@rightkit/release 0.2.150 → 0.2.153

package/publish-cargo.mjs

@@ -7,6 +7,9 @@ import { runCargoSync } from "./managed-cargo.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
 import { recordPublished } from "./rightkit-sync.mjs";
+import { readCargoPackage } from "./crate-graph.mjs";
+import { runtimeBudgetCheck, RUNTIME_BUDGET_CODE } from "./runtime-budgets.mjs";
+import { formatPreflight, PREFLIGHT_FAIL } from "./preflight.mjs";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
 const SECRET_PATTERNS = [
@@ -46,6 +49,9 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
   if (allowDirty) packageArgs.push("--allow-dirty");
   const plan = [
     { label: "secret scan", internal: "secret-scan", crateDir },
+    // Runtime-budget crates (runtime-budgets.mjs) must carry a measured runtime-budget.json for this
+    // version on every required host. Dry-run reports the check; a real publish refuses it.
+    { label: "runtime budget", internal: "runtime-budget", crate, crateDir },
     { label: "format", command: "cargo", args: ["fmt", "-p", crate, "--check"] },
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
@@ -91,7 +97,11 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
   const manifest = path.join(crateDir, "Cargo.toml");
   if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
-  const cargoVersion = fs.readFileSync(manifest, "utf8").match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+  // Parsed, not pattern-matched: `version.workspace = true` resolves through the workspace root, and a
+  // manifest whose [package].name is not the requested crate is refused before anything else runs.
+  const pkg = readCargoPackage(crateDir);
+  if (pkg.name !== options.crate) throw new Error(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crate ${options.crate}`);
+  const cargoVersion = pkg.version ?? undefined;
   const gateOptions = {
     kind: "cargo", name: options.crate, version: cargoVersion, packagePath: crateDir,
     evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(options.workspaceRoot, "cargo", options.crate)),
@@ -110,6 +120,16 @@ export async function runCargoPublish(options, execute = (_command, args, settin
       if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
       continue;
     }
+    if (step.internal === "runtime-budget") {
+      const check = runtimeBudgetCheck({ crate: options.crate, crateDir, version: cargoVersion, evidence: gate.evidence ?? undefined });
+      if (check) process.stdout.write(`${formatPreflight([check])}\n`);
+      if (check?.status === PREFLIGHT_FAIL && !options.dryRun) {
+        const error = new Error(`runtime budget refused: ${check.detail}. Fix: ${check.fix}`);
+        error.code = RUNTIME_BUDGET_CODE;
+        throw error;
+      }
+      continue;
+    }
     if (step.internal === "verify-archive") {
       // Revalidate source/evidence after packaging; preserve that exact evidence object.
       const current = (deps.enforceGate ?? enforcePublicationGate)(gateOptions);

package/publish-swift.mjs

@@ -1,129 +1,73 @@
-// Publish RightKitSwift by the ONE Swift distribution contract: a git repository pinned by URL +
-// exact version tag (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). Gates, in order:
-// secret scan -> swift test -> release build -> mirror tree into a git checkout + tag ->
-// FRESH CONSUMER RESOLUTION (a throwaway app pins the tag with `exact:` and runs
-// `swift package resolve`) -> push. A dry-run performs everything except the push, so a green
-// dry-run proves the mirror layout, the tag, and clean consumer resolution -- not just that tests passed.
-// swift-tools is macOS/Linux only, so the plan builder, arg parser, and version check are
-// pure and unit-tested on any OS (publish-swift.test.mjs); the swift steps run where swift exists.
+// Publish RightKitSwift by the ONE Swift distribution contract: a plain semver git tag on this
+// repository (github.com/Orthic-Labs/rightkit), resolved by apps through the root Package.swift
+// (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). There is no mirror and no second repository.
+//
+// `right-release publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]` verifies, in order:
+//   1. VERSION (swift/RightKitSwift/VERSION) is plain semver (X.Y.Z, no "v", no prerelease);
+//   2. the checkout is on main, has a clean tree, and HEAD is reachable from origin/main;
+//   3. the root Package.swift and the nested manifest agree (scripts/swift-root-manifest.test.mjs);
+//   4. the tag <VERSION> exists neither locally nor on origin;
+//   5. the publication gate evidence is bound to HEAD and to the package tree at HEAD;
+// then creates the tag on HEAD and pushes it:
+//   git tag <VERSION> <HEAD sha>
+//   git push origin refs/tags/<VERSION>:refs/tags/<VERSION>
+// A dry-run performs every check and prints those commands without running them.
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { digestBytes } from "./publication-artifacts.mjs";
-import { scanCrateForSecrets } from "./publish-cargo.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
-export const DEFAULT_SWIFT_GIT_URL = "https://github.com/bogusyogi/rightkit-swift.git";
-// The mirror must reproduce the verified git subtree exactly (its tree id is
-// compared), so only untracked build state is excluded. Tracked Xcode scheme
-// metadata under .swiftpm ships with the package; SwiftPM consumers ignore it.
-const MIRROR_EXCLUDES = new Set([".build", ".git", "Package.resolved", ".DS_Store"]);
+export const SWIFT_DISTRIBUTION_URL = "https://github.com/Orthic-Labs/rightkit";
+const DRIFT_TEST = path.join("scripts", "swift-root-manifest.test.mjs");
 
-export function parseSwiftPublishArgs(argv, env = process.env) {
-  const allowed = new Set(["--repo", "--dry-run", "--allow-dirty", "--evidence", "--workspace"]);
-  let repo = env.RIGHTKIT_SWIFT_GIT_URL ?? DEFAULT_SWIFT_GIT_URL;
+export function parseSwiftPublishArgs(argv) {
+  const allowed = new Set(["--dry-run", "--evidence", "--workspace"]);
   let dryRun = false;
-  let allowDirty = false;
   let evidence;
   let workspace;
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!allowed.has(arg)) throw new Error(`unexpected argument: ${arg}`);
-    if (arg === "--dry-run") dryRun = true;
-    else if (arg === "--allow-dirty") allowDirty = true;
-    else {
-      const value = argv[(index += 1)];
-      if (value === undefined) throw new Error(`${arg} needs a value`);
-      if (arg === "--evidence") evidence = value;
-      else if (arg === "--workspace") workspace = value;
-      else repo = value;
-    }
+    if (arg === "--dry-run") { dryRun = true; continue; }
+    const value = argv[(index += 1)];
+    if (value === undefined) throw new Error(`${arg} needs a value`);
+    if (arg === "--evidence") evidence = value;
+    else workspace = value;
   }
-  if (!/^(https:\/\/|git@|ssh:\/\/|file:\/\/)/.test(repo)) throw new Error(`invalid swift git url: ${repo}`);
-  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
-  return { repo, dryRun, allowDirty, evidence, workspace };
+  return { dryRun, evidence, workspace };
 }
 
-// The VERSION file is the single source of truth; Package.swift must name the package and the
-// version must be a clean semver so the registry archive is reproducible.
+// VERSION is the single source of truth; the tag is exactly its text.
 export function readPackageIdentity(packageDir) {
   const manifest = path.join(packageDir, "Package.swift");
   if (!fs.existsSync(manifest)) throw new Error(`Package.swift not found: ${manifest}`);
   const versionFile = path.join(packageDir, "VERSION");
   if (!fs.existsSync(versionFile)) throw new Error(`VERSION not found: ${versionFile}`);
   const version = fs.readFileSync(versionFile, "utf8").trim();
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
-    throw new Error(`VERSION is not clean semver: "${version}"`);
-  }
+  if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error(`VERSION is not plain semver (X.Y.Z): "${version}"`);
   const nameMatch = fs.readFileSync(manifest, "utf8").match(/name:\s*"([^"]+)"/);
   if (!nameMatch) throw new Error("could not read package name from Package.swift");
   return { name: nameMatch[1], version };
 }
 
-export function buildSwiftPublishPlan({ packageDir, name, version, repo, dryRun }) {
-  const plan = [
-    { label: "secret scan", internal: "secret-scan" },
-    { label: "tests", command: "swift", args: ["test", "--package-path", packageDir] },
-    { label: "release build", command: "swift", args: ["build", "-c", "release", "--package-path", packageDir] },
-    // Dry-run mirrors into a fresh local repo; a real publish clones the distribution repo first.
-    { label: "mirror and tag", internal: "mirror", tag: version, repo: dryRun ? null : repo },
-    { label: "fresh consumer resolution (exact pin)", internal: "consume", tag: version, name },
+// The exact commands a real publish runs after every check passes.
+export function swiftTagCommands(version, sha) {
+  return [
+    ["git", ["tag", version, sha]],
+    ["git", ["push", "origin", `refs/tags/${version}:refs/tags/${version}`]],
   ];
-  if (!dryRun) plan.push({ label: "git push (branch and tag)", internal: "push", tag: version, repo });
-  return plan;
 }
 
-function git(args, cwd, execute = spawnSync) {
+function git(args, cwd, execute) {
   const result = execute("git", args, { cwd, encoding: "utf8", windowsHide: true });
   if (result.error) throw result.error;
   if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
   return (result.stdout ?? "").trim();
 }
 
-function copyTree(from, to) {
-  fs.mkdirSync(to, { recursive: true });
-  for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
-    if (MIRROR_EXCLUDES.has(entry.name)) continue;
-    const source = path.join(from, entry.name);
-    const target = path.join(to, entry.name);
-    if (entry.isDirectory()) copyTree(source, target);
-    else if (entry.isFile()) { fs.copyFileSync(source, target); fs.chmodSync(target, fs.statSync(source).mode & 0o777); }
-    else throw new Error(`unsupported Swift source entry: ${entry.name}`);
-  }
-}
-
-function mirrorAndTag(step, packageDir, work, execute) {
-  const mirror = path.join(work, "rightkit-swift"); // SwiftPM names the package by repo directory
-  if (step.repo) git(["clone", step.repo, mirror], work, execute);
-  else { fs.mkdirSync(mirror, { recursive: true }); git(["init", "-q", "-b", "main"], mirror, execute); }
-  for (const entry of fs.readdirSync(mirror)) if (entry !== ".git") fs.rmSync(path.join(mirror, entry), { recursive: true, force: true });
-  copyTree(packageDir, mirror);
-  git(["add", "-A"], mirror, execute);
-  git(["-c", "user.email=release@rightsuite.invalid", "-c", "user.name=right-release", "commit", "-q", "--allow-empty", "-m", `RightKitSwift ${step.tag}`], mirror, execute);
-  if (git(["tag", "-l", step.tag], mirror, execute) !== "") throw new Error(`tag ${step.tag} already exists: bump VERSION`);
-  git(["tag", step.tag], mirror, execute);
-  return mirror;
-}
-
-function consumeFresh(step, mirror, work, execute) {
-  const app = path.join(work, "consumer");
-  fs.mkdirSync(path.join(app, "Sources", "App"), { recursive: true });
-  fs.writeFileSync(path.join(app, "Package.swift"), [
-    "// swift-tools-version: 6.0", "import PackageDescription", "let package = Package(",
-    '  name: "App", platforms: [.iOS(.v17), .macOS(.v14)],',
-    `  dependencies: [.package(url: "file://${mirror}", exact: "${step.tag}")],`,
-    '  targets: [.target(name: "App", dependencies: [.product(name: "RightKitStore", package: "rightkit-swift")])]', ")", "",
-  ].join("\n"));
-  fs.writeFileSync(path.join(app, "Sources", "App", "App.swift"), "import RightKitStore\npublic let ok = true\n");
-  const result = execute("swift", ["package", "resolve"], { cwd: app, encoding: "utf8", windowsHide: true, stdio: "inherit" });
-  if (result.error || result.status !== 0) throw new Error("fresh consumer resolution failed");
-  const pins = fs.readFileSync(path.join(app, "Package.resolved"), "utf8");
-  if (!pins.includes(`"version" : "${step.tag}"`)) throw new Error(`consumer did not resolve exact tag ${step.tag}`);
-}
-
-// Evidence binds this exact git-archive command, rooted at the package tree.
+// Evidence binds this exact git-archive of the package tree at HEAD.
 export function verifySwiftSourceArchive(bytes, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.artifactSha256 ?? "")) throw new Error("Swift source archive hash evidence is required");
   if (digestBytes(bytes) !== evidence.artifactSha256) throw new Error("Swift source archive sha256 does not match evidence artifactSha256");
@@ -133,70 +77,63 @@ export function verifySwiftSourceArchive(bytes, evidence) {
 export function runSwiftPublish(options, execute = spawnSync) {
   const packageDir = options.packageDir;
   const { name, version } = readPackageIdentity(packageDir);
+  const toplevel = git(["rev-parse", "--show-toplevel"], packageDir, execute);
+  const out = (message) => process.stdout.write(`[right-release] swift ${message}\n`);
+
+  const branch = git(["symbolic-ref", "--short", "-q", "HEAD"], toplevel, execute);
+  if (branch !== "main") throw new Error(`publish swift runs only on main (current: ${branch || "detached HEAD"})`);
+  if (git(["status", "--porcelain", "--untracked-files=normal"], toplevel, execute) !== "") throw new Error("working tree is not clean: commit or remove changes before tagging");
+  git(["fetch", "--quiet", "origin", "main"], toplevel, execute);
+  const sha = git(["rev-parse", "HEAD"], toplevel, execute);
+  const ancestor = execute("git", ["merge-base", "--is-ancestor", sha, "origin/main"], { cwd: toplevel, encoding: "utf8", windowsHide: true });
+  if (ancestor.error) throw ancestor.error;
+  if (ancestor.status !== 0) throw new Error(`HEAD ${sha} is not on origin/main: push it and let CI pass first`);
+  out("branch, clean tree, HEAD on origin/main: ok");
+
+  const drift = execute(process.execPath, ["--test", DRIFT_TEST], { cwd: toplevel, encoding: "utf8", windowsHide: true });
+  if (drift.error) throw drift.error;
+  if (drift.status !== 0) throw new Error(`root Package.swift drifted from swift/RightKitSwift/Package.swift:\n${drift.stdout ?? ""}${drift.stderr ?? ""}`);
+  out("root manifest matches nested manifest: ok");
+
+  if (git(["tag", "-l", version], toplevel, execute) !== "") throw new Error(`tag ${version} already exists locally: bump VERSION`);
+  if (git(["ls-remote", "--tags", "origin", `refs/tags/${version}`], toplevel, execute) !== "") throw new Error(`tag ${version} already exists on origin: bump VERSION`);
+  out(`tag ${version} is free: ok`);
+
   const workspaceRoot = path.resolve(options.workspace ?? path.join(packageDir, "..", ".."));
   const gate = enforcePublicationGate({
     kind: "swift", name, version, packagePath: packageDir,
     evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(workspaceRoot, "swift", name)),
   }, { dryRun: options.dryRun });
-  const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
-  const sourceCommit = gate.evidence?.commit ?? "HEAD";
-  const tree = git(["rev-parse", prefix ? `${sourceCommit}:${prefix}` : `${sourceCommit}^{tree}`], packageDir, execute);
-  // `git archive` filters by the current subdirectory, so archiving the package
-  // subtree from inside the package yields an empty tar; run it at the toplevel.
-  const toplevel = git(["rev-parse", "--show-toplevel"], packageDir, execute) || packageDir;
-  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: toplevel, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
-  if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift source archive creation failed");
-  const bytes = Buffer.from(archive.stdout);
-  if (gate.ok || !options.dryRun) verifySwiftSourceArchive(bytes, gate.evidence);
-  const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
-  const work = fs.mkdtempSync(path.join(os.tmpdir(), "rightkit-swift-publish-"));
-  let mirror = null;
-  let sealedCommit;
-  const snapshot = path.join(work, "source");
-  fs.mkdirSync(snapshot);
-  try {
-    const extracted = execute("tar", ["-xf", "-", "-C", snapshot], { input: bytes, windowsHide: true });
-    if (extracted.error || extracted.status !== 0) throw new Error("Swift source archive extraction failed");
-    const identity = readPackageIdentity(snapshot);
-    if (identity.name !== name || identity.version !== version) throw new Error("Swift source archive identity mismatch");
-    for (const step of plan) {
-      process.stdout.write(`[right-release] swift ${step.label}\n`);
-      if (step.internal === "secret-scan") {
-        const violations = scanCrateForSecrets(snapshot);
-        if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
-        continue;
-      }
-      if (step.internal === "mirror") { mirror = mirrorAndTag(step, snapshot, work, execute);
-        if (git(["rev-parse", `${step.tag}^{tree}`], mirror, execute) !== tree) throw new Error("Swift mirror differs from verified source archive");
-        sealedCommit = git(["rev-parse", step.tag], mirror, execute);
-        continue; }
-      if (step.internal === "consume") { consumeFresh(step, mirror, work, execute); continue; }
-      if (step.internal === "push") {
-        if (git(["rev-parse", `${sealedCommit}^{tree}`], mirror, execute) !== tree || git(["rev-parse", step.tag], mirror, execute) !== sealedCommit) throw new Error("Swift publication tag changed after verification");
-        const branch = git(["symbolic-ref", "--short", "HEAD"], mirror, execute);
-        git(["push", "--atomic", "origin", `${sealedCommit}:refs/heads/${branch}`, `${sealedCommit}:refs/tags/${step.tag}`], mirror, execute);
-        continue;
-      }
-      const result = execute(step.command, step.args.map((arg) => arg === packageDir ? snapshot : arg), { cwd: snapshot, encoding: "utf8", windowsHide: true, stdio: "inherit" });
-      if (result.error) {
-        if (result.error.code === "ENOENT") {
-          throw new Error(`${step.command} not found -- run publish swift on macOS/Linux with the Swift toolchain installed`);
-        }
-        throw result.error;
-      }
-      if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
-    }
-  } finally {
-    fs.rmSync(work, { recursive: true, force: true });
+  if (gate.ok) {
+    if (gate.evidence?.commit !== sha) throw new Error(`publication evidence commit ${gate.evidence?.commit} is not HEAD ${sha}`);
+    const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
+    const tree = git(["rev-parse", prefix ? `${sha}:${prefix}` : `${sha}^{tree}`], packageDir, execute);
+    // `git archive` filters by the current subdirectory, so archive the tree id from the toplevel.
+    const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: toplevel, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
+    if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift package tree archive creation failed");
+    verifySwiftSourceArchive(Buffer.from(archive.stdout), gate.evidence);
+  }
+
+  const commands = swiftTagCommands(version, sha);
+  if (options.dryRun) {
+    for (const [command, args] of commands) out(`dry-run would run: ${command} ${args.join(" ")}`);
+    return { name, version, commit: sha, published: false };
   }
-  return { name, version, published: !options.dryRun };
+  const [tagCommand, pushCommand] = commands;
+  git(tagCommand[1], toplevel, execute);
+  try { git(pushCommand[1], toplevel, execute); }
+  catch (error) { git(["tag", "-d", version], toplevel, execute); throw error; }
+  const remote = git(["ls-remote", "--tags", "origin", `refs/tags/${version}`], toplevel, execute);
+  if (!remote.startsWith(sha)) throw new Error(`origin does not show tag ${version} at ${sha}`);
+  out(`tagged ${version} at ${sha} on ${SWIFT_DISTRIBUTION_URL}`);
+  return { name, version, commit: sha, published: true };
 }
 
 const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
 if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const options = parseSwiftPublishArgs(process.argv.slice(2));
-    const packageDir = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "../../swift/RightKitSwift");
+    const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../swift/RightKitSwift");
     runSwiftPublish({ ...options, packageDir });
   } catch (error) {
     process.stderr.write(`${error.message}\n`);

package/publish-update.mjs

@@ -114,6 +114,7 @@ if (!dryRun && (tier === "update" || artifacts.length > 0)) {
 if (tier === "patch") {
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
+    assertVersionedKey(installer.versionedKey);
     artifactFile(installer.file);
   }
   const platforms = {};
@@ -161,6 +162,13 @@ if (tier === "patch") {
       ...metadata,
       updaterSignature: null,
     });
+    // The versioned copy is the App Installer install source: Windows repairs by re-adding from the URI the
+    // package came from, so it must outlive the version that replaces it.
+    if (installer.versionedKey && !uploadedKeys.has(installer.versionedKey)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.versionedKey}`);
+      if (!dryRun) uploadVerifiedR2Artifact(verifiedArtifact(file), installer.versionedKey, "public", { cwd: root });
+      uploadedKeys.add(installer.versionedKey);
+    }
   }
   if (!artifacts.length) {
     console.log(`${dryRun ? "[dry-run] " : ""}NO patch updater artifacts; skipping patch manifest registration`);
@@ -169,9 +177,10 @@ if (tier === "patch") {
       platform: platform === "mac" ? "mac" : "windows",
       dryRun,
       keep: {
-        public: installers.map((artifact) => artifact.key),
+        public: installerKeepKeys(),
         private: target.updater.artifacts.map((artifact) => artifact.key),
       },
+      retainPreviousVersions: installers.some((artifact) => artifact.versionedKey) ? 1 : 0,
     });
     if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
     process.exit(0);
@@ -207,9 +216,10 @@ if (tier === "patch") {
     platform: platform === "mac" ? "mac" : "windows",
     dryRun,
     keep: {
-      public: [...installers.map((artifact) => artifact.key), ...registrations.keys()],
+      public: [...installerKeepKeys(), ...registrations.keys()],
       private: [],
     },
+    retainPreviousVersions: installers.some((artifact) => artifact.versionedKey) ? 1 : 0,
   });
   if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
   process.exit(0);
@@ -311,6 +321,18 @@ function assertCurrentKey(key, kind) {
   }
 }
 
+// Current + versioned installer keys: both stay public so the old install source is never deleted.
+function installerKeepKeys() {
+  return installers.flatMap((artifact) => [artifact.key, ...(artifact.versionedKey ? [artifact.versionedKey] : [])]);
+}
+
+function assertVersionedKey(key) {
+  if (key === undefined) return;
+  if (!/\/installers\/(?:mac|windows)\/versions\/[^/]+\/[^/]+$/.test(key)) {
+    fail(`installer versionedKey must be <app>/installers/<os>/versions/<version>/<file>, got: ${key}`);
+  }
+}
+
 function patchInstallerKey(artifact) {
   if (artifact.patchKey) return artifact.patchKey;
   if (!artifact.key.includes("/updates/")) fail(`patch updater key must be convertible to installers/current, got: ${artifact.key}`);

package/qa-build-features.mjs

@@ -0,0 +1,216 @@
+// Source-level layer of "no test-automation surface ships": a release or update build must not enable the cargo
+// features that compile one in. The binary layer (`qa-control-scan.mjs`) cannot see every surface (a stripped
+// binary, compressed installers), so right-release also refuses, before it builds anything:
+//   - a build command (prePackage, package, native package hook, finalizer) that enables one of the forbidden
+//     features, directly (`--features`, `-F`, `-f`, `--features=`, `--all-features`) or through a package.json
+//     script it runs (`pnpm run <script>`, followed up to three levels);
+//   - an app Cargo.toml whose DEFAULT feature closure reaches one of them, or that lists `devtools` on `tauri`,
+//     (`devtools` and rightkit-tauri-shell's `content-devtools` are accepted only for an allow-listed app, see devtools-policy.mjs)
+//     `qa-control` on `rightkit-qa-driver`, `dev-inspect` on `rightkit-tauri-shell`, or `tauri-plugin-wdio-webdriver` as a non-optional dependency.
+// Dev builds are unaffected: `development.mjs` never calls this.
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+export const FORBIDDEN_FEATURES = Object.freeze(["devtools", "content-devtools", "qa-native", "qa-control", "dev-native", "dev-inspect",
+  // Per-app test-automation features (M20 owner gap): HeardRight `qa-shot`/`qa-tools`, ViewRight `dev-control`/`bench-native`.
+  "qa-shot", "qa-tools", "dev-control", "bench-native",
+  // D4 (M21/M23): rightkit-daemon `test-mode` compiles the override selectors; never in a release build.
+  "test-mode"]);
+// The only forbidden features an allow-listed app may enable: rightkit-tauri-shell's `content-devtools` (and the Tauri
+// `devtools` it switches on). See devtools-policy.mjs; every other app is refused them.
+const DEVTOOLS_FEATURES = Object.freeze(["devtools", "content-devtools"]);
+const FORBIDDEN_DEPENDENCY = "tauri-plugin-wdio-webdriver";
+const MANAGERS = new Set(["pnpm", "npm", "yarn", "bun", "npx"]);
+
+// "dep:foo" -> "foo"; "tauri/devtools" and "tauri?/devtools" -> "devtools".
+function featureName(item) {
+  const bare = String(item).trim().replace(/^dep:/, "");
+  return bare.includes("/") ? bare.slice(bare.lastIndexOf("/") + 1) : bare;
+}
+export function isForbiddenFeature(item, { allowDevtools = false } = {}) {
+  const text = String(item).trim();
+  const name = featureName(text);
+  if (allowDevtools && DEVTOOLS_FEATURES.includes(name)) return false;
+  return text === `dep:${FORBIDDEN_DEPENDENCY}` || FORBIDDEN_FEATURES.includes(name);
+}
+
+export function tokenize(text) {
+  return (String(text).match(/"[^"]*"|'[^']*'|[^\s"']+/g) ?? []).map((t) => t.replace(/^["']|["']$/g, ""));
+}
+
+// Feature names a token list enables, plus whether it asks for every feature.
+export function featuresInTokens(tokens) {
+  const enabled = []; let allFeatures = false;
+  const take = (value) => { for (const part of String(value).split(/[,\s]+/)) if (part) enabled.push(part); };
+  for (let i = 0; i < tokens.length; i += 1) {
+    const t = tokens[i];
+    if (t === "--all-features") allFeatures = true;
+    else if (t === "--features" || t === "-F" || t === "-f" || t === "--feature") { if (i + 1 < tokens.length) take(tokens[i + 1]); }
+    else if (t.startsWith("--features=")) take(t.slice("--features=".length));
+    else if (/^-F.+/.test(t)) take(t.slice(2));
+  }
+  return { enabled, allFeatures };
+}
+
+export function scriptTarget(tokens) {
+  const first = tokens.findIndex((t) => MANAGERS.has(path.basename(t).replace(/\.(cmd|exe)$/i, "")));
+  if (first < 0) return null;
+  let i = first + 1;
+  while (i < tokens.length && tokens[i].startsWith("-")) i += 1;
+  if (["run", "run-script"].includes(tokens[i])) { i += 1; while (i < tokens.length && tokens[i].startsWith("-")) i += 1; }
+  return tokens[i] ?? null;
+}
+
+// Issues (strings) for one command object { cmd, args, env? } or a shell string.
+export function commandFeatureIssues(command, { label = "command", scripts = {}, depth = 0, seen = new Set(), allowDevtools = false } = {}) {
+  const parts = typeof command === "string" ? [command] : [command?.cmd, ...(command?.args ?? [])].filter((v) => v !== undefined).map(String);
+  // Two views: every argument whole (`--features` followed by "a b qa-native"), and every argument re-tokenised as
+  // shell text (`sh -c "cargo build --features qa-native"`).
+  const views = [parts, parts.flatMap((p) => tokenize(p))];
+  const issues = new Set();
+  for (const tokens of views) {
+    const { enabled, allFeatures } = featuresInTokens(tokens);
+    if (allFeatures) issues.add(`${label}: --all-features enables every feature including ${FORBIDDEN_FEATURES.join(", ")}`);
+    for (const feature of enabled) if (isForbiddenFeature(feature, { allowDevtools })) issues.add(`${label}: enables feature \`${feature}\``);
+  }
+  if (command && typeof command === "object") {
+    for (const [key, value] of Object.entries(command.env ?? {})) {
+      if (/FEATURES$/i.test(key)) for (const feature of String(value).split(/[,\s]+/)) if (feature && isForbiddenFeature(feature, { allowDevtools })) issues.add(`${label}: env ${key} enables feature \`${feature}\``);
+    }
+  }
+  const script = views.map(scriptTarget).find(Boolean);
+  if (script && depth < 3 && Object.hasOwn(scripts, script) && !seen.has(script)) {
+    for (const issue of commandFeatureIssues(String(scripts[script]), { label: `${label} -> package script \`${script}\``, scripts, depth: depth + 1, seen: new Set([...seen, script]), allowDevtools })) issues.add(issue);
+  }
+  return [...issues];
+}
+
+// ---- Cargo.toml ---------------------------------------------------------------------------------------------
+function stripComments(text) {
+  let out = ""; let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) { out += c; if (c === quote && text[i - 1] !== "\\") quote = null; continue; }
+    if (c === '"' || c === "'") { quote = c; out += c; continue; }
+    if (c === "#") { while (i < text.length && text[i] !== "\n") i += 1; out += "\n"; continue; }
+    out += c;
+  }
+  return out;
+}
+
+function sectionsOf(text) {
+  const sections = []; let current = { name: "", body: "" };
+  for (const line of text.split(/\r?\n/)) {
+    const header = line.match(/^\s*\[\s*([^\[\]]+?)\s*\]\s*$/);
+    if (header) { sections.push(current); current = { name: header[1].replace(/\s+/g, ""), body: "" }; }
+    else current.body += `${line}\n`;
+  }
+  sections.push(current);
+  return sections;
+}
+
+function balanced(text, from, open, close) {
+  let depth = 0; let quote = null;
+  for (let i = from; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) { if (c === quote && text[i - 1] !== "\\") quote = null; continue; }
+    if (c === '"' || c === "'") quote = c;
+    else if (c === open) depth += 1;
+    else if (c === close) { depth -= 1; if (depth === 0) return text.slice(from, i + 1); }
+  }
+  return text.slice(from);
+}
+
+const strings = (text) => [...String(text).matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2]);
+const unquote = (key) => key.replace(/^["']|["']$/g, "");
+
+export function parseCargoFeaturesAndDependencies(manifestText) {
+  const sections = sectionsOf(stripComments(manifestText));
+  const features = new Map(); const dependencies = new Map();
+  for (const { name, body } of sections) {
+    if (name === "features") {
+      for (const m of body.matchAll(/^\s*([A-Za-z0-9_\-"']+)\s*=\s*\[/gm)) {
+        features.set(unquote(m[1]), strings(balanced(body, m.index + m[0].length - 1, "[", "]")));
+      }
+    } else if (/^(?:target\.[^\n]+\.)?dependencies$/.test(name)) {
+      for (const m of body.matchAll(/^\s*([A-Za-z0-9_\-"']+)\s*=\s*(\{)?/gm)) {
+        const depName = unquote(m[1]);
+        const spec = m[2] ? balanced(body, m.index + m[0].length - 1, "{", "}") : "";
+        dependencies.set(depName, dependencyInfo(spec));
+      }
+    } else {
+      const table = name.match(/^(?:target\.[^\n]+\.)?dependencies\.([A-Za-z0-9_\-]+)$/);
+      if (table) dependencies.set(table[1], dependencyInfo(body));
+    }
+  }
+  return { features, dependencies };
+}
+function dependencyInfo(spec) {
+  const list = spec.match(/features\s*=\s*(\[)/);
+  return {
+    optional: /optional\s*=\s*true/.test(spec),
+    features: list ? strings(balanced(spec, list.index + list[0].length - 1, "[", "]")) : [],
+  };
+}
+
+export function cargoManifestIssues(manifestText, label = "Cargo.toml", { allowDevtools = false } = {}) {
+  const { features, dependencies } = parseCargoFeaturesAndDependencies(manifestText);
+  const issues = [];
+  const tauri = dependencies.get("tauri");
+  if (!allowDevtools && tauri?.features.includes("devtools")) issues.push(`${label}: dependency \`tauri\` lists feature \`devtools\` unconditionally (inspector ships in release builds)`);
+  // The crate was renamed from rightkit-control; apps still on the old published name must stay covered.
+  for (const name of ["rightkit-qa-driver", "rightkit-control"]) {
+    const control = dependencies.get(name);
+    if (control && !control.optional && control.features.includes("qa-control")) issues.push(`${label}: dependency \`${name}\` lists \`qa-control\` unconditionally`);
+  }
+  // The crate was renamed from rightkit-shell; apps still on the old published name must stay covered.
+  for (const name of ["rightkit-tauri-shell", "rightkit-shell"]) {
+    const shell = dependencies.get(name);
+    if (shell && !shell.optional && shell.features.includes("dev-inspect")) issues.push(`${label}: dependency \`${name}\` lists \`dev-inspect\` unconditionally (developer inspection ships in release builds)`);
+  }
+  const service = dependencies.get("rightkit-daemon");
+  if (service && !service.optional && service.features.includes("test-mode")) issues.push(`${label}: dependency \`rightkit-daemon\` lists \`test-mode\` unconditionally (test-mode capability ships in release builds)`);
+  const wdio = dependencies.get(FORBIDDEN_DEPENDENCY);
+  if (wdio && !wdio.optional) issues.push(`${label}: dependency \`${FORBIDDEN_DEPENDENCY}\` is not optional`);
+  const reached = new Set(); const stack = [...(features.get("default") ?? [])];
+  while (stack.length) {
+    const item = stack.pop();
+    if (reached.has(item)) continue;
+    reached.add(item);
+    if (isForbiddenFeature(item, { allowDevtools })) issues.push(`${label}: default feature set reaches \`${item}\``);
+    if (features.has(item)) stack.push(...features.get(item));
+  }
+  return issues;
+}
+
+// commands: [{ label, command }]. Reads package.json scripts and the app Cargo manifests under `root`.
+// `devtools`: the allowance resolved by devtools-policy.mjs (mode "content-only") for an allow-listed app, else undefined.
+// Single manifest resolver shared by the closure gate (release-switch-scan.mjs) and the default-feature check below:
+// targets.<os>.cargoManifest -> releaseSwitches.manifest -> src-tauri/Cargo.toml -> Cargo.toml. `rel` is the first
+// candidate that exists (undefined when none does); `declared` are the configured paths.
+export function resolveCargoManifestPath({ root, cargoManifest, manifest } = {}) {
+  const declared = [cargoManifest, manifest].filter(Boolean);
+  const candidates = [...declared, path.join("src-tauri", "Cargo.toml"), "Cargo.toml"];
+  return { rel: candidates.find((c) => existsSync(path.join(root, c))), declared, candidates };
+}
+
+export function buildFeatureIssues({ root, commands, devtools, cargoManifest, manifest }) {
+  const allowDevtools = devtools?.mode === "content-only";
+  let scripts = {};
+  try { scripts = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).scripts ?? {}; } catch { /* no package.json */ }
+  const issues = [];
+  for (const { label, command } of commands) if (command) issues.push(...commandFeatureIssues(command, { label, scripts, allowDevtools }));
+  const { rel } = resolveCargoManifestPath({ root, cargoManifest, manifest });
+  if (rel) issues.push(...cargoManifestIssues(readFileSync(path.join(root, rel), "utf8"), rel, { allowDevtools }));
+  return issues;
+}
+
+export function assertNoForbiddenBuildFeatures({ root, commands, tier = "release", devtools, cargoManifest, manifest }) {
+  const issues = buildFeatureIssues({ root, commands, devtools, cargoManifest, manifest });
+  if (issues.length === 0) return;
+  throw new Error(
+    `${tier} build refused: it enables a test-automation or debugging feature (${FORBIDDEN_FEATURES.join(", ")}); none may ship:\n- ${issues.join("\n- ")}\n`
+    + "Remove the feature from the release build command, the app's default features and its tauri dependency; dev builds (`right-release dev`) may keep it. "
+    + "No app may ship devtools unless it is on the allow-list in devtools-policy.json and declares `devtools: \"content-only\"` (rightkit-tauri-shell DevToolsPolicy::ContentOnly).",
+  );
+}