@rightkit/release 0.6.2 → 0.6.3

package/build-release.mjs

@@ -18,7 +18,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
-import { iosOwnershipScope } from "./ownership-scope.mjs";
+import { preflightOwnershipScope } from "./ownership-scope.mjs";
 import { spawn, spawnSync } from "./background-process.mjs";
 import { RightKitRegistryError, SNAPSHOT_ENV, SNAPSHOT_FILE, assertManifestRegistryEvidence, loadAdmittedSnapshot, prepareRightKitResolution, registryManifestFields, rightKitLockInventory, writeAdmissionRecord } from "./rightkit-registry-resolver.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -84,7 +84,7 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     version = undefined;
   }
   // An iOS target is built from its Xcode project and local packages only; the ownership scan covers just those roots.
-  const ownershipScope = platform === "ios" ? iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly: config?.nativeAssembly }) : null;
+  const ownershipScope = preflightOwnershipScope({ repoRoot, appRoot, platform, target, nativeAssembly: config?.nativeAssembly });
   return collectPreflight({
     platform,
     ownershipScope,

package/ownership-scope.mjs

@@ -87,6 +87,15 @@ export function iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly })
   return [...new Set([...checked, OWNERSHIP_SCOPE_ALWAYS])].sort();
 }
 
+/**
+ * The one place the doctor (`releasePreflight`) and the build (`buildPreflight`) assemble the ownership scan scope, so the
+ * two can never disagree about what ships (rightkit#927). iOS builds from its Xcode project and local packages only; every
+ * other platform scans the whole repository (null).
+ */
+export function preflightOwnershipScope({ repoRoot, appRoot, platform, target, nativeAssembly }) {
+  return platform === "ios" ? iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly }) : null;
+}
+
 /** Repository-relative file or directory under any scope root (null scope = everything). */
 export function inOwnershipScope(scope, rel) {
   if (!scope) return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/preflight.mjs

@@ -193,6 +193,7 @@ export function collectPreflight({
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
   ownershipScope = null,
+  ownershipScopeError = null,
   runtimeBudgetAdoption = appRuntimeBudgetAdoptionCheck,
   freeDisk = freeDiskGb,
   projectType,
@@ -333,7 +334,10 @@ export function collectPreflight({
     if (adoption) checks.push(adoption);
   }
 
-  if (repoRoot && ownership) {
+  if (repoRoot && ownership && ownershipScopeError) {
+    // The target's scan scope could not be determined (the build refuses the same config): fail closed, never scan wider.
+    checks.push(fail("ownership", `ownership scope refused: ${ownershipScopeError}`, "fix the target's ownership scope configuration; the build refuses it too"));
+  } else if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
     const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
     checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory }));

package/release.mjs

@@ -50,7 +50,7 @@ import { assertReleaseDependencies } from "./release-dependencies.mjs";
 import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
 import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 import { assertNoReleaseSwitches, commandTokens, localCrateDirsFromTree, resolveFeatureClosure, shippedRustTriples } from "./release-switch-scan.mjs";
-import { iosOwnershipScope } from "./ownership-scope.mjs";
+import { iosOwnershipScope, preflightOwnershipScope } from "./ownership-scope.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { runAndroidRelease, validateAndroidTarget } from "./android-release.mjs";
 import { runIosPackageRecipe } from "./ios-package-recipe.mjs";
@@ -348,8 +348,19 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
     ...pinnedCargoLocks,
     ...(config.cargoLocks ?? []).map((entry) => path.resolve(root, entry)),
   ].filter((entry, index, entries) => entries.indexOf(entry) === index);
+  // Same scope the build uses (rightkit#927): an iOS target is checked over its Xcode project and local packages only.
+  // The doctor reports a refused scope as an ownership FAIL (never a crash, never a whole-repo scan); the build still throws.
+  let ownershipScope = null;
+  let ownershipScopeError = null;
+  try {
+    ownershipScope = preflightOwnershipScope({ repoRoot, appRoot: root, platform, target: projectTarget, nativeAssembly: config.nativeAssembly });
+  } catch (error) {
+    ownershipScopeError = error instanceof Error ? error.message : String(error);
+  }
   return collectPreflight({
     platform,
+    ownershipScope,
+    ownershipScopeError,
     appRoot: root,
     repoRoot,
     app: config.app,

package/rightkit-versions.json

@@ -32,7 +32,7 @@
     "@rightkit/qa": "0.6.1",
     "@rightkit/qa-chrome": "0.1.11",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.2",
+    "@rightkit/release": "0.6.3",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.2",
@@ -228,7 +228,8 @@
       "0.5.0",
       "0.5.1",
       "0.6.0",
-      "0.6.1"
+      "0.6.1",
+      "0.6.2"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -441,7 +442,7 @@
     "rightkit-asr": "0.3.0",
     "rightkit-audio": "0.3.1",
     "rightkit-automation": "0.6.0",
-    "rightkit-browser": "0.3.5",
+    "rightkit-browser": "0.3.6",
     "rightkit-cache": "0.2.3",
     "rightkit-channel-memory": "0.2.1",
     "rightkit-child-process": "0.5.5",
@@ -451,7 +452,7 @@
     "rightkit-credentials": "0.4.2",
     "rightkit-crypto": "0.1.0",
     "rightkit-daemon": "0.4.0",
-    "rightkit-db": "0.5.1",
+    "rightkit-db": "0.5.2",
     "rightkit-device": "0.4.0",
     "rightkit-docs": "0.1.2",
     "rightkit-embed": "0.6.1",
@@ -524,7 +525,7 @@
       "rightkit-asr": "0.3.0",
       "rightkit-audio": "0.3.1",
       "rightkit-automation": "0.6.0",
-      "rightkit-browser": "0.3.5",
+      "rightkit-browser": "0.3.6",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
       "rightkit-child-process": "0.5.5",
@@ -535,7 +536,7 @@
       "rightkit-credentials": "0.4.2",
       "rightkit-crypto": "0.1.0",
       "rightkit-daemon": "0.4.0",
-      "rightkit-db": "0.5.1",
+      "rightkit-db": "0.5.2",
       "rightkit-device": "0.4.0",
       "rightkit-docs": "0.1.2",
       "rightkit-embed": "0.6.1",
@@ -622,7 +623,7 @@
       "@rightkit/qa": "0.6.1",
       "@rightkit/qa-chrome": "0.1.11",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.6.1",
+      "@rightkit/release": "0.6.2",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
@@ -644,7 +645,8 @@
       "0.2.2",
       "0.3.0",
       "0.3.1",
-      "0.3.4"
+      "0.3.4",
+      "0.3.5"
     ],
     "rightkit-models": [
       "0.2.1",
@@ -672,7 +674,8 @@
       "0.3.0",
       "0.3.1",
       "0.4.0",
-      "0.4.3"
+      "0.4.3",
+      "0.5.1"
     ],
     "rightkit-embed": [
       "0.2.1",