cleanliness, then use the same content validator as CI.
+export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+  const missing = [];
+  const head = git(["rev-parse", "HEAD"], packagePath);
+  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
+  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
+  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
+  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
+  let evidence = null;
+  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
+    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  }
+  const runs = Array.isArray(evidence?.runs) ? evidence.runs : [];
+  const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
+  if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
+  // Local publication retains its recorded single-host grant. CI callers own their policy separately.
+  const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
+  const result = validatePublicationEvidence({ expected: { kind, name, version, commit: head, tree,
+    ...(singleHost ? { requiredHosts: [singleHost] } : {}) }, evidence, artifactBytes });
+  for (const problem of result.missing) {
+    if (problem === `evidence commit ${evidence?.commit} != expected commit ${head}`) {
+      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
+    } else missing.push(problem);
+  }
+  return gateResult(missing, evidence);
 }
 
 // Enforce: throws on missing evidence unless dryRun (then reports and continues).
@@ -253,10 +303,10 @@ export function runNpmPreflight(argv, workspaceRoot = process.cwd(), deps = {})
   if (dryRun) throw new Error("--publish and --dry-run are mutually exclusive");
   if (!tarball) throw new Error("--publish requires --tarball <gated .tgz>");
   enforcePublicationGate(options);
-  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath }, deps);
+  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath, workspaceRoot }, deps);
 }
 
-export function publishGatedTarball({ name, version, tarball, evidencePath }, deps = {}) {
+export function publishGatedTarball({ name, version, tarball, evidencePath, workspaceRoot }, deps = {}) {
   const run = deps.spawnSync ?? spawnSync;
   const bytes = fs.readFileSync(tarball);
   const evidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
@@ -278,7 +328,8 @@ export function publishGatedTarball({ name, version, tarball, evidencePath }, de
   }
   const sha1 = crypto.createHash("sha1").update(bytes).digest("hex");
   verifyNpmRegistryBytes({ name, version, sha1 }, deps);
-  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version });
+  // Feed and consumer copies belong to the requested workspace, never to this module's own (possibly installed) location.
+  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version }, workspaceRoot ? workspaceFeedOptions(workspaceRoot) : undefined);
 }
 
 // CI and the authenticated helper share mandatory, fail-closed registry equality.

package/publish-cargo.mjs

@@ -2,12 +2,12 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy, batchClippyMissingFeatureSets } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { recordPublished, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { readCargoPackage } from "./crate-graph.mjs";
 import { runtimeBudgetCheck, RUNTIME_BUDGET_CODE } from "./runtime-budgets.mjs";
 import { formatPreflight, PREFLIGHT_FAIL } from "./preflight.mjs";
@@ -147,7 +147,6 @@ export function scanCrateForSecrets(crateDir) {
       continue;
     }
     const bytes = fs.readFileSync(file);
-    if (bytes.includes(0)) continue;
     const text = bytes.toString("utf8");
     if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) violations.push(relative);
   }
@@ -176,8 +175,9 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
   if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
   if (reuseEvidence) {
-    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
-    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml and Cargo.lock");
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock", "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    // The gate config decides the steps replayed below, so an uncommitted edit would change what is demanded (0.4.1 review A3).
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
     const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
     const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
     const command = `cargo package --locked -p ${options.crate}`;
@@ -201,6 +201,11 @@ export async function runCargoPublish(options, execute = (_command, args, settin
           throw new Error(`--from-evidence missing configured qualification step: ${text}`);
         }
       }
+      // A batch run's clippy lives in its batch receipt, which `expected` leaves out: demand one row per feature set (0.4.1 review A2).
+      if (run.batch) {
+        const missing = batchClippyMissingFeatureSets(run.batch, gate.evidence, config?.rust?.[options.crate]?.featureSets ?? [[]]);
+        if (missing.length) throw new Error(`--from-evidence missing batch clippy for feature set${missing.length === 1 ? "" : "s"}: ${missing.map((features) => features.join(" ") || "default").join("; ")}`);
+      }
     }
   }
   const plan = buildCargoPublishPlan({ ...options, crateDir, proven,
@@ -316,7 +321,7 @@ async function main() {
   const result = await runCargoPublish(options);
   process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
   if (!options.dryRun) {
-    recordPublished({ registry: "cargo", name: result.name, version: result.version });
+    recordPublished({ registry: "cargo", name: result.name, version: result.version }, workspaceFeedOptions(options.workspaceRoot));
   }
 }
 

package/publish-swift.mjs

@@ -1,5 +1,5 @@
 // Publish RightKitSwift by the ONE Swift distribution contract: a plain semver git tag on this
-// repository (github.com/Orthic-Labs/rightkit), resolved by apps through the root Package.swift
+// repository (the checkout's own origin, github.com/bogusyogi/rightkit), resolved by apps through the root Package.swift
 // (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). There is no mirror and no second repository.
 //
 // `right-release publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]` verifies, in order:
@@ -19,7 +19,14 @@ import { spawnSync } from "./background-process.mjs";
 import { digestBytes } from "./publication-artifacts.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
-export const SWIFT_DISTRIBUTION_URL = "https://github.com/Orthic-Labs/rightkit";
+// The distribution URL is whatever repository this checkout's origin names (GITHUB_REPOSITORY when origin does not
+// parse); it is never a constant, so a repository move cannot leave a stale name in the success message.
+export function swiftDistributionUrl(origin, environment = process.env) {
+  const fromOrigin = /github\.com[:/]([\w.-]+\/[\w.-]+?)(?:\.git)?\/?$/i.exec(String(origin ?? "").trim())?.[1];
+  const fromEnvironment = /^[\w.-]+\/[\w.-]+$/.test(environment?.GITHUB_REPOSITORY ?? "") ? environment.GITHUB_REPOSITORY : null;
+  const repository = fromOrigin ?? fromEnvironment;
+  return repository ? `https://github.com/${repository}` : String(origin ?? "").trim();
+}
 const DRIFT_TEST = path.join("scripts", "swift-root-manifest.test.mjs");
 
 export function parseSwiftPublishArgs(argv) {
@@ -125,7 +132,9 @@ export function runSwiftPublish(options, execute = spawnSync) {
   catch (error) { git(["tag", "-d", version], toplevel, execute); throw error; }
   const remote = git(["ls-remote", "--tags", "origin", `refs/tags/${version}`], toplevel, execute);
   if (!remote.startsWith(sha)) throw new Error(`origin does not show tag ${version} at ${sha}`);
-  out(`tagged ${version} at ${sha} on ${SWIFT_DISTRIBUTION_URL}`);
+  let origin = "";
+  try { origin = git(["config", "--get", "remote.origin.url"], toplevel, execute); } catch { /* the tag is already verified on origin; the name is cosmetic */ }
+  out(`tagged ${version} at ${sha} on ${swiftDistributionUrl(origin, options.environment)}`);
   return { name, version, commit: sha, published: true };
 }
 

package/qa-control-scan.mjs

@@ -391,6 +391,10 @@ export const WEB_MOCK_MARKERS = Object.freeze([
   { id: "isBrowserQaMode", pattern: /isBrowserQaMode/ },
   { id: "MockDataSource", pattern: /MockDataSource/ },
   { id: "qa-build-flag", pattern: /\bVITE_[A-Z0-9_]*_QA\b/ },
+
+  // @rightkit/license/testing (M12): its sentinel value, and the subpath a bundle that kept the import still names.
+  { id: "license-testing-sentinel", pattern: /\bRIGHTKIT_LICENSE_TESTING_DO_NOT_SHIP\b/ },
+  { id: "license-testing-entry", pattern: /@rightkit\/license\/testing/ },
 ]);
 const WEB_EXTENSIONS = /\.(?:m?js|cjs|html?|css|map)$/i;
 

package/release-config.mjs

@@ -0,0 +1,330 @@
+// The release config contract (M24): `right-release.config.json`, a finite, versioned JSON schema read by dev, build, doctor, install
+// and upload alike. It is data. RightKit never imports, evaluates or converts an executable (`.mjs`, `.js`, `.cjs`, `.ts`) config: the
+// file name is judged BEFORE anything is opened or imported, including for `--dry-run`, so a legacy config cannot run a single line.
+//
+// Load order (build, dev, upload): resolve the primary checkout and the config path first, then `loadReleaseConfigSync` parses the JSON
+// strictly (no comments, no trailing commas, no duplicate keys), checks `schema: 1` and the finite top-level key set, expands the
+// typed templates below, and runs the M24 pipeline validation (`pipeline-config.mjs`) so a command that is not an admitted RightKit
+// invocation stops the run before the #340 preflight and before any recipe executes. A hash alone is never trusted: each effect
+// boundary (build, sign, upload) loads and validates again.
+//
+// Typed templates (the only computation a config may express):
+//   { "$fromJson": { "file": "src-tauri/tauri.conf.json", "pointer": "/version" } }   a string read from an app-relative JSON file
+//   { "$fromToml": { "file": "src-tauri/Cargo.toml", "path": "package.version" } }    a string read from an app-relative TOML file
+//   { "$json": <value> }                                                              JSON.stringify(<value>), for a JSON argument
+//   "{{app}}" "{{version}}" "{{home}}" "{{localAppData}}"                              replaced inside any string value
+// Anything else with braces is left alone, and an unknown {{token}} is an error.
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { collectConfigCommands, formatFindings, validateConfigPipeline } from "./pipeline-config.mjs";
+import { loadGeneratorRegistry } from "./pipeline-generators.mjs";
+
+export const RELEASE_CONFIG_FILE = "right-release.config.json";
+export const LEGACY_RELEASE_CONFIG_FILE = "right-release.config.mjs";
+export const RELEASE_CONFIG_SCHEMA = 1;
+export const MAX_CONFIG_BYTES = 1024 * 1024;
+export const LEGACY_EXECUTABLE_EXTENSIONS = Object.freeze([".mjs", ".js", ".cjs", ".ts", ".mts", ".cts", ".jsx", ".tsx"]);
+
+/** The complete set of top-level keys. A key outside it is refused: a new capability is a RightKit change, not an app extension. */
+export const TOP_LEVEL_KEYS = Object.freeze([
+  "$schema", "$comment", "schema", "app", "version", "channel", "distribution", "packageManager", "workdir", "targets", "development",
+  "deps", "checks", "buildInputs", "hostedWorkflows", "devtools", "releaseSwitches", "qa", "nativeAssembly", "legal", "web", "tests",
+  "sidecars", "releaseDependencies", "appStoreConnect", "storage", "cargoProfileExempt", "runtimeArtifacts",
+]);
+export const TEMPLATE_TOKENS = Object.freeze(["app", "version", "home", "localAppData"]);
+
+export class ReleaseConfigError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "ReleaseConfigError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+const fail = (code, message, details) => { throw new ReleaseConfigError(code, message, details); };
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+/**
+ * Judge a config file NAME. Throws for an executable config and for anything that is not `.json`. It touches no file: call it before
+ * opening, importing or even resolving a repository, so a legacy config is refused on every route (dry runs included).
+ */
+export function assertReleaseConfigFileName(file) {
+  if (typeof file !== "string" || !file.trim()) fail("RELEASE_CONFIG_NOT_JSON", "a release config path is required (right-release.config.json)");
+  const extension = path.extname(path.basename(file)).toLowerCase();
+  if (LEGACY_EXECUTABLE_EXTENSIONS.includes(extension)) {
+    fail("RELEASE_CONFIG_LEGACY_EXECUTABLE", `${file} is an executable release config (${extension}). RightKit never imports, evaluates or converts one; write ${RELEASE_CONFIG_FILE} (finite JSON schema, see the README section "Release config (JSON)") and delete the module.`, { file });
+  }
+  if (extension !== ".json") fail("RELEASE_CONFIG_NOT_JSON", `${file} is not a JSON release config; the only config file is ${RELEASE_CONFIG_FILE}`, { file });
+  return file;
+}
+
+/** A hint for a missing config: a legacy sibling is named (never opened). */
+function missingConfigMessage(file) {
+  const legacy = path.join(path.dirname(file), LEGACY_RELEASE_CONFIG_FILE);
+  return existsSync(legacy)
+    ? `release config not found: ${file}. A legacy executable config exists at ${legacy}; it is never imported or converted. Write ${RELEASE_CONFIG_FILE}.`
+    : `release config not found: ${file}`;
+}
+
+// ---- strict JSON ----------------------------------------------------------------------------------------------------------------
+const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const NUMBER = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+const pointerKey = (key) => key.replaceAll("~", "~0").replaceAll("/", "~1");
+
+/** Parse JSON strictly and remember where every value starts: `{ value, offsets }` (offsets: JSON pointer -> character offset). */
+export function parseStrictJson(text) {
+  const offsets = new Map();
+  let pos = 0;
+  const error = (message) => { throw Object.assign(new SyntaxError(message), { offset: pos }); };
+  const skip = () => { while (pos < text.length && (text[pos] === " " || text[pos] === "\t" || text[pos] === "\n" || text[pos] === "\r")) pos += 1; };
+  const string = () => {
+    const start = pos;
+    pos += 1;
+    while (pos < text.length && text[pos] !== '"') {
+      if (text.charCodeAt(pos) < 0x20) error("a control character inside a string");
+      pos += text[pos] === "\\" ? 2 : 1;
+    }
+    if (text[pos] !== '"') error("an unterminated string");
+    pos += 1;
+    try { return JSON.parse(text.slice(start, pos)); } catch { pos = start; return error("an invalid string escape"); }
+  };
+  const literal = (word, result) => { if (!text.startsWith(word, pos)) error(`unexpected token`); pos += word.length; return result; };
+  const value = (pointer, depth) => {
+    if (depth > 64) error("nesting deeper than 64 levels");
+    skip();
+    offsets.set(pointer, pos);
+    const ch = text[pos];
+    if (ch === "{") return object(pointer, depth);
+    if (ch === "[") return array(pointer, depth);
+    if (ch === '"') return string();
+    if (ch === "t") return literal("true", true);
+    if (ch === "f") return literal("false", false);
+    if (ch === "n") return literal("null", null);
+    NUMBER.lastIndex = pos;
+    const match = NUMBER.exec(text);
+    if (!match || match.index !== pos) error("unexpected token");
+    pos += match[0].length;
+    return Number(match[0]);
+  };
+  const object = (pointer, depth) => {
+    const out = {};
+    pos += 1;
+    skip();
+    if (text[pos] === "}") { pos += 1; return out; }
+    for (;;) {
+      skip();
+      if (text[pos] !== '"') error("expected a string key");
+      const keyStart = pos;
+      const key = string();
+      if (FORBIDDEN_KEYS.has(key)) { pos = keyStart; error(`the key "${key}" is not allowed`); }
+      if (Object.prototype.hasOwnProperty.call(out, key)) { pos = keyStart; error(`duplicate key "${key}"`); }
+      skip();
+      if (text[pos] !== ":") error("expected ':'");
+      pos += 1;
+      out[key] = value(`${pointer}/${pointerKey(key)}`, depth + 1);
+      skip();
+      if (text[pos] === ",") { pos += 1; continue; }
+      if (text[pos] === "}") { pos += 1; return out; }
+      error("expected ',' or '}'");
+    }
+  };
+  const array = (pointer, depth) => {
+    const out = [];
+    pos += 1;
+    skip();
+    if (text[pos] === "]") { pos += 1; return out; }
+    for (;;) {
+      out.push(value(`${pointer}/${out.length}`, depth + 1));
+      skip();
+      if (text[pos] === ",") { pos += 1; continue; }
+      if (text[pos] === "]") { pos += 1; return out; }
+      error("expected ',' or ']'");
+    }
+  };
+  const result = value("", 0);
+  skip();
+  if (pos !== text.length) error("unexpected content after the JSON value");
+  return { value: result, offsets };
+}
+
+/** 1-based line of a JSON pointer in `text` (the nearest recorded ancestor when the exact pointer is not a source position). */
+export function lineOfPointer(text, offsets, pointer) {
+  let current = pointer;
+  while (current !== "" && !offsets.has(current)) current = current.slice(0, current.lastIndexOf("/"));
+  const offset = offsets.get(current) ?? 0;
+  let line = 1;
+  for (let i = 0; i < offset && i < text.length; i += 1) if (text[i] === "\n") line += 1;
+  return line;
+}
+
+// ---- templates ------------------------------------------------------------------------------------------------------------------
+function readInside(appRoot, relative, label, { readBytes, lstat }) {
+  if (typeof relative !== "string" || !relative.trim() || path.isAbsolute(relative) || path.win32.isAbsolute(relative) || /^[A-Za-z]:/.test(relative) || relative.replaceAll("\\", "/").split("/").includes("..")) {
+    fail("RELEASE_CONFIG_TEMPLATE", `${label}: file must be a relative path inside the app: ${JSON.stringify(relative)}`);
+  }
+  const absolute = path.resolve(appRoot, relative);
+  let info;
+  try { info = lstat(absolute); } catch { fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${relative} does not exist`); }
+  if (info.isSymbolicLink() || !info.isFile()) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${relative} must be a regular file (no symlink)`);
+  if (info.size > MAX_CONFIG_BYTES) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${relative} is larger than ${MAX_CONFIG_BYTES} bytes`);
+  const bytes = readBytes(absolute);
+  return { bytes, sha256: createHash("sha256").update(bytes).digest("hex"), relative: relative.replaceAll("\\", "/") };
+}
+
+function jsonPointerGet(document, pointer, label) {
+  if (pointer === "") return document;
+  if (typeof pointer !== "string" || !pointer.startsWith("/")) fail("RELEASE_CONFIG_TEMPLATE", `${label}: pointer must be a JSON pointer such as /version`);
+  let current = document;
+  for (const raw of pointer.slice(1).split("/")) {
+    const key = raw.replaceAll("~1", "/").replaceAll("~0", "~");
+    if (!(isObject(current) || Array.isArray(current)) || !Object.prototype.hasOwnProperty.call(current, key)) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${pointer} is not in the file`);
+    current = current[key];
+  }
+  return current;
+}
+
+function scalarString(value, label) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return fail("RELEASE_CONFIG_TEMPLATE", `${label}: the referenced value must be a string or a number`);
+}
+
+/** Replace the typed templates in `node`. `context` carries the template values, the app root and the injectable file access. */
+function expand(node, context, label) {
+  if (typeof node === "string") {
+    return node.replace(/\{\{([A-Za-z][A-Za-z0-9]*)\}\}/g, (_, token) => {
+      if (!TEMPLATE_TOKENS.includes(token)) fail("RELEASE_CONFIG_TEMPLATE", `${label}: unknown template token {{${token}}} (allowed: ${TEMPLATE_TOKENS.map((t) => `{{${t}}}`).join(", ")})`);
+      const resolved = context.values[token];
+      if (typeof resolved !== "string" || resolved === "") fail("RELEASE_CONFIG_TEMPLATE", `${label}: {{${token}}} is not available${token === "localAppData" ? " (LOCALAPPDATA is not set)" : token === "version" ? " here (version cannot refer to itself)" : ""}`);
+      return resolved;
+    });
+  }
+  if (Array.isArray(node)) return node.map((item, index) => expand(item, context, `${label}/${index}`));
+  if (!isObject(node)) return node;
+  const keys = Object.keys(node);
+  if (keys.length === 1 && keys[0] === "$fromJson") {
+    const spec = node.$fromJson;
+    if (!isObject(spec) || Object.keys(spec).some((key) => key !== "file" && key !== "pointer") || typeof spec.file !== "string") fail("RELEASE_CONFIG_TEMPLATE", `${label}: $fromJson must be { file, pointer }`);
+    const read = readInside(context.appRoot, spec.file, `${label} $fromJson`, context);
+    let document;
+    try { document = JSON.parse(Buffer.from(read.bytes).toString("utf8")); } catch { fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${spec.file} is not valid JSON`); }
+    context.inputs.set(read.relative, read.sha256);
+    return scalarString(jsonPointerGet(document, spec.pointer ?? "", `${label} $fromJson`), label);
+  }
+  if (keys.length === 1 && keys[0] === "$fromToml") {
+    const spec = node.$fromToml;
+    if (!isObject(spec) || Object.keys(spec).some((key) => key !== "file" && key !== "path") || typeof spec.file !== "string" || typeof spec.path !== "string") fail("RELEASE_CONFIG_TEMPLATE", `${label}: $fromToml must be { file, path }`);
+    const read = readInside(context.appRoot, spec.file, `${label} $fromToml`, context);
+    let document;
+    try { document = parseToml(Buffer.from(read.bytes).toString("utf8")); } catch { fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${spec.file} is not valid TOML`); }
+    context.inputs.set(read.relative, read.sha256);
+    let current = document;
+    for (const key of spec.path.split(".")) {
+      if (!isObject(current) || !Object.prototype.hasOwnProperty.call(current, key)) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${spec.path} is not in ${spec.file}`);
+      current = current[key];
+    }
+    return scalarString(current, label);
+  }
+  if (keys.length === 1 && keys[0] === "$json") return JSON.stringify(expand(node.$json, context, `${label}/$json`));
+  const out = {};
+  for (const key of keys) {
+    if (key.startsWith("$") && !TOP_LEVEL_KEYS.includes(key)) fail("RELEASE_CONFIG_TEMPLATE", `${label}/${key}: "$" keys other than $fromJson, $fromToml and $json are reserved`);
+    out[key] = expand(node[key], context, `${label}/${pointerKey(key)}`);
+  }
+  return out;
+}
+
+// ---- shape ----------------------------------------------------------------------------------------------------------------------
+const SAFE_APP = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const SAFE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+
+/** Schema, finite key set and the identity fields. Throws RELEASE_CONFIG_SCHEMA / RELEASE_CONFIG_KEY. */
+export function validateReleaseConfigShape(config, { file = RELEASE_CONFIG_FILE, phase = "final" } = {}) {
+  if (!isObject(config)) fail("RELEASE_CONFIG_SCHEMA", `${file} must be a JSON object`, { file });
+  if (config.schema !== RELEASE_CONFIG_SCHEMA) fail("RELEASE_CONFIG_SCHEMA", `${file}: unsupported config schema ${JSON.stringify(config.schema ?? null)} (expected ${RELEASE_CONFIG_SCHEMA})`, { file });
+  const unknown = Object.keys(config).filter((key) => !TOP_LEVEL_KEYS.includes(key));
+  if (unknown.length) fail("RELEASE_CONFIG_KEY", `${file}: unknown top-level key(s): ${unknown.join(", ")}. The config schema is finite (allowed: ${TOP_LEVEL_KEYS.filter((key) => !key.startsWith("$")).join(", ")}); a new capability is a RightKit change.`, { file, unknown });
+  if (typeof config.app !== "string" || !SAFE_APP.test(config.app)) fail("RELEASE_CONFIG_SCHEMA", `${file}: app must be a safe name (letters, digits, . _ -)`, { file });
+  // Before template expansion a version may still be a { $fromJson | $fromToml } node or carry a {{token}}; the final check is strict.
+  const versionIsTemplate = phase === "raw" && (isObject(config.version) || (typeof config.version === "string" && config.version.includes("{{")));
+  if (config.version !== undefined && !versionIsTemplate && (typeof config.version !== "string" || !SAFE_VERSION.test(config.version))) fail("RELEASE_CONFIG_SCHEMA", `${file}: version must be a safe version string`, { file });
+  for (const key of ["targets", "development", "buildInputs", "distribution"]) {
+    if (config[key] !== undefined && !isObject(config[key])) fail("RELEASE_CONFIG_SCHEMA", `${file}: ${key} must be an object`, { file });
+  }
+  return config;
+}
+
+function packageScripts(appRoot, readText) {
+  try {
+    const parsed = JSON.parse(readText(path.join(appRoot, "package.json")));
+    return isObject(parsed?.scripts) ? parsed.scripts : undefined;
+  } catch { return undefined; }
+}
+
+/**
+ * Load, validate and expand a release config. Returns `{ config, configPath, appRoot, sha256, inputs, lineOf }`. Throws ReleaseConfigError
+ * (RELEASE_CONFIG_LEGACY_EXECUTABLE | _NOT_JSON | _NOT_FOUND | _INVALID_JSON | _SCHEMA | _KEY | _TEMPLATE | _M24). `validatePipeline: false`
+ * skips only the M24 command admission (the pipeline scanner reports those findings itself); nothing else is optional.
+ * File access, the generator registry, the environment and the home directory are injectable for tests.
+ */
+export function loadReleaseConfigSync(file, {
+  validatePipeline = true, registry, containment, env = process.env, homedir = () => os.homedir(),
+  readText = (target) => readFileSync(target, "utf8"), readBytes = (target) => readFileSync(target), lstat = lstatSync,
+} = {}) {
+  assertReleaseConfigFileName(file);
+  const configPath = path.resolve(file);
+  const appRoot = path.dirname(configPath);
+  let text;
+  try { text = readText(configPath); } catch { fail("RELEASE_CONFIG_NOT_FOUND", missingConfigMessage(configPath), { file: configPath }); }
+  if (Buffer.byteLength(text) > MAX_CONFIG_BYTES) fail("RELEASE_CONFIG_INVALID_JSON", `${configPath} is larger than ${MAX_CONFIG_BYTES} bytes`, { file: configPath });
+  if (text.charCodeAt(0) === 0xfeff) text = text.slice(1);
+  let parsed;
+  try { parsed = parseStrictJson(text); } catch (error) {
+    let line = 1;
+    for (let i = 0; i < (error.offset ?? 0) && i < text.length; i += 1) if (text[i] === "\n") line += 1;
+    fail("RELEASE_CONFIG_INVALID_JSON", `${configPath}:${line} is not valid strict JSON (${error.message}; no comments, trailing commas or duplicate keys)`, { file: configPath, line });
+  }
+  const raw = parsed.value;
+  validateReleaseConfigShape(raw, { file: configPath, phase: "raw" });
+  const inputs = new Map();
+  const base = { appRoot, inputs, readBytes, lstat, values: { home: homedir(), localAppData: env.LOCALAPPDATA ?? "", app: "", version: "" } };
+  base.values.app = expand(raw.app, { ...base }, "/app");
+  if (raw.version !== undefined) base.values.version = expand(raw.version, { ...base, values: { ...base.values, version: "" } }, "/version");
+  const config = expand(raw, base, "");
+  validateReleaseConfigShape(config, { file: configPath });
+  const sha256 = createHash("sha256").update(Buffer.from(text)).digest("hex");
+  if (validatePipeline) {
+    const findings = validateConfigPipeline(config, {
+      scripts: packageScripts(appRoot, readText),
+      registry: registry ?? loadGeneratorRegistry(),
+      appRoot,
+      containment,
+      readBytes,
+      lineOf: (pointer) => lineOfPointer(text, parsed.offsets, pointer),
+    });
+    if (findings.length) {
+      fail("RELEASE_CONFIG_M24", `${configPath} has ${findings.length} M24 pipeline finding(s); every command must be an admitted RightKit invocation:\n${formatFindings(findings, configPath).map((line) => `- ${line}`).join("\n")}`, { file: configPath, findings });
+    }
+  }
+  return {
+    config, configPath, appRoot, sha256,
+    inputs: [...inputs].map(([file, digest]) => ({ file, sha256: digest })),
+    lineOf: (pointer) => lineOfPointer(text, parsed.offsets, pointer),
+  };
+}
+
+/** The config object only (what `(await import(configPath)).default` used to be). */
+export async function loadReleaseConfig(file, options) {
+  return loadReleaseConfigSync(file, options).config;
+}
+
+/** `{ config, appRoot, configPath }` for the commands that need the app root beside the config. */
+export async function loadAppConfigFile(file = RELEASE_CONFIG_FILE, options) {
+  const loaded = loadReleaseConfigSync(file, options);
+  return { config: loaded.config, appRoot: loaded.appRoot, configPath: loaded.configPath };
+}
+
+export { collectConfigCommands };