@rightkit/release 0.2.23 → 0.2.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/right-suite-contract.test.mjs

@@ -317,7 +317,8 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.22");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.25");
+  assert.equal(versions.npm["@rightkit/legal"], "0.1.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
   assert.equal(versions.npm["@rightkit/tauri"], "0.1.0");

package/rightkit-versions.json

@@ -2,11 +2,12 @@
   "schema": 1,
   "packageManager": "pnpm@11.12.0",
   "npm": {
+    "@rightkit/legal": "0.1.0",
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.22",
+    "@rightkit/release": "0.2.25",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/upload-large.mjs

@@ -8,6 +8,12 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
+// Wrangler always runs remotely through a package runner; which one exists is machine-specific
+// (a node install without npm/npx is normal when pnpm is the pinned package manager).
+const RUNNERS = [
+  { cmd: "npx", prefix: [] },
+  { cmd: "pnpm", prefix: ["dlx"] },
+];
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -36,11 +42,24 @@ const env = cleanCloudflareEnv(process.env);
 console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
 console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
 
+// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
+// and that must fail here rather than after a signed build has already been produced.
+const runner = resolveRunner(env);
+if (!runner) {
+  console.error(
+    "upload-large: no package runner found. Tried: " +
+      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
+      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+  );
+  process.exit(1);
+}
+console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
+
 if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
   process.exit(0);
 }
 
-const result = spawnSync("npx", wranglerArgs, {
+const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
   env,
   stdio: "inherit",
   shell: process.platform === "win32",
@@ -53,6 +72,24 @@ if (result.error) {
 }
 process.exit(result.status ?? 1);
 
+function resolveRunner(env) {
+  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
+  if (override) {
+    const [cmd, ...prefix] = override.split(/\s+/);
+    return { cmd, prefix };
+  }
+  for (const candidate of RUNNERS) {
+    const probe = spawnSync(candidate.cmd, ["--version"], {
+      env,
+      stdio: "ignore",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    if (!probe.error && probe.status === 0) return candidate;
+  }
+  return null;
+}
+
 function cleanCloudflareEnv(source) {
   const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
   delete env.CLOUDFLARE_API_KEY;

package/upload-large.test.mjs

@@ -42,3 +42,44 @@ test("refuses unknown bucket aliases", () => {
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /expected public\|private/);
 });
+
+test("resolves a real package runner for wrangler on this machine", () => {
+  const result = run("public");
+  assert.equal(result.status, 0, result.stderr);
+  // A node install carrying neither npm nor npx is normal where pnpm is the pinned package
+  // manager; the uploader must find a runner that actually exists rather than assume npx.
+  assert.match(result.stdout, /^runner: (npx|pnpm dlx)$/m);
+});
+
+test("fails loudly when no package runner exists instead of skipping the upload", () => {
+  const result = spawnSync(
+    process.execPath,
+    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
+    {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        RIGHT_RELEASE_UPLOAD_DRY_RUN: "1",
+        RIGHT_RELEASE_WRANGLER_RUNNER: "",
+        PATH: path.join(os.tmpdir(), "right-upload-empty-path"),
+        Path: path.join(os.tmpdir(), "right-upload-empty-path"),
+        PATHEXT: process.env.PATHEXT ?? "",
+      },
+    },
+  );
+  assert.notEqual(result.status, 0, "a box with no runner must not report a successful upload");
+  assert.match(result.stderr, /no package runner found/);
+});
+
+test("honours an explicit runner override", () => {
+  const result = spawnSync(
+    process.execPath,
+    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
+    {
+      encoding: "utf8",
+      env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1", RIGHT_RELEASE_WRANGLER_RUNNER: "pnpm dlx" },
+    },
+  );
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /^runner: pnpm dlx$/m);
+});