@rightkit/release 0.2.135 → 0.2.137

package/ownership.mjs

@@ -1,7 +1,11 @@
 // RightKit ownership scan. Public exports retain the original findings-array API.
+import { isBlockingFinding } from "./ownership-verdict.mjs";
 import { spawnSync } from "./background-process.mjs";
-import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, resolveKeyLogTrust, sha256, verifyException, verifyProtectedProvenance } from "./ownership-approval.mjs";
+import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, policyEntryDigest, resolveKeyLogTrust, sha256, verifyException, verifyProtectedProvenance } from "./ownership-approval.mjs";
+import installedManifest from "./rightkit-ownership.json" with { type: "json" };
 import { parse as parseToml } from "smol-toml";
+import { sourceNonCode } from "./ownership-source.mjs";
+import { OWNERSHIP_LOCKFILES, transitiveDependencies } from "./ownership-lockfiles.mjs";
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { acquireCommittedSource, committedSourceDataForInternalUse } from "./committed-source.mjs";
@@ -15,7 +19,7 @@ export const EXCEPTIONS_FILE = path.join(".rightkit", "ownership-exceptions.json
 const CODE_EXT = new Set([".rs", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".jsx", ".swift", ".m", ".mm", ".c", ".cc", ".cpp", ".h", ".py", ".go", ".kt", ".java", ".cs"]);
 // Listed installed/build inputs retain explicit coverage diagnostics.
 const OPAQUE_DIRS = new Set(["target", ".build", "DerivedData", "Pods"]);
-export const SCANNER_VERSION = "2.4.0";
+export const SCANNER_VERSION = "2.6.0";
 export const catalogDigest = (manifest) => sha256(manifest);
 const byteDigest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const inputDigest = (file) => file.digest ?? byteDigest(file.bytes);
@@ -40,57 +44,24 @@ function sourceMatchers(manifest) {
   return matchers;
 }
 
-// Code-only patterns may consume string arguments, but must start outside
-// literals/comments. Keep offsets/newlines intact for multiline call reporting.
-function sourceNonCode(text, rust) {
-  const nonCode = new Uint8Array(text.length);
-  for (let i = 0; i < text.length;) {
-    const start = i;
-    if (text.startsWith("//", i) || text.startsWith("/*", i)) {
-      if (text[i + 1] === "/") {
-        i = text.indexOf("\n", i + 2);
-        if (i === -1) i = text.length;
-      } else {
-        i += 2;
-        let depth = 1;
-        while (i < text.length && depth) {
-          if (rust && text.startsWith("/*", i)) { depth++; i += 2; }
-          else if (text.startsWith("*/", i)) { depth--; i += 2; }
-          else i++;
-        }
-      }
-      nonCode.fill(1, start, i);
-      continue;
-    }
-    const raw = rust && (i === 0 || !/[\w]/.test(text[i - 1])) && /^(?:br|cr|r)(#*)"/.exec(text.slice(i));
-    if (raw) {
-      const closing = `"${raw[1]}`, end = text.indexOf(closing, i + raw[0].length);
-      i = end === -1 ? text.length : end + closing.length;
-    } else if (text[i] === '"' || (!rust && (text[i] === "'" || text[i] === "`")) ||
-      (rust && text[i] === "'" && /^'(?:\\(?:u\{[\da-fA-F]+\}|x[\da-fA-F]{2}|[^\r\n])|[^'\\\r\n])'/.test(text.slice(i)))) {
-      const quote = text[i++];
-      while (i < text.length) {
-        if (text[i] === "\\") i = Math.min(i + 2, text.length);
-        else if (text[i++] === quote) break;
-      }
-    } else { i++; continue; }
-    nonCode.fill(1, start, i);
-  }
-  return nonCode;
-}
-
 function sourceFindings(file, matchers) {
   const ext = path.posix.extname(file.rel).toLowerCase();
   const key = `${matchers.digest}:${ext}:${file.cacheKey ?? inputDigest(file)}`;
   if (sourceCache.has(key)) return sourceCache.get(key);
   const text = file.bytes.toString("utf8"), findings = [];
+  const ordinals = new Map();
+  const push = (c, f, line, lineText) => {
+    const identity = `${f.id}\0${lineText}`, ordinal = ordinals.get(identity) ?? 0;
+    ordinals.set(identity, ordinal + 1);
+    findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, ...findingPolicy(c, f), kind: "source", line, lineText, ordinal, text: lineText.trim().slice(0, 160) });
+  };
   if (matchers.prefilter.test(text)) {
     const lines = text.split(/\r?\n/);
     const applicable = matchers.sources.filter(({ f }) => !f.extensions || f.extensions.includes(ext));
     const lineMatchers = applicable.filter(({ f }) => !f.codeOnly);
     for (const [i, line] of lines.entries()) if (!commentOnly(line)) for (const { c, f, re } of lineMatchers) {
       re.lastIndex = 0;
-      if (re.test(line)) findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, line: i + 1, text: line.trim().slice(0, 160) });
+      if (re.test(line)) push(c, f, i + 1, line);
     }
     const codeMatchers = applicable.filter(({ f }) => f.codeOnly);
     if (codeMatchers.length) {
@@ -104,7 +75,7 @@ function sourceFindings(file, matchers) {
           for (; offset < match.index; offset++) if (text[offset] === "\n") line++;
           if (reported.has(line)) continue;
           reported.add(line);
-          findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, line, text: lines[line - 1].trim().slice(0, 160) });
+          push(c, f, line, lines[line - 1]);
         }
       }
     }
@@ -121,7 +92,8 @@ export function aggregateOwnership(rightkitRoot) {
     if (!existsSync(dir)) continue;
     for (const name of readdirSync(dir).sort()) {
       const child = path.join(dir, name);
-      let file = path.join(child, MANIFEST_FILE);
+      let file = path.join(child, "ownership-declaration.json");
+      if (!existsSync(file)) file = path.join(child, MANIFEST_FILE);
       if (!existsSync(file) && group === "swift") file = path.join(child, "rightkit-ownership.json");
       if (!existsSync(file)) continue;
       const declared = JSON.parse(readFileSync(file, "utf8"));
@@ -129,7 +101,9 @@ export function aggregateOwnership(rightkitRoot) {
       for (const capability of declared.capabilities ?? []) entries.push({ package: declared.package, ...capability });
     }
   }
-  const manifest = { schema: 1, version: "1", capabilities: entries };
+  const internalFile = path.join(rightkitRoot, "packages/release/ownership-internal-owners.json");
+  const internalOwners = existsSync(internalFile) ? JSON.parse(readFileSync(internalFile, "utf8")).owners : [];
+  const manifest = { schema: 1, version: "2", capabilities: entries, internalOwners };
   validateManifest(manifest);
   return manifest;
 }
@@ -137,7 +111,7 @@ export function aggregateOwnership(rightkitRoot) {
 export function validateManifest(manifest) {
   const ids = new Set();
   for (const c of manifest.capabilities ?? []) {
-    if (!c.package || !c.capability || !Array.isArray(c.fingerprints) || !c.fingerprints.length) throw new Error(`ownership: incomplete capability ${JSON.stringify(c).slice(0, 120)}`);
+    if (!c.package || !c.capability || !Array.isArray(c.fingerprints)) throw new Error(`ownership: incomplete capability ${JSON.stringify(c).slice(0, 120)}`);
     for (const f of c.fingerprints) {
       if (!f.id || ids.has(f.id)) throw new Error(`ownership: missing or duplicate fingerprint id ${f.id}`);
       ids.add(f.id);
@@ -177,18 +151,25 @@ function parseCargo(parsed, file, out, workspace, root, coverage, inventory) {
   const pathSpec = (pathValue, sourceFile, display) => {
     resolveLocalPath(root, sourceFile, pathValue, coverage, display, inventory);
   };
-  const addTable = (table) => {
+  const addTable = (table, prefix = "") => {
     if (!table || typeof table !== "object") return;
     for (const section of ["dependencies", "dev-dependencies", "build-dependencies"]) for (const [alias, raw] of Object.entries(table[section] ?? {})) {
       const spec = raw && typeof raw === "object" ? raw : {};
-      const inherited = spec.workspace === true ? workspace.deps?.[alias] ?? {} : {};
+      const inheritedRaw = spec.workspace === true ? workspace.deps?.[alias] : undefined;
+      if (spec.workspace === true && inheritedRaw === undefined) throw new Error(`missing workspace dependency: ${alias}`);
+      const inherited = typeof inheritedRaw === "string" ? { version: inheritedRaw } : inheritedRaw ?? {};
       const name = spec.package ?? inherited.package ?? alias;
-      const source = spec.path ?? inherited.path ? "path" : spec.git ?? inherited.git ? "git" : undefined;
-      addDependency(out, "cargo", name, file, { local: source === "path" || source === "git", source });
-      if (source === "path") pathSpec(spec.path ?? inherited.path, spec.path ? file : path.posix.join(workspace.dir ?? ".", "Cargo.toml"), file);
-      if (source === "git") coverage.push({ path: file, status: "unscanned", reason: `git-dependency-source:${name}` });
+      const pathValue = spec.path ?? inherited.path, git = spec.git ?? inherited.git, selector = spec.rev ?? inherited.rev ?? spec.branch ?? inherited.branch ?? spec.tag ?? inherited.tag;
+      const source = pathValue ? `path:${pathValue}` : git ? `git+${git}${selector ? `#${selector}` : ""}` : "registry";
+      const requirement = typeof raw === "string" ? raw : spec.version ?? inherited.version ?? null;
+      if (spec.features !== undefined && !Array.isArray(spec.features) || inherited.features !== undefined && !Array.isArray(inherited.features)) throw new Error(`malformed dependency features: ${alias}`);
+      const features = [...new Set([...(inherited.features ?? []), ...(spec.features ?? [])])].sort();
+      if (!raw || typeof raw !== "string" && (typeof raw !== "object" || Array.isArray(raw)) || features.some((x) => typeof x !== "string") || requirement !== null && typeof requirement !== "string") throw new Error(`malformed dependency declaration: ${alias}`);
+      addDependency(out, "cargo", name, file, { alias: name === alias ? null : alias, section: `${prefix}${section}`, requirement, features, defaultFeatures: spec["default-features"] ?? inherited["default-features"] ?? null, source, resolvedVersion: null, local: !!pathValue || !!git });
+      if (pathValue) pathSpec(pathValue, spec.path ? file : path.posix.join(workspace.dir ?? ".", "Cargo.toml"), file);
+      if (git) coverage.push({ path: file, status: "unscanned", reason: `git-dependency-source:${name}` });
     }
-    for (const target of Object.values(table.target ?? {})) addTable(target);
+    for (const [target, value] of Object.entries(table.target ?? {})) addTable(value, `${prefix}target.'${target}'.`);
   };
   addTable(parsed);
 }
@@ -211,7 +192,7 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   const inventory = gitListedInventory(appRoot, {
     repositoryRoot,
     protectedPaths: [...protectedPaths],
-    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift"].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
+    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
     maxFileBytes: (rel) => CODE_EXT.has(path.posix.extname(rel).toLowerCase()) || protectedPaths.has(rel) ? 2 * 1024 * 1024 : 64 * 1024 * 1024,
   });
   for (const item of inventory.coverage) if (item.reason === "file-over-size-limit") item.reason = protectedPaths.has(item.path) ? "protected-provenance-file-over-2MiB" : CODE_EXT.has(path.posix.extname(item.path).toLowerCase()) ? "source-file-over-2MiB" : "manifest-file-over-64MiB";
@@ -231,7 +212,7 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
     if (entry.mode === "160000" || entry.type === "commit") { coverage.push({ path: rel, status: "unscanned", reason: "committed-gitlink" }); continue; }
     if (entry.type !== "blob") { coverage.push({ path: rel, status: "unscanned", reason: "committed-unsupported-entry" }); continue; }
-    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json"].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
+    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "ownership-exceptions.json", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
     const bytes = relevant ? entry.bytes : undefined;
     if (relevant && !bytes) coverage.push({ path: rel, status: "unscanned", reason: "committed-blob-unavailable" });
     const isExceptionFile = path.posix.basename(rel) === "ownership-exceptions.json";
@@ -253,6 +234,113 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
   return { files, coverage, committed: true, pathPrefix, repositoryFiles, snapshotFiles: new Map(repositoryFiles.map((file) => [file.rel, file])) };
 }
 
+function swiftPackageArguments(text) {
+  const args = [];
+  for (const match of text.matchAll(/\.package\s*\(/g)) {
+    let at = match.index + match[0].length, start = at, depth = 1, quote = false;
+    for (; at < text.length && depth; at++) {
+      if (text[at] === "\\" && quote) { at++; continue; }
+      if (text[at] === '"') quote = !quote;
+      if (!quote && text[at] === "(") depth++;
+      if (!quote && text[at] === ")") depth--;
+    }
+    if (depth) throw new Error("unterminated Swift package declaration");
+    args.push(text.slice(start, at - 1));
+  }
+  return args;
+}
+function resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDigests) {
+  const cache = new Map();
+  const adjacent = (file, name) => {
+    const rel = path.posix.join(path.posix.dirname(file), name);
+    if (cache.has(rel)) return cache.get(rel);
+    let bytes;
+    if (inventory.committed) {
+      const item = inventory.snapshotFiles.get(`${inventory.pathPrefix ?? ""}${rel}`);
+      if (item && !item.bytes) throw new Error(`lockfile bytes unavailable: ${rel}`);
+      bytes = item?.bytes;
+    } else {
+      const inventoried = OWNERSHIP_LOCKFILES.includes(name) ? inventory.files.find((item) => item.rel === rel) : undefined;
+      if (inventoried && !inventoried.bytes) throw new Error(`lockfile bytes unavailable: ${rel}`);
+      const absolute = path.resolve(appRoot, ...rel.split("/"));
+      if (inventoried) bytes = inventoried.bytes;
+      else if (existsSync(absolute)) {
+        const root = realpathSync(appRoot), real = realpathSync(absolute);
+        if (!real.startsWith(`${root}${path.sep}`)) throw new Error(`lockfile outside scan root: ${rel}`);
+        if (!lstatSync(absolute).isFile() || lstatSync(absolute).size > 64 * 1024 * 1024) throw new Error(`lockfile unsupported or too large: ${rel}`);
+        bytes = readFileSync(absolute);
+      }
+    }
+    const text = bytes?.toString("utf8");
+    cache.set(rel, text);
+    if (bytes) contentDigests.push({ path: rel, digest: byteDigest(bytes) });
+    return text;
+  };
+  for (const d of deps) {
+    try {
+      if (d.ecosystem === "cargo") {
+        const text = adjacent(d.file, "Cargo.lock");
+        if (text !== undefined) {
+          const lock = parseToml(text);
+          if (!Array.isArray(lock.package)) throw new Error("Cargo.lock package list missing");
+          let candidates = lock.package.filter((p) => p.name === d.name && (d.source === "registry" ? String(p.source ?? "").startsWith("registry+") : d.source.startsWith("git+") ? String(p.source ?? "").split("#")[0].split("?")[0] === d.source.split("#")[0] : !p.source));
+          if (candidates.length > 1) {
+            const manifestText = inventory.files.find((f) => f.rel === d.file)?.bytes?.toString("utf8");
+            const owner = manifestText && parseToml(manifestText).package?.name;
+            const refs = lock.package.filter((p) => p.name === owner).flatMap((p) => p.dependencies ?? []);
+            candidates = candidates.filter((p) => refs.some((ref) => ref === `${d.name} ${p.version}` || ref.startsWith(`${d.name} ${p.version} (`)));
+          }
+          if (candidates.length !== 1 || typeof candidates[0].version !== "string") throw new Error(`Cargo.lock resolution missing or ambiguous: ${d.name}`);
+          d.resolvedVersion = candidates[0].version;
+        }
+      } else if (d.ecosystem === "npm") {
+        const text = adjacent(d.file, "npm-shrinkwrap.json") ?? adjacent(d.file, "package-lock.json");
+        if (text !== undefined) {
+          const lock = JSON.parse(text), name = d.alias ?? d.name;
+          const item = lock.packages?.[`node_modules/${name}`] ?? lock.dependencies?.[name];
+          if (typeof item?.version !== "string") throw new Error(`npm lock resolution missing: ${name}`);
+          d.resolvedVersion = item.version;
+        } else {
+          const pnpm = adjacent(d.file, "pnpm-lock.yaml"), yarn = pnpm === undefined ? adjacent(d.file, "yarn.lock") : undefined;
+          if (pnpm !== undefined) {
+            let section, name, dependencyIndent, inRoot = !/^importers:/m.test(pnpm), rootIndent;
+            for (const line of pnpm.split(/\r?\n/)) {
+              const entry = /^(\s*)(?:'([^']+)'|"([^"]+)"|([^:]+)):\s*(.*?)\s*$/.exec(line);
+              if (!entry) continue;
+              const indent = entry[1].length, key = entry[2] ?? entry[3] ?? entry[4], value = entry[5];
+              if (key === "." && indent === 2) { inRoot = true; rootIndent = 2; continue; }
+              if (rootIndent !== undefined && indent <= rootIndent) inRoot = false;
+              if (!inRoot) continue;
+              if (["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"].includes(key)) { section = key; dependencyIndent = indent + 2; name = undefined; continue; }
+              if (indent === dependencyIndent) { name = key; if (name === (d.alias ?? d.name) && section === d.section && value) d.resolvedVersion = value.replace(/^['"]|['"]$/g, "").split("(")[0]; }
+              if (key === "version" && name === (d.alias ?? d.name) && section === d.section && indent === dependencyIndent + 2) d.resolvedVersion = value.replace(/^['"]|['"]$/g, "").split("(")[0].replace(/^.*@(?=\d)/, "");
+            }
+            if (!d.resolvedVersion) throw new Error(`pnpm lock resolution missing: ${d.alias ?? d.name}`);
+          } else if (yarn !== undefined) {
+            let selected = false;
+            for (const line of yarn.split(/\r?\n/)) {
+              if (/^\S/.test(line) && /:$/.test(line)) selected = line.includes(`${d.alias ?? d.name}@${d.requirement}`) || line.includes(`${d.alias ?? d.name}@npm:${d.requirement}`);
+              const version = /^\s+version(?::|\s)\s*["']?([^\s"']+)/.exec(line);
+              if (selected && version) d.resolvedVersion = version[1];
+            }
+            if (!d.resolvedVersion) throw new Error(`yarn lock resolution missing: ${d.alias ?? d.name}`);
+          }
+        }
+      } else if (d.ecosystem === "swiftpm") {
+        const text = adjacent(d.file, "Package.resolved");
+        if (text !== undefined && !d.local) {
+          const lock = JSON.parse(text), pins = lock.pins ?? lock.object?.pins;
+          if (!Array.isArray(pins)) throw new Error("Swift lock pins missing");
+          const pin = pins.filter((p) => (p.identity ?? p.package)?.toLowerCase() === d.name.toLowerCase() || p.location === d.source.slice(4).split("#")[0] || p.repositoryURL === d.source.slice(4).split("#")[0]);
+          if (pin.length !== 1) throw new Error(`Swift lock resolution missing or ambiguous: ${d.name}`);
+          d.resolvedVersion = pin[0].state?.version ?? null;
+          if (d.resolvedVersion !== null && typeof d.resolvedVersion !== "string") throw new Error(`invalid Swift resolved version: ${d.name}`);
+        }
+      }
+    } catch (error) { coverage.push({ path: d.file, status: "unscanned", reason: `dependency-lock-resolution:${error.message}` }); }
+  }
+}
+
 function dependenciesFromInventory(appRoot, inventory) {
   const deps = [], coverage = [], contentDigests = [];
   // Workspace inheritance is loaded before member manifests.
@@ -304,29 +392,35 @@ function dependenciesFromInventory(appRoot, inventory) {
     else if (base === "package.json") {
       let pkg; try { pkg = JSON.parse(text); } catch { coverage.push({ path: rel, status: "unscanned", reason: "invalid-json" }); continue; }
       for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) for (const [name, spec] of Object.entries(pkg[field] ?? {})) {
-        if (typeof spec !== "string") continue;
+        if (typeof spec !== "string") { coverage.push({ path: rel, status: "unscanned", reason: `invalid-npm-dependency:${name}` }); continue; }
         const alias = spec.match(/^(?:npm:)(@[^/]+\/[^@]+|[^@]+)(?:@|$)/)?.[1];
         const localPath = spec.match(/^(?:file:|link:)(.+)$/)?.[1];
         const isGit = /^(git\+|https?:.*\.git)/i.test(spec);
         const devOnly = field === "devDependencies" && !["dependencies", "optionalDependencies", "peerDependencies"].some((section) => Object.hasOwn(pkg[section] ?? {}, name));
-        addDependency(deps, "npm", alias ?? name, rel, { alias: alias ? name : undefined, local: !!localPath, source: localPath ? spec.split(":")[0] : isGit ? "git" : spec.startsWith("workspace:") ? "workspace" : undefined, ...(devOnly ? { devOnly: true } : {}) });
+        addDependency(deps, "npm", alias ?? name, rel, { alias: alias ? name : null, section: field, requirement: spec, features: [], defaultFeatures: null, resolvedVersion: null, local: !!localPath, source: localPath ? `path:${localPath}` : isGit ? spec.startsWith("git+") ? spec : `git+${spec}` : spec.startsWith("workspace:") ? `path:${spec}` : "registry", ...(devOnly ? { devOnly: true } : {}) });
         if (localPath) {
           resolveLocalPath(appRoot, rel, localPath, coverage, rel, inventory, "local-npm-dependency", name);
         } else if (isGit) coverage.push({ path: rel, status: "unscanned", reason: `git-npm-dependency-source:${name}` });
       }
     } else {
-      for (const m of text.matchAll(/\.package\s*\(([^)]*)\)/g)) {
-        const arg = m[1], url = arg.match(/url:\s*["']([^"']+)["']/)?.[1], pathDep = arg.match(/path:\s*["']([^"']+)["']/)?.[1];
-        const id = arg.match(/name:\s*["']([^"']+)["']/)?.[1] ?? url?.replace(/\.git$/i, "").split("/").pop()?.toLowerCase() ?? pathDep?.split(/[\\/]/).pop();
-        addDependency(deps, "swiftpm", id, rel, { local: !!pathDep, source: pathDep ? "path" : url });
+      for (const arg of swiftPackageArguments(text)) {
+        const url = arg.match(/url:\s*["']([^"']+)["']/)?.[1], pathDep = arg.match(/path:\s*["']([^"']+)["']/)?.[1], registry = arg.match(/id:\s*["']([^"']+)["']/)?.[1];
+        const explicitName = arg.match(/name:\s*["']([^"']+)["']/)?.[1];
+        const id = explicitName ?? registry ?? url?.replace(/\.git$/i, "").split("/").pop()?.toLowerCase() ?? pathDep?.split(/[\\/]/).pop();
+        if (!id || !url && !pathDep && !registry) throw new Error("unsupported Swift package identity or source");
+        const selector = arg.match(/(?:branch|revision):\s*["']([^"']+)["']/)?.[1];
+        const requirement = arg.replace(/(?:name|url|path|id):\s*"(?:\\.|[^"\\])*"\s*,?\s*/g, "").trim() || null;
+        addDependency(deps, "swiftpm", id, rel, { alias: null, section: "dependencies", requirement, features: [], defaultFeatures: null, resolvedVersion: null, local: !!pathDep, source: pathDep ? `path:${pathDep}` : registry ? "registry" : `git+${url}${selector ? `#${selector}` : ""}` });
         if (pathDep) {
           resolveLocalPath(appRoot, rel, pathDep, coverage, rel, inventory, "local-swift-dependency", id);
         }
       }
     }
   }
+  resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDigests);
   Object.defineProperty(deps, "coverage", { value: coverage, enumerable: false });
   Object.defineProperty(deps, "contentDigests", { value: contentDigests, enumerable: false });
+  Object.defineProperty(deps, "manifests", { value: files, enumerable: false });
   return deps;
 }
 
@@ -419,31 +513,23 @@ function trustedProvenance(appRoot, inventory, trust, repositoryIdentity, covera
   return { excluded, classifications };
 }
 
-function npmImportUsage(inventory) {
-  const usage = new Map(), qaSegments = new Set(["test", "tests", "__tests__", "e2e", "qa", "fixtures"]);
-  for (const { rel, bytes } of inventory.files) {
-    if (!CODE_EXT.has(path.posix.extname(rel).toLowerCase()) || !bytes) continue;
-    const qaPath = rel.split("/").some((segment) => qaSegments.has(segment)) || /(?:\.(?:test|spec)\.|^qa-.*\.)/.test(path.posix.basename(rel));
-    for (const match of bytes.toString("utf8").matchAll(/\bimport\b\s*(?:[\w$*{},\s]+?\bfrom\s*)?["']([^"']+)["']|\b(?:import|require)\s*\(\s*["']([^"']+)["']/g)) {
-      const specifier = match[1] ?? match[2];
-      const name = specifier.split("/").slice(0, specifier.startsWith("@") ? 2 : 1).join("/");
-      usage.set(name, (usage.get(name) ?? true) && qaPath);
-    }
-  }
-  return usage;
-}
-
 function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), trust, repositoryIdentity, repositoryRoot = appRoot, pathPrefix = "" } = {}) {
   const findings = [], coverage = [...inventory.coverage], deps = dependenciesFromInventory(appRoot, inventory), contentDigests = [...(deps.contentDigests ?? [])];
+  const catalogOwners = new Set(manifest.capabilities.map((entry) => entry.package));
   coverage.push(...(deps.coverage ?? []));
   const provenance = trustedProvenance(appRoot, inventory, trust, repositoryIdentity, coverage, repositoryRoot, pathPrefix);
-  const npmUsage = npmImportUsage(inventory);
+  const pushDependency = (c, f, d, kind = "dependency") => findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, ...findingPolicy(c, f), file: d.file, line: 0, kind, ecosystem: d.ecosystem, name: d.name,
+    ...(kind === "dependency" ? { alias: d.alias, section: d.section, requirement: d.requirement, features: d.features, defaultFeatures: d.defaultFeatures, local: d.local } : { lockfile: d.lockfile, dependencyPath: d.dependencyPath }),
+    source: d.source, resolvedVersion: d.resolvedVersion, text: `${d.ecosystem} dependency ${d.alias ? `${d.alias} aliases ` : ""}${d.name}`, provenance: d.source });
   for (const c of manifest.capabilities) for (const f of c.fingerprints.filter((x) => x.type === "dependency")) for (const d of deps) {
-    if (d.ecosystem === f.ecosystem && (d.name === f.name || d.alias === f.name)) {
-      const qaOnly = c.capability !== "desktop-qa" && d.ecosystem === "npm" && d.devOnly && npmUsage.get(d.alias ?? d.name) === true;
-      findings.push({ fingerprint: f.id, capability: c.capability, package: c.package, file: d.file, line: 0, text: `${d.ecosystem} dependency ${d.alias ? `${d.alias} aliases ` : ""}${d.name}`, local: d.local, provenance: d.source, ...(qaOnly ? { qaOnly: true } : {}) });
+    if (d.ecosystem === f.ecosystem && (d.name === f.name || d.alias === f.name) && !catalogOwners.has(d.name)) {
+      pushDependency(c, f, d);
     }
   }
+  const blockRules = manifest.capabilities.flatMap((c) => c.fingerprints.filter((f) => f.type === "dependency" && findingPolicy(c, f).tier === "block").map((f) => ({ c, f })));
+  const transitiveOwners = new Set([...catalogOwners, ...(manifest.internalOwners ?? []).map((owner) => typeof owner === "string" ? owner : owner.package)]);
+  const transitive = transitiveDependencies(appRoot, inventory, deps.manifests, transitiveOwners, coverage, contentDigests, blockRules.map(({ f }) => `${f.ecosystem}:${f.name}`));
+  for (const { c, f } of blockRules) for (const d of transitive) if (d.ecosystem === f.ecosystem && d.name === f.name) pushDependency(c, f, d, "transitive-dependency");
   const matchers = sourceMatchers(manifest);
   for (const file of inventory.files) {
     const { rel, size, bytes } = file;
@@ -458,7 +544,7 @@ function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), t
   }
   if (pathPrefix) {
     const prefix = (p) => p === "." ? pathPrefix.slice(0, -1) : `${pathPrefix}${p}`;
-    for (const f of findings) f.file = prefix(f.file);
+    for (const f of findings) { f.file = prefix(f.file); if (f.lockfile) f.lockfile = prefix(f.lockfile); }
     for (const c of coverage) c.path = prefix(c.path);
     for (const d of deps) d.file = prefix(d.file);
     for (const d of contentDigests) d.path = prefix(d.path);
@@ -473,26 +559,32 @@ function trustForScan(options = {}) {
   try { return loadTrustedExternal().trust; } catch { return null; }
 }
 
-function resolveSharedAuthority(trust) {
+function resolveSharedAuthority(trust, readAuthority = readCommittedKeyAuthority) {
   if (!trust?.keyAuthority) return { trust };
-  const authority = readCommittedKeyAuthority(trust);
+  const authority = readAuthority(trust);
   if (!authority.ok) throw new Error(`protected ownership key authority failed: ${authority.problems.join("; ")}`);
   if (!authority.resolvedTrust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
   return { trust: authority.resolvedTrust, keyLogDigest: authority.digest, keyCheckpoint: authority.keyCheckpoint, rootFingerprint: authority.rootFingerprint, keyAuthority: authority.authority };
 }
 
-function resolveRepositoryKeyLog(trust, repositoryRoot, repositoryIdentity) {
+function resolveRepositoryKeyLog(trust, repositoryRoot, repositoryIdentity, readAuthority = readCommittedKeyAuthority) {
   if (!trust?.rootFingerprint || trust.keyAuthority) return { trust };
-  const authority = readCommittedKeyAuthority({ ...trust, keyAuthority: { repositoryIdentity, checkoutPath: repositoryRoot } });
+  const authority = readAuthority({ ...trust, keyAuthority: { repositoryIdentity, checkoutPath: repositoryRoot } });
   if (!authority.ok) throw new Error(`protected ownership key log failed: ${authority.problems.join("; ")}`);
   if (!authority.resolvedTrust.ownershipKeys.length) throw new Error("protected ownership key log has no active approval keys");
   return { trust: authority.resolvedTrust, keyLogDigest: authority.digest, keyCheckpoint: authority.keyCheckpoint, rootFingerprint: authority.rootFingerprint };
 }
 
 export function scanApp(appRoot, manifest, options = {}) {
+  return scanAppInternal(appRoot, manifest, options);
+}
+export function scanAppForTest(appRoot, manifest, options = {}) {
+  return scanAppInternal(appRoot, manifest, options, options.readAuthorityForTest);
+}
+function scanAppInternal(appRoot, manifest, options, readAuthority) {
   const initialTrust = trustForScan(options), location = scanRepositoryRoot(appRoot);
   const repositoryIdentity = repositoryIdentityFor(appRoot);
-  const authority = initialTrust?.keyAuthority ? resolveSharedAuthority(initialTrust) : resolveRepositoryKeyLog(initialTrust, location.root, repositoryIdentity);
+  const authority = initialTrust?.keyAuthority ? resolveSharedAuthority(initialTrust, readAuthority) : resolveRepositoryKeyLog(initialTrust, location.root, repositoryIdentity, readAuthority);
   const trust = authority.trust;
   const result = scanInternal(appRoot, manifest, { inventory: fileInventory(appRoot, trust, location.prefix, location.root), trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix });
   Object.defineProperty(result.findings, "coverage", { value: result.coverage, enumerable: false });
@@ -522,52 +614,68 @@ function enrollmentPending(trust, state) {
   return !keys.every((key) => key?.keyId && key.publicKeyPem && !trust.revokedKeyIds?.includes(key.keyId)) || keys[0]?.keyId === keys[1]?.keyId || keys[0]?.publicKeyPem === keys[1]?.publicKeyPem;
 }
 
+/** Effective enforcement policy; a fingerprint without a tier is treated as `block` (fail closed). */
+function findingPolicy(c, f) {
+  return { tier: f.tier ?? c.tier ?? "block", ...(f.policy ? { policy: f.policy } : {}) };
+}
 export function evaluate(findings, exceptions, options = {}) {
   const today = options.today ?? new Date().toISOString().slice(0, 10), problems = [], covered = [], violations = [], warnings = [];
   const metadata = options.metadata ?? findings.metadata ?? {};
   const catalogDigest = metadata.catalogDigest ?? options.catalogDigest ?? "";
   const identity = options.repositoryIdentity ?? metadata.repositoryIdentity ?? "";
   for (const e of exceptions) {
-    const p = e.payload ?? e;
-    const where = `exception #${e.index} (${p.fingerprint ?? "?"})`;
-    const missing = ["fingerprint", "paths", "reason", "owner", "expires", "requestId", "occurrenceHashes"].filter((k) => !p[k] || (Array.isArray(p[k]) && !p[k].length));
+    const p = e?.payload ?? e ?? {};
+    const where = `exception #${e?.index} (${p.fingerprint ?? "?"})`;
+    const missing = ["fingerprint", "occurrences", "policyDigest", "minimumScannerVersion", "minimumCatalogVersion", "issued", "reason", "owner", "expires", "requestId"].filter((k) => !p[k] || (Array.isArray(p[k]) && !p[k].length));
     if (missing.length) { problems.push(`${where}: missing ${missing.join(", ")}`); continue; }
     const approvedBy = e.approvedBy ?? p.approvedBy;
     if (approvedBy !== undefined && approvedBy !== "Adrian") { problems.push(`${where}: approvedBy must be Adrian`); continue; }
     if (!/^\d{4}-\d{2}-\d{2}$/.test(p.expires) || Number.isNaN(Date.parse(`${p.expires}T00:00:00Z`)) || p.expires < today) { problems.push(`${where}: invalid or expired expires date`); continue; }
     if (!p.trackingRef || typeof p.trackingRef !== "object" || !p.trackingRef.verified || !/^https:\/\//.test(p.trackingRef.url ?? "") || !p.trackingRef.id) { problems.push(`${where}: tracking must be a verified RightKit request reference`); continue; }
-    if (p.paths.some((item) => !item || item.includes("\\") || item.startsWith("/") || item.split("/").includes("..") || /[*?\[\]{}]/.test(item))) { problems.push(`${where}: exception paths must be exact repository-relative paths`); continue; }
-    const verification = verifyException(e, { repositoryIdentity: identity, catalogDigest, findings, trust: options.trust, today, scannerVersion: options.scannerVersion ?? metadata.scannerVersion ?? SCANNER_VERSION, catalogVersion: options.catalogVersion ?? metadata.catalogVersion });
+    let policyDigest;
+    try { policyDigest = policyEntryDigest(options.manifest ?? installedManifest, p.fingerprint); } catch (error) { problems.push(`${where}: ${error.message}`); continue; }
+    const { index, ...record } = e;
+    const verification = verifyException(record, { repositoryIdentity: identity, catalogDigest, policyDigest, findings, trust: options.trust, today, scannerVersion: options.scannerVersion ?? metadata.scannerVersion ?? SCANNER_VERSION, catalogVersion: options.catalogVersion ?? metadata.catalogVersion });
     if (!verification?.ok) { problems.push(`${where}: signature verification failed${verification?.problems?.length ? ` (${verification.problems.join("; ")})` : ""}`); continue; }
-    const matching = findings.filter((f) => f.fingerprint === p.fingerprint && p.paths.includes(f.file) && p.occurrenceHashes.includes(occurrenceHash(f)));
+    const matching = findings.filter((f) => f.fingerprint === p.fingerprint && p.occurrences.some((item) => item.path === f.file && item.hash === occurrenceHash(f)));
     if (!matching.length) { problems.push(`${where}: stale, matches no signed occurrence`); continue; }
     for (const f of matching) covered.push({ ...f, occurrenceHash: occurrenceHash(f), exception: e });
   }
   const pending = enrollmentPending(options.trust, options.trustEnrollment);
   if (pending) warnings.push("approval enrollment pending; detected findings remain open backlog requests until distinct Windows & macOS keys are enrolled");
-  const qaOnly = findings.filter((f) => f.qaOnly === true && f.capability !== "desktop-qa");
-  for (const f of findings) if (!qaOnly.includes(f) && !covered.some((x) => x.occurrenceHash === occurrenceHash(f))) violations.push({ ...f, occurrenceHash: occurrenceHash(f) });
-  return { violations, covered, qaOnly, problems, warnings, enrollmentPending: pending };
+  for (const f of findings) if (!covered.some((x) => x.occurrenceHash === occurrenceHash(f))) violations.push({ ...f, occurrenceHash: occurrenceHash(f) });
+  return { violations, covered, problems, warnings, enrollmentPending: pending };
 }
 
 export function capabilityTable(manifest, deps, result) {
-  return [...new Map(manifest.capabilities.map((c) => [c.capability, c.package])).entries()].map(([capability, owner]) => {
-    const declared = deps.some((d) => d.name === owner || d.name === owner.replace(/^rightkit-/, "@rightkit/"));
+  const groups = new Map();
+  for (const c of manifest.capabilities) {
+    if (!groups.has(c.capability)) groups.set(c.capability, []);
+    groups.get(c.capability).push(c.package);
+  }
+  return [...groups].map(([capability, owners]) => {
+    const owner = owners[0];
+    const declared = deps.some((d) => owners.includes(d.name) || owners.some((name) => d.name === name.replace(/^rightkit-/, "@rightkit/")));
     const own = result.violations.filter((x) => x.capability === capability), covered = result.covered.filter((x) => x.capability === capability);
-    const qaOnly = (result.qaOnly ?? []).filter((x) => x.capability === capability && !covered.some((item) => item.occurrenceHash === x.occurrenceHash));
-    const status = own.length ? "blocked" : covered.length ? "excepted" : qaOnly.length ? "qa-only" : declared ? "declared-dependency" : result.coverage?.length ? "unscanned" : "not-detected";
-    return { capability, owner, uses: declared, status, count: own.length + covered.length + qaOnly.length };
+    const status = own.length ? "blocked" : covered.length ? "excepted" : declared ? "declared-dependency" : result.coverage?.length ? "unscanned" : "not-detected";
+    return { capability, owner, ...(owners.length > 1 ? { owners } : {}), uses: declared, status, count: own.length + covered.length };
   });
 }
 export function formatTable(rows) { return ["capability  owner  status", ...rows.map((x) => `${x.capability}  ${x.owner}  ${x.status}`)].join("\n"); }
 
 export function checkApp(appRoot, manifest, options = {}) {
+  return checkAppInternal(appRoot, manifest, options);
+}
+export function checkAppForTest(appRoot, manifest, options = {}) {
+  return checkAppInternal(appRoot, manifest, options, options.readAuthorityForTest);
+}
+function checkAppInternal(appRoot, manifest, options, readAuthority) {
   let trustState = options.trust;
   if (!trustState) trustState = loadTrustedExternal();
   const initialTrust = trustState && Object.prototype.hasOwnProperty.call(trustState, "trust") ? trustState.trust : trustState;
   const repositoryLocation = scanRepositoryRoot(appRoot);
   const repositoryIdentity = repositoryIdentityFor(appRoot);
-  const resolved = initialTrust?.keyAuthority ? resolveSharedAuthority(initialTrust) : resolveRepositoryKeyLog(initialTrust, repositoryLocation.root, repositoryIdentity);
+  const resolved = initialTrust?.keyAuthority ? resolveSharedAuthority(initialTrust, readAuthority) : resolveRepositoryKeyLog(initialTrust, repositoryLocation.root, repositoryIdentity, readAuthority);
   const trust = resolved.trust;
   const location = repositoryLocation;
   const scanned = scanInternal(appRoot, manifest, { inventory: fileInventory(appRoot, trust, location.prefix, location.root), trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix });
@@ -576,13 +684,13 @@ export function checkApp(appRoot, manifest, options = {}) {
   const enrollment = trust?.rootFingerprint
     ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined;
-  const result = evaluate(scanned.findings, loadExceptions(appRoot), { ...options, trust, trustEnrollment: enrollment, metadata });
+  const result = evaluate(scanned.findings, loadExceptions(appRoot), { ...options, manifest, trust, trustEnrollment: enrollment, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
-  return { ok: result.enrollmentPending || (!result.violations.length && !result.problems.length && !coverage.length), rows, ...result, findings: scanned.findings, coverage, metadata };
+  return { ok: !result.enrollmentPending && !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
 }
 
-function checkCommitted(appRoot, manifest, options, acquire) {
+function checkCommitted(appRoot, manifest, options, acquire, readAuthority = readCommittedKeyAuthority) {
   let trustState = options.trust;
   if (!trustState) trustState = loadTrustedExternal();
   let trust = trustState && Object.prototype.hasOwnProperty.call(trustState, "trust") ? trustState.trust : trustState;
@@ -601,7 +709,7 @@ function checkCommitted(appRoot, manifest, options, acquire) {
   if (!repositoryIdentity) throw new Error("committed ownership: repository origin is missing or invalid");
   let keyLogDigest, keyCheckpoint, keyAuthorityBinding;
   if (trust?.keyAuthority) {
-    const authority = readCommittedKeyAuthority(trust);
+    const authority = readAuthority(trust);
     if (!authority.ok) throw new Error(`committed ownership key authority failed: ${authority.problems.join("; ")}`);
     trust = authority.resolvedTrust;
     if (!trust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
@@ -639,12 +747,12 @@ function checkCommitted(appRoot, manifest, options, acquire) {
     pathBase: location.pathBase, pathPrefix: location.prefix, provenance: scanned.provenance, exceptionDigest,
     source: "committed-git-tree", ...(keyLogDigest ? { keyLogDigest, keyCheckpoint, rootFingerprint: trust.rootFingerprint, ...(keyAuthorityBinding ? { keyAuthority: keyAuthorityBinding } : {}) } : {}),
   };
-  const result = evaluate(scanned.findings, exceptions, { ...options, trust, trustEnrollment: trust?.rootFingerprint
+  const result = evaluate(scanned.findings, exceptions, { ...options, manifest, trust, trustEnrollment: trust?.rootFingerprint
     ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
-  return { ok: !result.enrollmentPending && !result.violations.length && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
+  return { ok: !result.enrollmentPending && !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
 }
 
 /** Protected production scan: acquire and inspect exact HEAD blobs without reading checkout contents. */
@@ -654,5 +762,5 @@ export function checkCommittedApp(appRoot, manifest, options = {}) {
 
 /** Explicit test-only seam for bounded Git process failures and fixtures. */
 export function checkCommittedAppForTest(appRoot, manifest, options = {}) {
-  return checkCommitted(appRoot, manifest, options, options.acquireCommittedSourceForTest ?? acquireCommittedSource);
+  return checkCommitted(appRoot, manifest, options, options.acquireCommittedSourceForTest ?? acquireCommittedSource, options.readAuthorityForTest);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.135",
+  "version": "0.2.137",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",