@etiquekit/etq 1.0.14 → 1.0.15

package/scripts/release-pack-canary.sh

@@ -1,97 +0,0 @@
-#!/bin/sh
-# Build a fresh npm tarball in a temp dir and verify the public package surface.
-set -eu
-
-ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-TMPDIR_ROOT=${TMPDIR:-/tmp}
-TMP=$(mktemp -d "$TMPDIR_ROOT/etiquette-pack-canary.XXXXXX")
-trap 'rm -rf "$TMP"' EXIT INT TERM
-
-cd "$ROOT"
-npm run release:scan >/dev/null
-npm pack --pack-destination "$TMP" >/dev/null
-
-TGZ=$(find "$TMP" -maxdepth 1 -name '*.tgz' -print | sort | sed -n '1p')
-if [ -z "$TGZ" ]; then
-  echo "release-pack-canary: npm pack did not produce a tarball" >&2
-  exit 1
-fi
-
-FILES="$TMP/files.txt"
-tar -tzf "$TGZ" | sort > "$FILES"
-
-FILE_COUNT=$(wc -l < "$FILES" | tr -d ' ')
-MAX_FILES=190
-if [ "$FILE_COUNT" -gt "$MAX_FILES" ]; then
-  echo "release-pack-canary: package file count $FILE_COUNT exceeds budget $MAX_FILES" >&2
-  exit 1
-fi
-
-require_file() {
-  rel=$1
-  if ! grep -Fxq "$rel" "$FILES"; then
-    echo "release-pack-canary: missing required package file: $rel" >&2
-    exit 1
-  fi
-}
-
-forbid_prefix() {
-  prefix_re=$1
-  label=$2
-  if grep -Eq "^$prefix_re" "$FILES"; then
-    echo "release-pack-canary: forbidden package surface included: $label" >&2
-    grep -E "^$prefix_re" "$FILES" >&2
-    exit 1
-  fi
-}
-
-require_file "package/package.json"
-require_file "package/LICENSE"
-require_file "package/bin/etiquette"
-require_file "package/bin/etiquette-core"
-require_file "package/README.md"
-require_file "package/QuickStart.md"
-require_file "package/AGENTS.md"
-require_file "package/docs/README.md"
-require_file "package/docs/TEAM_HANDOFF.md"
-require_file "package/docs/CODEX_CLIENT_COMPATIBILITY.md"
-require_file "package/docs/RELEASE_SURFACE_AUDIT.md"
-require_file "package/packages/control/src/cli.ts"
-require_file "package/packages/control/src/core-cli.ts"
-require_file "package/packages/protocol/src/index.ts"
-require_file "package/release/lineage.v0.json"
-require_file "package/scripts/release-candidate-verify.sh"
-require_file "package/scripts/install.sh"
-require_file "package/scripts/uninstall.sh"
-require_file "package/scripts/release-scan.sh"
-require_file "package/scripts/release-pack-canary.sh"
-require_file "package/scripts/release-checksum.sh"
-require_file "package/scripts/release-sign.sh"
-require_file "package/templates/etiquette-vanilla-v0/README.md"
-require_file "package/templates/github-actions/README.md"
-require_file "package/templates/github-actions/w1-webhook-wake-canary.yml"
-require_file "package/templates/seat-packs-v0/README.md"
-
-forbid_prefix 'package/\.codex/' '.codex'
-forbid_prefix 'package/\.etiquette/' '.etiquette'
-forbid_prefix 'package/\.git' '.git'
-forbid_prefix 'package/apps/' 'apps'
-forbid_prefix 'package/conformance/' 'conformance'
-forbid_prefix 'package/coverage/' 'coverage'
-forbid_prefix 'package/dist/' 'dist'
-forbid_prefix 'package/fixtures/' 'fixtures'
-forbid_prefix 'package/internal/' 'internal'
-forbid_prefix 'package/docs/INTERNAL_HANDOFF\.md$' 'internal handoff doc'
-forbid_prefix 'package/node_modules/' 'node_modules'
-forbid_prefix 'package/docs/work/' 'repo-local workspace scaffold docs'
-forbid_prefix 'package/packages/control/src/cli/commands/slice\.ts$' 'legacy slice command'
-forbid_prefix 'package/packages/control/src/cli/commands/runtime\.ts$' 'infra runtime command'
-forbid_prefix 'package/packages/control/src/runtime/' 'infra runtime source'
-forbid_prefix 'package/packages/adapter-' 'legacy adapter packages'
-forbid_prefix 'package/packages/dbt-core/' 'legacy dbt-core package'
-forbid_prefix 'package/packages/[^/]*/fixtures/' 'workspace fixtures'
-forbid_prefix 'package/packages/[^/]*/package\.json$' 'workspace package metadata'
-forbid_prefix 'package/site/' 'site'
-forbid_prefix 'package/templates/hosted-receiver/' 'hosted receiver template'
-
-echo "release-pack-canary: ok $(basename "$TGZ") files=$FILE_COUNT budget=$MAX_FILES"

package/scripts/release-scan.sh

@@ -1,249 +0,0 @@
-#!/bin/sh
-# Fail if release-hostile local/private markers are committed.
-set -eu
-
-ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-
-if ! command -v rg >/dev/null 2>&1; then
-  echo "release-scan requires rg" >&2
-  exit 2
-fi
-
-forbidden_path='/'"Users/"
-forbidden_name='justine'"massawe"
-old_repo_name='discipline-'"control"
-pattern="(${forbidden_path}|${forbidden_name}|${old_repo_name})"
-
-if rg -n --hidden --glob '!.git' --glob '!.git/**' --glob '!_worktrees/**' --glob '!node_modules/**' --glob '!bun.lock' "$pattern" "$ROOT"; then
-  echo "release-scan: found forbidden local/private marker" >&2
-  exit 1
-fi
-
-vanilla_root="$ROOT/templates/etiquette-vanilla-v0"
-github_actions_root="$ROOT/templates/github-actions"
-seat_packs_root="$ROOT/templates/seat-packs-v0"
-control_src_root="$ROOT/packages/control/src"
-protocol_src_root="$ROOT/packages/protocol/src"
-shop_marker_pattern="(El""sa|7""ven|Za""ch|bo""ss|Bo""ss)"
-prior_run_pattern="(El""sa|7""ven|Za""ch|bo""ss|Bo""ss|ale-""felicity|codex-spark-""ale-seat|felicity-""review-seat|v3-""handshake|V3-""SCR|LMS-""SCR|bus""://|claude""logs|last""talk\.log|last""miles\.log|karp""athy|lee""pick|LP-""SCR)"
-
-allowed_docs='docs/README.md
-docs/ARCHITECTURE.md
-docs/MANAGED_RUNTIME_COMPATIBILITY.md
-docs/CODEX_CLIENT_COMPATIBILITY.md
-docs/CONCEPTS.md
-docs/CONCEPT_STATUS.md
-docs/CORE_PROFILE.md
-docs/HOSTED_RUNTIME_PARITY.md
-docs/LANE_PROVISIONING.md
-docs/PORTAL.md
-docs/RELEASE_SURFACE_AUDIT.md
-docs/SEAT_DISCIPLINE.md
-docs/SEAT_PROVISIONING.md
-docs/TEAM_HANDOFF.md
-docs/WORKTREE_QOL.md
-docs/work/bus-feed/README.md
-docs/work/consumer-registry/README.md
-docs/contracts/ledger-entry/ledger-entry.v0.2.md
-docs/contracts/ledger-entry/README.md
-docs/contracts/ledger-entry/ledger-query-cli.v0.1.md
-docs/contracts/ledger-entry/ledger-entry.v0.1.md
-docs/contracts/ledger-entry/ledger-entry.v0.md
-docs/work/seats/owner-cards/default-review-seat.yaml'
-
-for doc_path in $(find "$ROOT/docs" -type f | sed "s#^$ROOT/##" | sort); do
-  if ! printf '%s\n' "$allowed_docs" | grep -qx "$doc_path"; then
-    echo "release-scan: unexpected all-dev docs file: $doc_path" >&2
-    exit 1
-  fi
-done
-
-allowed_templates='templates/etiquette-vanilla-v0
-templates/github-actions
-templates/seat-packs-v0'
-
-for template_path in $(find "$ROOT/templates" -mindepth 1 -maxdepth 1 -type d | sed "s#^$ROOT/##" | sort); do
-  if ! printf '%s\n' "$allowed_templates" | grep -qx "$template_path"; then
-    echo "release-scan: unexpected public template directory: $template_path" >&2
-    exit 1
-  fi
-done
-
-allowed_scripts='scripts/release-checksum.sh
-scripts/install.sh
-scripts/uninstall.sh
-scripts/release-candidate-verify.sh
-scripts/release-pack-canary.sh
-scripts/release-scan.sh
-scripts/release-sign.sh'
-
-for script_path in $(find "$ROOT/scripts" -type f | sed "s#^$ROOT/##" | sort); do
-  if ! printf '%s\n' "$allowed_scripts" | grep -qx "$script_path"; then
-    echo "release-scan: unexpected public script: $script_path" >&2
-    exit 1
-  fi
-  sh -n "$ROOT/$script_path"
-done
-
-allowed_bins='bin/etiquette
-bin/etiquette-core'
-
-for bin_path in $(find "$ROOT/bin" -type f | sed "s#^$ROOT/##" | sort); do
-  if ! printf '%s\n' "$allowed_bins" | grep -qx "$bin_path"; then
-    echo "release-scan: unexpected public executable: $bin_path" >&2
-    exit 1
-  fi
-  sh -n "$ROOT/$bin_path"
-done
-
-default_surface_files="$ROOT/README.md
-$ROOT/QuickStart.md
-$ROOT/AGENTS.md
-$ROOT/docs/README.md
-$ROOT/docs/ARCHITECTURE.md
-$ROOT/docs/CONCEPTS.md
-$ROOT/docs/CONCEPT_STATUS.md
-$ROOT/docs/LANE_PROVISIONING.md
-$ROOT/docs/SEAT_DISCIPLINE.md
-$ROOT/docs/SEAT_PROVISIONING.md
-$ROOT/docs/WORKTREE_QOL.md
-$ROOT/templates/etiquette-vanilla-v0/README.md"
-
-if rg -n 'internal/docs' $default_surface_files; then
-  echo "release-scan: found maintainer-doc path in default onboarding surface" >&2
-  exit 1
-fi
-
-if command -v git >/dev/null 2>&1 && git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-  tracked_forbidden=$(
-    git -C "$ROOT" ls-files \
-      '.etiquette/**' \
-      '.llm-substrate/**' \
-      'site/public/fonts/**' \
-      '*.woff' \
-      '*.woff2' \
-      '*.ttf' \
-      '*.otf' \
-      || true
-  )
-  if [ -n "$tracked_forbidden" ]; then
-    echo "$tracked_forbidden" >&2
-    echo "release-scan: tracked release-hostile local state or font assets" >&2
-    exit 1
-  fi
-fi
-
-if rg -n "$prior_run_pattern" \
-  "$ROOT/README.md" \
-  "$ROOT/QuickStart.md" \
-  "$ROOT/AGENTS.md" \
-  "$ROOT/docs" \
-  "$ROOT/scripts" \
-  "$control_src_root" \
-  "$protocol_src_root" \
-  "$vanilla_root" \
-  "$github_actions_root" \
-  "$seat_packs_root"; then
-  echo "release-scan: found prior-run marker in all-dev onboarding surface" >&2
-  exit 1
-fi
-
-third_party_concept_pattern="\bC""MA\b"
-if rg -n "$third_party_concept_pattern" \
-  --glob '!**/HOSTED_RUNTIME_PARITY.md' \
-  --glob '!**/src/mcp/**' \
-  "$ROOT/README.md" \
-  "$ROOT/QuickStart.md" \
-  "$ROOT/AGENTS.md" \
-  "$ROOT/docs" \
-  "$ROOT/scripts" \
-  "$control_src_root" \
-  "$protocol_src_root" \
-  "$vanilla_root" \
-  "$github_actions_root" \
-  "$seat_packs_root"; then
-  echo "release-scan: found third-party concept marker in all-dev onboarding surface" >&2
-  exit 1
-fi
-
-if command -v git >/dev/null 2>&1 && git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-  archive_bad=$(
-    git -C "$ROOT" archive --worktree-attributes --format=tar HEAD \
-      | tar -tf - \
-      | sed 's#^\./##' \
-      | grep -E '^(\.etiquette/|\.llm-substrate/|apps/|conformance/|dist/|fixtures/|internal/|site/)' \
-      || true
-  )
-  if [ -n "$archive_bad" ]; then
-    echo "$archive_bad" >&2
-    echo "release-scan: source archive includes maintainer-only or generated surfaces" >&2
-    exit 1
-  fi
-fi
-
-check_max_lines() {
-  rel=$1
-  max=$2
-  lines=$(wc -l < "$ROOT/$rel" | tr -d ' ')
-  if [ "$lines" -gt "$max" ]; then
-    echo "release-scan: $rel has $lines lines; max allowed for onboarding surface is $max" >&2
-    exit 1
-  fi
-}
-
-check_max_lines "README.md" 80
-check_max_lines "QuickStart.md" 95
-check_max_lines "AGENTS.md" 45
-check_max_lines "docs/README.md" 30
-check_max_lines "docs/ARCHITECTURE.md" 100
-check_max_lines "docs/CODEX_CLIENT_COMPATIBILITY.md" 85
-check_max_lines "docs/CONCEPTS.md" 130
-check_max_lines "docs/CONCEPT_STATUS.md" 75
-check_max_lines "docs/CORE_PROFILE.md" 95
-check_max_lines "docs/SEAT_DISCIPLINE.md" 120
-check_max_lines "docs/SEAT_PROVISIONING.md" 100
-check_max_lines "docs/TEAM_HANDOFF.md" 190
-check_max_lines "docs/WORKTREE_QOL.md" 100
-check_max_lines "docs/RELEASE_SURFACE_AUDIT.md" 160
-check_max_lines "templates/etiquette-vanilla-v0/README.md" 70
-check_max_lines "templates/github-actions/README.md" 70
-check_max_lines "templates/github-actions/w1-webhook-wake-canary.yml" 130
-check_max_lines "templates/seat-packs-v0/README.md" 90
-
-normalize_words() {
-  tr ' ' '\n' | sed '/^$/d' | sort | tr '\n' ' ' | sed 's/ $//'
-}
-
-seat_types=$(sed -n 's/^  \([a-z0-9-]*\)) src=.*$/\1/p' "$seat_packs_root/bin/provision-seat" | normalize_words)
-
-check_seat_pack_catalog() {
-  rel=$1
-  found=$(rg -o 'provision-seat [a-z0-9-]+' "$ROOT/$rel" | sed 's/provision-seat //' | grep -v '^auto$' | normalize_words)
-  if [ "$found" != "$seat_types" ]; then
-    echo "release-scan: $rel seat-pack list '$found' does not match provision-seat '$seat_types'" >&2
-    exit 1
-  fi
-}
-
-check_seat_pack_catalog "README.md"
-check_seat_pack_catalog "QuickStart.md"
-check_seat_pack_catalog "docs/SEAT_PROVISIONING.md"
-check_seat_pack_catalog "templates/etiquette-vanilla-v0/README.md"
-check_seat_pack_catalog "templates/seat-packs-v0/README.md"
-
-if [ -d "$vanilla_root" ] && rg -n "$shop_marker_pattern" "$vanilla_root"; then
-  echo "release-scan: found shop marker in vanilla package" >&2
-  exit 1
-fi
-
-if [ -d "$seat_packs_root" ] && rg -n "$shop_marker_pattern" "$seat_packs_root"; then
-  echo "release-scan: found shop marker in seat packs package" >&2
-  exit 1
-fi
-
-if [ -d "$ROOT/templates/hosted-receiver" ]; then
-  echo "release-scan: hosted receiver template belongs outside thin devkit" >&2
-  exit 1
-fi
-
-echo "release-scan: ok"

package/scripts/release-sign.sh

@@ -1,34 +0,0 @@
-#!/bin/sh
-# Sign the checksum manifest when an operator provides a release signing key.
-set -eu
-
-ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-CHECKSUMS="$ROOT/dist/SHA256SUMS"
-
-if [ ! -f "$CHECKSUMS" ]; then
-  echo "release-sign: missing dist/SHA256SUMS; run npm run release:checksum first" >&2
-  exit 1
-fi
-
-if [ -n "${ETIQUETTE_RELEASE_SIGNING_KEY:-}" ]; then
-  if [ ! -f "$ETIQUETTE_RELEASE_SIGNING_KEY" ]; then
-    echo "release-sign: ETIQUETTE_RELEASE_SIGNING_KEY does not point to a file" >&2
-    exit 1
-  fi
-  openssl dgst -sha256 -sign "$ETIQUETTE_RELEASE_SIGNING_KEY" -out "$CHECKSUMS.sig" "$CHECKSUMS"
-  printf 'method=openssl-rsa-sha256\nsigned_ref=dist/SHA256SUMS.sig\n' > "$ROOT/dist/SIGNATURE_MANIFEST.txt"
-  rm -f "$ROOT/dist/SIGNATURE_REQUIRED.txt"
-  echo "release-sign: wrote dist/SHA256SUMS.sig"
-  exit 0
-fi
-
-cat > "$ROOT/dist/SIGNATURE_REQUIRED.txt" <<'MSG'
-Release signing was not performed.
-
-Set ETIQUETTE_RELEASE_SIGNING_KEY to an operator-held private key file, then rerun:
-
-  npm run release:sign
-MSG
-
-echo "release-sign: signing key missing; wrote dist/SIGNATURE_REQUIRED.txt" >&2
-exit 1