@rightkit/release 0.2.13 → 0.2.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-update.mjs

@@ -5,6 +5,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
 import { pruneReleaseObjects } from "./prune-r2.mjs";
+import { loadReleaseToken } from "./release-token.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
@@ -37,8 +38,19 @@ const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
 const installers = target?.installer?.artifacts ?? [];
 
+if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
+if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
+
+let releaseToken = null;
+if (!dryRun && (tier === "update" || artifacts.length > 0)) {
+  try {
+    releaseToken = await loadReleaseToken();
+  } catch (error) {
+    fail(error.message);
+  }
+}
+
 if (tier === "patch") {
-  if (!installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
     const file = path.resolve(root, installer.file);
@@ -49,7 +61,6 @@ if (tier === "patch") {
   const updaterManifestArtifacts = new Map();
   const installerManifestArtifacts = new Map();
   const uploadedKeys = new Set();
-  const uploadedSignatures = new Set();
   for (const artifact of artifacts) {
     assertCurrentKey(artifact.key, "updater");
     const installerKey = patchInstallerKey(artifact);
@@ -65,11 +76,6 @@ if (tier === "patch") {
       if (!dryRun) await run(process.execPath, [UPLOAD, file, installerKey, "public"], root);
       uploadedKeys.add(installerKey);
     }
-    if (!uploadedSignatures.has(`${installerKey}.sig`)) {
-      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}.sig`);
-      if (!dryRun) await run(process.execPath, [UPLOAD, signatureFile, `${installerKey}.sig`, "public"], root);
-      uploadedSignatures.add(`${installerKey}.sig`);
-    }
     const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
@@ -108,7 +114,7 @@ if (tier === "patch") {
       dryRun,
       keep: {
         public: installers.map((artifact) => artifact.key),
-        private: target.updater.artifacts.flatMap((artifact) => [artifact.key, `${artifact.key}.sig`]),
+        private: target.updater.artifacts.map((artifact) => artifact.key),
       },
     });
     process.exit(0);
@@ -144,20 +150,17 @@ if (tier === "patch") {
     platform: platform === "mac" ? "mac" : "windows",
     dryRun,
     keep: {
-      public: [...installers.map((artifact) => artifact.key), ...registrations.keys(), ...[...registrations.keys()].map((key) => `${key}.sig`)],
+      public: [...installers.map((artifact) => artifact.key), ...registrations.keys()],
       private: [],
     },
   });
   process.exit(0);
 }
 
-if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
-
 const platforms = {};
 const registrations = new Map();
 const updaterManifestArtifacts = new Map();
 const uploadedKeys = new Set();
-const uploadedSignatures = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = path.resolve(root, artifact.file);
@@ -171,12 +174,6 @@ for (const artifact of artifacts) {
     if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);
     uploadedKeys.add(artifact.key);
   }
-  if (!uploadedSignatures.has(`${artifact.key}.sig`)) {
-    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}.sig`);
-    if (!dryRun) await run(process.execPath, [UPLOAD, signatureFile, `${artifact.key}.sig`, "private"], root);
-    uploadedSignatures.add(`${artifact.key}.sig`);
-  }
-
   const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
@@ -227,7 +224,7 @@ await pruneReleaseObjects({
   dryRun,
   keep: {
     public: installers.map((artifact) => artifact.key),
-    private: [...registrations.keys(), ...[...registrations.keys()].map((key) => `${key}.sig`)],
+    private: [...registrations.keys()],
   },
 });
 
@@ -275,12 +272,11 @@ function patchInstallerKey(artifact) {
 }
 
 async function register(route, body) {
-  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
-  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
+  if (!releaseToken) fail("RIGHTAPPS_RELEASE_TOKEN is required to register an update");
   const response = await fetch(`${API_BASE}${route}`, {
     method: "POST",
     headers: {
-      authorization: `Bearer ${token}`,
+      authorization: `Bearer ${releaseToken}`,
       "content-type": "application/json",
       "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
     },

package/publish-update.test.mjs

@@ -8,7 +8,7 @@ import test from "node:test";
 
 const publisher = fileURLToPath(new URL("./publish-update.mjs", import.meta.url));
 
-function fixture() {
+function fixture({ materialize = false } = {}) {
   const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
   const config = path.join(dir, "right-release.config.mjs");
   writeFileSync(config, `export default ${JSON.stringify({
@@ -27,6 +27,11 @@ function fixture() {
       },
     },
   })};\n`);
+  if (materialize) {
+    writeFileSync(path.join(dir, "Fixture-Setup.exe"), "signed installer");
+    writeFileSync(path.join(dir, "Fixture.exe"), "signed updater");
+    writeFileSync(path.join(dir, "Fixture.exe.sig"), "updater signature");
+  }
   return config;
 }
 
@@ -100,7 +105,8 @@ test("patch registers a free updater manifest backed by public installer-path ob
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
   assert.match(result.stdout, /"tier":"patch"/);
   assert.match(result.stdout, /"platform":"windows"/);
-  assert.equal((result.stdout.match(/UPLOAD public\/fixture\/installers\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
+  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
+  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 2, "patch may upload only one installer and one updater object per OS");
   assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
   assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
   const body = registrationBody(result);
@@ -129,7 +135,8 @@ test("routes feature updates to the Pro-gated release endpoint", () => {
   assert.match(result.stdout, /"tier":"update"/);
   assert.match(result.stdout, /"platform":"windows"/);
   assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
-  assert.equal((result.stdout.match(/UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
+  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
+  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 1, "feature update may upload only one updater object per OS");
   assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
   assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
   assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
@@ -179,3 +186,17 @@ test("refuses versioned updater object keys for gated feature updates", () => {
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /current R2 object/);
 });
+
+test("requires the durable release credential before the first patch upload", () => {
+  const config = fixture({ materialize: true });
+  const env = { ...process.env, RIGHT_RELEASE_TIER: "patch", RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session" };
+  delete env.RIGHTAPPS_RELEASE_TOKEN;
+  delete env.RIGHTAPPS_RELEASE_TOKEN_FILE;
+  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
+    encoding: "utf8",
+    env,
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /RIGHTAPPS_RELEASE_TOKEN/);
+  assert.doesNotMatch(result.stdout, /UPLOAD /, "credential preflight must run before R2 mutation");
+});

package/release-token.mjs

@@ -0,0 +1,54 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const KEYCHAIN_SERVICE = "rightkit-rightapps-release-token";
+
+export function defaultWindowsReleaseTokenFile(env = process.env) {
+  const appData = env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+  return path.join(appData, "RightKit", "rightapps-release.token");
+}
+
+async function readTokenFile(file) {
+  const token = (await readFile(file, "utf8")).trim();
+  if (!token) throw new Error(`release token file is empty: ${file}`);
+  return token;
+}
+
+export async function loadReleaseToken({ env = process.env, platform = process.platform } = {}) {
+  const direct = env.RIGHTAPPS_RELEASE_TOKEN?.trim();
+  if (direct) return direct;
+
+  if (env.RIGHTAPPS_RELEASE_TOKEN_FILE) {
+    return readTokenFile(path.resolve(env.RIGHTAPPS_RELEASE_TOKEN_FILE));
+  }
+
+  if (platform === "win32") {
+    try {
+      return await readTokenFile(defaultWindowsReleaseTokenFile(env));
+    } catch (error) {
+      throw new Error(`RIGHTAPPS_RELEASE_TOKEN is unavailable (${error.message})`);
+    }
+  }
+
+  if (platform === "darwin") {
+    try {
+      const { stdout } = await execFileAsync("security", [
+        "find-generic-password",
+        "-a", env.USER || os.userInfo().username,
+        "-s", KEYCHAIN_SERVICE,
+        "-w",
+      ], { windowsHide: true });
+      const token = stdout.trim();
+      if (!token) throw new Error("Keychain item is empty");
+      return token;
+    } catch (error) {
+      throw new Error(`RIGHTAPPS_RELEASE_TOKEN is unavailable (macOS Keychain service ${KEYCHAIN_SERVICE}: ${error.message})`);
+    }
+  }
+
+  throw new Error("RIGHTAPPS_RELEASE_TOKEN or RIGHTAPPS_RELEASE_TOKEN_FILE is required");
+}

package/release-token.test.mjs

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { defaultWindowsReleaseTokenFile, loadReleaseToken } from "./release-token.mjs";
+
+test("loads an explicit release token without exposing admin-session fallback", async () => {
+  assert.equal(await loadReleaseToken({ env: { RIGHTAPPS_RELEASE_TOKEN: " durable-token ", RIGHTAPPS_ADMIN_TOKEN: "admin-session" } }), "durable-token");
+});
+
+test("loads the release token from an explicit protected-file path", async () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-token-"));
+  const file = path.join(dir, "token");
+  writeFileSync(file, "file-token\n");
+  assert.equal(await loadReleaseToken({ env: { RIGHTAPPS_RELEASE_TOKEN_FILE: file }, platform: "linux" }), "file-token");
+});
+
+test("uses the portable Windows token location", () => {
+  assert.equal(defaultWindowsReleaseTokenFile({ APPDATA: "C:\\Users\\fixture\\AppData\\Roaming" }), path.join("C:\\Users\\fixture\\AppData\\Roaming", "RightKit", "rightapps-release.token"));
+});

package/right-suite-contract.test.mjs

@@ -19,10 +19,10 @@ const apps = [
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.13");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.15");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
-  assert.equal(versions.npm["@rightkit/updates"], "0.1.1");
+  assert.equal(versions.npm["@rightkit/updates"], "0.2.1");
   assert.equal(versions.cargo["rightkit-license"], "0.1.1");
   assert.equal(versions.cargo["rightkit-logs"], "0.1.0");
   for (const [crate, version] of Object.entries(versions.cargo)) {

package/rightkit-versions.json

@@ -4,8 +4,8 @@
   "npm": {
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
-    "@rightkit/release": "0.2.13",
-    "@rightkit/updates": "0.1.1"
+    "@rightkit/release": "0.2.15",
+    "@rightkit/updates": "0.2.1"
   },
   "cargo": {
     "rightkit-license": "0.1.1",