@rightkit/release 0.2.0

package/publish-update.test.mjs

@@ -0,0 +1,101 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const publisher = fileURLToPath(new URL("./publish-update.mjs", import.meta.url));
+
+function fixture() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
+  const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(config, `export default ${JSON.stringify({
+    schema: 1,
+    app: "fixture",
+    version: "1.2.3",
+    targets: {
+      win: {
+        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
+        updater: {
+          artifacts: [
+            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/updates/windows/current/Fixture.exe" },
+            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-arm64", key: "fixture/updates/windows/current/Fixture.exe" },
+          ],
+        },
+      },
+    },
+  })};\n`);
+  return config;
+}
+
+function versionedFixture() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
+  const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(config, `export default ${JSON.stringify({
+    schema: 1,
+    app: "fixture",
+    version: "1.2.3",
+    targets: {
+      win: {
+        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/1.2.3/Fixture-Setup.exe" }] },
+        updater: {
+          artifacts: [
+            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/1.2.3/windows/Fixture.exe" },
+          ],
+        },
+      },
+    },
+  })};\n`);
+  return config;
+}
+
+function run(tier) {
+  const config = fixture();
+  return spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_TIER: tier },
+  });
+}
+
+test("routes patch manifests to the public patch registration endpoint", () => {
+  const result = run("patch");
+  assert.equal(result.status, 0, result.stderr);
+  const updaterUpload = result.stdout.indexOf("UPLOAD public/fixture/updates/windows/current/Fixture.exe");
+  const installerUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture-Setup.exe");
+  const registration = result.stdout.indexOf("/v1/admin/apps/patches");
+  assert.ok(updaterUpload >= 0, "patch must upload a public updater");
+  assert.ok(installerUpload >= 0, "patch must upload a public installer");
+  assert.ok(updaterUpload < installerUpload, "patch should upload the updater before replacing the public installer");
+  assert.ok(installerUpload < registration, "patch should register only after uploads complete");
+  assert.equal(result.stdout.match(/UPLOAD public\/fixture\/updates\/windows\/current\/Fixture\.exe/g)?.length, 1);
+  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/updates\/windows\/current\/Fixture\.exe/);
+  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
+  assert.match(result.stdout, /"tier":"patch"/);
+});
+
+test("routes feature updates to the Pro-gated release endpoint", () => {
+  const result = run("update");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/releases/);
+  assert.match(result.stdout, /"tier":"update"/);
+  assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
+  assert.doesNotMatch(result.stdout, /Fixture-Setup\.exe/);
+});
+
+test("refuses to publish without a valid tier", () => {
+  const result = run("");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /RIGHT_RELEASE_TIER.*patch\|update/);
+});
+
+test("refuses versioned R2 object keys that would accumulate old releases", () => {
+  const config = versionedFixture();
+  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /current R2 object/);
+});

package/release.mjs

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+import { access, readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
+
+const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
+const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
+const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
+const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
+const VERSION = "0.2.0";
+const TIERS = new Set(["patch", "update"]);
+
+const args = process.argv.slice(2);
+const opts = {
+  config: "right-release.config.mjs",
+  platform: process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform,
+  upload: false,
+  install: false,
+  dryRun: false,
+  skipChecks: false,
+  skipHardening: false,
+  doctor: false,
+  tier: null,
+};
+
+for (let i = 0; i < args.length; i++) {
+  const arg = args[i];
+  if (arg === "--") continue;
+  else if (arg === "--config") opts.config = args[++i];
+  else if (arg === "--platform") opts.platform = args[++i];
+  else if (arg === "--upload" || arg === "--publish") opts.upload = true;
+  else if (arg === "--no-upload" || arg === "--package") opts.upload = false;
+  else if (arg === "--install") opts.install = true;
+  else if (arg === "--dry-run") opts.dryRun = true;
+  else if (arg === "--skip-checks") opts.skipChecks = true;
+  else if (arg === "--skip-hardening") opts.skipHardening = true;
+  else if (arg === "--doctor") opts.doctor = true;
+  else if (arg === "--tier") opts.tier = args[++i];
+  else if (arg.startsWith("--tier=")) opts.tier = arg.slice("--tier=".length);
+  else if (arg === "--version") {
+    console.log(VERSION);
+    process.exit(0);
+  }
+  else if (arg === "-h" || arg === "--help") usage(0);
+  else usage(2, `unknown argument: ${arg}`);
+}
+
+if (!opts.doctor && !opts.tier) usage(2, "--tier is required (patch|update)");
+if (opts.tier && !TIERS.has(opts.tier)) usage(2, `invalid --tier: ${opts.tier} (expected patch|update)`);
+
+const configPath = path.resolve(opts.config);
+const config = (await import(pathToFileURL(configPath))).default;
+if (!config) usage(2, `config did not export default: ${configPath}`);
+if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<missing>"} (expected 1)`);
+
+const root = path.dirname(configPath);
+const workdir = path.resolve(root, config.workdir ?? ".");
+const target = config.targets?.[opts.platform];
+if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
+if (target.signed !== true) {
+  fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
+}
+if (opts.platform === "win" && !target.sign?.files?.length) {
+  fail(`${config.app ?? "app"} win must declare sign.files for the signed release pipeline`);
+}
+if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
+if (opts.doctor) {
+  console.log(`right-release ${VERSION}`);
+  console.log(`config: ${configPath}`);
+  console.log(`app: ${config.app}`);
+  console.log(`platform: ${opts.platform}`);
+  console.log(`tier: ${opts.tier ?? "<required for release/publish>"}`);
+  console.log(`packageManager: ${config.packageManager}`);
+  console.log(`workdir: ${workdir}`);
+  console.log(`hardeningscan: ${HARDENING_SCAN}`);
+  if (target.sign?.files?.length) console.log(`sign: ${target.sign.files.join(", ")}`);
+  if (target.publishBlocked) console.log(`publishBlocked: ${target.publishBlocked}`);
+  process.exit(0);
+}
+
+const mode = opts.upload ? "publish" : "package";
+const command = target.package;
+if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (opts.upload && !target.publish && !target.upload) {
+  fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
+}
+
+const started = Date.now();
+console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier}`);
+
+if (opts.install) await runInstall(config.packageManager, workdir);
+if (!opts.skipChecks) {
+  for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
+}
+
+await runCommand(command, root);
+
+for (const rel of target.artifacts ?? []) {
+  await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
+}
+
+if (opts.platform === "win" && target.sign?.files?.length) {
+  const files = target.sign.files.map((p) => path.resolve(root, p));
+  for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
+  await run("node", [SIGN_WINDOWS, ...(opts.dryRun ? ["--dry-run"] : []), ...files], root);
+  const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => path.resolve(root, artifact.file)))];
+  if (!updaterFiles.length) fail(`${config.app} win must declare updater.artifacts for post-code-signing minisign`);
+  await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
+}
+
+if (target.postSign) {
+  await runCommand(target.postSign, root);
+}
+
+if (!opts.skipHardening) {
+  const scanTargets = target.hardening ?? target.artifacts ?? [];
+  if (scanTargets.length) {
+    await run("node", [HARDENING_SCAN, ...scanTargets.map((p) => path.resolve(root, p))], root);
+  }
+}
+
+if (opts.upload && target.publish) {
+  await runCommand(target.publish, root);
+}
+
+if (opts.upload && !target.publish) {
+  for (const item of target.upload ?? []) {
+    const file = path.resolve(root, item.file);
+    await mustExist(file, `missing upload artifact: ${item.file}`);
+    await run("node", [UPLOAD_LARGE, file, item.key, item.bucket ?? "public"], root);
+  }
+}
+
+console.log(`right-release: done (${Date.now() - started}ms)`);
+
+function usage(code, message) {
+  if (message) console.error(`right-release: ${message}\n`);
+  console.error("usage: node release.mjs --tier patch|update [--config right-release.config.mjs] [--platform mac|win] [--upload|--no-upload] [--install] [--dry-run] [--doctor]");
+  process.exit(code);
+}
+
+function fail(message) {
+  console.error(`right-release: ${message}`);
+  process.exit(1);
+}
+
+async function mustExist(file, message) {
+  if (opts.dryRun) return;
+  await access(file).catch(() => fail(message));
+}
+
+async function runInstall(pm, cwd) {
+  if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd);
+  else if (pm === "npm") await run("npm", ["ci"], cwd);
+  else fail(`unsupported package manager: ${pm}`);
+}
+
+async function runPackageScript(pm, script, cwd) {
+  if (script === false) return;
+  await run(pm, ["run", script], cwd);
+}
+
+async function runCommand(command, root) {
+  const cwd = path.resolve(root, command.cwd ?? ".");
+  await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), command);
+}
+
+async function commandEnv(command, root) {
+  const env = { ...(command.env ?? {}) };
+  for (const [name, rel] of Object.entries(command.envFiles ?? {})) {
+    if (opts.dryRun) continue;
+    env[name] = await readFile(path.resolve(root, expandEnv(rel)), "utf8");
+  }
+  return env;
+}
+
+function expandEnv(value) {
+  return String(value).replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? "");
+}
+
+function run(cmd, runArgs, cwd, env = {}, options = {}) {
+  const printable = `${cmd} ${runArgs.join(" ")}`.trim();
+  const releaseEnv = opts.tier ? { RIGHT_RELEASE_TIER: opts.tier } : {};
+  if (opts.dryRun) {
+    const timeout = options.timeoutMs ? ` timeout=${options.timeoutMs}ms` : "";
+    const tier = opts.tier ? `RIGHT_RELEASE_TIER=${opts.tier} ` : "";
+    console.log(`dry-run: (${cwd}) ${tier}${printable}${timeout}`);
+    return Promise.resolve();
+  }
+  const started = Date.now();
+  return new Promise((resolve) => {
+    const child = spawn(cmd, runArgs, {
+      cwd,
+      env: { ...process.env, ...releaseEnv, ...env },
+      stdio: "inherit",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    const timer = options.timeoutMs
+      ? setTimeout(() => {
+          killProcessTree(child.pid);
+          console.error(`right-release step timed out after ${Math.round(options.timeoutMs / 1000)}s: ${printable}`);
+          process.exit(1);
+        }, options.timeoutMs)
+      : null;
+    child.on("error", (error) => {
+      if (timer) clearTimeout(timer);
+      console.error(`right-release step failed to start: ${printable}`);
+      console.error(error.message);
+      process.exit(1);
+    });
+    child.on("exit", (code) => {
+      if (timer) clearTimeout(timer);
+      console.log(`right-release step: ${printable} (${Date.now() - started}ms)`);
+      if (code !== 0) process.exit(code ?? 1);
+      resolve();
+    });
+  });
+}
+
+function killProcessTree(pid) {
+  if (!pid) return;
+  if (process.platform === "win32") {
+    spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+      // already gone
+    }
+  }
+}

package/release.test.mjs

@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
+
+function fixture({ signed = true, publish = false } = {}) {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
+  const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(
+    config,
+    `export default ${JSON.stringify({
+      schema: 1,
+      app: "fixture",
+      packageManager: "pnpm",
+      checks: [],
+      targets: {
+        win: {
+          signed,
+          package: { cmd: "node", args: ["-e", "process.exit(0)"] },
+          ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
+          artifacts: [],
+          sign: { files: ["fixture.exe"] },
+          updater: { artifacts: [{ file: "fixture.exe", signature: "fixture.exe.sig", platform: "windows-x86_64", key: "fixture/fixture.exe" }] },
+          hardening: [],
+        },
+      },
+    })};\n`,
+  );
+  return config;
+}
+
+function run(config, ...args) {
+  return spawnSync(process.execPath, [release, "--config", config, "--platform", "win", "--dry-run", ...args], {
+    encoding: "utf8",
+  });
+}
+
+test("rejects a release without an explicit entitlement tier", () => {
+  const result = run(fixture());
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /--tier is required.*patch\|update/i);
+});
+
+test("accepts patch and exposes it to the signed package command", () => {
+  const result = run(fixture(), "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /tier=patch/);
+  assert.match(result.stdout, /RIGHT_RELEASE_TIER=patch/);
+});
+
+test("accepts update as the Pro-gated feature tier", () => {
+  const result = run(fixture(), "--tier", "update");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /tier=update/);
+  assert.match(result.stdout, /RIGHT_RELEASE_TIER=update/);
+});
+
+test("rejects an invalid entitlement tier", () => {
+  const result = run(fixture(), "--tier=minor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /invalid --tier.*patch\|update/i);
+});
+
+test("rejects targets that do not explicitly declare signed release output", () => {
+  const result = run(fixture({ signed: false }), "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /signed: true/);
+});
+
+test("publish runs the signed package step before the updater publication step", () => {
+  const result = run(fixture({ publish: true }), "--tier=update", "--upload");
+  assert.equal(result.status, 0, result.stderr);
+  const packageAt = result.stdout.indexOf("node -e process.exit(0)");
+  const publishAt = result.stdout.indexOf("node publish-update.mjs");
+  assert.ok(packageAt >= 0, result.stdout);
+  assert.ok(publishAt > packageAt, result.stdout);
+});
+
+test("Windows re-signs the updater artifact after Azure code signing", () => {
+  const result = run(fixture({ publish: true }), "--tier=patch", "--upload");
+  assert.equal(result.status, 0, result.stderr);
+  const azureAt = result.stdout.indexOf("sign-windows.mjs");
+  const updaterAt = result.stdout.indexOf("sign-updater.mjs");
+  const publishAt = result.stdout.indexOf("publish-update.mjs");
+  assert.ok(azureAt >= 0, result.stdout);
+  assert.ok(updaterAt > azureAt, result.stdout);
+  assert.ok(publishAt > updaterAt, result.stdout);
+});

package/right-suite-contract.test.mjs

@@ -0,0 +1,83 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import test from "node:test";
+
+const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
+const releasePackage = "^0.2.0";
+const apps = [
+  { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
+  { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },
+  { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", host: "heardright.app" },
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", host: "mailright.cc" },
+  { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", host: "coderight.cc" },
+];
+
+for (const app of apps) {
+  test(`${app.key} follows the signed tiered Right Release contract`, async () => {
+    const root = path.join(workspace, app.root);
+    const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+    assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
+    assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
+    assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));
+    assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
+    assert.equal(pkg.scripts["release:mac"], "right-release --platform mac");
+    assert.equal(pkg.scripts["release:win"], "right-release --platform win");
+    assert.equal(pkg.scripts["release:patch:mac"], "right-release --platform mac --tier patch");
+    assert.equal(pkg.scripts["release:patch:win"], "right-release --platform win --tier patch");
+    assert.equal(pkg.scripts["release:update:mac"], "right-release --platform mac --tier update");
+    assert.equal(pkg.scripts["release:update:win"], "right-release --platform win --tier update");
+    assert.equal(pkg.scripts["publish:patch:mac"], "right-release publish --platform mac --tier patch");
+    assert.equal(pkg.scripts["publish:patch:win"], "right-release publish --platform win --tier patch");
+    assert.equal(pkg.scripts["publish:update:mac"], "right-release publish --platform mac --tier update");
+    assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
+    assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
+    assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
+    assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/right-release"), `${app.key} scripts must not depend on the parent Claude workspace`);
+
+    const config = (await import(`${pathToFileURL(path.join(root, "right-release.config.mjs"))}?contract=${Date.now()}`)).default;
+    assert.equal(config.app, app.key);
+    assert.ok(config.version);
+    for (const platform of ["mac", "win"]) {
+      const target = config.targets[platform];
+      assert.equal(target.signed, true);
+      assert.equal(target.upload, undefined, "generic uploads bypass tier manifest routing");
+      assert.equal(target.publish.cmd, "right-release");
+      assert.match(target.publish.args.join(" "), /^publish-update\b/);
+      assert.ok(target.updater.artifacts.length);
+      assert.ok(target.installer.artifacts.length, "patch releases must refresh the public installer");
+      for (const installer of target.installer.artifacts) {
+        assert.match(installer.key, /\/installers\/(mac|windows)\/current\//, `${app.key} ${platform} installers must replace the stable current R2 object`);
+      }
+      for (const updater of target.updater.artifacts) {
+        assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
+      }
+    }
+    assert.ok(config.targets.win.sign.files.length);
+    const winUpdaterFiles = new Set(config.targets.win.updater.artifacts.map((artifact) => artifact.file));
+    for (const signed of config.targets.win.sign.files) assert.ok(winUpdaterFiles.has(signed), `${signed} must be both Azure-signed and updater-signed`);
+
+    const tauri = JSON.parse(readFileSync(path.join(root, app.tauri), "utf8"));
+    assert.equal(tauri.plugins.updater.pubkey, pubkey);
+    assert.deepEqual(tauri.plugins.updater.endpoints, [
+      `https://${app.host}/releases/patches.json`,
+      `https://${app.host}/releases/latest.json`,
+    ]);
+    assert.equal(tauri.bundle.createUpdaterArtifacts, true);
+  });
+}
+
+test("RightApps brand hosts expose app-keyed update manifest proxies", () => {
+  for (const app of apps) {
+    const siteRoot = path.join(workspace, "rightapps", app.key);
+    for (const route of ["patches", "latest"]) {
+      const routeFile = path.join(siteRoot, "src", "routes", "releases", `${route}.json`, "index.ts");
+      const source = readFileSync(routeFile, "utf8");
+      assert.match(source, new RegExp(`APP_KEY\\s*=\\s*["']${app.key}["']`), `${app.key} ${route}.json proxy must set the app key`);
+      assert.match(source, /RIGHTAPPS_API_URL/, `${app.key} ${route}.json proxy must use the configurable RightApps API base`);
+      assert.match(source, /x-app-key/i, `${app.key} ${route}.json proxy must forward the app key header`);
+    }
+  }
+});

package/sign-updater.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const args = process.argv.slice(2);
+const files = [];
+let dryRun = false;
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--file") files.push(path.resolve(args[++i]));
+  else if (args[i] === "--dry-run") dryRun = true;
+  else fail(`unknown argument: ${args[i]}`);
+}
+if (!files.length) fail("at least one --file is required");
+
+const env = { ...process.env };
+if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
+  if (process.platform === "win32") {
+    const key = path.join(env.APPDATA || "", "ViewRight", "updater.key");
+    if (!existsSync(key)) fail(`shared updater key not found: ${key}`);
+    env.TAURI_SIGNING_PRIVATE_KEY = readFileSync(key, "utf8");
+  } else if (process.platform === "darwin") {
+    try {
+      env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
+        "security",
+        ["find-generic-password", "-a", os.userInfo().username, "-s", "rightsuite-updater-key", "-w"],
+        { encoding: "utf8" },
+      ).trim();
+    } catch {
+      fail("shared updater key is missing from Keychain service rightsuite-updater-key");
+    }
+  } else {
+    fail("TAURI_SIGNING_PRIVATE_KEY is required on this platform");
+  }
+}
+env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ??= "";
+
+for (const file of files) {
+  if (!dryRun && !existsSync(file)) fail(`updater artifact not found: ${file}`);
+  rmSync(`${file}.sig`, { force: true });
+  console.log(`${dryRun ? "[dry-run] " : ""}pnpm exec tauri signer sign ${file}`);
+  if (dryRun) continue;
+  const result = spawnSync("pnpm", ["exec", "tauri", "signer", "sign", file], {
+    cwd: process.cwd(),
+    env,
+    stdio: "inherit",
+  });
+  if (result.status !== 0) process.exit(result.status ?? 1);
+}
+
+function fail(message) {
+  console.error(`sign-updater: ${message}`);
+  process.exit(1);
+}

package/sign-updater.test.mjs

@@ -0,0 +1,12 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const helper = fileURLToPath(new URL("./sign-updater.mjs", import.meta.url));
+
+test("dry-run signs the final OS-signed artifact with Tauri minisign", () => {
+  const result = spawnSync(process.execPath, [helper, "--file", "Fixture.exe", "--dry-run"], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /tauri signer sign .*Fixture\.exe/);
+});