@rightkit/release 0.2.134 → 0.2.136

package/rightkit-versions.json

@@ -13,28 +13,28 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/app-shell": "0.2.1",
+    "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
-    "@rightkit/doc-render": "0.1.3",
-    "@rightkit/git": "0.2.26",
-    "@rightkit/hooks": "0.1.1",
+    "@rightkit/doc-render": "0.1.4",
+    "@rightkit/git": "0.2.29",
+    "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
-    "@rightkit/legal-ui": "0.1.3",
+    "@rightkit/legal-ui": "0.2.0",
     "@rightkit/license": "0.1.8",
     "@rightkit/logs": "0.1.4",
-    "@rightkit/media-ui": "0.2.6",
-    "@rightkit/onboarding": "0.2.3",
+    "@rightkit/media-ui": "0.3.0",
+    "@rightkit/onboarding": "0.3.0",
     "@rightkit/pdf-ui": "0.1.2",
-    "@rightkit/platform-ui": "0.1.2",
-    "@rightkit/qa": "0.3.1",
+    "@rightkit/platform-ui": "0.2.0",
+    "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.134",
-    "@rightkit/settings-ui": "0.2.7",
+    "@rightkit/release": "0.2.136",
+    "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
-    "@rightkit/tauri": "0.1.1",
+    "@rightkit/tauri": "0.2.0",
     "@rightkit/theme": "0.2.1",
-    "@rightkit/updates": "0.2.4"
+    "@rightkit/updates": "0.2.5"
   },
   "legacyNpm": {
     "@rightkit/ax": [
@@ -67,15 +67,20 @@
       "0.2.22",
       "0.2.23",
       "0.2.24",
-      "0.2.25"
+      "0.2.25",
+      "0.2.26",
+      "0.2.27",
+      "0.2.28"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
       "0.1.1",
-      "0.1.2"
+      "0.1.2",
+      "0.1.3"
     ],
     "@rightkit/hooks": [
-      "0.1.0"
+      "0.1.0",
+      "0.1.1"
     ],
     "@rightkit/legal": [
       "0.3.0"
@@ -157,7 +162,9 @@
       "0.2.130",
       "0.2.131",
       "0.2.132",
-      "0.2.133"
+      "0.2.133",
+      "0.2.134",
+      "0.2.135"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -166,11 +173,14 @@
       "0.2.2",
       "0.2.3",
       "0.2.4",
-      "0.3.0"
+      "0.3.0",
+      "0.3.1",
+      "0.3.2"
     ],
     "@rightkit/app-shell": [
       "0.1.0",
-      "0.2.0"
+      "0.2.0",
+      "0.2.1"
     ],
     "@rightkit/media-ui": [
       "0.1.0",
@@ -179,7 +189,8 @@
       "0.2.2",
       "0.2.3",
       "0.2.4",
-      "0.2.5"
+      "0.2.5",
+      "0.2.6"
     ],
     "@rightkit/theme": [
       "0.1.0",
@@ -192,21 +203,25 @@
       "0.2.3",
       "0.2.4",
       "0.2.5",
-      "0.2.6"
+      "0.2.6",
+      "0.2.7"
     ],
     "@rightkit/onboarding": [
       "0.1.0",
       "0.2.0",
       "0.2.1",
-      "0.2.2"
+      "0.2.2",
+      "0.2.3"
     ],
     "@rightkit/doc-render": [
       "0.1.0",
       "0.1.1",
-      "0.1.2"
+      "0.1.2",
+      "0.1.3"
     ],
     "@rightkit/platform-ui": [
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "@rightkit/pdf-ui": [
       "0.1.0",
@@ -216,6 +231,12 @@
       "0.1.0",
       "0.1.1",
       "0.1.2"
+    ],
+    "@rightkit/updates": [
+      "0.2.4"
+    ],
+    "@rightkit/tauri": [
+      "0.1.1"
     ]
   },
   "cargo": {
@@ -236,41 +257,50 @@
     "rightkit-tauri": "0.1.0"
   },
   "stagedCargo": {
-    "rightkit-audio": "0.1.1",
+    "agent-room-core": "0.3.0",
+    "rightkit-asr": "0.0.2",
+    "rightkit-audio": "0.2.0",
     "rightkit-automation": "0.1.0",
-    "rightkit-browser": "0.2.2",
+    "rightkit-browser": "0.2.3",
     "rightkit-cache": "0.1.0",
-    "rightkit-control": "0.1.8",
-    "rightkit-crash": "0.1.0",
-    "rightkit-db": "0.3.0",
-    "rightkit-embed": "0.2.2",
+    "rightkit-contracts": "0.1.2",
+    "rightkit-control": "0.1.9",
+    "rightkit-crash": "0.2.0",
+    "rightkit-db": "0.3.2",
+    "rightkit-embed": "0.3.1",
     "rightkit-framed-sidecar": "0.1.0",
-    "rightkit-fs": "0.1.0",
-    "rightkit-http": "0.1.0",
-    "rightkit-jobs": "0.2.2",
+    "rightkit-fs": "0.3.2",
+    "rightkit-fsindex": "0.1.0",
+    "rightkit-http": "0.2.2",
+    "rightkit-jobs": "0.2.6",
     "rightkit-license": "0.1.3",
     "rightkit-logs": "0.2.0",
-    "rightkit-mcp": "0.3.1",
-    "rightkit-media": "0.2.3",
-    "rightkit-models": "0.2.2",
-    "rightkit-oauth": "0.2.1",
-    "rightkit-ort": "0.2.0",
-    "rightkit-pdf": "0.1.0",
+    "rightkit-mcp": "0.5.1",
+    "rightkit-media": "0.2.4",
+    "rightkit-models": "0.2.7",
+    "rightkit-oauth": "0.3.0",
+    "rightkit-ocr": "0.1.2",
+    "rightkit-ort": "0.2.2",
+    "rightkit-ownership": "0.2.0",
+    "rightkit-pdf": "0.2.0",
     "rightkit-playback": "0.1.1",
-    "rightkit-process": "0.3.1",
-    "rightkit-qa": "0.2.11",
-    "rightkit-qts": "0.2.1",
-    "rightkit-qts-ggml": "0.1.0",
-    "rightkit-qts-ggml-sys": "0.1.0",
-    "rightkit-sandbox": "0.2.4",
-    "rightkit-search": "0.1.0",
-    "rightkit-secrets": "0.1.0",
-    "rightkit-service": "0.1.0",
+    "rightkit-process": "0.3.3",
+    "rightkit-qa": "0.2.14",
+    "rightkit-qts": "0.2.4",
+    "rightkit-qts-ggml": "0.1.1",
+    "rightkit-qts-ggml-sys": "0.1.1",
+    "rightkit-sandbox": "0.3.3",
+    "rightkit-search": "0.2.0",
+    "rightkit-secrets": "0.1.2",
+    "rightkit-service": "0.1.3",
     "rightkit-settings": "0.1.0",
-    "rightkit-shell": "0.1.3",
-    "rightkit-speech-client": "0.3.0",
+    "rightkit-shell": "0.1.4",
+    "rightkit-speech-client": "0.3.2",
     "rightkit-sync": "0.1.0",
-    "rightkit-tauri": "0.1.1",
+    "rightkit-tauri": "0.1.2",
+    "rightkit-transcript": "0.1.0",
+    "rightkit-tts": "0.1.0",
+    "rightkit-vad": "0.0.2",
     "rightkit-watch": "0.3.1"
   },
   "swift": {
@@ -287,124 +317,162 @@
   },
   "registry": {
     "cargo": {
-      "rightkit-audio": "0.1.1",
+      "rightkit-asr": "0.0.2",
+      "rightkit-audio": "0.2.0",
       "rightkit-browser": "0.2.2",
       "rightkit-cache": "0.1.0",
-      "rightkit-control": "0.1.8",
-      "rightkit-crash": "0.1.0",
-      "rightkit-db": "0.3.0",
-      "rightkit-embed": "0.2.2",
+      "rightkit-control": "0.1.9",
+      "rightkit-crash": "0.2.0",
+      "rightkit-db": "0.3.2",
+      "rightkit-embed": "0.3.1",
       "rightkit-framed-sidecar": "0.1.0",
-      "rightkit-fs": "0.1.0",
-      "rightkit-http": "0.1.0",
-      "rightkit-jobs": "0.2.2",
+      "rightkit-fs": "0.3.2",
+      "rightkit-fsindex": "0.1.0",
+      "rightkit-http": "0.2.2",
+      "rightkit-jobs": "0.2.6",
       "rightkit-license": "0.1.3",
       "rightkit-logs": "0.2.0",
-      "rightkit-mcp": "0.3.1",
-      "rightkit-media": "0.2.3",
-      "rightkit-models": "0.2.2",
-      "rightkit-oauth": "0.2.1",
-      "rightkit-ort": "0.2.0",
-      "rightkit-pdf": "0.1.0",
+      "rightkit-mcp": "0.5.1",
+      "rightkit-media": "0.2.4",
+      "rightkit-models": "0.2.7",
+      "rightkit-oauth": "0.3.0",
+      "rightkit-ocr": "0.1.2",
+      "rightkit-ort": "0.2.2",
+      "rightkit-ownership": "0.2.0",
+      "rightkit-pdf": "0.2.0",
       "rightkit-playback": "0.1.1",
-      "rightkit-process": "0.3.1",
-      "rightkit-qa": "0.2.11",
-      "rightkit-qts": "0.2.1",
-      "rightkit-qts-ggml": "0.1.0",
-      "rightkit-qts-ggml-sys": "0.1.0",
-      "rightkit-sandbox": "0.2.4",
-      "rightkit-search": "0.1.0",
-      "rightkit-secrets": "0.1.0",
-      "rightkit-service": "0.1.0",
+      "rightkit-process": "0.3.3",
+      "rightkit-qa": "0.2.14",
+      "rightkit-qts": "0.2.4",
+      "rightkit-qts-ggml": "0.1.1",
+      "rightkit-qts-ggml-sys": "0.1.1",
+      "rightkit-sandbox": "0.3.3",
+      "rightkit-search": "0.2.0",
+      "rightkit-secrets": "0.1.2",
+      "rightkit-service": "0.1.3",
       "rightkit-settings": "0.1.0",
-      "rightkit-shell": "0.1.3",
-      "rightkit-speech-client": "0.3.0",
-      "rightkit-tauri": "0.1.1",
+      "rightkit-shell": "0.1.4",
+      "rightkit-speech-client": "0.3.2",
+      "rightkit-tauri": "0.1.2",
+      "rightkit-transcript": "0.1.0",
+      "rightkit-tts": "0.1.0",
+      "rightkit-vad": "0.0.2",
       "rightkit-watch": "0.3.1"
     },
     "npm": {
-      "@rightkit/app-shell": "0.2.1",
+      "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
-      "@rightkit/doc-render": "0.1.3",
-      "@rightkit/git": "0.2.26",
-      "@rightkit/hooks": "0.1.1",
+      "@rightkit/doc-render": "0.1.4",
+      "@rightkit/git": "0.2.29",
+      "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
-      "@rightkit/legal-ui": "0.1.3",
+      "@rightkit/legal-ui": "0.2.0",
       "@rightkit/license": "0.1.8",
       "@rightkit/logs": "0.1.4",
-      "@rightkit/media-ui": "0.2.6",
-      "@rightkit/onboarding": "0.2.3",
+      "@rightkit/media-ui": "0.3.0",
+      "@rightkit/onboarding": "0.3.0",
       "@rightkit/pdf-ui": "0.1.2",
-      "@rightkit/platform-ui": "0.1.2",
-      "@rightkit/qa": "0.3.1",
+      "@rightkit/platform-ui": "0.2.0",
+      "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.133",
-      "@rightkit/settings-ui": "0.2.7",
+      "@rightkit/release": "0.2.136",
+      "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
-      "@rightkit/tauri": "0.1.1",
+      "@rightkit/tauri": "0.2.0",
       "@rightkit/theme": "0.2.1",
-      "@rightkit/updates": "0.2.4"
+      "@rightkit/updates": "0.2.5"
     }
   },
   "legacyCargo": {
     "rightkit-browser": [
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.2.2"
     ],
     "rightkit-models": [
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4",
+      "0.2.5",
+      "0.2.6"
     ],
     "rightkit-audio": [
-      "0.1.0"
+      "0.1.0",
+      "0.1.1"
     ],
     "rightkit-db": [
-      "0.2.1"
+      "0.2.1",
+      "0.3.0",
+      "0.3.1"
     ],
     "rightkit-embed": [
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.3.0"
     ],
     "rightkit-jobs": [
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4",
+      "0.2.5"
     ],
     "rightkit-mcp": [
       "0.1.1",
       "0.2.0",
-      "0.3.0"
+      "0.3.0",
+      "0.3.1",
+      "0.4.0",
+      "0.5.0"
     ],
     "rightkit-media": [
-      "0.2.2"
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-oauth": [
-      "0.2.0"
+      "0.2.0",
+      "0.2.1"
     ],
     "rightkit-ort": [
-      "0.1.4"
+      "0.1.4",
+      "0.2.0",
+      "0.2.1"
     ],
     "rightkit-playback": [
       "0.1.0"
     ],
     "rightkit-process": [
       "0.2.1",
-      "0.3.0"
+      "0.3.0",
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-qa": [
       "0.2.7",
       "0.2.8",
       "0.2.9",
-      "0.2.10"
+      "0.2.10",
+      "0.2.11",
+      "0.2.12"
     ],
     "rightkit-sandbox": [
       "0.1.0",
       "0.2.0",
       "0.2.1",
       "0.2.2",
-      "0.2.3"
+      "0.2.3",
+      "0.2.4",
+      "0.3.0",
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-shell": [
       "0.1.0",
       "0.1.1",
-      "0.1.2"
+      "0.1.2",
+      "0.1.3"
     ],
     "rightkit-watch": [
       "0.1.0",
@@ -412,11 +480,57 @@
       "0.3.0"
     ],
     "rightkit-qts": [
-      "0.2.0"
+      "0.2.0",
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-control": [
       "0.1.6",
-      "0.1.7"
+      "0.1.7",
+      "0.1.8"
+    ],
+    "rightkit-secrets": [
+      "0.1.0",
+      "0.1.1"
+    ],
+    "rightkit-http": [
+      "0.1.0",
+      "0.2.0",
+      "0.2.1"
+    ],
+    "rightkit-fs": [
+      "0.1.0",
+      "0.2.0",
+      "0.3.0",
+      "0.3.1"
+    ],
+    "rightkit-service": [
+      "0.1.0",
+      "0.1.1",
+      "0.1.2"
+    ],
+    "rightkit-search": [
+      "0.1.0"
+    ],
+    "rightkit-tauri": [
+      "0.1.1"
+    ],
+    "rightkit-qts-ggml": [
+      "0.1.0"
+    ],
+    "rightkit-pdf": [
+      "0.1.0"
+    ],
+    "rightkit-speech-client": [
+      "0.3.0",
+      "0.3.1"
+    ],
+    "rightkit-crash": [
+      "0.1.0"
+    ],
+    "rightkit-qts-ggml-sys": [
+      "0.1.0"
     ]
   }
 }

package/runtime-artifact-manifest.mjs

@@ -21,8 +21,8 @@ export const RIGHT_SUITE_APP_KEYS = Object.freeze([
   "voiceright",
 ]);
 
-const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios"]);
-const TARGET_ARCHES = new Set(["x86_64", "aarch64", "universal"]);
+const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios", "any"]);
+const TARGET_ARCHES = new Set(["x86_64", "aarch64", "universal", "any"]);
 const VERSION_FIELDS = Object.freeze([
   "runtime",
   "model",
@@ -32,6 +32,7 @@ const VERSION_FIELDS = Object.freeze([
   "provenance",
 ]);
 const SHA256 = /^[0-9a-f]{64}$/;
+const ARTIFACT_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
 export function buildRuntimeArtifactManifest(input) {
   const entitlement = cloneObject(input.entitlement);
@@ -53,6 +54,7 @@ export function buildRuntimeArtifactManifest(input) {
     provenance: cloneObject(input.provenance),
     promotion: cloneObject(input.promotion),
   };
+  if (Object.hasOwn(input, "artifactId")) manifest.artifactId = input.artifactId;
   if (manifest.distribution?.delivery === "bundled") {
     manifest.object.r2Key = null;
     manifest.pointerKey = null;
@@ -78,11 +80,15 @@ export function runtimeArtifactManifestPointerKey(value) {
   const kind = value?.artifactKind;
   const os = value?.target?.os;
   const arch = value?.target?.arch;
+  const hasArtifactId = value !== null && typeof value === "object" && Object.hasOwn(value, "artifactId");
   assertAppKey(appKey, "entitlement.appKey");
+  if (hasArtifactId) assertArtifactId(value.artifactId);
   if (!RUNTIME_ARTIFACT_KINDS.includes(kind)) fail("artifactKind is unsupported");
   if (!TARGET_OSES.has(os)) fail("target.os is unsupported");
   if (!TARGET_ARCHES.has(arch)) fail("target.arch is unsupported");
-  return `${appKey}/runtime-artifacts/${kind}/${os}/${arch}/current/manifest.json`;
+  if ((os === "any") !== (arch === "any")) fail("target any must use any/any");
+  const artifactPath = hasArtifactId ? `${value.artifactId}/` : "";
+  return `${appKey}/runtime-artifacts/${kind}/${artifactPath}${os}/${arch}/current/manifest.json`;
 }
 
 export function validateRuntimeArtifactManifest(value) {
@@ -90,7 +96,8 @@ export function validateRuntimeArtifactManifest(value) {
   assertExactKeys(value, [
     "schema", "artifactKind", "entitlement", "distribution", "target", "object", "pointerKey",
     "versions", "provenance", "promotion",
-  ], "manifest");
+  ], "manifest", ["artifactId"]);
+  if (Object.hasOwn(value, "artifactId")) assertArtifactId(value.artifactId);
   if (value.schema !== RUNTIME_ARTIFACT_SCHEMA) fail("schema must be 1");
   if (!RUNTIME_ARTIFACT_KINDS.includes(value.artifactKind)) fail("artifactKind is unsupported");
 
@@ -120,6 +127,7 @@ export function validateRuntimeArtifactManifest(value) {
   assertExactKeys(value.target, ["os", "arch"], "target");
   if (!TARGET_OSES.has(value.target.os)) fail("target.os is unsupported");
   if (!TARGET_ARCHES.has(value.target.arch)) fail("target.arch is unsupported");
+  if ((value.target.os === "any") !== (value.target.arch === "any")) fail("target any must use any/any");
 
   assertPlainObject(value.object, "object");
   assertExactKeys(value.object, ["r2Key", "filename", "sha256", "sizeBytes"], "object");
@@ -204,12 +212,18 @@ function sortDeep(value) {
   return value;
 }
 
-function assertExactKeys(value, expected, label) {
-  const expectedSet = new Set(expected);
+function assertExactKeys(value, expected, label, optional = []) {
+  const expectedSet = new Set([...expected, ...optional]);
   for (const key of Object.keys(value)) if (!expectedSet.has(key)) fail(`${label} has unknown field ${key}`);
   for (const key of expected) if (!Object.hasOwn(value, key)) fail(`${label}.${key} is required`);
 }
 
+function assertArtifactId(value) {
+  if (typeof value !== "string" || value.length > 128 || value.trim() !== value || !ARTIFACT_ID.test(value)) {
+    fail("artifactId must be a lowercase safe slug (^[a-z0-9]+(?:-[a-z0-9]+)*$), max 128 characters");
+  }
+}
+
 function assertPlainObject(value, label) {
   if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) fail(`${label} must be a plain object`);
 }

package/sign-updater.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from "./background-process.mjs";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import path from "node:path";
 import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
+import { refuseManagedEnvSecrets, MANAGED_HOST_ENV_SECRET_REFUSED } from "./managed-host-secrets.mjs";
 
 const args = process.argv.slice(2);
 const files = [];
@@ -15,6 +16,10 @@ for (let i = 0; i < args.length; i++) {
 if (!files.length) fail("at least one --file is required");
 
 const env = { ...process.env };
+if (!dryRun) {
+  try { refuseManagedEnvSecrets(process.env, ["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"]); }
+  catch (error) { fail(`[${MANAGED_HOST_ENV_SECRET_REFUSED}] ${error.message}`); }
+}
 if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
   if (process.platform === "win32") {
     const key = path.join(env.APPDATA || "", "ViewRight", "updater.key");