@rightkit/release 0.2.102 → 0.2.104

package/direct-bootstrap.mjs

@@ -22,6 +22,23 @@ export function sha256File(path) {
   return createHash("sha256").update(readFileSync(path)).digest("hex");
 }
 
+// The RightRelease PowerShell bootstrap is still generated and published to R2
+// as the branded installer's outer verifier. It must not be embedded into the
+// Membrane Tauri NSIS installer resource set: Section Install now lays the
+// versioned payload down and runs `membrane activate` directly (see
+// docs/MEMBRANE-INSTALLER-SIMPLIFICATION-CONTRACT-2026-09-02.md). This guard
+// throws loudly if anyone re-wires the payload into that resource set.
+export function assertBootstrapNotEmbeddedInNsis(product, resourceNames) {
+  if (product !== "membrane") return;
+  const embedded = [...(resourceNames ?? [])].filter((name) => /(^|[\\/])install\.ps1$/i.test(String(name)));
+  if (embedded.length) {
+    throw new Error(
+      `RightRelease bootstrap install.ps1 must not be embedded into the Membrane NSIS installer (${embedded.join(", ")}); ` +
+        "Section Install activates the release directly. See MEMBRANE-INSTALLER-SIMPLIFICATION-CONTRACT-2026-09-02.",
+    );
+  }
+}
+
 export function collectReleaseAsset({
   target,
   name,

package/nsis-upgrade-contract.mjs

@@ -33,16 +33,22 @@ export function assertNsisInPlaceUpgradeContract(appRoot, options = {}) {
       "Windows NSIS template must declare the RightKit automatic in-place upgrade policy; uninstall/reinstall maintenance choices add unnecessary friction",
     );
   }
-  if (
-    !/\$\{If\}\s+\$WixMode\s*=\s*0[\s\S]{0,160}\$\{AndIf\}\s+\$R0\s*>=\s*0[\s\S]{0,80}\bAbort\b/.test(
+  // Two acceptable shapes:
+  //  - legacy: Tauri's reinstall page is present but skipped for same-version
+  //    repair and in-place upgrades (the $WixMode / $R0 skip logic);
+  //  - no maintenance surface at all: the template declares no reinstall page,
+  //    no components page and no custom page, so there is nothing to skip.
+  const legacySkipLogic =
+    /\$\{If\}\s+\$WixMode\s*=\s*0[\s\S]{0,160}\$\{AndIf\}\s+\$R0\s*>=\s*0[\s\S]{0,80}\bAbort\b/.test(
       source,
-    )
-  ) {
+    );
+  const maintenanceSurface = /\bPageReinstall\b|MUI_PAGE_COMPONENTS|^\s*Page\s+custom\b/m.test(source);
+  if (!legacySkipLogic && maintenanceSurface) {
     throw new Error(
-      "Windows NSIS template is missing skip-page logic for same-version repair and in-place upgrades",
+      "Windows NSIS template has a reinstall or maintenance page without skip-page logic for same-version repair and in-place upgrades",
     );
   }
-  return { templatePath };
+  return { templatePath, shape: legacySkipLogic ? "legacy-skip-page" : "no-maintenance-page" };
 }
 
 function readJson(file, label) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.102",
+  "version": "0.2.104",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -726,7 +726,10 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     // (Windows) and macos-sign (macOS), so publish is unreachable unless every
     // signing/qualification stage actually verified in this exact run.
     const legacyReleasePublishGate = /publish:\n    needs: \[[^\n]*installed-qualification[^\n]*\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) && needs\.installed-qualification\.result == 'success'/.test(publishSource);
-    const admittedReleasePublishGate = /publish:\n    needs: \[(?=[^\n]*\badmission\b)(?=[^\n]*\binstalled-qualification\b)(?=[^\n]*\bmacos-sign\b)[^\n]*\]\n    if: \$\{\{ needs\.admission\.outputs\.publish == 'true' && needs\.installed-qualification\.result == 'success' && needs\.macos-sign\.result == 'success' \}\}/.test(publishSource);
+    // Template 1.9.0 adds a dry-run rehearsal: publish is additionally unreachable
+    // when admission recorded `dry_run`. The clause only narrows the gate, so it
+    // is accepted as an optional trailing conjunct.
+    const admittedReleasePublishGate = /publish:\n    needs: \[(?=[^\n]*\badmission\b)(?=[^\n]*\binstalled-qualification\b)(?=[^\n]*\bmacos-sign\b)[^\n]*\]\n    if: \$\{\{ needs\.admission\.outputs\.publish == 'true' && needs\.installed-qualification\.result == 'success' && needs\.macos-sign\.result == 'success'(?: && needs\.admission\.outputs\.dry_run != 'true')? \}\}/.test(publishSource);
     const protectedReleasePublish = releaseChain
       && (legacyReleasePublishGate || admittedReleasePublishGate)
       && /\n    permissions:\n      contents: write\n/.test(publishSource);

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.102",
+    "@rightkit/release": "0.2.104",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },