@rightkit/release 0.2.123 → 0.2.124

package/build-release.mjs

@@ -241,10 +241,8 @@ try {
   }
   const ownershipEvidence = preflight.find((check) => check.name === "ownership")?.evidence;
   if (!ownershipEvidence) fail("ownership evidence was not produced by release preflight");
-  // Pending-enrollment advisory evidence asserts no commit (ownership-evidence.mjs); only
-  // committed-tree evidence must match the release commit.
-  if (ownershipEvidence.source !== "enrollment-pending-advisory" && ownershipEvidence.commit !== commit) {
-    fail("ownership scan source differs from release commit");
+  if (ownershipEvidence.commit !== commit) {
+    fail(`ownership scan commit ${ownershipEvidence.commit ?? "(missing)"} differs from release commit ${commit}; regenerate with right-release ownership at release commit ${commit}`);
   }
   for (const check of preflight) {
     if (check.status !== "ok") console.error(`[right-release] preflight ${check.name}: ${check.detail}`);

package/ownership-evidence.mjs

@@ -41,7 +41,7 @@ function createEvidence(repoRoot, {
   let enrollmentPending = trustState.enrolled !== true;
   if (committed && enrollmentPending && !allowPendingAdvisory && !trustState.trust?.rootFingerprint) throw new Error("protected ownership evidence requires both distinct, unrevoked approval keys to be enrolled");
   // A valid protected registry with incomplete key enrollment can still drive
-  // a useful local backlog scan. It cannot produce a source binding or verify
+  // a useful local backlog scan. It cannot assert a protected source binding or verify
   // approval signatures, so this result is deliberately advisory.
   const useCommittedSource = committed && (!enrollmentPending || Boolean(trustState.trust?.rootFingerprint));
   if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root);
@@ -68,6 +68,7 @@ function createEvidence(repoRoot, {
   }
   if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root, { expectedCommit: source.commit, expectedTree: source.tree });
   const commit = useCommittedSource ? source.commit : git(root, ["rev-parse", "HEAD"], gitRunner);
+  if (!commit) throw new Error("ownership evidence: scan source did not produce a HEAD commit");
   const tree = useCommittedSource ? source.tree : git(root, ["rev-parse", `${commit}^{tree}`], gitRunner);
   const scannerVersion = SCANNER_VERSION;
   const catalogVersion = manifest.version ?? String(manifest.schema ?? "1");
@@ -154,7 +155,8 @@ function createEvidence(repoRoot, {
     schema: 1,
     repositoryIdentity: repositoryIdentity ? canonicalRepositoryIdentity(result.metadata?.repositoryIdentity) : null,
     source: enrollmentPending ? "enrollment-pending-advisory" : useCommittedSource ? "committed-git-tree" : "mutable-checkout-test-seam",
-    ...(enrollmentPending ? {} : { commit, tree }),
+    commit,
+    ...(enrollmentPending ? {} : { tree }),
     catalogDigest,
     catalogVersion,
     scannerVersion,

package/ownership-report.mjs

@@ -37,6 +37,7 @@ function statusFor(row, report) {
   if (report.enrollmentPending && (row.status === "blocked" || row.status === "blocked-by-findings")) return "enrollment-pending";
   if (row.status === "blocked" || row.status === "blocked-by-findings") return "blocked";
   if (row.status === "excepted") return "excepted";
+  if (row.status === "qa-only") return "qa-only";
   if (row.status === "verified-integration") return "verified-integration";
   if (row.status === "declared-dependency" || row.uses === true) return "declared-dependency";
   if (report.coverage?.length) return "unscanned";
@@ -59,7 +60,7 @@ function exceptionRequests(root, app, report) {
 
 function asRecord(app, root, scope, report, manifest, versions, scannedAt) {
   const meta = report.metadata ?? {};
-  const findings = (report.findings ?? []).map((f) => ({ fingerprint: f.fingerprint, capability: f.capability, file: f.file, line: f.line ?? 0, occurrenceHash: f.occurrenceHash ?? sha256(canonicalJson(f)) }));
+  const findings = (report.findings ?? []).map((f) => ({ fingerprint: f.fingerprint, capability: f.capability, file: f.file, line: f.line ?? 0, occurrenceHash: f.occurrenceHash ?? sha256(canonicalJson(f)), ...(f.qaOnly ? { qaOnly: true } : {}) }));
   const files = [...new Set(findings.map((f) => f.file))].sort();
   const contentDigestSource = meta.contentDigests ? "scanner-inputs" : "finding-occurrences-only";
   const contentDigests = meta.contentDigests ?? findings.map((f) => ({ path: f.file, digest: f.occurrenceHash, kind: "finding-occurrence" }));

package/ownership.mjs

@@ -15,7 +15,7 @@ export const EXCEPTIONS_FILE = path.join(".rightkit", "ownership-exceptions.json
 const CODE_EXT = new Set([".rs", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".jsx", ".swift", ".m", ".mm", ".c", ".cc", ".cpp", ".h", ".py", ".go", ".kt", ".java", ".cs"]);
 // Listed installed/build inputs retain explicit coverage diagnostics.
 const OPAQUE_DIRS = new Set(["target", ".build", "DerivedData", "Pods"]);
-export const SCANNER_VERSION = "2.2.0";
+export const SCANNER_VERSION = "2.3.0";
 export const catalogDigest = (manifest) => sha256(manifest);
 const byteDigest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const inputDigest = (file) => file.digest ?? byteDigest(file.bytes);
@@ -249,7 +249,8 @@ function dependenciesFromInventory(appRoot, inventory) {
         const alias = spec.match(/^(?:npm:)(@[^/]+\/[^@]+|[^@]+)(?:@|$)/)?.[1];
         const localPath = spec.match(/^(?:file:|link:)(.+)$/)?.[1];
         const isGit = /^(git\+|https?:.*\.git)/i.test(spec);
-        addDependency(deps, "npm", alias ?? name, rel, { alias: alias ? name : undefined, local: !!localPath, source: localPath ? spec.split(":")[0] : isGit ? "git" : spec.startsWith("workspace:") ? "workspace" : undefined });
+        const devOnly = field === "devDependencies" && !["dependencies", "optionalDependencies", "peerDependencies"].some((section) => Object.hasOwn(pkg[section] ?? {}, name));
+        addDependency(deps, "npm", alias ?? name, rel, { alias: alias ? name : undefined, local: !!localPath, source: localPath ? spec.split(":")[0] : isGit ? "git" : spec.startsWith("workspace:") ? "workspace" : undefined, ...(devOnly ? { devOnly: true } : {}) });
         if (localPath) {
           resolveLocalPath(appRoot, rel, localPath, coverage, rel, inventory, "local-npm-dependency", name);
         } else if (isGit) coverage.push({ path: rel, status: "unscanned", reason: `git-npm-dependency-source:${name}` });
@@ -359,13 +360,29 @@ function trustedProvenance(appRoot, inventory, trust, repositoryIdentity, covera
   return { excluded, classifications };
 }
 
+function npmImportUsage(inventory) {
+  const usage = new Map(), qaSegments = new Set(["test", "tests", "__tests__", "e2e", "qa", "fixtures"]);
+  for (const { rel, bytes } of inventory.files) {
+    if (!CODE_EXT.has(path.posix.extname(rel).toLowerCase()) || !bytes) continue;
+    const qaPath = rel.split("/").some((segment) => qaSegments.has(segment)) || /(?:\.(?:test|spec)\.|^qa-.*\.)/.test(path.posix.basename(rel));
+    for (const match of bytes.toString("utf8").matchAll(/\bimport\b\s*(?:[\w$*{},\s]+?\bfrom\s*)?["']([^"']+)["']|\b(?:import|require)\s*\(\s*["']([^"']+)["']/g)) {
+      const specifier = match[1] ?? match[2];
+      const name = specifier.split("/").slice(0, specifier.startsWith("@") ? 2 : 1).join("/");
+      usage.set(name, (usage.get(name) ?? true) && qaPath);
+    }
+  }
+  return usage;
+}
+
 function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), trust, repositoryIdentity, repositoryRoot = appRoot, pathPrefix = "" } = {}) {
   const findings = [], coverage = [...inventory.coverage], deps = dependenciesFromInventory(appRoot, inventory), contentDigests = [...(deps.contentDigests ?? [])];
   coverage.push(...(deps.coverage ?? []));
   const provenance = trustedProvenance(appRoot, inventory, trust, repositoryIdentity, coverage, repositoryRoot, pathPrefix);
+  const npmUsage = npmImportUsage(inventory);
   for (const c of manifest.capabilities) for (const f of c.fingerprints.filter((x) => x.type === "dependency")) for (const d of deps) {
     if (d.ecosystem === f.ecosystem && (d.name === f.name || d.alias === f.name)) {
-      findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, file: d.file, line: 0, text: `${d.ecosystem} dependency ${d.alias ? `${d.alias} aliases ` : ""}${d.name}`, local: d.local, provenance: d.source });
+      const qaOnly = c.capability !== "desktop-qa" && d.ecosystem === "npm" && d.devOnly && npmUsage.get(d.alias ?? d.name) === true;
+      findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, file: d.file, line: 0, text: `${d.ecosystem} dependency ${d.alias ? `${d.alias} aliases ` : ""}${d.name}`, local: d.local, provenance: d.source, ...(qaOnly ? { qaOnly: true } : {}) });
     }
   }
   const matchers = sourceMatchers(manifest);
@@ -469,16 +486,18 @@ export function evaluate(findings, exceptions, options = {}) {
   }
   const pending = enrollmentPending(options.trust, options.trustEnrollment);
   if (pending) warnings.push("approval enrollment pending; detected findings remain open backlog requests until distinct Windows & macOS keys are enrolled");
-  for (const f of findings) if (!covered.some((x) => x.occurrenceHash === occurrenceHash(f))) violations.push({ ...f, occurrenceHash: occurrenceHash(f) });
-  return { violations, covered, problems, warnings, enrollmentPending: pending };
+  const qaOnly = findings.filter((f) => f.qaOnly === true && f.capability !== "desktop-qa");
+  for (const f of findings) if (!qaOnly.includes(f) && !covered.some((x) => x.occurrenceHash === occurrenceHash(f))) violations.push({ ...f, occurrenceHash: occurrenceHash(f) });
+  return { violations, covered, qaOnly, problems, warnings, enrollmentPending: pending };
 }
 
 export function capabilityTable(manifest, deps, result) {
   return [...new Map(manifest.capabilities.map((c) => [c.capability, c.package])).entries()].map(([capability, owner]) => {
     const declared = deps.some((d) => d.name === owner || d.name === owner.replace(/^rightkit-/, "@rightkit/"));
     const own = result.violations.filter((x) => x.capability === capability), covered = result.covered.filter((x) => x.capability === capability);
-    const status = own.length ? "blocked" : covered.length ? "excepted" : declared ? "declared-dependency" : result.coverage?.length ? "unscanned" : "not-detected";
-    return { capability, owner, uses: declared, status, count: own.length + covered.length };
+    const qaOnly = (result.qaOnly ?? []).filter((x) => x.capability === capability && !covered.some((item) => item.occurrenceHash === x.occurrenceHash));
+    const status = own.length ? "blocked" : covered.length ? "excepted" : qaOnly.length ? "qa-only" : declared ? "declared-dependency" : result.coverage?.length ? "unscanned" : "not-detected";
+    return { capability, owner, uses: declared, status, count: own.length + covered.length + qaOnly.length };
   });
 }
 export function formatTable(rows) { return ["capability  owner  status", ...rows.map((x) => `${x.capability}  ${x.owner}  ${x.status}`)].join("\n"); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.123",
+  "version": "0.2.124",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.1.2",
     "@rightkit/qa": "0.3.0",
     "@rightkit/qa-chrome": "0.1.2",
-    "@rightkit/release": "0.2.123",
+    "@rightkit/release": "0.2.124",
     "@rightkit/settings-ui": "0.2.7",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.1.1",
@@ -145,7 +145,8 @@
       "0.2.119",
       "0.2.120",
       "0.2.121",
-      "0.2.122"
+      "0.2.122",
+      "0.2.123"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -245,6 +246,9 @@
     "rightkit-playback": "0.1.0",
     "rightkit-process": "0.2.1",
     "rightkit-qa": "0.2.7",
+    "rightkit-qts": "0.1.1",
+    "rightkit-qts-ggml": "0.1.0",
+    "rightkit-qts-ggml-sys": "0.1.0",
     "rightkit-sandbox": "0.1.0",
     "rightkit-search": "0.1.0",
     "rightkit-secrets": "0.1.0",
@@ -292,6 +296,9 @@
       "rightkit-playback": "0.1.0",
       "rightkit-process": "0.2.1",
       "rightkit-qa": "0.2.7",
+      "rightkit-qts": "0.1.1",
+      "rightkit-qts-ggml": "0.1.0",
+      "rightkit-qts-ggml-sys": "0.1.0",
       "rightkit-sandbox": "0.1.0",
       "rightkit-search": "0.1.0",
       "rightkit-secrets": "0.1.0",
@@ -319,7 +326,7 @@
       "@rightkit/platform-ui": "0.1.2",
       "@rightkit/qa": "0.3.0",
       "@rightkit/qa-chrome": "0.1.2",
-      "@rightkit/release": "0.2.122",
+      "@rightkit/release": "0.2.123",
       "@rightkit/settings-ui": "0.2.7",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.1.1",