@rightkit/release 0.2.111 → 0.2.113

package/cargo-contract.mjs

@@ -1,230 +1,230 @@
-import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
-import { managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
-
-const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".right-release", ".worktrees", "node_modules", "target", "vendor"]);
-const CRATES_IO_SOURCES = new Set([
-  "registry+https://github.com/rust-lang/crates.io-index",
-  "registry+https://index.crates.io/",
-]);
-const CACHE_V2_ENVIRONMENT = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "RIGHT_RELEASE_CACHE_OWNER"];
-
-export function managedCargoShimOnPath(env = process.env, platform = process.platform, exists = existsSync) {
-  const pathApi = platform === "win32" ? path.win32 : path.posix;
-  const delimiter = platform === "win32" ? ";" : ":";
-  const extensions = platform === "win32"
-    ? String(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)
-    : [""];
-  for (const directory of String(env.PATH ?? "").split(delimiter).filter(Boolean)) {
-    for (const extension of extensions) {
-      const candidate = pathApi.join(directory, `cargo${extension.toLowerCase()}`);
-      if (!exists(candidate)) continue;
-      return /(?:^|\/)(?:\.rightkit-managed|rightkitmanagedagent)\/agent-bin\/cargo(?:\.[^/]*)?$/i
-        .test(candidate.replaceAll("\\", "/"));
-    }
-  }
-  return false;
-}
-
-export function brokerManagedHost(env = process.env, platform = process.platform, exists = existsSync) {
-  return Boolean(managedRuntimeClient(env, platform, exists)) || Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET) || managedCargoShimOnPath(env, platform, exists);
-}
-
-export function isolatedCargoMetadataEnv(cargoHome, env = process.env, platform = process.platform, exists = existsSync) {
-  const metadataEnv = { ...env };
-  for (const name of CACHE_V2_ENVIRONMENT) delete metadataEnv[name];
-  if (brokerManagedHost(metadataEnv, platform, exists)) return metadataEnv;
-  return { ...metadataEnv, CARGO_HOME: cargoHome };
-}
-
-export function cargoExecutable(platform = process.platform) {
-  return "cargo";
-}
-
-export function cargoArguments(args, platform = process.platform) {
-  return args;
-}
-
-export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {
-  const scanRoot = path.resolve(root);
-  const boundary = findRepositoryRoot(scanRoot);
-  const published = publishedVersions instanceof Map
-    ? publishedVersions
-    : new Map(Object.entries(publishedVersions ?? {}));
-  const manifests = findCargoManifests(scanRoot);
-  const cargoHome = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-home-"));
-  try {
-    for (const manifestPath of manifests) {
-      const manifestLabel = path.relative(boundary, manifestPath) || "Cargo.toml";
-      assertNoRightKitCargoOverrides(manifestPath, boundary, `${label}/${manifestLabel}`);
-      const dependencies = readCargoManifestDependencies(manifestPath, cargoHome, `${label}/${manifestLabel}`);
-      assertPublishedRightKitCargoDependencies(dependencies, published, `${label}/${manifestLabel}`);
-    }
-  } finally {
-    rmSync(cargoHome, { recursive: true, force: true });
-  }
-  return manifests.length;
-}
-
-export function assertPublishedRightKitCargoDependencies(dependencies, published, label) {
-  let checked = 0;
-  for (const dependency of dependencies.filter(({ name }) => name.startsWith("rightkit-"))) {
-    checked += 1;
-    const configured = published.get(dependency.name);
-    if (!configured) throw new Error(`${label} ${dependency.name} is not a published RightKit crate`);
-    const allowed = configured instanceof Set ? configured : new Set(Array.isArray(configured) ? configured : [configured]);
-    const exactVersions = new Set([...allowed].map((version) => `=${version}`));
-    if (!CRATES_IO_SOURCES.has(dependency.source) || dependency.path || dependency.registry || !exactVersions.has(dependency.req)) {
-      throw new Error(`${label} ${dependency.name} must use exact crates.io versions (${[...exactVersions].join(" or ")})`);
-    }
-  }
-  return checked;
-}
-
-export function assertNoRightKitCargoOverrides(manifestPath, repoRoot, label) {
-  const boundary = path.resolve(repoRoot);
-  const manifest = path.resolve(manifestPath);
-  assertInsideBoundary(manifest, boundary);
-  assertNoRightKitOverrides(readToml(manifest, label), label, path.relative(boundary, manifest) || "Cargo.toml");
-
-  for (const configPath of findRepoCargoConfigs(path.dirname(manifest), boundary)) {
-    const source = path.relative(boundary, configPath);
-    const parsed = readToml(configPath, source);
-    assertNoRightKitOverrides(parsed, label, source);
-    const cratesIo = parsed.source?.["crates-io"];
-    if (cratesIo && typeof cratesIo === "object"
-      && ["replace-with", "directory", "git", "registry", "local-registry"].some((key) => key in cratesIo)) {
-      throw new Error(`${label} has forbidden crates.io source replacement in ${source}`);
-    }
-  }
-}
-
-function readCargoManifestDependencies(manifestPath, cargoHome, label) {
-  const result = runCargoSync(
-    cargoArguments(["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath]),
-    {
-      cwd: path.dirname(manifestPath),
-      encoding: "utf8",
-      env: isolatedCargoMetadataEnv(cargoHome),
-      windowsHide: true,
-    },
-  );
-  if (result.error) {
-    // spawnSync failed to launch the process at all (no exit code, no stderr) -
-    // a missing/unspawnable binary, not cargo rejecting the manifest. Reporting
-    // this as a version-contract violation sent a real diagnosis (a Windows
-    // rustup-proxy binary that can't be spawned from a non-console session)
-    // down the wrong path: it read as "fix your Cargo.toml" instead of "cargo
-    // could not be launched here".
-    throw new Error(`${label} could not launch ${cargoExecutable()} to read Cargo metadata: ${result.error.message}`);
-  }
-  if (result.status !== 0) {
-    throw new Error(`${label} Cargo metadata rejected manifest; RightKit dependencies must use exact crates.io versions: ${String(result.stderr ?? "").trim()}`);
-  }
-  const metadata = JSON.parse(result.stdout);
-  const expectedPath = path.resolve(manifestPath).toLowerCase();
-  const pkg = metadata.packages.find(({ manifest_path: candidate }) => path.resolve(candidate).toLowerCase() === expectedPath);
-  if (!pkg && path.resolve(metadata.workspace_root, "Cargo.toml").toLowerCase() === expectedPath) return [];
-  if (!pkg) throw new Error(`${label} was not returned by Cargo metadata`);
-  return pkg.dependencies;
-}
-
-function assertNoRightKitOverrides(parsed, label, source) {
-  for (const overrides of Object.values(parsed.patch ?? {})) {
-    if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) continue;
-    for (const [name, specifier] of Object.entries(overrides)) {
-      const packageName = typeof specifier === "object" && specifier ? specifier.package : undefined;
-      if (name.startsWith("rightkit-") || packageName?.startsWith("rightkit-")) {
-        throw new Error(`${label} has forbidden RightKit Cargo override ${name} in ${source}`);
-      }
-    }
-  }
-  for (const [name, specifier] of Object.entries(parsed.replace ?? {})) {
-    const packageName = typeof specifier === "object" && specifier ? specifier.package : undefined;
-    if (name.split(":", 1)[0].startsWith("rightkit-") || packageName?.startsWith("rightkit-")) {
-      throw new Error(`${label} has forbidden RightKit Cargo override ${name} in ${source}`);
-    }
-  }
-}
-
-// `tomllib` is Python 3.11+. Windows pins `py -3.11`, but a bare `python3` on macOS is the system
-// 3.9, which has no tomllib — so every app's release:doctor died on a stock Mac, and reported the
-// manifest as invalid TOML when the real problem was the interpreter. Probe for one that can.
-let tomlRunner;
-function resolveTomlRunner() {
-  if (tomlRunner) return tomlRunner;
-  const probe = "import sys,tomllib";
-  const candidates =
-    process.platform === "win32"
-      ? [["py", ["-3.11"]], ["py", ["-3"]], ["python", []]]
-      : [["python3.13", []], ["python3.12", []], ["python3.11", []], ["python3", []]];
-  for (const [command, prefix] of candidates) {
-    const check = spawnSync(command, [...prefix, "-c", probe], { encoding: "utf8", windowsHide: true });
-    if (check.status === 0) {
-      tomlRunner = { command, prefix };
-      return tomlRunner;
-    }
-  }
-  throw new Error(
-    "no Python with tomllib found (needs 3.11+). Install one, or put it on PATH: the release " +
-      "contract reads Cargo manifests through it.",
-  );
-}
-
-function readToml(file, label) {
-  const script = "import json,pathlib,sys,tomllib; json.dump(tomllib.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')),sys.stdout,default=str)";
-  const { command, prefix } = resolveTomlRunner();
-  const result = spawnSync(command, [...prefix, "-c", script, file], { encoding: "utf8", windowsHide: true });
-  if (result.status !== 0) throw new Error(`${label} is not valid TOML: ${String(result.stderr ?? "").trim()}`);
-  return JSON.parse(result.stdout);
-}
-
-function findCargoManifests(root) {
-  const found = [];
-  const visit = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && SKIP_DIRECTORIES.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) visit(full);
-      else if (entry.isFile() && entry.name === "Cargo.toml") found.push(full);
-    }
-  };
-  visit(root);
-  return found;
-}
-
-function findRepoCargoConfigs(start, repoRoot) {
-  const boundary = path.resolve(repoRoot);
-  let current = path.resolve(start);
-  assertInsideBoundary(current, boundary);
-  const configs = [];
-  while (true) {
-    for (const filename of ["config", "config.toml"]) {
-      const candidate = path.join(current, ".cargo", filename);
-      if (existsSync(candidate)) configs.push(candidate);
-    }
-    if (current.toLowerCase() === boundary.toLowerCase()) break;
-    current = path.dirname(current);
-  }
-  return configs;
-}
-
-function assertInsideBoundary(candidate, boundary) {
-  const relative = path.relative(boundary, candidate);
-  if (relative !== "" && (relative.startsWith("..") || path.isAbsolute(relative))) {
-    throw new Error(`${candidate} is outside ${boundary}`);
-  }
-}
-
-function findRepositoryRoot(start) {
-  const original = path.resolve(start);
-  let current = original;
-  while (true) {
-    if (existsSync(path.join(current, ".git"))) return current;
-    const parent = path.dirname(current);
-    if (parent === current) return original;
-    current = parent;
-  }
-}
+import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
+
+const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".right-release", ".worktrees", "node_modules", "target", "vendor"]);
+const CRATES_IO_SOURCES = new Set([
+  "registry+https://github.com/rust-lang/crates.io-index",
+  "registry+https://index.crates.io/",
+]);
+const CACHE_V2_ENVIRONMENT = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "RIGHT_RELEASE_CACHE_OWNER"];
+
+export function managedCargoShimOnPath(env = process.env, platform = process.platform, exists = existsSync) {
+  const pathApi = platform === "win32" ? path.win32 : path.posix;
+  const delimiter = platform === "win32" ? ";" : ":";
+  const extensions = platform === "win32"
+    ? String(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)
+    : [""];
+  for (const directory of String(env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    for (const extension of extensions) {
+      const candidate = pathApi.join(directory, `cargo${extension.toLowerCase()}`);
+      if (!exists(candidate)) continue;
+      return /(?:^|\/)(?:\.rightkit-managed|rightkitmanagedagent)\/agent-bin\/cargo(?:\.[^/]*)?$/i
+        .test(candidate.replaceAll("\\", "/"));
+    }
+  }
+  return false;
+}
+
+export function brokerManagedHost(env = process.env, platform = process.platform, exists = existsSync) {
+  return Boolean(managedRuntimeClient(env, platform, exists)) || Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET) || managedCargoShimOnPath(env, platform, exists);
+}
+
+export function isolatedCargoMetadataEnv(cargoHome, env = process.env, platform = process.platform, exists = existsSync) {
+  const metadataEnv = { ...env };
+  for (const name of CACHE_V2_ENVIRONMENT) delete metadataEnv[name];
+  if (brokerManagedHost(metadataEnv, platform, exists)) return metadataEnv;
+  return { ...metadataEnv, CARGO_HOME: cargoHome };
+}
+
+export function cargoExecutable(platform = process.platform) {
+  return "cargo";
+}
+
+export function cargoArguments(args, platform = process.platform) {
+  return args;
+}
+
+export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {
+  const scanRoot = path.resolve(root);
+  const boundary = findRepositoryRoot(scanRoot);
+  const published = publishedVersions instanceof Map
+    ? publishedVersions
+    : new Map(Object.entries(publishedVersions ?? {}));
+  const manifests = findCargoManifests(scanRoot);
+  const cargoHome = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-home-"));
+  try {
+    for (const manifestPath of manifests) {
+      const manifestLabel = path.relative(boundary, manifestPath) || "Cargo.toml";
+      assertNoRightKitCargoOverrides(manifestPath, boundary, `${label}/${manifestLabel}`);
+      const dependencies = readCargoManifestDependencies(manifestPath, cargoHome, `${label}/${manifestLabel}`);
+      assertPublishedRightKitCargoDependencies(dependencies, published, `${label}/${manifestLabel}`);
+    }
+  } finally {
+    rmSync(cargoHome, { recursive: true, force: true });
+  }
+  return manifests.length;
+}
+
+export function assertPublishedRightKitCargoDependencies(dependencies, published, label) {
+  let checked = 0;
+  for (const dependency of dependencies.filter(({ name }) => name.startsWith("rightkit-"))) {
+    checked += 1;
+    const configured = published.get(dependency.name);
+    if (!configured) throw new Error(`${label} ${dependency.name} is not a published RightKit crate`);
+    const allowed = configured instanceof Set ? configured : new Set(Array.isArray(configured) ? configured : [configured]);
+    const exactVersions = new Set([...allowed].map((version) => `=${version}`));
+    if (!CRATES_IO_SOURCES.has(dependency.source) || dependency.path || dependency.registry || !exactVersions.has(dependency.req)) {
+      throw new Error(`${label} ${dependency.name} must use exact crates.io versions (${[...exactVersions].join(" or ")})`);
+    }
+  }
+  return checked;
+}
+
+export function assertNoRightKitCargoOverrides(manifestPath, repoRoot, label) {
+  const boundary = path.resolve(repoRoot);
+  const manifest = path.resolve(manifestPath);
+  assertInsideBoundary(manifest, boundary);
+  assertNoRightKitOverrides(readToml(manifest, label), label, path.relative(boundary, manifest) || "Cargo.toml");
+
+  for (const configPath of findRepoCargoConfigs(path.dirname(manifest), boundary)) {
+    const source = path.relative(boundary, configPath);
+    const parsed = readToml(configPath, source);
+    assertNoRightKitOverrides(parsed, label, source);
+    const cratesIo = parsed.source?.["crates-io"];
+    if (cratesIo && typeof cratesIo === "object"
+      && ["replace-with", "directory", "git", "registry", "local-registry"].some((key) => key in cratesIo)) {
+      throw new Error(`${label} has forbidden crates.io source replacement in ${source}`);
+    }
+  }
+}
+
+function readCargoManifestDependencies(manifestPath, cargoHome, label) {
+  const result = runCargoSync(
+    cargoArguments(["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath]),
+    {
+      cwd: path.dirname(manifestPath),
+      encoding: "utf8",
+      env: isolatedCargoMetadataEnv(cargoHome),
+      windowsHide: true,
+    },
+  );
+  if (result.error) {
+    // spawnSync failed to launch the process at all (no exit code, no stderr) -
+    // a missing/unspawnable binary, not cargo rejecting the manifest. Reporting
+    // this as a version-contract violation sent a real diagnosis (a Windows
+    // rustup-proxy binary that can't be spawned from a non-console session)
+    // down the wrong path: it read as "fix your Cargo.toml" instead of "cargo
+    // could not be launched here".
+    throw new Error(`${label} could not launch ${cargoExecutable()} to read Cargo metadata: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`${label} Cargo metadata rejected manifest; RightKit dependencies must use exact crates.io versions: ${String(result.stderr ?? "").trim()}`);
+  }
+  const metadata = JSON.parse(result.stdout);
+  const expectedPath = path.resolve(manifestPath).toLowerCase();
+  const pkg = metadata.packages.find(({ manifest_path: candidate }) => path.resolve(candidate).toLowerCase() === expectedPath);
+  if (!pkg && path.resolve(metadata.workspace_root, "Cargo.toml").toLowerCase() === expectedPath) return [];
+  if (!pkg) throw new Error(`${label} was not returned by Cargo metadata`);
+  return pkg.dependencies;
+}
+
+function assertNoRightKitOverrides(parsed, label, source) {
+  for (const overrides of Object.values(parsed.patch ?? {})) {
+    if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) continue;
+    for (const [name, specifier] of Object.entries(overrides)) {
+      const packageName = typeof specifier === "object" && specifier ? specifier.package : undefined;
+      if (name.startsWith("rightkit-") || packageName?.startsWith("rightkit-")) {
+        throw new Error(`${label} has forbidden RightKit Cargo override ${name} in ${source}`);
+      }
+    }
+  }
+  for (const [name, specifier] of Object.entries(parsed.replace ?? {})) {
+    const packageName = typeof specifier === "object" && specifier ? specifier.package : undefined;
+    if (name.split(":", 1)[0].startsWith("rightkit-") || packageName?.startsWith("rightkit-")) {
+      throw new Error(`${label} has forbidden RightKit Cargo override ${name} in ${source}`);
+    }
+  }
+}
+
+// `tomllib` is Python 3.11+. Windows pins `py -3.11`, but a bare `python3` on macOS is the system
+// 3.9, which has no tomllib — so every app's release:doctor died on a stock Mac, and reported the
+// manifest as invalid TOML when the real problem was the interpreter. Probe for one that can.
+let tomlRunner;
+function resolveTomlRunner() {
+  if (tomlRunner) return tomlRunner;
+  const probe = "import sys,tomllib";
+  const candidates =
+    process.platform === "win32"
+      ? [["py", ["-3.11"]], ["py", ["-3"]], ["python", []]]
+      : [["python3.13", []], ["python3.12", []], ["python3.11", []], ["python3", []]];
+  for (const [command, prefix] of candidates) {
+    const check = spawnSync(command, [...prefix, "-c", probe], { encoding: "utf8", windowsHide: true });
+    if (check.status === 0) {
+      tomlRunner = { command, prefix };
+      return tomlRunner;
+    }
+  }
+  throw new Error(
+    "no Python with tomllib found (needs 3.11+). Install one, or put it on PATH: the release " +
+      "contract reads Cargo manifests through it.",
+  );
+}
+
+function readToml(file, label) {
+  const script = "import json,pathlib,sys,tomllib; json.dump(tomllib.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')),sys.stdout,default=str)";
+  const { command, prefix } = resolveTomlRunner();
+  const result = spawnSync(command, [...prefix, "-c", script, file], { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(`${label} is not valid TOML: ${String(result.stderr ?? "").trim()}`);
+  return JSON.parse(result.stdout);
+}
+
+function findCargoManifests(root) {
+  const found = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_DIRECTORIES.has(entry.name)) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) visit(full);
+      else if (entry.isFile() && entry.name === "Cargo.toml") found.push(full);
+    }
+  };
+  visit(root);
+  return found;
+}
+
+function findRepoCargoConfigs(start, repoRoot) {
+  const boundary = path.resolve(repoRoot);
+  let current = path.resolve(start);
+  assertInsideBoundary(current, boundary);
+  const configs = [];
+  while (true) {
+    for (const filename of ["config", "config.toml"]) {
+      const candidate = path.join(current, ".cargo", filename);
+      if (existsSync(candidate)) configs.push(candidate);
+    }
+    if (current.toLowerCase() === boundary.toLowerCase()) break;
+    current = path.dirname(current);
+  }
+  return configs;
+}
+
+function assertInsideBoundary(candidate, boundary) {
+  const relative = path.relative(boundary, candidate);
+  if (relative !== "" && (relative.startsWith("..") || path.isAbsolute(relative))) {
+    throw new Error(`${candidate} is outside ${boundary}`);
+  }
+}
+
+function findRepositoryRoot(start) {
+  const original = path.resolve(start);
+  let current = original;
+  while (true) {
+    if (existsSync(path.join(current, ".git"))) return current;
+    const parent = path.dirname(current);
+    if (parent === current) return original;
+    current = parent;
+  }
+}

package/cargo-target.mjs

@@ -1,53 +1,53 @@
-#!/usr/bin/env node
-// Resolves the Cargo target directory for a manifest by asking Cargo itself.
-//
-// `cargo metadata` is authoritative on BOTH broker-managed and unmanaged
-// hosts: through a managed shim it reports the broker's own workspace target
-// directory; without one it reports the local `target/` directory. LOCATING
-// the target directory therefore never needs broker detection — the metadata
-// command already reflects whichever host it runs on. `brokerManagedHost()`
-// (see cargo-contract.mjs) remains a separate, cache-policy-only decision:
-// whether Cache V2's lease/slot/prune/floor machinery should run at all, not
-// where the target directory lives.
-import { execFileSync } from "./background-process.mjs";
-import { runCargoSync } from "./managed-cargo.mjs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-export function resolveTargetRoot(manifestPath, options = {}) {
-  if (!manifestPath) throw new Error("resolveTargetRoot requires a Cargo.toml manifest path");
-  const execute = options.execFileSync ?? execFileSync;
-  let output;
-  try {
-    const args = ["metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifestPath];
-    if (options.execFileSync) {
-      output = execute("cargo", args, { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-    } else {
-      const result = runCargoSync(args, { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-      if (result.error) throw result.error;
-      if (result.status !== 0) throw new Error(String(result.stderr ?? "").trim() || `exited ${result.status}`);
-      output = result.stdout;
-    }
-  } catch (error) {
-    throw new Error(`metadata failed for ${manifestPath}: ${error.message}`);
-  }
-  const { target_directory: directory } = JSON.parse(output);
-  if (typeof directory !== "string" || directory.length === 0 || !path.isAbsolute(directory)) {
-    throw new Error(`metadata for ${manifestPath} did not report an absolute target_directory`);
-  }
-  return path.resolve(directory);
-}
-
-if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
-  const manifestPath = process.argv[2];
-  if (!manifestPath) {
-    console.error("usage: cargo-target.mjs <path-to-Cargo.toml>");
-    process.exit(1);
-  }
-  try {
-    process.stdout.write(`${resolveTargetRoot(manifestPath)}\n`);
-  } catch (error) {
-    console.error(error.message);
-    process.exit(1);
-  }
-}
+#!/usr/bin/env node
+// Resolves the Cargo target directory for a manifest by asking Cargo itself.
+//
+// `cargo metadata` is authoritative on BOTH broker-managed and unmanaged
+// hosts: through a managed shim it reports the broker's own workspace target
+// directory; without one it reports the local `target/` directory. LOCATING
+// the target directory therefore never needs broker detection — the metadata
+// command already reflects whichever host it runs on. `brokerManagedHost()`
+// (see cargo-contract.mjs) remains a separate, cache-policy-only decision:
+// whether Cache V2's lease/slot/prune/floor machinery should run at all, not
+// where the target directory lives.
+import { execFileSync } from "./background-process.mjs";
+import { runCargoSync } from "./managed-cargo.mjs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export function resolveTargetRoot(manifestPath, options = {}) {
+  if (!manifestPath) throw new Error("resolveTargetRoot requires a Cargo.toml manifest path");
+  const execute = options.execFileSync ?? execFileSync;
+  let output;
+  try {
+    const args = ["metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifestPath];
+    if (options.execFileSync) {
+      output = execute("cargo", args, { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    } else {
+      const result = runCargoSync(args, { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+      if (result.error) throw result.error;
+      if (result.status !== 0) throw new Error(String(result.stderr ?? "").trim() || `exited ${result.status}`);
+      output = result.stdout;
+    }
+  } catch (error) {
+    throw new Error(`metadata failed for ${manifestPath}: ${error.message}`);
+  }
+  const { target_directory: directory } = JSON.parse(output);
+  if (typeof directory !== "string" || directory.length === 0 || !path.isAbsolute(directory)) {
+    throw new Error(`metadata for ${manifestPath} did not report an absolute target_directory`);
+  }
+  return path.resolve(directory);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  const manifestPath = process.argv[2];
+  if (!manifestPath) {
+    console.error("usage: cargo-target.mjs <path-to-Cargo.toml>");
+    process.exit(1);
+  }
+  try {
+    process.stdout.write(`${resolveTargetRoot(manifestPath)}\n`);
+  } catch (error) {
+    console.error(error.message);
+    process.exit(1);
+  }
+}

package/cli/right-release.mjs

@@ -70,6 +70,8 @@ if (first === "--version" || first === "-v") {
   const rest = args.slice(1);
   if (rest[0] === "cargo") {
     run("publish-cargo.mjs", rest.slice(1));
+  } else if (rest[0] === "npm") {
+    run("publication-gate.mjs", rest.slice(1));
   } else if (rest[0] === "swift") {
     run("publish-swift.mjs", rest.slice(1));
   } else {
@@ -155,8 +157,10 @@ Commands:
                                                       Upload one sealed release; never builds
   release                                             Compatibility alias for build
   publish                                             Compatibility alias for upload
+  publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish (no publish)
+  publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish (never publishes)
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
-  publish swift [--scope <s>] [--url <u>] [--dry-run] Test, archive, scan, and publish RightKitSwift to a Swift registry
+  publish swift [--repo <git-url>] [--dry-run] Test, tag, resolve a fresh exact-pin consumer, and publish RightKitSwift to its git repo
   model promote --authority heardright --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
   addon doctor|build|upload|adopt <options>           Manage a signed headless add-on

package/development.mjs

@@ -1,6 +1,6 @@
 import { spawnSync } from "./background-process.mjs";
 import { createHash } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
@@ -48,7 +48,8 @@ export function validateDevelopmentConfig(config, platform) {
     if (target.install.manifestPath && path.isAbsolute(target.install.manifestPath)) throw new Error("install.manifestPath must be relative to app root");
   } else if (target.install?.kind === "portable") {
     const descriptor = target.install;
-    if (descriptor.activation?.kind !== "current" || !path.isAbsolute(descriptor.installRoot ?? "")) throw new Error("portable development installer requires absolute installRoot and current activation");
+    const absoluteInstallRoot = platform === "win" ? path.win32.isAbsolute(descriptor.installRoot ?? "") : path.isAbsolute(descriptor.installRoot ?? "");
+    if (descriptor.activation?.kind !== "current" || !absoluteInstallRoot) throw new Error("portable development installer requires absolute installRoot and current activation");
     for (const key of ["sourceDirectory", "entrypoint"]) {
       if (typeof descriptor[key] !== "string" || !descriptor[key] || path.isAbsolute(descriptor[key]) || path.win32.isAbsolute(descriptor[key]) || descriptor[key].split(/[\\/]/).includes("..")) throw new Error(`portable development ${key} must be a contained relative path`);
     }
@@ -231,10 +232,20 @@ export function resolvePnpmCli({ root, env = process.env } = {}) {
     const match = /"%~dp0\\([^"]*pnpm\.(?:mjs|cjs|js))"/i.exec(readFileSync(shim, "utf8"));
     if (match) candidates.push(path.resolve(dir, match[1]));
   }
-  const selected = candidates.find((candidate) => existsSync(candidate));
+  // Unix global pnpm exposes its JavaScript entry through a PATH symlink.
+  for (const dir of String(env.PATH ?? env.Path ?? "").split(path.delimiter).filter(Boolean)) candidates.push(path.join(dir, "pnpm"));
+  const selected = candidates.map(resolveJavaScriptEntrypoint).find(Boolean);
   if (!selected) throw new Error("could not resolve pnpm JavaScript CLI entrypoint; install/pin pnpm through Corepack");
   return selected;
 }
+function resolveJavaScriptEntrypoint(candidate) {
+  try {
+    const resolved = realpathSync(candidate);
+    return /pnpm\.(?:mjs|cjs|js)$/i.test(resolved) && statSync(resolved).isFile() ? resolved : undefined;
+  } catch {
+    return undefined;
+  }
+}
 function git(cwd, args) { const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed`); return result.stdout.trim(); }
 function inside(root, child) { const rel = path.relative(path.resolve(root), path.resolve(child)); return rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel)); }
 export async function main(args = process.argv.slice(2)) {