@rightkit/release 0.2.142 → 0.2.144

package/ownership-declaration.json

@@ -3,12 +3,183 @@
   "capabilities": [
     {
       "capability": "release-tooling",
-      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
+      "fingerprints": [
+        {
+          "id": "release.sign.codesign-signtool",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|spawn\\w*|execFile\\w*|exec\\w*)\\s*\\(\\s*(?:[\"`]\\s*(?:codesign\\b[^\"`';]{0,160}--sign|signtool(?:\\.exe)?\\s+sign\\b)|[\"'](?:codesign|signtool(?:\\.exe)?)[\"'][^;]{0,300}?[\"'](?:--sign|sign)[\"'])",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.notarize.notarytool",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|spawn\\w*|execFile\\w*|exec\\w*)\\s*\\([^;]{0,200}?[\"'`\\s]notarytool\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-builder",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-builder",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-notarize",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-notarize",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-notarize-scoped",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@electron/notarize",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-osx-sign",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-osx-sign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-osx-sign-scoped",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@electron/osx-sign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.create-dmg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "create-dmg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.appdmg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "appdmg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.cargo.apple-codesign",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "apple-codesign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     }
   ]

package/ownership-dependency-allowlist-seed.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// Propose or regenerate dependency-allowlist baselines from each registered repository's CURRENT direct
+// dependencies. This only edits the committed proposal file; it takes effect solely through Adrian's trust-sync.
+//   node ownership-dependency-allowlist-seed.mjs --workspace <dir> [--write]
+// Existing approvals are never removed (union with the current file); block-tier catalog dependencies
+// and RightKit packages are never recorded as approvals.
+import { existsSync, readdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { canonicalRepositoryIdentity } from "./ownership-approval.mjs";
+import { directDependencies } from "./ownership.mjs";
+import { ALLOWLIST_FILE, entryKey, isRightKitPackage, sourceKind, validateAllowlist } from "./ownership-dependency-allowlist.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const readJson = (name) => JSON.parse(readFileSync(path.join(here, name), "utf8"));
+
+// Universally approved tooling: tiny on purpose. Everything else is per-repository.
+export const SEED_GLOBAL = Object.freeze(["npm:@types/node", "npm:typescript", "npm:vitest"]);
+// A renamed repository that has no checkout of its own reuses the baseline of its current name.
+export const SEED_ALIASES = Object.freeze({ "https://github.com/orthic-labs/cockpit": "https://github.com/orthic-labs/pulse" });
+
+function localCheckouts(workspace) {
+  const found = new Map();
+  for (const name of readdirSync(workspace)) {
+    const dir = path.join(workspace, name);
+    if (!existsSync(path.join(dir, ".git"))) continue;
+    const origin = spawnSync("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf8", windowsHide: true });
+    if (origin.status !== 0) continue;
+    try { found.set(canonicalRepositoryIdentity(origin.stdout.trim()), dir); } catch { /* not a canonical remote */ }
+  }
+  return found;
+}
+
+export function seedRepository(root, manifest) {
+  const blocked = new Set(manifest.capabilities.flatMap((c) => c.fingerprints.filter((f) => f.type === "dependency" && (f.tier ?? c.tier ?? "block") === "block").map((f) => `${f.ecosystem}:${f.name}`)));
+  const owners = manifest.capabilities.map((c) => c.package);
+  const entries = new Set(); let skippedBlock = 0, skippedFirstParty = 0, skippedRightKit = 0;
+  const deps = directDependencies(root);
+  for (const d of deps) {
+    const kind = sourceKind(d.source);
+    if (kind === "path") { skippedFirstParty += 1; continue; }
+    if (isRightKitPackage(d.name, owners)) { skippedRightKit += 1; continue; }
+    if (blocked.has(`${d.ecosystem}:${d.name}`)) { skippedBlock += 1; continue; }
+    entries.add(entryKey(d.ecosystem, d.name, kind));
+  }
+  return { entries: [...entries].sort(), direct: deps.length, skippedBlock, skippedFirstParty, skippedRightKit, unscanned: deps.coverage?.length ?? 0 };
+}
+
+export function buildSeed({ workspace, registry = readJson("ownership-repositories.json"), manifest = readJson("rightkit-ownership.json"), existing = null, log = () => {} } = {}) {
+  const checkouts = localCheckouts(workspace);
+  const previous = new Map((existing?.repositories ?? []).map((entry) => [entry.repositoryIdentity, entry]));
+  const seeded = new Map(), stats = [];
+  for (const { repositoryIdentity } of registry.repositories) {
+    const root = checkouts.get(repositoryIdentity);
+    if (!root) continue;
+    const result = seedRepository(root, manifest);
+    seeded.set(repositoryIdentity, result.entries);
+    stats.push({ repositoryIdentity, root, ...result });
+  }
+  const repositories = registry.repositories.map(({ repositoryIdentity }) => {
+    const prior = previous.get(repositoryIdentity)?.dependencies ?? [];
+    let note;
+    let fresh = seeded.get(repositoryIdentity);
+    if (!fresh && SEED_ALIASES[repositoryIdentity] && seeded.has(SEED_ALIASES[repositoryIdentity])) { fresh = seeded.get(SEED_ALIASES[repositoryIdentity]); note = `seeded from ${SEED_ALIASES[repositoryIdentity]} (same repository, renamed)`; stats.push({ repositoryIdentity, alias: SEED_ALIASES[repositoryIdentity], entries: fresh }); }
+    if (!fresh) { fresh = []; note = "no local checkout when seeded; baseline is empty until proposed"; stats.push({ repositoryIdentity, unseeded: true, entries: [] }); }
+    return { repositoryIdentity, ...(note ? { note } : {}), dependencies: [...new Set([...prior, ...fresh])].sort() };
+  });
+  const allowlist = { schema: 1, global: [...new Set([...(existing?.global ?? []), ...SEED_GLOBAL])].sort(), repositories };
+  const check = validateAllowlist(allowlist);
+  if (!check.ok) throw new Error(`generated allowlist is invalid: ${check.problems.join("; ")}`);
+  log(stats);
+  return { allowlist, stats };
+}
+
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  const args = process.argv.slice(2);
+  const flag = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
+  const workspace = path.resolve(flag("--workspace") ?? path.resolve(here, "../../.."));
+  const file = path.join(here, ALLOWLIST_FILE);
+  const existing = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null;
+  const { allowlist, stats } = buildSeed({ workspace, existing });
+  for (const s of stats) process.stdout.write(`${s.repositoryIdentity}: ${s.entries.length} entries${s.direct !== undefined ? ` (direct ${s.direct}, first-party ${s.skippedFirstParty}, rightkit ${s.skippedRightKit}, block-tier ${s.skippedBlock}, unscanned ${s.unscanned})` : s.alias ? ` (alias of ${s.alias})` : " (UNSEEDED)"}\n`);
+  if (args.includes("--write")) { writeFileSync(file, `${JSON.stringify(allowlist, null, 2)}\n`); process.stdout.write(`wrote ${file}\n`); }
+}