@rightkit/release 0.6.12 → 0.6.14

package/install-tauri-authenticode.mjs

@@ -0,0 +1,346 @@
+// `development.targets.win.install.kind: "tauri-authenticode"` (rightkit#1303): the Windows dev install that signs what it installs. The unsigned
+// kind (`tauri`: build the NSIS installer and run it) is refused on the Dell, because a dev build must carry the product's one signing identity
+// (Azure Artifact Signing, subject CN=Damned Ventures LLC) exactly as the release does. This kind reuses the release's order
+// (package-recipe-targets.mjs winPackage, tauri-bundle-marker.mjs, nsis-payload.mjs, release.mjs) and its signer (sign-windows.mjs):
+//   1. build the app without bundling    (`target.build`: a `tauri build ... --no-bundle`; runDevelopment runs it before this module)
+//   2. patch the bundle marker           (UNK -> NSS BEFORE signing: Tauri rewrites it during bundling, and doing that to signed bytes breaks Authenticode)
+//   3. sign the exe and its sidecars, then verify them (signer subject, timestamp)
+//   4. carried `tauri bundle --bundles nsis --debug`   (the installer embeds the exe as signed)
+//   5. check the payload                 (the exe inside the installer is byte for byte the signed one)
+//   6. sign the installer, then verify it
+//   7. install                           (the silent installer, as the unsigned kind runs it)
+//   8. verify                            (the installed exe equals the build, and its Authenticode subject is the signer's)
+// Nothing installs before step 6 has verified, so no unsigned installer is ever run. Every host effect is a dependency, so the order runs with fakes.
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { neutralIgnored } from "./stage-ledger.mjs";
+import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
+import { listNsisPayload, verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
+import { SIGN_SUBJECT, SuiteSigningError, WINDOWS_SIGNED_KIND, identifierOverrideReason, isProductBuildStep, stepWords } from "./suite-signing-policy.mjs";
+
+export const TAURI_AUTHENTICODE_KIND = WINDOWS_SIGNED_KIND;
+/** The steps in the order this module runs them (1 is runDevelopment's build). Exported so a test can prove the order. */
+export const TAURI_AUTHENTICODE_ORDER = Object.freeze(["patch-marker", "sign-exe", "bundle", "check-payload", "sign-installer", "install", "verify"]);
+const KEYS = new Set(["kind", "productName", "targetTriple", "manifestPath", "expectedInstalledPath", "sidecars", "tauriCwd"]);
+
+export class TauriAuthenticodeError extends SuiteSigningError {
+  constructor(code, message, details) { super(code, message, details); this.name = "TauriAuthenticodeError"; }
+}
+const refuse = (code, message, details) => { throw new TauriAuthenticodeError(code, message, details); };
+const sha256 = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+const relativeInside = (value, label) => {
+  const text = String(value ?? "").replaceAll("\\", "/");
+  if (!text || path.isAbsolute(text) || path.win32.isAbsolute(text) || /^[A-Za-z]:/.test(text) || text.split("/").includes("..")) refuse("TAURI_AUTHENTICODE_CONFIG", `${label} must be a relative path that stays inside its directory: ${JSON.stringify(value)}`);
+  return text;
+};
+
+/** Validate the descriptor and return it normalized. No other key is accepted: the identity is derived, so there is nothing to declare it with. */
+export function resolveAuthenticodeDescriptor(descriptor, label = "development.targets.win.install") {
+  if (!descriptor || typeof descriptor !== "object" || Array.isArray(descriptor)) refuse("TAURI_AUTHENTICODE_CONFIG", `${label} must be an object`);
+  const unknown = Object.keys(descriptor).filter((key) => !KEYS.has(key));
+  if (unknown.length) refuse("TAURI_AUTHENTICODE_CONFIG", `${label} has unknown key(s): ${unknown.join(", ")} (allowed: ${[...KEYS].join(", ")}). The signer is the product's one identity (${SIGN_SUBJECT}); it is never declared`);
+  if (descriptor.kind !== TAURI_AUTHENTICODE_KIND) refuse("TAURI_AUTHENTICODE_CONFIG", `${label}.kind must be ${TAURI_AUTHENTICODE_KIND}`);
+  for (const key of ["productName", "targetTriple", "expectedInstalledPath"]) if (typeof descriptor[key] !== "string" || !descriptor[key].trim()) refuse("TAURI_AUTHENTICODE_CONFIG", `${label}.${key} is required`);
+  if (!/-pc-windows-msvc$/.test(descriptor.targetTriple)) refuse("TAURI_AUTHENTICODE_CONFIG", `${label}.targetTriple must be a windows msvc triple, got ${descriptor.targetTriple}`);
+  if (typeof descriptor.manifestPath !== "string" || !descriptor.manifestPath.trim()) refuse("TAURI_AUTHENTICODE_CONFIG", `${label}.manifestPath is required (the Tauri manifest, to find the build output)`);
+  relativeInside(descriptor.manifestPath, `${label}.manifestPath`);
+  if (descriptor.tauriCwd !== undefined) relativeInside(descriptor.tauriCwd, `${label}.tauriCwd`);
+  const sidecars = descriptor.sidecars ?? [];
+  if (!Array.isArray(sidecars)) refuse("TAURI_AUTHENTICODE_CONFIG", `${label}.sidecars must be a list of paths relative to the build's output directory`);
+  return { ...descriptor, sidecars: sidecars.map((item, index) => relativeInside(item, `${label}.sidecars[${index}]`)) };
+}
+
+/**
+ * The build must not bundle: a `tauri build` that also bundles would embed the unsigned exe in the installer. Every Tauri build of the target needs
+ * `--no-bundle` and none names `--bundles`; a `--config` that sets the identifier is refused. `readFile(rel)` reads an app-relative file (text or null).
+ */
+export function validateAuthenticodeBuild(build, label = "development.targets.win.build", readFile = () => null) {
+  let builds = 0;
+  (Array.isArray(build) ? build : []).forEach((step, index) => {
+    if (!isProductBuildStep(step)) return;
+    const words = stepWords(step);
+    const at = `${label}[${index}]`;
+    const tauriBuild = words.some((word) => word === "tauri") && words.includes("build");
+    if (words.includes("bundle")) refuse("TAURI_AUTHENTICODE_BUILD", `${at} runs \`tauri bundle\`; the bundle is this install kind's own step 4, after the exe is signed`);
+    if (tauriBuild) {
+      builds += 1;
+      if (!words.includes("--no-bundle") || words.includes("--bundles") || words.some((word) => word.startsWith("--bundles="))) refuse("TAURI_AUTHENTICODE_BUILD", `${at} must be \`tauri build --no-bundle\` (and name no --bundles): bundling here would embed the unsigned exe in the installer`);
+    }
+    const override = identifierOverrideReason(step, readFile);
+    if (override) refuse("TAURI_AUTHENTICODE_BUILD", `${at}: ${override}`);
+  });
+  if (!builds) refuse("TAURI_AUTHENTICODE_BUILD", `${label} has no \`tauri build --no-bundle\` step: this install kind signs the raw exe the build leaves in its output directory`);
+}
+
+/** The carried bundle command (step 4): the same Tauri bundle the release makes, debug profile, no Tauri-side signing (the installer is signed by step 6). */
+export function authenticodeBundleCommand(descriptor) {
+  const override = { bundle: { createUpdaterArtifacts: false, windows: { signCommand: null } } };
+  return { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--debug", "--target", descriptor.targetTriple, "--config", JSON.stringify(override)], ...(descriptor.tauriCwd ? { cwd: descriptor.tauriCwd } : {}), name: "tauri bundle" };
+}
+
+const exeBase = (name) => String(name).replace(/\.exe$/i, "");
+const readJson = (readFile, file) => { const text = readFile(file); if (text === null || text === undefined) return null; try { return JSON.parse(text); } catch (error) { return refuse("TAURI_AUTHENTICODE_CONFIG", `${file} is not valid JSON: ${error.message}`); } };
+const readText = (file) => (existsSync(file) ? readFileSync(file, "utf8") : null);
+const isFile = (file) => existsSync(file) && statSync(file).isFile() && statSync(file).size > 0;
+
+/** The `tauri.conf.json` directory: the Tauri manifest's directory under `appRoot`, else the parent of the build's `target/` ancestor. */
+function resolveTauriDir({ descriptor, debugDir, appRoot }) {
+  if (appRoot) return path.dirname(path.resolve(appRoot, descriptor.manifestPath));
+  let dir = path.resolve(debugDir);
+  while (path.dirname(dir) !== dir) { if (path.basename(dir) === "target") return path.dirname(dir); dir = path.dirname(dir); }
+  return refuse("TAURI_AUTHENTICODE_CONFIG", `cannot find the Tauri directory from ${debugDir}: pass appRoot`);
+}
+
+/** The sidecar names the release's config.sidecars (right-release.config.mjs `sidecars`) stages as Tauri externalBin for Windows. */
+export function configSidecarNames(releaseConfig) {
+  const raw = releaseConfig?.sidecars;
+  const list = Array.isArray(raw) ? raw : Array.isArray(raw?.sidecars) ? raw.sidecars : [];
+  const names = [];
+  for (const item of list) {
+    if (!item || typeof item !== "object" || !["cargo-bin", "command", "remote", "cmake", "prebuilt"].includes(item.kind)) continue;
+    if (Array.isArray(item.platforms) && !item.platforms.includes("win")) continue;
+    if (item.kind === "command" && item.externalBin === false) continue;
+    const name = item.name ?? item.bin ?? item.package;
+    if (typeof name === "string" && name) names.push(exeBase(name));
+  }
+  return names;
+}
+
+/**
+ * The required sidecar set, derived from `bundle.externalBin` (tauri.windows.conf.json replaces tauri.conf.json's list, as Tauri merges it) and
+ * `config.sidecars`. A declared `install.sidecars` list must EQUAL the derived set, refused in either direction; with no list the derived set stands.
+ * Each sidecar has up to two copies: the build output (`debugDir/<name>.exe`, tauri-build's copy) and the bundler source
+ * (`<tauriDir>/<externalBin>-<triple>.exe`, which `tauri bundle` reads). Both are signed; the payload must match one of them.
+ */
+export function deriveRequiredSidecars({ descriptor, debugDir, tauriDir, releaseConfig, readFile = readText }) {
+  const derived = new Map();
+  const add = (name, { bundlerSource, buildOutput }) => {
+    const key = name.toLowerCase();
+    const entry = derived.get(key) ?? { name, file: `${name}.exe`, candidates: [] };
+    for (const [role, file] of [["build-output", buildOutput], ["bundler-source", bundlerSource]]) if (file && !entry.candidates.some((c) => c.path === file)) entry.candidates.push({ role, path: file });
+    derived.set(key, entry);
+  };
+  const base = readJson(readFile, path.join(tauriDir, "tauri.conf.json"));
+  const windows = readJson(readFile, path.join(tauriDir, "tauri.windows.conf.json"));
+  if (!base && !windows) refuse("TAURI_AUTHENTICODE_CONFIG", `no tauri.conf.json under ${tauriDir}: the sidecar set cannot be derived`);
+  const externalBin = windows?.bundle?.externalBin ?? base?.bundle?.externalBin ?? [];
+  if (!Array.isArray(externalBin)) refuse("TAURI_AUTHENTICODE_CONFIG", "bundle.externalBin must be a list");
+  for (const item of externalBin) {
+    const rel = relativeInside(item, "bundle.externalBin entry");
+    const name = exeBase(path.posix.basename(rel));
+    add(name, { bundlerSource: path.join(tauriDir, ...rel.split("/").slice(0, -1), `${name}-${descriptor.targetTriple}.exe`), buildOutput: path.join(debugDir, `${name}.exe`) });
+  }
+  for (const name of configSidecarNames(releaseConfig)) add(name, { bundlerSource: path.join(tauriDir, "binaries", `${name}-${descriptor.targetTriple}.exe`), buildOutput: path.join(debugDir, `${name}.exe`) });
+  if (descriptor.sidecars.length) {
+    const listed = new Map(descriptor.sidecars.map((item) => [exeBase(path.posix.basename(item)).toLowerCase(), item]));
+    for (const [key, entry] of derived) if (!listed.has(key)) refuse("TAURI_AUTHENTICODE_SIDECAR_UNLISTED", `sidecar ${entry.name} is derived from bundle.externalBin / config.sidecars but install.sidecars leaves it out`, { sidecar: entry.name });
+    for (const [key, item] of listed) if (!derived.has(key)) refuse("TAURI_AUTHENTICODE_SIDECAR_UNDERIVED", `install.sidecars lists ${item}, which neither bundle.externalBin nor config.sidecars declares`, { sidecar: item });
+    for (const [key, item] of listed) add(derived.get(key).name, { buildOutput: path.resolve(debugDir, item) });
+  }
+  const sidecars = [...derived.values()];
+  for (const sidecar of sidecars) {
+    sidecar.copies = sidecar.candidates.filter((c) => isFile(c.path));
+    if (!sidecar.copies.length) refuse("TAURI_AUTHENTICODE_SIDECAR_MISSING", `sidecar ${sidecar.name} is in neither the build output nor the bundler source (${sidecar.candidates.map((c) => c.path).join(", ")})`, { sidecar: sidecar.name });
+  }
+  return sidecars;
+}
+
+const isPlainObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const mergePatch = (base, over) => {
+  if (over === undefined) return base;
+  if (isPlainObject(base) && isPlainObject(over)) {
+    const out = { ...base };
+    for (const [key, value] of Object.entries(over)) { if (value === null) delete out[key]; else out[key] = mergePatch(base[key], value); }
+    return out;
+  }
+  return over;
+};
+const globRegex = (segment) => new RegExp(`^${segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`, "i");
+const collectExecutables = (dir, rel = "") => {
+  const found = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const next = rel ? `${rel}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) found.push(...collectExecutables(path.join(dir, entry.name), next));
+    else if (/\.exe$/i.test(entry.name)) found.push({ abs: path.join(dir, entry.name), rel: next });
+  }
+  return found;
+};
+
+/**
+ * Every `.exe` the installer ships as a resource, from `bundle.resources` (base and windows config merged as Tauri does): a list of paths, or a map
+ * of source to destination. Sources may be a file, a directory (searched recursively) or a glob (`*`, `?`, `**` segments). Only existing files count.
+ * Release signs every executable the installer wraps (win-package-recipe.mjs sign-raw), so a resource executable carries the same identity here.
+ * Each returned entry is `{ name, file, installRel, copies: [{ role: "resource", path }] }`; `installRel` is its path under the install directory.
+ */
+export function deriveResourceExecutables({ tauriDir, readFile = readText }) {
+  const base = readJson(readFile, path.join(tauriDir, "tauri.conf.json"));
+  const windows = readJson(readFile, path.join(tauriDir, "tauri.windows.conf.json"));
+  const resources = mergePatch(base?.bundle?.resources, windows?.bundle?.resources);
+  if (resources === undefined || resources === null) return [];
+  const pairs = Array.isArray(resources)
+    ? resources.map((src) => [src, null])
+    : isPlainObject(resources) ? Object.entries(resources) : refuse("TAURI_AUTHENTICODE_CONFIG", "bundle.resources must be a list or a map");
+  const found = new Map();
+  for (const [src, destValue] of pairs) {
+    const source = String(src).replaceAll("\\", "/").replace(/^\.\//, "");
+    const segments = source.split("/");
+    const wild = segments.findIndex((segment) => /[*?]/.test(segment));
+    const prefixSegments = wild === -1 ? segments : segments.slice(0, wild);
+    const prefix = path.resolve(tauriDir, ...prefixSegments);
+    const hits = [];
+    const walk = (dir, rest, rel) => {
+      if (!existsSync(dir) || !statSync(dir).isDirectory()) return;
+      const [head, ...tail] = rest;
+      if (head === undefined) { for (const item of collectExecutables(dir)) hits.push({ abs: item.abs, rel: rel ? `${rel}/${item.rel}` : item.rel }); return; }
+      if (head === "**") { walk(dir, tail, rel); for (const entry of readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) walk(path.join(dir, entry.name), rest, rel ? `${rel}/${entry.name}` : entry.name); return; }
+      const matcher = globRegex(head);
+      for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (!matcher.test(entry.name)) continue;
+        const next = rel ? `${rel}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) walk(path.join(dir, entry.name), tail.length ? tail : [], next);
+        else if (tail.length === 0 && /\.exe$/i.test(entry.name)) hits.push({ abs: path.join(dir, entry.name), rel: next });
+      }
+    };
+    if (wild !== -1) walk(prefix, segments.slice(wild), "");
+    else if (existsSync(prefix) && statSync(prefix).isDirectory()) walk(prefix, [], "");
+    else if (/\.exe$/i.test(prefix) && isFile(prefix)) hits.push({ abs: prefix, rel: path.posix.basename(source) });
+    const isDir = wild !== -1 || (existsSync(prefix) && statSync(prefix).isDirectory());
+    for (const hit of hits) {
+      let dest;
+      if (destValue === null || destValue === undefined) dest = source.replaceAll("../", "_up_/");
+      else if (isDir || String(destValue).endsWith("/")) dest = `${String(destValue).replace(/\/+$/, "")}${destValue === "" ? "" : "/"}${isDir ? hit.rel : path.posix.basename(source)}`;
+      else dest = String(destValue);
+      dest = dest.replaceAll("\\", "/").replace(/^\.?\//, "");
+      if (destValue === null || destValue === undefined) dest = isDir ? `${dest.replace(/\/+$/, "")}/${hit.rel}`.replace(/^\/+/, "") : dest;
+      if (!isFile(hit.abs) || found.has(hit.abs.toLowerCase())) continue;
+      found.set(hit.abs.toLowerCase(), { name: dest, file: path.posix.basename(dest), installRel: dest, kind: "resource", copies: [{ role: "resource", path: hit.abs }] });
+    }
+  }
+  return [...found.values()];
+}
+
+/** `Map(file -> "tracked" | "ignored" | "unignored")` through git: `ls-files --error-unmatch` for tracked, then the commit's own ignore rules (stage-ledger.mjs neutralIgnored). Throws when git cannot answer. */
+export function classifyStagedFiles(files, { appRoot, tauriDir }) {
+  const out = new Map();
+  for (const file of files) {
+    const dir = path.dirname(path.resolve(file));
+    const top = spawnSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true });
+    if (top.status !== 0) refuse("TAURI_AUTHENTICODE_TRACKED_RESOURCE", `cannot tell whether ${file} is tracked: git rev-parse failed under ${appRoot ?? tauriDir}`, { file });
+    const root = String(top.stdout).trim();
+    const rel = path.relative(root, path.resolve(file)).split(path.sep).join("/");
+    const tracked = spawnSync("git", ["-C", root, "ls-files", "--error-unmatch", "--", rel], { encoding: "utf8", windowsHide: true });
+    if (tracked.status === 0) { out.set(file, "tracked"); continue; }
+    if (tracked.status !== 1) refuse("TAURI_AUTHENTICODE_TRACKED_RESOURCE", `cannot tell whether ${file} is tracked: git ls-files exited ${tracked.status}`, { file });
+    out.set(file, neutralIgnored({ dir: root, paths: [rel] }).has(rel) ? "ignored" : "unignored");
+  }
+  return out;
+}
+
+/**
+ * Steps 2 to 8 (step 1, the build, has run). `debugDir` is the build's output directory holding the raw exe. `appRoot` (to find the Tauri directory;
+ * else derived from `debugDir`'s `target/` ancestor) and `releaseConfig` (for config.sidecars) feed the sidecar derivation. deps:
+ *   patchMarker(file) signWindows(files) -> evidence[] verifyWindows(files) -> evidence[] bundle(command) findInstaller() -> path
+ *   listPayload(installer) -> [{ name }]  verifyPayload({ installer, entryName, expectedSha256 })  install(installer)  installedExe() -> path
+ *   classifyStaged(files) -> Map(file -> tracked|ignored|unignored)  installedSidecar(file) -> path (default: next to the installed exe)  readFile(path) -> text | null
+ * Returns `{ order, exe, installer, installed, payload, sidecars, signing }`; `signing` records the sha256 of each signed file before and after.
+ */
+export function installTauriAuthenticode({ descriptor: raw, debugDir, appRoot, releaseConfig, deps = {} }) {
+  const descriptor = resolveAuthenticodeDescriptor(raw);
+  const order = [];
+  const step = (name, run) => { order.push(name); return run(); };
+  const exe = path.join(debugDir, path.basename(descriptor.expectedInstalledPath));
+  if (!existsSync(exe) || !statSync(exe).isFile() || statSync(exe).size === 0) refuse("TAURI_AUTHENTICODE_BUILD_MISSING", `the build left no ${path.basename(exe)} in ${debugDir}`);
+  const tauriDir = resolveTauriDir({ descriptor, debugDir, appRoot });
+  const sidecars = [...deriveRequiredSidecars({ descriptor, debugDir, tauriDir, releaseConfig, readFile: deps.readFile }), ...deriveResourceExecutables({ tauriDir, readFile: deps.readFile })];
+  const patchMarker = deps.patchMarker ?? ((file) => patchTauriBundleType(file, { bundle: "nsis" }));
+  const verifyPayload = deps.verifyPayload ?? verifyNsisEmbeddedBinary;
+  const listPayload = deps.listPayload ?? ((installer) => listNsisPayload(installer));
+  const sidecarNames = new Set(sidecars.map((sidecar) => sidecar.file.toLowerCase()));
+  const recorded = (evidence, files) => {
+    if (!Array.isArray(evidence) || evidence.length !== files.length) refuse("TAURI_AUTHENTICODE_SIGN", `the signer returned ${Array.isArray(evidence) ? evidence.length : "no"} record(s) for ${files.length} file(s)`);
+    evidence.forEach((item) => {
+      if (item.subject === SIGN_SUBJECT && item.authenticode === "Valid") return;
+      const code = sidecarNames.has(path.basename(String(item.file)).toLowerCase()) ? "TAURI_AUTHENTICODE_SIDECAR_UNSIGNED" : "TAURI_AUTHENTICODE_SIGN";
+      refuse(code, `${item.file}: signer subject ${JSON.stringify(item.subject)} / ${JSON.stringify(item.authenticode)}, expected ${SIGN_SUBJECT} / Valid`);
+    });
+    return evidence;
+  };
+  // Signing a copy in place rewrites it. A copy outside the build's output directory (src-tauri/binaries, src-tauri/resources) must be a git-ignored stage output
+  // (the gate's stage-output ledger records it); a TRACKED one would change the commit's tree, so it is refused before anything is signed.
+  const inPlace = sidecars.flatMap((sidecar) => sidecar.copies.map((copy) => copy.path)).filter((file) => path.relative(path.resolve(debugDir), path.resolve(file)).startsWith(".."));
+  const classify = deps.classifyStaged ?? classifyStagedFiles;
+  const classes = inPlace.length ? classify(inPlace, { appRoot, tauriDir }) : new Map();
+  for (const file of inPlace) {
+    const kind = classes.get(file) ?? classes.get(path.resolve(file));
+    if (kind === "tracked") refuse("TAURI_AUTHENTICODE_TRACKED_RESOURCE", `${file} is tracked by git, and signing it in place would change the commit's tree: stage it (or git-ignore it) the way release stages it`, { file });
+    if (kind !== "ignored") refuse("TAURI_AUTHENTICODE_TRACKED_RESOURCE", `${file} is not a git-ignored stage output (${kind ?? "unknown"}): it cannot be signed in place`, { file, state: kind ?? "unknown" });
+  }
+  // 2. The marker reaches its final value before any byte is signed.
+  step("patch-marker", () => patchMarker(exe));
+  // 3. Sign and verify the exe and every copy of every sidecar, and record each digest.
+  const signedFiles = [exe, ...sidecars.flatMap((sidecar) => sidecar.copies.map((copy) => copy.path))];
+  const signedExe = step("sign-exe", () => {
+    const signed = recorded(deps.signWindows(signedFiles), signedFiles);
+    recorded(deps.verifyWindows(signedFiles), signedFiles);
+    return signed;
+  });
+  const signedSha = sha256(exe);
+  for (const sidecar of sidecars) {
+    sidecar.digests = new Set();
+    for (const copy of sidecar.copies) {
+      const record = signedExe.find((item) => path.resolve(item.file) === path.resolve(copy.path));
+      copy.sha256After = record?.after?.sha256;
+      if (!copy.sha256After || copy.sha256After !== sha256(copy.path)) refuse("TAURI_AUTHENTICODE_SIDECAR_STALE", `${copy.path}: the signer recorded sha256After ${copy.sha256After}, the file is ${sha256(copy.path)}`, { sidecar: sidecar.name });
+      sidecar.digests.add(copy.sha256After);
+    }
+  }
+  // 4. The carried bundle; a signed copy that changed since signing is stale.
+  step("bundle", () => deps.bundle(authenticodeBundleCommand(descriptor)));
+  for (const sidecar of sidecars) for (const copy of sidecar.copies) if (!isFile(copy.path) || sha256(copy.path) !== copy.sha256After) refuse("TAURI_AUTHENTICODE_SIDECAR_STALE", `${copy.path} changed after it was signed (signed ${copy.sha256After})`, { sidecar: sidecar.name });
+  const installer = deps.findInstaller();
+  // 5. The installer must embed the signed exe and each signed sidecar (the bundler's copy or the build output's), byte for byte, and no other executable.
+  const payload = step("check-payload", () => {
+    const main = verifyPayload({ installer, entryName: path.basename(exe), expectedSha256: signedSha });
+    const embedded = sidecars.map((sidecar) => {
+      const failures = [];
+      for (const digest of sidecar.digests) {
+        try { return { name: sidecar.name, ...verifyPayload({ installer, entryName: sidecar.file, expectedSha256: digest }) }; } catch (error) { failures.push(error.message); }
+      }
+      return refuse(failures.every((message) => /does not embed/.test(message)) ? "TAURI_AUTHENTICODE_SIDECAR_STALE" : "TAURI_AUTHENTICODE_PAYLOAD", `the installer does not carry the signed ${sidecar.file}: ${failures.join("; ")}`, { sidecar: sidecar.name });
+    });
+    const known = new Set([path.basename(exe).toLowerCase(), ...sidecarNames]);
+    for (const entry of listPayload(installer)) {
+      const name = String(entry.name).replaceAll("\\", "/");
+      const leaf = path.posix.basename(name).toLowerCase();
+      if (!leaf.endsWith(".exe") || name.startsWith("$PLUGINSDIR") || leaf === "uninstall.exe" || known.has(leaf)) continue;
+      refuse("TAURI_AUTHENTICODE_PAYLOAD_UNSIGNED_EXECUTABLE", `the installer carries an executable that is not signed here: ${entry.name}`, { entry: entry.name });
+    }
+    return { ...main, sidecars: embedded };
+  });
+  // 6. Sign and verify the installer.
+  const signedInstaller = step("sign-installer", () => {
+    const signed = recorded(deps.signWindows([installer]), [installer]);
+    recorded(deps.verifyWindows([installer]), [installer]);
+    return signed;
+  });
+  // 7. Install (only now), then 8. verify what was installed: the exe and each sidecar, by signature and by digest.
+  step("install", () => deps.install(installer));
+  const installed = deps.installedExe();
+  const installedSidecars = sidecars.map((sidecar) => ({ sidecar, path: deps.installedSidecar ? deps.installedSidecar(sidecar.file, sidecar) : path.join(path.dirname(installed), sidecar.installRel ?? sidecar.file) }));
+  for (const item of installedSidecars) if (!isFile(item.path)) refuse("TAURI_AUTHENTICODE_SIDECAR_MISSING", `sidecar ${item.sidecar.name} is not installed at ${item.path}`, { sidecar: item.sidecar.name });
+  const installedFiles = [installed, ...installedSidecars.map((item) => item.path)];
+  step("verify", () => recorded(deps.verifyWindows(installedFiles), installedFiles));
+  for (const item of installedSidecars) {
+    item.sha256 = sha256(item.path);
+    if (!item.sidecar.digests.has(item.sha256)) refuse("TAURI_AUTHENTICODE_SIDECAR_STALE", `installed ${item.path} (sha256 ${item.sha256}) is not the signed ${item.sidecar.file}`, { sidecar: item.sidecar.name });
+  }
+  return {
+    order, exe, installer, installed, payload,
+    // In-place signed stage outputs (git-ignored): the gate's ledger walk attributes them from `files` (stage-ledger.mjs reportedPaths); paths are absolute here, the caller makes them app-relative.
+    stageOutputs: { files: inPlace.map((file) => ({ path: file.replaceAll("\\", "/"), kind: "signed-in-place", sha256: sha256(file) })) },
+    sidecars: installedSidecars.map((item) => ({ name: item.sidecar.name, copies: item.sidecar.copies.map((copy) => ({ role: copy.role, path: copy.path, sha256After: copy.sha256After })), installed: { path: item.path, sha256: item.sha256 } })),
+    signing: { subject: SIGN_SUBJECT, files: [...signedExe, ...signedInstaller].map((item) => ({ file: item.file, sha256Before: item.before?.sha256, sha256After: item.after?.sha256, subject: item.subject })) },
+  };
+}

package/ios-dev.mjs

@@ -13,13 +13,19 @@
 //           | { kind: "device",     device: "<devicectl identifier>", bundleId, productName?, launch?: true, launchArgs?: [] },
 //   }
 // The build commands are generated from the config (a hand-written `build` is refused). The device is chosen by id only, never
-// "the only device": `install.device`, `--serial` or RIGHTKIT_IOS_DEVICE. DerivedData comes from `rustright storage xcode-args`.
+// "the only device": `install.device`, `--serial` or RIGHTKIT_IOS_DEVICE.
+//
+// RA-09 / R3-M02: xcodegen and every xcodebuild call (build, build-for-testing, test-without-building) are typed native adapter jobs of the production runner (build-launch.mjs createNativeRunner,
+// `runIosDevelopmentCommands`): no -derivedDataPath, -resultBundlePath, -archivePath or -exportPath is ever named (the broker owns the output root), and the built .app and the result bundle are READ
+// BACK from the verified receipt's managed output roles (`derived-data`, `result-bundle`). A call the door or the broker's grammar refuses (no runner route, an unadvertised capability, an argv with
+// no managed form) is refused before anything is launched; there is no spawn fallback. simctl, devicectl and the app's own non-native `prepare` commands stay direct, non-compiling steps.
 import * as nodeFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { assertGuiSigningSession, IosHostError, outputTail, resolveXcodeStorage } from "./ios-host.mjs";
+import { assertGuiSigningSession, IosHostError, outputTail } from "./ios-host.mjs";
 import { SECRET_VALUE } from "./ios-package-recipe.mjs";
+import { NATIVE_STATE_LEAVES, nativeStateDir, nativeToolOf } from "./native-adapters.mjs";
 
 export class IosDevelopmentError extends Error {
   constructor(code, message) { super(message); this.name = "IosDevelopmentError"; this.code = code; }
@@ -117,14 +123,14 @@ export function validateIosDevelopment(target, { root, env = process.env } = {})
     uiTests = { scheme: t.scheme ?? target.scheme, ...(t.testPlan ? { testPlan: t.testPlan } : {}), onlyTesting: [...t.onlyTesting] };
   }
   const normalized = { project, projectSpec, scheme: target.scheme, configuration, teamId: target.teamId, extraBuildSettings, prepare, install, uiTests };
-  return { ...normalized, build: iosDevelopmentBuildCommands(normalized, { root, storage: { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>" }) };
+  return { ...normalized, build: iosDevelopmentBuildCommands(normalized, { root, destinationId: "<device or simulator id>" }) };
 }
 
 const destinationFor = (install, id) => (install?.kind === "device" ? `id=${id}` : `platform=iOS Simulator,id=${id}`);
 export const productsDirectory = (dev) => `${dev.configuration}-${dev.install?.kind === "device" ? "iphoneos" : "iphonesimulator"}`;
 
-/** Pure: the generated argv commands, in order. No secret is ever part of them. */
-export function iosDevelopmentBuildCommands(dev, { root, storage, destinationId }) {
+/** Pure: the generated argv commands, in order. No secret is ever part of them, and none names where a build writes (the broker's xcodebuild adapter owns the output root). */
+export function iosDevelopmentBuildCommands(dev, { root, destinationId }) {
   const commands = [];
   if (dev.projectSpec) commands.push({ cmd: "xcodegen", args: ["generate", "--spec", path.resolve(root, dev.projectSpec), "--project", path.resolve(root, path.posix.dirname(dev.project))], name: "xcodegen generate" });
   for (const step of dev.prepare) commands.push({ ...step, name: step.cmd });
@@ -137,8 +143,7 @@ export function iosDevelopmentBuildCommands(dev, { root, storage, destinationId
       "-scheme", dev.scheme,
       "-configuration", dev.configuration,
       "-destination", dev.install ? destinationFor(dev.install, destinationId) : "generic/platform=iOS Simulator",
-      "-derivedDataPath", storage.derivedData,
-      ...(storage.resultBundle ? ["-resultBundlePath", storage.resultBundle] : []),
+      // GB-51 / RA-09: the xcodebuild ADAPTER owns where the build writes (the one managed output root, named by the signed receipt): the step names no -derivedDataPath or -resultBundlePath.
       ...(dev.teamId ? [`DEVELOPMENT_TEAM=${dev.teamId}`] : []),
       ...Object.entries(dev.extraBuildSettings).map(([name, value]) => `${name}=${value}`),
       ...(device ? ["-allowProvisioningUpdates", "-allowProvisioningDeviceRegistration"] : []),
@@ -215,11 +220,11 @@ function listDevices({ run, fs, tmpRoot }) {
 }
 
 /**
- * Resolve the storage, the device or simulator and the final build commands BEFORE the (long) build, so a missing or
- * unready device is refused up front. Returns { build, install } with install carrying the resolved id and the .app path.
+ * Resolve the device or simulator and the final build commands BEFORE the (long) build, so a missing or unready device is refused up front.
+ * Returns { build, brokerOwned, install } with install carrying the resolved id. The built .app is known only after the build, from the verified
+ * receipt's managed `derived-data` role (`iosDevelopmentApp`, or `appFromOutputDir` for a caller that holds the job's output directory).
  */
 export function prepareIosDevelopment(dev, { root, env = process.env, run = spawnSync, fs = nodeFs, serial, tmpRoot = os.tmpdir() }) {
-  const storage = resolveXcodeStorage({ env, run, cwd: root, fallbackRoot: path.join(root, ".right-release", "ios-dev") });
   let resolved = null;
   if (dev.install) {
     const wanted = iosDevelopmentDevice({ descriptor: dev.install, serial, env });
@@ -231,9 +236,21 @@ export function prepareIosDevelopment(dev, { root, env = process.env, run = spaw
       resolved = { id: device.identifier, detail: device.detail };
     }
   }
-  const build = iosDevelopmentBuildCommands(dev, { root, storage, destinationId: resolved?.id });
-  const app = dev.install ? path.join(storage.derivedData, "Build", "Products", productsDirectory(dev), `${dev.install.productName}.app`) : null;
-  return { build, storage, install: dev.install ? { ...dev.install, resolved, app } : null };
+  const build = iosDevelopmentBuildCommands(dev, { root, destinationId: resolved?.id });
+  const appUnder = (derivedData) => path.join(derivedData, "Build", "Products", productsDirectory(dev), `${dev.install.productName}.app`);
+  // The managed DerivedData of a job's output directory for a call run in `relativeCwd` (snapshot-relative; "" for the snapshot root).
+  const appFromOutputDir = (outputDir, { relativeCwd = "" } = {}) => appUnder(path.join(nativeStateDir(outputDir, "xcodebuild", relativeCwd), NATIVE_STATE_LEAVES.derivedData));
+  return { build, brokerOwned: true, ...(dev.install ? { appFromOutputDir } : {}), install: dev.install ? { ...dev.install, resolved, app: null } : null };
+}
+
+/**
+ * The built .app of a dev build, from the managed outputs of the xcodebuild call that built it (`result.outputs` of the native runner, role `derived-data`). Refuses when the
+ * broker did not report the location: a broker-owned build's output is never guessed.
+ */
+export function iosDevelopmentApp(dev, outputs) {
+  const derived = outputs?.ok === true ? outputs.byRole?.["derived-data"] : undefined;
+  if (typeof derived !== "string" || !path.isAbsolute(derived)) refuse("DEV_IOS_OUTPUT_UNKNOWN", `the broker did not report the managed derived-data location (${outputs?.ok === false ? outputs.problem : "no verified output directory"}), so there is no built app to install`);
+  return path.join(derived, "Build", "Products", productsDirectory(dev), `${dev.install.productName}.app`);
 }
 
 // App arguments follow a "--" terminator so an argument such as --device or --json-output is passed to the app and can never be
@@ -242,10 +259,11 @@ const launchTail = (args) => (args.length ? ["--", ...args] : []);
 
 // ---- UI test journeys -------------------------------------------------------------------------------------------
 /**
- * Pure: `xcodebuild build-for-testing` then `test-without-building` of the declared journeys on the resolved device or simulator,
- * with the same project, configuration, signing and derived data as the dev build. The result bundle is a fresh path per run.
+ * Pure: `xcodebuild build-for-testing` then `test-without-building` of the declared journeys on the resolved device or simulator, with the same project, configuration and
+ * signing. Both calls run in the same directory, so the broker's managed DerivedData is shared between them; the result bundle is the broker's run-unique `result-bundle` role
+ * of the test call (no -derivedDataPath or -resultBundlePath is named). The test plan and each selection are admitted shapes (`-testPlan <name>`, `-only-testing:Target[/Class[/test]]`).
  */
-export function iosUiTestCommands(dev, { root, storage, destinationId, resultBundle }) {
+export function iosUiTestCommands(dev, { root, destinationId }) {
   if (!dev.uiTests) throw new Error("development.targets.ios.uiTests is not declared");
   const device = dev.install?.kind === "device";
   const common = [
@@ -254,23 +272,59 @@ export function iosUiTestCommands(dev, { root, storage, destinationId, resultBun
     ...(dev.uiTests.testPlan ? ["-testPlan", dev.uiTests.testPlan] : []),
     "-configuration", dev.configuration,
     "-destination", destinationFor(dev.install, destinationId),
-    "-derivedDataPath", storage.derivedData,
     ...(dev.teamId ? [`DEVELOPMENT_TEAM=${dev.teamId}`] : []),
     ...Object.entries(dev.extraBuildSettings).map(([name, value]) => `${name}=${value}`),
     ...(device ? ["-allowProvisioningUpdates", "-allowProvisioningDeviceRegistration"] : []),
   ];
   return [
     { cmd: "xcodebuild", name: "xcodebuild build-for-testing", args: [...common, "build-for-testing"] },
-    { cmd: "xcodebuild", name: "xcodebuild test-without-building", args: [...common, "-resultBundlePath", resultBundle, ...dev.uiTests.onlyTesting.map((x) => `-only-testing:${x}`), "test-without-building"] },
+    { cmd: "xcodebuild", name: "xcodebuild test-without-building", args: [...common, ...dev.uiTests.onlyTesting.map((x) => `-only-testing:${x}`), "test-without-building"] },
   ];
 }
 
-/** Resolve the device (waking a sleeping tunnel), then the UI test commands; the caller runs them under its lease. */
-export function prepareIosUiTests(dev, { root, env = process.env, run = spawnSync, fs = nodeFs, serial, tmpRoot = os.tmpdir(), now = Date.now }) {
+/** Resolve the device (waking a sleeping tunnel), then the UI test commands; the caller runs them with `runIosDevelopmentCommands` under its lease. */
+export function prepareIosUiTests(dev, { root, env = process.env, run = spawnSync, fs = nodeFs, serial, tmpRoot = os.tmpdir() }) {
   const prepared = prepareIosDevelopment(dev, { root, env, run, fs, serial, tmpRoot });
-  const base = prepared.storage.resultBundle ? path.dirname(prepared.storage.resultBundle) : path.join(root, ".right-release", "ios-dev");
-  const resultBundle = path.join(base, `ui-tests-${now()}.xcresult`);
-  return { ...prepared, resultBundle, tests: iosUiTestCommands(dev, { root, storage: prepared.storage, destinationId: prepared.install.resolved?.id, resultBundle }) };
+  // The result bundle is the broker's run-unique `result-bundle` role of the test call, known only from its outputs (`runIosDevelopmentCommands` returns it); there is no path to choose here.
+  return { ...prepared, resultBundle: null, tests: iosUiTestCommands(dev, { root, destinationId: prepared.install.resolved?.id }) };
+}
+
+// ---- running the generated commands ---------------------------------------------------------------------------------
+/**
+ * Runs generated commands in order through the production native runner (`native`, build-launch.mjs createNativeRunner): xcodegen and xcodebuild are broker adapter jobs and nothing
+ * else runs them. EVERY native command is planned first (the door's launch, the broker's grammar and capability), so a refusal stops the whole sequence before the first launch.
+ * A command that is not a native build tool (the app's own `prepare` commands) goes to `direct(command)` when the caller supplies one and is otherwise refused; it is never given to a
+ * native-tool spawn. Returns { steps: [{ name, result }], outputs } where `outputs` is the LAST xcodebuild call's managed mapping and `resultBundle` the test call's `result-bundle` role.
+ */
+export function runIosDevelopmentCommands(commands, { native, root, env = process.env, direct, log = console.log, timeout } = {}) {
+  if (!native || typeof native.run !== "function" || typeof native.plan !== "function") refuse("DEV_IOS_NATIVE_REQUIRED", "the iOS dev and test builds need the production native runner (build-launch.mjs createNativeRunner); xcodegen and xcodebuild run only as broker adapter jobs");
+  const cwdOf = (command) => path.resolve(root, command.cwd ?? ".");
+  for (const command of commands) {
+    if (nativeToolOf(command.cmd) === null) continue;
+    try { native.plan(command.cmd, command.args, { cwd: cwdOf(command), env }); } catch (error) {
+      if (error?.code === "RK_BUILD_LAUNCH_REFUSED") refuse("DEV_IOS_NATIVE_REFUSED", `${command.name ?? command.cmd} was refused before any launch (${error.reason ?? "refused"}): ${error.message}`);
+      throw error;
+    }
+  }
+  const steps = [];
+  let outputs = null;
+  let resultBundle = null;
+  for (const command of commands) {
+    const name = command.name ?? command.cmd;
+    log(`right-release: ios ${name}`);
+    if (nativeToolOf(command.cmd) === null) {
+      if (typeof direct !== "function") refuse("DEV_IOS_DIRECT_STEP_UNHANDLED", `${name} is not a native build tool and no direct runner was supplied; it is never run as a native-tool spawn`);
+      steps.push({ name, result: direct(command) });
+      continue;
+    }
+    const result = native.run(command.cmd, command.args, { cwd: cwdOf(command), env, ...(timeout ? { timeout } : {}) });
+    steps.push({ name, result });
+    if (result.refusal) refuse("DEV_IOS_NATIVE_REFUSED", `${name} was refused before any launch (${result.refusal.code}): ${result.refusal.message}`);
+    if (!result.ok) refuse("DEV_IOS_BUILD_FAILED", `${name} failed (${result.status ?? "unavailable"})${result.error ? `: ${result.error.message}` : ""}\n${outputTail(result, 20)}`);
+    if (command.cmd === "xcodebuild") outputs = result.outputs;
+    if (result.outputs?.ok === true && typeof result.outputs.byRole?.["result-bundle"] === "string") resultBundle = result.outputs.byRole["result-bundle"];
+  }
+  return { steps, outputs, resultBundle };
 }
 
 // ---- install ------------------------------------------------------------------------------------------------------