@rightkit/release 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-update.mjs

@@ -33,24 +33,80 @@ const root = path.dirname(configPath);
 const config = (await import(pathToFileURL(configPath))).default;
 const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
-if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} has no updater.artifacts`);
 const installers = target?.installer?.artifacts ?? [];
 
 if (tier === "patch") {
   if (!installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
+  if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} patch has no updater.artifacts for the free app-update manifest`);
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
     const file = path.resolve(root, installer.file);
     if (!dryRun) await access(file).catch(() => fail(`missing signed installer: ${installer.file}`));
   }
+  const platforms = {};
+  const registrations = new Map();
+  const uploadedKeys = new Set();
+  for (const artifact of artifacts) {
+    assertCurrentKey(artifact.key, "updater");
+    const installerKey = patchInstallerKey(artifact);
+    assertCurrentKey(installerKey, "installer");
+    const file = path.resolve(root, artifact.file);
+    const signatureFile = path.resolve(root, artifact.signature);
+    if (!dryRun) {
+      await access(file).catch(() => fail(`missing patch updater payload: ${artifact.file}`));
+      await access(signatureFile).catch(() => fail(`missing patch updater signature: ${artifact.signature}`));
+    }
+    if (!uploadedKeys.has(installerKey)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}`);
+      if (!dryRun) await run(process.execPath, [UPLOAD, file, installerKey, "public"], root);
+      uploadedKeys.add(installerKey);
+    }
+    const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
+    const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
+    const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
+    platforms[artifact.platform] = {
+      signature,
+      url: `${PUBLIC_BASE}/${installerKey}`,
+    };
+    registrations.set(installerKey, { artifactKey, path: installerKey, ...metadata });
+  }
+  for (const installer of installers) {
+    const file = path.resolve(root, installer.file);
+    if (!uploadedKeys.has(installer.key)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
+      if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
+      uploadedKeys.add(installer.key);
+    }
+  }
+  const version = config.version || target.updater.version;
+  if (!version) fail(`${config.app} config must expose version or targets.${platform}.updater.version`);
+  const body = {
+    appKey: config.app,
+    version,
+    channel: config.channel || "stable",
+    platform: null,
+    manifest: {
+      version,
+      tier,
+      notes: process.env.RIGHT_RELEASE_NOTES || `${config.app} ${version}`,
+      pub_date: new Date().toISOString(),
+      platforms,
+    },
+    artifacts: [...registrations.values()],
+  };
+  console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}/v1/admin/apps/patches`);
+  console.log(JSON.stringify(body));
+  if (!dryRun) await register("/v1/admin/apps/patches", body);
+  process.exit(0);
 }
 
+if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
+
 const platforms = {};
 const registrations = new Map();
 const uploadedKeys = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
-  const bucket = tier === "patch" ? "public" : "private";
   const file = path.resolve(root, artifact.file);
   const signatureFile = path.resolve(root, artifact.signature);
   if (!dryRun) {
@@ -58,8 +114,8 @@ for (const artifact of artifacts) {
     await access(signatureFile).catch(() => fail(`missing updater signature: ${artifact.signature}`));
   }
   if (!uploadedKeys.has(artifact.key)) {
-    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD ${bucket}/${artifact.key}`);
-    if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, bucket], root);
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`);
+    if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);
     uploadedKeys.add(artifact.key);
   }
 
@@ -68,19 +124,11 @@ for (const artifact of artifacts) {
   const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
   platforms[artifact.platform] = {
     signature,
-    url: tier === "patch" ? `${PUBLIC_BASE}/${artifact.key}` : `${DOWNLOAD_BASE}/${artifact.key}`,
+    url: `${DOWNLOAD_BASE}/${artifact.key}`,
   };
   registrations.set(artifact.key, { artifactKey, path: artifact.key, ...metadata });
 }
 
-if (tier === "patch") {
-  for (const installer of installers) {
-    const file = path.resolve(root, installer.file);
-    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
-    if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
-  }
-}
-
 const version = config.version || target.updater.version;
 if (!version) fail(`${config.app} config must expose version or targets.${platform}.updater.version`);
 const body = {
@@ -97,25 +145,11 @@ const body = {
   },
   artifacts: [...registrations.values()],
 };
-const route = tier === "patch" ? "/v1/admin/apps/patches" : "/v1/admin/apps/releases";
+const route = "/v1/admin/apps/releases";
 console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
 console.log(JSON.stringify(body));
 
-if (!dryRun) {
-  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
-  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
-  const response = await fetch(`${API_BASE}${route}`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      "content-type": "application/json",
-      "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
-    },
-    body: JSON.stringify(body),
-  });
-  if (!response.ok) fail(`registration failed: ${response.status} ${await response.text()}`);
-  console.log(await response.text());
-}
+if (!dryRun) await register(route, body);
 
 async function fileMetadata(file) {
   const bytes = await readFile(file);
@@ -142,6 +176,28 @@ function assertCurrentKey(key, kind) {
   }
 }
 
+function patchInstallerKey(artifact) {
+  if (artifact.patchKey) return artifact.patchKey;
+  if (!artifact.key.includes("/updates/")) fail(`patch updater key must be convertible to installers/current, got: ${artifact.key}`);
+  return artifact.key.replace("/updates/", "/installers/");
+}
+
+async function register(route, body) {
+  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
+  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
+  const response = await fetch(`${API_BASE}${route}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
+    },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) fail(`registration failed: ${response.status} ${await response.text()}`);
+  console.log(await response.text());
+}
+
 function fail(message) {
   console.error(`publish-update: ${message}`);
   process.exit(1);

package/publish-update.test.mjs

@@ -59,18 +59,19 @@ function run(tier) {
   });
 }
 
-test("routes patch manifests to the public patch registration endpoint", () => {
+test("patch registers a free updater manifest backed by public installer-path objects", () => {
   const result = run("patch");
   assert.equal(result.status, 0, result.stderr);
-  const updaterUpload = result.stdout.indexOf("UPLOAD public/fixture/updates/windows/current/Fixture.exe");
+  const patchPayloadUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture.exe");
   const installerUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture-Setup.exe");
   const registration = result.stdout.indexOf("/v1/admin/apps/patches");
-  assert.ok(updaterUpload >= 0, "patch must upload a public updater");
-  assert.ok(installerUpload >= 0, "patch must upload a public installer");
-  assert.ok(updaterUpload < installerUpload, "patch should upload the updater before replacing the public installer");
+  assert.ok(patchPayloadUpload >= 0, "patch updater payload must upload to the public installer path");
+  assert.ok(installerUpload >= 0, "patch download installer must upload to the public installer path");
+  assert.ok(patchPayloadUpload < installerUpload, "patch should upload app-update payloads before replacing the public download installer");
   assert.ok(installerUpload < registration, "patch should register only after uploads complete");
-  assert.equal(result.stdout.match(/UPLOAD public\/fixture\/updates\/windows\/current\/Fixture\.exe/g)?.length, 1);
-  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/updates\/windows\/current\/Fixture\.exe/);
+  assert.doesNotMatch(result.stdout, /UPLOAD public\/fixture\/updates\//);
+  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
+  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
   assert.match(result.stdout, /"tier":"patch"/);
 });
@@ -99,3 +100,13 @@ test("refuses versioned R2 object keys that would accumulate old releases", () =
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /current R2 object/);
 });
+
+test("refuses versioned updater object keys for gated feature updates", () => {
+  const config = versionedFixture();
+  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
+    encoding: "utf8",
+    env: { ...process.env, RIGHT_RELEASE_TIER: "update" },
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /current R2 object/);
+});

package/release.mjs

@@ -9,7 +9,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.2";
+const VERSION = "0.2.3";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.3"],

package/release.test.mjs

@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.3", "@rightkit/logs": "^0.1.1" },
-        devDependencies: { "@rightkit/release": "^0.2.2" },
+        devDependencies: { "@rightkit/release": "^0.2.3" },
       },
       null,
       2,
@@ -115,7 +115,7 @@ test("publish runs the signed package step before the updater publication step",
   assert.ok(publishAt > packageAt, result.stdout);
 });
 
-test("Windows re-signs the updater artifact after Azure code signing", () => {
+test("Windows patch signs the installer then minisigns the free updater payload", () => {
   const result = run(fixture({ publish: true }), "--tier=patch", "--upload");
   assert.equal(result.status, 0, result.stderr);
   const azureAt = result.stdout.indexOf("sign-windows.mjs");
@@ -125,3 +125,14 @@ test("Windows re-signs the updater artifact after Azure code signing", () => {
   assert.ok(updaterAt > azureAt, result.stdout);
   assert.ok(publishAt > updaterAt, result.stdout);
 });
+
+test("Windows update re-signs the updater artifact after Azure code signing", () => {
+  const result = run(fixture({ publish: true }), "--tier=update", "--upload");
+  assert.equal(result.status, 0, result.stderr);
+  const azureAt = result.stdout.indexOf("sign-windows.mjs");
+  const updaterAt = result.stdout.indexOf("sign-updater.mjs");
+  const publishAt = result.stdout.indexOf("publish-update.mjs");
+  assert.ok(azureAt >= 0, result.stdout);
+  assert.ok(updaterAt > azureAt, result.stdout);
+  assert.ok(publishAt > updaterAt, result.stdout);
+});

package/right-suite-contract.test.mjs

@@ -8,7 +8,7 @@ const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replac
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.3";
 const logsPackage = "^0.1.1";
-const releasePackage = "^0.2.2";
+const releasePackage = "^0.2.3";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },