@rightkit/release 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release.mjs

@@ -9,8 +9,14 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.0";
+const VERSION = "0.2.2";
 const TIERS = new Set(["patch", "update"]);
+const RIGHTKIT_EXPECTED = new Map([
+  ["@rightkit/license", "^0.1.3"],
+  ["@rightkit/logs", "^0.1.1"],
+  ["@rightkit/release", `^${VERSION}`],
+]);
+const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
 const args = process.argv.slice(2);
 const opts = {
@@ -57,6 +63,7 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
+await validateRightKitPackageContract(root, config.app);
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
 if (target.signed !== true) {
@@ -167,6 +174,28 @@ async function runCommand(command, root) {
   await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), command);
 }
 
+async function validateRightKitPackageContract(root, appName) {
+  const packageJsonPath = path.join(root, "package.json");
+  const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
+  const scripts = pkg.scripts ?? {};
+  if (JSON.stringify(scripts).includes("../tools/right-release")) {
+    fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not ../tools/right-release/*`);
+  }
+  const rightKitDeps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+  for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
+    if (FORBIDDEN_RIGHTKIT_SPEC.test(String(specifier))) {
+      fail(`${appName ?? pkg.name ?? "app"} ${name} must come from the published npm package, not ${specifier}`);
+    }
+    const expected = RIGHTKIT_EXPECTED.get(name);
+    if (expected && specifier !== expected) {
+      fail(`${appName ?? pkg.name ?? "app"} ${name} must be ${expected}, got ${specifier}`);
+    }
+  }
+  if (pkg.devDependencies?.["@rightkit/release"] !== RIGHTKIT_EXPECTED.get("@rightkit/release")) {
+    fail(`${appName ?? pkg.name ?? "app"} must depend on @rightkit/release ${RIGHTKIT_EXPECTED.get("@rightkit/release")} in devDependencies`);
+  }
+}
+
 async function commandEnv(command, root) {
   const env = { ...(command.env ?? {}) };
   for (const [name, rel] of Object.entries(command.envFiles ?? {})) {

package/release.test.mjs

@@ -8,9 +8,22 @@ import test from "node:test";
 
 const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
 
-function fixture({ signed = true, publish = false } = {}) {
+function fixture({ signed = true, publish = false, packageJson } = {}) {
   const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify(
+      packageJson ?? {
+        name: "fixture",
+        scripts: { "release:patch:win": "right-release --platform win --tier patch" },
+        dependencies: { "@rightkit/license": "^0.1.3", "@rightkit/logs": "^0.1.1" },
+        devDependencies: { "@rightkit/release": "^0.2.2" },
+      },
+      null,
+      2,
+    ),
+  );
   writeFileSync(
     config,
     `export default ${JSON.stringify({
@@ -72,6 +85,27 @@ test("rejects targets that do not explicitly declare signed release output", ()
   assert.match(result.stderr, /signed: true/);
 });
 
+test("rejects Git, path, or link RightKit app dependencies before release work starts", () => {
+  const result = run(
+    fixture({
+      packageJson: {
+        name: "fixture",
+        scripts: { "release:patch:win": "node ../tools/right-release/release.mjs --tier patch" },
+        dependencies: {
+          "@rightkit/license": "git+https://github.com/adrdsouza/rightkit.git#main",
+          "@rightkit/logs": "link:../../../rightkit/packages/logs",
+        },
+        devDependencies: {
+          "@rightkit/release": "github:adrdsouza/claude#main&path:/tools/right-release",
+        },
+      },
+    }),
+    "--tier=patch",
+  );
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /right-release bin|published npm package/i);
+});
+
 test("publish runs the signed package step before the updater publication step", () => {
   const result = run(fixture({ publish: true }), "--tier=update", "--upload");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -6,7 +6,9 @@ import test from "node:test";
 
 const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
-const releasePackage = "^0.2.0";
+const licensePackage = "^0.1.3";
+const logsPackage = "^0.1.1";
+const releasePackage = "^0.2.2";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },
@@ -19,6 +21,12 @@ for (const app of apps) {
   test(`${app.key} follows the signed tiered Right Release contract`, async () => {
     const root = path.join(workspace, app.root);
     const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+    const rightKitDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+    for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
+      assert.doesNotMatch(specifier, /^(?:git|file|link|workspace):|github/i, `${app.key} ${name} must come from the published npm package`);
+    }
+    if (rightKitDeps["@rightkit/license"]) assert.equal(rightKitDeps["@rightkit/license"], licensePackage);
+    if (rightKitDeps["@rightkit/logs"]) assert.equal(rightKitDeps["@rightkit/logs"], logsPackage);
     assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
     assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));

package/upload-large.mjs

@@ -1,74 +1,63 @@
 #!/usr/bin/env node
-import { createReadStream, statSync } from "node:fs";
+import { accessSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev";
-const PART_SIZE = 90 * 1024 * 1024;
+const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = new Map([
+  ["public", "rightapps-downloads"],
+  ["private", "rightapps-updates"],
+]);
 
-const [, , localFile, r2Key, bucket = "public"] = process.argv;
+const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
   console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
   process.exit(1);
 }
 
-const token = process.env.ADMIN_UPLOAD_TOKEN || readKeychainToken();
-if (!token) {
-  console.error("ADMIN_UPLOAD_TOKEN not set and no Keychain token found");
+const bucket = BUCKETS.get(bucketAlias);
+if (!bucket) {
+  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
+  process.exit(1);
+}
+
+try {
+  accessSync(localFile);
+} catch {
+  console.error(`upload-large: missing local file: ${localFile}`);
   process.exit(1);
 }
 
-const headers = { Authorization: `Bearer ${token}` };
 const fileSize = statSync(localFile).size;
+const object = `${bucket}/${r2Key}`;
+const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
+const env = cleanCloudflareEnv(process.env);
 
-async function api(method, pathname, body, isJson = true) {
-  const opts = {
-    method,
-    headers: isJson
-      ? { ...headers, "Content-Type": "application/json" }
-      : { ...headers, "Content-Type": "application/octet-stream" },
-  };
-  if (body != null) opts.body = isJson ? JSON.stringify(body) : body;
-  const resp = await fetch(`${WORKER_BASE}${pathname}`, opts);
-  const text = await resp.text();
-  if (!resp.ok) throw new Error(`${method} ${pathname} -> ${resp.status}: ${text}`);
-  return JSON.parse(text);
-}
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
+console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
 
-async function readChunk(offset, size) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    const stream = createReadStream(localFile, { start: offset, end: offset + size - 1 });
-    stream.on("data", (c) => chunks.push(c));
-    stream.on("end", () => resolve(Buffer.concat(chunks)));
-    stream.on("error", reject);
-  });
+if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
+  process.exit(0);
 }
 
-console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${bucket}/${r2Key}`);
-const { uploadId } = await api("POST", "/admin/multipart/init", { key: r2Key, bucket });
-const parts = [];
-const totalParts = Math.ceil(fileSize / PART_SIZE);
-for (let i = 0; i < totalParts; i++) {
-  const offset = i * PART_SIZE;
-  const size = Math.min(PART_SIZE, fileSize - offset);
-  const partNumber = i + 1;
-  const chunk = await readChunk(offset, size);
-  const params = `?uploadId=${encodeURIComponent(uploadId)}&key=${encodeURIComponent(r2Key)}&bucket=${bucket}`;
-  const { etag } = await api("PUT", `/admin/multipart/part/${partNumber}${params}`, chunk, false);
-  parts.push({ partNumber, etag });
-  console.log(`  part ${partNumber}/${totalParts}`);
-}
-await api("POST", "/admin/multipart/complete", { uploadId, key: r2Key, bucket, parts });
-console.log(`Done. ${r2Key} uploaded to ${bucket}.`);
+const result = spawnSync("npx", wranglerArgs, {
+  env,
+  stdio: "inherit",
+  shell: process.platform === "win32",
+  windowsHide: true,
+});
 
-function readKeychainToken() {
-  if (process.platform !== "darwin") return "";
-  for (const service of ["rightapps-admin-upload-token", "heardright-admin-upload-token"]) {
-    const result = spawnSync("security", ["find-generic-password", "-a", process.env.USER || "", "-s", service, "-w"], {
-      encoding: "utf8",
-    });
-    if (result.status === 0 && result.stdout.trim()) return result.stdout.trim();
-  }
-  return "";
+if (result.error) {
+  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(result.status ?? 1);
+
+function cleanCloudflareEnv(source) {
+  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
+  delete env.CLOUDFLARE_API_KEY;
+  delete env.CLOUDFLARE_EMAIL;
+  delete env.CF_API_KEY;
+  delete env.CF_EMAIL;
+  return env;
 }

package/upload-large.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const uploader = fileURLToPath(new URL("./upload-large.mjs", import.meta.url));
+
+function fixtureFile() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-upload-test-"));
+  const file = path.join(dir, "Artifact.exe");
+  writeFileSync(file, "artifact");
+  return file;
+}
+
+function run(bucket) {
+  return spawnSync(process.execPath, [uploader, fixtureFile(), "fixture/updates/windows/current/Artifact.exe", bucket], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1" },
+  });
+}
+
+test("uploads public artifacts through wrangler remote R2 downloads bucket", () => {
+  const result = run("public");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /wrangler r2 object put rightapps-downloads\/fixture\/updates\/windows\/current\/Artifact\.exe/);
+  assert.match(result.stdout, /--remote/);
+  assert.doesNotMatch(result.stdout, /workers\.dev|multipart|heardright-models/i);
+});
+
+test("uploads private artifacts through wrangler remote R2 updates bucket", () => {
+  const result = run("private");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /wrangler r2 object put rightapps-updates\/fixture\/updates\/windows\/current\/Artifact\.exe/);
+  assert.match(result.stdout, /--remote/);
+});
+
+test("refuses unknown bucket aliases", () => {
+  const result = run("random");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /expected public\|private/);
+});