@rightkit/release 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-update.mjs

@@ -33,24 +33,80 @@ const root = path.dirname(configPath);
 const config = (await import(pathToFileURL(configPath))).default;
 const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
-if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} has no updater.artifacts`);
 const installers = target?.installer?.artifacts ?? [];
 
 if (tier === "patch") {
   if (!installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
+  if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} patch has no updater.artifacts for the free app-update manifest`);
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
     const file = path.resolve(root, installer.file);
     if (!dryRun) await access(file).catch(() => fail(`missing signed installer: ${installer.file}`));
   }
+  const platforms = {};
+  const registrations = new Map();
+  const uploadedKeys = new Set();
+  for (const artifact of artifacts) {
+    assertCurrentKey(artifact.key, "updater");
+    const installerKey = patchInstallerKey(artifact);
+    assertCurrentKey(installerKey, "installer");
+    const file = path.resolve(root, artifact.file);
+    const signatureFile = path.resolve(root, artifact.signature);
+    if (!dryRun) {
+      await access(file).catch(() => fail(`missing patch updater payload: ${artifact.file}`));
+      await access(signatureFile).catch(() => fail(`missing patch updater signature: ${artifact.signature}`));
+    }
+    if (!uploadedKeys.has(installerKey)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}`);
+      if (!dryRun) await run(process.execPath, [UPLOAD, file, installerKey, "public"], root);
+      uploadedKeys.add(installerKey);
+    }
+    const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
+    const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
+    const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
+    platforms[artifact.platform] = {
+      signature,
+      url: `${PUBLIC_BASE}/${installerKey}`,
+    };
+    registrations.set(installerKey, { artifactKey, path: installerKey, ...metadata });
+  }
+  for (const installer of installers) {
+    const file = path.resolve(root, installer.file);
+    if (!uploadedKeys.has(installer.key)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
+      if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
+      uploadedKeys.add(installer.key);
+    }
+  }
+  const version = config.version || target.updater.version;
+  if (!version) fail(`${config.app} config must expose version or targets.${platform}.updater.version`);
+  const body = {
+    appKey: config.app,
+    version,
+    channel: config.channel || "stable",
+    platform: null,
+    manifest: {
+      version,
+      tier,
+      notes: process.env.RIGHT_RELEASE_NOTES || `${config.app} ${version}`,
+      pub_date: new Date().toISOString(),
+      platforms,
+    },
+    artifacts: [...registrations.values()],
+  };
+  console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}/v1/admin/apps/patches`);
+  console.log(JSON.stringify(body));
+  if (!dryRun) await register("/v1/admin/apps/patches", body);
+  process.exit(0);
 }
 
+if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
+
 const platforms = {};
 const registrations = new Map();
 const uploadedKeys = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
-  const bucket = tier === "patch" ? "public" : "private";
   const file = path.resolve(root, artifact.file);
   const signatureFile = path.resolve(root, artifact.signature);
   if (!dryRun) {
@@ -58,8 +114,8 @@ for (const artifact of artifacts) {
     await access(signatureFile).catch(() => fail(`missing updater signature: ${artifact.signature}`));
   }
   if (!uploadedKeys.has(artifact.key)) {
-    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD ${bucket}/${artifact.key}`);
-    if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, bucket], root);
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`);
+    if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);
     uploadedKeys.add(artifact.key);
   }
 
@@ -68,19 +124,11 @@ for (const artifact of artifacts) {
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
   platforms[artifact.platform] = {
     signature,
-    url: tier === "patch" ? `${PUBLIC_BASE}/${artifact.key}` : `${DOWNLOAD_BASE}/${artifact.key}`,
+    url: `${DOWNLOAD_BASE}/${artifact.key}`,
   };
   registrations.set(artifact.key, { artifactKey, path: artifact.key, ...metadata });
 }
 
-if (tier === "patch") {
-  for (const installer of installers) {
-    const file = path.resolve(root, installer.file);
-    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
-    if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
-  }
-}
-
 const version = config.version || target.updater.version;
 if (!version) fail(`${config.app} config must expose version or targets.${platform}.updater.version`);
 const body = {
@@ -97,25 +145,11 @@ const body = {
   },
   artifacts: [...registrations.values()],
 };
-const route = tier === "patch" ? "/v1/admin/apps/patches" : "/v1/admin/apps/releases";
+const route = "/v1/admin/apps/releases";
 console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
 console.log(JSON.stringify(body));
 
-if (!dryRun) {
-  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
-  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
-  const response = await fetch(`${API_BASE}${route}`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      "content-type": "application/json",
-      "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
-    },
-    body: JSON.stringify(body),
-  });
-  if (!response.ok) fail(`registration failed: ${response.status} ${await response.text()}`);
-  console.log(await response.text());
-}
+if (!dryRun) await register(route, body);
 
 async function fileMetadata(file) {
   const bytes = await readFile(file);
@@ -142,6 +176,28 @@ function assertCurrentKey(key, kind) {
   }
 }
 
+function patchInstallerKey(artifact) {
+  if (artifact.patchKey) return artifact.patchKey;
+  if (!artifact.key.includes("/updates/")) fail(`patch updater key must be convertible to installers/current, got: ${artifact.key}`);
+  return artifact.key.replace("/updates/", "/installers/");
+}
+
+async function register(route, body) {
+  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
+  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
+  const response = await fetch(`${API_BASE}${route}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
+    },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) fail(`registration failed: ${response.status} ${await response.text()}`);
+  console.log(await response.text());
+}
+
 function fail(message) {
   console.error(`publish-update: ${message}`);
   process.exit(1);

package/publish-update.test.mjs

@@ -59,18 +59,19 @@ function run(tier) {
   });
 }
 
-test("routes patch manifests to the public patch registration endpoint", () => {
+test("patch registers a free updater manifest backed by public installer-path objects", () => {
   const result = run("patch");
   assert.equal(result.status, 0, result.stderr);
-  const updaterUpload = result.stdout.indexOf("UPLOAD public/fixture/updates/windows/current/Fixture.exe");
+  const patchPayloadUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture.exe");
   const installerUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture-Setup.exe");
   const registration = result.stdout.indexOf("/v1/admin/apps/patches");
-  assert.ok(updaterUpload >= 0, "patch must upload a public updater");
-  assert.ok(installerUpload >= 0, "patch must upload a public installer");
-  assert.ok(updaterUpload < installerUpload, "patch should upload the updater before replacing the public installer");
+  assert.ok(patchPayloadUpload >= 0, "patch updater payload must upload to the public installer path");
+  assert.ok(installerUpload >= 0, "patch download installer must upload to the public installer path");
+  assert.ok(patchPayloadUpload < installerUpload, "patch should upload app-update payloads before replacing the public download installer");
   assert.ok(installerUpload < registration, "patch should register only after uploads complete");
-  assert.equal(result.stdout.match(/UPLOAD public\/fixture\/updates\/windows\/current\/Fixture\.exe/g)?.length, 1);
-  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/updates\/windows\/current\/Fixture\.exe/);
+  assert.doesNotMatch(result.stdout, /UPLOAD public\/fixture\/updates\//);
+  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
+  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
   assert.match(result.stdout, /"tier":"patch"/);
 });
@@ -99,3 +100,13 @@ test("refuses versioned R2 object keys that would accumulate old releases", () =
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /current R2 object/);
 });
+
+test("refuses versioned updater object keys for gated feature updates", () => {
+  const config = versionedFixture();
+  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_TIER: "update" },
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /current R2 object/);
+});

package/release.mjs

@@ -9,7 +9,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.1";
+const VERSION = "0.2.3";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.3"],

package/release.test.mjs

@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.3", "@rightkit/logs": "^0.1.1" },
-        devDependencies: { "@rightkit/release": "^0.2.1" },
+        devDependencies: { "@rightkit/release": "^0.2.3" },
       },
       null,
       2,
@@ -115,7 +115,7 @@ test("publish runs the signed package step before the updater publication step",
   assert.ok(publishAt > packageAt, result.stdout);
 });
 
-test("Windows re-signs the updater artifact after Azure code signing", () => {
+test("Windows patch signs the installer then minisigns the free updater payload", () => {
   const result = run(fixture({ publish: true }), "--tier=patch", "--upload");
   assert.equal(result.status, 0, result.stderr);
   const azureAt = result.stdout.indexOf("sign-windows.mjs");
@@ -125,3 +125,14 @@ test("Windows re-signs the updater artifact after Azure code signing", () => {
   assert.ok(updaterAt > azureAt, result.stdout);
   assert.ok(publishAt > updaterAt, result.stdout);
 });
+
+test("Windows update re-signs the updater artifact after Azure code signing", () => {
+  const result = run(fixture({ publish: true }), "--tier=update", "--upload");
+  assert.equal(result.status, 0, result.stderr);
+  const azureAt = result.stdout.indexOf("sign-windows.mjs");
+  const updaterAt = result.stdout.indexOf("sign-updater.mjs");
+  const publishAt = result.stdout.indexOf("publish-update.mjs");
+  assert.ok(azureAt >= 0, result.stdout);
+  assert.ok(updaterAt > azureAt, result.stdout);
+  assert.ok(publishAt > updaterAt, result.stdout);
+});

package/right-suite-contract.test.mjs

@@ -8,7 +8,7 @@ const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replac
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.3";
 const logsPackage = "^0.1.1";
-const releasePackage = "^0.2.1";
+const releasePackage = "^0.2.3";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },

package/upload-large.mjs

@@ -1,74 +1,63 @@
 #!/usr/bin/env node
-import { createReadStream, statSync } from "node:fs";
+import { accessSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev";
-const PART_SIZE = 90 * 1024 * 1024;
+const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = new Map([
+  ["public", "rightapps-downloads"],
+  ["private", "rightapps-updates"],
+]);
 
-const [, , localFile, r2Key, bucket = "public"] = process.argv;
+const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
   console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
   process.exit(1);
 }
 
-const token = process.env.ADMIN_UPLOAD_TOKEN || readKeychainToken();
-if (!token) {
-  console.error("ADMIN_UPLOAD_TOKEN not set and no Keychain token found");
+const bucket = BUCKETS.get(bucketAlias);
+if (!bucket) {
+  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
+  process.exit(1);
+}
+
+try {
+  accessSync(localFile);
+} catch {
+  console.error(`upload-large: missing local file: ${localFile}`);
   process.exit(1);
 }
 
-const headers = { Authorization: `Bearer ${token}` };
 const fileSize = statSync(localFile).size;
+const object = `${bucket}/${r2Key}`;
+const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
+const env = cleanCloudflareEnv(process.env);
 
-async function api(method, pathname, body, isJson = true) {
-  const opts = {
-    method,
-    headers: isJson
-      ? { ...headers, "Content-Type": "application/json" }
-      : { ...headers, "Content-Type": "application/octet-stream" },
-  };
-  if (body != null) opts.body = isJson ? JSON.stringify(body) : body;
-  const resp = await fetch(`${WORKER_BASE}${pathname}`, opts);
-  const text = await resp.text();
-  if (!resp.ok) throw new Error(`${method} ${pathname} -> ${resp.status}: ${text}`);
-  return JSON.parse(text);
-}
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
+console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
 
-async function readChunk(offset, size) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    const stream = createReadStream(localFile, { start: offset, end: offset + size - 1 });
-    stream.on("data", (c) => chunks.push(c));
-    stream.on("end", () => resolve(Buffer.concat(chunks)));
-    stream.on("error", reject);
-  });
+if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
+  process.exit(0);
 }
 
-console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${bucket}/${r2Key}`);
-const { uploadId } = await api("POST", "/admin/multipart/init", { key: r2Key, bucket });
-const parts = [];
-const totalParts = Math.ceil(fileSize / PART_SIZE);
-for (let i = 0; i < totalParts; i++) {
-  const offset = i * PART_SIZE;
-  const size = Math.min(PART_SIZE, fileSize - offset);
-  const partNumber = i + 1;
-  const chunk = await readChunk(offset, size);
-  const params = `?uploadId=${encodeURIComponent(uploadId)}&key=${encodeURIComponent(r2Key)}&bucket=${bucket}`;
-  const { etag } = await api("PUT", `/admin/multipart/part/${partNumber}${params}`, chunk, false);
-  parts.push({ partNumber, etag });
-  console.log(`  part ${partNumber}/${totalParts}`);
-}
-await api("POST", "/admin/multipart/complete", { uploadId, key: r2Key, bucket, parts });
-console.log(`Done. ${r2Key} uploaded to ${bucket}.`);
+const result = spawnSync("npx", wranglerArgs, {
+  env,
+  stdio: "inherit",
+  shell: process.platform === "win32",
+  windowsHide: true,
+});
 
-function readKeychainToken() {
-  if (process.platform !== "darwin") return "";
-  for (const service of ["rightapps-admin-upload-token", "heardright-admin-upload-token"]) {
-    const result = spawnSync("security", ["find-generic-password", "-a", process.env.USER || "", "-s", service, "-w"], {
-      encoding: "utf8",
-    });
-    if (result.status === 0 && result.stdout.trim()) return result.stdout.trim();
-  }
-  return "";
+if (result.error) {
+  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(result.status ?? 1);
+
+function cleanCloudflareEnv(source) {
+  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
+  delete env.CLOUDFLARE_API_KEY;
+  delete env.CLOUDFLARE_EMAIL;
+  delete env.CF_API_KEY;
+  delete env.CF_EMAIL;
+  return env;
 }

package/upload-large.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const uploader = fileURLToPath(new URL("./upload-large.mjs", import.meta.url));
+
+function fixtureFile() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-upload-test-"));
+  const file = path.join(dir, "Artifact.exe");
+  writeFileSync(file, "artifact");
+  return file;
+}
+
+function run(bucket) {
+  return spawnSync(process.execPath, [uploader, fixtureFile(), "fixture/updates/windows/current/Artifact.exe", bucket], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1" },
+  });
+}
+
+test("uploads public artifacts through wrangler remote R2 downloads bucket", () => {
+  const result = run("public");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /wrangler r2 object put rightapps-downloads\/fixture\/updates\/windows\/current\/Artifact\.exe/);
+  assert.match(result.stdout, /--remote/);
+  assert.doesNotMatch(result.stdout, /workers\.dev|multipart|heardright-models/i);
+});
+
+test("uploads private artifacts through wrangler remote R2 updates bucket", () => {
+  const result = run("private");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /wrangler r2 object put rightapps-updates\/fixture\/updates\/windows\/current\/Artifact\.exe/);
+  assert.match(result.stdout, /--remote/);
+});
+
+test("refuses unknown bucket aliases", () => {
+  const result = run("random");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /expected public\|private/);
+});