@rightkit/release 0.2.121 → 0.2.122

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.121",
+  "version": "0.2.122",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -26,6 +26,9 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
+  "dependencies": {
+    "smol-toml": "1.7.0"
+  },
   "scripts": {
     "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",

package/preflight.mjs

@@ -20,10 +20,9 @@
 
 import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
-import { checkApp, MANIFEST_FILE } from "./ownership.mjs";
+import { createOwnershipEvidence } from "./ownership-evidence.mjs";
 
 export const PREFLIGHT_OK = "ok";
 export const PREFLIGHT_WARN = "warn";
@@ -179,6 +178,7 @@ export function collectPreflight({
   versionProbe = commandVersion,
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
+  ownershipEvidenceFactory = createOwnershipEvidence,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
@@ -293,30 +293,33 @@ export function collectPreflight({
   if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
     const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
-    checks.push(ownershipCheck(workspace && appRoot ? appRoot : repoRoot));
+    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, evidenceFactory: ownershipEvidenceFactory }));
   }
 
   return checks;
 }
 
 /** Release-blocking: the app keeps no unexcepted copy of a RightKit-owned capability. */
-export function ownershipCheck(repoRoot, manifestPath = path.join(path.dirname(fileURLToPath(import.meta.url)), MANIFEST_FILE)) {
-  let manifest;
-  try {
-    manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-  } catch (error) {
-    return fail("ownership", `RightKit ownership manifest unreadable: ${error.message}`, "reinstall @rightkit/release");
+export function ownershipCheck(repoRoot, options = {}) {
+  let checked;
+  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot); }
+  catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
+  const { result, evidence, floor } = checked;
+  if (checked.enrollmentPending) {
+    const diagnostics = [...(result.problems ?? []), ...(result.violations ?? []).map((entry) => `${entry.fingerprint} at ${entry.file}${entry.line ? `:${entry.line}` : ""}`)];
+    return { ...warn("ownership", `${checked.warning}${diagnostics.length ? `; ${diagnostics.length} diagnostic finding/problem(s) retained` : ""}`, null), evidence, diagnostics, result, floor };
   }
-  const result = checkApp(repoRoot, manifest);
-  if (result.ok) {
+  if (checked.ok) {
     const excepted = result.covered.length;
-    return ok("ownership", excepted ? `no unexcepted copies (${excepted} findings under dated exceptions)` : "no copies of RightKit-owned capabilities");
+    return { ...ok("ownership", excepted ? `no unapproved copies (${excepted} signed findings)` : "no copies of RightKit-owned capabilities"), evidence };
   }
   const first = result.violations[0];
-  const detail = first
-    ? `${result.violations.length} own cop${result.violations.length === 1 ? "y" : "ies"} of RightKit capabilities, e.g. ${first.fingerprint} at ${first.file}${first.line ? `:${first.line}` : ""}`
-    : result.problems[0];
-  return fail("ownership", detail, "run: right-release ownership (move to RightKit, or add a reviewed, dated exception)");
+  const detail = !floor.ok
+    ? floor.problems.join("; ")
+    : first
+      ? `${result.violations.length} own cop${result.violations.length === 1 ? "y" : "ies"} of RightKit capabilities, e.g. ${first.fingerprint} at ${first.file}${first.line ? `:${first.line}` : ""}`
+      : result.problems[0] ?? result.coverage[0]?.reason ?? "ownership scan incomplete";
+  return { ...fail("ownership", detail, "run: right-release ownership (move to RightKit, or request a signed, dated exception)"), evidence };
 }
 
 export function formatPreflight(checks) {

package/publication-gate.mjs

@@ -8,6 +8,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
+import { recordPublished } from "./rightkit-sync.mjs";
 import { fileURLToPath } from "node:url";
 
 export const GATE_SCHEMA = 1;
@@ -158,7 +159,7 @@ export function publishGatedTarball({ name, version, tarball, evidencePath }, de
   for (;;) {
     const view = run("npm", ["view", `${name}@${version}`, "dist.shasum", "--prefer-online", "--registry", "https://registry.npmjs.org/"], { encoding: "utf8", windowsHide: true });
     const registry = (view.stdout ?? "").trim();
-    if (registry === sha1) { process.stdout.write(`[right-release] registry bytes verified for ${name}@${version} (shasum ${sha1})\n`); return; }
+    if (registry === sha1) { process.stdout.write(`[right-release] registry bytes verified for ${name}@${version} (shasum ${sha1})\n`); (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version }); return; }
     if (registry && registry !== sha1) throw new Error(`registry shasum ${registry} != gated tarball ${sha1} for ${name}@${version}`);
     if (Date.now() > deadline) throw new Error(`${name}@${version} not visible on the registry after publish; verify later with npm view`);
     (deps.sleep ?? ((ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)))(15000);

package/publish-cargo.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
+import { recordPublished } from "./rightkit-sync.mjs";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
 const SECRET_PATTERNS = [
@@ -139,6 +140,10 @@ function main() {
   const options = parseCargoPublishArgs(process.argv.slice(2));
   runCargoPublish(options);
   process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
+  if (!options.dryRun) {
+    const version = fs.readFileSync(path.join(options.workspaceRoot, "crates", options.crate, "Cargo.toml"), "utf8").match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+    if (version) recordPublished({ registry: "cargo", name: options.crate, version });
+  }
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {

package/release.mjs

@@ -41,7 +41,7 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
   RIGHTKIT_VERSIONS.stagedNpm,
   RIGHTKIT_VERSIONS.legacyNpm,
 );
-const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
+const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo, RIGHTKIT_VERSIONS.legacyCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 const WINDOWS_NSIS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
 const WINDOWS_PORTABLE_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-portable-v1";

package/rightkit-drift.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+// RightKit adoption drift: which @rightkit/* and rightkit-* pins in an app are behind the latest
+// published versions, and (with --apply) move them forward and refresh the lockfiles.
+// Self-contained (node: built-ins only) so the SessionStart hook can carry a byte copy of it.
+//   node rightkit-drift.mjs [--apply [--all]] [app-root]   (--all also adopts breaking bumps)
+import { spawnSync } from "./background-process.mjs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const DEPENDENCY_SECTIONS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+const CARGO_PIN = /^(\s*)(rightkit-[A-Za-z0-9_-]+)(\s*=\s*(?:\{[^}\n]*?\bversion\s*=\s*)?")([=^~]?)(\d+\.\d+\.\d+)(")/;
+
+export function loadRightkitVersions() {
+  for (const name of ["rightkit-versions.json", "ownership-session-versions.json"]) {
+    const file = path.join(here, name);
+    if (existsSync(file)) return JSON.parse(readFileSync(file, "utf8"));
+  }
+  throw new Error("rightkit versions manifest not found next to rightkit-drift.mjs");
+}
+
+const numeric = (value) => String(value).split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+const newer = (candidate, current) => { const a = numeric(candidate); const b = numeric(current); for (let i = 0; i < 3; i += 1) if (a[i] !== b[i]) return a[i] > b[i]; return false; };
+/** Semver-breaking for 0.x crates/packages is a minor bump; from 1.0 it is a major bump. */
+export const breakingBump = (from, to) => { const a = numeric(from); const b = numeric(to); return a[0] === 0 && b[0] === 0 ? a[1] !== b[1] : a[0] !== b[0]; };
+// Only versions the registry is known to serve: a staged version may not be published yet.
+const latestFor = (versions, ecosystem, name) => versions.registry
+  ? versions.registry[ecosystem]?.[name]
+  : ecosystem === "npm" ? versions.stagedNpm?.[name] ?? versions.npm?.[name] : versions.stagedCargo?.[name] ?? versions.cargo?.[name];
+
+/** Tracked package.json and Cargo.toml files, excluding RightKit's own source tree and vendored trees. */
+export function dependencyManifests(appRoot) {
+  const listed = spawnSync("git", ["-C", appRoot, "ls-files", "-z", "--", "package.json", "*/package.json", "Cargo.toml", "*/Cargo.toml"], { encoding: "utf8", windowsHide: true, maxBuffer: 16 * 1024 * 1024 });
+  const files = listed.status === 0 ? listed.stdout.split("\0").filter(Boolean) : ["package.json", "Cargo.toml"].filter((file) => existsSync(path.join(appRoot, file)));
+  return files.filter((file) => !/(^|\/)(node_modules|vendor|target|dist)\//.test(file) && !file.startsWith("tools/rightkit/"));
+}
+
+/** Pins behind the latest published RightKit version. Workspace, path, git and range-less specs are skipped. */
+export function rightkitDrift(appRoot, versions = loadRightkitVersions()) {
+  const drift = [];
+  for (const file of dependencyManifests(appRoot)) {
+    const text = readFileSync(path.join(appRoot, file), "utf8");
+    if (file.endsWith("package.json")) {
+      let manifest; try { manifest = JSON.parse(text); } catch { continue; }
+      for (const section of DEPENDENCY_SECTIONS) {
+        for (const [name, spec] of Object.entries(manifest[section] ?? {})) {
+          const match = name.startsWith("@rightkit/") && typeof spec === "string" ? spec.match(/^([\^~=]?)(\d+\.\d+\.\d+)$/) : null;
+          const latest = match && latestFor(versions, "npm", name);
+          if (latest && newer(latest, match[2])) drift.push({ ecosystem: "npm", name, file, current: match[2], latest, breaking: breakingBump(match[2], latest) });
+        }
+      }
+      continue;
+    }
+    for (const line of text.split(/\r?\n/)) {
+      if (/\bpath\s*=/.test(line)) continue;
+      const match = line.match(CARGO_PIN);
+      const latest = match && latestFor(versions, "cargo", match[2]);
+      if (latest && newer(latest, match[5])) drift.push({ ecosystem: "cargo", name: match[2], file, current: match[5], latest, breaking: breakingBump(match[5], latest) });
+    }
+  }
+  return drift;
+}
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, { cwd, stdio: "inherit", windowsHide: true, shell: process.platform === "win32" });
+  if (result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed in ${cwd} (exit ${result.status ?? result.error?.message})`);
+}
+
+/** Move drifted pins to the latest version (keeping their = ^ ~ prefix), then refresh lockfiles.
+ * Breaking bumps need code changes, so they are adopted only with includeBreaking. */
+export function applyRightkitAdoption(appRoot, versions = loadRightkitVersions(), { refreshLocks = true, includeBreaking = false } = {}) {
+  const drift = rightkitDrift(appRoot, versions).filter((item) => includeBreaking || !item.breaking);
+  const byFile = Map.groupBy(drift, (item) => item.file);
+  for (const [file, items] of byFile) {
+    const full = path.join(appRoot, file); let text = readFileSync(full, "utf8");
+    if (file.endsWith("package.json")) {
+      const manifest = JSON.parse(text);
+      for (const item of items) for (const section of DEPENDENCY_SECTIONS) {
+        const spec = manifest[section]?.[item.name];
+        if (typeof spec === "string") manifest[section][item.name] = spec.replace(item.current, item.latest);
+      }
+      text = `${JSON.stringify(manifest, null, 2)}\n`;
+    } else {
+      const latest = new Map(items.map((item) => [item.name, item.latest]));
+      text = text.split(/(?<=\n)/).map((line) => line.replace(CARGO_PIN, (all, indent, name, mid, prefix, version, close) => /\bpath\s*=/.test(line) || !latest.has(name) ? all : `${indent}${name}${mid}${prefix}${latest.get(name)}${close}`)).join("");
+    }
+    writeFileSync(full, text);
+  }
+  if (refreshLocks) {
+    for (const file of byFile.keys()) {
+      const dir = path.join(appRoot, path.dirname(file));
+      if (file.endsWith("package.json")) run("pnpm", ["install", "--lockfile-only", "--ignore-scripts"], dir);
+      else run("rightkit", ["cargo", "metadata", "--format-version", "1", "--manifest-path", path.join(appRoot, file)], dir);
+    }
+  }
+  return drift;
+}
+
+export function formatDrift(drift) {
+  if (!drift.length) return "RightKit pins are current.";
+  return [`RightKit updates available (${drift.length}):`, ...drift.map((d) => `- ${d.name} ${d.current} -> ${d.latest}${d.breaking ? " (breaking)" : ""} (${d.file})`)].join("\n");
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2); const apply = args.includes("--apply");
+  const root = path.resolve(args.find((arg) => !arg.startsWith("--")) ?? process.cwd());
+  try {
+    const drift = apply ? applyRightkitAdoption(root, undefined, { includeBreaking: args.includes("--all") }) : rightkitDrift(root);
+    process.stdout.write(`${apply && drift.length ? `Adopted:\n${formatDrift(drift).split("\n").slice(1).join("\n")}` : formatDrift(drift)}\n`);
+  } catch (error) { process.stderr.write(`rightkit-drift: ${error.message}\n`); process.exitCode = 1; }
+}

package/rightkit-ownership.json

@@ -1,5 +1,6 @@
 {
   "schema": 1,
+  "version": "1",
   "capabilities": [
     {
       "package": "rightkit-browser",
@@ -47,6 +48,93 @@
           "type": "dependency",
           "ecosystem": "npm",
           "name": "playwright-core"
+        },
+        {
+          "id": "browser.npm.playwright",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "playwright"
+        },
+        {
+          "id": "browser.npm.playwright-test",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@playwright/test"
+        },
+        {
+          "id": "browser.npm.selenium-webdriver",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "selenium-webdriver"
+        },
+        {
+          "id": "browser.cargo.webdriver",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "webdriver"
+        },
+        {
+          "id": "browser.source.chrome-discovery",
+          "type": "source",
+          "pattern": "Google[\\\\/]+Chrome[\\\\/]+Application[\\\\/]+chrome\\.exe|Google Chrome\\.app/Contents/MacOS/Google Chrome"
+        }
+      ]
+    },
+    {
+      "package": "rightkit-control",
+      "capability": "desktop-control",
+      "summary": "Background native input, accessibility reads and WebDriver bridge for driving desktop apps without stealing focus",
+      "fingerprints": [
+        {
+          "id": "control.cargo.enigo",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "enigo"
+        },
+        {
+          "id": "control.cargo.rdev",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "rdev"
+        },
+        {
+          "id": "control.cargo.uiautomation",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "uiautomation"
+        },
+        {
+          "id": "control.cargo.accessibility-sys",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "accessibility-sys"
+        },
+        {
+          "id": "control.npm.nut-js",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@nut-tree/nut-js"
+        },
+        {
+          "id": "control.npm.robotjs",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "robotjs"
+        },
+        {
+          "id": "control.api.cgevent-post",
+          "type": "source",
+          "pattern": "\\bCGEventPost(ToPid)?\\s*\\("
+        },
+        {
+          "id": "control.api.ax-element",
+          "type": "source",
+          "pattern": "\\bAXUIElementCreate(Application|SystemWide)\\s*\\("
+        },
+        {
+          "id": "control.api.sendinput",
+          "type": "source",
+          "pattern": "\\bSendInput\\s*\\("
         }
       ]
     },
@@ -227,6 +315,37 @@
         }
       ]
     },
+    {
+      "package": "rightkit-qa",
+      "capability": "desktop-qa",
+      "summary": "Desktop app QA engine: launch, drive, assert and capture installed apps (with rightkit-control)",
+      "fingerprints": [
+        {
+          "id": "qa.npm.webdriverio",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "webdriverio"
+        },
+        {
+          "id": "qa.npm.wdio-cli",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@wdio/cli"
+        },
+        {
+          "id": "qa.npm.axe-playwright",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@axe-core/playwright"
+        },
+        {
+          "id": "qa.cargo.tauri-driver",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-driver"
+        }
+      ]
+    },
     {
       "package": "rightkit-sandbox",
       "capability": "os-sandbox",
@@ -358,6 +477,18 @@
           "name": "chokidar"
         }
       ]
+    },
+    {
+      "package": "RightKitSwift",
+      "capability": "os-credential-store",
+      "summary": "Native Apple scoped credential storage and sync migration",
+      "fingerprints": [
+        {
+          "id": "secrets.swift.scoped-migration",
+          "type": "source",
+          "pattern": "\\bfunc\\s+copySyncedToDeviceOnly\\s*\\("
+        }
+      ]
     }
   ]
 }

package/rightkit-sync.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// Release feed: set rightkit-versions.json staged maps from what crates.io and npm actually serve.
+// Every publishable crate under crates/ and package under packages/ is looked up; a newer
+// published version becomes the staged (latest) version and the one it replaces stays allowed
+// in legacyCargo / legacyNpm, so apps pinned to it keep validating until they adopt.
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+const rightkitRoot = path.resolve(packageRoot, "..", "..");
+const VERSIONS_FILE = path.join(packageRoot, "rightkit-versions.json");
+const USER_AGENT = "rightkit-sync/1 (https://github.com/bogusyogi/claude)";
+
+const field = (toml, key) => toml.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"))?.[1] ?? null;
+
+/** Publishable RightKit crates and npm packages, from the source tree. */
+export function rightkitPublishables(root = rightkitRoot) {
+  const crates = []; const packages = [];
+  for (const dir of readdirSync(path.join(root, "crates")).sort()) {
+    const manifest = path.join(root, "crates", dir, "Cargo.toml");
+    if (!existsSync(manifest)) continue;
+    const toml = readFileSync(manifest, "utf8");
+    const [packageSection] = toml.split(/^\[(?!package\])/m);
+    if (/^publish\s*=\s*false/m.test(packageSection)) continue;
+    const name = field(packageSection, "name");
+    if (name?.startsWith("rightkit-")) crates.push(name);
+  }
+  for (const dir of readdirSync(path.join(root, "packages")).sort()) {
+    const manifest = path.join(root, "packages", dir, "package.json");
+    if (!existsSync(manifest)) continue;
+    const pkg = JSON.parse(readFileSync(manifest, "utf8"));
+    if (!pkg.private && pkg.name?.startsWith("@rightkit/")) packages.push(pkg.name);
+  }
+  return { crates, packages };
+}
+
+export function compareVersions(left, right) {
+  const parse = (value) => String(value).split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const a = parse(left); const b = parse(right);
+  for (let i = 0; i < 3; i += 1) if (a[i] !== b[i]) return a[i] - b[i];
+  return 0;
+}
+
+async function fetchJson(fetchImpl, url) {
+  const response = await fetchImpl(url, { headers: { "user-agent": USER_AGENT, accept: "application/json" }, signal: AbortSignal.timeout(15_000) });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`);
+  return response.json();
+}
+
+/** Latest stable published version per registry, or null when never published. */
+export async function registryLatest({ crates, packages }, { fetchImpl = fetch, concurrency = 6 } = {}) {
+  const jobs = [
+    ...crates.map((name) => ({ registry: "cargo", name, url: `https://crates.io/api/v1/crates/${name}`, pick: (body) => body?.crate?.max_stable_version ?? null })),
+    ...packages.map((name) => ({ registry: "npm", name, url: `https://registry.npmjs.org/${name.replace("/", "%2f")}`, pick: (body) => body?.["dist-tags"]?.latest ?? null })),
+  ];
+  const results = []; let cursor = 0;
+  const worker = async () => {
+    while (cursor < jobs.length) {
+      const job = jobs[cursor]; cursor += 1;
+      results.push({ registry: job.registry, name: job.name, version: job.pick(await fetchJson(fetchImpl, job.url)) });
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, jobs.length) }, worker));
+  return results.sort((a, b) => `${a.registry}:${a.name}`.localeCompare(`${b.registry}:${b.name}`));
+}
+
+/** Pure update: returns the new versions document and the list of changes. */
+export function applyRegistryLatest(versions, latest) {
+  const next = structuredClone(versions); const changes = []; let verified = 0;
+  for (const { registry, name, version } of latest) {
+    if (!version) continue;
+    // What the registry serves: the only versions adoption recommends (staged may still be unpublished).
+    next.registry ??= { cargo: {}, npm: {} }; next.registry[registry] ??= {};
+    if (next.registry[registry][name] !== version) { next.registry[registry][name] = version; verified += 1; }
+    const stagedKey = registry === "cargo" ? "stagedCargo" : "stagedNpm";
+    const legacyKey = registry === "cargo" ? "legacyCargo" : "legacyNpm";
+    const current = next[stagedKey]?.[name] ?? next[registry]?.[name] ?? null;
+    if (current && compareVersions(version, current) <= 0) continue;
+    next[stagedKey] ??= {};
+    const previous = next[stagedKey][name];
+    if (previous && previous !== next[registry]?.[name]) {
+      next[legacyKey] ??= {};
+      const legacy = new Set(next[legacyKey][name] ?? []); legacy.add(previous);
+      next[legacyKey][name] = [...legacy].sort(compareVersions);
+    }
+    next[stagedKey][name] = version;
+    next[stagedKey] = Object.fromEntries(Object.entries(next[stagedKey]).sort(([a], [b]) => a.localeCompare(b)));
+    changes.push({ registry, name, from: current, to: version });
+  }
+  for (const key of ["cargo", "npm"]) if (next.registry?.[key]) next.registry[key] = Object.fromEntries(Object.entries(next.registry[key]).sort(([a], [b]) => a.localeCompare(b)));
+  return { versions: next, changes, verified };
+}
+
+export async function syncRightkitVersions({ check = false, fetchImpl = fetch, file = VERSIONS_FILE, root = rightkitRoot, log = (line) => process.stdout.write(`${line}\n`) } = {}) {
+  const versions = JSON.parse(readFileSync(file, "utf8"));
+  const latest = await registryLatest(rightkitPublishables(root), { fetchImpl });
+  const { versions: next, changes, verified } = applyRegistryLatest(versions, latest);
+  for (const change of changes) log(`${change.registry} ${change.name}: ${change.from ?? "unlisted"} -> ${change.to}`);
+  const unpublished = latest.filter((item) => !item.version).map((item) => `${item.registry}:${item.name}`);
+  if (unpublished.length) log(`never published: ${unpublished.join(", ")}`);
+  if (!changes.length) log("rightkit-versions.json matches the registries");
+  if (check) return { changes, unpublished, copies: [], written: false };
+  if (changes.length || verified) writeFileSync(file, `${JSON.stringify(next, null, 2)}\n`);
+  const copies = syncConsumerCopies(root);
+  for (const copy of copies) log(`refreshed ${copy}`);
+  return { changes, unpublished, copies, written: changes.length > 0 };
+}
+
+/** Record one just-published version (the registry index can lag the upload) and refresh the copies.
+ * Called by right-release after a verified cargo or npm publish; never fails the publish itself. */
+export function recordPublished({ registry, name, version }, { file = VERSIONS_FILE, root = rightkitRoot, log = (line) => process.stdout.write(`${line}\n`) } = {}) {
+  try {
+    const { versions: next, changes, verified } = applyRegistryLatest(JSON.parse(readFileSync(file, "utf8")), [{ registry, name, version }]);
+    if (changes.length || verified) writeFileSync(file, `${JSON.stringify(next, null, 2)}\n`);
+    const copies = syncConsumerCopies(root);
+    log(`[right-release] release feed: ${name} ${version} ${changes.length ? "staged" : "already current"}${copies.length ? `; refreshed ${copies.length} copies` : ""}; commit rightkit-versions.json and its copies`);
+  } catch (error) { log(`[right-release] release feed not updated (${error.message}); run node rightkit-sync.mjs`); }
+}
+
+/** The broker client and the session hook carry byte copies of the catalog and versions; keep them exact. */
+export function syncConsumerCopies(root = rightkitRoot) {
+  const release = path.join(root, "packages", "release");
+  const targets = [
+    ["rightkit-ownership.json", path.join(root, "packages", "build-control-clients", "src", "ownership-catalog.json")],
+    ["rightkit-versions.json", path.join(root, "packages", "build-control-clients", "src", "rightkit-versions.json")],
+    ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-catalog.json")],
+    ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-fingerprints.json")],
+    ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
+    ["rightkit-drift.mjs", path.join(root, "packages", "build-control-policy", "src", "rightkit-drift.mjs")],
+    ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
+  ];
+  const updated = [];
+  for (const [source, target] of targets) {
+    const bytes = readFileSync(path.join(release, source));
+    if (source.endsWith(".json")) JSON.parse(bytes.toString("utf8"));
+    if (existsSync(target) && readFileSync(target).equals(bytes)) continue;
+    writeFileSync(target, bytes);
+    updated.push(path.relative(root, target).split(path.sep).join("/"));
+  }
+  return updated;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const check = process.argv.includes("--check");
+  syncRightkitVersions({ check })
+    .then(({ changes }) => { if (check && changes.length) process.exitCode = 1; })
+    .catch((error) => { process.stderr.write(`rightkit-sync: ${error.message}\n`); process.exitCode = 1; });
+}