@rightkit/release 0.2.111 → 0.2.112

package/publish-swift.mjs

@@ -1,25 +1,28 @@
-#!/usr/bin/env node
-// Publish RightKitSwift to a Swift package registry, gated exactly like `publish cargo`:
-// secret scan -> swift test -> release build -> deterministic source archive + hash ->
-// registry dry-run -> publish. Canonical source stays under tools/rightkit/swift; the
-// registry package is an output only. No Git distribution repo, no path/Git dependency.
-//
+// Publish RightKitSwift by the ONE Swift distribution contract: a git repository pinned by URL +
+// exact version tag (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). Gates, in order:
+// secret scan -> swift test -> release build -> mirror tree into a git checkout + tag ->
+// FRESH CONSUMER RESOLUTION (a throwaway app pins the tag with `exact:` and runs
+// `swift package resolve`) -> push. A dry-run performs everything except the push, so a green
+// dry-run proves the mirror layout, the tag, and clean consumer resolution -- not just that tests passed.
 // swift-tools is macOS/Linux only, so the plan builder, arg parser, and version check are
 // pure and unit-tested on any OS (publish-swift.test.mjs); the swift steps run where swift exists.
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
-import { createHash } from "node:crypto";
 import { spawnSync } from "./background-process.mjs";
 import { scanCrateForSecrets } from "./publish-cargo.mjs";
+import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
-const IDENTIFIER = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/i;
+export const DEFAULT_SWIFT_GIT_URL = "https://github.com/bogusyogi/rightkit-swift.git";
+const MIRROR_EXCLUDES = new Set([".build", ".swiftpm", ".git", "Package.resolved", ".DS_Store"]);
 
 export function parseSwiftPublishArgs(argv, env = process.env) {
-  const allowed = new Set(["--scope", "--url", "--dry-run", "--allow-dirty"]);
-  let scope = env.RIGHTKIT_SWIFT_REGISTRY_SCOPE ?? "rightsuite";
-  let url = env.RIGHTKIT_SWIFT_REGISTRY_URL ?? "";
+  const allowed = new Set(["--repo", "--dry-run", "--allow-dirty", "--evidence", "--workspace"]);
+  let repo = env.RIGHTKIT_SWIFT_GIT_URL ?? DEFAULT_SWIFT_GIT_URL;
   let dryRun = false;
   let allowDirty = false;
+  let evidence;
+  let workspace;
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!allowed.has(arg)) throw new Error(`unexpected argument: ${arg}`);
@@ -28,14 +31,14 @@ export function parseSwiftPublishArgs(argv, env = process.env) {
     else {
       const value = argv[(index += 1)];
       if (value === undefined) throw new Error(`${arg} needs a value`);
-      if (arg === "--scope") scope = value;
-      if (arg === "--url") url = value;
+      if (arg === "--evidence") evidence = value;
+      else if (arg === "--workspace") workspace = value;
+      else repo = value;
     }
   }
-  if (!IDENTIFIER.test(scope)) throw new Error(`invalid registry scope: ${scope}`);
+  if (!/^(https:\/\/|git@|ssh:\/\/|file:\/\/)/.test(repo)) throw new Error(`invalid swift git url: ${repo}`);
   if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
-  if (!dryRun && !url) throw new Error("registry publish needs --url or RIGHTKIT_SWIFT_REGISTRY_URL");
-  return { scope, url, dryRun, allowDirty };
+  return { repo, dryRun, allowDirty, evidence, workspace };
 }
 
 // The VERSION file is the single source of truth; Package.swift must name the package and the
@@ -54,58 +57,103 @@ export function readPackageIdentity(packageDir) {
   return { name: nameMatch[1], version };
 }
 
-export function buildSwiftPublishPlan({ packageDir, scope, name, version, url, dryRun, allowDirty = false }) {
-  const packageId = `${scope}.${name}`;
-  const archive = path.join(packageDir, ".build", `${name}-${version}.zip`);
+export function buildSwiftPublishPlan({ packageDir, name, version, repo, dryRun }) {
   const plan = [
     { label: "secret scan", internal: "secret-scan" },
     { label: "tests", command: "swift", args: ["test", "--package-path", packageDir] },
     { label: "release build", command: "swift", args: ["build", "-c", "release", "--package-path", packageDir] },
-    // Deterministic source archive; its bytes are what the registry stores, so hash it for the log.
-    { label: "source archive", command: "swift", args: ["package", "--package-path", packageDir, "archive-source", "-o", archive] },
-    { label: "archive hash", internal: "archive-hash", archive },
+    // Dry-run mirrors into a fresh local repo; a real publish clones the distribution repo first.
+    { label: "mirror and tag", internal: "mirror", tag: version, repo: dryRun ? null : repo },
+    { label: "fresh consumer resolution (exact pin)", internal: "consume", tag: version, name },
   ];
-  if (dryRun) {
-    plan.push({ label: "registry dry-run (validate only)", internal: "dry-run-note", packageId, version });
-    return plan;
-  }
-  plan.push({
-    label: "registry publish",
-    command: "swift",
-    args: ["package-registry", "publish", packageId, version, "--url", url, "--package-path", packageDir],
-  });
+  if (!dryRun) plan.push({ label: "git push (branch and tag)", internal: "push", tag: version, repo });
   return plan;
 }
 
+function git(args, cwd) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
+  return (result.stdout ?? "").trim();
+}
+
+function copyTree(from, to) {
+  fs.mkdirSync(to, { recursive: true });
+  for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
+    if (MIRROR_EXCLUDES.has(entry.name)) continue;
+    const source = path.join(from, entry.name);
+    const target = path.join(to, entry.name);
+    if (entry.isDirectory()) copyTree(source, target);
+    else if (entry.isFile()) fs.copyFileSync(source, target);
+  }
+}
+
+function mirrorAndTag(step, packageDir, work) {
+  const mirror = path.join(work, "rightkit-swift"); // SwiftPM names the package by repo directory
+  if (step.repo) git(["clone", step.repo, mirror], work);
+  else { fs.mkdirSync(mirror, { recursive: true }); git(["init", "-q", "-b", "main"], mirror); }
+  for (const entry of fs.readdirSync(mirror)) if (entry !== ".git") fs.rmSync(path.join(mirror, entry), { recursive: true, force: true });
+  copyTree(packageDir, mirror);
+  git(["add", "-A"], mirror);
+  git(["-c", "user.email=release@rightsuite.invalid", "-c", "user.name=right-release", "commit", "-q", "--allow-empty", "-m", `RightKitSwift ${step.tag}`], mirror);
+  if (git(["tag", "-l", step.tag], mirror) !== "") throw new Error(`tag ${step.tag} already exists: bump VERSION`);
+  git(["tag", step.tag], mirror);
+  return mirror;
+}
+
+function consumeFresh(step, mirror, work, execute) {
+  const app = path.join(work, "consumer");
+  fs.mkdirSync(path.join(app, "Sources", "App"), { recursive: true });
+  fs.writeFileSync(path.join(app, "Package.swift"), [
+    "// swift-tools-version: 6.0", "import PackageDescription", "let package = Package(",
+    '  name: "App", platforms: [.iOS(.v17), .macOS(.v14)],',
+    `  dependencies: [.package(url: "file://${mirror}", exact: "${step.tag}")],`,
+    '  targets: [.target(name: "App", dependencies: [.product(name: "RightKitStore", package: "rightkit-swift")])]', ")", "",
+  ].join("\n"));
+  fs.writeFileSync(path.join(app, "Sources", "App", "App.swift"), "import RightKitStore\npublic let ok = true\n");
+  const result = execute("swift", ["package", "resolve"], { cwd: app, encoding: "utf8", windowsHide: true, stdio: "inherit" });
+  if (result.error || result.status !== 0) throw new Error("fresh consumer resolution failed");
+  const pins = fs.readFileSync(path.join(app, "Package.resolved"), "utf8");
+  if (!pins.includes(`"version" : "${step.tag}"`)) throw new Error(`consumer did not resolve exact tag ${step.tag}`);
+}
+
 export function runSwiftPublish(options, execute = spawnSync) {
   const packageDir = options.packageDir;
   const { name, version } = readPackageIdentity(packageDir);
+  const workspaceRoot = path.resolve(options.workspace ?? path.join(packageDir, "..", ".."));
+  enforcePublicationGate({
+    kind: "swift", name, version, packagePath: packageDir,
+    evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(workspaceRoot, "swift", name)),
+  }, { dryRun: options.dryRun });
   const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
-
-  for (const step of plan) {
-    process.stdout.write(`[right-release] swift ${step.label}\n`);
-    if (step.internal === "secret-scan") {
-      const violations = scanCrateForSecrets(packageDir);
-      if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
-      continue;
-    }
-    if (step.internal === "dry-run-note") {
-      process.stdout.write(`[right-release] dry-run OK: ${step.packageId} ${step.version} (not published)\n`);
-      continue;
-    }
-    if (step.internal === "archive-hash") {
-      const bytes = fs.readFileSync(step.archive);
-      process.stdout.write(`sha256 ${createHash("sha256").update(bytes).digest("hex")}  ${path.basename(step.archive)}\n`);
-      continue;
-    }
-    const result = execute(step.command, step.args, { cwd: packageDir, encoding: "utf8", windowsHide: true, stdio: "inherit" });
-    if (result.error) {
-      if (result.error.code === "ENOENT") {
-        throw new Error(`${step.command} not found — run publish swift on macOS/Linux with the Swift toolchain installed`);
+  const work = fs.mkdtempSync(path.join(os.tmpdir(), "rightkit-swift-publish-"));
+  let mirror = null;
+  try {
+    for (const step of plan) {
+      process.stdout.write(`[right-release] swift ${step.label}\n`);
+      if (step.internal === "secret-scan") {
+        const violations = scanCrateForSecrets(packageDir);
+        if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
+        continue;
+      }
+      if (step.internal === "mirror") { mirror = mirrorAndTag(step, packageDir, work); continue; }
+      if (step.internal === "consume") { consumeFresh(step, mirror, work, execute); continue; }
+      if (step.internal === "push") {
+        git(["push", "origin", "HEAD"], mirror);
+        git(["push", "origin", step.tag], mirror);
+        continue;
+      }
+      const result = execute(step.command, step.args, { cwd: packageDir, encoding: "utf8", windowsHide: true, stdio: "inherit" });
+      if (result.error) {
+        if (result.error.code === "ENOENT") {
+          throw new Error(`${step.command} not found -- run publish swift on macOS/Linux with the Swift toolchain installed`);
+        }
+        throw result.error;
       }
-      throw result.error;
+      if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
     }
-    if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
+  } finally {
+    fs.rmSync(work, { recursive: true, force: true });
   }
   return { name, version, published: !options.dryRun };
 }

package/registry-parity.mjs

@@ -65,8 +65,24 @@ async function extract(archive, destination) {
   return join(destination, 'package');
 }
 
-export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl = fetch } = {}) {
-  const manifest = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
+// Every npm package RightKit publishes: the names in rightkit-versions.json (adopted, staged, legacy).
+export async function publishedPackageNames() {
+  const versions = JSON.parse(await readFile(join(packageRoot, 'rightkit-versions.json'), 'utf8'));
+  return [...new Set([...Object.keys(versions.npm ?? {}), ...Object.keys(versions.stagedNpm ?? {}), ...Object.keys(versions.legacyNpm ?? {})])].sort();
+}
+
+export async function verifyAllRegistryParity({ allowUnpublished = false, fetchImpl = fetch, names } = {}) {
+  const results = [];
+  for (const name of names ?? await publishedPackageNames()) {
+    results.push(await verifyRegistryParity({ allowUnpublished, fetchImpl, packageName: name }));
+  }
+  return Object.freeze(results);
+}
+
+export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl = fetch, packageName = '@rightkit/release' } = {}) {
+  const sourceRoot = packageName === '@rightkit/release' ? packageRoot : join(packageRoot, '..', packageName.replace('@rightkit/', ''));
+  const manifest = JSON.parse(await readFile(join(sourceRoot, 'package.json'), 'utf8'));
+  if (manifest.name !== packageName) throw new Error(`source ${sourceRoot} is ${manifest.name}, expected ${packageName}`);
   const encodedName = encodeURIComponent(manifest.name);
   const metadata = await fetchImpl(`https://registry.npmjs.org/${encodedName}/${manifest.version}`);
   if (metadata.status === 404 && allowUnpublished) return Object.freeze({ status: 'UNPUBLISHED', name: manifest.name, version: manifest.version });
@@ -77,7 +93,7 @@ export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl
   try {
     const localDir = join(root, 'local'); const publishedArchive = join(root, 'published.tgz');
     await mkdir(localDir, { recursive: true });
-    const packed = runPnpm(['pack', '--pack-destination', localDir, '--json'], { cwd: packageRoot, encoding: 'utf8' });
+    const packed = runPnpm(['pack', '--pack-destination', localDir, '--json'], { cwd: sourceRoot, encoding: 'utf8' });
     const localArchive = join(localDir, basename(packedArchivePath(packed)));
     const response = await fetchImpl(record.dist.tarball);
     if (!response.ok) throw new Error(`registry tarball failed: HTTP ${response.status}`);
@@ -93,7 +109,9 @@ export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  verifyRegistryParity({ allowUnpublished: process.argv.includes('--allow-unpublished') })
+  const flag = process.argv.indexOf('--package');
+  const allowUnpublished = process.argv.includes('--allow-unpublished');
+  (flag > 0 ? verifyRegistryParity({ allowUnpublished, packageName: process.argv[flag + 1] }) : verifyAllRegistryParity({ allowUnpublished }))
     .then((result) => process.stdout.write(`${JSON.stringify(result)}\n`))
     .catch((error) => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });
 }

package/rightkit-versions.json

@@ -13,17 +13,26 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
+    "@rightkit/app-shell": "0.2.0",
     "@rightkit/ax": "0.2.4",
+    "@rightkit/doc-render": "0.1.0",
     "@rightkit/git": "0.2.25",
     "@rightkit/hooks": "0.1.1",
+    "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
-    "@rightkit/legal-ui": "0.1.1",
+    "@rightkit/legal-ui": "0.1.2",
     "@rightkit/license": "0.1.8",
     "@rightkit/logs": "0.1.4",
+    "@rightkit/media-ui": "0.2.0",
+    "@rightkit/onboarding": "0.2.0",
+    "@rightkit/pdf-ui": "0.1.0",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.111",
+    "@rightkit/release": "0.2.112",
+    "@rightkit/settings-ui": "0.2.0",
+    "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.1.1",
+    "@rightkit/theme": "0.2.0",
     "@rightkit/updates": "0.2.4"
   },
   "legacyNpm": {
@@ -59,7 +68,8 @@
       "0.2.24"
     ],
     "@rightkit/legal-ui": [
-      "0.1.0"
+      "0.1.0",
+      "0.1.1"
     ],
     "@rightkit/hooks": [
       "0.1.0"
@@ -121,11 +131,27 @@
       "0.2.107",
       "0.2.108",
       "0.2.109",
-      "0.2.110"
+      "0.2.110",
+      "0.2.111"
     ],
     "@rightkit/qa": [
       "0.1.0",
       "0.2.0"
+    ],
+    "@rightkit/app-shell": [
+      "0.1.0"
+    ],
+    "@rightkit/media-ui": [
+      "0.1.0"
+    ],
+    "@rightkit/theme": [
+      "0.1.0"
+    ],
+    "@rightkit/settings-ui": [
+      "0.1.0"
+    ],
+    "@rightkit/onboarding": [
+      "0.1.0"
     ]
   },
   "cargo": {
@@ -135,6 +161,30 @@
     "rightkit-tauri": "0.1.0"
   },
   "stagedCargo": {
+    "rightkit-automation": "0.1.0",
+    "rightkit-audio": "0.1.0",
+    "rightkit-browser": "0.1.0",
+    "rightkit-cache": "0.1.0",
+    "rightkit-control": "0.1.0",
+    "rightkit-crash": "0.1.0",
+    "rightkit-db": "0.1.0",
+    "rightkit-framed-sidecar": "0.1.0",
+    "rightkit-fs": "0.1.0",
+    "rightkit-jobs": "0.1.0",
+    "rightkit-logs": "0.2.0",
+    "rightkit-media": "0.1.0",
+    "rightkit-models": "0.1.0",
+    "rightkit-pdf": "0.1.0",
+    "rightkit-playback": "0.1.0",
+    "rightkit-process": "0.2.0",
+    "rightkit-qa": "0.1.0",
+    "rightkit-sandbox": "0.1.0",
+    "rightkit-search": "0.1.0",
+    "rightkit-service": "0.1.0",
+    "rightkit-settings": "0.1.0",
+    "rightkit-shell": "0.1.0",
+    "rightkit-speech-client": "0.1.0",
+    "rightkit-sync": "0.1.0",
     "rightkit-license": "0.1.3",
     "rightkit-tauri": "0.1.1"
   },
@@ -143,5 +193,11 @@
       "url": "https://github.com/bogusyogi/rightkit-swift.git",
       "version": "0.1.1"
     }
+  },
+  "stagedSwift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.3.1"
+    }
   }
 }