@rightkit/release 0.2.164 → 0.2.172

package/rightkit-ownership.json

@@ -16,12 +16,12 @@
     {
       "package": "rightkit-agents",
       "capability": "agent-sessions",
-      "summary": "Supervised vendor agent sessions for Right Suite apps: shared agent event model, Claude Code stream-json and Codex app-server protocol clients, recorded fixtures. No SDK, no HTTP, no MCP.",
+      "summary": "Supervised vendor agent sessions for Right Suite apps: shared agent event model, Claude Code stream-json and Codex app-server protocol clients, session lifecycle with approvals and tree teardown, recorded fixtures. No SDK, no HTTP, no MCP.",
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
         "Declaration-only: vendor CLI protocol handling is not a dependency fingerprint.",
-        "Lane 1 ships protocol clients and fixtures only; session lifecycle, approvals and the API backend land in later releases."
+        "0.2.0 adds the session lifecycle (feature session) over rightkit-child-process; the API backend lands in a later release."
       ]
     },
     {
@@ -35,6 +35,49 @@
         "Consumes rightkit-transcript words; holds no audio, models or I/O."
       ]
     },
+    {
+      "package": "rightkit-android",
+      "capability": "android-bridge",
+      "summary": "Android JNI context capture, UniFFI Kotlin bridge, Keystore credential bridge and Gradle library module for Right Suite apps",
+      "fingerprints": [
+        {
+          "id": "android.cargo.jni",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "jni",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency in an app crate; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "android.cargo.uniffi",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "uniffi",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency in an app crate; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Apps reach the JavaVM, the application Context and Keystore through rightkit-android; app crates do not depend on jni directly for context capture.",
+        "App-specific UniFFI exports (model load, PCM sessions) belong in the app's own cdylib; the dependency allowlist decision for uniffi in app crates is made outside this file.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
     {
       "package": "rightkit-app-settings",
       "capability": "settings-persistence",
@@ -762,7 +805,7 @@
         {
           "id": "tauri.rs.standard-command-fn",
           "type": "source",
-          "pattern": "\\bfn\\s+(?:secure_update_license_(?:get|set|delete)|secure_device_id_get_or_create)\\s*\\((?![\\s\\S]{0,800}?\\b(?:rightkit_device|rightkit_tauri|SecureService|DeviceService|AuthorizationService)\\b)",
+          "pattern": "\\bfn\\s+(?:secure_update_license_(?:get|set|delete)|secure_device_id_get_or_create)\\s*\\((?![\\s\\S]{0,800}?\\b(?:rightkit_device|rightkit_tauri|SecureService|DeviceService|AuthorizationService)\\b|[\\s\\S]{0,800}?\\b[A-Z][A-Z0-9_]*SERVICE\\s*\\.\\s*(?:get_or_create|get|set|delete)\\s*\\()",
           "codeOnly": true,
           "extensions": [
             ".rs"
@@ -784,6 +827,224 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-docs",
+      "capability": "document-io",
+      "summary": "Product-neutral DOCX, XLSX and PDF read and write: format detection from content, typed reads with caps, typed write ops through an atomic writer with a source-hash recheck, honest loss receipts, hardened against zip bombs, XML entities, macros, encryption and formula injection",
+      "fingerprints": [
+        {
+          "id": "docs.cargo.docx-rs",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "docx-rs",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.cargo.docx-rust",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "docx-rust",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.cargo.calamine",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "calamine",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.cargo.rust-xlsxwriter",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "rust_xlsxwriter",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.cargo.umya-spreadsheet",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "umya-spreadsheet",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.cargo.office-oxide",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "office_oxide",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.cargo.edit-xlsx",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "edit-xlsx",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.npm.docx",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "docx",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.npm.exceljs",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "exceljs",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.npm.xlsx",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "xlsx",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "docs.npm.mammoth",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "mammoth",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded.",
+        "Reads and edits PDF through rightkit-pdf (capability pdf-engine); use pdf-engine directly for page graphs, font work and the staged-save pipeline."
+      ]
+    },
+    {
+      "package": "rightkit-docs",
+      "capability": "docx",
+      "summary": "Alias of document-io: read, create and edit Word (.docx) documents; owner is rightkit-docs",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Discovery alias so `rightkit owns docx` resolves to the document-io owner; carries no fingerprints of its own."
+      ]
+    },
+    {
+      "package": "rightkit-docs",
+      "capability": "xlsx",
+      "summary": "Alias of document-io: read, create and edit Excel (.xlsx) workbooks; owner is rightkit-docs",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Discovery alias so `rightkit owns xlsx` resolves to the document-io owner; carries no fingerprints of its own."
+      ]
+    },
+    {
+      "package": "rightkit-docs",
+      "capability": "document",
+      "summary": "Alias of document-io: read and write DOCX, XLSX and PDF documents; owner is rightkit-docs",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Discovery alias so `rightkit owns document` resolves to the document-io owner; carries no fingerprints of its own."
+      ]
+    },
+    {
+      "package": "rightkit-docs",
+      "capability": "spreadsheet",
+      "summary": "Alias of document-io: read, create and edit spreadsheets (.xlsx); owner is rightkit-docs",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Discovery alias so `rightkit owns spreadsheet` resolves to the document-io owner; carries no fingerprints of its own."
+      ]
+    },
     {
       "package": "rightkit-embed",
       "capability": "embeddings",
@@ -1059,6 +1320,18 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-hooks",
+      "capability": "lifecycle-hooks",
+      "summary": "Native pair of @rightkit/hooks: typed Claude Code and Codex hook payloads, a deadline-bound dispatcher that always exits 0, exact per-event output builders, and emitted/observed delivery receipts.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: no precise implementation fingerprint; never enforced ownership or verified integration.",
+        "Shares the lifecycle-hooks capability with @rightkit/hooks (JS). Unlike the JS bin, the Rust dispatcher exits 0 on every internal failure.",
+        "Codex PreToolUse denials exit 2 with the reason on stderr (the shipped Legion shape); every other failure prints nothing and exits 0."
+      ]
+    },
     {
       "package": "rightkit-hotkeys",
       "capability": "global-hotkeys",
@@ -1622,10 +1895,42 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-motion",
+      "capability": "motion-beat-sync",
+      "summary": "Bracketed-script beat sync: parse a script with [spans] and snap animation cues to word timings from rightkit-transcript; typed errors on any mismatch, no fuzzy matching",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: script parsing and word snapping are not an ownership fingerprint.",
+        "Consumes rightkit-transcript words; fuzzy ASR matching stays in rightkit-align."
+      ]
+    },
+    {
+      "package": "rightkit-motion",
+      "capability": "motion-inspect-sheets",
+      "summary": "Storyboard inspect sheets: plan and (feature assemble) compose rendered frames into sheets, six tiles per 2x3 sheet by default with a 480 px minimum tile width (defaults to confirm), with a rightkit.motion.sheets.v1 manifest",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: sheet layout is not an ownership fingerprint.",
+        "No media decode or encode lives in this crate; callers decode frames through rightkit-ffmpeg."
+      ]
+    },
+    {
+      "package": "rightkit-motion",
+      "capability": "motion-takes",
+      "summary": "Append-only checksummed take container for rendered frames (gated: not built until a producer is named)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only and gated: the take module is not built; this capability reserves the name until a producer is named (decision record docs/design/motion-owner.md)."
+      ]
+    },
     {
       "package": "rightkit-oauth",
       "capability": "oauth-sign-in",
-      "summary": "OAuth sign-in: loopback PKCE, device flow, provider endpoints, refresh",
+      "summary": "OAuth sign-in: loopback PKCE, device flow, provider endpoints, refresh; default-browser sign-in only",
       "fingerprints": [
         {
           "id": "oauth.cargo.oauth2",
@@ -1701,6 +2006,111 @@
             "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "oauth.webview.auth-url-load",
+          "excludePaths": [
+            "crates/rightkit-ownership/tests/ownership_fixtures.rs",
+            "packages/release/fixtures/ownership/source-fingerprint-samples.mjs"
+          ],
+          "type": "source",
+          "pattern": "\\b(?:WebviewWindowBuilder|WebviewUrl::External|WebviewBuilder|WebView2|WKWebView|loadRequest|loadUrl|load_url|\\.navigate|\\.eval)\\b[^\\n]{0,300}(?:accounts\\.google\\.com|appleid\\.apple\\.com|/oauth2?/authorize|/o/oauth2/(?:v2/)?auth)",
+          "codeOnly": false,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs",
+            ".swift",
+            ".m",
+            ".mm",
+            ".kt",
+            ".java",
+            ".cs"
+          ],
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Source text (the auth URL sits in a string literal); an app loading an authorization URL in its own webview"
+          },
+          "tierReason": "Banned by owner policy; sign-in opens the user's default browser through rightkit-oauth (browser::SystemBrowser), never an in-app webview",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-17: every Google, Apple or OAuth sign-in opens the default browser, never an in-app webview (Orthic-Labs/rightkit#279)"
+        },
+        {
+          "id": "oauth.webview.on-navigation-intercept",
+          "excludePaths": [
+            "crates/rightkit-ownership/tests/ownership_fixtures.rs",
+            "packages/release/fixtures/ownership/source-fingerprint-samples.mjs"
+          ],
+          "type": "source",
+          "pattern": "\\bon_navigation\\b[^\\n]{0,400}(?:[?&]code=|redirect_uri|\\boauth|access_token|id_token)",
+          "codeOnly": false,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs",
+            ".swift",
+            ".m",
+            ".mm",
+            ".kt",
+            ".java",
+            ".cs"
+          ],
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Source text (the auth URL sits in a string literal); an on_navigation callback intercepting an OAuth redirect"
+          },
+          "tierReason": "Banned by owner policy; sign-in opens the user's default browser through rightkit-oauth (browser::SystemBrowser), never an in-app webview",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-17: every Google, Apple or OAuth sign-in opens the default browser, never an in-app webview (Orthic-Labs/rightkit#279)"
+        },
+        {
+          "id": "oauth.webview.bundled-chromium-login",
+          "excludePaths": [
+            "crates/rightkit-ownership/tests/ownership_fixtures.rs",
+            "packages/release/fixtures/ownership/source-fingerprint-samples.mjs"
+          ],
+          "type": "source",
+          "pattern": "\\b(?:chromiumoxide|headless_chrome|CefBrowser(?:Host)?|CefLifeSpanHandler)\\b[^\\n]{0,300}(?:accounts\\.google\\.com|appleid\\.apple\\.com|/oauth2?/authorize|/o/oauth2/(?:v2/)?auth)",
+          "codeOnly": false,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs",
+            ".swift",
+            ".m",
+            ".mm",
+            ".kt",
+            ".java",
+            ".cs"
+          ],
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Source text (the auth URL sits in a string literal); bundled Chromium used to run a sign-in"
+          },
+          "tierReason": "Banned by owner policy; sign-in opens the user's default browser through rightkit-oauth (browser::SystemBrowser), never an in-app webview",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-17: every Google, Apple or OAuth sign-in opens the default browser, never an in-app webview (Orthic-Labs/rightkit#279)"
         }
       ],
       "detection": "fingerprinted",
@@ -1973,6 +2383,27 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-pdf",
+      "capability": "pdf",
+      "summary": "Discovery alias of pdf-engine: PDF inspect, edit, merge and text extraction are rightkit-pdf; one-shot PDF text read and replace beside DOCX and XLSX is rightkit-docs (document-io)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Discovery alias so `rightkit owns pdf` resolves to the PDF owner; carries no fingerprints of its own."
+      ]
+    },
+    {
+      "package": "rightkit-platform-rules",
+      "capability": "platform-rules",
+      "summary": "Versioned catalog of per-platform limits and rules with a stable rule-revision hash and a check of planned values against sourced rules",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the bundled rules catalog and revision hash are not an ownership fingerprint.",
+        "Unsourced, stale or missing rules block use; apps bind work to a rule revision instead of hard-coding platform limits."
+      ]
+    },
     {
       "package": "rightkit-playback",
       "capability": "media-playback",
@@ -2199,7 +2630,7 @@
     {
       "package": "rightkit-review",
       "capability": "content-review",
-      "summary": "Shared review capability: typed deterministic checks over a media or brief description, declared holds, a hard-capped repair loop, an advisory judge interface that cannot override deterministic failures, and versioned verdict records.",
+      "summary": "Shared review capability: typed deterministic checks over a media or brief description, declared holds, a hard-capped repair loop, an advisory judge interface that cannot override deterministic failures, versioned verdict records, and the autonomy ladder (reviewed, review-light, autonomous per content type and platform, with overridable thresholds and a version-tagged state).",
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
@@ -2512,6 +2943,17 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-spend",
+      "capability": "spend-ledger",
+      "summary": "Spend reservation, allowance and compare-and-swap ledger on SQLite: integer micro-units, idempotent reserve on request id, in-flight and overrun handling, opaque allowance periods",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the ledger tables and reservation state machine are not an ownership fingerprint.",
+        "Price rows live in rightkit-llm; the ledger stores opaque route and price-version text and no currency."
+      ]
+    },
     {
       "package": "rightkit-sync",
       "capability": "cloud-sync",
@@ -2523,6 +2965,17 @@
         "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
+    {
+      "package": "rightkit-sync-keys",
+      "capability": "sync-key-management",
+      "summary": "End-to-end sync key management: account data key, versioned rotation, per-zone key derivation, OS credential storage and device-approval key transfer (X25519, short code, AEAD); declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
     {
       "package": "rightkit-tauri-shell",
       "capability": "desktop-shell",
@@ -2748,6 +3201,63 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-typeset",
+      "capability": "typeset",
+      "summary": "Typst rendering for titles, captions and math, with mitex LaTeX input: SVG (and PNG with a feature), no file access, no package fetching, explicit fonts",
+      "fingerprints": [
+        {
+          "id": "typeset.cargo.typst",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "typst",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "typeset.cargo.typst-render",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "typst-render",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "typeset.cargo.mitex",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "mitex",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; apps use rightkit-typeset instead of taking typst, typst-render or mitex directly; published two-host replacement qualification is not recorded."
+      ]
+    },
     {
       "package": "rightkit-vad",
       "capability": "voice-activity-detection",
@@ -2790,6 +3300,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-vault",
+      "capability": "secret-vault",
+      "summary": "Split-key secret vault: a small secret map sealed under a random data key, the key wrapped under a server-held wrapping key combined with a device-held client secret, blob kept in the user's own cloud app folder; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
     {
       "package": "rightkit-workflow",
       "capability": "scenario-runtime",
@@ -3892,6 +4413,17 @@
         "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
+    {
+      "package": "@rightkit/sync-worker",
+      "capability": "sync-worker",
+      "summary": "Cloudflare Worker implementing the server side of rightkit-sync-http/1 on D1 and R2; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
     {
       "package": "@rightkit/tauri",
       "capability": "tauri-host-adapters",

package/rightkit-sync.mjs

@@ -166,6 +166,32 @@ export async function syncRightkitVersions({ check = false, fetchImpl = fetch, f
   return { changes, unpublished, copies, written };
 }
 
+/** Stage source versions into the feed BEFORE packing, so the rightkit-versions.json a tarball ships lists
+ * the very version it ships with (the feed is otherwise written after publish and lags by one release).
+ * Synchronous and offline: a unit below its staged version is skipped (never lowered); published pins stay
+ * allowed through the same retainPublished rule as stageVersion. Refreshes the consumer copies. */
+export function stageSourceVersions(entries, { file = VERSIONS_FILE, root = rightkitRoot, log = (line) => process.stdout.write(`${line}\n`) } = {}) {
+  const versions = JSON.parse(readFileSync(file, "utf8"));
+  const next = structuredClone(versions); const changes = [];
+  for (const { registry, name, version } of entries) {
+    const [stagedKey] = versionKeys(registry);
+    if (typeof name !== "string" || !name.trim()) throw new Error("stageSourceVersions requires a package or crate name");
+    if (typeof version !== "string" || !SEMVER.test(version)) throw new Error(`invalid semver: ${version}`);
+    const current = next[stagedKey]?.[name] ?? next[registry]?.[name] ?? null;
+    if (current && compareVersions(version, current) <= 0) continue;
+    retainPublished(next, { registry, name, version }, [current, next.registry?.[registry]?.[name]], undefined);
+    next[stagedKey] ??= {};
+    next[stagedKey][name] = version;
+    next[stagedKey] = Object.fromEntries(Object.entries(next[stagedKey]).sort(([a], [b]) => a.localeCompare(b)));
+    changes.push({ registry, name, from: current, to: version });
+  }
+  const written = JSON.stringify(next) !== JSON.stringify(versions);
+  if (written) writeFileSync(file, `${JSON.stringify(next, null, 2)}\n`);
+  const copies = syncConsumerCopies(root);
+  for (const change of changes) log(`${change.registry} ${change.name}: ${change.from ?? "unlisted"} -> ${change.to} (staged before pack)`);
+  return { changes, copies, written };
+}
+
 /** Record one just-published version (the registry index can lag the upload) and refresh the copies.
  * Called by right-release after a verified cargo or npm publish; never fails the publish itself unless `strict` is set. */
 export function recordPublished({ registry, name, version }, { file = VERSIONS_FILE, root = rightkitRoot, log = (line) => process.stdout.write(`${line}\n`), strict = false } = {}) {