@rightkit/release 0.2.143 → 0.2.145

package/rightkit-sync.mjs

@@ -185,8 +185,11 @@ export function syncConsumerCopies(root = rightkitRoot) {
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-catalog.json")],
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-fingerprints.json")],
     ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
+    ["ownership-repositories.json", path.join(root, "packages", "build-control-policy", "src", "ownership-repositories.json")],
     ["rightkit-drift.mjs", path.join(root, "packages", "build-control-policy", "src", "rightkit-drift.mjs")],
     ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
+    ["ownership-dependency-allowlist.json", path.join(root, "packages", "build-control-policy", "src", "ownership-dependency-allowlist.json")],
+    ["ownership-dependency-allowlist.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-dependency-allowlist.mjs")],
     ["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
     ["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
   ];

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.143",
+    "@rightkit/release": "0.2.145",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -175,7 +175,9 @@
       "0.2.139",
       "0.2.140",
       "0.2.141",
-      "0.2.142"
+      "0.2.142",
+      "0.2.143",
+      "0.2.144"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -275,7 +277,7 @@
     "rightkit-browser": "0.2.3",
     "rightkit-cache": "0.1.0",
     "rightkit-contracts": "0.1.2",
-    "rightkit-control": "0.1.9",
+    "rightkit-control": "0.1.11",
     "rightkit-crash": "0.2.0",
     "rightkit-db": "0.3.2",
     "rightkit-embed": "0.3.1",
@@ -332,7 +334,7 @@
       "rightkit-audio": "0.2.0",
       "rightkit-browser": "0.2.2",
       "rightkit-cache": "0.1.0",
-      "rightkit-control": "0.1.9",
+      "rightkit-control": "0.1.11",
       "rightkit-crash": "0.2.0",
       "rightkit-db": "0.3.2",
       "rightkit-embed": "0.3.1",
@@ -387,7 +389,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.143",
+      "@rightkit/release": "0.2.145",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -503,7 +505,9 @@
     "rightkit-control": [
       "0.1.6",
       "0.1.7",
-      "0.1.8"
+      "0.1.8",
+      "0.1.9",
+      "0.1.10"
     ],
     "rightkit-secrets": [
       "0.1.0",

package/swift-package-command.mjs

@@ -29,7 +29,7 @@ export function windowsStageOptions({ config, base }) {
   const w = config.windows;
   if (!w?.exe || !w?.out) throw fail("SWIFT_PACKAGE_CONFIG", "windows.exe and windows.out are required");
   return { exe: rel(base, w.exe), out: rel(base, w.stageDir ?? `${w.out}.stage`), searchDirs: relList(base, w.searchDirs),
-    include: relList(base, w.include), systemDlls: w.systemDlls, dependencies: w.dependencies, architecture: w.architecture };
+    include: relList(base, w.include), systemDlls: w.systemDlls, dependencies: w.dependencies, architecture: w.architecture, subsystem: w.subsystem };
 }
 
 export function msixOptions({ config, base }, staged) {

package/swift-windows-stage.mjs

@@ -41,7 +41,9 @@ function findInDirs(name, dirs) {
  *   systemDlls[] (extra allowed), dependencies[{ name, provides[] }], architecture }
  * Returns a manifest; throws SWIFT_STAGE_UNRESOLVED listing every missing DLL.
  */
-export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], systemDlls = [], dependencies = [], architecture, clean = true } = {}) {
+const PE_SUBSYSTEMS = { gui: 2, console: 3 };
+
+export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], systemDlls = [], dependencies = [], architecture, subsystem, clean = true } = {}) {
   if (!exe || !out) throw fail("SWIFT_STAGE_OPTIONS", "exe and out are required");
   exe = path.resolve(exe); out = path.resolve(out);
   if (!/\.exe$/i.test(exe) || !existsSync(exe) || !statSync(exe).isFile()) throw fail("SWIFT_STAGE_OPTIONS", `exe must be an existing .exe: ${exe}`);
@@ -71,6 +73,14 @@ export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], sys
     const info = readPeImports(readFileSync(item.source));
     if (!["x64", "arm64"].includes(info.architecture)) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture}; only x64 and arm64 are supported`);
     arch ??= info.architecture;
+    if (item.from === "<root>" && subsystem) {
+      const want = PE_SUBSYSTEMS[subsystem];
+      if (!want) throw fail("SWIFT_STAGE_OPTIONS", `windows.subsystem must be "gui" or "console", got ${JSON.stringify(subsystem)}`);
+      if (info.subsystem !== want) {
+        throw fail("SWIFT_STAGE_SUBSYSTEM", `${item.source} has PE subsystem ${info.subsystem}, expected ${want} (${subsystem})` +
+          (subsystem === "gui" ? "; link with -Xlinker /SUBSYSTEM:WINDOWS -Xlinker /ENTRY:mainCRTStartup so launching it opens no console window" : ""));
+      }
+    }
     if (info.architecture !== arch) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture} but package architecture is ${arch}`);
     for (const dep of [...info.imports, ...info.delayImports]) {
       const dk = lower(dep);

package/upload-release.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { pathToFileURL } from "node:url";
@@ -9,6 +10,7 @@ import { verifySealedRelease } from "./release-state.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
 import { recordPublishedVersion } from "./artifact-storage.mjs";
+import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
 
 const args = process.argv.slice(2);
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
@@ -58,6 +60,11 @@ if (!configuredRepo) fail("release config distribution.repository is required fo
 if (repo && repo !== configuredRepo) fail(`--repo must match configured distribution.repository (${configuredRepo})`);
 repo = configuredRepo;
 
+// Hardening step 4: installed QA on these exact artifact hashes and commit must have passed before any upload.
+if (!dryRun) {
+  try { assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: createHash("sha256").update(readFileSync(configPath)).digest("hex") }); }
+  catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; fail(error.message); }
+}
 const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
 const verifiedMarker = path.join(stateRoot, `verified-${tier}-github-releases.json`);
 if (existsSync(verifiedMarker)) {