@rightkit/release 0.3.0 → 0.4.1

package/ownership-mandatory-set.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // right-release ownership-mandatory: Table 1 mandatory-owner-set check (plan task 5.1).
 //
+// This evaluates declarations only; it does not establish active target/features, lock resolution or production adoption.
 // A registered app must declare every Table 1 owner (rows M1-M23) at or above the required version,
 // from the registry. Report mode (default) prints per-app findings and exits 0; --enforce exits 1
 // on any missing owner, below-required version, or path/git/patch override ("not-on-registry").
@@ -11,7 +12,14 @@
 //                                     [--amendment v2.1] [--enforce] [--json]
 //
 // App-side declaration (optional): <app>/rightkit-mandatory.json
-//   { "profile": "desktop", "notApplicable": { "M16": "reason text" } }
+//   { "profile": "desktop", "notApplicable": { "M16": "reason text" },
+//     "M22": { "role": "client|host|both|absent", "entrypoints": ["src-tauri/src/agent.rs#register_tools"] } }
+//
+// PK17.scanner (report only, never enforcement): rows M21 and M23 stay `ownerPending` and never fail, but each lists its
+// `pendingOwners` (M21: rightkit-fs, rightkit-daemon, rightkit-qa; M23: @rightkit/release, rightkit-daemon) and the report shows
+// how each app's declarations measure up (`pending[].candidateOwners`, `enforced: false`). Moving those owners into `rows` and
+// raising minimums is the separate activation step (PK17.activation). The M22 applicability record (PK15-2) is validated and
+// reported under `applicability.M22`; an invalid or contradictory record is a `problem`, which never changes the exit code.
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -25,14 +33,51 @@ const SKIP_DIRS = new Set(["node_modules", "target", ".git", "rk-snapshot", "ven
 const MAX_MANIFESTS = 2000;
 
 // ---- versions -------------------------------------------------------------------------------
-/** Lower bound of the first comparator in a Cargo/npm requirement, or null when none can be proven. */
+/**
+ * Proven minimum of a Cargo/npm requirement: a version every satisfying version is guaranteed >=, or null when
+ * none can be proven (upper-only `<9`, `*`, `latest`, malformed, or a `||` branch with no proven minimum).
+ * Space/comma comparators AND (proven minimum = max of lower contributions; `<`/`<=` contribute none); `||`
+ * branches union (proven minimum = min of branch minima, null if any branch is unprovable). Hyphen ranges
+ * contribute their lower end. `>`, `>=`, `=`, `^`, `~`, bare & wildcard partials contribute their version
+ * (missing/`x`/`*` components read as 0), so `>1.2.3` proves 1.2.3 (sound, never above the true floor).
+ */
 export function lowerBound(spec) {
   if (typeof spec !== "string") return null;
-  let s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "");
-  const m = /(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?/.exec(s);
-  if (!m || /^(\*|latest|x|)$/i.test(s)) return null;
-  const n = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
-  return { major: Number(m[1]), minor: n(m[2]), patch: n(m[3]), pre: m[4] ?? null };
+  const s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "").trim();
+  if (!s || /^(\*|latest|x)$/i.test(s)) return null;
+  const part = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
+  const versionOf = (text) => {
+    const m = /^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(text);
+    if (m?.[4] && m[4].split(".").some((id) => !id || (/^\d+$/.test(id) && id.length > 1 && id.startsWith("0")))) return null;
+    return m ? { major: Number(m[1]), minor: part(m[2]), patch: part(m[3]), pre: m[4] ?? null } : null;
+  };
+  const branchBound = (branch) => {
+    const raw = branch.split(/[\s,]+/).filter(Boolean);
+    const tokens = [];
+    for (let i = 0; i < raw.length; i += 1) {
+      if (/^(>=|<=|>|<|=|\^|~)$/.test(raw[i]) && i + 1 < raw.length) { tokens.push(raw[i] + raw[i + 1]); i += 1; }
+      else tokens.push(raw[i]);
+    }
+    if (!tokens.length) return null;
+    const lowers = [];
+    let skipUpperEnd = false;
+    for (const token of tokens) {
+      if (token === "-") { skipUpperEnd = true; continue; }
+      if (skipUpperEnd) { skipUpperEnd = false; continue; }
+      if (/^(\*|x|latest)$/i.test(token)) continue;
+      const m = /^(>=|<=|>|<|=|\^|~)?(.+)$/.exec(token);
+      const version = m && versionOf(m[2]);
+      if (!version) return null;
+      if (m[1] === "<" || m[1] === "<=") continue;
+      lowers.push(version);
+    }
+    return lowers.length ? lowers.reduce((best, v) => (compareVersions(v, best) > 0 ? v : best)) : null;
+  };
+  const branches = s.split("||").map((b) => b.trim());
+  if (branches.some((b) => !b)) return null;
+  const bounds = branches.map(branchBound);
+  if (bounds.some((b) => b === null)) return null;
+  return bounds.reduce((best, v) => (compareVersions(v, best) < 0 ? v : best));
 }
 export const parseVersion = lowerBound;
 export function compareVersions(a, b) {
@@ -40,7 +85,19 @@ export function compareVersions(a, b) {
   if (a.pre === b.pre) return 0;
   if (a.pre === null) return 1;
   if (b.pre === null) return -1;
-  return a.pre < b.pre ? -1 : 1;
+  const left = a.pre.split("."), right = b.pre.split(".");
+  for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+    if (left[i] === undefined) return -1;
+    if (right[i] === undefined) return 1;
+    if (left[i] === right[i]) continue;
+    const an = /^\d+$/.test(left[i]), bn = /^\d+$/.test(right[i]);
+    if (an && bn) {
+      const av = BigInt(left[i]), bv = BigInt(right[i]);
+      if (av !== bv) return av < bv ? -1 : 1;
+    } else if (an !== bn) return an ? -1 : 1;
+    else return left[i] < right[i] ? -1 : 1;
+  }
+  return 0;
 }
 const show = (v) => `${v.major}.${v.minor}.${v.patch}${v.pre ? `-${v.pre}` : ""}`;
 
@@ -75,21 +132,21 @@ export function readManifest(file, root) {
     try { doc = parseToml(text); } catch (error) { return { rel, facts, error: `unparseable Cargo.toml: ${error.message}` }; }
     workspaceDeps = doc.workspace?.dependencies;
     const wsTable = workspaceDeps ?? {};
-    const sections = (table, dev) => {
+    const sections = (table, dev, target = null) => {
       for (const [section, isDev] of [["dependencies", dev], ["build-dependencies", dev], ["dev-dependencies", true]]) {
-        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev);
+        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev, target);
       }
     };
-    const add = (key, raw, dev) => {
+    const add = (key, raw, dev, target) => {
       let value = raw;
       if (value && typeof value === "object" && value.workspace === true && wsTable[key] !== undefined) value = { ...(typeof wsTable[key] === "object" ? wsTable[key] : { version: wsTable[key] }), ...value };
       const name = typeof value === "object" && typeof value.package === "string" ? value.package : key;
       const spec = typeof value === "string" ? value : value?.version;
       const unresolved = raw && typeof raw === "object" && raw.workspace === true && wsTable[key] === undefined;
-      facts.push({ owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
+      facts.push({ target, optional: Boolean(value?.optional), owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
     };
     sections(doc, false);
-    for (const target of Object.values(doc.target ?? {})) sections(target, false);
+    for (const [target, table] of Object.entries(doc.target ?? {})) sections(table, false, target);
     for (const [key, raw] of Object.entries(wsTable)) {
       // workspace.dependencies only counts through members that opt in (above); record path/git overrides here.
       if (isNonRegistry(raw)) facts.push({ owner: typeof raw.package === "string" ? raw.package : key, ecosystem: "cargo", kind: "override", dev: false, spec: raw.version ?? null, via: "workspace.dependencies path/git", file: rel, declarationOnly: true });
@@ -107,7 +164,7 @@ export function readManifest(file, root) {
         const alias = typeof spec === "string" ? /^npm:((?:@[^@/]+\/)?[^@]+)@/.exec(spec) : null;
         const owner = alias ? alias[1] : name;
         const local = typeof spec === "string" && /^(workspace:|file:|link:|portal:|git\+|git:|github:|https?:)/.test(spec);
-        facts.push({ owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
+        facts.push({ declarationSection: section, optional: section === "optionalDependencies", peer: section === "peerDependencies", owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
       }
     }
     for (const table of [doc.pnpm?.overrides, doc.overrides, doc.resolutions]) {
@@ -164,7 +221,7 @@ function judge(req, facts) {
   const counted = mine.filter((f) => f.kind === "registry" && (req.allowDev || !f.dev));
   const devOnly = !counted.length && mine.some((f) => f.kind === "registry" && f.dev);
   const min = lowerBound(req.min);
-  const base = { owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
+  const base = { evidenceKind: "declaration", qualification: "unverified", activeTarget: null, lockResolution: null, productionUse: null, declarations: mine.map((f) => ({ file: f.file, spec: f.spec, dev: f.dev, target: f.target ?? null, optional: f.optional ?? false, peer: f.peer ?? false })), owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
   const bounds = counted.map((f) => ({ f, v: lowerBound(f.spec) }));
   const best = bounds.filter((b) => b.v).sort((a, b) => compareVersions(b.v, a.v))[0];
   const declaredAt = best ? show(best.v) : null;
@@ -181,9 +238,50 @@ function judge(req, facts) {
   return { ...base, status: "ok", declared: declaredAt, evidence: [] };
 }
 
+// An entrypoint is `<relative file>`, optionally `#<symbol>` or `::<symbol>`; a bare token with no path separator or extension
+// is a symbol or command name and is recorded unverified. A file part must stay inside the app root and exist.
+const entrypointFile = (entry) => entry.split(/#|::/)[0];
+const looksLikePath = (text) => /[\\/]/.test(text) || /\.[A-Za-z0-9]+$/.test(text);
+
+/** Validate one applicability record (`M22: { role, entrypoints }`); report-only, never throws. */
+export function validateApplicabilityRecord(id, raw, { spec, root }) {
+  const result = { row: id, status: "unrecorded", role: null, entrypoints: [], unverifiedEntrypoints: 0, problems: [] };
+  if (raw === undefined) return result;
+  const bad = (reason) => result.problems.push(`${id}: ${reason}`);
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) { bad("applicability record must be an object { role, entrypoints }"); result.status = "invalid"; return result; }
+  const extra = Object.keys(raw).filter((key) => key !== "role" && key !== "entrypoints");
+  if (extra.length) bad(`unknown applicability record key(s): ${extra.join(", ")}`);
+  const roles = spec?.roles ?? [];
+  if (!roles.includes(raw.role)) bad(`role must be one of ${roles.join("|")}, got ${JSON.stringify(raw.role)}`);
+  else result.role = raw.role;
+  if (!Array.isArray(raw.entrypoints)) bad("entrypoints must be an array");
+  else {
+    const seen = new Set();
+    for (const entry of raw.entrypoints) {
+      if (typeof entry !== "string" || !entry.trim()) { bad("every entrypoint must be a non-empty string"); continue; }
+      const text = entry.trim();
+      if (seen.has(text)) { bad(`entrypoint ${JSON.stringify(text)} is listed twice`); continue; }
+      seen.add(text);
+      result.entrypoints.push(text);
+      const file = entrypointFile(text);
+      if (!file) { bad(`entrypoint ${JSON.stringify(text)} names no file or symbol`); continue; }
+      if (!looksLikePath(file)) { result.unverifiedEntrypoints += 1; continue; }
+      const normalized = file.replace(/\\/g, "/");
+      if (path.isAbsolute(file) || /^[A-Za-z]:/.test(file) || normalized.split("/").includes("..")) { bad(`entrypoint ${JSON.stringify(text)} must be a relative path inside the app`); continue; }
+      let isFile = false;
+      try { isFile = statSync(path.join(root, normalized)).isFile(); } catch { /* missing */ }
+      if (!isFile) bad(`entrypoint ${JSON.stringify(text)}: file not found under the app root`);
+    }
+    if (result.role === "absent" && raw.entrypoints.length) bad("role absent must list no entrypoints");
+    if (result.role && result.role !== "absent" && !raw.entrypoints.length) bad(`role ${result.role} needs at least one real entrypoint`);
+  }
+  result.status = result.problems.length ? "invalid" : "recorded";
+  return result;
+}
+
 export function loadAppDeclaration(root, data) {
   const file = path.join(root, data.appDeclarationFile);
-  if (!existsSync(file)) return { profile: data.defaultProfile, notApplicable: {}, problems: [] };
+  if (!existsSync(file)) return { profile: data.defaultProfile, notApplicable: {}, records: {}, problems: [] };
   const problems = [];
   let doc = {};
   try { doc = JSON.parse(readFileSync(file, "utf8")); } catch (error) { problems.push(`${data.appDeclarationFile} unparseable: ${error.message}`); }
@@ -192,7 +290,9 @@ export function loadAppDeclaration(root, data) {
     if (typeof reason === "string" && reason.trim().length >= 10) notApplicable[id] = reason.trim();
     else problems.push(`${id}: N/A declaration needs a reason (>= 10 chars); ignored`);
   }
-  return { profile: doc.profile ?? data.defaultProfile, notApplicable, problems };
+  const records = {};
+  for (const id of Object.keys(data.applicabilityRecords ?? {})) if (doc && typeof doc === "object" && Object.hasOwn(doc, id)) records[id] = doc[id];
+  return { profile: doc.profile ?? data.defaultProfile, notApplicable, records, problems };
 }
 
 export function checkApp(root, { data = loadData(), profile, amendments = [] } = {}) {
@@ -213,12 +313,30 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
   }
   const notApplicable = Object.entries(declaration.notApplicable).map(([id, reason]) => ({ row: id, reason }));
   const applicable = rows.filter((r) => !(r.id in declaration.notApplicable));
-  const pending = data.pendingRows.filter((r) => r.profile === active).map((r) => ({ row: r.id, name: r.name, status: "owner-pending", note: r.ownerPending }));
   const manifests = findManifests(root).map((f) => readManifest(f, root));
   resolveWorkspaceInheritance(manifests);
   for (const m of manifests) if (m.error) problems.push(`${m.rel}: ${m.error}`);
   const facts = manifests.flatMap((m) => m.facts);
-  const owners = [...requirements(applicable).values()].map((req) => judge(req, facts));
+  // Pending rows never fail. Their `pendingOwners` are judged like any owner and listed as `candidateOwners` (`enforced: false`)
+  // so the report shows what activation would find; the result is never counted in `violations`.
+  const pending = data.pendingRows.filter((r) => r.profile === active).map((r) => ({
+    row: r.id, name: r.name, status: "owner-pending", note: r.ownerPending,
+    candidateOwners: r.id in declaration.notApplicable ? [] : (r.pendingOwners ?? []).map((o) => {
+      const judged = judge({ ...o, rows: [r.id] }, facts);
+      return { owner: judged.owner, ecosystem: judged.ecosystem, rows: judged.rows, required: judged.required, declared: judged.declared, declarationStatus: judged.status, evidence: judged.evidence, enforced: false };
+    }),
+  }));
+  // Applicability records (PK15-2): validated and reported, never enforced.
+  const applicability = {};
+  for (const [id, spec] of Object.entries(data.applicabilityRecords ?? {})) {
+    const record = validateApplicabilityRecord(id, declaration.records[id], { spec, root });
+    applicability[id] = record;
+    problems.push(...record.problems);
+    const declaredNa = id in declaration.notApplicable;
+    if (record.role === "absent" && !declaredNa) problems.push(`${id}: applicability role is absent but notApplicable.${id} is not declared; the ${id} row still applies until the app declares it not applicable with a reason`);
+    if (record.role && record.role !== "absent" && declaredNa) problems.push(`${id}: notApplicable.${id} is declared but the applicability record says role ${record.role}`);
+  }
+  const owners = [...requirements(applicable).values()].map((req) => { const result = judge(req, facts); return { ...result, declarationStatus: result.status }; });
   // A profile that is unknown, marked unratified, or has no rows checks nothing; an app may not select it, so it fails rather than passing empty.
   const profileStatus = !data.profiles[active] ? "unknown-profile" : (data.profiles[active].ratified === false || !data.rows.some((r) => r.profile === active)) ? "unratified" : null;
   if (profileStatus) {
@@ -226,7 +344,7 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
     owners.push({ owner: `profile:${active}`, ecosystem: "profile", rows: [], required: "ratified profile", status: profileStatus, declared: null, evidence: ["an app may not select a profile that is not ratified"] });
   }
   const violations = owners.filter((o) => o.status !== "ok").length;
-  return { app: name, root, scanned: true, profile: active, manifests: manifests.length, owners, pending, notApplicable, problems, violations };
+  return { app: name, root, scanned: true, profile: active, manifests: manifests.length, owners, pending, applicability, notApplicable, problems, violations };
 }
 
 export function checkApps(roots, options = {}) {
@@ -236,12 +354,14 @@ export function checkApps(roots, options = {}) {
 }
 
 export function renderText(report) {
-  const out = [`ownership-mandatory (${report.mode}) — Table 1 mandatory owner set`];
+  const out = [`ownership-mandatory (${report.mode}) — Table 1 owner declarations (active-target, lock & production qualification unverified)`];
   for (const app of report.apps) {
     const count = (s) => app.owners.filter((o) => o.status === s).length;
     out.push("", `${app.app} [${app.profile}] ${app.scanned ? `ok=${count("ok")} missing=${count("missing")} below-required=${count("below-required")} not-on-registry=${count("not-on-registry")}` : "UNSCANNED"}`
       + (app.pending.length ? ` pending=${app.pending.map((p) => p.row).join(",")}` : "") + (app.notApplicable.length ? ` n/a=${app.notApplicable.map((n) => n.row).join(",")}` : ""));
     for (const o of app.owners.filter((x) => x.status !== "ok")) out.push(`  ${o.status.padEnd(15)} ${o.owner} (${o.rows.join(",")}) requires ${o.required}${o.declared ? `, declared ${o.declared}` : ""}${o.evidence.length ? ` — ${o.evidence.join("; ")}` : ""}`);
+    for (const p of app.pending) for (const c of p.candidateOwners ?? []) if (c.declarationStatus !== "ok") out.push(`  not-enforced    ${p.row} ${c.declarationStatus} ${c.owner} requires ${c.required}${c.declared ? `, declared ${c.declared}` : ""} (owner-pending: report only)`);
+    for (const record of Object.values(app.applicability ?? {})) if (record.status !== "unrecorded") out.push(`  applicability   ${record.row} ${record.status}${record.role ? ` role=${record.role}` : ""} entrypoints=${record.entrypoints.length}${record.unverifiedEntrypoints ? ` (${record.unverifiedEntrypoints} unverified symbol)` : ""}`);
     for (const n of app.notApplicable) out.push(`  n/a             ${n.row}: ${n.reason}`);
     for (const p of app.problems) out.push(`  problem         ${p}`);
   }

package/ownership-repositories.json

@@ -15,7 +15,7 @@
     { "repositoryIdentity": "https://github.com/orthic-labs/legion", "roots": ["."], "visibility": "public" },
     { "repositoryIdentity": "https://github.com/bogusyogi/workright", "roots": ["."], "visibility": "private" },
     { "repositoryIdentity": "https://github.com/orthic-labs/sellright", "roots": ["."], "visibility": "public" },
-    { "repositoryIdentity": "https://github.com/orthic-labs/pulse", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/pulse", "roots": ["."], "visibility": "private" },
     { "repositoryIdentity": "https://github.com/bogusyogi/swiftright", "roots": ["."], "visibility": "private" }
   ]
 }

package/ownership-scope.mjs

@@ -0,0 +1,94 @@
+// Ownership scan scope for a target that builds from only part of its repository (iOS).
+// A scope is a sorted, de-duplicated list of repository-relative directory roots. Only committed files under those roots
+// are inventoried; the exceptions file under `.rightkit` is always read. Sealed ownership evidence records the scope and
+// upload-time verification re-derives it from the config, so the scope cannot be narrowed after the build.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+export const OWNERSHIP_SCOPE_ALWAYS = ".rightkit";
+
+/** Normalize and validate repository-relative scope roots; throws a clear error for absolute, escaping, or missing roots. */
+export function normalizeScopeRoots(roots, { repoRoot, label = "ownershipScope" } = {}) {
+  if (!Array.isArray(roots)) throw new Error(`${label} must be an array of repository-relative directories`);
+  const out = new Set();
+  for (const raw of roots) {
+    if (typeof raw !== "string" || !raw.trim()) throw new Error(`${label} entries must be non-empty strings`);
+    const slashed = raw.replaceAll("\\", "/");
+    if (path.posix.isAbsolute(slashed) || path.win32.isAbsolute(raw) || /^[A-Za-z]:/.test(slashed)) throw new Error(`${label} entry ${raw} must be repository-relative, not absolute`);
+    const normal = path.posix.normalize(slashed).replace(/\/+$/, "");
+    if (normal === ".." || normal.startsWith("../")) throw new Error(`${label} entry ${raw} escapes the repository`);
+    if (normal === "." || normal === "") throw new Error(`${label} entry ${raw} is the whole repository; omit the scope instead`);
+    if (repoRoot) {
+      const absolute = path.join(repoRoot, ...normal.split("/"));
+      let directory = false;
+      try { directory = existsSync(absolute) && statSync(absolute).isDirectory(); } catch { directory = false; }
+      if (!directory) throw new Error(`${label} entry ${raw} is not an existing directory in the repository`);
+    }
+    out.add(normal);
+  }
+  return [...out];
+}
+
+/** Local SwiftPM package directories named by `path:` inside the `packages:` section of an XcodeGen project.yml. */
+export function projectYmlLocalPackagePaths(text) {
+  const lines = String(text).split(/\r?\n/);
+  const paths = [];
+  let inPackages = false;
+  for (const line of lines) {
+    if (/^\s*(#.*)?$/.test(line)) continue;
+    if (/^\S/.test(line)) { inPackages = /^packages:\s*(#.*)?$/.test(line); continue; }
+    if (!inPackages) continue;
+    const match = /(?:^|[\s{,])path:\s*(?:"([^"]*)"|'([^']*)'|([^\s,}#]+))/.exec(line);
+    if (match) paths.push(match[1] ?? match[2] ?? match[3]);
+  }
+  return paths;
+}
+
+/**
+ * Scan scope of an iOS target: the Xcode project directory, each local SwiftPM package its project.yml references,
+ * `.rightkit` (exceptions), the native Rust assembly (`nativeAssembly.workspaceRoot` and the directory of its cargo manifest,
+ * which is compiled into the IPA), and `targets.ios.ownershipScope` additions. Accepts the raw or the expanded target.
+ * The scan itself closes this scope under local path dependencies of the in-scope manifests (see ownership.mjs).
+ * A native assembly rooted at the repository root is ignored (it would make the scope the whole repository).
+ * Returns null when the target has no iosPackage (nothing to scope from).
+ */
+export function iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly }) {
+  const spec = target?.recipe?.kind === "iosPackage" ? target.recipe.spec : target?.iosPackage;
+  if (!spec || typeof spec !== "object") return null;
+  const toRepo = (absolute) => {
+    const relative = path.relative(repoRoot, absolute).split(path.sep).join("/");
+    if (relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) throw new Error(`ios ownership scope: ${absolute} is outside the repository`);
+    return relative || ".";
+  };
+  const specFile = spec.projectSpec ?? spec.project;
+  if (typeof specFile !== "string") throw new Error("ios ownership scope: iosPackage.project or projectSpec is required");
+  const specDir = path.resolve(appRoot, path.posix.dirname(specFile.replaceAll("\\", "/")));
+  const roots = [];
+  const projectDir = toRepo(specDir);
+  if (projectDir === ".") throw new Error("ios ownership scope: the Xcode project sits at the repository root, so there is no narrower scope; declare the project in a subdirectory");
+  roots.push(projectDir);
+  if (spec.projectSpec) {
+    const ymlPath = path.resolve(appRoot, spec.projectSpec);
+    if (existsSync(ymlPath)) {
+      for (const local of projectYmlLocalPackagePaths(readFileSync(ymlPath, "utf8"))) roots.push(toRepo(path.resolve(specDir, local)));
+    }
+  }
+  const native = nativeAssembly && typeof nativeAssembly === "object" ? nativeAssembly : null;
+  const nativeDirs = [native?.workspaceRoot ?? native?.cargoWorkspaceRoot, (native?.cargoManifest ?? native?.manifest) ? path.dirname(native.cargoManifest ?? native.manifest) : undefined].filter((value) => typeof value === "string" && value);
+  for (const dir of nativeDirs) {
+    const nativeRoot = toRepo(path.resolve(appRoot, dir));
+    // A native assembly at the repository root is the app's own (usually desktop) workspace; folding it in would widen the
+    // scope to the whole repository, so it adds nothing. The scan's path-dependency closure still follows the in-scope manifests.
+    if (nativeRoot !== ".") roots.push(nativeRoot);
+  }
+  const extra = target.ownershipScope;
+  if (extra !== undefined) roots.push(...normalizeScopeRoots(extra, { repoRoot, label: "targets.ios.ownershipScope" }));
+  const checked = normalizeScopeRoots(roots.filter((root) => root !== OWNERSHIP_SCOPE_ALWAYS), { repoRoot, label: "ios ownership scope" });
+  return [...new Set([...checked, OWNERSHIP_SCOPE_ALWAYS])].sort();
+}
+
+/** Repository-relative file or directory under any scope root (null scope = everything). */
+export function inOwnershipScope(scope, rel) {
+  if (!scope) return true;
+  return scope.some((root) => rel === root || rel.startsWith(`${root}/`));
+}

package/ownership.mjs

@@ -12,6 +12,7 @@ import { createHash } from "node:crypto";
 import { acquireCommittedSource, committedSourceDataForInternalUse } from "./committed-source.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { gitListedInventory } from "./ownership-git-inventory.mjs";
+import { inOwnershipScope } from "./ownership-scope.mjs";
 import os from "node:os";
 import path from "node:path";
 
@@ -240,14 +241,40 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   return listedCoverage(inventory);
 }
 
-function committedFileInventory(appRoot, trust, pathPrefix, committed) {
+// A scoped scan also reads the workspace/lockfile authorities that sit in an ancestor directory of a scope root
+// (a root Cargo.toml / Cargo.lock / lockfile resolves a member crate's inherited fields and lock graph), so a member
+// of a larger workspace is judged against the same lockfile as in a whole-repository scan.
+function inScopeOrAuthority(scope, rel) {
+  if (inOwnershipScope(scope, rel)) return true;
+  const dir = path.posix.dirname(rel);
+  return ["Cargo.toml", "Cargo.lock", "package.json", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel))
+    && scope.some((root) => dir === "." || root === dir || root.startsWith(`${dir}/`));
+}
+
+// Directories named by local path dependencies of in-scope manifests that are not yet in scope. A target that is not a
+// directory of the committed tree is left to resolveLocalPath, which records a blocking coverage gap for it.
+function localDependencyRoots(deps, scope, entries) {
+  const roots = new Set();
+  for (const dep of deps) {
+    if (!dep.local || typeof dep.source !== "string" || !dep.source.startsWith("path:")) continue;
+    const value = dep.source.slice(5);
+    if (!value || value.startsWith("workspace:") || path.posix.isAbsolute(value) || path.win32.isAbsolute(value) || value.includes("\\")) continue;
+    const relative = path.posix.normalize(path.posix.join(path.posix.dirname(dep.file), value)).replace(/\/$/, "");
+    if (relative === "." || relative === ".." || relative.startsWith("../") || inOwnershipScope(scope, relative)) continue;
+    if (entries.some((entry) => entry.rel.startsWith(`${relative}/`))) roots.add(relative);
+  }
+  return [...roots];
+}
+
+function committedFileInventory(appRoot, trust, pathPrefix, committed, scope = null) {
   const prefix = pathPrefix ? `${pathPrefix.replace(/\/$/, "")}/` : "";
   const repositoryFiles = committed.entries.filter((entry) => entry.type === "blob").map((entry) => ({ rel: entry.rel, size: entry.size, bytes: entry.bytes, mode: entry.mode }));
-  const files = [], coverage = committed.coverage.filter((entry) => !prefix || entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: prefix ? entry.path.slice(prefix.length) : entry.path }));
+  const files = [], coverage = committed.coverage.filter((entry) => (!prefix || entry.path.startsWith(prefix)) && inScopeOrAuthority(scope, entry.path)).map((entry) => ({ ...entry, path: prefix ? entry.path.slice(prefix.length) : entry.path }));
   const protectedPaths = new Set((trust?.provenance ?? []).flatMap((record) => record.paths ?? []));
   const reportedOpaque = new Set(), reportedNodeModules = new Set();
   for (const entry of committed.entries) {
     if (prefix && !entry.rel.startsWith(prefix)) continue;
+    if (!inScopeOrAuthority(scope, entry.rel)) continue;
     const rel = prefix ? entry.rel.slice(prefix.length) : entry.rel;
     if (!rel) continue;
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
@@ -834,14 +861,28 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     keyCheckpoint = resolved.checkpoint;
   }
   const location = { root: committed.repositoryRoot, prefix: pathPrefix, pathBase: "repository" };
-  const inventory = committedFileInventory(appRoot, trust, location.prefix, committed);
-  if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
-    inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
-  }
+  const declaredScope = options.scope ?? null;
   const committedEnrollment = trust?.rootFingerprint
     ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined;
-  const scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
+  // The scope is closed under local path dependencies: a path dependency of an in-scope manifest that lands in an
+  // out-of-scope directory adds that directory to the scope and the scan repeats, so compiled-in code is never skipped.
+  let scope = declaredScope ? [...declaredScope] : null;
+  let inventory, scanned;
+  for (let round = 0; ; round += 1) {
+    inventory = committedFileInventory(appRoot, trust, location.prefix, committed, scope);
+    if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
+      inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
+    }
+    scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
+    if (!scope) break;
+    const added = localDependencyRoots(scanned.deps, scope, committed.entries);
+    if (!added.length) break;
+    if (round >= 64) throw new Error("committed ownership: scan scope did not converge under local path dependencies");
+    scope = [...new Set([...scope, ...added])].sort();
+  }
+  // Provenance and lockfile diagnostics are computed beside the inventory; a scoped scan reports only gaps under its scope.
+  if (scope) scanned.coverage = scanned.coverage.filter((entry) => typeof entry.path !== "string" || entry.path === "." || inScopeOrAuthority(scope, entry.path));
   const exceptionPath = [location.prefix.replace(/\/$/, ""), EXCEPTIONS_FILE.split(path.sep).join("/")].filter(Boolean).join("/");
   const exceptionObject = committed.entries.find((entry) => entry.rel === exceptionPath);
   const exceptionEntry = exceptionObject?.bytes;
@@ -856,6 +897,7 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     scannedAt: new Date().toISOString(), catalogDigest: catalogDigest(manifest), catalogVersion: manifest.version ?? String(manifest.schema ?? "1"),
     scannerVersion: SCANNER_VERSION, contentDigests: scanned.contentDigests, coverage: scanned.coverage,
     pathBase: location.pathBase, pathPrefix: location.prefix, provenance: scanned.provenance, exceptionDigest,
+    ...(scope ? { ownershipScopeClosed: scope } : {}),
     source: "committed-git-tree", ...(keyLogDigest ? { keyLogDigest, keyCheckpoint, rootFingerprint: trust.rootFingerprint, ...(keyAuthorityBinding ? { keyAuthority: keyAuthorityBinding } : {}) } : {}),
   };
   const result = evaluate(scanned.findings, exceptions, { ...options, manifest, trust, trustEnrollment: trust?.rootFingerprint

package/package-recipe-targets.mjs

@@ -9,6 +9,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
+import { IOS_SIGNING_CONTRACT, IosPackageError, validateIosPackageConfig } from "./ios-package-recipe.mjs";
+import { IosUploadError, validateIosDistribution } from "./ios-upload.mjs";
 
 export class PackageRecipeTargetError extends Error {
   constructor(message) { super(message); this.name = "PackageRecipeTargetError"; this.code = "RK_PACKAGE_RECIPE_TARGET"; }
@@ -249,11 +251,49 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   };
 }
 
+const IOS_TARGET_KEYS = new Set(["signed", "signingContract", "iosPackage", "artifacts", "hardening", "hardeningAllowances", "qaControlScan", "publishBlocked", "distribution", "ownershipScope", "cargoManifest", "cargoTarget", "recipe"]);
+
+/**
+ * `targets.ios.iosPackage` (bogusyogi/rightkit#349) is validated strictly and kept as `recipe: { kind: "iosPackage", spec }`.
+ * Unlike macPackage there is no hook to expand into: xcodebuild archive and export run in ios-package-recipe.mjs (macOS only),
+ * which release.mjs calls like the Android lane. The target may carry only the keys in IOS_TARGET_KEYS: a hand-written
+ * prePackage / package / sign / notarize / gradle script, or an App Store Connect credential, is refused.
+ * `artifacts` must list the .ipa so the IPA is checked and sealed. `distribution` (the App Store Connect target of an app that
+ * also ships desktop) is validated here exactly as the upload validates it, so a credential in it fails the build.
+ */
+export function expandIosPackageTarget(target, { appRoot: _appRoot } = {}) {
+  if (!isObject(target) || target.iosPackage === undefined) return withoutRecipe(target);
+  const unknown = Object.keys(target).filter((key) => !IOS_TARGET_KEYS.has(key));
+  if (unknown.length) fail(`targets.ios has unknown key(s): ${unknown.join(", ")} (allowed: ${[...IOS_TARGET_KEYS].filter((key) => key !== "recipe").join(", ")}); the iOS recipe replaces prePackage, package, sign and notarize scripts, and App Store Connect credentials never belong in a target`);
+  if (target.distribution !== undefined) {
+    try { validateIosDistribution(target.distribution); } catch (error) {
+      if (error instanceof IosUploadError) fail(`targets.ios.${error.message.replace(/^\[[A-Z0-9_]+\] /, "")}`);
+      throw error;
+    }
+  }
+  if (target.ownershipScope !== undefined && (!Array.isArray(target.ownershipScope) || target.ownershipScope.some((entry) => typeof entry !== "string" || !entry.trim()))) fail("targets.ios.ownershipScope must be an array of repository-relative directory strings");
+  // The Rust the app links (for the feature-closure scan): an app-relative Cargo.toml and its iPhone triple.
+  if (target.cargoManifest !== undefined && (typeof target.cargoManifest !== "string" || !target.cargoManifest.endsWith("Cargo.toml"))) fail("targets.ios.cargoManifest must be an app-relative path to a Cargo.toml");
+  if (target.cargoTarget !== undefined && !/^aarch64-apple-ios(-sim)?$/.test(target.cargoTarget)) fail("targets.ios.cargoTarget must be aarch64-apple-ios or aarch64-apple-ios-sim");
+  if (target.signed !== true) fail("targets.ios must declare signed: true");
+  if (target.signingContract !== undefined && target.signingContract !== IOS_SIGNING_CONTRACT) fail(`targets.ios.iosPackage signs with Xcode automatic signing; signingContract must be ${IOS_SIGNING_CONTRACT}, got ${target.signingContract}`);
+  let spec;
+  try { spec = validateIosPackageConfig(target.iosPackage); } catch (error) {
+    if (error instanceof IosPackageError) fail(`targets.ios.${error.message}`);
+    throw error;
+  }
+  const declared = (target.artifacts ?? []).map((artifact) => String(typeof artifact === "string" ? artifact : artifact?.file).replaceAll("\\", "/").replace(/^\.\//, ""));
+  if (!declared.includes(spec.ipa)) fail("targets.ios.artifacts must list iosPackage.ipa so the IPA is checked and sealed");
+  const { iosPackage, recipe: _ignored, ...rest } = target;
+  return { ...rest, signingContract: IOS_SIGNING_CONTRACT, recipe: { kind: "iosPackage", spec } };
+}
+
 /** Expand whichever declarative package key the target carries. */
 export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot }) {
   const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}) };
   if (platform === "win") return expandWinPackageTarget(target, { appRoot, config, ...injected });
   if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config, ...injected });
-  if (target?.winPackage || target?.macPackage) fail(`winPackage / macPackage are not valid on ${platform}`);
+  if (platform === "ios") return expandIosPackageTarget(target, { appRoot });
+  if (target?.winPackage || target?.macPackage || target?.iosPackage) fail(`winPackage / macPackage / iosPackage are not valid on ${platform}`);
   return target;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",