@rightkit/release 0.2.12 → 0.2.13

package/cli/right-release.mjs

@@ -35,9 +35,18 @@ if (first === "--version" || first === "-v") {
   } else {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
+} else if (first === "suite-doctor") {
+  runTest(
+    ["--test", path.join(packageRoot, "right-suite-contract.test.mjs")],
+    "[right-release] suite-doctor passed",
+  );
 } else if (first === "publish") {
   const rest = args.slice(1);
-  run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+  if (rest[0] === "cargo") {
+    run("publish-cargo.mjs", rest.slice(1));
+  } else {
+    run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+  }
 } else if (first === "lsclean") {
   runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
 } else if (first === "generate-dmg-background") {
@@ -66,7 +75,7 @@ function run(script, scriptArgs) {
   child.on("exit", (code) => process.exit(code ?? 1));
 }
 
-function runTest(testArgs) {
+function runTest(testArgs, successMessage) {
   const child = spawn(process.execPath, testArgs, {
     cwd: process.cwd(),
     env: process.env,
@@ -77,7 +86,10 @@ function runTest(testArgs) {
     console.error(`right-release: failed to start doctor --all: ${error.message}`);
     process.exit(1);
   });
-  child.on("exit", (code) => process.exit(code ?? 1));
+  child.on("exit", (code) => {
+    if (code === 0 && successMessage) console.log(successMessage);
+    process.exit(code ?? 1);
+  });
 }
 
 function runBinary(cmd, cmdArgs) {
@@ -100,8 +112,10 @@ function printHelp() {
 Commands:
   release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
   publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
+  publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   doctor [--platform mac|win]                        Inspect one app's release config
   doctor --all                                       Verify all Right Suite app release contracts
+  suite-doctor                                       Verify all local Right Suite repositories
   deps --check|--audit|--update                      Shared dependency lane
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-cargo.mjs

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
+const SECRET_PATTERNS = [
+  /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/,
+  /\bnpm_[A-Za-z0-9]{30,}\b/,
+];
+
+export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
+  const crate = valueAfter(argv, "--crate");
+  if (!crate) throw new Error("publish cargo requires --crate <name>");
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(crate)) throw new Error(`invalid crate name: ${crate}`);
+  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty"]);
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith("--")) continue;
+    if (!allowed.has(arg)) throw new Error(`unknown publish cargo option: ${arg}`);
+    if (arg !== "--dry-run" && arg !== "--allow-dirty") index += 1;
+  }
+  const dryRun = argv.includes("--dry-run");
+  const allowDirty = argv.includes("--allow-dirty");
+  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  return {
+    crate,
+    dryRun,
+    allowDirty,
+    workspaceRoot: path.resolve(valueAfter(argv, "--workspace") ?? cwd),
+  };
+}
+
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false }) {
+  const dryRunArgs = ["publish", "--dry-run", "-p", crate];
+  const packageArgs = ["package", "--list", "-p", crate];
+  if (allowDirty) dryRunArgs.push("--allow-dirty");
+  if (allowDirty) packageArgs.push("--allow-dirty");
+  const plan = [
+    { label: "secret scan", internal: "secret-scan", crateDir },
+    { label: "format", command: "cargo", args: ["fmt", "--all", "--check"] },
+    { label: "tests", command: "cargo", args: ["test", "-p", crate] },
+    { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
+    { label: "package contents", command: "cargo", args: packageArgs, capture: true },
+    { label: "registry dry-run", command: "cargo", args: dryRunArgs },
+  ];
+  if (!dryRun) plan.push({ label: "registry publish", command: "cargo", args: ["publish", "-p", crate] });
+  return plan;
+}
+
+export function packageFileViolations(files) {
+  return files
+    .map((file) => file.trim().replaceAll("\\", "/"))
+    .filter(Boolean)
+    .filter((file) => FORBIDDEN_PACKAGE_PATH.test(file));
+}
+
+export function scanCrateForSecrets(crateDir) {
+  const violations = [];
+  for (const file of walkFiles(crateDir)) {
+    const relative = path.relative(crateDir, file).replaceAll("\\", "/");
+    if (FORBIDDEN_PACKAGE_PATH.test(relative)) {
+      violations.push(relative);
+      continue;
+    }
+    const bytes = fs.readFileSync(file);
+    if (bytes.includes(0)) continue;
+    const text = bytes.toString("utf8");
+    if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) violations.push(relative);
+  }
+  return [...new Set(violations)].sort();
+}
+
+export function runCargoPublish(options, execute = spawnSync) {
+  const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
+  const manifest = path.join(crateDir, "Cargo.toml");
+  if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
+  const plan = buildCargoPublishPlan({ ...options, crateDir });
+
+  for (const step of plan) {
+    process.stdout.write(`[right-release] cargo ${step.label}\n`);
+    if (step.internal === "secret-scan") {
+      const violations = scanCrateForSecrets(crateDir);
+      if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
+      continue;
+    }
+    const result = execute(step.command, step.args, {
+      cwd: options.workspaceRoot,
+      encoding: "utf8",
+      windowsHide: true,
+      stdio: step.capture ? "pipe" : "inherit",
+    });
+    if (result.error) throw result.error;
+    if (result.status !== 0) {
+      if (step.capture && result.stderr) process.stderr.write(result.stderr);
+      throw new Error(`${step.label} failed with exit code ${result.status}`);
+    }
+    if (step.capture) {
+      if (result.stderr) process.stderr.write(result.stderr);
+      const files = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);
+      const violations = packageFileViolations(files);
+      if (violations.length) throw new Error(`package contents rejected: ${violations.join(", ")}`);
+      process.stdout.write(`${files.join("\n")}\n`);
+    }
+  }
+}
+
+function walkFiles(root) {
+  const files = [];
+  const pending = [root];
+  while (pending.length) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      if (entry.isDirectory() && [".git", "target", "node_modules"].includes(entry.name)) continue;
+      const absolute = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(absolute);
+      else if (entry.isFile()) files.push(absolute);
+    }
+  }
+  return files;
+}
+
+function valueAfter(argv, flag) {
+  const index = argv.indexOf(flag);
+  return index >= 0 ? argv[index + 1] : undefined;
+}
+
+function main() {
+  const options = parseCargoPublishArgs(process.argv.slice(2));
+  runCargoPublish(options);
+  process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(`right-release publish cargo: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  }
+}

package/publish-cargo.test.mjs

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  buildCargoPublishPlan,
+  packageFileViolations,
+  parseCargoPublishArgs,
+} from "./publish-cargo.mjs";
+
+test("cargo publish requires a safe explicit crate name", () => {
+  assert.throws(() => parseCargoPublishArgs([]), /--crate/);
+  assert.throws(() => parseCargoPublishArgs(["--crate", "../secret"]), /invalid crate/);
+  assert.throws(() => parseCargoPublishArgs(["--crate", "rightkit-license", "--allow-dirty"]), /only valid with --dry-run/);
+  assert.equal(parseCargoPublishArgs(["--crate", "rightkit-license"]).crate, "rightkit-license");
+});
+
+test("cargo publish plan always runs local safety gates before upload", () => {
+  const plan = buildCargoPublishPlan({ crate: "rightkit-license", crateDir: "C:/rightkit/crates/rightkit-license", dryRun: false });
+  assert.deepEqual(plan.map((step) => step.label), [
+    "secret scan",
+    "format",
+    "tests",
+    "clippy",
+    "package contents",
+    "registry dry-run",
+    "registry publish",
+  ]);
+  assert.deepEqual(plan.at(-1)?.args, ["publish", "-p", "rightkit-license"]);
+});
+
+test("dry-run plan never contains a real registry upload", () => {
+  const plan = buildCargoPublishPlan({ crate: "rightkit-logs", crateDir: "C:/rightkit/crates/rightkit-logs", dryRun: true });
+  assert.equal(plan.at(-1)?.label, "registry dry-run");
+});
+
+test("package inspection rejects secret and build-output paths", () => {
+  assert.deepEqual(packageFileViolations([
+    "Cargo.toml",
+    "src/lib.rs",
+    ".env",
+    "keys/signing.p8",
+    "target/release/app",
+  ]), [".env", "keys/signing.p8", "target/release/app"]);
+});

package/publish-update.mjs

@@ -11,6 +11,7 @@ const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
 const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev";
 const PUBLIC_BASE = process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
+const PIPELINE_VERSION = JSON.parse(await readFile(path.join(TOOL_ROOT, "package.json"), "utf8")).version;
 const tier = process.env.RIGHT_RELEASE_TIER || "";
 const args = process.argv.slice(2);
 let configName = "right-release.config.mjs";
@@ -45,6 +46,8 @@ if (tier === "patch") {
   }
   const platforms = {};
   const registrations = new Map();
+  const updaterManifestArtifacts = new Map();
+  const installerManifestArtifacts = new Map();
   const uploadedKeys = new Set();
   const uploadedSignatures = new Set();
   for (const artifact of artifacts) {
@@ -75,6 +78,12 @@ if (tier === "patch") {
       url: `${PUBLIC_BASE}/${installerKey}`,
     };
     registrations.set(installerKey, { artifactKey, path: installerKey, ...metadata });
+    updaterManifestArtifacts.set(installerKey, {
+      kind: "updater",
+      r2Key: installerKey,
+      ...metadata,
+      updaterSignature: signature,
+    });
   }
   for (const installer of installers) {
     const file = path.resolve(root, installer.file);
@@ -83,6 +92,13 @@ if (tier === "patch") {
       if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
       uploadedKeys.add(installer.key);
     }
+    const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
+    installerManifestArtifacts.set(installer.key, {
+      kind: "installer",
+      r2Key: installer.key,
+      ...metadata,
+      updaterSignature: null,
+    });
   }
   if (!artifacts.length) {
     console.log(`${dryRun ? "[dry-run] " : ""}NO patch updater artifacts; skipping patch manifest registration`);
@@ -112,6 +128,13 @@ if (tier === "patch") {
       platforms,
     },
     artifacts: [...registrations.values()],
+    artifactManifest: buildArtifactManifest({
+      appKey: config.app,
+      appVersion: version,
+      tier,
+      platform,
+      artifacts: [...installerManifestArtifacts.values(), ...updaterManifestArtifacts.values()],
+    }),
   };
   console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}/v1/admin/apps/patches`);
   console.log(JSON.stringify(body));
@@ -132,6 +155,7 @@ if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no u
 
 const platforms = {};
 const registrations = new Map();
+const updaterManifestArtifacts = new Map();
 const uploadedKeys = new Set();
 const uploadedSignatures = new Set();
 for (const artifact of artifacts) {
@@ -161,6 +185,12 @@ for (const artifact of artifacts) {
     url: `${DOWNLOAD_BASE}/${artifact.key}`,
   };
   registrations.set(artifact.key, { artifactKey, path: artifact.key, ...metadata });
+  updaterManifestArtifacts.set(artifact.key, {
+    kind: "updater",
+    r2Key: artifact.key,
+    ...metadata,
+    updaterSignature: signature,
+  });
 }
 
 const version = config.version || target.updater.version;
@@ -178,6 +208,13 @@ const body = {
     platforms,
   },
   artifacts: [...registrations.values()],
+  artifactManifest: buildArtifactManifest({
+    appKey: config.app,
+    appVersion: version,
+    tier,
+    platform,
+    artifacts: [...updaterManifestArtifacts.values()],
+  }),
 };
 const route = "/v1/admin/apps/releases";
 console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
@@ -202,6 +239,18 @@ async function fileMetadata(file) {
   };
 }
 
+function buildArtifactManifest({ appKey, appVersion, tier, platform, artifacts }) {
+  return {
+    schema: 1,
+    pipelineVersion: PIPELINE_VERSION,
+    appKey,
+    appVersion,
+    tier,
+    platform: platform === "mac" ? "darwin" : "windows",
+    artifacts,
+  };
+}
+
 function run(cmd, runArgs, cwd) {
   return new Promise((resolve, reject) => {
     const child = spawn(cmd, runArgs, { cwd, env: process.env, stdio: "inherit", windowsHide: true });

package/publish-update.test.mjs

@@ -76,6 +76,14 @@ function run(tier) {
   });
 }
 
+function registrationBody(result) {
+  return result.stdout
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith('{'))
+    .map((line) => JSON.parse(line))
+    .find((body) => body.artifactManifest);
+}
+
 test("patch registers a free updater manifest backed by public installer-path objects", () => {
   const result = run("patch");
   assert.equal(result.status, 0, result.stderr);
@@ -95,6 +103,23 @@ test("patch registers a free updater manifest backed by public installer-path ob
   assert.equal((result.stdout.match(/UPLOAD public\/fixture\/installers\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
   assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
   assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
+  const body = registrationBody(result);
+  assert.deepEqual(
+    {
+      schema: body.artifactManifest.schema,
+      appKey: body.artifactManifest.appKey,
+      appVersion: body.artifactManifest.appVersion,
+      tier: body.artifactManifest.tier,
+      platform: body.artifactManifest.platform,
+    },
+    { schema: 1, appKey: 'fixture', appVersion: '1.2.3', tier: 'patch', platform: 'windows' },
+  );
+  assert.match(body.artifactManifest.pipelineVersion, /^\d+\.\d+\.\d+$/);
+  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
+    ['installer', 'fixture/installers/windows/current/Fixture-Setup.exe'],
+    ['updater', 'fixture/installers/windows/current/Fixture.exe'],
+  ]);
+  assert.match(body.artifactManifest.artifacts[1].updaterSignature, /^<signature:/);
 });
 
 test("routes feature updates to the Pro-gated release endpoint", () => {
@@ -108,6 +133,11 @@ test("routes feature updates to the Pro-gated release endpoint", () => {
   assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
   assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
   assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
+  const body = registrationBody(result);
+  assert.equal(body.artifactManifest.tier, 'update');
+  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
+    ['updater', 'fixture/updates/windows/current/Fixture.exe'],
+  ]);
 });
 
 test("allows an installer-only patch without registering an updater manifest", () => {

package/right-suite-contract.test.mjs

@@ -19,10 +19,34 @@ const apps = [
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.12");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.13");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
   assert.equal(versions.npm["@rightkit/updates"], "0.1.1");
+  assert.equal(versions.cargo["rightkit-license"], "0.1.1");
+  assert.equal(versions.cargo["rightkit-logs"], "0.1.0");
+  for (const [crate, version] of Object.entries(versions.cargo)) {
+    const manifest = readFileSync(path.join(workspace, `tools/rightkit/crates/${crate}/Cargo.toml`), "utf8");
+    assert.match(manifest, new RegExp(`^version\\s*=\\s*"${version.replaceAll(".", "\\.")}"$`, "m"));
+  }
+});
+
+test("license v2 public vector is identical at every portable consumer boundary", () => {
+  const canonical = readFileSync(
+    path.join(workspace, "tools/rightkit/crates/rightkit-license/test-vectors/license-v2.json"),
+    "utf8",
+  );
+  for (const relativePath of [
+    "tools/rightkit/packages/license/test-vectors/license-v2.json",
+    "rightapps/packages/api/src/licensing/test-vectors/license-v2.json",
+    "scraperight/tests/fixtures/license-v2.json",
+  ]) {
+    assert.equal(
+      readFileSync(path.join(workspace, relativePath), "utf8"),
+      canonical,
+      `${relativePath} must be the canonical public license vector byte-for-byte`,
+    );
+  }
 });
 
 for (const app of apps) {

package/rightkit-versions.json

@@ -4,7 +4,11 @@
   "npm": {
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
-    "@rightkit/release": "0.2.12",
+    "@rightkit/release": "0.2.13",
     "@rightkit/updates": "0.1.1"
+  },
+  "cargo": {
+    "rightkit-license": "0.1.1",
+    "rightkit-logs": "0.1.0"
   }
 }

package/suite-doctor.test.mjs

@@ -0,0 +1,19 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+const cli = path.join(packageRoot, "cli", "right-release.mjs");
+
+test("suite-doctor runs the complete local multi-repo contract", () => {
+  const result = spawnSync(process.execPath, [cli, "suite-doctor"], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+
+  assert.equal(result.status, 0, result.stderr || result.stdout);
+  assert.match(result.stdout, /\[right-release\] suite-doctor passed/);
+});