@rightkit/release 0.2.11 → 0.2.13

package/cli/right-release.mjs

@@ -35,9 +35,18 @@ if (first === "--version" || first === "-v") {
   } else {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
+} else if (first === "suite-doctor") {
+  runTest(
+    ["--test", path.join(packageRoot, "right-suite-contract.test.mjs")],
+    "[right-release] suite-doctor passed",
+  );
 } else if (first === "publish") {
   const rest = args.slice(1);
-  run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+  if (rest[0] === "cargo") {
+    run("publish-cargo.mjs", rest.slice(1));
+  } else {
+    run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+  }
 } else if (first === "lsclean") {
   runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
 } else if (first === "generate-dmg-background") {
@@ -66,7 +75,7 @@ function run(script, scriptArgs) {
   child.on("exit", (code) => process.exit(code ?? 1));
 }
 
-function runTest(testArgs) {
+function runTest(testArgs, successMessage) {
   const child = spawn(process.execPath, testArgs, {
     cwd: process.cwd(),
     env: process.env,
@@ -77,7 +86,10 @@ function runTest(testArgs) {
     console.error(`right-release: failed to start doctor --all: ${error.message}`);
     process.exit(1);
   });
-  child.on("exit", (code) => process.exit(code ?? 1));
+  child.on("exit", (code) => {
+    if (code === 0 && successMessage) console.log(successMessage);
+    process.exit(code ?? 1);
+  });
 }
 
 function runBinary(cmd, cmdArgs) {
@@ -100,8 +112,10 @@ function printHelp() {
 Commands:
   release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
   publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
+  publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   doctor [--platform mac|win]                        Inspect one app's release config
   doctor --all                                       Verify all Right Suite app release contracts
+  suite-doctor                                       Verify all local Right Suite repositories
   deps --check|--audit|--update                      Shared dependency lane
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates

package/mirror-root-artifact.test.mjs

@@ -4,8 +4,9 @@ import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "nod
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 
-const helper = new URL("./mirror-root-artifact.mjs", import.meta.url);
+const helper = fileURLToPath(new URL("./mirror-root-artifact.mjs", import.meta.url));
 
 test("mirrors a nested package artifact from a linked worktree into both package roots", () => {
   const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-"));
@@ -26,7 +27,7 @@ test("mirrors a nested package artifact from a linked worktree into both package
     mkdirSync(path.dirname(source), { recursive: true });
     writeFileSync(source, "signed-dmg-fixture");
 
-    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
+    execFileSync(process.execPath, [helper, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
 
     assert.equal(readFileSync(path.join(packageRoot, "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
     assert.equal(readFileSync(path.join(main, "apps", "desktop", "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
@@ -44,7 +45,7 @@ test("copies a main-worktree artifact into its package root", () => {
     mkdirSync(path.dirname(source), { recursive: true });
     writeFileSync(source, "main-worktree-dmg");
 
-    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", root], { encoding: "utf8" });
+    execFileSync(process.execPath, [helper, "--file", source, "--package-root", root], { encoding: "utf8" });
 
     assert.equal(readFileSync(path.join(root, "App_2.0.0.dmg"), "utf8"), "main-worktree-dmg");
   } finally {

package/notary-auth.test.mjs

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import os from "node:os";
+import path from "node:path";
 import test from "node:test";
 import { notarytoolAuthArgs } from "./notary-auth.mjs";
 
@@ -9,7 +10,7 @@ test("prefers a complete App Store Connect API credential set", () => {
     process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
     process.env.APPLE_API_KEY = "KEY123";
     process.env.APPLE_API_ISSUER = "ISSUER123";
-    assert.deepEqual(notarytoolAuthArgs(), ["--key", `${os.homedir()}/AuthKey.p8`, "--key-id", "KEY123", "--issuer", "ISSUER123"]);
+    assert.deepEqual(notarytoolAuthArgs(), ["--key", path.join(os.homedir(), "AuthKey.p8"), "--key-id", "KEY123", "--issuer", "ISSUER123"]);
   } finally {
     process.env = before;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "cli",
     "*.mjs",
+    "*.json",
     "*.sh",
     "*.py"
   ],

package/publish-cargo.mjs

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
+const SECRET_PATTERNS = [
+  /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/,
+  /\bnpm_[A-Za-z0-9]{30,}\b/,
+];
+
+export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
+  const crate = valueAfter(argv, "--crate");
+  if (!crate) throw new Error("publish cargo requires --crate <name>");
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(crate)) throw new Error(`invalid crate name: ${crate}`);
+  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty"]);
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith("--")) continue;
+    if (!allowed.has(arg)) throw new Error(`unknown publish cargo option: ${arg}`);
+    if (arg !== "--dry-run" && arg !== "--allow-dirty") index += 1;
+  }
+  const dryRun = argv.includes("--dry-run");
+  const allowDirty = argv.includes("--allow-dirty");
+  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  return {
+    crate,
+    dryRun,
+    allowDirty,
+    workspaceRoot: path.resolve(valueAfter(argv, "--workspace") ?? cwd),
+  };
+}
+
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false }) {
+  const dryRunArgs = ["publish", "--dry-run", "-p", crate];
+  const packageArgs = ["package", "--list", "-p", crate];
+  if (allowDirty) dryRunArgs.push("--allow-dirty");
+  if (allowDirty) packageArgs.push("--allow-dirty");
+  const plan = [
+    { label: "secret scan", internal: "secret-scan", crateDir },
+    { label: "format", command: "cargo", args: ["fmt", "--all", "--check"] },
+    { label: "tests", command: "cargo", args: ["test", "-p", crate] },
+    { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
+    { label: "package contents", command: "cargo", args: packageArgs, capture: true },
+    { label: "registry dry-run", command: "cargo", args: dryRunArgs },
+  ];
+  if (!dryRun) plan.push({ label: "registry publish", command: "cargo", args: ["publish", "-p", crate] });
+  return plan;
+}
+
+export function packageFileViolations(files) {
+  return files
+    .map((file) => file.trim().replaceAll("\\", "/"))
+    .filter(Boolean)
+    .filter((file) => FORBIDDEN_PACKAGE_PATH.test(file));
+}
+
+export function scanCrateForSecrets(crateDir) {
+  const violations = [];
+  for (const file of walkFiles(crateDir)) {
+    const relative = path.relative(crateDir, file).replaceAll("\\", "/");
+    if (FORBIDDEN_PACKAGE_PATH.test(relative)) {
+      violations.push(relative);
+      continue;
+    }
+    const bytes = fs.readFileSync(file);
+    if (bytes.includes(0)) continue;
+    const text = bytes.toString("utf8");
+    if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) violations.push(relative);
+  }
+  return [...new Set(violations)].sort();
+}
+
+export function runCargoPublish(options, execute = spawnSync) {
+  const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
+  const manifest = path.join(crateDir, "Cargo.toml");
+  if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
+  const plan = buildCargoPublishPlan({ ...options, crateDir });
+
+  for (const step of plan) {
+    process.stdout.write(`[right-release] cargo ${step.label}\n`);
+    if (step.internal === "secret-scan") {
+      const violations = scanCrateForSecrets(crateDir);
+      if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
+      continue;
+    }
+    const result = execute(step.command, step.args, {
+      cwd: options.workspaceRoot,
+      encoding: "utf8",
+      windowsHide: true,
+      stdio: step.capture ? "pipe" : "inherit",
+    });
+    if (result.error) throw result.error;
+    if (result.status !== 0) {
+      if (step.capture && result.stderr) process.stderr.write(result.stderr);
+      throw new Error(`${step.label} failed with exit code ${result.status}`);
+    }
+    if (step.capture) {
+      if (result.stderr) process.stderr.write(result.stderr);
+      const files = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);
+      const violations = packageFileViolations(files);
+      if (violations.length) throw new Error(`package contents rejected: ${violations.join(", ")}`);
+      process.stdout.write(`${files.join("\n")}\n`);
+    }
+  }
+}
+
+function walkFiles(root) {
+  const files = [];
+  const pending = [root];
+  while (pending.length) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      if (entry.isDirectory() && [".git", "target", "node_modules"].includes(entry.name)) continue;
+      const absolute = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(absolute);
+      else if (entry.isFile()) files.push(absolute);
+    }
+  }
+  return files;
+}
+
+function valueAfter(argv, flag) {
+  const index = argv.indexOf(flag);
+  return index >= 0 ? argv[index + 1] : undefined;
+}
+
+function main() {
+  const options = parseCargoPublishArgs(process.argv.slice(2));
+  runCargoPublish(options);
+  process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(`right-release publish cargo: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+}

package/publish-cargo.test.mjs

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  buildCargoPublishPlan,
+  packageFileViolations,
+  parseCargoPublishArgs,
+} from "./publish-cargo.mjs";
+
+test("cargo publish requires a safe explicit crate name", () => {
+  assert.throws(() => parseCargoPublishArgs([]), /--crate/);
+  assert.throws(() => parseCargoPublishArgs(["--crate", "../secret"]), /invalid crate/);
+  assert.throws(() => parseCargoPublishArgs(["--crate", "rightkit-license", "--allow-dirty"]), /only valid with --dry-run/);
+  assert.equal(parseCargoPublishArgs(["--crate", "rightkit-license"]).crate, "rightkit-license");
+});
+
+test("cargo publish plan always runs local safety gates before upload", () => {
+  const plan = buildCargoPublishPlan({ crate: "rightkit-license", crateDir: "C:/rightkit/crates/rightkit-license", dryRun: false });
+  assert.deepEqual(plan.map((step) => step.label), [
+    "secret scan",
+    "format",
+    "tests",
+    "clippy",
+    "package contents",
+    "registry dry-run",
+    "registry publish",
+  ]);
+  assert.deepEqual(plan.at(-1)?.args, ["publish", "-p", "rightkit-license"]);
+});
+
+test("dry-run plan never contains a real registry upload", () => {
+  const plan = buildCargoPublishPlan({ crate: "rightkit-logs", crateDir: "C:/rightkit/crates/rightkit-logs", dryRun: true });
+  assert.equal(plan.at(-1)?.label, "registry dry-run");
+});
+
+test("package inspection rejects secret and build-output paths", () => {
+  assert.deepEqual(packageFileViolations([
+    "Cargo.toml",
+    "src/lib.rs",
+    ".env",
+    "keys/signing.p8",
+    "target/release/app",
+  ]), [".env", "keys/signing.p8", "target/release/app"]);
+});

package/publish-update.mjs

@@ -11,6 +11,7 @@ const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
 const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev";
 const PUBLIC_BASE = process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
+const PIPELINE_VERSION = JSON.parse(await readFile(path.join(TOOL_ROOT, "package.json"), "utf8")).version;
 const tier = process.env.RIGHT_RELEASE_TIER || "";
 const args = process.argv.slice(2);
 let configName = "right-release.config.mjs";
@@ -45,6 +46,8 @@ if (tier === "patch") {
   }
   const platforms = {};
   const registrations = new Map();
+  const updaterManifestArtifacts = new Map();
+  const installerManifestArtifacts = new Map();
   const uploadedKeys = new Set();
   const uploadedSignatures = new Set();
   for (const artifact of artifacts) {
@@ -75,6 +78,12 @@ if (tier === "patch") {
       url: `${PUBLIC_BASE}/${installerKey}`,
     };
     registrations.set(installerKey, { artifactKey, path: installerKey, ...metadata });
+    updaterManifestArtifacts.set(installerKey, {
+      kind: "updater",
+      r2Key: installerKey,
+      ...metadata,
+      updaterSignature: signature,
+    });
   }
   for (const installer of installers) {
     const file = path.resolve(root, installer.file);
@@ -83,6 +92,13 @@ if (tier === "patch") {
       if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
       uploadedKeys.add(installer.key);
     }
+    const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
+    installerManifestArtifacts.set(installer.key, {
+      kind: "installer",
+      r2Key: installer.key,
+      ...metadata,
+      updaterSignature: null,
+    });
   }
   if (!artifacts.length) {
     console.log(`${dryRun ? "[dry-run] " : ""}NO patch updater artifacts; skipping patch manifest registration`);
@@ -112,6 +128,13 @@ if (tier === "patch") {
       platforms,
     },
     artifacts: [...registrations.values()],
+    artifactManifest: buildArtifactManifest({
+      appKey: config.app,
+      appVersion: version,
+      tier,
+      platform,
+      artifacts: [...installerManifestArtifacts.values(), ...updaterManifestArtifacts.values()],
+    }),
   };
   console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}/v1/admin/apps/patches`);
   console.log(JSON.stringify(body));
@@ -132,6 +155,7 @@ if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no u
 
 const platforms = {};
 const registrations = new Map();
+const updaterManifestArtifacts = new Map();
 const uploadedKeys = new Set();
 const uploadedSignatures = new Set();
 for (const artifact of artifacts) {
@@ -161,6 +185,12 @@ for (const artifact of artifacts) {
     url: `${DOWNLOAD_BASE}/${artifact.key}`,
   };
   registrations.set(artifact.key, { artifactKey, path: artifact.key, ...metadata });
+  updaterManifestArtifacts.set(artifact.key, {
+    kind: "updater",
+    r2Key: artifact.key,
+    ...metadata,
+    updaterSignature: signature,
+  });
 }
 
 const version = config.version || target.updater.version;
@@ -178,6 +208,13 @@ const body = {
     platforms,
   },
   artifacts: [...registrations.values()],
+  artifactManifest: buildArtifactManifest({
+    appKey: config.app,
+    appVersion: version,
+    tier,
+    platform,
+    artifacts: [...updaterManifestArtifacts.values()],
+  }),
 };
 const route = "/v1/admin/apps/releases";
 console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
@@ -202,6 +239,18 @@ async function fileMetadata(file) {
   };
 }
 
+function buildArtifactManifest({ appKey, appVersion, tier, platform, artifacts }) {
+  return {
+    schema: 1,
+    pipelineVersion: PIPELINE_VERSION,
+    appKey,
+    appVersion,
+    tier,
+    platform: platform === "mac" ? "darwin" : "windows",
+    artifacts,
+  };
+}
+
 function run(cmd, runArgs, cwd) {
   return new Promise((resolve, reject) => {
     const child = spawn(cmd, runArgs, { cwd, env: process.env, stdio: "inherit", windowsHide: true });

package/publish-update.test.mjs

@@ -76,6 +76,14 @@ function run(tier) {
   });
 }
 
+function registrationBody(result) {
+  return result.stdout
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith('{'))
+    .map((line) => JSON.parse(line))
+    .find((body) => body.artifactManifest);
+}
+
 test("patch registers a free updater manifest backed by public installer-path objects", () => {
   const result = run("patch");
   assert.equal(result.status, 0, result.stderr);
@@ -95,6 +103,23 @@ test("patch registers a free updater manifest backed by public installer-path ob
   assert.equal((result.stdout.match(/UPLOAD public\/fixture\/installers\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
   assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
   assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
+  const body = registrationBody(result);
+  assert.deepEqual(
+    {
+      schema: body.artifactManifest.schema,
+      appKey: body.artifactManifest.appKey,
+      appVersion: body.artifactManifest.appVersion,
+      tier: body.artifactManifest.tier,
+      platform: body.artifactManifest.platform,
+    },
+    { schema: 1, appKey: 'fixture', appVersion: '1.2.3', tier: 'patch', platform: 'windows' },
+  );
+  assert.match(body.artifactManifest.pipelineVersion, /^\d+\.\d+\.\d+$/);
+  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
+    ['installer', 'fixture/installers/windows/current/Fixture-Setup.exe'],
+    ['updater', 'fixture/installers/windows/current/Fixture.exe'],
+  ]);
+  assert.match(body.artifactManifest.artifacts[1].updaterSignature, /^<signature:/);
 });
 
 test("routes feature updates to the Pro-gated release endpoint", () => {
@@ -108,6 +133,11 @@ test("routes feature updates to the Pro-gated release endpoint", () => {
   assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
   assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
   assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
+  const body = registrationBody(result);
+  assert.equal(body.artifactManifest.tier, 'update');
+  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
+    ['updater', 'fixture/updates/windows/current/Fixture.exe'],
+  ]);
 });
 
 test("allows an installer-only patch without registering an updater manifest", () => {

package/release.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { access, readFile } from "node:fs/promises";
+import { access, readFile, readdir } from "node:fs/promises";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -10,13 +10,10 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.11";
+const RIGHTKIT_VERSIONS = JSON.parse(readFileSync(path.resolve(TOOL_ROOT, "rightkit-versions.json"), "utf8"));
+const VERSION = RIGHTKIT_VERSIONS.npm["@rightkit/release"];
 const TIERS = new Set(["patch", "update"]);
-const RIGHTKIT_EXPECTED = new Map([
-  ["@rightkit/license", "^0.1.5"],
-  ["@rightkit/logs", "^0.1.3"],
-  ["@rightkit/release", `^${VERSION}`],
-]);
+const RIGHTKIT_EXPECTED = new Map(Object.entries(RIGHTKIT_VERSIONS.npm));
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
 const args = process.argv.slice(2);
@@ -181,6 +178,16 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
+  const workflowDir = path.join(root, ".github", "workflows");
+  if (existsSync(workflowDir)) {
+    const workflows = await readdir(workflowDir);
+    if (workflows.length) {
+      fail(`${appName ?? pkg.name ?? "app"} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+    }
+  }
+  if (pkg.packageManager !== RIGHTKIT_VERSIONS.packageManager) {
+    fail(`${appName ?? pkg.name ?? "app"} packageManager must be ${RIGHTKIT_VERSIONS.packageManager}, got ${pkg.packageManager ?? "<missing>"}`);
+  }
   if (JSON.stringify(scripts).includes("../tools/right-release") || JSON.stringify(scripts).includes("../tools/rightkit/packages/release")) {
     fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not parent-workspace release source`);
   }

package/release.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { existsSync, mkdtempSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import test from "node:test";
 
 const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
+const versions = JSON.parse(readFileSync(new URL("./rightkit-versions.json", import.meta.url), "utf8"));
 
 function fixture({ signed = true, publish = false, packageJson } = {}) {
   const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
@@ -17,8 +18,12 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
       packageJson ?? {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
-        dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.11" },
+        packageManager: versions.packageManager,
+        dependencies: {
+          "@rightkit/license": versions.npm["@rightkit/license"],
+          "@rightkit/logs": versions.npm["@rightkit/logs"],
+        },
+        devDependencies: { "@rightkit/release": versions.npm["@rightkit/release"] },
       },
       null,
       2,
@@ -56,8 +61,12 @@ function lockFixture() {
       {
         name: "fixture-lock",
         scripts: { "release:patch:mac": "right-release --platform mac --tier patch" },
-        dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.11" },
+        packageManager: versions.packageManager,
+        dependencies: {
+          "@rightkit/license": versions.npm["@rightkit/license"],
+          "@rightkit/logs": versions.npm["@rightkit/logs"],
+        },
+        devDependencies: { "@rightkit/release": versions.npm["@rightkit/release"] },
       },
       null,
       2,
@@ -134,6 +143,7 @@ test("rejects Git, path, or link RightKit app dependencies before release work s
     fixture({
       packageJson: {
         name: "fixture",
+        packageManager: versions.packageManager,
         scripts: { "release:patch:win": "node ../tools/right-release/release.mjs --tier patch" },
         dependencies: {
           "@rightkit/license": "git+https://github.com/adrdsouza/rightkit.git#main",
@@ -150,6 +160,17 @@ test("rejects Git, path, or link RightKit app dependencies before release work s
   assert.match(result.stderr, /right-release bin|published npm package/i);
 });
 
+test("rejects hosted workflow files before release work starts", () => {
+  const config = fixture();
+  const workflowDir = path.join(path.dirname(config), ".github", "workflows");
+  mkdirSync(workflowDir, { recursive: true });
+  writeFileSync(path.join(workflowDir, "ci.yml"), "name: forbidden\n");
+
+  const result = run(config, "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /hosted workflow.*forbidden/i);
+});
+
 test("publish runs the signed package step before the updater publication step", () => {
   const result = run(fixture({ publish: true }), "--tier=update", "--upload");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -1,22 +1,54 @@
 import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import test from "node:test";
 
 const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const versionsPath = path.join(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "rightkit-versions.json");
+const versions = JSON.parse(readFileSync(versionsPath, "utf8"));
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
-const licensePackage = "^0.1.5";
-const logsPackage = "^0.1.3";
-const releasePackage = "^0.2.11";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
   { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac.sh"] },
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
+test("RightKit exposes one current version manifest", () => {
+  assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
+  assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
+  assert.equal(versions.npm["@rightkit/release"], "0.2.13");
+  assert.equal(versions.npm["@rightkit/license"], "0.1.5");
+  assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
+  assert.equal(versions.npm["@rightkit/updates"], "0.1.1");
+  assert.equal(versions.cargo["rightkit-license"], "0.1.1");
+  assert.equal(versions.cargo["rightkit-logs"], "0.1.0");
+  for (const [crate, version] of Object.entries(versions.cargo)) {
+    const manifest = readFileSync(path.join(workspace, `tools/rightkit/crates/${crate}/Cargo.toml`), "utf8");
+    assert.match(manifest, new RegExp(`^version\\s*=\\s*"${version.replaceAll(".", "\\.")}"$`, "m"));
+  }
+});
+
+test("license v2 public vector is identical at every portable consumer boundary", () => {
+  const canonical = readFileSync(
+    path.join(workspace, "tools/rightkit/crates/rightkit-license/test-vectors/license-v2.json"),
+    "utf8",
+  );
+  for (const relativePath of [
+    "tools/rightkit/packages/license/test-vectors/license-v2.json",
+    "rightapps/packages/api/src/licensing/test-vectors/license-v2.json",
+    "scraperight/tests/fixtures/license-v2.json",
+  ]) {
+    assert.equal(
+      readFileSync(path.join(workspace, relativePath), "utf8"),
+      canonical,
+      `${relativePath} must be the canonical public license vector byte-for-byte`,
+    );
+  }
+});
+
 for (const app of apps) {
   test(`${app.key} follows the signed tiered Right Release contract`, async () => {
     const root = path.join(workspace, app.root);
@@ -24,16 +56,16 @@ for (const app of apps) {
     const rightKitDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
       assert.doesNotMatch(specifier, /^(?:git|file|link|workspace):|github/i, `${app.key} ${name} must come from the published npm package`);
+      if (versions.npm[name]) assert.equal(specifier, versions.npm[name], `${app.key} ${name} must match rightkit-versions.json exactly`);
     }
-    if (rightKitDeps["@rightkit/license"]) assert.equal(rightKitDeps["@rightkit/license"], licensePackage);
-    if (rightKitDeps["@rightkit/logs"]) assert.equal(rightKitDeps["@rightkit/logs"], logsPackage);
-    assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
+    assert.equal(pkg.packageManager, versions.packageManager);
+    assert.equal(pkg.devDependencies?.["@rightkit/release"], versions.npm["@rightkit/release"]);
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/rightkit/packages/release"));
     assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
-    assert.equal(pkg.scripts["release:mac"], "right-release --platform mac");
-    assert.equal(pkg.scripts["release:win"], "right-release --platform win");
+    assert.equal(pkg.scripts["release:mac"], undefined, "tierless release entry points are forbidden");
+    assert.equal(pkg.scripts["release:win"], undefined, "tierless release entry points are forbidden");
     assert.equal(pkg.scripts["release:patch:mac"], "right-release --platform mac --tier patch");
     assert.equal(pkg.scripts["release:patch:win"], "right-release --platform win --tier patch");
     assert.equal(pkg.scripts["release:update:mac"], "right-release --platform mac --tier update");
@@ -44,7 +76,7 @@ for (const app of apps) {
     assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
-    assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /mac|dmg/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} must not expose an unsigned macOS DMG mode`);
+    assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /^(?:release|publish):/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} release/publish commands must not expose an unsigned macOS DMG mode`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/right-release"), `${app.key} scripts must not depend on the parent Claude workspace`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/rightkit/packages/release"), `${app.key} scripts must not depend on the parent Claude workspace`);
 
@@ -66,7 +98,8 @@ for (const app of apps) {
         assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
       }
     }
-    assert.match(config.targets.mac.package.args.join(" "), /mac:dmg:notarized|--notarize/, `${app.key} publish packaging must use the notarized macOS lane`);
+    assert.equal(config.targets.mac.package.cmd, "pnpm", `${app.key} must use the shared pnpm package entry point`);
+    assert.deepEqual(config.targets.mac.package.args, ["run", "mac:dmg:notarized"], `${app.key} R2 release must use the signed and notarized macOS package entry point`);
     for (const installer of config.targets.mac.installer.artifacts) {
       assert.equal(path.dirname(installer.file), ".", `${app.key} macOS installer must be copied to the app package root before upload`);
     }
@@ -85,12 +118,17 @@ for (const app of apps) {
       assert.doesNotMatch(source, /(?:\.\.\/)+tools\/right-release|tools\/right-release\//, `${app.key} ${releaseFile} must consume the installed package`);
       assert.match(source, /right-release["']?,?\s*["']mirror-root-artifact|right-release mirror-root-artifact/, `${app.key} ${releaseFile} must mirror the final DMG to the canonical package root`);
     }
-    for (const forbidden of ["scripts/build-mac-unsigned.sh", "package-unsigned.sh"]) {
-      assert.equal(existsSync(path.join(root, forbidden)), false, `${app.key} must not ship ${forbidden}`);
-    }
   });
 }
 
+test("Right Suite has no hosted workflow files", () => {
+  for (const root of ["viewright", "scraperight", "heardright", "mailright", "coderight", "genright", "voiceright", "tools/rightkit"]) {
+    const workflowDir = path.join(workspace, root, ".github", "workflows");
+    const workflows = existsSync(workflowDir) ? readdirSync(workflowDir) : [];
+    assert.deepEqual(workflows, [], `${root} must not contain hosted workflow files`);
+  }
+});
+
 test("RightApps brand hosts expose app-keyed update manifest proxies", () => {
   for (const app of apps) {
     const siteRoot = path.join(workspace, "rightapps", app.key);

package/rightkit-versions.json

@@ -0,0 +1,14 @@
+{
+  "schema": 1,
+  "packageManager": "pnpm@11.12.0",
+  "npm": {
+    "@rightkit/license": "0.1.5",
+    "@rightkit/logs": "0.1.3",
+    "@rightkit/release": "0.2.13",
+    "@rightkit/updates": "0.1.1"
+  },
+  "cargo": {
+    "rightkit-license": "0.1.1",
+    "rightkit-logs": "0.1.0"
+  }
+}

package/suite-doctor.test.mjs

@@ -0,0 +1,19 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+const cli = path.join(packageRoot, "cli", "right-release.mjs");
+
+test("suite-doctor runs the complete local multi-repo contract", () => {
+  const result = spawnSync(process.execPath, [cli, "suite-doctor"], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+
+  assert.equal(result.status, 0, result.stderr || result.stdout);
+  assert.match(result.stdout, /\[right-release\] suite-doctor passed/);
+});