@rightkit/release 0.6.0 → 0.6.1

package/cargo-contract.mjs

@@ -71,13 +71,15 @@ export function validateRightKitCargoContract(root, publishedVersions, label = p
 export function assertPublishedRightKitCargoDependencies(dependencies, published, label) {
   let checked = 0;
   for (const dependency of dependencies.filter(({ name }) => name.startsWith("rightkit-"))) {
+    // An app's own path crate with the prefix that RightKit does not publish (e.g. Pulse's rightkit-mesh-ffi) is app code.
+    if (dependency.path && !published.has(dependency.name)) continue;
     checked += 1;
     const configured = published.get(dependency.name);
     if (!configured) throw new Error(`${label} ${dependency.name} is not a published RightKit crate`);
     const allowed = configured instanceof Set ? configured : new Set(Array.isArray(configured) ? configured : [configured]);
     const exactVersions = new Set([...allowed].map((version) => `=${version}`));
     if (!CRATES_IO_SOURCES.has(dependency.source) || dependency.path || dependency.registry || !exactVersions.has(dependency.req)) {
-      throw new Error(`${label} ${dependency.name} must use exact crates.io versions (${[...exactVersions].join(" or ")})`);
+      throw new Error(`${label} ${dependency.name} must use exact crates.io versions (${[...exactVersions].join(" or ")})${dependency.req && !exactVersions.has(dependency.req) && /^=\d/.test(dependency.req) ? `; ${dependency.req} is not among them: the accepted versions are the bundled feed plus the versions your Cargo.lock proves against crates.io, so if you just bumped the pin, refresh Cargo.lock so it locks ${dependency.req.slice(1)}` : ""}`);
     }
   }
   return checked;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-registry-resolver.mjs

@@ -153,7 +153,13 @@ export function collectLockedRightKit(root, owned, { extraLocks = [] } = {}) {
   const entries = [];
   for (const file of lockFiles) {
     const all = path.basename(file) === "Cargo.lock" ? cargoLockEntries(file) : pnpmLockEntries(file);
-    for (const entry of all) if (owned[entry.ecosystem].has(entry.name) || prefixed(entry.ecosystem, entry.name)) entries.push(entry);
+    for (const entry of all) {
+      if (owned[entry.ecosystem].has(entry.name)) { entries.push(entry); continue; }
+      // An app's own path/workspace crate or package that happens to carry the prefix (no registry source, e.g. Pulse's
+      // rightkit-mesh-ffi) is app-local code, not a RightKit pin. A prefixed name that DOES resolve from a registry and is not
+      // owned stays a refusal (it could be a squatted or foreign package).
+      if (prefixed(entry.ecosystem, entry.name) && entry.source !== null) entries.push(entry);
+    }
   }
   return { lockFiles, entries };
 }
@@ -174,7 +180,10 @@ function manifestRoots(root, extraLocks) {
 /** RightKit dependencies the manifests under root declare (Cargo.toml, package.json): the inputs that need lock proof. */
 export function declaredRightKitDependencies(root, owned, extraLocks = []) {
   const found = [];
-  const take = (ecosystem, name, file) => { if (owned[ecosystem].has(name) || prefixed(ecosystem, name)) found.push({ ecosystem, name, file }); };
+  const take = (ecosystem, name, file, local = false) => {
+    if (owned[ecosystem].has(name)) found.push({ ecosystem, name, file });
+    else if (prefixed(ecosystem, name) && !local) found.push({ ecosystem, name, file });
+  };
   for (const file of manifestRoots(root, extraLocks).flatMap((dir) => scanFiles(dir, new Set(["Cargo.toml", "package.json"])))) {
     try {
       if (path.basename(file) === "package.json") {
@@ -184,7 +193,8 @@ export function declaredRightKitDependencies(root, owned, extraLocks = []) {
       } else {
         const doc = parseToml(readFileSync(file, "utf8"));
         const tables = [...MANIFEST_DEP_TABLES.map((t) => doc[t]), doc.workspace?.dependencies, ...Object.values(doc.target ?? {}).flatMap((target) => MANIFEST_DEP_TABLES.map((t) => target?.[t]))];
-        for (const table of tables) for (const [key, spec] of Object.entries(table ?? {})) take("cargo", typeof spec === "object" && spec && typeof spec.package === "string" ? spec.package : key, file);
+        // A path or workspace dependency on an unowned prefixed name is app-local (see collectLockedRightKit).
+        for (const table of tables) for (const [key, spec] of Object.entries(table ?? {})) take("cargo", typeof spec === "object" && spec && typeof spec.package === "string" ? spec.package : key, file, typeof spec === "object" && spec !== null && (typeof spec.path === "string" || spec.workspace === true));
       }
     } catch { /* an unreadable manifest is the manifest validators' finding */ }
   }

package/rightkit-versions.json

@@ -32,7 +32,7 @@
     "@rightkit/qa": "0.6.1",
     "@rightkit/qa-chrome": "0.1.11",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.0",
+    "@rightkit/release": "0.6.1",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.2",
@@ -225,7 +225,8 @@
       "0.4.0",
       "0.4.1",
       "0.5.0",
-      "0.5.1"
+      "0.5.1",
+      "0.6.0"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -473,7 +474,7 @@
     "rightkit-onnx": "0.2.7",
     "rightkit-overlay": "0.2.0",
     "rightkit-overlay-win": "0.1.0",
-    "rightkit-ownership": "0.4.0",
+    "rightkit-ownership": "0.4.1",
     "rightkit-pdf": "0.3.3",
     "rightkit-platform-rules": "0.1.0",
     "rightkit-playback": "0.3.0",
@@ -488,7 +489,7 @@
     "rightkit-speech-client": "0.4.0",
     "rightkit-spend": "0.2.0",
     "rightkit-sync": "0.2.2",
-    "rightkit-tauri-shell": "0.5.0",
+    "rightkit-tauri-shell": "0.5.1",
     "rightkit-time": "0.1.0",
     "rightkit-transcript": "0.4.0",
     "rightkit-tts": "0.2.3",
@@ -521,7 +522,7 @@
       "rightkit-asr": "0.3.0",
       "rightkit-audio": "0.3.1",
       "rightkit-automation": "0.6.0",
-      "rightkit-browser": "0.3.4",
+      "rightkit-browser": "0.3.5",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
       "rightkit-child-process": "0.5.5",
@@ -561,7 +562,7 @@
       "rightkit-ort": "0.2.3",
       "rightkit-overlay": "0.2.0",
       "rightkit-overlay-win": "0.1.0",
-      "rightkit-ownership": "0.4.0",
+      "rightkit-ownership": "0.4.1",
       "rightkit-pdf": "0.3.3",
       "rightkit-platform-rules": "0.1.0",
       "rightkit-playback": "0.3.0",
@@ -585,7 +586,7 @@
       "rightkit-spend": "0.2.0",
       "rightkit-sync": "0.2.2",
       "rightkit-tauri": "0.1.3",
-      "rightkit-tauri-shell": "0.5.0",
+      "rightkit-tauri-shell": "0.5.1",
       "rightkit-time": "0.1.0",
       "rightkit-transcript": "0.4.0",
       "rightkit-tts": "0.2.3",
@@ -619,7 +620,7 @@
       "@rightkit/qa": "0.6.1",
       "@rightkit/qa-chrome": "0.1.11",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.5.1",
+      "@rightkit/release": "0.6.0",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
@@ -632,7 +633,8 @@
     "rightkit-ownership": [
       "0.2.0",
       "0.2.1",
-      "0.3.1"
+      "0.3.1",
+      "0.4.0"
     ],
     "rightkit-browser": [
       "0.2.0",
@@ -1057,7 +1059,8 @@
       "0.3.0",
       "0.3.2",
       "0.3.3",
-      "0.4.0"
+      "0.4.0",
+      "0.5.0"
     ],
     "rightkit-android": [
       "0.2.0"