@rightkit/release 0.4.0 → 0.5.0

package/stage-sidecar.mjs

@@ -23,7 +23,7 @@
 // metadata`) or { npm: "<pkg>/<file>" }. The wrapper form { sidecars, profiles: { dev, release } } sets the default cargo
 // profile pair; RIGHTKIT_BUILD_MODE (dev|release, default release) selects. The target `universal-apple-darwin` builds
 // both slices of a cargo-bin and lipo-creates `<name>-universal-apple-darwin`. `ffmpeg` and `onnxruntime` do the same from their
-// per-arch catalog rows (each slice staged under .right-release/slices/<triple>, then lipo-merged), a `cmake` entry builds with
+// per-arch catalog rows (each slice staged under .right-release/slices/<triple>, then lipo-merged; an onnxruntime `universal` macOS row is staged once, lipo -archs checked, no merge), a `cmake` entry builds with
 // CMAKE_OSX_ARCHITECTURES="arm64;x86_64". A `prebuilt` entry does it from per-arch host-built inputs (`from: { aarch64, x86_64 }`, or the
 // staged `<name>-<slice triple>` files), each verified against its own manifest entry and then lipo-merged. An `ffmpeg` source may be a
 // local path (`sources.ffmpeg: { path: "../vendor/ffmpeg-lgpl" }`) instead of a pinned https archive.
@@ -73,6 +73,28 @@ const MODES = new Set(["dev", "release"]);
 const PROFILE = /^[a-z][a-z0-9_-]*$/;
 const PLATFORMS = new Set(["mac", "win", "linux"]);
 const NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+/** One path segment of an archive member path: no glob metacharacters, no separators, no drive colon. */
+const MEMBER_SEGMENT = /^[A-Za-z0-9_.+@~-]+$/;
+
+/**
+ * Normalize and guard a requested archive member. A bare file name (no `/`) selects the one member with that base name; a path
+ * (contains `/`) selects the one member with exactly that archive path. A leading `./` is stripped. Absolute paths, drive
+ * prefixes, backslashes, empty, `.` and `..` segments and glob metacharacters are refused. Returns { value, byPath } or
+ * { error }. The member never influences where the extracted file is written.
+ */
+export function normalizeArchiveMember(member) {
+  if (typeof member !== "string" || !member) return { error: "must be a non-empty string" };
+  if (member.includes("\\")) return { error: "must not contain a backslash" };
+  const value = member.startsWith("./") ? member.slice(2) : member;
+  if (value.startsWith("/")) return { error: "must not be an absolute path" };
+  if (/^[A-Za-z]:/.test(value)) return { error: "must not start with a drive prefix" };
+  const segments = value.split("/");
+  if (segments.some((segment) => segment === "")) return { error: "must not contain an empty segment" };
+  if (segments.some((segment) => segment === "." || segment === "..")) return { error: "must not contain a '.' or '..' segment" };
+  // A bare file name keeps today's matching (any characters but the refused ones above); a path is held to a strict segment alphabet so it can never act as a tar glob.
+  if (segments.length > 1 && !segments.every((segment) => MEMBER_SEGMENT.test(segment))) return { error: "has a segment with characters outside A-Z a-z 0-9 _ . + @ ~ -" };
+  return { value, byPath: segments.length > 1 };
+}
 const KEYS = Object.freeze({
   "cargo-bin": ["kind", "package", "bin", "name", "profile", "features", "manifestPath", "sha256", "dest", "clean", "platforms"],
   ffmpeg: ["kind", "variant", "variants", "tools", "notices", "catalog", "stage", "bundleDir", "sources", "probe", "platforms"],
@@ -390,7 +412,7 @@ export function validateSidecarManifest(raw, { target, mode = "release" } = {})
       if (item.dest === undefined && item.to === undefined) errors.push(`${where}: dest (or to) is required`);
       const dest = destOf(item.dest ?? item.to, item.dest === undefined ? "to" : "dest");
       if (item.size !== undefined && (!Number.isSafeInteger(item.size) || item.size <= 0)) errors.push(`${where}: size must be a positive integer (bytes)`);
-      if (item.extract !== undefined && (typeof item.extract !== "string" || !NAME.test(item.extract))) errors.push(`${where}: extract must be the bare file name of one archive member (no path)`);
+      if (item.extract !== undefined) { const member = normalizeArchiveMember(item.extract); if (member.error || (!member.byPath && !NAME.test(member.value))) errors.push(`${where}: extract must be the bare file name of one archive member or its archive path (posix, no leading /, no .. segment): ${member.error ?? "invalid file name"}`); }
       if (item.memberSha256 !== undefined && (item.extract === undefined || !SHA256.test(item.memberSha256 ?? ""))) errors.push(`${where}: memberSha256 must be a lowercase 64-hex SHA-256 and needs extract`);
       if (item.executable !== undefined && typeof item.executable !== "boolean") errors.push(`${where}: executable must be a boolean`);
       const clean = cleanOf();
@@ -499,15 +521,31 @@ export function defaultRun(command, args, { cwd, env = process.env } = {}) {
   });
 }
 
-/** Default archive member extraction (bsdtar reads tgz and zip/nupkg): the one member whose basename is `fileName`. */
+/**
+ * Default archive member extraction (bsdtar reads tgz and zip/nupkg). A bare `fileName` selects the one member whose basename it is;
+ * a `fileName` containing `/` selects the one member whose full archive path equals it (case-sensitive, leading `./` ignored on both
+ * sides), so archives with the same base name in several directories (ORT DirectML nupkgs) can be addressed. The returned file is
+ * always under `destDir`; callers copy it to their own declared output name, so the member path never decides where anything is written.
+ * A bare name ignores members inside a `.dSYM` bundle: Apple archives (ORT osx tgz) ship the DWARF copy under the same base name.
+ */
+const isDebugSymbolMember = (member) => member.split("/").some((part) => part.toLowerCase().endsWith(".dsym"));
+
 export function defaultExtractMember({ archive, fileName, destDir, run = defaultRun }) {
+  const wanted = normalizeArchiveMember(fileName);
+  if (wanted.error) fail("STAGE_SIDECAR_EXTRACT_FAILED", `archive member ${JSON.stringify(fileName)} ${wanted.error}`);
   const listing = run("tar", ["-tf", archive], { cwd: path.dirname(archive) });
   if (listing.status !== 0) fail("STAGE_SIDECAR_EXTRACT_FAILED", `cannot list ${archive}`);
-  const members = String(listing.stdout).split(/\r?\n/).map((line) => line.trim()).filter((line) => line && path.posix.basename(line) === fileName);
-  if (members.length !== 1) fail("STAGE_SIDECAR_EXTRACT_FAILED", `${archive} has ${members.length} members named ${fileName}, expected exactly one`);
+  const lines = String(listing.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const members = wanted.byPath
+    ? lines.filter((line) => (line.startsWith("./") ? line.slice(2) : line) === wanted.value)
+    : lines.filter((line) => path.posix.basename(line) === wanted.value && !isDebugSymbolMember(line));
+  if (members.length !== 1) fail("STAGE_SIDECAR_EXTRACT_FAILED", `${archive} has ${members.length} members ${wanted.byPath ? "at the path" : "named"} ${wanted.value}, expected exactly one`);
   const extracted = run("tar", ["-xf", archive, "-C", destDir, members[0]], { cwd: path.dirname(archive) });
   if (extracted.status !== 0) fail("STAGE_SIDECAR_EXTRACT_FAILED", `cannot extract ${members[0]} from ${archive}`);
-  return path.join(destDir, ...members[0].split("/"));
+  const out = path.join(destDir, ...members[0].split("/"));
+  const inside = path.relative(path.resolve(destDir), path.resolve(out));
+  if (!inside || inside === ".." || inside.startsWith(`..${path.sep}`) || path.isAbsolute(inside)) fail("STAGE_SIDECAR_EXTRACT_FAILED", `member ${members[0]} of ${archive} resolves outside the extraction directory`);
+  return out;
 }
 
 async function defaultFetchBytes(url) {
@@ -877,18 +915,48 @@ async function stageFfmpeg(entry, ctx) {
   }
 }
 
+/** Catalog statuses that may serve a staged library; `stale-unverified` and `planned` rows never do. */
+const SERVING_STATUS = new Set(["approved", "pinned"]);
+
+/**
+ * The one onnxruntime catalog row that serves target `t` (mirrors rightkit-onnx provision.rs select()): an approved or pinned
+ * exact-(os, arch) row wins; only when none exists does a macOS `universal` row (both Apple slices) serve an aarch64 or x86_64
+ * target. A stale-unverified or planned row is never selected. With nothing serving, the typed error names the exact-arch row's
+ * status when there is one, else the missing row.
+ */
+function selectOnnxRuntimeRow(loaded, entry, t, where) {
+  const candidates = (loaded.catalog?.libraries ?? []).filter((row) => row.library === "onnxruntime" && row.version === entry.version && row.os === t.os);
+  const serving = candidates.filter((row) => SERVING_STATUS.has(row.status));
+  const exact = serving.filter((row) => row.arch === t.arch);
+  const appleThin = t.os === "macos" && (t.arch === "aarch64" || t.arch === "x86_64");
+  const hits = exact.length ? exact : appleThin ? serving.filter((row) => row.arch === "universal") : [];
+  if (hits.length === 1) return hits[0];
+  if (hits.length > 1) return fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has ${hits.length} ${where} rows`);
+  const unserved = candidates.filter((row) => row.arch === t.arch);
+  if (unserved.length === 0) return fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has no ${where} row`);
+  if (unserved.length > 1) return fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has ${unserved.length} ${where} rows`);
+  return fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${unserved[0].id} is ${unserved[0].status}, not approved or pinned`);
+}
+
+/**
+ * The archive member of a catalog row: archive.member when present; else, for a macOS `.zip` archive, `<archive name without
+ * .zip>/lib/<artifactFileName>` (as provision.rs derives it); else the bare artifactFileName.
+ */
+function onnxRuntimeMember(row) {
+  if (row.archive.member !== undefined) return row.archive.member;
+  const archiveName = path.posix.basename(new URL(row.archive.url).pathname);
+  if (row.os === "macos" && archiveName.endsWith(".zip")) return `${archiveName.slice(0, -".zip".length)}/lib/${row.artifactFileName}`;
+  return row.artifactFileName;
+}
+
 /**
  * Stage one architecture of onnxruntime: the approved or pinned catalog row for `t`, its archive (digest-checked), the library
  * (digest-checked) into `destDir` (default the entry's resourceDir), and the notices. Returns { row, dest, outName, notices }.
  */
 async function stageOnnxRuntimeSlice(entry, ctx, loaded, t, { destDir } = {}) {
   const { appRoot, fs } = ctx;
-  const rows = (loaded.catalog?.libraries ?? []).filter((row) => row.library === "onnxruntime" && row.version === entry.version && row.os === t.os && row.arch === t.arch);
   const where = `onnxruntime ${entry.version} ${t.os}/${t.arch}`;
-  if (rows.length === 0) fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has no ${where} row`);
-  if (rows.length > 1) fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog has ${rows.length} ${where} rows`);
-  const [row] = rows;
-  if (!["approved", "pinned"].includes(row.status)) fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} is ${row.status}, not approved or pinned`);
+  const row = selectOnnxRuntimeRow(loaded, entry, t, where);
   for (const key of ["sha256", "artifactFileName"]) if (typeof row[key] !== "string" || !row[key]) fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} has no ${key}`);
   if (!SHA256.test(row.sha256) || !SHA256.test(row.archive?.sha256 ?? "") || typeof row.archive?.url !== "string") fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} lacks a valid library digest or archive url and digest`);
   if (!Array.isArray(row.noticeFiles) || !row.noticeFiles.length) fail("STAGE_SIDECAR_NOTICE_MISSING", `the ${where} row ${row.id} lists no notice files; the licence must ship with the library`);
@@ -900,6 +968,10 @@ async function stageOnnxRuntimeSlice(entry, ctx, loaded, t, { destDir } = {}) {
   });
   for (const { source } of notices) if (!fs.existsSync(source)) fail("STAGE_SIDECAR_NOTICE_MISSING", `notice file not found: ${source}`);
 
+  // The archive member is the catalog's archive.member (an archive path) when present, else the library file name; the output name never comes from it.
+  const member = onnxRuntimeMember(row);
+  const memberCheck = normalizeArchiveMember(member);
+  if (memberCheck.error) fail("STAGE_SIDECAR_NOT_APPROVED", `the ${where} row ${row.id} has an invalid archive member ${JSON.stringify(member)}: ${memberCheck.error}`);
   const outName = entry.as ?? row.artifactFileName;
   const dest = path.resolve(appRoot, destDir ?? entry.resourceDir, outName);
   if (fs.existsSync(dest) && sha256Of(fs.readFileSync(dest)) === row.sha256) {
@@ -915,9 +987,9 @@ async function stageOnnxRuntimeSlice(entry, ctx, loaded, t, { destDir } = {}) {
     }
     const scratch = ctx.makeTempDir();
     try {
-      const library = await ctx.extractMember({ archive, fileName: row.artifactFileName, destDir: scratch });
+      const library = await ctx.extractMember({ archive, fileName: member, destDir: scratch });
       const actual = sha256Of(fs.readFileSync(library));
-      if (actual !== row.sha256) fail("STAGE_SIDECAR_HASH_MISMATCH", `${row.artifactFileName} extracted as ${actual}, the catalog pins ${row.sha256}; nothing staged`, { expected: row.sha256, actual });
+      if (actual !== row.sha256) fail("STAGE_SIDECAR_HASH_MISMATCH", `${member} extracted as ${actual}, the catalog pins ${row.sha256}; nothing staged`, { expected: row.sha256, actual });
       copyInto(ctx, library, dest, { executable: false });
     } finally {
       ctx.removeDir(scratch);
@@ -939,7 +1011,19 @@ async function stageOnnxRuntime(entry, ctx) {
     const { row, dest, outName, notices } = await stageOnnxRuntimeSlice(entry, ctx, loaded, target);
     return [{ kind: "onnxruntime", name: outName, path: rel(ctx, dest), sha256: row.sha256, sizeBytes: fs.statSync(dest).size, changed: null, catalogRow: row.id, version: row.version, archiveSha256: row.archive.sha256, license: row.licenseSpdx ?? null, notices, externalBin: false }];
   }
-  // universal-apple-darwin: each arch row is staged thin under SLICE_ROOT, then merged into the entry's resource file.
+  // universal-apple-darwin: one macOS `universal` row serving both slices is staged once, in place, with no lipo merge.
+  const selected = SLICES.map((triple) => selectOnnxRuntimeRow(loaded, entry, parseTargetTriple(triple), `onnxruntime ${entry.version} macos/${triple.split("-")[0]}`));
+  if (selected.some((row) => row.arch === "universal")) {
+    if (selected[0] !== selected[1]) fail("STAGE_SIDECAR_NOT_APPROVED", `the native catalog mixes a universal row with exact-arch rows (${selected.map((row) => row.id).join(", ")}); universal-apple-darwin takes either one universal row or one row per arch`);
+    const staged = await stageOnnxRuntimeSlice(entry, ctx, loaded, parseTargetTriple(SLICES[0]));
+    requireUniversalFile(ctx, staged.dest, `onnxruntime ${entry.version} ${staged.row.id}`);
+    return [{
+      kind: "onnxruntime", name: staged.outName, path: rel(ctx, staged.dest), sha256: staged.row.sha256, sizeBytes: fs.statSync(staged.dest).size, changed: null, sourceSha256: staged.row.sha256,
+      catalogRow: staged.row.id, version: entry.version, archiveSha256: staged.row.archive.sha256, license: staged.row.licenseSpdx ?? null, notices: staged.notices, externalBin: false,
+      slices: SLICES.map((triple) => ({ triple, sha256: staged.row.sha256, catalogRow: staged.row.id, archiveSha256: staged.row.archive.sha256 })),
+    }];
+  }
+  // Otherwise each arch row is staged thin under SLICE_ROOT, then merged into the entry's resource file.
   const slices = [];
   for (const triple of SLICES) slices.push({ triple, ...(await stageOnnxRuntimeSlice(entry, ctx, loaded, parseTargetTriple(triple), { destDir: `${SLICE_ROOT}/${triple}` })) });
   const names = [...new Set(slices.map((slice) => slice.outName))];
@@ -1042,7 +1126,7 @@ async function ensureCachedDownload(ctx, { url, sha256, size }) {
 
 /**
  * A pinned https download. `dest` is copied only from the verified cache entry. With `extract` the download is an archive
- * (zip, tgz): the one member whose base name is `extract` is unpacked (digest-checked against `memberSha256` when given) and
+ * (zip, tgz): the one member whose base name is `extract` (or, when `extract` contains `/`, whose archive path equals it) is unpacked (digest-checked against `memberSha256` when given) and
  * only that member is staged, so no `command` entry or shell is needed to unpack it.
  */
 async function stageRemote(entry, ctx) {

package/swap-helper-bundle.mjs

@@ -1,7 +1,11 @@
 // The Developer-ID-signed `bin/darwin/rightkit-swap` that @rightkit/release ships (Orthic-Labs/rightkit#258).
-// rightkit-swap is the bin target of crates/rightkit-fs (renamex_np RENAME_SWAP). CI has no Apple signing secrets, so
-// @rightkit/release is published through `right-release publish npm --local` on the Mac, which calls
-// `prepareSwapHelper` before packing. install-app calls `assertShippedSwapHelperSigned` before it trusts the helper.
+// rightkit-swap is the bin target of crates/rightkit-fs (renamex_np RENAME_SWAP). Two signing routes produce it:
+// (a) local publish — `right-release publish npm --local` on the Mac calls `prepareSwapHelper` before packing;
+// (b) CI qualification — `publish.yml` build-swap -> sign-swap -> pack (docs/CI.md), where sign-swap imports the
+// Developer ID from the `release` environment secrets. Route (b) stays blocked until root provisions
+// APPLE_CERTIFICATE_BASE64/APPLE_CERTIFICATE_PASSWORD there; exporting that identity needs an Aqua login session
+// (SSH export fails errSecInteractionNotAllowed/-25308 & the signing agent has no key-export capability — never
+// retry either). install-app calls `assertShippedSwapHelperSigned` before it trusts the helper.
 import crypto from "node:crypto";
 import nodeFs from "node:fs";
 import path from "node:path";

package/workflow-yaml.mjs

@@ -0,0 +1,177 @@
+// A strict parser for the YAML subset GitHub Actions workflows in this repository use: block
+// mappings, block sequences, literal block scalars (`|` and `|-`, no indentation indicator), flow
+// sequences of scalars on one line, quoted and plain single-line scalars, comments. It parses
+// structure so a contract test can assert on it. It REJECTS everything it does not implement exactly
+// instead of guessing, so an unparsed construct can never pass as "absent" and no scalar can mean
+// something different to GitHub than to the contract: tabs anywhere, folded scalars (`>`) in any
+// form, block scalars with an indentation indicator or `+` chomping, anchors, aliases, tags, merge
+// keys, explicit keys, document markers, flow mappings (except the empty `{}`), flow collections that span lines, multi-line
+// scalars, duplicate keys. Every scalar is returned as a string. Literal block scalars follow the
+// spec: `|` keeps one trailing newline, `|-` none.
+
+function fail(no, message) { throw new Error(`yaml line ${no}: ${message}`); }
+
+function stripComment(text) {
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) { if (c === quote) quote = null; continue; }
+    if ((c === '"' || c === "'") && (i === 0 || /[\s[,:]/.test(text[i - 1]))) { quote = c; continue; }
+    if (c === "#" && (i === 0 || /\s/.test(text[i - 1]))) return text.slice(0, i).trimEnd();
+  }
+  return text.trimEnd();
+}
+
+function scalar(raw, no) {
+  const text = raw.trim();
+  if (text === "") return "";
+  if (/^[&*!]/.test(text)) fail(no, `anchors, aliases and tags are not supported: ${text.slice(0, 40)}`);
+  if (/^[|>]/.test(text)) fail(no, `block scalar header ${JSON.stringify(text.slice(0, 12))} is not supported here (only "|" and "|-" after a mapping key)`);
+  if (/^(?:[-?:](?:\s|$)|[%@`])/.test(text)) fail(no, `YAML indicator at the start of a plain scalar is not supported: ${text.slice(0, 40)}`);
+  // The empty flow mapping alone (`permissions: {}`) is unambiguous; any other flow mapping is refused.
+  if (text === "{}") return {};
+  if (text.startsWith("{")) fail(no, "flow mappings are not supported");
+  if (text.startsWith('"')) {
+    if (!/^"(?:[^"\\]|\\.)*"$/.test(text)) fail(no, `unterminated or trailing text after a quoted scalar: ${text.slice(0, 40)}`);
+    return JSON.parse(text);
+  }
+  if (text.startsWith("'")) {
+    if (!/^'(?:[^']|'')*'$/.test(text)) fail(no, `unterminated or trailing text after a quoted scalar: ${text.slice(0, 40)}`);
+    return text.slice(1, -1).replaceAll("''", "'");
+  }
+  if (text.startsWith("[")) {
+    if (!text.endsWith("]")) fail(no, "flow sequence must close on the same line");
+    const inner = text.slice(1, -1);
+    const items = []; let current = ""; let quote = null;
+    for (const c of inner) {
+      if (quote) { current += c; if (c === quote) quote = null; continue; }
+      if (c === '"' || c === "'") { quote = c; current += c; continue; }
+      if (c === "[" || c === "{") fail(no, "nested flow collections are not supported");
+      if (c === ",") { items.push(current); current = ""; continue; }
+      current += c;
+    }
+    if (quote) fail(no, "unterminated quote in flow sequence");
+    items.push(current);
+    const kept = items.map((item) => item.trim());
+    while (kept.length && kept.at(-1) === "") kept.pop(); // a trailing comma
+    if (kept.includes("")) fail(no, "empty item in a flow sequence");
+    return kept.map((item) => scalar(item, no));
+  }
+  return text;
+}
+
+export function parseYaml(source) {
+  const raw = String(source).replace(/\r\n/g, "\n").split("\n");
+  raw.forEach((line, i) => { if (line.includes("\t")) fail(i + 1, "tabs are not allowed"); });
+  const lines = raw.map((text, i) => ({ no: i + 1, raw: text, indent: /^( *)/.exec(text)[1].length, body: stripComment(text).trim() }));
+  let cursor = 0;
+
+  const skipBlank = () => { while (cursor < lines.length && lines[cursor].body === "") cursor += 1; };
+
+  function blockScalar(parentIndent, header, no) {
+    const strip = header === "|-";
+    const body = [];
+    let blockIndent = null;
+    while (cursor < lines.length) {
+      const line = lines[cursor];
+      if (line.raw.trim() === "") {
+        // A blank line deeper than the block indentation carries content (its spaces); not modeled.
+        if (blockIndent !== null && line.raw.length > blockIndent) fail(line.no, "whitespace-only line inside a block scalar is indented past the block; not supported");
+        body.push(""); cursor += 1; continue;
+      }
+      if (line.indent <= parentIndent) break;
+      if (blockIndent === null) blockIndent = line.indent;
+      if (line.indent < blockIndent) fail(line.no, "block scalar line is indented less than its first line");
+      body.push(line.raw.slice(blockIndent));
+      cursor += 1;
+    }
+    while (body.length && body.at(-1) === "") body.pop();
+    if (body.length === 0) return "";
+    return body.join("\n") + (strip ? "" : "\n");
+  }
+
+  function parseBlock(indent) {
+    skipBlank();
+    if (cursor >= lines.length) return null;
+    const first = lines[cursor];
+    if (first.indent !== indent) fail(first.no, `expected indent ${indent}, found ${first.indent}`);
+    return /^-(\s|$)/.test(first.body) ? parseSequence(indent) : parseMapping(indent);
+  }
+
+  function parseSequence(indent) {
+    const out = [];
+    for (;;) {
+      skipBlank();
+      if (cursor >= lines.length) break;
+      const line = lines[cursor];
+      if (line.indent < indent) break;
+      if (line.indent > indent) fail(line.no, "unexpected indentation inside a sequence");
+      if (!/^-(\s|$)/.test(line.body)) break;
+      const rest = line.body.slice(1);
+      const offset = rest.length - rest.trimStart().length;
+      const content = rest.trimStart();
+      if (content === "") {
+        cursor += 1; skipBlank();
+        const next = lines[cursor];
+        if (!next || next.indent <= indent) { out.push(""); continue; }
+        out.push(parseBlock(next.indent));
+        continue;
+      }
+      // "- key: value" opens a mapping whose keys sit at the column after "- ".
+      if (keyMatch(content) && !/^["'[]/.test(content)) {
+        const childIndent = indent + 1 + offset;
+        lines[cursor] = { ...line, indent: childIndent, body: content, raw: " ".repeat(childIndent) + content };
+        out.push(parseMapping(childIndent));
+        continue;
+      }
+      cursor += 1;
+      out.push(scalar(content, line.no));
+    }
+    return out;
+  }
+
+  function keyMatch(body) {
+    const m = /^("(?:[^"\\]|\\.)*"|'(?:[^']|'')*'|[^\s:#"'[\]{},&*!|>-][^:]*?|-[^\s:][^:]*?)\s*:(?:\s+(.*))?$/.exec(body);
+    return m ? { key: m[1], value: m[2] ?? "" } : null;
+  }
+
+  function parseMapping(indent) {
+    const out = {};
+    for (;;) {
+      skipBlank();
+      if (cursor >= lines.length) break;
+      const line = lines[cursor];
+      if (line.indent < indent) break;
+      if (line.indent > indent) fail(line.no, "unexpected indentation inside a mapping");
+      if (/^-(\s|$)/.test(line.body)) break;
+      const hit = keyMatch(line.body);
+      if (!hit) fail(line.no, `cannot parse mapping entry: ${line.body.slice(0, 60)}`);
+      const key = hit.key.startsWith('"') || hit.key.startsWith("'") ? scalar(hit.key, line.no) : hit.key;
+      if (Object.hasOwn(out, key)) fail(line.no, `duplicate key ${JSON.stringify(key)}`);
+      cursor += 1;
+      const value = hit.value.trim();
+      if (value === "") {
+        skipBlank();
+        const next = lines[cursor];
+        if (next && next.indent > indent) out[key] = parseBlock(next.indent);
+        else if (next && next.indent === indent && /^-(\s|$)/.test(next.body)) out[key] = parseSequence(indent);
+        else out[key] = "";
+      } else if (value === "|" || value === "|-") {
+        out[key] = blockScalar(indent, value, line.no);
+      } else if (/^[|>]/.test(value)) {
+        fail(line.no, `block scalar header ${JSON.stringify(value.slice(0, 12))} is not supported (indentation indicators, "+" chomping and folded scalars are rejected)`);
+      } else {
+        const next = (skipBlank(), lines[cursor]);
+        if (next && next.indent > indent) fail(next.no, "multi-line plain scalars are not supported");
+        out[key] = scalar(value, line.no);
+      }
+    }
+    return out;
+  }
+
+  skipBlank();
+  const result = cursor >= lines.length ? {} : parseBlock(lines[cursor].indent);
+  skipBlank();
+  if (cursor < lines.length) fail(lines[cursor].no, "unparsed trailing content");
+  return result;
+}

package/bin/darwin/rightkit-swap.sign.json

@@ -1,6 +0,0 @@
-{
-  "schema": 1,
-  "sha256": "a41ce13fd3bac31db0230d70bed20db0ed9bf554bdae2255bdf2064589b48f29",
-  "identity": "Developer ID Application: Adrian D'souza (6KLGD3LLKF)",
-  "codesign": "strict-valid"
-}