@rightkit/release 0.2.19 → 0.2.21

package/runtime-artifact-manifest.mjs

@@ -0,0 +1,247 @@
+import { sign as edSign, verify as edVerify } from "node:crypto";
+
+export const RUNTIME_ARTIFACT_SCHEMA = 1;
+export const RUNTIME_ARTIFACT_KINDS = Object.freeze([
+  "asr-model",
+  "ocr-model",
+  "ort-runtime",
+  "media-runtime",
+  "tokenizer",
+  "preprocessing",
+]);
+export const RIGHT_SUITE_APP_KEYS = Object.freeze([
+  "viewright",
+  "heardright",
+  "mailright",
+  "scraperight",
+  "coderight",
+]);
+
+const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios"]);
+const TARGET_ARCHES = new Set(["x86_64", "aarch64", "universal"]);
+const VERSION_FIELDS = Object.freeze([
+  "runtime",
+  "model",
+  "tokenizer",
+  "preprocessing",
+  "license",
+  "provenance",
+]);
+const SHA256 = /^[0-9a-f]{64}$/;
+
+export function buildRuntimeArtifactManifest(input) {
+  const entitlement = cloneObject(input.entitlement);
+  const target = cloneObject(input.target);
+  const manifest = {
+    schema: RUNTIME_ARTIFACT_SCHEMA,
+    artifactKind: input.artifactKind,
+    entitlement,
+    distribution: cloneObject(input.distribution),
+    target,
+    object: {
+      r2Key: "",
+      filename: input.filename,
+      sha256: input.sha256,
+      sizeBytes: input.sizeBytes,
+    },
+    pointerKey: "",
+    versions: cloneObject(input.versions),
+    provenance: cloneObject(input.provenance),
+    promotion: cloneObject(input.promotion),
+  };
+  if (manifest.distribution?.delivery === "bundled") {
+    manifest.object.r2Key = null;
+    manifest.pointerKey = null;
+  } else {
+    manifest.object.r2Key = runtimeArtifactObjectKey(manifest);
+    manifest.pointerKey = runtimeArtifactManifestPointerKey(manifest);
+  }
+  return validateRuntimeArtifactManifest(manifest);
+}
+
+export function runtimeArtifactObjectKey(value) {
+  const appKey = value?.entitlement?.appKey;
+  const digest = value?.object?.sha256 ?? value?.sha256;
+  const filename = value?.object?.filename ?? value?.filename;
+  assertAppKey(appKey, "entitlement.appKey");
+  assertSha256(digest, "object.sha256");
+  assertFilename(filename);
+  return `${appKey}/runtime-artifacts/objects/sha256/${digest}/${filename}`;
+}
+
+export function runtimeArtifactManifestPointerKey(value) {
+  const appKey = value?.entitlement?.appKey;
+  const kind = value?.artifactKind;
+  const os = value?.target?.os;
+  const arch = value?.target?.arch;
+  assertAppKey(appKey, "entitlement.appKey");
+  if (!RUNTIME_ARTIFACT_KINDS.includes(kind)) fail("artifactKind is unsupported");
+  if (!TARGET_OSES.has(os)) fail("target.os is unsupported");
+  if (!TARGET_ARCHES.has(arch)) fail("target.arch is unsupported");
+  return `${appKey}/runtime-artifacts/${kind}/${os}/${arch}/current/manifest.json`;
+}
+
+export function validateRuntimeArtifactManifest(value) {
+  assertPlainObject(value, "manifest");
+  assertExactKeys(value, [
+    "schema", "artifactKind", "entitlement", "distribution", "target", "object", "pointerKey",
+    "versions", "provenance", "promotion",
+  ], "manifest");
+  if (value.schema !== RUNTIME_ARTIFACT_SCHEMA) fail("schema must be 1");
+  if (!RUNTIME_ARTIFACT_KINDS.includes(value.artifactKind)) fail("artifactKind is unsupported");
+
+  assertPlainObject(value.entitlement, "entitlement");
+  assertExactKeys(value.entitlement, ["appKey", "tier"], "entitlement");
+  assertAppKey(value.entitlement.appKey, "entitlement.appKey");
+  if (!["pro", "public", "bundled"].includes(value.entitlement.tier)) fail("entitlement.tier is unsupported");
+
+  assertPlainObject(value.distribution, "distribution");
+  assertExactKeys(value.distribution, ["delivery", "bucket"], "distribution");
+  const laneContracts = {
+    "private-r2": { tier: "pro", bucket: "rightapps-updates" },
+    "public-r2": { tier: "public", bucket: "rightapps-downloads" },
+    bundled: { tier: "bundled", bucket: null },
+  };
+  const lane = laneContracts[value.distribution.delivery];
+  if (!lane) fail("distribution.delivery is unsupported");
+  if (value.entitlement.tier !== lane.tier || value.distribution.bucket !== lane.bucket) {
+    fail("distribution lane contradicts entitlement tier or bucket");
+  }
+  if (["asr-model", "ocr-model", "tokenizer"].includes(value.artifactKind)
+      && (value.distribution.delivery !== "private-r2" || value.entitlement.tier !== "pro")) {
+    fail("model artifacts must use private-r2 with Pro entitlement");
+  }
+
+  assertPlainObject(value.target, "target");
+  assertExactKeys(value.target, ["os", "arch"], "target");
+  if (!TARGET_OSES.has(value.target.os)) fail("target.os is unsupported");
+  if (!TARGET_ARCHES.has(value.target.arch)) fail("target.arch is unsupported");
+
+  assertPlainObject(value.object, "object");
+  assertExactKeys(value.object, ["r2Key", "filename", "sha256", "sizeBytes"], "object");
+  assertFilename(value.object.filename);
+  assertSha256(value.object.sha256, "object.sha256");
+  if (!Number.isSafeInteger(value.object.sizeBytes) || value.object.sizeBytes <= 0) fail("object.sizeBytes must be a positive safe integer");
+  if (value.distribution.delivery === "bundled") {
+    if (value.object.r2Key !== null || value.pointerKey !== null) fail("bundled artifacts must not claim R2 keys");
+  } else {
+    if (value.object.r2Key !== runtimeArtifactObjectKey(value)) fail("object.r2Key contradicts its immutable SHA-256 object key");
+    if (value.pointerKey !== runtimeArtifactManifestPointerKey(value)) fail("pointerKey must be the replace-only stable current manifest key");
+  }
+
+  assertPlainObject(value.versions, "versions");
+  assertExactKeys(value.versions, VERSION_FIELDS, "versions");
+  for (const field of VERSION_FIELDS) assertNonempty(value.versions[field], `versions.${field}`);
+
+  assertPlainObject(value.provenance, "provenance");
+  assertExactKeys(value.provenance, ["source", "sourceRevision", "licenseId", "noticeSha256"], "provenance");
+  assertHttpsUrl(value.provenance.source, "provenance.source");
+  assertNonempty(value.provenance.sourceRevision, "provenance.sourceRevision");
+  assertNonempty(value.provenance.licenseId, "provenance.licenseId");
+  assertSha256(value.provenance.noticeSha256, "provenance.noticeSha256");
+  if (normalizeLicense(value.versions.license) !== normalizeLicense(value.provenance.licenseId)) {
+    fail("license version contradicts provenance licenseId");
+  }
+
+  assertPlainObject(value.promotion, "promotion");
+  assertExactKeys(value.promotion, ["authorityAppKey", "promotionId", "promotedAt", "evidenceSha256"], "promotion");
+  assertAppKey(value.promotion.authorityAppKey, "promotion.authorityAppKey");
+  assertNonempty(value.promotion.promotionId, "promotion.promotionId");
+  const promotedAt = new Date(value.promotion.promotedAt);
+  if (Number.isNaN(promotedAt.getTime()) || promotedAt.toISOString() !== value.promotion.promotedAt) fail("promotion.promotedAt must be an exact ISO-8601 UTC timestamp");
+  assertSha256(value.promotion.evidenceSha256, "promotion.evidenceSha256");
+  return value;
+}
+
+export function canonicalRuntimeArtifactManifest(manifest) {
+  validateRuntimeArtifactManifest(manifest);
+  return JSON.stringify(sortDeep(manifest));
+}
+
+export function signRuntimeArtifactManifest(manifest, privateKey, keyId) {
+  assertNonempty(keyId, "signature.keyId");
+  const canonical = Buffer.from(canonicalRuntimeArtifactManifest(manifest), "utf8");
+  return {
+    manifest,
+    signature: {
+      algorithm: "Ed25519",
+      keyId,
+      value: edSign(null, canonical, privateKey).toString("base64url"),
+    },
+  };
+}
+
+export function verifyRuntimeArtifactEnvelope(value, publicKey) {
+  assertPlainObject(value, "envelope");
+  assertExactKeys(value, ["manifest", "signature"], "envelope");
+  validateRuntimeArtifactManifest(value.manifest);
+  assertPlainObject(value.signature, "signature");
+  assertExactKeys(value.signature, ["algorithm", "keyId", "value"], "signature");
+  if (value.signature.algorithm !== "Ed25519") fail("signature algorithm must be Ed25519");
+  assertNonempty(value.signature.keyId, "signature.keyId");
+  assertNonempty(value.signature.value, "signature.value");
+  let signature;
+  try {
+    signature = Buffer.from(value.signature.value, "base64url");
+  } catch {
+    fail("signature is not base64url");
+  }
+  if (signature.length !== 64 || !edVerify(null, Buffer.from(canonicalRuntimeArtifactManifest(value.manifest), "utf8"), publicKey, signature)) {
+    fail("signature verification failed");
+  }
+  return value.manifest;
+}
+
+function sortDeep(value) {
+  if (Array.isArray(value)) return value.map(sortDeep);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sortDeep(value[key])]));
+  }
+  return value;
+}
+
+function assertExactKeys(value, expected, label) {
+  const expectedSet = new Set(expected);
+  for (const key of Object.keys(value)) if (!expectedSet.has(key)) fail(`${label} has unknown field ${key}`);
+  for (const key of expected) if (!Object.hasOwn(value, key)) fail(`${label}.${key} is required`);
+}
+
+function assertPlainObject(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) fail(`${label} must be a plain object`);
+}
+
+function assertAppKey(value, label) {
+  if (!RIGHT_SUITE_APP_KEYS.includes(value)) fail(`${label} is not a Right Suite app`);
+}
+
+function assertFilename(value) {
+  assertNonempty(value, "object.filename");
+  if (value === "." || value === ".." || value.includes("/") || value.includes("\\") || value.includes("..")) fail("object.filename must be one safe basename");
+}
+
+function assertSha256(value, label) {
+  if (typeof value !== "string" || !SHA256.test(value)) fail(`${label} must be lowercase SHA-256`);
+}
+
+function assertNonempty(value, label) {
+  if (typeof value !== "string" || value.trim() !== value || value.length === 0) fail(`${label} must be a nonempty exact string`);
+}
+
+function assertHttpsUrl(value, label) {
+  assertNonempty(value, label);
+  let url;
+  try { url = new URL(value); } catch { fail(`${label} must be an HTTPS URL`); }
+  if (url.protocol !== "https:") fail(`${label} must be an HTTPS URL`);
+}
+
+function normalizeLicense(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+
+function cloneObject(value) {
+  return value && typeof value === "object" ? structuredClone(value) : value;
+}
+
+function fail(message) {
+  throw new Error(`invalid runtime artifact manifest: ${message}`);
+}

package/runtime-artifact-manifest.test.mjs

@@ -0,0 +1,128 @@
+import assert from "node:assert/strict";
+import { generateKeyPairSync } from "node:crypto";
+import test from "node:test";
+
+import {
+  buildRuntimeArtifactManifest,
+  runtimeArtifactManifestPointerKey,
+  runtimeArtifactObjectKey,
+  signRuntimeArtifactManifest,
+  validateRuntimeArtifactManifest,
+  verifyRuntimeArtifactEnvelope,
+} from "./runtime-artifact-manifest.mjs";
+
+const digest = "a".repeat(64);
+const evidenceDigest = "b".repeat(64);
+
+function validManifest(overrides = {}) {
+  return buildRuntimeArtifactManifest({
+    artifactKind: "asr-model",
+    filename: "parakeet-tdt-v3.onnx",
+    sha256: digest,
+    sizeBytes: 42,
+    entitlement: { appKey: "scraperight", tier: "pro" },
+    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+    target: { os: "windows", arch: "x86_64" },
+    versions: {
+      runtime: "onnxruntime-1.22.0",
+      model: "parakeet-tdt-0.6b-v3",
+      tokenizer: "sentencepiece-2026-07-14",
+      preprocessing: "rightkit-asr-0.1.0",
+      license: "cc-by-4.0",
+      provenance: "heardright-approved-2026-07-14",
+    },
+    provenance: {
+      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
+      sourceRevision: "0123456789abcdef",
+      licenseId: "CC-BY-4.0",
+      noticeSha256: "c".repeat(64),
+    },
+    promotion: {
+      authorityAppKey: "heardright",
+      promotionId: "hr-asr-2026-07-14-001",
+      promotedAt: "2026-07-14T12:00:00.000Z",
+      evidenceSha256: evidenceDigest,
+    },
+    ...overrides,
+  });
+}
+
+test("builds exact stable-pointer and immutable content-addressed object keys", () => {
+  const manifest = validManifest();
+  assert.equal(
+    manifest.pointerKey,
+    "scraperight/runtime-artifacts/asr-model/windows/x86_64/current/manifest.json",
+  );
+  assert.equal(
+    manifest.object.r2Key,
+    `scraperight/runtime-artifacts/objects/sha256/${digest}/parakeet-tdt-v3.onnx`,
+  );
+  assert.equal(runtimeArtifactManifestPointerKey(manifest), manifest.pointerKey);
+  assert.equal(runtimeArtifactObjectKey(manifest), manifest.object.r2Key);
+  assert.equal(validateRuntimeArtifactManifest(manifest), manifest);
+});
+
+test("signs and verifies the canonical manifest with Ed25519", () => {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const envelope = signRuntimeArtifactManifest(validManifest(), privateKey, "rightapps-runtime-2026-01");
+  assert.equal(envelope.signature.algorithm, "Ed25519");
+  assert.equal(verifyRuntimeArtifactEnvelope(envelope, publicKey).artifactKind, "asr-model");
+
+  const tampered = structuredClone(envelope);
+  tampered.manifest.object.sizeBytes += 1;
+  assert.throws(() => verifyRuntimeArtifactEnvelope(tampered, publicKey), /signature verification failed/);
+});
+
+test("fails closed on missing or contradictory digest, provenance, version, scope, and promotion metadata", () => {
+  const mutations = [
+    (m) => delete m.versions.tokenizer,
+    (m) => { m.versions.license = ""; },
+    (m) => delete m.provenance.sourceRevision,
+    (m) => { m.provenance.licenseId = "MIT"; },
+    (m) => { m.entitlement.tier = "free"; },
+    (m) => { m.object.sha256 = "d".repeat(64); },
+    (m) => { m.object.sizeBytes = 0; },
+    (m) => { m.pointerKey = "scraperight/runtime-artifacts/asr-model/windows/x86_64/v1/manifest.json"; },
+    (m) => { m.promotion.authorityAppKey = "unknown"; },
+    (m) => { m.promotion.evidenceSha256 = "not-a-digest"; },
+  ];
+  for (const mutate of mutations) {
+    const manifest = structuredClone(validManifest());
+    mutate(manifest);
+    assert.throws(() => validateRuntimeArtifactManifest(manifest));
+  }
+});
+
+test("rejects unknown fields and path traversal instead of guessing", () => {
+  const extra = structuredClone(validManifest());
+  extra.secretUrl = "https://example.invalid/token";
+  assert.throws(() => validateRuntimeArtifactManifest(extra), /unknown field/);
+  assert.throws(() => validManifest({ filename: "../model.onnx" }), /filename/);
+});
+
+test("requires an explicit compatible entitlement and delivery lane per artifact", () => {
+  const publicMedia = validManifest({
+    artifactKind: "media-runtime",
+    entitlement: { appKey: "scraperight", tier: "public" },
+    distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
+  });
+  assert.equal(publicMedia.distribution.delivery, "public-r2");
+
+  const bundledOrt = validManifest({
+    artifactKind: "ort-runtime",
+    entitlement: { appKey: "viewright", tier: "bundled" },
+    distribution: { delivery: "bundled", bucket: null },
+  });
+  assert.equal(bundledOrt.pointerKey, null);
+  assert.equal(bundledOrt.object.r2Key, null);
+
+  assert.throws(() => validManifest({
+    entitlement: { appKey: "scraperight", tier: "public" },
+    distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
+  }), /model.*private-r2.*pro/i);
+  assert.throws(() => validManifest({
+    artifactKind: "media-runtime",
+    entitlement: { appKey: "scraperight", tier: "public" },
+    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+  }), /contradict/);
+});

package/standalone-clone-verify.mjs

@@ -0,0 +1,131 @@
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+export const DEFAULT_APPS = Object.freeze([
+  { key: "viewright", remote: "https://github.com/bogusyogi/viewright.git", appDir: "." },
+  { key: "scraperight", remote: "https://github.com/bogusyogi/scraperight.git", appDir: "." },
+  { key: "heardright", remote: "https://github.com/bogusyogi/heardright.git", appDir: "tauri-app-next" },
+  { key: "mailright", remote: "https://github.com/bogusyogi/mailright.git", appDir: "." },
+  { key: "coderight", remote: "https://github.com/bogusyogi/coderight.git", appDir: "apps/coderight-tauri" },
+]);
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 16 * 1024 * 1024,
+    env: { ...process.env, CI: "1", GIT_TERMINAL_PROMPT: "0" },
+  });
+  return {
+    command: [command, ...args].join(" "),
+    status: result.status,
+    stdout: String(result.stdout ?? "").trim().slice(-8000),
+    stderr: String(result.stderr ?? "").trim().slice(-8000),
+    error: result.error?.message,
+  };
+}
+
+function runPnpm(args, cwd, command) {
+  if (process.platform !== "win32" || command !== "pnpm") return run(command, args, cwd);
+  for (const entry of String(process.env.PATH ?? "").split(path.delimiter)) {
+    const cli = path.join(entry.replace(/^"|"$/g, ""), "node_modules", "pnpm", "bin", "pnpm.mjs");
+    if (existsSync(cli)) return run(process.execPath, [cli, ...args], cwd);
+  }
+  throw new Error("pnpm installation could not be resolved from PATH");
+}
+
+function requireSuccess(result, label) {
+  if (result.status !== 0) {
+    throw new Error(`${label} failed (${result.status ?? "spawn error"})\n${result.stderr || result.stdout || result.error || "no output"}`);
+  }
+}
+
+function assertGeneratedWorkRoot(workRoot, tempParent) {
+  const parent = path.resolve(tempParent);
+  const candidate = path.resolve(workRoot);
+  if (path.dirname(candidate) !== parent || !path.basename(candidate).startsWith("rightkit-standalone-")) {
+    throw new Error(`refusing cleanup outside generated standalone directory: ${candidate}`);
+  }
+}
+
+export async function verifyStandaloneClones({
+  apps = DEFAULT_APPS,
+  evidencePath = path.resolve("standalone-clone-evidence.json"),
+  tempParent = tmpdir(),
+  pnpmCommand = "pnpm",
+} = {}) {
+  mkdirSync(tempParent, { recursive: true });
+  const workRoot = mkdtempSync(path.join(path.resolve(tempParent), "rightkit-standalone-"));
+  const evidence = { schemaVersion: 1, generatedAt: new Date().toISOString(), workRoot, apps: [] };
+
+  try {
+    for (const app of apps) {
+      const cloneRoot = path.join(workRoot, app.key);
+      const clone = run("git", ["clone", "--depth", "1", "--single-branch", app.remote, cloneRoot], workRoot);
+      requireSuccess(clone, `${app.key} clone`);
+      const appRoot = path.resolve(cloneRoot, app.appDir);
+      if (!appRoot.startsWith(`${path.resolve(cloneRoot)}${path.sep}`) && appRoot !== path.resolve(cloneRoot)) {
+        throw new Error(`${app.key} package root escapes its clone`);
+      }
+      if (!existsSync(path.join(appRoot, "package.json"))) throw new Error(`${app.key} package root does not exist: ${app.appDir}`);
+      const pkg = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8"));
+      const expectedPnpm = String(pkg.packageManager ?? "").match(/^pnpm@(\d+\.\d+\.\d+)$/)?.[1];
+      if (!expectedPnpm) throw new Error(`${app.key} must pin an exact pnpm packageManager`);
+      const pnpmVersion = runPnpm(["--version"], appRoot, pnpmCommand);
+      requireSuccess(pnpmVersion, `${app.key} pnpm version`);
+      if (pnpmVersion.stdout !== expectedPnpm) {
+        throw new Error(`${app.key} requires pnpm ${expectedPnpm}, found ${pnpmVersion.stdout}`);
+      }
+      const install = runPnpm(["install", "--frozen-lockfile"], appRoot, pnpmCommand);
+      requireSuccess(install, `${app.key} pnpm install`);
+      const doctor = runPnpm(["release:doctor"], appRoot, pnpmCommand);
+      requireSuccess(doctor, `${app.key} release:doctor`);
+      const revision = run("git", ["rev-parse", "HEAD"], cloneRoot);
+      requireSuccess(revision, `${app.key} revision`);
+      evidence.apps.push({
+        key: app.key,
+        remote: app.remote,
+        appDir: app.appDir,
+        revision: revision.stdout,
+        packageManager: pkg.packageManager,
+        clone,
+        install,
+        doctor,
+      });
+      mkdirSync(path.dirname(path.resolve(evidencePath)), { recursive: true });
+      writeFileSync(path.resolve(evidencePath), `${JSON.stringify(evidence, null, 2)}\n`, "utf8");
+    }
+    return evidence;
+  } finally {
+    assertGeneratedWorkRoot(workRoot, tempParent);
+    rmSync(workRoot, { recursive: true, force: true });
+  }
+}
+
+function parseArgs(argv) {
+  let evidencePath = path.resolve("standalone-clone-evidence.json");
+  let selectedKeys = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] === "--evidence") evidencePath = path.resolve(argv[++index]);
+    else if (argv[index] === "--app") selectedKeys.push(argv[++index]);
+    else throw new Error(`unknown argument: ${argv[index]}`);
+  }
+  const apps = selectedKeys.length ? DEFAULT_APPS.filter(({ key }) => selectedKeys.includes(key)) : DEFAULT_APPS;
+  if (apps.length !== (selectedKeys.length || DEFAULT_APPS.length)) throw new Error("unknown or duplicate --app value");
+  return { apps, evidencePath };
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try {
+    const evidence = await verifyStandaloneClones(parseArgs(process.argv.slice(2)));
+    for (const app of evidence.apps) process.stdout.write(`[standalone] ${app.key} ${app.revision.slice(0, 12)} install+doctor passed\n`);
+    process.stdout.write(`[standalone] evidence ${path.resolve(parseArgs(process.argv.slice(2)).evidencePath)}\n`);
+  } catch (error) {
+    process.stderr.write(`[standalone] ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}

package/standalone-clone-verify.test.mjs

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync, mkdirSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import test from "node:test";
+
+import { verifyStandaloneClones } from "./standalone-clone-verify.mjs";
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8", windowsHide: true });
+  assert.equal(result.status, 0, `${command} ${args.join(" ")}\n${result.stderr}`);
+}
+
+test("standalone verifier clones, installs, doctors from a nested app root, and removes only its own temp tree", async (t) => {
+  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "rightkit-standalone-fixture-"));
+  t.after(() => rmSync(fixtureRoot, { recursive: true, force: true }));
+  const source = path.join(fixtureRoot, "source");
+  const outsideSentinel = path.join(fixtureRoot, "keep.txt");
+  mkdirSync(path.join(source, "apps", "desktop"), { recursive: true });
+  writeFileSync(outsideSentinel, "keep", "utf8");
+  writeFileSync(path.join(source, "apps", "desktop", "package.json"), JSON.stringify({
+    name: "standalone-fixture",
+    private: true,
+    packageManager: "pnpm@11.12.0",
+    scripts: { "release:doctor": "node doctor.mjs" },
+  }), "utf8");
+  writeFileSync(path.join(source, "apps", "desktop", "pnpm-lock.yaml"), "lockfileVersion: '9.0'\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\nimporters:\n  .: {}\n", "utf8");
+  writeFileSync(path.join(source, "apps", "desktop", "doctor.mjs"), "process.stdout.write('fixture doctor passed\\n')\n", "utf8");
+  run("git", ["init", "-q"], source);
+  run("git", ["config", "user.email", "fixture@example.test"], source);
+  run("git", ["config", "user.name", "Fixture"], source);
+  run("git", ["add", "."], source);
+  run("git", ["commit", "-qm", "fixture"], source);
+
+  const evidencePath = path.join(fixtureRoot, "evidence.json");
+  const result = await verifyStandaloneClones({
+    apps: [{ key: "fixture", remote: source, appDir: "apps/desktop" }],
+    evidencePath,
+    tempParent: fixtureRoot,
+  });
+
+  assert.equal(result.apps[0].install.status, 0);
+  assert.equal(result.apps[0].doctor.status, 0);
+  assert.match(result.apps[0].doctor.stdout, /fixture doctor passed/);
+  assert.equal(existsSync(result.workRoot), false, "generated clone tree must be removed");
+  assert.equal(readFileSync(outsideSentinel, "utf8"), "keep", "cleanup must not escape the generated tree");
+  assert.deepEqual(JSON.parse(readFileSync(evidencePath, "utf8")).apps.map(({ key }) => key), ["fixture"]);
+});
+
+test("release package exposes the local standalone verification lane", () => {
+  const pkg = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8"));
+  assert.equal(pkg.scripts["verify:standalone"], "node standalone-clone-verify.mjs");
+});
+
+test("standalone verifier rejects a package root that escapes its clone", async (t) => {
+  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "rightkit-standalone-escape-"));
+  t.after(() => rmSync(fixtureRoot, { recursive: true, force: true }));
+  const source = path.join(fixtureRoot, "source");
+  mkdirSync(source, { recursive: true });
+  writeFileSync(path.join(source, "README.md"), "fixture", "utf8");
+  run("git", ["init", "-q"], source);
+  run("git", ["config", "user.email", "fixture@example.test"], source);
+  run("git", ["config", "user.name", "Fixture"], source);
+  run("git", ["add", "."], source);
+  run("git", ["commit", "-qm", "fixture"], source);
+
+  await assert.rejects(
+    verifyStandaloneClones({
+      apps: [{ key: "fixture", remote: source, appDir: ".." }],
+      evidencePath: path.join(fixtureRoot, "evidence.json"),
+      tempParent: fixtureRoot,
+    }),
+    /package root escapes its clone/,
+  );
+});