@rightkit/release 0.4.1 → 0.5.0

package/rightkit-versions.json

@@ -19,6 +19,7 @@
     "@rightkit/doc-render": "0.2.1",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.2.0",
+    "@rightkit/issues-tracker": "0.1.0",
     "@rightkit/legal": "0.6.1",
     "@rightkit/legal-ui": "0.4.1",
     "@rightkit/license": "0.3.0",
@@ -31,7 +32,7 @@
     "@rightkit/qa": "0.5.2",
     "@rightkit/qa-chrome": "0.1.10",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.4.1",
+    "@rightkit/release": "0.5.0",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.2",
@@ -220,7 +221,8 @@
       "0.2.173",
       "0.2.174",
       "0.3.0",
-      "0.4.0"
+      "0.4.0",
+      "0.4.1"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -424,49 +426,50 @@
     "rightkit-tauri": "0.1.0"
   },
   "stagedCargo": {
-    "rightkit-agent-tools": "0.2.1",
+    "rightkit-agent-tools": "0.3.0",
     "rightkit-agents": "0.2.0",
     "rightkit-android": "0.3.0",
     "rightkit-app-settings": "0.3.0",
     "rightkit-asr": "0.3.0",
     "rightkit-audio": "0.3.1",
-    "rightkit-automation": "0.5.0",
+    "rightkit-automation": "0.6.0",
     "rightkit-browser": "0.3.5",
     "rightkit-cache": "0.2.3",
     "rightkit-channel-memory": "0.2.1",
-    "rightkit-child-process": "0.5.4",
+    "rightkit-child-process": "0.5.5",
     "rightkit-compose": "0.2.0",
     "rightkit-contracts": "0.1.7",
-    "rightkit-crash": "0.3.4",
-    "rightkit-credentials": "0.3.1",
+    "rightkit-crash": "0.3.6",
+    "rightkit-credentials": "0.4.2",
     "rightkit-crypto": "0.1.0",
-    "rightkit-daemon": "0.3.1",
-    "rightkit-db": "0.5.0",
-    "rightkit-device": "0.3.1",
-    "rightkit-docs": "0.1.1",
-    "rightkit-embed": "0.6.0",
+    "rightkit-daemon": "0.4.0",
+    "rightkit-db": "0.5.1",
+    "rightkit-device": "0.4.0",
+    "rightkit-docs": "0.1.2",
+    "rightkit-embed": "0.6.1",
     "rightkit-ffmpeg": "0.2.10",
     "rightkit-file-watch": "0.4.1",
     "rightkit-fs": "0.4.6",
-    "rightkit-fsindex": "0.4.1",
+    "rightkit-fsindex": "0.5.0",
     "rightkit-google-identity": "0.2.0",
     "rightkit-hooks": "0.2.0",
     "rightkit-hotkeys": "0.1.2",
     "rightkit-http": "0.3.8",
     "rightkit-identity": "0.1.0",
-    "rightkit-job-queue": "0.4.1",
+    "rightkit-job-queue": "0.5.0",
     "rightkit-license": "0.2.4",
     "rightkit-llm": "0.3.0",
     "rightkit-logs": "0.3.5",
     "rightkit-mcp": "0.7.0",
-    "rightkit-models": "0.5.0",
+    "rightkit-models": "0.5.1",
     "rightkit-motion": "0.2.0",
-    "rightkit-oauth": "0.9.0",
+    "rightkit-oauth": "0.10.0",
     "rightkit-ocr": "0.2.3",
     "rightkit-onnx": "0.2.7",
-    "rightkit-overlay": "0.1.2",
-    "rightkit-ownership": "0.3.1",
-    "rightkit-pdf": "0.3.2",
+    "rightkit-overlay": "0.2.0",
+    "rightkit-overlay-win": "0.1.0",
+    "rightkit-ownership": "0.4.0",
+    "rightkit-pdf": "0.3.3",
     "rightkit-platform-rules": "0.1.0",
     "rightkit-playback": "0.3.0",
     "rightkit-qa": "0.7.1",
@@ -506,63 +509,64 @@
   },
   "registry": {
     "cargo": {
-      "rightkit-agent-tools": "0.2.0",
+      "rightkit-agent-tools": "0.3.0",
       "rightkit-agents": "0.2.0",
-      "rightkit-android": "0.2.0",
+      "rightkit-android": "0.3.0",
       "rightkit-app-settings": "0.3.0",
-      "rightkit-asr": "0.2.4",
+      "rightkit-asr": "0.3.0",
       "rightkit-audio": "0.3.1",
-      "rightkit-automation": "0.5.0",
+      "rightkit-automation": "0.6.0",
       "rightkit-browser": "0.3.4",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
-      "rightkit-child-process": "0.5.4",
+      "rightkit-child-process": "0.5.5",
       "rightkit-compose": "0.2.0",
       "rightkit-contracts": "0.1.7",
       "rightkit-control": "0.3.0",
-      "rightkit-crash": "0.3.4",
-      "rightkit-credentials": "0.3.0",
+      "rightkit-crash": "0.3.6",
+      "rightkit-credentials": "0.4.2",
       "rightkit-crypto": "0.1.0",
-      "rightkit-daemon": "0.3.0",
+      "rightkit-daemon": "0.4.0",
       "rightkit-db": "0.5.1",
-      "rightkit-device": "0.3.1",
-      "rightkit-docs": "0.1.1",
-      "rightkit-embed": "0.6.0",
-      "rightkit-ffmpeg": "0.2.9",
+      "rightkit-device": "0.4.0",
+      "rightkit-docs": "0.1.2",
+      "rightkit-embed": "0.6.1",
+      "rightkit-ffmpeg": "0.2.10",
       "rightkit-file-watch": "0.4.1",
       "rightkit-framed-sidecar": "0.2.0",
       "rightkit-fs": "0.4.6",
-      "rightkit-fsindex": "0.4.1",
-      "rightkit-google-identity": "0.1.0",
+      "rightkit-fsindex": "0.5.0",
+      "rightkit-google-identity": "0.2.0",
       "rightkit-hooks": "0.2.0",
       "rightkit-hotkeys": "0.1.2",
       "rightkit-http": "0.3.8",
       "rightkit-identity": "0.1.0",
-      "rightkit-job-queue": "0.4.0",
+      "rightkit-job-queue": "0.5.0",
       "rightkit-jobs": "0.3.0",
-      "rightkit-license": "0.2.3",
+      "rightkit-license": "0.2.4",
       "rightkit-llm": "0.3.0",
       "rightkit-logs": "0.3.5",
       "rightkit-mcp": "0.7.0",
       "rightkit-media": "0.2.6",
-      "rightkit-models": "0.4.4",
-      "rightkit-motion": "0.1.0",
-      "rightkit-oauth": "0.9.0",
+      "rightkit-models": "0.5.1",
+      "rightkit-motion": "0.2.0",
+      "rightkit-oauth": "0.10.0",
       "rightkit-ocr": "0.2.3",
-      "rightkit-onnx": "0.2.6",
+      "rightkit-onnx": "0.2.7",
       "rightkit-ort": "0.2.3",
-      "rightkit-overlay": "0.1.2",
-      "rightkit-ownership": "0.3.1",
-      "rightkit-pdf": "0.3.2",
+      "rightkit-overlay": "0.2.0",
+      "rightkit-overlay-win": "0.1.0",
+      "rightkit-ownership": "0.4.0",
+      "rightkit-pdf": "0.3.3",
       "rightkit-platform-rules": "0.1.0",
-      "rightkit-playback": "0.2.2",
+      "rightkit-playback": "0.3.0",
       "rightkit-process": "0.4.0",
       "rightkit-qa": "0.7.1",
       "rightkit-qa-driver": "0.6.0",
       "rightkit-qts": "0.2.6",
       "rightkit-qts-ggml": "0.1.2",
       "rightkit-qts-ggml-sys": "0.1.2",
-      "rightkit-record": "0.3.2",
+      "rightkit-record": "0.3.3",
       "rightkit-review": "0.4.0",
       "rightkit-sandbox": "0.5.0",
       "rightkit-search": "0.4.0",
@@ -572,8 +576,8 @@
       "rightkit-settings": "0.2.0",
       "rightkit-shell": "0.3.0",
       "rightkit-sidecar": "0.3.0",
-      "rightkit-speech-client": "0.3.6",
-      "rightkit-spend": "0.1.1",
+      "rightkit-speech-client": "0.4.0",
+      "rightkit-spend": "0.2.0",
       "rightkit-sync": "0.2.2",
       "rightkit-tauri": "0.1.3",
       "rightkit-tauri-shell": "0.4.0",
@@ -584,13 +588,13 @@
       "rightkit-tts-qwen-sys": "0.1.2",
       "rightkit-typeset": "0.1.0",
       "rightkit-vad": "0.1.2",
-      "rightkit-vault": "0.1.0",
+      "rightkit-vault": "0.2.0",
       "rightkit-watch": "0.4.0",
       "rightkit-workflow": "0.2.0"
     },
     "npm": {
       "@rightkit/app-shell": "0.6.2",
-      "@rightkit/app-update": "0.4.0",
+      "@rightkit/app-update": "0.4.1",
       "@rightkit/ax": "0.3.2",
       "@rightkit/ci": "0.3.0",
       "@rightkit/doc-render": "0.2.1",
@@ -600,7 +604,7 @@
       "@rightkit/legal": "0.6.1",
       "@rightkit/legal-ui": "0.4.1",
       "@rightkit/license": "0.3.0",
-      "@rightkit/logs": "0.1.5",
+      "@rightkit/logs": "0.1.6",
       "@rightkit/media-ui": "0.3.4",
       "@rightkit/onboarding": "0.6.3",
       "@rightkit/outdated": "0.2.0",
@@ -609,8 +613,8 @@
       "@rightkit/qa": "0.5.2",
       "@rightkit/qa-chrome": "0.1.10",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.4.0",
-      "@rightkit/settings-ui": "0.6.1",
+      "@rightkit/release": "0.4.1",
+      "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
       "@rightkit/tauri-shell": "0.1.2",
@@ -621,7 +625,8 @@
   "legacyCargo": {
     "rightkit-ownership": [
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.3.1"
     ],
     "rightkit-browser": [
       "0.2.0",
@@ -666,7 +671,8 @@
       "0.3.1",
       "0.3.2",
       "0.4.0",
-      "0.5.0"
+      "0.5.0",
+      "0.6.0"
     ],
     "rightkit-jobs": [
       "0.2.1",
@@ -829,7 +835,8 @@
     ],
     "rightkit-pdf": [
       "0.1.0",
-      "0.3.0"
+      "0.3.0",
+      "0.3.2"
     ],
     "rightkit-speech-client": [
       "0.3.0",
@@ -845,7 +852,9 @@
       "0.2.2",
       "0.3.0",
       "0.3.2",
-      "0.3.3"
+      "0.3.3",
+      "0.3.4",
+      "0.3.5"
     ],
     "rightkit-qts-ggml-sys": [
       "0.1.0",
@@ -855,7 +864,8 @@
       "0.1.0",
       "0.2.0",
       "0.2.1",
-      "0.3.0"
+      "0.3.0",
+      "0.4.1"
     ],
     "rightkit-asr": [
       "0.0.2",
@@ -941,7 +951,8 @@
       "0.5.0",
       "0.5.1",
       "0.5.2",
-      "0.5.3"
+      "0.5.3",
+      "0.5.4"
     ],
     "rightkit-hotkeys": [
       "0.1.0",
@@ -965,7 +976,8 @@
       "0.2.1"
     ],
     "rightkit-overlay": [
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "rightkit-app-settings": [
       "0.2.0",
@@ -984,7 +996,9 @@
     "rightkit-credentials": [
       "0.2.0",
       "0.2.1",
-      "0.3.0"
+      "0.3.0",
+      "0.4.0",
+      "0.4.1"
     ],
     "rightkit-review": [
       "0.2.0"
@@ -995,7 +1009,8 @@
     "rightkit-device": [
       "0.1.3",
       "0.2.0",
-      "0.3.0"
+      "0.3.0",
+      "0.3.1"
     ],
     "rightkit-onnx": [
       "0.2.3",
@@ -1010,7 +1025,8 @@
       "0.2.0"
     ],
     "rightkit-docs": [
-      "0.1.0"
+      "0.1.0",
+      "0.1.1"
     ],
     "rightkit-tts-qwen": [
       "0.2.6"

package/runtime-budget-classes.json

@@ -21,6 +21,10 @@
       "ceilings": null,
       "requiredScale": null
     },
+    "rightkit-crash": {
+      "ceilings": null,
+      "requiredScale": null
+    },
     "rightkit-embed": {
       "ceilings": null,
       "requiredScale": null
@@ -41,6 +45,10 @@
       "ceilings": null,
       "requiredScale": null
     },
+    "rightkit-overlay-win": {
+      "ceilings": null,
+      "requiredScale": null
+    },
     "rightkit-record": {
       "ceilings": null,
       "requiredScale": null

package/scan-digest.mjs

@@ -0,0 +1,107 @@
+// Canonical JSON and the scan-set digest, shared by the scanner (deterministic-scans.mjs) and the credentialed
+// receipt verifiers (scripts/ci/scan-receipt.mjs). No imports beyond node:crypto, by design.
+import crypto from "node:crypto";
+
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+
+/** Deterministic JSON: object keys sorted, no undefined, no non-finite numbers. */
+export function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("canonicalJson: non-finite number");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    for (const key of keys) if (value[key] === undefined) throw new TypeError(`canonicalJson: undefined at ${key}`);
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: unsupported ${typeof value}`);
+}
+
+/** Digest of a scan set: the sorted (id, class, command) of every entry. Plan items and result rows agree. */
+export function digestScanSet(entries) {
+  const rows = entries.map((e) => [String(e.id), String(e.class), String(e.command)]).sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+  return sha256(canonicalJson(rows));
+}
+
+// ---- required scan ids ---------------------------------------------------------------------------------
+// The one place the scan ids that belong to a crate are spelled, shared by planScans (deterministic-scans.mjs) and by the
+// credentialed verifiers (scripts/ci/scan-receipt.mjs), so a verifier recomputes what a receipt must contain from the
+// authenticated source and never trusts the plan the producer recorded. Dependency-free by design (see the header).
+
+export const rustScanId = Object.freeze({
+  check: (name) => `check:${name}`,
+  checkFeatures: (name, index) => `check-features:${name}:${index}`,
+  clippy: (name, count, index) => (count === 1 ? `clippy:${name}` : `clippy:${name}:${index}`),
+  doc: (name) => `doc:${name}`,
+  testRust: (name, count, index) => `test:rust:${name}${count === 1 ? "" : `:${index}`}`,
+  testRustSerial: (name, count, index) => `test:rust-serial:${name}${count === 1 ? "" : `:${index}`}`,
+  packageList: (name) => `cargo-package-list:${name}`,
+  changelog: (name) => `changelog-version:${name}`,
+});
+
+/**
+ * A crate's compile feature plan exactly as CI's gate runs it (ci/gate.config.json rust.<crate>): `lintSets` (clippy; default
+ * features when none), whether a default `check` is needed (no lint set covers default features), and the `checkSets` that
+ * remain (none when a lint set already uses --all-features).
+ */
+export function rustCratePlan(own = {}) {
+  const lintSets = Array.isArray(own?.featureSets) && own.featureSets.length ? own.featureSets : [[]];
+  const defaultCheck = !lintSets.some((set) => set.length === 0);
+  const checkSets = (lintSets.some((set) => set.includes("--all-features")) ? [] : (Array.isArray(own?.checkFeatureSets) ? own.checkFeatureSets : [["--all-features"]])).filter((set) => set.length);
+  return { lintSets, defaultCheck, checkSets };
+}
+
+/** Scan ids every scan of the whole repository always has when it holds Rust units (cargo.toml, workflows, YAML, JSON and licences). */
+export const WORKSPACE_SCAN_IDS = Object.freeze(["cargo-metadata", "cargo-deny", "cargo-audit", "actionlint", "yaml-parse", "toml-parse", "json-parse", "license", "secret-scan"]);
+/** Prefixes at least one scan id must carry (rustfmt groups by edition, so its exact ids depend on the files). */
+export const REQUIRED_SCAN_PREFIXES = Object.freeze(["rustfmt:"]);
+
+/**
+ * The scan ids a LOCAL scan record must contain, each with status pass, for these publishable Rust `units` ([names], crates/<name>).
+ * `exists(repoPath)` answers from the AUTHENTICATED source (never from the record): src/lib.rs decides `doc`, CHANGELOG.md decides
+ * `changelog-version`, and the repository's own ci/advisory-exceptions.json, ownership catalog and docs generator decide theirs.
+ * `crateFeatures` is ci/gate.config.json `rust`. `includeTests` adds the per-feature-set test scans. Extra scans in a record are
+ * allowed; a missing one is not. planScans builds its ids from the same helpers, and a test holds the two in agreement.
+ */
+export function requiredScanIds({ units, crateFeatures = {}, exists, includeTests = false }) {
+  if (!Array.isArray(units) || units.length === 0 || !units.every((n) => typeof n === "string" && n)) throw new TypeError("requiredScanIds: units must be a non-empty array of names");
+  if (typeof exists !== "function") throw new TypeError("requiredScanIds: exists(repoPath) is required");
+  const ids = new Set(WORKSPACE_SCAN_IDS);
+  if (exists("ci/advisory-exceptions.json")) ids.add("advisory-exceptions");
+  if (exists("packages/release/rightkit-ownership.json") && exists("crates/rightkit-ownership/catalog/ownership-catalog.json")) ids.add("ownership-catalog");
+  if (exists("scripts/generate-index.mjs")) ids.add("generated-docs");
+  for (const name of units) {
+    const own = crateFeatures?.[name] ?? {};
+    const { lintSets, defaultCheck, checkSets } = rustCratePlan(own);
+    ids.add(rustScanId.packageList(name));
+    if (exists(`crates/${name}/CHANGELOG.md`)) ids.add(rustScanId.changelog(name));
+    if (defaultCheck) ids.add(rustScanId.check(name));
+    checkSets.forEach((_set, i) => ids.add(rustScanId.checkFeatures(name, i)));
+    lintSets.forEach((_set, i) => ids.add(rustScanId.clippy(name, lintSets.length, i)));
+    if (exists(`crates/${name}/src/lib.rs`)) ids.add(rustScanId.doc(name));
+    if (includeTests) {
+      lintSets.forEach((_set, i) => {
+        ids.add(rustScanId.testRust(name, lintSets.length, i));
+        if (own.alsoSerial) ids.add(rustScanId.testRustSerial(name, lintSets.length, i));
+      });
+    }
+  }
+  return [...ids].sort();
+}
+
+/** Why `rows` (a record's scans) do not contain every required id with status pass; empty when they do. */
+export function requiredScanProblems(rows, required, prefixes = REQUIRED_SCAN_PREFIXES) {
+  const byId = new Map();
+  for (const row of Array.isArray(rows) ? rows : []) if (row && typeof row.id === "string") byId.set(row.id, row);
+  const problems = [];
+  for (const id of required) {
+    const row = byId.get(id);
+    if (!row) problems.push(`required scan ${id} is missing`);
+    else if (row.status !== "pass") problems.push(`required scan ${id} is ${row.status}`);
+  }
+  for (const prefix of prefixes) if (![...byId.values()].some((row) => row.id.startsWith(prefix) && row.status === "pass")) problems.push(`no passing ${prefix}* scan`);
+  return problems;
+}