@rightkit/release 0.6.5 → 0.6.6

package/binary-license-notices.mjs

@@ -18,6 +18,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { escapeHtml } from "./npm-license-notices.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
@@ -123,7 +124,7 @@ export function generateBinaryNotices({ appRoot, config, flags = {}, check = fal
 }
 
 export function parseBinaryNoticeArgs(argv) {
-  const opts = { config: "right-release.config.mjs", output: undefined, productName: undefined, receipt: undefined, check: false };
+  const opts = { config: defaultReleaseConfigFile(), output: undefined, productName: undefined, receipt: undefined, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--output" || arg === "--product-name" || arg === "--receipt") {

package/build-release.mjs

@@ -23,7 +23,8 @@ import { spawn, spawnSync } from "./background-process.mjs";
 import { RightKitRegistryError, SNAPSHOT_ENV, SNAPSHOT_FILE, assertManifestRegistryEvidence, loadAdmittedSnapshot, prepareRightKitResolution, registryManifestFields, rightKitLockInventory, writeAdmissionRecord, writeSnapshot } from "./rightkit-registry-resolver.mjs";
 import { formatAdmission, formatNotRun, runAdmission } from "./admission.mjs";
 import { sccacheRefusal } from "./admission-host.mjs";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
+import { fileURLToPath } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { admitSourceQa } from "./release-qa-audit.mjs";
@@ -111,7 +112,7 @@ const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
 const RELEASE_TOOL_VERSION = JSON.parse(readFileSync(path.join(TOOL_ROOT, "package.json"), "utf8")).version;
 const args = process.argv.slice(2);
-let configName = "right-release.config.mjs";
+let configName = defaultReleaseConfigFile();
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let dryRun = false;
 let skipChecks = false;
@@ -195,7 +196,7 @@ try {
   const shortCommit = commit.slice(0, 8);
   const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
   if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
-  const config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default;
+  const config = await importReleaseConfig(configPath, { query: `commit=${commit}` });
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
     fail("app and version must be safe release-id components");
@@ -566,7 +567,7 @@ async function admit() {
     commit = git(invocationRoot, ["rev-parse", "HEAD"]);
     const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
     if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
-    try { config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default; } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
+    try { config = await importReleaseConfig(configPath, { query: `commit=${commit}` }); } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
   } catch (error) {
     if (error?.reported) process.exit(1);
     throw error;
@@ -630,7 +631,7 @@ function sqlCipherFeatures(text) {
 }
 
 function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields }) {
-  // Every app's right-release.config.mjs names installer/updater artifacts
+  // Every app's release config names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
   // targetBridge.ensure() deliberately leaves a real local directory alone,
@@ -1053,7 +1054,7 @@ function writeJson(file, value) {
 }
 
 function usage(code) {
-  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.mjs] [--dry-run]");
+  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.json] [--dry-run]");
   process.exit(code);
 }
 

package/cache-command.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import {
   applyCachePrune,
   inspectCache,
@@ -12,6 +12,7 @@ import {
   resolveSharedCacheIdentity,
   resolveSharedCacheRoot,
 } from "./cache-policy.mjs";
+import { importReleaseConfig } from "./release-config.mjs";
 import { resolveReleaseLayout } from "./release-state.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
@@ -52,11 +53,11 @@ export async function runCacheCommand(args = process.argv.slice(2), { env = proc
   }
   if (command === "migrate") {
     const configPath = option(rest, "--config");
-    if (!configPath) throw new Error("cache migrate requires --config <right-release.config.mjs>");
+    if (!configPath) throw new Error("cache migrate requires --config <right-release.config.json>");
     rejectUnknown(rest.filter((value) => value !== "--config" && value !== configPath), new Set(["--json", "--dry-run", "--apply"]));
     if (rest.includes("--dry-run") && rest.includes("--apply")) throw new Error("cache migrate accepts either --dry-run or --apply");
     const configFile = path.resolve(configPath);
-    const config = (await import(pathToFileURL(configFile).href)).default;
+    const config = await importReleaseConfig(configFile);
     if (!config?.app) throw new Error("cache migrate config must expose app");
     const appRoot = path.dirname(configFile);
     const configuredTarget = config.targets?.[platform] ?? {};

package/cargo-license-notices.mjs

@@ -15,6 +15,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
@@ -73,7 +74,7 @@ export function generateCargoNotices({ appRoot, config, flags = {}, check = fals
 }
 
 export function parseCargoNoticeArgs(argv) {
-  const opts = { config: "right-release.config.mjs", output: undefined, check: false };
+  const opts = { config: defaultReleaseConfigFile(), output: undefined, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--output") {

package/cargo-manifest-text.mjs

@@ -0,0 +1,25 @@
+// A line reading of the [package] table of a Cargo.toml, for the scans that must run without a TOML parser (the license scan and
+// the secret scan of the repository gate). This module has no imports on purpose: publish-cargo.mjs is in the trusted runtime
+// helper closure (scripts/ci/runtime-supplement.mjs), which may only follow static relative imports of plain modules.
+
+/**
+ * `{ hasPackage, unpublished }` for the text of a Cargo.toml: whether it has a `[package]` table, and whether that table says
+ * `publish = false` or `publish = []`. A crate that can never be published ships its licence to no one, like a package.json with
+ * `"private": true`. An array-of-tables header (`[[bin]]`, `[[package.metadata.x]]`) starts a new table like any other, so a
+ * `publish` key under it is not the package's.
+ */
+export function cargoManifestState(text) {
+  let table = "";
+  let hasPackage = false;
+  let unpublished = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    const header = /^\s*\[\[?([^\]]+)\]\]?\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      table = header[1].trim();
+      if (table === "package") hasPackage = true;
+      continue;
+    }
+    if (table === "package" && /^\s*publish\s*=\s*(?:false\b|\[\s*\])/.test(line)) unpublished = true;
+  }
+  return { hasPackage, unpublished };
+}

package/cargo-profile-contract.mjs

@@ -19,6 +19,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse } from "smol-toml";
 import { findCargoManifests, isExcludedScanDirectory } from "./cargo-contract.mjs";
+import { defaultReleaseConfigFile, isJsonReleaseConfig } from "./release-config.mjs";
 
 export const CARGO_PROFILE_TEMPLATE = fileURLToPath(new URL("./templates/cargo-profiles.toml", import.meta.url));
 export const RETIRED_PROFILE = "release-iterate";
@@ -74,28 +75,40 @@ export function checkManifestProfiles(manifest, template, file) {
 // Non-shipping workspaces: fixed prefixes plus the app's declared `cargoProfileExempt` directories.
 const NON_SHIPPING_PREFIXES = ["qa", "benchmarks"];
 const CARGO_PROFILE_EXEMPT_KEY = "cargoProfileExempt";
-const RELEASE_CONFIG = "right-release.config.mjs";
 const STRING_LITERAL = /"([^"\\\n]*)"|'([^'\\\n]*)'/g;
 
-// release.mjs imports the app's release config as an ES module. This scanner is synchronous and has only the
-// app root, so it reads the literal `cargoProfileExempt` array from the same file: every entry must be a plain
-// string literal naming a directory inside the app. Anything else is a finding, never silently ignored.
+// This scanner is synchronous and has only the app root, so it reads `cargoProfileExempt` from the release config file itself and
+// never imports it. A JSON config (the one `defaultReleaseConfigFile` picks when it exists) is parsed as data: the array must hold
+// plain strings. A legacy `.mjs` config, which release.mjs still imports as an ES module, is read as text: the literal array must
+// hold plain string literals. Either way every entry names a directory inside the app, and anything else is a finding, never
+// silently ignored. M24 command admission is not run here: this is a pure file reader.
 export function readCargoProfileExempt(root) {
-  const file = path.join(root, RELEASE_CONFIG);
+  const configFile = defaultReleaseConfigFile(root);
+  const file = path.join(root, configFile);
   const findings = [];
   if (!existsSync(file)) return { paths: [], findings };
-  const match = new RegExp(`\\b${CARGO_PROFILE_EXEMPT_KEY}\\s*:\\s*\\[([^\\]]*)\\]`).exec(readFileSync(file, "utf8"));
-  if (!match) return { paths: [], findings };
-  const body = match[1];
-  if (body.replace(STRING_LITERAL, "").replace(/[,\s]/g, "") !== "") {
-    findings.push({ rule: "invalid-exempt", file: RELEASE_CONFIG, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of string literals` });
+  let entries;
+  if (isJsonReleaseConfig(configFile)) {
+    let declared;
+    try { declared = JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, ""))?.[CARGO_PROFILE_EXEMPT_KEY]; }
+    catch (error) { return { paths: [], findings: [{ rule: "invalid-exempt", file: configFile, message: `is not valid JSON, so ${CARGO_PROFILE_EXEMPT_KEY} cannot be read: ${error.message}` }] }; }
+    if (declared === undefined) return { paths: [], findings };
+    if (!Array.isArray(declared) || declared.some((entry) => typeof entry !== "string")) findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of strings` });
+    entries = Array.isArray(declared) ? declared.filter((entry) => typeof entry === "string") : [];
+  } else {
+    const match = new RegExp(`\\b${CARGO_PROFILE_EXEMPT_KEY}\\s*:\\s*\\[([^\\]]*)\\]`).exec(readFileSync(file, "utf8"));
+    if (!match) return { paths: [], findings };
+    const body = match[1];
+    if (body.replace(STRING_LITERAL, "").replace(/[,\s]/g, "") !== "") {
+      findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of string literals` });
+    }
+    entries = [...body.matchAll(STRING_LITERAL)].map(([, double, single]) => double ?? single);
   }
   const paths = [];
-  for (const [, double, single] of body.matchAll(STRING_LITERAL)) {
-    const entry = double ?? single;
+  for (const entry of entries) {
     const normalized = path.posix.normalize(entry.replace(/\\/g, "/")).replace(/\/+$/, "");
     if (normalized === "." || normalized === "" || path.posix.isAbsolute(normalized) || normalized.split("/").includes("..")) {
-      findings.push({ rule: "invalid-exempt", file: RELEASE_CONFIG, message: `${CARGO_PROFILE_EXEMPT_KEY} entry ${JSON.stringify(entry)} must be a relative directory inside the app` });
+      findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} entry ${JSON.stringify(entry)} must be a relative directory inside the app` });
     } else paths.push(normalized);
   }
   return { paths, findings };

package/cli/right-release.mjs

@@ -13,6 +13,7 @@ const commands = new Map([
   ["publish", "upload-release.mjs"],
   ["upload", "upload-release.mjs"],
   ["deps", "deps.mjs"],
+  ["update", "outdated-command.mjs"],
   ["publish-update", "publish-update.mjs"],
   ["hardening", "hardeningscan.mjs"],
   ["harden", "hardeningscan.mjs"],
@@ -295,8 +296,12 @@ Commands:
   ios-credentials store --key-id <KEYID> --issuer <uuid> | check
                                                       Put the App Store Connect API key (stdin), key id and issuer into the login Keychain once, or check them; never a file (macOS)
   qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa (and the journeys lane when the config sets qa.journeys) and write the sealed QA receipt. Refused inside a QA run. The receipt must match the platform and release id, come from an approved runner digest, and show every release-critical journey passed
-                                                      Admission is per app in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks build, upload and publish. Only adrian moves an app from refuse back to warn
+                                                      Admission is per app, and per stage (source = build, installed = upload and publish), in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks that stage. Only adrian moves an app or stage from refuse back to warn, or approves a runner
   qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
+  qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]
+                                                      Show the QA admission policy, or set an app's mode (both stages, or one with --stage)
+  qa policy approve-runner --runner <file> --version <v> --platform mac|win --set-by adrian [--note <text>]
+                                                      Approve a rightkit-qa runner build for one platform: the file must report "rightkit-qa <v>" from --version and <v> must be the published version
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
@@ -371,6 +376,8 @@ Commands:
   disk run                                           self-check, check, dry-run sweep, move sweep, warn (the scheduled job)
   disk schedule install|uninstall|status             Daily launchd job (Mac) / hidden Task Scheduler entry (Windows), bound to the stable per-user copy
   deps --check|--audit|--update                      Shared dependency lane
+  update check|apply|gate|land|discard|run|schedule [--repo <path>]
+                                                      Run the pinned @rightkit/outdated updater (right-update) that moves stale pins; reads .rightkit/update.json
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background

package/command-spec.mjs

@@ -5,13 +5,12 @@
 // `cwd` and `node` are app-relative and may not leave the app. `nodeFlags` go before the script, `nodeOptions` are merged
 // (de-duplicated) into NODE_OPTIONS for the child. Unknown keys are refused so a typo cannot silently change a run.
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 
-/** Load an app's `right-release.config.mjs`; the app root is the config file's directory. */
-export async function loadAppConfig(configFile = "right-release.config.mjs") {
+/** Load an app's release config (`right-release.config.json`, or the legacy `.mjs` while it is the only one); the app root is the config file's directory. */
+export async function loadAppConfig(configFile = defaultReleaseConfigFile()) {
   const configPath = path.resolve(configFile);
-  const loaded = await import(pathToFileURL(configPath).href);
-  return { config: loaded.default ?? loaded.config ?? loaded, appRoot: path.dirname(configPath), configPath };
+  return { config: await importReleaseConfig(configPath, { lenient: true }), appRoot: path.dirname(configPath), configPath };
 }
 
 export class CommandSpecError extends Error {

package/deps.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { existsSync } from "node:fs";
 import { cargoAuditWorkdirs, runCargoAudits } from "./deps-cargo.mjs";
 
 const args = process.argv.slice(2);
 const opts = {
-  config: "right-release.config.mjs",
+  config: defaultReleaseConfigFile(),
   mode: "check",
   latest: false,
 };
@@ -25,7 +25,8 @@ for (let i = 0; i < args.length; i++) {
 }
 
 const configPath = path.resolve(opts.config);
-const config = (await import(pathToFileURL(configPath))).default;
+let config;
+try { config = await importReleaseConfig(configPath); } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
 if (config?.schema !== 1) fail(`unsupported config schema: ${config?.schema ?? "<missing>"} (expected 1)`);
 if (config.packageManager !== "pnpm") fail(`deps tool expects pnpm, got ${config.packageManager}`);
 
@@ -69,7 +70,7 @@ if (failures.length > 0) {
 
 function usage(code, message) {
   if (message) console.error(`right-deps: ${message}\n`);
-  console.error("usage: node deps.mjs [--config right-release.config.mjs] [--check|--audit|--update] [--latest]");
+  console.error("usage: node deps.mjs [--config right-release.config.json] [--check|--audit|--update] [--latest]");
   process.exit(code);
 }