@rightkit/release 0.2.115 → 0.2.117

package/cli/right-release.mjs

@@ -22,6 +22,7 @@ const commands = new Map([
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
   ["github", "github-release.mjs"],
   ["cargo-target", "cargo-target.mjs"],
+  ["ownership", "ownership-command.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -157,8 +158,10 @@ Commands:
                                                       Upload one sealed release; never builds
   release                                             Compatibility alias for build
   publish                                             Compatibility alias for upload
-  publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish (no publish)
-  publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish (never publishes)
+  publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish
+  publish npm --package @rightkit/<name> --publish --tarball <gated.tgz>
+                                                      Publish the gated tarball with the Keychain token
+                                                      (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish swift [--repo <git-url>] [--dry-run] Test, tag, resolve a fresh exact-pin consumer, and publish RightKitSwift to its git repo
   model promote --authority heardright --config <file> [--dry-run]
@@ -167,6 +170,7 @@ Commands:
   doctor [--platform mac|win]                        Inspect one app's release config
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories
+  ownership [--app <dir>] [--json]                   Fail on app copies of RightKit-owned capabilities
   cache status [--json]                              Inspect the shared local build cache
   cache prune [--dry-run|--apply] [--json]           Plan or apply safe shared-target pruning
   cache migrate --config <file> [--dry-run|--apply] [--json]

package/ownership-command.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// right-release ownership: check an app against RightKit's capability ownership, or rebuild
+// the shipped manifest from each package's declaration.
+//
+//   right-release ownership [--app <dir>] [--json]
+//   right-release ownership --write-manifest [--rightkit <tools/rightkit>]
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { aggregateOwnership, checkApp, formatTable, MANIFEST_FILE } from "./ownership.mjs";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+const shipped = path.join(packageRoot, MANIFEST_FILE);
+
+function flag(args, name) {
+  const i = args.indexOf(name);
+  return i >= 0 ? args[i + 1] : undefined;
+}
+
+export function main(args) {
+  if (args.includes("--write-manifest")) {
+    const root = path.resolve(flag(args, "--rightkit") ?? path.join(packageRoot, "..", ".."));
+    const manifest = aggregateOwnership(root);
+    writeFileSync(shipped, `${JSON.stringify(manifest, null, 2)}\n`);
+    console.log(`[right-release] ownership manifest: ${manifest.capabilities.length} capabilities -> ${shipped}`);
+    return 0;
+  }
+  const app = path.resolve(flag(args, "--app") ?? process.cwd());
+  const manifest = JSON.parse(readFileSync(shipped, "utf8"));
+  const result = checkApp(app, manifest);
+  if (args.includes("--json")) {
+    console.log(JSON.stringify({ ok: result.ok, rows: result.rows, violations: result.violations, problems: result.problems }, null, 2));
+  } else {
+    console.log(`RightKit ownership: ${path.basename(app)}`);
+    console.log(formatTable(result.rows));
+    for (const v of result.violations) {
+      console.log(`  OWN COPY ${v.fingerprint} (${v.package}) ${v.file}${v.line ? `:${v.line}` : ""}  ${v.text}`);
+    }
+    for (const p of result.problems) console.log(`  EXCEPTION ${p}`);
+    console.log(result.ok ? "[right-release] ownership passed" : "[right-release] ownership FAILED: move these to RightKit or add a reviewed, dated exception");
+  }
+  return result.ok ? 0 : 1;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main(process.argv.slice(2));
+}

package/ownership.mjs

@@ -0,0 +1,273 @@
+// RightKit ownership gate: no Right Suite app keeps its own copy of a capability RightKit owns.
+//
+// Each RightKit package declares what it owns in `rightkit-ownership.json` beside its manifest
+// (capability + fingerprints of a reimplementation). `aggregateOwnership` folds those into the
+// shipped `rightkit-ownership.json`, so an app is always checked against the data of the
+// RightKit version it pins. `scanApp` reports fingerprint matches in an app repository; each
+// must be covered by a live, specific entry in the app's `.rightkit/ownership-exceptions.json`
+// (the migration backlog) or the gate fails.
+//
+// Fingerprint types:
+//   dependency  direct dependency by name (cargo | npm | swiftpm). Transitive use through a
+//               RightKit package is never flagged.
+//   source      regex over code files (comments-only lines, docs, tests fixtures, vendored and
+//               generated trees are skipped).
+import { spawnSync } from "./background-process.mjs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+export const MANIFEST_FILE = "rightkit-ownership.json";
+export const EXCEPTIONS_FILE = path.join(".rightkit", "ownership-exceptions.json");
+
+const SKIP_DIRS = new Set([
+  ".git", "node_modules", "target", "dist", "build", "out", ".next", ".turbo", ".cache",
+  "vendor", "third_party", "Pods", "DerivedData", ".build", "generated", "fixtures",
+  "test-fixtures", "__fixtures__", ".rightkit", ".audit",
+]);
+const CODE_EXT = new Set([".rs", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".jsx", ".swift", ".m", ".mm", ".c", ".cc", ".cpp", ".h", ".py", ".go", ".kt", ".java", ".cs"]);
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+
+/** Collect every package's ownership declaration under a RightKit checkout. */
+export function aggregateOwnership(rightkitRoot) {
+  const entries = [];
+  for (const group of ["crates", "packages"]) {
+    const dir = path.join(rightkitRoot, group);
+    if (!existsSync(dir)) continue;
+    for (const name of readdirSync(dir).sort()) {
+      const file = path.join(dir, name, MANIFEST_FILE);
+      if (!existsSync(file)) continue;
+      const declared = JSON.parse(readFileSync(file, "utf8"));
+      if (declared.schema !== undefined) continue; // the shipped aggregate itself
+      for (const capability of declared.capabilities ?? []) {
+        entries.push({ package: declared.package, ...capability });
+      }
+    }
+  }
+  const manifest = { schema: 1, capabilities: entries };
+  validateManifest(manifest);
+  return manifest;
+}
+
+export function validateManifest(manifest) {
+  const ids = new Set();
+  for (const c of manifest.capabilities) {
+    if (!c.package || !c.capability || !Array.isArray(c.fingerprints) || c.fingerprints.length === 0) {
+      throw new Error(`ownership: incomplete capability ${JSON.stringify(c).slice(0, 120)}`);
+    }
+    for (const f of c.fingerprints) {
+      if (!f.id || ids.has(f.id)) throw new Error(`ownership: missing or duplicate fingerprint id ${f.id}`);
+      ids.add(f.id);
+      if (f.type === "dependency") {
+        if (!["cargo", "npm", "swiftpm"].includes(f.ecosystem) || !f.name) throw new Error(`ownership: bad dependency fingerprint ${f.id}`);
+      } else if (f.type === "source") {
+        new RegExp(f.pattern); // throws on a bad pattern
+      } else {
+        throw new Error(`ownership: unknown fingerprint type ${f.type} (${f.id})`);
+      }
+    }
+  }
+}
+
+function skippedDir(name) {
+  return SKIP_DIRS.has(name) || name.startsWith(".") || /^(node_modules|target)/.test(name);
+}
+
+const RIGHTKIT_MARKER = `packages/release/${MANIFEST_FILE}`;
+
+// A nested repository is its own app with its own exceptions file, and RightKit's own sources
+// are the owner, never a copy.
+function walkTree(root, visit, rel = "") {
+  let entries;
+  try { entries = readdirSync(path.join(root, rel), { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    const r = rel ? `${rel}/${e.name}` : e.name;
+    if (e.isDirectory()) {
+      if (!skippedDir(e.name) && !existsSync(path.join(root, r, ".git"))
+        && !existsSync(path.join(root, r, RIGHTKIT_MARKER))) walkTree(root, visit, r);
+    } else if (e.isFile()) {
+      visit(r);
+    }
+  }
+}
+
+// Tracked plus untracked-but-not-ignored files. Git never descends into nested repositories,
+// and honoring .gitignore keeps model, data and build trees out of the scan.
+function gitFiles(root) {
+  if (!existsSync(path.join(root, ".git"))) return null;
+  const r = spawnSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    encoding: "utf8", maxBuffer: 256 * 1024 * 1024, windowsHide: true,
+  });
+  if (r.status !== 0) return null;
+  const files = r.stdout.split("\0").filter((f) => f && !f.endsWith("/"));
+  const rightkitRoots = files.filter((f) => f === RIGHTKIT_MARKER || f.endsWith(`/${RIGHTKIT_MARKER}`))
+    .map((f) => f.slice(0, f.length - RIGHTKIT_MARKER.length));
+  return files.filter((f) => !rightkitRoots.some((p) => f.startsWith(p))
+    && !f.split("/").slice(0, -1).some(skippedDir));
+}
+
+function walk(root, visit) {
+  const files = gitFiles(root);
+  if (files) files.forEach((f) => visit(f));
+  else walkTree(root, visit);
+}
+
+/** Direct dependencies declared by an app repository: [{ecosystem, name, file}]. */
+export function directDependencies(appRoot) {
+  const deps = [];
+  walk(appRoot, (rel) => {
+    const base = path.posix.basename(rel);
+    const abs = path.join(appRoot, rel);
+    if (base === "Cargo.toml") {
+      let section = "";
+      for (const line of readFileSync(abs, "utf8").split(/\r?\n/)) {
+        const header = line.match(/^\s*\[([^\]]+)\]/);
+        if (header) { section = header[1]; continue; }
+        const dotted = section.match(/(^|\.)(dev-|build-)?dependencies\.([A-Za-z0-9_-]+)$/);
+        if (dotted) { deps.push({ ecosystem: "cargo", name: dotted[3], file: rel }); section = "~"; continue; }
+        if (!/(^|\.)((dev|build)-)?dependencies$/.test(section)) continue;
+        const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=/);
+        if (m) deps.push({ ecosystem: "cargo", name: m[1], file: rel });
+      }
+    } else if (base === "package.json") {
+      let pkg;
+      try { pkg = JSON.parse(readFileSync(abs, "utf8")); } catch { return; }
+      for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+        for (const name of Object.keys(pkg[field] ?? {})) deps.push({ ecosystem: "npm", name, file: rel });
+      }
+    } else if (base === "Package.swift") {
+      for (const m of readFileSync(abs, "utf8").matchAll(/\.package\([^)]*url:\s*"([^"]+)"/g)) {
+        const name = m[1].replace(/\.git$/, "").split("/").pop();
+        deps.push({ ecosystem: "swiftpm", name, file: rel });
+      }
+    }
+  });
+  return deps;
+}
+
+function isCommentOnly(line) {
+  const t = line.trim();
+  return t.startsWith("//") || t.startsWith("#") || t.startsWith("*") || t.startsWith("/*") || t.startsWith("--");
+}
+
+/** All fingerprint matches in an app: [{fingerprint, capability, package, file, line, text}]. */
+export function scanApp(appRoot, manifest) {
+  const findings = [];
+  const deps = directDependencies(appRoot);
+  const sources = [];
+  for (const c of manifest.capabilities) {
+    for (const f of c.fingerprints) {
+      if (f.type === "dependency") {
+        for (const d of deps) {
+          if (d.ecosystem === f.ecosystem && d.name === f.name) {
+            findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, file: d.file, line: 0, text: `${d.ecosystem} dependency ${d.name}` });
+          }
+        }
+      } else {
+        sources.push({ c, f, re: new RegExp(f.pattern, f.flags ?? "") });
+      }
+    }
+  }
+  if (sources.length) {
+    // One combined pass rejects almost every file and line before the per-fingerprint tests.
+    const any = new RegExp(sources.map(({ f }) => `(?:${f.pattern})`).join("|"));
+    walk(appRoot, (rel) => {
+      if (!CODE_EXT.has(path.posix.extname(rel))) return;
+      const abs = path.join(appRoot, rel);
+      try { if (statSync(abs).size > MAX_FILE_BYTES) return; } catch { return; }
+      const text = readFileSync(abs, "utf8");
+      if (!any.test(text)) return;
+      const lines = text.split(/\r?\n/);
+      lines.forEach((line, i) => {
+        if (!any.test(line) || isCommentOnly(line)) return;
+        for (const { c, f, re } of sources) {
+          if (re.test(line)) findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, file: rel, line: i + 1, text: line.trim().slice(0, 160) });
+        }
+      });
+    });
+  }
+  return findings;
+}
+
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") { re += ".*"; i++; if (glob[i + 1] === "/") i++; }
+    else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+
+/** Load and validate an app's exceptions (the migration backlog). */
+export function loadExceptions(appRoot) {
+  const file = path.join(appRoot, EXCEPTIONS_FILE);
+  if (!existsSync(file)) return [];
+  const parsed = JSON.parse(readFileSync(file, "utf8"));
+  return (parsed.exceptions ?? []).map((e, i) => ({ ...e, index: i }));
+}
+
+/**
+ * Apply exceptions. Returns {violations, covered, problems}: uncovered findings, findings an
+ * exception covers, and exception defects (expired, stale, wildcard-only, incomplete).
+ */
+export function evaluate(findings, exceptions, { today = new Date().toISOString().slice(0, 10) } = {}) {
+  const problems = [];
+  const live = [];
+  for (const e of exceptions) {
+    const where = `exception #${e.index} (${e.fingerprint ?? "?"})`;
+    const missing = ["fingerprint", "paths", "reason", "owner", "approvedBy"].filter((k) => !e[k] || (Array.isArray(e[k]) && e[k].length === 0));
+    if (missing.length) { problems.push(`${where}: missing ${missing.join(", ")}`); continue; }
+    if (!e.expires && !e.tracking) { problems.push(`${where}: needs an expires date or a tracking item`); continue; }
+    if (e.paths.some((p) => /^\*+(\/\*+)*$/.test(p))) { problems.push(`${where}: wildcard-only paths are not allowed`); continue; }
+    if (e.expires && e.expires < today) { problems.push(`${where}: expired ${e.expires}`); continue; }
+    live.push({ ...e, matchers: e.paths.map(globToRegExp), used: false });
+  }
+  const violations = [];
+  const covered = [];
+  for (const f of findings) {
+    const e = live.find((x) => x.fingerprint === f.fingerprint && x.matchers.some((m) => m.test(f.file)));
+    if (e) { e.used = true; covered.push({ ...f, exception: e }); } else violations.push(f);
+  }
+  for (const e of live) if (!e.used) problems.push(`exception #${e.index} (${e.fingerprint}): stale, matches nothing; delete it`);
+  return { violations, covered, problems };
+}
+
+/** One row per capability: uses RightKit | own copy (exception, expiry) | not needed. */
+export function capabilityTable(manifest, deps, result) {
+  const rows = [];
+  const byCapability = new Map();
+  for (const c of manifest.capabilities) {
+    if (!byCapability.has(c.capability)) byCapability.set(c.capability, c.package);
+  }
+  for (const [capability, owner] of byCapability) {
+    const uses = deps.some((d) => d.name === owner || d.name === owner.replace(/^rightkit-/, "@rightkit/"));
+    const own = result.violations.filter((v) => v.capability === capability);
+    const excepted = result.covered.filter((v) => v.capability === capability);
+    let status;
+    if (own.length) status = `OWN COPY, NOT EXCEPTED (${own.length})`;
+    else if (excepted.length) {
+      const e = excepted[0].exception;
+      status = `own copy, excepted until ${e.expires ?? e.tracking} (${excepted.length})`;
+    } else status = uses ? "uses RightKit" : "not needed";
+    rows.push({ capability, owner, uses, status });
+  }
+  return rows;
+}
+
+export function formatTable(rows) {
+  const w1 = Math.max(10, ...rows.map((r) => r.capability.length));
+  const w2 = Math.max(7, ...rows.map((r) => r.owner.length));
+  const lines = [`${"capability".padEnd(w1)}  ${"owner".padEnd(w2)}  status`];
+  for (const r of rows) lines.push(`${r.capability.padEnd(w1)}  ${r.owner.padEnd(w2)}  ${r.status}`);
+  return lines.join("\n");
+}
+
+/** Full check for one app. `ok` is false on any uncovered copy or exception defect. */
+export function checkApp(appRoot, manifest, options = {}) {
+  const findings = scanApp(appRoot, manifest);
+  const result = evaluate(findings, loadExceptions(appRoot), options);
+  const rows = capabilityTable(manifest, directDependencies(appRoot), result);
+  return { ok: result.violations.length === 0 && result.problems.length === 0, rows, ...result };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.115",
+  "version": "0.2.117",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/preflight.mjs

@@ -20,8 +20,10 @@
 
 import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
+import { checkApp, MANIFEST_FILE } from "./ownership.mjs";
 
 export const PREFLIGHT_OK = "ok";
 export const PREFLIGHT_WARN = "warn";
@@ -176,6 +178,7 @@ export function collectPreflight({
   env = process.env,
   versionProbe = commandVersion,
   isBrokerManagedHost = brokerManagedHost,
+  ownership = true,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
@@ -287,9 +290,35 @@ export function collectPreflight({
     }
   }
 
+  if (repoRoot && ownership) {
+    // An app living inside the RightKit workspace repository is scoped to its own directory.
+    const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
+    checks.push(ownershipCheck(workspace && appRoot ? appRoot : repoRoot));
+  }
+
   return checks;
 }
 
+/** Release-blocking: the app keeps no unexcepted copy of a RightKit-owned capability. */
+export function ownershipCheck(repoRoot, manifestPath = path.join(path.dirname(fileURLToPath(import.meta.url)), MANIFEST_FILE)) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (error) {
+    return fail("ownership", `RightKit ownership manifest unreadable: ${error.message}`, "reinstall @rightkit/release");
+  }
+  const result = checkApp(repoRoot, manifest);
+  if (result.ok) {
+    const excepted = result.covered.length;
+    return ok("ownership", excepted ? `no unexcepted copies (${excepted} findings under dated exceptions)` : "no copies of RightKit-owned capabilities");
+  }
+  const first = result.violations[0];
+  const detail = first
+    ? `${result.violations.length} own cop${result.violations.length === 1 ? "y" : "ies"} of RightKit capabilities, e.g. ${first.fingerprint} at ${first.file}${first.line ? `:${first.line}` : ""}`
+    : result.problems[0];
+  return fail("ownership", detail, "run: right-release ownership (move to RightKit, or add a reviewed, dated exception)");
+}
+
 export function formatPreflight(checks) {
   const symbol = { [PREFLIGHT_OK]: "ok  ", [PREFLIGHT_WARN]: "WARN", [PREFLIGHT_FAIL]: "FAIL" };
   const lines = checks.map((check) => {

package/publication-gate.mjs

@@ -3,7 +3,9 @@
 // evidence file names the exact current commit SHA (clean tree for the package path) and carries
 // passing host run receipts from that same SHA: macOS and Windows, or macOS only for Swift.
 // Format: docs/RIGHTKIT-SHARED-PACKAGES.md, "Publication gate" -> "Evidence file format".
+import crypto from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
@@ -43,7 +45,11 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
     if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
     else if (head && evidence.commit !== head) missing.push(`evidence commit ${evidence.commit} != current HEAD ${head}`);
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
-    for (const host of requiredHosts(kind)) {
+    // npm UI packages may ship on macOS evidence first when Adrian decides so; the decision must be
+    // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
+    const darwinOnly = kind === "npm" && evidence.hostPolicy === "darwin-only"
+      && typeof evidence.hostPolicyReason === "string" && evidence.hostPolicyReason.trim() !== "";
+    for (const host of darwinOnly ? ["darwin"] : requiredHosts(kind)) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
@@ -68,21 +74,76 @@ export function enforcePublicationGate(options, { dryRun = false, write = (line)
   throw new Error(report);
 }
 
-// `right-release publish npm --package <name> [--evidence <file>] [--dry-run]`: preflight only.
-export function runNpmPreflight(argv, workspaceRoot = process.cwd()) {
-  let pkg; let evidence; const dryRun = argv.includes("--dry-run");
+// Keychain item holding a granular npm token scoped to @rightkit with 2FA bypass (created by Adrian).
+export const NPM_KEYCHAIN_SERVICE = "npm-rightkit-publish";
+
+// `right-release publish npm --package <name> [--evidence <file>] [--dry-run]` runs the gate only.
+// Add `--publish --tarball <file>` to publish that exact gated tarball: its sha256 must equal the
+// evidence artifactSha256, the token is read from the macOS Keychain inside this process (never
+// printed or passed on a command line), and the registry shasum is verified after publication.
+export function runNpmPreflight(argv, workspaceRoot = process.cwd(), deps = {}) {
+  let pkg; let evidence; let tarball; const dryRun = argv.includes("--dry-run"); const publish = argv.includes("--publish");
   for (let i = 0; i < argv.length; i += 1) {
     if (argv[i] === "--package") pkg = argv[++i];
     else if (argv[i] === "--evidence") evidence = argv[++i];
+    else if (argv[i] === "--tarball") tarball = path.resolve(argv[++i]);
     else if (argv[i] === "--workspace") workspaceRoot = path.resolve(argv[++i]);
-    else if (argv[i] !== "--dry-run") throw new Error(`unknown publish npm option: ${argv[i]}`);
+    else if (argv[i] !== "--dry-run" && argv[i] !== "--publish") throw new Error(`unknown publish npm option: ${argv[i]}`);
   }
   if (!pkg || !/^@rightkit\/[a-z0-9-]+$/.test(pkg)) throw new Error("publish npm requires --package @rightkit/<name>");
   const packagePath = path.join(workspaceRoot, "packages", pkg.slice("@rightkit/".length));
   const manifest = JSON.parse(fs.readFileSync(path.join(packagePath, "package.json"), "utf8"));
-  const options = { kind: "npm", name: pkg, version: manifest.version, packagePath, evidencePath: path.resolve(evidence ?? defaultEvidencePath(workspaceRoot, "npm", pkg)) };
-  enforcePublicationGate(options, { dryRun });
-  process.stdout.write("[right-release] npm preflight only: publish stays on the authenticated Windows primary checkout (pnpm publish)\n");
+  const evidencePath = path.resolve(evidence ?? defaultEvidencePath(workspaceRoot, "npm", pkg));
+  const options = { kind: "npm", name: pkg, version: manifest.version, packagePath, evidencePath };
+  if (!publish) {
+    enforcePublicationGate(options, { dryRun });
+    process.stdout.write("[right-release] npm preflight only; add --publish --tarball <file> to publish\n");
+    return;
+  }
+  if (dryRun) throw new Error("--publish and --dry-run are mutually exclusive");
+  if (!tarball) throw new Error("--publish requires --tarball <gated .tgz>");
+  enforcePublicationGate(options);
+  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath }, deps);
+}
+
+export function publishGatedTarball({ name, version, tarball, evidencePath }, deps = {}) {
+  const run = deps.spawnSync ?? spawnSync;
+  const bytes = fs.readFileSync(tarball);
+  const evidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
+  const sha256 = crypto.createHash("sha256").update(bytes).digest("hex");
+  if (sha256 !== evidence.artifactSha256) throw new Error(`tarball sha256 ${sha256} != evidence artifactSha256 ${evidence.artifactSha256}`);
+  const token = deps.readToken ? deps.readToken() : readKeychainToken(run);
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-npm-publish-"));
+  const userconfig = path.join(dir, "npmrc");
+  const redact = (text) => String(text ?? "").split(token).join("<redacted>");
+  try {
+    fs.writeFileSync(userconfig, "//registry.npmjs.org/:_authToken=${RIGHTKIT_NPM_TOKEN}\n", { mode: 0o600 });
+    const result = run("npm", ["publish", tarball, "--access", "public", "--registry", "https://registry.npmjs.org/", "--userconfig", userconfig],
+      { encoding: "utf8", env: { ...process.env, RIGHTKIT_NPM_TOKEN: token }, windowsHide: true });
+    const out = redact(`${result.stdout ?? ""}${result.stderr ?? ""}`);
+    if (result.error || result.status !== 0) throw new Error(`npm publish failed for ${name}@${version}:\n${out.trim()}`);
+    process.stdout.write(`[right-release] published ${name}@${version}\n`);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+  const sha1 = crypto.createHash("sha1").update(bytes).digest("hex");
+  const deadline = Date.now() + (deps.verifyTimeoutMs ?? 10 * 60 * 1000);
+  for (;;) {
+    const view = run("npm", ["view", `${name}@${version}`, "dist.shasum", "--prefer-online", "--registry", "https://registry.npmjs.org/"], { encoding: "utf8", windowsHide: true });
+    const registry = (view.stdout ?? "").trim();
+    if (registry === sha1) { process.stdout.write(`[right-release] registry bytes verified for ${name}@${version} (shasum ${sha1})\n`); return; }
+    if (registry && registry !== sha1) throw new Error(`registry shasum ${registry} != gated tarball ${sha1} for ${name}@${version}`);
+    if (Date.now() > deadline) throw new Error(`${name}@${version} not visible on the registry after publish; verify later with npm view`);
+    (deps.sleep ?? ((ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)))(15000);
+  }
+}
+
+function readKeychainToken(run) {
+  if (process.platform !== "darwin") throw new Error(`npm publish token lookup is implemented for the macOS Keychain (${NPM_KEYCHAIN_SERVICE}) only`);
+  const result = run("security", ["find-generic-password", "-s", NPM_KEYCHAIN_SERVICE, "-w"], { encoding: "utf8", windowsHide: true });
+  const token = (result.stdout ?? "").trim();
+  if (result.status !== 0 || !token) throw new Error(`Keychain item ${NPM_KEYCHAIN_SERVICE} not found; create it with: security add-generic-password -a "$USER" -s ${NPM_KEYCHAIN_SERVICE} -w`);
+  return token;
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {

package/rightkit-ownership.json

@@ -0,0 +1,363 @@
+{
+  "schema": 1,
+  "capabilities": [
+    {
+      "package": "rightkit-browser",
+      "capability": "browser-automation",
+      "summary": "Chromium over CDP with admission, SSRF policy, profiles and owned processes",
+      "fingerprints": [
+        {
+          "id": "browser.cargo.chromiumoxide",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "chromiumoxide"
+        },
+        {
+          "id": "browser.cargo.headless_chrome",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "headless_chrome"
+        },
+        {
+          "id": "browser.cargo.fantoccini",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fantoccini"
+        },
+        {
+          "id": "browser.cargo.thirtyfour",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "thirtyfour"
+        },
+        {
+          "id": "browser.npm.puppeteer",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "puppeteer"
+        },
+        {
+          "id": "browser.npm.puppeteer-core",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "puppeteer-core"
+        },
+        {
+          "id": "browser.npm.playwright-core",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "playwright-core"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-db",
+      "capability": "sqlite-storage",
+      "summary": "SQLite open profiles, WAL with verified fallback, keys, migrations, backup, recovery",
+      "fingerprints": [
+        {
+          "id": "db.cargo.rusqlite",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "rusqlite"
+        },
+        {
+          "id": "db.cargo.sqlx",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "sqlx"
+        },
+        {
+          "id": "db.npm.better-sqlite3",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "better-sqlite3"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-embed",
+      "capability": "embeddings",
+      "summary": "Local text embeddings",
+      "fingerprints": [
+        {
+          "id": "embed.cargo.fastembed",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fastembed"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-mcp",
+      "capability": "mcp",
+      "summary": "MCP client/server transports, trust gate, server pool",
+      "fingerprints": [
+        {
+          "id": "mcp.cargo.rmcp",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "rmcp"
+        },
+        {
+          "id": "mcp.npm.sdk",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@modelcontextprotocol/sdk"
+        },
+        {
+          "id": "mcp.protocol.initialized",
+          "type": "source",
+          "pattern": "[\"']notifications/initialized[\"']"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-oauth",
+      "capability": "oauth-sign-in",
+      "summary": "OAuth sign-in: loopback PKCE, device flow, provider endpoints, refresh",
+      "fingerprints": [
+        {
+          "id": "oauth.cargo.oauth2",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "oauth2"
+        },
+        {
+          "id": "oauth.cargo.openidconnect",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "openidconnect"
+        },
+        {
+          "id": "oauth.cargo.yup-oauth2",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "yup-oauth2"
+        },
+        {
+          "id": "oauth.npm.simple-oauth2",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "simple-oauth2"
+        },
+        {
+          "id": "oauth.npm.oauth4webapi",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "oauth4webapi"
+        },
+        {
+          "id": "oauth.endpoint.github",
+          "type": "source",
+          "pattern": "github\\.com/login/(oauth/(authorize|access_token)|device/code)"
+        },
+        {
+          "id": "oauth.endpoint.google",
+          "type": "source",
+          "pattern": "accounts\\.google\\.com/o/oauth2|oauth2\\.googleapis\\.com/(token|device/code)"
+        },
+        {
+          "id": "oauth.endpoint.openai",
+          "type": "source",
+          "pattern": "auth\\.openai\\.com/oauth/(authorize|token)"
+        },
+        {
+          "id": "oauth.endpoint.apple",
+          "type": "source",
+          "pattern": "appleid\\.apple\\.com/auth/(authorize|token)"
+        },
+        {
+          "id": "oauth.endpoint.cloudflare",
+          "type": "source",
+          "pattern": "dash\\.cloudflare\\.com/oauth2/(auth|token)"
+        },
+        {
+          "id": "oauth.device-grant",
+          "type": "source",
+          "pattern": "urn:ietf:params:oauth:grant-type:device_code"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-ort",
+      "capability": "onnx-runtime",
+      "summary": "ONNX Runtime selection, execution providers, dylib resolution and global pools",
+      "fingerprints": [
+        {
+          "id": "ort.cargo.ort",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "ort"
+        },
+        {
+          "id": "ort.npm.onnxruntime-node",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "onnxruntime-node"
+        },
+        {
+          "id": "ort.env.dylib",
+          "type": "source",
+          "pattern": "ORT_DYLIB_PATH"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-process",
+      "capability": "owned-processes",
+      "summary": "Child processes owned as a tree: process groups / kill-on-close jobs, hidden windows",
+      "fingerprints": [
+        {
+          "id": "process.cargo.process-wrap",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "process-wrap"
+        },
+        {
+          "id": "process.cargo.command-group",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "command-group"
+        },
+        {
+          "id": "process.api.kill-on-job-close",
+          "type": "source",
+          "pattern": "JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-sandbox",
+      "capability": "os-sandbox",
+      "summary": "Seatbelt / Landlock+seccomp / AppContainer confinement, PTY leases, resource authority",
+      "fingerprints": [
+        {
+          "id": "sandbox.cargo.landlock",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "landlock"
+        },
+        {
+          "id": "sandbox.cargo.seccompiler",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "seccompiler"
+        },
+        {
+          "id": "sandbox.api.appcontainer",
+          "type": "source",
+          "pattern": "\\b(CreateAppContainerProfile|DeriveAppContainerSidFromAppContainerName|PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES)\\b"
+        },
+        {
+          "id": "sandbox.api.seatbelt",
+          "type": "source",
+          "pattern": "\\bsandbox_init\\b|sandbox-exec\\b"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-secrets",
+      "capability": "os-credential-store",
+      "summary": "Keychain / Credential Manager access with per-app namespaces and test guards",
+      "fingerprints": [
+        {
+          "id": "secrets.cargo.keyring",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "keyring"
+        },
+        {
+          "id": "secrets.cargo.security-framework",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "security-framework"
+        },
+        {
+          "id": "secrets.npm.keytar",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "keytar"
+        },
+        {
+          "id": "secrets.api.wincred",
+          "type": "source",
+          "pattern": "\\bCred(Write|Read|Delete|Enumerate)W?\\b"
+        },
+        {
+          "id": "secrets.api.secitem",
+          "type": "source",
+          "pattern": "\\bSecItem(Add|CopyMatching|Update|Delete)\\b"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-shell",
+      "capability": "desktop-shell",
+      "summary": "Tauri shell: tray, autostart, deep links, single instance, window state, notifications",
+      "fingerprints": [
+        {
+          "id": "shell.cargo.tauri-plugin-autostart",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-autostart"
+        },
+        {
+          "id": "shell.cargo.tauri-plugin-deep-link",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-deep-link"
+        },
+        {
+          "id": "shell.cargo.tauri-plugin-single-instance",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-single-instance"
+        },
+        {
+          "id": "shell.cargo.tauri-plugin-window-state",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-window-state"
+        },
+        {
+          "id": "shell.cargo.tauri-plugin-notification",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-notification"
+        },
+        {
+          "id": "shell.cargo.auto-launch",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "auto-launch"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-watch",
+      "capability": "file-watching",
+      "summary": "Coalesced, ignore-aware file watching with rescan recovery",
+      "fingerprints": [
+        {
+          "id": "watch.cargo.notify",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "notify"
+        },
+        {
+          "id": "watch.cargo.notify-debouncer-full",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "notify-debouncer-full"
+        },
+        {
+          "id": "watch.npm.chokidar",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "chokidar"
+        }
+      ]
+    }
+  ]
+}

package/rightkit-versions.json

@@ -20,16 +20,16 @@
     "@rightkit/hooks": "0.1.1",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
-    "@rightkit/legal-ui": "0.1.2",
+    "@rightkit/legal-ui": "0.1.3",
     "@rightkit/license": "0.1.8",
     "@rightkit/logs": "0.1.4",
-    "@rightkit/media-ui": "0.2.3",
-    "@rightkit/onboarding": "0.2.0",
+    "@rightkit/media-ui": "0.2.5",
+    "@rightkit/onboarding": "0.2.1",
     "@rightkit/pdf-ui": "0.1.0",
     "@rightkit/platform-ui": "0.1.2",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.115",
-    "@rightkit/settings-ui": "0.2.0",
+    "@rightkit/release": "0.2.117",
+    "@rightkit/settings-ui": "0.2.2",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/theme": "0.2.0",
@@ -69,7 +69,8 @@
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "@rightkit/hooks": [
       "0.1.0"
@@ -135,7 +136,9 @@
       "0.2.111",
       "0.2.112",
       "0.2.113",
-      "0.2.114"
+      "0.2.114",
+      "0.2.115",
+      "0.2.116"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -148,16 +151,20 @@
       "0.1.0",
       "0.2.0",
       "0.2.1",
-      "0.2.2"
+      "0.2.2",
+      "0.2.3",
+      "0.2.4"
     ],
     "@rightkit/theme": [
       "0.1.0"
     ],
     "@rightkit/settings-ui": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ],
     "@rightkit/onboarding": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ],
     "@rightkit/doc-render": [
       "0.1.0"
@@ -167,19 +174,30 @@
     ]
   },
   "cargo": {
+    "rightkit-audio": "0.1.0",
+    "rightkit-browser": "0.1.0",
+    "rightkit-cache": "0.1.0",
+    "rightkit-crash": "0.1.0",
+    "rightkit-db": "0.1.0",
+    "rightkit-framed-sidecar": "0.1.0",
+    "rightkit-fs": "0.1.0",
     "rightkit-license": "0.1.2",
     "rightkit-logs": "0.1.0",
+    "rightkit-media": "0.1.0",
+    "rightkit-pdf": "0.1.0",
+    "rightkit-playback": "0.1.0",
     "rightkit-process": "0.1.0",
+    "rightkit-search": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
   "stagedCargo": {
     "rightkit-automation": "0.1.0",
     "rightkit-audio": "0.1.0",
-    "rightkit-browser": "0.1.0",
+    "rightkit-browser": "0.1.1",
     "rightkit-cache": "0.1.0",
-    "rightkit-control": "0.1.0",
+    "rightkit-control": "0.1.1",
     "rightkit-crash": "0.1.0",
-    "rightkit-db": "0.1.0",
+    "rightkit-db": "0.2.0",
     "rightkit-framed-sidecar": "0.1.0",
     "rightkit-fs": "0.1.0",
     "rightkit-jobs": "0.1.0",
@@ -188,7 +206,7 @@
     "rightkit-models": "0.1.0",
     "rightkit-pdf": "0.1.0",
     "rightkit-playback": "0.1.0",
-    "rightkit-process": "0.2.0",
+    "rightkit-process": "0.2.1",
     "rightkit-qa": "0.1.0",
     "rightkit-sandbox": "0.1.0",
     "rightkit-search": "0.1.0",