@rightkit/release 0.2.0

package/cli/right-release.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const commands = new Map([
+  ["release", "release.mjs"],
+  ["build", "release.mjs"],
+  ["package", "release.mjs"],
+  ["deps", "deps.mjs"],
+  ["publish-update", "publish-update.mjs"],
+  ["hardening", "hardeningscan.mjs"],
+  ["harden", "hardeningscan.mjs"],
+  ["hardeningscan", "hardeningscan.mjs"],
+  ["sign-windows", "sign-windows.mjs"],
+  ["sign-updater", "sign-updater.mjs"],
+  ["create-mac-updater", "create-mac-updater.mjs"],
+]);
+
+const args = process.argv.slice(2);
+const first = args[0];
+
+if (!first || first === "-h" || first === "--help") {
+  printHelp();
+  process.exit(0);
+}
+
+if (first === "--version" || first === "-v") {
+  run("release.mjs", ["--version"]);
+} else if (first === "doctor") {
+  if (args.includes("--all")) {
+    runTest(["--test", path.join(packageRoot, "right-suite-contract.test.mjs")]);
+  } else {
+    run("release.mjs", ["--doctor", ...args.slice(1)]);
+  }
+} else if (first === "publish") {
+  const rest = args.slice(1);
+  run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+} else if (first === "lsclean") {
+  runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
+} else if (commands.has(first)) {
+  run(commands.get(first), args.slice(1));
+} else if (first.startsWith("-")) {
+  run("release.mjs", args);
+} else {
+  console.error(`right-release: unknown command: ${first}\n`);
+  printHelp();
+  process.exit(2);
+}
+
+function run(script, scriptArgs) {
+  const child = spawn(process.execPath, [path.join(packageRoot, script), ...scriptArgs], {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+  });
+  child.on("error", (error) => {
+    console.error(`right-release: failed to start ${script}: ${error.message}`);
+    process.exit(1);
+  });
+  child.on("exit", (code) => process.exit(code ?? 1));
+}
+
+function runTest(testArgs) {
+  const child = spawn(process.execPath, testArgs, {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+  });
+  child.on("error", (error) => {
+    console.error(`right-release: failed to start doctor --all: ${error.message}`);
+    process.exit(1);
+  });
+  child.on("exit", (code) => process.exit(code ?? 1));
+}
+
+function runBinary(cmd, cmdArgs) {
+  const child = spawn(cmd, cmdArgs, {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+  });
+  child.on("error", (error) => {
+    console.error(`right-release: failed to start ${cmd}: ${error.message}`);
+    process.exit(1);
+  });
+  child.on("exit", (code) => process.exit(code ?? 1));
+}
+
+function printHelp() {
+  console.log(`right-release <command> [options]
+
+Commands:
+  release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
+  publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
+  doctor [--platform mac|win]                        Inspect one app's release config
+  doctor --all                                       Verify all Right Suite app release contracts
+  deps --check|--audit|--update                      Shared dependency lane
+  hardening <artifact...>                            Run the Right Suite hardening scan
+  lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
+
+Direct flags are treated as: right-release release <flags>.
+Publishing requires an explicit tier. Unsigned/local smoke builds stay app-local unless declared in right-release.config.mjs.`);
+}

package/create-mac-updater.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const args = process.argv.slice(2);
+let app;
+let output;
+let cwd = process.cwd();
+let dryRun = false;
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--app") app = args[++i];
+  else if (args[i] === "--output") output = args[++i];
+  else if (args[i] === "--cwd") cwd = path.resolve(args[++i]);
+  else if (args[i] === "--dry-run") dryRun = true;
+  else fail(`unknown argument: ${args[i]}`);
+}
+if (!app || !output) fail("--app and --output are required");
+
+const appPath = path.resolve(cwd, app);
+const outputPath = path.resolve(cwd, output);
+if (!dryRun && !existsSync(appPath)) fail(`signed app not found: ${appPath}`);
+
+const env = { ...process.env };
+if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
+  try {
+    env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
+      "security",
+      ["find-generic-password", "-a", os.userInfo().username, "-s", "rightsuite-updater-key", "-w"],
+      { encoding: "utf8" },
+    ).trim();
+  } catch {
+    fail("shared updater key is missing from Keychain service rightsuite-updater-key");
+  }
+}
+env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ??= "";
+
+rmSync(outputPath, { force: true });
+rmSync(`${outputPath}.sig`, { force: true });
+run("tar", ["-czf", outputPath, "-C", path.dirname(appPath), path.basename(appPath)]);
+run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
+
+function run(command, commandArgs) {
+  console.log(`${dryRun ? "[dry-run] " : ""}${command} ${commandArgs.join(" ")}`);
+  if (dryRun) return;
+  const result = spawnSync(command, commandArgs, { cwd, env, stdio: "inherit" });
+  if (result.status !== 0) process.exit(result.status ?? 1);
+}
+
+function fail(message) {
+  console.error(`create-mac-updater: ${message}`);
+  process.exit(1);
+}

package/create-mac-updater.test.mjs

@@ -0,0 +1,13 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url));
+
+test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
+  const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /tar .*Test\.app\.tar\.gz.*Test\.app/);
+  assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
+});

package/deps.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+const args = process.argv.slice(2);
+const opts = {
+  config: "right-release.config.mjs",
+  mode: "check",
+  latest: false,
+};
+
+for (let i = 0; i < args.length; i++) {
+  const arg = args[i];
+  if (arg === "--") continue;
+  else if (arg === "--config") opts.config = args[++i];
+  else if (arg === "--check") opts.mode = "check";
+  else if (arg === "--audit") opts.mode = "audit";
+  else if (arg === "--update") opts.mode = "update";
+  else if (arg === "--latest") opts.latest = true;
+  else if (arg === "-h" || arg === "--help") usage(0);
+  else usage(2, `unknown argument: ${arg}`);
+}
+
+const configPath = path.resolve(opts.config);
+const config = (await import(pathToFileURL(configPath))).default;
+if (config?.schema !== 1) fail(`unsupported config schema: ${config?.schema ?? "<missing>"} (expected 1)`);
+if (config.packageManager !== "pnpm") fail(`deps tool expects pnpm, got ${config.packageManager}`);
+
+const root = path.dirname(configPath);
+const workdirs = [...new Set([config.workdir ?? ".", ...(config.deps?.workdirs ?? [])])];
+const resolvedWorkdirs = workdirs.map((rel) => ({ rel, cwd: path.resolve(root, rel) }));
+const missingLocks = resolvedWorkdirs.filter(({ cwd }) => !existsSync(path.join(cwd, "pnpm-lock.yaml")));
+if (missingLocks.length > 0) {
+  for (const { rel, cwd } of missingLocks) {
+    console.error(`right-deps: configured workdir ${rel} is missing ${path.join(cwd, "pnpm-lock.yaml")}`);
+  }
+  fail("dependency check refused: every configured workdir must have a pnpm-lock.yaml");
+}
+
+console.log(`right-deps: ${config.app} ${opts.mode}`);
+const failures = [];
+for (const { rel, cwd } of resolvedWorkdirs) {
+  const workspaceArgs = cwd === root ? [] : ["--ignore-workspace"];
+  if (opts.mode === "check") {
+    const status = run("pnpm", ["outdated", ...workspaceArgs], cwd, { allowFailure: true });
+    if (status == null) failures.push(`${rel}: pnpm outdated could not start`);
+  } else if (opts.mode === "audit") {
+    const status = run("pnpm", ["audit", ...workspaceArgs], cwd, { allowFailure: true });
+    if (status !== 0) failures.push(`${rel}: pnpm audit exited ${status ?? "without status"}`);
+  }
+  else if (opts.mode === "update") {
+    run("pnpm", ["update", ...workspaceArgs, ...(opts.latest ? ["--latest"] : [])], cwd, { ignoreScripts: true });
+    run("pnpm", ["install", ...workspaceArgs, "--lockfile-only", "--ignore-scripts"], cwd, { ignoreScripts: true });
+  }
+}
+if (failures.length > 0) {
+  for (const failure of failures) console.error(`right-deps: ${failure}`);
+  fail(`${failures.length} dependency workdir(s) failed`);
+}
+
+function usage(code, message) {
+  if (message) console.error(`right-deps: ${message}\n`);
+  console.error("usage: node deps.mjs [--config right-release.config.mjs] [--check|--audit|--update] [--latest]");
+  process.exit(code);
+}
+
+function fail(message) {
+  console.error(`right-deps: ${message}`);
+  process.exit(1);
+}
+
+function run(cmd, runArgs, cwd, options = {}) {
+  console.log(`\n> ${cmd} ${runArgs.join(" ")}  (${cwd})`);
+  const env = options.ignoreScripts
+    ? { ...process.env, npm_config_ignore_scripts: "true", PNPM_CONFIG_IGNORE_SCRIPTS: "true" }
+    : process.env;
+  const executable = process.platform === "win32" ? (process.env.ComSpec ?? "cmd.exe") : cmd;
+  const executableArgs = process.platform === "win32"
+    ? ["/d", "/s", "/c", [cmd, ...runArgs].join(" ")]
+    : runArgs;
+  const result = spawnSync(executable, executableArgs, { cwd, env, stdio: "inherit" });
+  if (result.status !== 0 && !options.allowFailure) process.exit(result.status ?? 1);
+  if (result.status !== 0 && options.allowFailure) {
+    console.log(`right-deps: ${cmd} exited ${result.status}; continuing so all workdirs report`);
+  }
+  return result.status;
+}

package/hardeningscan.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import { createReadStream } from "node:fs";
+import { lstat, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const args = process.argv.slice(2);
+if (args.length === 0 || args.includes("-h") || args.includes("--help")) {
+  console.error("usage: node hardeningscan.mjs <artifact-path>...");
+  process.exit(args.length === 0 ? 2 : 0);
+}
+
+const root = process.cwd();
+const findings = [];
+
+const fileNameRules = [
+  [/\.map$/i, "source map shipped"],
+  [/\.pdb$/i, "Windows debug symbols shipped"],
+  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
+  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
+  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
+  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
+  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
+  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
+  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
+  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
+];
+
+const contentRules = [
+  [/\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
+  [/\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
+  [/C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
+  [/docs\/experiments/gi, "experiment path leaked"],
+  [/l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
+  [/SYSTEM_PROMPT/gi, "system prompt marker leaked"],
+  [/OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
+  [/--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
+  [/tdt_w15_p6/gi, "stale TDT p6 string leaked"],
+  [/Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
+];
+
+const maxPatternLen = Math.max(...contentRules.map(([r]) => String(r).length), 256);
+
+function add(kind, file, message, detail = "") {
+  findings.push({
+    kind,
+    file: path.relative(root, file) || file,
+    message,
+    detail,
+  });
+}
+
+async function walk(p) {
+  const st = await lstat(p);
+  const normalized = p.split(path.sep).join("/");
+  for (const [rule, message] of fileNameRules) {
+    if (rule.test(normalized)) add("path", p, message);
+  }
+  if (st.isDirectory()) {
+    const entries = await readdir(p);
+    await Promise.all(entries.map((name) => walk(path.join(p, name))));
+    return;
+  }
+  if (st.isFile()) await scanFile(p);
+}
+
+function scanFile(file) {
+  return new Promise((resolve) => {
+    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
+    let tail = "";
+    stream.on("data", (chunk) => {
+      const text = tail + chunk.toString("latin1");
+      for (const [rule, message] of contentRules) {
+        if (/ffmpeg-LICENSE\.txt$/i.test(file) && message === "GPL/nonfree ffmpeg flag leaked") {
+          continue;
+        }
+        rule.lastIndex = 0;
+        if (rule.test(text)) add("content", file, message, rule.source);
+      }
+      tail = text.slice(-maxPatternLen);
+    });
+    stream.on("error", (err) => {
+      add("read", file, "could not scan file", err.message);
+      resolve();
+    });
+    stream.on("end", resolve);
+  });
+}
+
+for (const arg of args) {
+  const target = path.resolve(arg);
+  try {
+    await walk(target);
+  } catch (err) {
+    add("target", target, "could not scan target", err.message);
+  }
+}
+
+const unique = new Map();
+for (const finding of findings) {
+  unique.set(`${finding.kind}\0${finding.file}\0${finding.message}`, finding);
+}
+
+const deduped = [...unique.values()].sort((a, b) =>
+  `${a.file} ${a.message}`.localeCompare(`${b.file} ${b.message}`),
+);
+
+if (deduped.length) {
+  console.error(`hardeningscan: ${deduped.length} finding(s)`);
+  for (const f of deduped) {
+    console.error(`- [${f.kind}] ${f.file}: ${f.message}`);
+  }
+  process.exit(1);
+}
+
+console.log("hardeningscan: clean");

package/lsclean.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# lsclean.sh — drop a built macOS app from LaunchServices (Launchpad/Spotlight).
+#
+# macOS auto-registers every .app bundle it discovers, so each build of a Right
+# Suite app makes a build-folder copy show up in Launchpad even though it isn't
+# installed in /Applications. This unregisters every registered copy of <Name.app>
+# that is NOT under /Applications (i.e. build folders, .Trash, stale mounts).
+#
+# Usage:   lsclean.sh HeardRight.app
+#          lsclean.sh ViewRight.app
+# Run it after a build, or any time Launchpad shows phantom copies.
+# Note: `lsregister -kill` was removed by Apple; per-path `-u` is the replacement.
+
+set -eu
+LSR=/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
+name="${1:?usage: lsclean.sh <AppName.app>}"
+
+"$LSR" -dump \
+  | sed -n 's/^[[:space:]]*path:[[:space:]]*\(.*'"$name"'\) (0x[0-9a-f]*)$/\1/p' \
+  | sort -u \
+  | while IFS= read -r p; do
+      case "$p" in
+        /Applications/*) ;;                    # keep real installs
+        *) "$LSR" -u "$p" 2>/dev/null && echo "unregistered: $p" ;;
+      esac
+    done
+
+echo "done. (a fresh build re-registers the build-folder copy — re-run then.)"

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@rightkit/release",
+  "version": "0.2.0",
+  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
+  "type": "module",
+  "bin": {
+    "right-release": "cli/right-release.mjs"
+  },
+  "files": [
+    "cli",
+    "*.mjs",
+    "*.sh"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "test": "node --test *.test.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "packageManager": "pnpm@11.9.0"
+}

package/publish-update.mjs

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { access, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawn } from "node:child_process";
+
+const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
+const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
+const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev";
+const PUBLIC_BASE = process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
+const tier = process.env.RIGHT_RELEASE_TIER || "";
+const args = process.argv.slice(2);
+let configName = "right-release.config.mjs";
+let platform = process.platform === "win32" ? "win" : "mac";
+let dryRun = false;
+
+for (let i = 0; i < args.length; i++) {
+  const arg = args[i];
+  if (arg === "--config") configName = args[++i];
+  else if (arg === "--platform") platform = args[++i];
+  else if (arg === "--dry-run") dryRun = true;
+  else fail(`unknown argument: ${arg}`);
+}
+
+if (tier !== "patch" && tier !== "update") {
+  fail("RIGHT_RELEASE_TIER is required (patch|update)");
+}
+
+const configPath = path.resolve(configName);
+const root = path.dirname(configPath);
+const config = (await import(pathToFileURL(configPath))).default;
+const target = config?.targets?.[platform];
+const artifacts = target?.updater?.artifacts ?? [];
+if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} has no updater.artifacts`);
+const installers = target?.installer?.artifacts ?? [];
+
+if (tier === "patch") {
+  if (!installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
+  for (const installer of installers) {
+    assertCurrentKey(installer.key, "installer");
+    const file = path.resolve(root, installer.file);
+    if (!dryRun) await access(file).catch(() => fail(`missing signed installer: ${installer.file}`));
+  }
+}
+
+const platforms = {};
+const registrations = new Map();
+const uploadedKeys = new Set();
+for (const artifact of artifacts) {
+  assertCurrentKey(artifact.key, "updater");
+  const bucket = tier === "patch" ? "public" : "private";
+  const file = path.resolve(root, artifact.file);
+  const signatureFile = path.resolve(root, artifact.signature);
+  if (!dryRun) {
+    await access(file).catch(() => fail(`missing updater artifact: ${artifact.file}`));
+    await access(signatureFile).catch(() => fail(`missing updater signature: ${artifact.signature}`));
+  }
+  if (!uploadedKeys.has(artifact.key)) {
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD ${bucket}/${artifact.key}`);
+    if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, bucket], root);
+    uploadedKeys.add(artifact.key);
+  }
+
+  const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
+  const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
+  const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
+  platforms[artifact.platform] = {
+    signature,
+    url: tier === "patch" ? `${PUBLIC_BASE}/${artifact.key}` : `${DOWNLOAD_BASE}/${artifact.key}`,
+  };
+  registrations.set(artifact.key, { artifactKey, path: artifact.key, ...metadata });
+}
+
+if (tier === "patch") {
+  for (const installer of installers) {
+    const file = path.resolve(root, installer.file);
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
+    if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
+  }
+}
+
+const version = config.version || target.updater.version;
+if (!version) fail(`${config.app} config must expose version or targets.${platform}.updater.version`);
+const body = {
+  appKey: config.app,
+  version,
+  channel: config.channel || "stable",
+  platform: null,
+  manifest: {
+    version,
+    tier,
+    notes: process.env.RIGHT_RELEASE_NOTES || `${config.app} ${version}`,
+    pub_date: new Date().toISOString(),
+    platforms,
+  },
+  artifacts: [...registrations.values()],
+};
+const route = tier === "patch" ? "/v1/admin/apps/patches" : "/v1/admin/apps/releases";
+console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
+console.log(JSON.stringify(body));
+
+if (!dryRun) {
+  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
+  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
+  const response = await fetch(`${API_BASE}${route}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
+    },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) fail(`registration failed: ${response.status} ${await response.text()}`);
+  console.log(await response.text());
+}
+
+async function fileMetadata(file) {
+  const bytes = await readFile(file);
+  return {
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    sizeBytes: (await stat(file)).size,
+  };
+}
+
+function run(cmd, runArgs, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, runArgs, { cwd, env: process.env, stdio: "inherit", windowsHide: true });
+    child.on("error", reject);
+    child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)));
+  });
+}
+
+function assertCurrentKey(key, kind) {
+  const pattern = kind === "installer"
+    ? /\/installers\/(?:mac|windows)\/current\//
+    : /\/updates\/(?:mac|windows)\/current\//;
+  if (!pattern.test(key)) {
+    fail(`${kind} key must target the replaceable current R2 object, got: ${key}`);
+  }
+}
+
+function fail(message) {
+  console.error(`publish-update: ${message}`);
+  process.exit(1);
+}