@rightkit/release 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release.mjs

@@ -9,7 +9,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.1";
+const VERSION = "0.2.2";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.3"],

package/release.test.mjs

@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.3", "@rightkit/logs": "^0.1.1" },
-        devDependencies: { "@rightkit/release": "^0.2.1" },
+        devDependencies: { "@rightkit/release": "^0.2.2" },
       },
       null,
       2,

package/right-suite-contract.test.mjs

@@ -8,7 +8,7 @@ const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replac
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.3";
 const logsPackage = "^0.1.1";
-const releasePackage = "^0.2.1";
+const releasePackage = "^0.2.2";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },

package/upload-large.mjs

@@ -1,74 +1,63 @@
 #!/usr/bin/env node
-import { createReadStream, statSync } from "node:fs";
+import { accessSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev";
-const PART_SIZE = 90 * 1024 * 1024;
+const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = new Map([
+  ["public", "rightapps-downloads"],
+  ["private", "rightapps-updates"],
+]);
 
-const [, , localFile, r2Key, bucket = "public"] = process.argv;
+const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
   console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
   process.exit(1);
 }
 
-const token = process.env.ADMIN_UPLOAD_TOKEN || readKeychainToken();
-if (!token) {
-  console.error("ADMIN_UPLOAD_TOKEN not set and no Keychain token found");
+const bucket = BUCKETS.get(bucketAlias);
+if (!bucket) {
+  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
+  process.exit(1);
+}
+
+try {
+  accessSync(localFile);
+} catch {
+  console.error(`upload-large: missing local file: ${localFile}`);
   process.exit(1);
 }
 
-const headers = { Authorization: `Bearer ${token}` };
 const fileSize = statSync(localFile).size;
+const object = `${bucket}/${r2Key}`;
+const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
+const env = cleanCloudflareEnv(process.env);
 
-async function api(method, pathname, body, isJson = true) {
-  const opts = {
-    method,
-    headers: isJson
-      ? { ...headers, "Content-Type": "application/json" }
-      : { ...headers, "Content-Type": "application/octet-stream" },
-  };
-  if (body != null) opts.body = isJson ? JSON.stringify(body) : body;
-  const resp = await fetch(`${WORKER_BASE}${pathname}`, opts);
-  const text = await resp.text();
-  if (!resp.ok) throw new Error(`${method} ${pathname} -> ${resp.status}: ${text}`);
-  return JSON.parse(text);
-}
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
+console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
 
-async function readChunk(offset, size) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    const stream = createReadStream(localFile, { start: offset, end: offset + size - 1 });
-    stream.on("data", (c) => chunks.push(c));
-    stream.on("end", () => resolve(Buffer.concat(chunks)));
-    stream.on("error", reject);
-  });
+if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
+  process.exit(0);
 }
 
-console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${bucket}/${r2Key}`);
-const { uploadId } = await api("POST", "/admin/multipart/init", { key: r2Key, bucket });
-const parts = [];
-const totalParts = Math.ceil(fileSize / PART_SIZE);
-for (let i = 0; i < totalParts; i++) {
-  const offset = i * PART_SIZE;
-  const size = Math.min(PART_SIZE, fileSize - offset);
-  const partNumber = i + 1;
-  const chunk = await readChunk(offset, size);
-  const params = `?uploadId=${encodeURIComponent(uploadId)}&key=${encodeURIComponent(r2Key)}&bucket=${bucket}`;
-  const { etag } = await api("PUT", `/admin/multipart/part/${partNumber}${params}`, chunk, false);
-  parts.push({ partNumber, etag });
-  console.log(`  part ${partNumber}/${totalParts}`);
-}
-await api("POST", "/admin/multipart/complete", { uploadId, key: r2Key, bucket, parts });
-console.log(`Done. ${r2Key} uploaded to ${bucket}.`);
+const result = spawnSync("npx", wranglerArgs, {
+  env,
+  stdio: "inherit",
+  shell: process.platform === "win32",
+  windowsHide: true,
+});
 
-function readKeychainToken() {
-  if (process.platform !== "darwin") return "";
-  for (const service of ["rightapps-admin-upload-token", "heardright-admin-upload-token"]) {
-    const result = spawnSync("security", ["find-generic-password", "-a", process.env.USER || "", "-s", service, "-w"], {
-      encoding: "utf8",
-    });
-    if (result.status === 0 && result.stdout.trim()) return result.stdout.trim();
-  }
-  return "";
+if (result.error) {
+  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(result.status ?? 1);
+
+function cleanCloudflareEnv(source) {
+  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
+  delete env.CLOUDFLARE_API_KEY;
+  delete env.CLOUDFLARE_EMAIL;
+  delete env.CF_API_KEY;
+  delete env.CF_EMAIL;
+  return env;
 }

package/upload-large.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const uploader = fileURLToPath(new URL("./upload-large.mjs", import.meta.url));
+
+function fixtureFile() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-upload-test-"));
+  const file = path.join(dir, "Artifact.exe");
+  writeFileSync(file, "artifact");
+  return file;
+}
+
+function run(bucket) {
+  return spawnSync(process.execPath, [uploader, fixtureFile(), "fixture/updates/windows/current/Artifact.exe", bucket], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1" },
+  });
+}
+
+test("uploads public artifacts through wrangler remote R2 downloads bucket", () => {
+  const result = run("public");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /wrangler r2 object put rightapps-downloads\/fixture\/updates\/windows\/current\/Artifact\.exe/);
+  assert.match(result.stdout, /--remote/);
+  assert.doesNotMatch(result.stdout, /workers\.dev|multipart|heardright-models/i);
+});
+
+test("uploads private artifacts through wrangler remote R2 updates bucket", () => {
+  const result = run("private");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /wrangler r2 object put rightapps-updates\/fixture\/updates\/windows\/current\/Artifact\.exe/);
+  assert.match(result.stdout, /--remote/);
+});
+
+test("refuses unknown bucket aliases", () => {
+  const result = run("random");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /expected public\|private/);
+});