@rightkit/release 0.6.8 → 0.6.11

package/committed-source.mjs

@@ -115,7 +115,7 @@ function readBatch(root, oids, totalBytes, runner) {
   return result;
 }
 
-function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runner = spawnSync, env = gitEnv() } = {}) {
+function acquire(root, { expectedCommit, expectedTree, commit: selectedCommit, requiredPaths = [], runner = spawnSync, env = gitEnv() } = {}) {
   const text = (args) => runGit(root, args, { encoding: "utf8", runner, env }).trim();
   const repositoryRoot = path.resolve(text(["rev-parse", "--show-toplevel"]));
   const pathPrefix = text(["rev-parse", "--show-prefix"]).replaceAll("\\", "/");
@@ -125,9 +125,20 @@ function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runne
   const origin = originResult?.status === 0 ? String(originResult.stdout).trim() : null;
   const objectFormat = text(["rev-parse", "--show-object-format"]);
   if (objectFormat !== "sha1" && objectFormat !== "sha256") throw new Error("committed ownership: unsupported Git object format");
-  const commit = text(["rev-parse", "--verify", "HEAD^{commit}"]);
   const digestLength = objectFormat === "sha256" ? 64 : 40;
-  if (!new RegExp(`^[0-9a-f]{${digestLength}}$`).test(commit) || (expectedCommit && commit !== expectedCommit)) throw new Error("committed ownership: expected commit is not current HEAD");
+  // A door source split (release-source-identity.mjs, item 7 row 7.04) names the commit it builds: that commit's immutable objects are the
+  // source, never the checkout's HEAD. Only a full object id is accepted (never a ref, a revision expression or an option), and the
+  // object database must answer with that same commit. Without `commit` the source is HEAD, exactly as before.
+  let commit;
+  if (selectedCommit !== undefined) {
+    if (!new RegExp(`^[0-9a-f]{${digestLength}}$`).test(String(selectedCommit))) throw new Error("committed ownership: the selected commit is not a full object id");
+    commit = text(["rev-parse", "--verify", `${selectedCommit}^{commit}`]);
+    if (commit !== selectedCommit) throw new Error("committed ownership: the selected commit resolved to another object");
+    if (expectedCommit && commit !== expectedCommit) throw new Error("committed ownership: expected commit is not the selected commit");
+  } else {
+    commit = text(["rev-parse", "--verify", "HEAD^{commit}"]);
+    if (!new RegExp(`^[0-9a-f]{${digestLength}}$`).test(commit) || (expectedCommit && commit !== expectedCommit)) throw new Error("committed ownership: expected commit is not current HEAD");
+  }
   const tree = text(["rev-parse", "--verify", `${commit}^{tree}`]);
   if (!new RegExp(`^[0-9a-f]{${digestLength}}$`).test(tree) || (expectedTree && tree !== expectedTree)) throw new Error("committed ownership: expected tree does not match commit");
   const rows = parseTree(runGit(root, ["ls-tree", "-r", "-z", "--full-tree", tree], { encoding: "buffer", maxBuffer: MAX_TREE_BYTES, timeout: COMMAND_TIMEOUT_MS, runner, env }), objectFormat);
@@ -161,9 +172,13 @@ function acquire(root, { expectedCommit, expectedTree, requiredPaths = [], runne
   return Object.freeze({ repositoryRoot, pathPrefix, origin, commit, tree, objectFormat, entries, blobs, coverage });
 }
 
+/**
+ * The committed source of `root`'s repository. `options.commit` selects the commit by full object id (a door source split reads the
+ * selected commit's objects, never the checkout's HEAD); without it the source is HEAD. Blob-hash verification is the same either way.
+ */
 export function acquireCommittedSource(root, options = {}) {
-  const { expectedCommit, expectedTree, requiredPaths = [] } = options;
-  try { return createSourceHandle(acquire(path.resolve(root), { expectedCommit, expectedTree, requiredPaths })); }
+  const { expectedCommit, expectedTree, requiredPaths = [], commit } = options;
+  try { return createSourceHandle(acquire(path.resolve(root), { expectedCommit, expectedTree, requiredPaths, ...(commit !== undefined ? { commit } : {}) })); }
   catch (error) { if (error instanceof CommittedSourceIncompleteError) throw error; throw new CommittedSourceIncompleteError(error.message, error); }
 }
 
@@ -185,6 +200,25 @@ export function committedSourceDataForInternalUse(handle) {
   return acquiredSources.get(handle) ?? null;
 }
 
+/**
+ * `{ commit, tree }` of `commit` read from `root`'s object database: the full object id must name a commit, and the tree is that
+ * commit's own. It reads no HEAD, no index and no status, so a dirty or moved checkout cannot change the answer. Throws on any failure.
+ */
+export function resolveSelectedCommit(root, commit, { runner = spawnSync } = {}) {
+  const resolvedRoot = path.resolve(root);
+  const text = (args) => runGit(resolvedRoot, args, { encoding: "utf8", timeout: COMMAND_TIMEOUT_MS, runner, env: gitEnv() }).trim();
+  const objectFormat = text(["rev-parse", "--show-object-format"]);
+  if (objectFormat !== "sha1" && objectFormat !== "sha256") throw new Error("committed ownership: unsupported Git object format");
+  const digestLength = objectFormat === "sha256" ? 64 : 40;
+  const shape = new RegExp(`^[0-9a-f]{${digestLength}}$`);
+  if (!shape.test(String(commit))) throw new Error("committed ownership: the selected commit is not a full object id");
+  const resolved = text(["rev-parse", "--verify", `${commit}^{commit}`]);
+  if (resolved !== commit) throw new Error("committed ownership: the selected commit resolved to another object");
+  const tree = text(["rev-parse", "--verify", `${commit}^{tree}`]);
+  if (!shape.test(tree)) throw new Error("committed ownership: the selected commit has no tree");
+  return Object.freeze({ commit: resolved, tree, objectFormat });
+}
+
 export function assertCommittedCheckoutClean(root, { expectedCommit, expectedTree, runner = spawnSync } = {}) {
   if (expectedCommit || expectedTree) {
     const currentCommit = runGit(path.resolve(root), ["rev-parse", "--verify", "HEAD^{commit}"], { encoding: "utf8", timeout: COMMAND_TIMEOUT_MS, runner, env: gitEnv() }).trim();

package/crate-workspaces.mjs

@@ -0,0 +1,87 @@
+// One Cargo workspace and lock per RightKit crate (Adrian, 2026-10-29: "I want you to have 1 cargo dot lock per component";
+// rightkit#1285). Every `crates/<x>` is its own workspace; crates that use each other link by path dependency across
+// workspaces. This module reads manifests only (no cargo) and answers which crates exist, which sibling crates each one
+// path-depends on, and which crates a change reaches: the changed crate plus every crate that path-depends on it, transitively.
+// It imports nothing outside node: CI's plan job runs it before any package install, so it reads the few manifest keys it needs
+// (the package name and dependency `path` values) line by line instead of through a TOML library.
+import fs from "node:fs";
+import path from "node:path";
+
+const posix = (p) => p.split(path.sep).join("/");
+const defaults = { readFile: (f) => fs.readFileSync(f, "utf8"), readdir: (d) => fs.readdirSync(d), exists: fs.existsSync };
+
+/** [{ name, dir: "crates/<x>", manifest, lock }] for every crates/<x>/Cargo.toml, sorted by dir. */
+export function crateWorkspaces(root, io = {}) {
+  const { readFile, readdir, exists } = { ...defaults, ...io };
+  const cratesDir = path.join(root, "crates");
+  if (!exists(cratesDir)) return [];
+  const out = [];
+  for (const entry of [...readdir(cratesDir)].map(String).sort()) {
+    if (entry.startsWith(".")) continue;
+    const manifest = `crates/${entry}/Cargo.toml`;
+    if (!exists(path.join(root, manifest))) continue;
+    const name = manifestFacts(readFile(path.join(root, manifest))).name;
+    if (typeof name !== "string") continue;
+    out.push({ name, dir: `crates/${entry}`, manifest, lock: `crates/${entry}/Cargo.lock` });
+  }
+  return out;
+}
+
+const DEPENDENCY_TABLE = /^(?:target\.(?:'[^']*'|"[^"]*"|[^.\]]+)\.)?(?:dev-|build-)?dependencies$/;
+const unquote = (v) => v.replace(/^(["'])(.*)\1$/, "$2");
+
+/** { name, paths }: the [package] name and every dependency `path` value (inline tables and `[dependencies.<x>]` sections). */
+export function manifestFacts(text) {
+  let section = ""; let name; const paths = [];
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.replace(/\s+#.*$/, "").trim();
+    if (!line || line.startsWith("#")) continue;
+    const header = line.match(/^\[\[?([^\[\]]+)\]\]?$/);
+    if (header) { section = header[1].trim(); continue; }
+    if (section === "package") { const m = line.match(/^name\s*=\s*("[^"]*"|'[^']*')/); if (m) name = unquote(m[1]); continue; }
+    if (DEPENDENCY_TABLE.test(section)) {
+      const m = line.match(/^[A-Za-z0-9_.-]+\s*=\s*\{(.*)\}$/);
+      const p = m && m[1].match(/(?:^|,)\s*path\s*=\s*("[^"]*"|'[^']*')/);
+      if (p) paths.push(unquote(p[1]));
+      continue;
+    }
+    const dotted = section.match(/^(.*)\.([^.]+)$/);
+    if (dotted && DEPENDENCY_TABLE.test(dotted[1])) { const m = line.match(/^path\s*=\s*("[^"]*"|'[^']*')/); if (m) paths.push(unquote(m[1])); }
+  }
+  return { name, paths };
+}
+
+/** Map<name, Set<name>>: each crate's direct path dependencies on sibling crates (normal, dev, build, any target). */
+export function pathDependencies(root, io = {}, workspaces = crateWorkspaces(root, io)) {
+  const { readFile } = { ...defaults, ...io };
+  const byDir = new Map(workspaces.map((w) => [w.dir, w.name]));
+  const deps = new Map(workspaces.map((w) => [w.name, new Set()]));
+  for (const w of workspaces) {
+    for (const dep of manifestFacts(readFile(path.join(root, w.manifest))).paths) {
+      const target = byDir.get(posix(path.posix.normalize(path.posix.join(w.dir, posix(dep)))));
+      if (target && target !== w.name) deps.get(w.name).add(target);
+    }
+  }
+  return deps;
+}
+
+/** Set<name>: every crate that path-depends on any of `names`, transitively; `names` themselves are excluded. */
+export function reverseDependents(names, deps) {
+  const reverse = new Map();
+  for (const [from, tos] of deps) for (const to of tos) (reverse.get(to) ?? reverse.set(to, new Set()).get(to)).add(from);
+  const seen = new Set(); const queue = [...names];
+  while (queue.length) {
+    for (const dependent of reverse.get(queue.shift()) ?? []) {
+      if (!seen.has(dependent)) { seen.add(dependent); queue.push(dependent); }
+    }
+  }
+  for (const n of names) seen.delete(n);
+  return seen;
+}
+
+/** The crate whose workspace holds `file` (repository-relative, posix), or null. */
+export function crateOfFile(file, workspaces) {
+  let best = null;
+  for (const w of workspaces) if (file.startsWith(`${w.dir}/`) && (!best || w.dir.length > best.dir.length)) best = w;
+  return best?.name ?? null;
+}

package/create-mac-updater.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from "./background-process.mjs";
 import { existsSync, rmSync } from "node:fs";
 import path from "node:path";
 import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
+import { ArtifactPathError, loadSplitArtifactContext, resolveArtifactPath, resolveArtifactWritePath } from "./release-artifact-path.mjs";
 
 const args = process.argv.slice(2);
 let app;
@@ -18,8 +19,19 @@ for (let i = 0; i < args.length; i++) {
 }
 if (!app || !output) fail("--app and --output are required");
 
-const appPath = path.resolve(cwd, app);
-const outputPath = path.resolve(cwd, output);
+// A door split (row 7.04c, R-T2): a target-prefixed `--app` is the bound Cargo target's, an absolute one must lie inside it, and the tarball is
+// written under the snapshot app root (a generated, ignored ledger entry). Outside a split both are resolved against the cwd as always.
+let appPath;
+let outputPath;
+try {
+  const artifactPaths = await loadSplitArtifactContext({ cwd });
+  const split = artifactPaths.mode === "split";
+  appPath = split ? resolveArtifactPath(app, artifactPaths) : path.resolve(cwd, app);
+  outputPath = split ? resolveArtifactWritePath(output, artifactPaths) : path.resolve(cwd, output);
+} catch (error) {
+  if (error instanceof ArtifactPathError) fail(error.message);
+  throw error;
+}
 if (!dryRun && !existsSync(appPath)) fail(`signed app not found: ${appPath}`);
 
 const env = { ...process.env };