@rightkit/release 0.6.5 → 0.6.7

package/github-upload-gate.mjs

@@ -8,12 +8,12 @@
 //   - sealed ownership evidence that still matches the committed source;
 //   - an explicit distribution.provider of github-releases and a distribution.repository, with any --repo
 //     argument required to equal it (the origin remote is never consulted).
-// Order matters: the release config is a module that runs on import, so it is loaded only after the tree is
-// proven clean and the sealed commit equals HEAD.
+// Order matters: a legacy release config is a module that runs on import (a JSON config is data), so the config is
+// loaded only after the tree is proven clean and the sealed commit equals HEAD.
 import { existsSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { verifySealedRelease } from "./release-state.mjs";
@@ -48,9 +48,9 @@ export async function authorizeGitHubUpload({
   tier,
   releaseId,
   platform,
-  configName = "right-release.config.mjs",
-  repo = "",
   cwd = process.cwd(),
+  configName = defaultReleaseConfigFile(cwd),
+  repo = "",
 }) {
   assertUploadTier(tier);
   if (!releaseId) throw new Error("--release is required");
@@ -69,7 +69,7 @@ export async function authorizeGitHubUpload({
 
   const configPath = path.resolve(cwd, configName);
   if (!existsSync(configPath)) throw new Error(`release config is required: ${configName}`);
-  const releaseConfig = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
+  const releaseConfig = await importReleaseConfig(configPath, { query: `upload=${Date.now()}` });
   const ownership = verifyOwnershipEvidence(sealed.manifest.ownershipEvidence, repoRoot, path.dirname(configPath));
   if (!ownership.ok) throw new Error(`sealed ownership evidence rejected: ${ownership.reason}`);
   const configuredRepo = resolveGitHubDistribution(releaseConfig, repo);

package/init-command.mjs

@@ -3,9 +3,11 @@
 // (bogusyogi/rightkit#385): renames the desktop app template into a real app, in place. Ports PostRight's
 // crates/tools/src/init.rs. The template identity (`RightApp`, `rightapp`, `RIGHTAPP`, `app.rightsuite.rightapp`)
 // is rewritten in text files; nothing else is touched and no gate or build is run.
-import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { isJudgedNotice } from "./consumer-contracts.mjs";
 
 export const SKIP_DIRS = new Set(["node_modules", "target", ".git", "dist", "gen"]);
 export const TEXT_EXT = new Set(["json", "toml", "mjs", "ts", "tsx", "rs", "md", "html", "css", "yaml", "yml", "sh"]);
@@ -50,6 +52,60 @@ export function resolveIdentity({ name, id, slug }) {
   return { name, id, slug: resolvedSlug, warnings };
 }
 
+// Cargo writes Cargo.lock with its [[package]] tables sorted by name (then version) and each `dependencies` list sorted by name, and
+// `cargo --locked` refuses a lock that differs from what it would write. Renaming the template's own crates moves them in that order,
+// so the lock is re-sorted after the text rename; without it every `--locked` script fails on the first build of the new app.
+const LOCK_FILE = "Cargo.lock";
+const byteOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const semverParts = (version) => {
+  const [core, pre] = String(version ?? "").split("+")[0].split(/-(.*)/s);
+  return { nums: core.split(".").map((part) => Number.parseInt(part, 10) || 0), pre: pre ?? null };
+};
+function compareSemver(a, b) {
+  const x = semverParts(a);
+  const y = semverParts(b);
+  for (let i = 0; i < 3; i += 1) if (x.nums[i] !== y.nums[i]) return (x.nums[i] ?? 0) - (y.nums[i] ?? 0);
+  if (x.pre === y.pre) return 0;
+  if (x.pre === null) return 1;
+  if (y.pre === null) return -1;
+  return byteOrder(x.pre, y.pre);
+}
+const lockField = (block, key) => new RegExp(`^${key} = "([^"]*)"$`, "m").exec(block)?.[1] ?? "";
+/** `"name"`, `"name version"` or `"name version (source)"`: the name and version of one `dependencies` entry. */
+const lockDependency = (line) => {
+  const [name = "", version = ""] = line.trim().replace(/^"|",?$/g, "").split(" ");
+  return { name, version };
+};
+
+/** Sort one lock's [[package]] tables and their `dependencies` lists the way cargo writes them; everything else is kept byte for byte. */
+export function sortCargoLock(text) {
+  const crlf = text.includes("\r\n");
+  const lf = crlf ? text.replace(/\r\n/g, "\n") : text;
+  const first = /^\[\[package\]\]$/m.exec(lf);
+  if (!first) return text;
+  const head = lf.slice(0, first.index);
+  let body = lf.slice(first.index);
+  let tail = "";
+  const other = /^\[(?!\[package\]\]$)/m.exec(body);
+  if (other) {
+    tail = body.slice(other.index);
+    body = body.slice(0, other.index);
+  }
+  const blocks = body.replace(/\n+$/, "").split(/\n\n(?=\[\[package\]\]$)/m).map((block) => block.replace(
+    /^dependencies = \[\n([\s\S]*?)\n\]$/m,
+    (_, list) => `dependencies = [\n${list.split("\n").map((line) => ({ line, ...lockDependency(line) }))
+      .sort((a, b) => byteOrder(a.name, b.name) || compareSemver(a.version, b.version)).map((entry) => entry.line).join("\n")}\n]`,
+  ));
+  blocks.sort((a, b) => byteOrder(lockField(a, "name"), lockField(b, "name")) || compareSemver(lockField(a, "version"), lockField(b, "version")));
+  const out = `${head}${blocks.join("\n\n")}\n${tail ? `\n${tail}` : ""}`;
+  return crlf ? out.replace(/\n/g, "\r\n") : out;
+}
+
+/** Rename the template identity in a Cargo.lock and restore cargo's order, so `cargo --locked` accepts the renamed lock. */
+export function reidentifyCargoLock(text, identity) {
+  return sortCargoLock(renameText(text, identity));
+}
+
 export function walkTextFiles(dir, out = []) {
   let entries;
   try {
@@ -61,26 +117,77 @@ export function walkTextFiles(dir, out = []) {
     const full = path.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name)) walkTextFiles(full, out);
-    } else if (entry.isFile() && TEXT_EXT.has(path.extname(entry.name).slice(1))) {
+    } else if (entry.isFile() && (TEXT_EXT.has(path.extname(entry.name).slice(1)) || entry.name === LOCK_FILE)) {
       out.push(full);
     }
   }
   return out;
 }
 
+// `rightapps` is not the template identity: it is the RightApps distribution service (the `r2-rightapps` provider), which every app
+// keeps. A spelling followed by a whole-word `s` is therefore left alone; `rightapp-engine`, `rightapp_protocol`, `RIGHTAPP_HOME` and
+// the rest of the identity still rename.
+const spelling = (word) => new RegExp(`${word}(?![sS](?![A-Za-z0-9]))`, "g");
+const UPPER_WORD = spelling(UPPER);
+const TITLE_WORD = spelling(TITLE);
+const LOWER_WORD = spelling(LOWER);
+
 /** Rewrite the template identity in one string; the bundle id first, then the three spellings. */
 export function renameText(text, { name, id, slug }) {
   return text
     .replaceAll(TEMPLATE_ID, id)
-    .replaceAll(UPPER, slug.toUpperCase())
-    .replaceAll(TITLE, name)
-    .replaceAll(LOWER, slug);
+    .replace(UPPER_WORD, () => slug.toUpperCase())
+    .replace(TITLE_WORD, () => name)
+    .replace(LOWER_WORD, () => slug);
+}
+
+export const LEGAL_MANIFEST = "legal/legal-manifest.json";
+const sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+/**
+ * Recompute the `sha256` of every document and appendix of a legal manifest from the bytes `read(relativePath)` returns (paths are
+ * relative to the manifest's directory; `read` returns Buffer, string or null for a missing file). Returns `{ text, changed, stale,
+ * material }`: the manifest text with the new digests (2-space JSON, as `legal-snapshot` writes it), the entries whose digest moved,
+ * and which of those are material agreements. Material documents feed the acceptance digest in src/generated/legal-contract.json, which
+ * only `legal-snapshot` can recompute, so the caller warns about them.
+ */
+export function rehashLegalManifest(text, read) {
+  const manifest = JSON.parse(text);
+  const changed = [];
+  const material = [];
+  for (const entry of [...(manifest.documents ?? []), ...(manifest.appendices ?? [])]) {
+    const bytes = typeof entry?.path === "string" ? read(entry.path) : null;
+    if (bytes === null || bytes === undefined) continue;
+    const digest = sha256Hex(typeof bytes === "string" ? Buffer.from(bytes) : bytes);
+    if (entry.sha256 === digest) continue;
+    entry.sha256 = digest;
+    changed.push(entry.path);
+    if (entry.material === true) material.push(entry.path);
+  }
+  return { text: changed.length ? `${JSON.stringify(manifest, null, 2)}\n` : text, changed, material };
+}
+
+/**
+ * Rename the template under `root`. Returns the identity, the changed file paths (relative, sorted) and `warnings`.
+ * The rename changes the bytes of text the legal manifest hashes (the privacy notice and the npm appendix carry the product name), so the
+ * manifest's digests are recomputed from the renamed bytes in the same pass.
+ */
+/** The lock a notice field names (`prefix` holds the name or path), resolved from `dir` upward to `root` as CA-14 resolves it. */
+function resolveLockUpward(root, dir, prefix) {
+  const ref = /^`?([^`\s(]+)/.exec(prefix)[1];
+  for (let at = path.resolve(dir); ; at = path.dirname(at)) {
+    const candidate = path.resolve(at, ...ref.split("/"));
+    if (existsSync(candidate)) return candidate;
+    if (at === path.resolve(root) || at === path.dirname(at)) return null;
+  }
 }
 
-/** Rename the template under `root`. Returns the identity and the changed file paths (relative, sorted). */
 export function initTemplate(root, options) {
   const identity = resolveIdentity(options);
   const changed = [];
+  const warnings = [...identity.warnings];
+  const renamed = new Map();
+  const lockDigestsBefore = new Map();
   for (const file of walkTextFiles(root)) {
     if (path.basename(file) === SELF) continue;
     let before;
@@ -89,20 +196,80 @@ export function initTemplate(root, options) {
     } catch {
       continue;
     }
-    const after = renameText(before, identity);
+    const after = path.basename(file) === LOCK_FILE ? reidentifyCargoLock(before, identity) : renameText(before, identity);
     if (after === before) continue;
+    if (path.basename(file) === LOCK_FILE) lockDigestsBefore.set(path.resolve(file), createHash("sha256").update(before).digest("hex"));
+    renamed.set(path.resolve(file), after);
     if (!options.dryRun) writeFileSync(file, after);
     changed.push(path.relative(root, file).split(path.sep).join("/"));
   }
-  return { ...identity, changed: changed.sort() };
+  // The rename changes Cargo.lock's bytes (the app's own crates), so every notice that records the lock's digest
+  // (`Cargo.lock sha256 <hex>` / `sha256=<hex>`, checked by notice-lock-digest CA-14) would go stale: carry the new digest.
+  // Only the provenance field moves: `<lock> sha256 <hex>` or `<lock> sha256=<hex>` (optionally backticked, optionally with a
+  // parenthesised label) in a notice CA-14 judges (isJudgedNotice), where <lock> resolves from the notice's directory upward to
+  // this lock, as CA-14 resolves it, and <hex> is its old digest. The same digest, or the same formatted text, anywhere else
+  // (another input's field, archived reports and evidence, a source literal, a notice in a history tree) is left alone.
+  const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pairs = [...lockDigestsBefore].map(([file, old]) => {
+    const names = [...new Set([path.basename(file), path.relative(root, file).split(path.sep).join("/")])].map(escapeRe).join("|");
+    const field = new RegExp(`(\`?(?:${names})\`?(?:[ \\t]*\\([^)\\n]*\\))?[ \\t]+sha256(?:=|[ \\t]+)\`?)${old}(?![0-9a-f])`, "g");
+    return { lock: file, field, now: createHash("sha256").update(renamed.get(file)).digest("hex") };
+  });
+  if (pairs.length) {
+    for (const file of walkTextFiles(root)) {
+      if (path.basename(file) === SELF || path.basename(file) === LOCK_FILE) continue;
+      if (!isJudgedNotice(path.relative(root, file).split(path.sep).join("/"))) continue;
+      const before = renamed.get(path.resolve(file)) ?? readFileSync(file, "utf8");
+      let after = before;
+      for (const { lock, field, now } of pairs) {
+        after = after.replace(field, (whole, prefix) => (resolveLockUpward(root, path.dirname(file), prefix) === lock ? `${prefix}${now}` : whole));
+      }
+      if (after === before) continue;
+      renamed.set(path.resolve(file), after);
+      if (!options.dryRun) writeFileSync(file, after);
+      const relative = path.relative(root, file).split(path.sep).join("/");
+      if (!changed.includes(relative)) changed.push(relative);
+    }
+  }
+  const manifestFile = path.join(root, ...LEGAL_MANIFEST.split("/"));
+  if (existsSync(manifestFile)) {
+    const legalDir = path.dirname(manifestFile);
+    const read = (relative) => {
+      const target = path.resolve(legalDir, relative);
+      if (renamed.has(target)) return renamed.get(target);
+      try { return readFileSync(target); } catch { return null; }
+    };
+    const rehashed = rehashLegalManifest(renamed.get(path.resolve(manifestFile)) ?? readFileSync(manifestFile, "utf8"), read);
+    if (rehashed.changed.length) {
+      if (!options.dryRun) writeFileSync(manifestFile, rehashed.text);
+      if (!changed.includes(LEGAL_MANIFEST)) changed.push(LEGAL_MANIFEST);
+    }
+    for (const material of rehashed.material) {
+      warnings.push(`the rename changed the material legal document legal/${material}, which feeds src/generated/legal-contract.json; run \`pnpm exec legal-snapshot\` to regenerate the acceptance contract`);
+    }
+  }
+  return { ...identity, changed: changed.sort(), warnings };
 }
 
+/** What a person does after init: the steps no command can do for them, in order. */
+export const NEXT_STEPS = Object.freeze([
+  "pnpm install                      (installs the pinned packages and, through `prepare`, the pre-push hook)",
+  "right-release doctor              (the build's own checks for this app, as rows)",
+  "set the app's public legal host in legal-snapshot.config.json, replace legal/PRODUCT_SCHEDULE.md and legal/PRIVACY_NOTICE.md with reviewed text, then `pnpm exec legal-snapshot`",
+  "register the repository on each host: add it to packages/release/ownership-repositories.json in RightKit (and its byte copy under packages/build-control-policy), then run `right-release ownership trust-refresh` on the Mac and the Dell (a person with administrator rights; an agent cannot)",
+  "README.md in the template: \"Create a new app (checklist)\"",
+]);
+
 export function runInitCommand(argv, io = { stdout: console.log, stderr: console.error }) {
   const opts = parseInitArgs(argv);
   const result = initTemplate(path.resolve(opts.dir), opts);
   for (const warning of result.warnings) io.stderr(`warning: ${warning}`);
   io.stdout(`right-release init${opts.dryRun ? " --dry-run" : ""}: ${result.changed.length} file(s) ${opts.dryRun ? "would change" : "changed"}`);
   for (const file of result.changed) io.stdout(`  ${file}`);
+  if (!opts.dryRun) {
+    io.stdout("next:");
+    for (const step of NEXT_STEPS) io.stdout(`  ${step}`);
+  }
   return result;
 }
 

package/ios-upload.mjs

@@ -21,8 +21,8 @@
 // TestFlight steps use the same in-memory ES256 JWT. No file, temp or not, ever holds the key; no altool, no Transporter.
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { assertGuiSigningSession, assertIosHost, IosHostError } from "./ios-host.mjs";
 import { acquireFileLock } from "./ios-lock.mjs";
 import {
@@ -136,7 +136,7 @@ const git = (cwd, args) => {
 };
 
 /** Local checks only; no network, no secret. The sealed release is the only input: build-free by construction. */
-export async function authorizeIosUpload({ releaseId, configName = "right-release.config.mjs", cwd = process.cwd() }) {
+export async function authorizeIosUpload({ releaseId, cwd = process.cwd(), configName = defaultReleaseConfigFile(cwd) }) {
   if (!RELEASE_ID.test(releaseId ?? "")) refuse("IOS_UPLOAD_RELEASE_REQUIRED", "--release <sealed-id> is required");
   const repoRoot = git(cwd, ["rev-parse", "--show-toplevel"]);
   assertPrimaryReleaseCheckout(repoRoot);
@@ -144,8 +144,8 @@ export async function authorizeIosUpload({ releaseId, configName = "right-releas
   assertCleanSource({ status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release upload" });
   const configPath = path.resolve(cwd, configName);
   if (!existsSync(configPath)) refuse("IOS_UPLOAD_CONFIG_INVALID", `release config is required: ${configName}`);
-  // The config is a module that runs on import: loaded only after the tree is proven clean.
-  const config = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
+  // A legacy config is a module that runs on import (a JSON config is data): loaded only after the tree is proven clean.
+  const config = await importReleaseConfig(configPath, { query: `upload=${Date.now()}` });
   const distribution = validateIosDistribution(targetDistribution(config, "ios"));
   const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, "ios");
   const appRoot = path.dirname(configPath);