@rightkit/release 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release.mjs

@@ -9,8 +9,14 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.0";
+const VERSION = "0.2.1";
 const TIERS = new Set(["patch", "update"]);
+const RIGHTKIT_EXPECTED = new Map([
+  ["@rightkit/license", "^0.1.3"],
+  ["@rightkit/logs", "^0.1.1"],
+  ["@rightkit/release", `^${VERSION}`],
+]);
+const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
 const args = process.argv.slice(2);
 const opts = {
@@ -57,6 +63,7 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
+await validateRightKitPackageContract(root, config.app);
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
 if (target.signed !== true) {
@@ -167,6 +174,28 @@ async function runCommand(command, root) {
   await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), command);
 }
 
+async function validateRightKitPackageContract(root, appName) {
+  const packageJsonPath = path.join(root, "package.json");
+  const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
+  const scripts = pkg.scripts ?? {};
+  if (JSON.stringify(scripts).includes("../tools/right-release")) {
+    fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not ../tools/right-release/*`);
+  }
+  const rightKitDeps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+  for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
+    if (FORBIDDEN_RIGHTKIT_SPEC.test(String(specifier))) {
+      fail(`${appName ?? pkg.name ?? "app"} ${name} must come from the published npm package, not ${specifier}`);
+    }
+    const expected = RIGHTKIT_EXPECTED.get(name);
+    if (expected && specifier !== expected) {
+      fail(`${appName ?? pkg.name ?? "app"} ${name} must be ${expected}, got ${specifier}`);
+    }
+  }
+  if (pkg.devDependencies?.["@rightkit/release"] !== RIGHTKIT_EXPECTED.get("@rightkit/release")) {
+    fail(`${appName ?? pkg.name ?? "app"} must depend on @rightkit/release ${RIGHTKIT_EXPECTED.get("@rightkit/release")} in devDependencies`);
+  }
+}
+
 async function commandEnv(command, root) {
   const env = { ...(command.env ?? {}) };
   for (const [name, rel] of Object.entries(command.envFiles ?? {})) {

package/release.test.mjs

@@ -8,9 +8,22 @@ import test from "node:test";
 
 const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
 
-function fixture({ signed = true, publish = false } = {}) {
+function fixture({ signed = true, publish = false, packageJson } = {}) {
   const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify(
+      packageJson ?? {
+        name: "fixture",
+        scripts: { "release:patch:win": "right-release --platform win --tier patch" },
+        dependencies: { "@rightkit/license": "^0.1.3", "@rightkit/logs": "^0.1.1" },
+        devDependencies: { "@rightkit/release": "^0.2.1" },
+      },
+      null,
+      2,
+    ),
+  );
   writeFileSync(
     config,
     `export default ${JSON.stringify({
@@ -72,6 +85,27 @@ test("rejects targets that do not explicitly declare signed release output", ()
   assert.match(result.stderr, /signed: true/);
 });
 
+test("rejects Git, path, or link RightKit app dependencies before release work starts", () => {
+  const result = run(
+    fixture({
+      packageJson: {
+        name: "fixture",
+        scripts: { "release:patch:win": "node ../tools/right-release/release.mjs --tier patch" },
+        dependencies: {
+          "@rightkit/license": "git+https://github.com/adrdsouza/rightkit.git#main",
+          "@rightkit/logs": "link:../../../rightkit/packages/logs",
+        },
+        devDependencies: {
+          "@rightkit/release": "github:adrdsouza/claude#main&path:/tools/right-release",
+        },
+      },
+    }),
+    "--tier=patch",
+  );
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /right-release bin|published npm package/i);
+});
+
 test("publish runs the signed package step before the updater publication step", () => {
   const result = run(fixture({ publish: true }), "--tier=update", "--upload");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -6,7 +6,9 @@ import test from "node:test";
 
 const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
-const releasePackage = "^0.2.0";
+const licensePackage = "^0.1.3";
+const logsPackage = "^0.1.1";
+const releasePackage = "^0.2.1";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },
@@ -19,6 +21,12 @@ for (const app of apps) {
   test(`${app.key} follows the signed tiered Right Release contract`, async () => {
     const root = path.join(workspace, app.root);
     const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+    const rightKitDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+    for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
+      assert.doesNotMatch(specifier, /^(?:git|file|link|workspace):|github/i, `${app.key} ${name} must come from the published npm package`);
+    }
+    if (rightKitDeps["@rightkit/license"]) assert.equal(rightKitDeps["@rightkit/license"], licensePackage);
+    if (rightKitDeps["@rightkit/logs"]) assert.equal(rightKitDeps["@rightkit/logs"], logsPackage);
     assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
     assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));