@rightkit/release 0.6.8 → 0.6.11

package/rightkit-versions.json

@@ -26,13 +26,13 @@
     "@rightkit/logs": "0.1.6",
     "@rightkit/media-ui": "0.3.4",
     "@rightkit/onboarding": "0.6.3",
-    "@rightkit/outdated": "0.2.0",
+    "@rightkit/outdated": "0.3.0",
     "@rightkit/pdf-ui": "0.2.0",
     "@rightkit/platform-ui": "0.4.0",
-    "@rightkit/qa": "0.6.1",
+    "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.8",
+    "@rightkit/release": "0.6.11",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.3",
@@ -236,7 +236,8 @@
       "0.4.9",
       "0.5.0",
       "0.5.1",
-      "0.5.2"
+      "0.5.2",
+      "0.6.1"
     ],
     "@rightkit/qa-chrome": [
       "0.1.0",
@@ -374,7 +375,10 @@
       "0.6.3",
       "0.6.4",
       "0.6.5",
-      "0.6.6"
+      "0.6.6",
+      "0.6.7",
+      "0.6.8",
+      "0.6.10"
     ],
     "@rightkit/settings-ui": [
       "0.1.0",
@@ -424,6 +428,9 @@
     ],
     "@rightkit/updates": [
       "0.2.4"
+    ],
+    "@rightkit/outdated": [
+      "0.2.0"
     ]
   },
   "cargo": {
@@ -440,6 +447,7 @@
     "rightkit-pdf": "0.1.0",
     "rightkit-playback": "0.1.0",
     "rightkit-process": "0.1.0",
+    "rightkit-qa": "0.9.1",
     "rightkit-search": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
@@ -451,57 +459,57 @@
     "rightkit-asr": "0.3.1",
     "rightkit-audio": "0.3.1",
     "rightkit-automation": "0.6.1",
-    "rightkit-browser": "0.3.6",
+    "rightkit-browser": "0.3.7",
     "rightkit-cache": "0.2.3",
-    "rightkit-channel-memory": "0.2.1",
-    "rightkit-child-process": "0.5.6",
+    "rightkit-channel-memory": "0.2.2",
+    "rightkit-child-process": "0.5.7",
     "rightkit-compose": "0.2.0",
-    "rightkit-contracts": "0.1.7",
+    "rightkit-contracts": "0.1.8",
     "rightkit-crash": "0.3.6",
     "rightkit-credentials": "0.4.2",
     "rightkit-crypto": "0.1.0",
     "rightkit-daemon": "0.4.0",
-    "rightkit-db": "0.5.2",
+    "rightkit-db": "0.5.3",
     "rightkit-device": "0.4.0",
-    "rightkit-docs": "0.1.2",
-    "rightkit-embed": "0.6.1",
+    "rightkit-docs": "0.1.3",
+    "rightkit-embed": "0.6.2",
     "rightkit-ffmpeg": "0.2.11",
-    "rightkit-file-watch": "0.4.1",
+    "rightkit-file-watch": "0.4.2",
     "rightkit-fs": "0.4.7",
-    "rightkit-fsindex": "0.5.0",
+    "rightkit-fsindex": "0.6.0",
     "rightkit-google-identity": "0.2.0",
     "rightkit-hooks": "0.2.0",
     "rightkit-hotkeys": "0.1.2",
-    "rightkit-http": "0.3.8",
+    "rightkit-http": "0.3.9",
     "rightkit-identity": "0.1.0",
     "rightkit-job-queue": "0.5.1",
     "rightkit-license": "0.2.5",
     "rightkit-llm": "0.3.1",
-    "rightkit-logs": "0.3.5",
-    "rightkit-mcp": "0.7.0",
-    "rightkit-models": "0.5.1",
+    "rightkit-logs": "0.3.6",
+    "rightkit-mcp": "0.7.1",
+    "rightkit-models": "0.5.2",
     "rightkit-motion": "0.2.0",
     "rightkit-oauth": "0.10.0",
     "rightkit-ocr": "0.2.3",
     "rightkit-onnx": "0.2.8",
     "rightkit-overlay": "0.2.0",
     "rightkit-overlay-win": "0.1.0",
-    "rightkit-ownership": "0.4.2",
-    "rightkit-pdf": "0.3.3",
+    "rightkit-ownership": "0.4.3",
+    "rightkit-pdf": "0.3.4",
     "rightkit-platform-rules": "0.1.0",
     "rightkit-playback": "0.3.0",
-    "rightkit-qa": "0.9.1",
+    "rightkit-qa": "0.9.2",
     "rightkit-qa-driver": "0.7.0",
     "rightkit-record": "0.3.3",
     "rightkit-review": "0.4.0",
     "rightkit-sandbox": "0.6.1",
-    "rightkit-search": "0.4.0",
-    "rightkit-send": "0.2.0",
+    "rightkit-search": "0.4.1",
+    "rightkit-send": "0.3.0",
     "rightkit-sidecar": "0.3.0",
     "rightkit-speech-client": "0.4.0",
     "rightkit-spend": "0.2.0",
     "rightkit-sync": "0.2.2",
-    "rightkit-tauri-shell": "0.6.0",
+    "rightkit-tauri-shell": "0.7.0",
     "rightkit-time": "0.1.0",
     "rightkit-transcript": "0.4.0",
     "rightkit-tts": "0.2.3",
@@ -537,7 +545,7 @@
       "rightkit-browser": "0.3.6",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
-      "rightkit-child-process": "0.5.6",
+      "rightkit-child-process": "0.5.7",
       "rightkit-compose": "0.2.0",
       "rightkit-contracts": "0.1.7",
       "rightkit-control": "0.3.0",
@@ -579,7 +587,7 @@
       "rightkit-platform-rules": "0.1.0",
       "rightkit-playback": "0.3.0",
       "rightkit-process": "0.4.0",
-      "rightkit-qa": "0.9.0",
+      "rightkit-qa": "0.9.1",
       "rightkit-qa-driver": "0.7.0",
       "rightkit-qts": "0.2.6",
       "rightkit-qts-ggml": "0.1.2",
@@ -626,13 +634,13 @@
       "@rightkit/logs": "0.1.6",
       "@rightkit/media-ui": "0.3.4",
       "@rightkit/onboarding": "0.6.3",
-      "@rightkit/outdated": "0.2.0",
+      "@rightkit/outdated": "0.3.0",
       "@rightkit/pdf-ui": "0.2.0",
       "@rightkit/platform-ui": "0.4.0",
       "@rightkit/qa": "0.6.1",
-      "@rightkit/qa-chrome": "0.1.11",
+      "@rightkit/qa-chrome": "0.1.12",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.6.6",
+      "@rightkit/release": "0.6.10",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
@@ -647,7 +655,8 @@
       "0.2.1",
       "0.3.1",
       "0.4.0",
-      "0.4.1"
+      "0.4.1",
+      "0.4.2"
     ],
     "rightkit-browser": [
       "0.2.0",
@@ -656,7 +665,8 @@
       "0.3.0",
       "0.3.1",
       "0.3.4",
-      "0.3.5"
+      "0.3.5",
+      "0.3.6"
     ],
     "rightkit-models": [
       "0.2.1",
@@ -669,7 +679,8 @@
       "0.3.0",
       "0.3.1",
       "0.3.2",
-      "0.4.4"
+      "0.4.4",
+      "0.5.1"
     ],
     "rightkit-audio": [
       "0.1.0",
@@ -685,7 +696,8 @@
       "0.3.1",
       "0.4.0",
       "0.4.3",
-      "0.5.1"
+      "0.5.1",
+      "0.5.2"
     ],
     "rightkit-embed": [
       "0.2.1",
@@ -695,7 +707,8 @@
       "0.3.2",
       "0.4.0",
       "0.5.0",
-      "0.6.0"
+      "0.6.0",
+      "0.6.1"
     ],
     "rightkit-jobs": [
       "0.2.1",
@@ -715,7 +728,8 @@
       "0.5.1",
       "0.5.2",
       "0.5.3",
-      "0.6.0"
+      "0.6.0",
+      "0.7.0"
     ],
     "rightkit-media": [
       "0.2.2",
@@ -767,7 +781,8 @@
       "0.7.0",
       "0.7.1",
       "0.8.0",
-      "0.9.0"
+      "0.9.0",
+      "0.9.1"
     ],
     "rightkit-sandbox": [
       "0.1.0",
@@ -828,7 +843,8 @@
       "0.3.0",
       "0.3.5",
       "0.3.6",
-      "0.3.7"
+      "0.3.7",
+      "0.3.8"
     ],
     "rightkit-fs": [
       "0.1.0",
@@ -864,7 +880,8 @@
     "rightkit-pdf": [
       "0.1.0",
       "0.3.0",
-      "0.3.2"
+      "0.3.2",
+      "0.3.3"
     ],
     "rightkit-speech-client": [
       "0.3.0",
@@ -893,7 +910,8 @@
       "0.2.0",
       "0.2.1",
       "0.3.0",
-      "0.4.1"
+      "0.4.1",
+      "0.5.0"
     ],
     "rightkit-asr": [
       "0.0.2",
@@ -907,7 +925,8 @@
       "0.2.2",
       "0.3.0",
       "0.3.2",
-      "0.3.3"
+      "0.3.3",
+      "0.3.5"
     ],
     "rightkit-ocr": [
       "0.1.2",
@@ -985,20 +1004,23 @@
       "0.5.2",
       "0.5.3",
       "0.5.4",
-      "0.5.5"
+      "0.5.5",
+      "0.5.6"
     ],
     "rightkit-hotkeys": [
       "0.1.0",
       "0.1.1"
     ],
     "rightkit-channel-memory": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.1"
     ],
     "rightkit-compose": [
       "0.1.0"
     ],
     "rightkit-contracts": [
-      "0.1.5"
+      "0.1.5",
+      "0.1.7"
     ],
     "rightkit-hooks": [
       "0.1.0",
@@ -1062,7 +1084,8 @@
     ],
     "rightkit-docs": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "rightkit-tts-qwen": [
       "0.2.6"
@@ -1072,10 +1095,12 @@
       "0.2.2"
     ],
     "rightkit-send": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ],
     "rightkit-file-watch": [
-      "0.4.0"
+      "0.4.0",
+      "0.4.1"
     ],
     "rightkit-sync": [
       "0.1.1"
@@ -1086,7 +1111,8 @@
       "0.3.3",
       "0.4.0",
       "0.5.0",
-      "0.5.1"
+      "0.5.1",
+      "0.6.0"
     ],
     "rightkit-android": [
       "0.2.0"

package/runtime-budgets.mjs

@@ -251,10 +251,13 @@ const posix = (p) => p.split(path.sep).join("/");
  * The git pathspecs (relative to the workspace root) whose change makes a measurement stale: the
  * crate's src, benches, Cargo.toml (features) and build.rs, plus src, Cargo.toml and build.rs of every
  * workspace crate it reaches through `path` dependencies (transitively). Returns { root, specs, problems }.
+ * Every crate is its own Cargo workspace (rightkit#1285), so `root` is the crate directory (its own Cargo.toml and Cargo.lock)
+ * and a sibling crate's paths are `../<x>/...`. `deps.base` names the directory the specs are relative to (default: the
+ * workspace root); a caller that runs git at the repository root passes it so the specs read crates/<x>/....
  * Callers must refuse incomplete metadata rather than using a partial dependency scope.
  */
 export function measuredPathspecs(crateDir, deps = {}) {
-  const { exists = existsSync, readFile = readFileSync } = deps;
+  const { exists = existsSync, readFile = readFileSync, base } = deps;
   const problems = [];
   // Workspace discovery deliberately tolerates bad ancestor manifests elsewhere. Freshness cannot:
   // a swallowed read/parse failure could hide inherited dependencies and shrink the measured graph.
@@ -271,7 +274,7 @@ export function measuredPathspecs(crateDir, deps = {}) {
   const checked = { exists, readFile: checkedRead };
   let root = path.resolve(crateDir);
   const specs = [];
-  const add = (dir, names) => { for (const name of names) specs.push(posix(path.relative(root, path.join(dir, name)))); };
+  const add = (dir, names) => { for (const name of names) specs.push(posix(path.relative(base ? path.resolve(base) : root, path.join(dir, name)))); };
   try {
     root = findWorkspaceRoot(crateDir, checked) ?? root;
     add(path.resolve(crateDir), CRATE_PATHS);
@@ -365,6 +368,7 @@ export function measurementStaleness(commit, crateDir, git = defaultGit, deps =
     }
   } catch (error) { return `cannot resolve Cargo.lock package identity: ${error.message}`; }
   if (name) {
+    // The crate's own workspace lock: root is the crate directory when the crate is its own workspace (#1285).
     const lockPath = path.join(root, "Cargo.lock");
     let now;
     try { now = exists(lockPath) ? readFile(lockPath, "utf8") : null; }

package/scan-digest.mjs

@@ -54,6 +54,60 @@ export function rustCratePlan(own = {}) {
   return { lintSets, defaultCheck, checkSets };
 }
 
+// ---- Clippy batching (GATE-CONTRACT §1 "Clippy route & batching"; item 8 rows 8.6, 8.8, 8.15) -----------------------------------------
+// Lives here, beside the scan ids, so the credentialed verifiers (requiredScanIds) and the planner (planScans) spell a batch's id from
+// one function. Pure: no file reads.
+
+/** The feature flags that mean the same thing on every package they are applied to: any other set names features of one crate. */
+export const CLIPPY_UNIVERSAL_FEATURE_FLAGS = Object.freeze(["--all-features", "--no-default-features"]);
+const optionValue = (set, names) => {
+  for (let i = 0; i < set.length; i += 1) for (const n of names) { if (set[i] === n) return set[i + 1] ?? null; if (set[i].startsWith(`${n}=`)) return set[i].slice(n.length + 1); }
+  return null;
+};
+/** The target and profile a feature-set argv selects (null: the toolchain's host target and the dev profile). */
+export const clippySelectionOf = (set) => ({ target: optionValue(set, ["--target"]), profile: set.includes("--release") || set.includes("-r") ? "release" : optionValue(set, ["--profile"]) });
+
+/**
+ * Groups the Clippy configurations of a plan into invocations. `entries`: `[{ name, crate, ws, set, count, env }]`, one per crate
+ * and lint feature set (`count` is how many sets the crate declares). Entries are batched when workspace, feature set, target,
+ * profile, lint policy, toolchain and environment are all equal (they share one `-p` list); an entry is its own invocation, with
+ * the reason recorded, when:
+ *  - its crate is in `solo` (ci/shards.json `solo`: a crate that always gets a job of its own);
+ *  - it is in `separate` (a name to a reason): batching changed what compiles for it (feature unification, item 8 row 8.7);
+ *  - its feature set names crate-specific features (anything but --all-features / --no-default-features): such a set is
+ *    per-configuration by construction, for example rightkit-db's SQLCipher variants or rightkit-qa-driver's wv2 generations
+ *    (ci/gate.config.json featureSets);
+ *  - its crate is sidecar-bound: it is scheduled after every independent batch and never joins one.
+ * A batch never widens a package set: it names exactly its members with `-p`. A batch's id is `clippy:batch:[<ws>:]<8 hex>` over its
+ * workspace, feature set, target, profile, lint policy and member list (never the toolchain or the output directory, which a
+ * verifier does not know), so the planner and requiredScanIds agree and the id names exactly the crates it covers. Returns
+ * `{ batches, notes }`; batches are ordered independent first, then sidecar-bound, each group by workspace then key.
+ */
+export function clippyBatchPlan(entries, { solo = [], separate = new Map(), sidecarBound = new Set(), toolchain = null, lint = ["-D", "warnings"] } = {}) {
+  const soloSet = new Set(solo);
+  const groups = new Map();
+  for (const e of entries) {
+    const set = [...e.set];
+    const crate = e.crate ?? e.name;
+    const sel = clippySelectionOf(set);
+    let reason = null;
+    if (soloSet.has(e.name) || soloSet.has(crate)) reason = "ci/shards.json solo: the crate always gets an invocation of its own";
+    else if (separate instanceof Map && separate.has(e.name)) reason = separate.get(e.name);
+    else if (set.some((w) => !CLIPPY_UNIVERSAL_FEATURE_FLAGS.includes(w))) reason = `ci/gate.config.json featureSets names crate-specific features (${set.join(" ")})${e.count > 1 ? `; ${crate} declares ${e.count} feature configurations that are separate invocations by construction` : ""}`;
+    const bound = sidecarBound.has(e.name) || sidecarBound.has(crate);
+    const identity = { ws: e.ws, set, target: sel.target, profile: sel.profile, lint, ...(reason || bound ? { only: e.name, sidecar: bound } : {}) };
+    const key = canonicalJson({ ...identity, toolchain, env: e.env ?? null });
+    if (!groups.has(key)) groups.set(key, { key, identity: canonicalJson(identity), ws: e.ws, set, target: sel.target, profile: sel.profile, units: [], crates: [], reason: reason ?? (bound ? "sidecar-bound: scheduled after its sidecar prerequisite, never batched with independent crates" : null), order: bound ? "sidecar" : "independent" });
+    const g = groups.get(key);
+    g.units.push(e.name); if (!g.crates.includes(crate)) g.crates.push(crate);
+  }
+  const batches = [...groups.values()].map((g) => ({ ...g, units: g.units.sort(), crates: g.crates.sort() })).map((g) => ({ ...g, id: `clippy:batch:${g.ws === "." ? "" : `${g.ws}:`}${sha256(`${g.identity}\0${g.units.join("\0")}`).slice(0, 8)}` }));
+  batches.sort((a, b) => (a.order === b.order ? (a.ws === b.ws ? (a.key < b.key ? -1 : 1) : a.ws < b.ws ? -1 : 1) : a.order === "independent" ? -1 : 1));
+  const notes = batches.filter((b) => b.reason).map((b) => `clippy batching: ${b.units.join(", ")} (${b.set.join(" ") || "default features"}) stays its own invocation: ${b.reason}`);
+  notes.push(`clippy batching: ${entries.length} crate configuration(s) in ${batches.length} invocation(s), each \`-p\` list exactly its members, \`--locked\` and \`--no-deps\` on every one; no batch is \`--workspace\``);
+  return { batches, notes };
+}
+
 /** Scan ids every scan of the whole repository always has when it holds Rust units (cargo.toml, workflows, YAML, JSON and licences). */
 export const WORKSPACE_SCAN_IDS = Object.freeze(["cargo-metadata", "cargo-deny", "cargo-audit", "actionlint", "yaml-parse", "toml-parse", "json-parse", "license", "secret-scan"]);
 /** Prefixes at least one scan id must carry (rustfmt groups by edition, so its exact ids depend on the files). */
@@ -62,25 +116,35 @@ export const REQUIRED_SCAN_PREFIXES = Object.freeze(["rustfmt:"]);
 /**
  * The scan ids a LOCAL scan record must contain, each with status pass, for these publishable Rust `units` ([names], crates/<name>).
  * `exists(repoPath)` answers from the AUTHENTICATED source (never from the record): src/lib.rs decides `doc`, CHANGELOG.md decides
- * `changelog-version`, and the repository's own ci/advisory-exceptions.json, ownership catalog and docs generator decide theirs.
+ * `changelog-version`, and the repository's own ci/advisory-exceptions.json (or, per crate, crates/<name>/.rightkit/advisory-exceptions.json), ownership catalog and docs generator decide theirs.
  * `crateFeatures` is ci/gate.config.json `rust`. `includeTests` adds the per-feature-set test scans. Extra scans in a record are
  * allowed; a missing one is not. planScans builds its ids from the same helpers, and a test holds the two in agreement.
  */
-export function requiredScanIds({ units, crateFeatures = {}, exists, includeTests = false }) {
+export function requiredScanIds({ units, crateFeatures = {}, exists, includeTests = false, perCrateWorkspaces = undefined, clippyBatching = false, shardSolo = [], clippySeparate = new Map(), sidecarBound = new Set() }) {
   if (!Array.isArray(units) || units.length === 0 || !units.every((n) => typeof n === "string" && n)) throw new TypeError("requiredScanIds: units must be a non-empty array of names");
   if (typeof exists !== "function") throw new TypeError("requiredScanIds: exists(repoPath) is required");
-  const ids = new Set(WORKSPACE_SCAN_IDS);
-  if (exists("ci/advisory-exceptions.json")) ids.add("advisory-exceptions");
+  // One Cargo workspace and lock per crate (rightkit#1285): every unit has its own crates/<name>/Cargo.lock, so the per-workspace scans
+  // (metadata, deny, audit and the advisory ledger where the crate has one) are required per unit and carry the crate name; there is no
+  // repository-level ledger. A repository with one root workspace has no per-crate lock and keeps the unsuffixed ids.
+  const perCrate = perCrateWorkspaces ?? units.every((n) => exists(`crates/${n}/Cargo.lock`));
+  const ids = new Set(WORKSPACE_SCAN_IDS.filter((id) => !(perCrate && /^cargo-(metadata|deny|audit)$/.test(id))));
+  if (!perCrate && exists("ci/advisory-exceptions.json")) ids.add("advisory-exceptions");
   if (exists("packages/release/rightkit-ownership.json") && exists("crates/rightkit-ownership/catalog/ownership-catalog.json")) ids.add("ownership-catalog");
   if (exists("scripts/generate-index.mjs")) ids.add("generated-docs");
+  const clippyEntries = [];
   for (const name of units) {
     const own = crateFeatures?.[name] ?? {};
     const { lintSets, defaultCheck, checkSets } = rustCratePlan(own);
+    if (perCrate) {
+      for (const id of ["cargo-metadata", "cargo-deny", "cargo-audit"]) ids.add(`${id}:${name}`);
+      if (exists(`crates/${name}/.rightkit/advisory-exceptions.json`)) ids.add(`advisory-exceptions:${name}`);
+    }
     ids.add(rustScanId.packageList(name));
     if (exists(`crates/${name}/CHANGELOG.md`)) ids.add(rustScanId.changelog(name));
     if (defaultCheck) ids.add(rustScanId.check(name));
     checkSets.forEach((_set, i) => ids.add(rustScanId.checkFeatures(name, i)));
-    lintSets.forEach((_set, i) => ids.add(rustScanId.clippy(name, lintSets.length, i)));
+    if (clippyBatching) lintSets.forEach((set) => clippyEntries.push({ name, crate: name, ws: ".", set, count: lintSets.length, env: null }));
+    else lintSets.forEach((_set, i) => ids.add(rustScanId.clippy(name, lintSets.length, i)));
     if (exists(`crates/${name}/src/lib.rs`)) ids.add(rustScanId.doc(name));
     if (includeTests) {
       lintSets.forEach((_set, i) => {
@@ -89,6 +153,8 @@ export function requiredScanIds({ units, crateFeatures = {}, exists, includeTest
       });
     }
   }
+  // With batching on, the Clippy ids are the batches' (the same function the planner calls), never the per-crate ones.
+  if (clippyBatching) for (const b of clippyBatchPlan(clippyEntries, { solo: shardSolo, separate: clippySeparate, sidecarBound }).batches) ids.add(b.id);
   return [...ids].sort();
 }
 

package/sign-updater.mjs

@@ -7,6 +7,7 @@ import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
 import { execWithUpdaterCredential } from "./protected-credentials.mjs";
 import { resolvePnpmCli } from "./development.mjs";
 import { UPDATER_KEY_ID_RE, updaterSignatureKeyId } from "./github-updater-release.mjs";
+import { ArtifactPathError, loadSplitArtifactContext, resolveArtifactPath } from "./release-artifact-path.mjs";
 
 export const UPDATER_SIGNING_SECRET = "updater-signing-key";
 
@@ -14,6 +15,8 @@ export function runSignUpdater(args, {
   env = process.env, platform = process.platform, cwd = process.cwd(),
   execCredential = execWithUpdaterCredential, resolvePnpm = resolvePnpmCli,
   signMac = signMacUpdaterFiles, exists = existsSync, remove = rmSync, read = (file) => readFileSync(file, "utf8"), log = console.log,
+  // The artifact-path context of a door split (release-artifact-path.mjs, row 7.04c): `--file` is then the bound Cargo target's, never the checkout's.
+  artifactPaths = null,
 } = {}) {
   const files = [];
   let dryRun = false;
@@ -21,7 +24,7 @@ export function runSignUpdater(args, {
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--file") {
       if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error("--file requires an artifact path");
-      files.push(path.resolve(cwd, args[++i]));
+      files.push(artifactPaths?.mode === "split" ? resolveArtifactPath(args[++i], artifactPaths) : path.resolve(cwd, args[++i]));
     } else if (args[i] === "--key-id") {
       if (keyId !== undefined) throw new Error("--key-id may be given only once");
       if (!UPDATER_KEY_ID_RE.test(args[i + 1] ?? "")) throw new Error("--key-id requires the 16 upper-case hex digits of the updater key id");
@@ -77,9 +80,9 @@ export function runSignUpdater(args, {
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try { runSignUpdater(process.argv.slice(2)); }
+  try { runSignUpdater(process.argv.slice(2), { artifactPaths: await loadSplitArtifactContext({ cwd: process.cwd() }) }); }
   catch (error) {
-    console.error(`sign-updater: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    console.error(`sign-updater: ${error instanceof ArtifactPathError ? "" : error.code ? `[${error.code}] ` : ""}${error.message}`);
     process.exitCode = error.exitCode ?? 1;
   }
 }