@rightkit/release 0.2.24 → 0.2.26

package/legal-contract.mjs

@@ -60,15 +60,12 @@ export function assertLegalReleaseContract(root, legal, appName, platform) {
   const manifest = readJson(manifestPath, appName, "legal manifest");
   const snapshotRoot = realpathSync(path.dirname(manifestPath));
 
-  if (manifest.schema !== 1 || manifest.suite !== "right-suite-desktop") {
-    fail(appName, "manifest must use Right Suite legal schema 1");
+  if (manifest.schema !== 2 || manifest.suite !== "right-suite-desktop") {
+    fail(appName, "manifest must use Right Suite legal schema 2");
   }
   if (!APP_KEY.test(manifest.appKey ?? "") || (appName && manifest.appKey !== appName)) {
     fail(appName, `manifest appKey must match release app (${manifest.appKey ?? "missing"})`);
   }
-  if (manifest.freeWorkerMaximum !== 9 || manifest.paidWorkerMinimum !== 10) {
-    fail(appName, "manifest Worker threshold must be free through 9 and paid from 10");
-  }
   if (typeof manifest.acceptanceVersion !== "string" || !manifest.acceptanceVersion.trim()) {
     fail(appName, "manifest acceptanceVersion is required");
   }

package/legal-contract.test.mjs

@@ -26,15 +26,13 @@ function fixture() {
   ];
   for (const [, file, content] of definitions) writeFileSync(path.join(legalDir, file), content);
   const manifest = {
-    schema: 1,
+    schema: 2,
     suite: "right-suite-desktop",
     appKey: "fixture",
     productName: "Fixture",
     licensor: "Damned Ventures LLC",
     effectiveDate: "2026-07-16",
     acceptanceVersion: "fixture-2026-07-16-v1",
-    freeWorkerMaximum: 9,
-    paidWorkerMinimum: 10,
     documents: definitions.map(([role, file, content]) => ({
       id: `fixture-${role}`,
       role,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/right-suite-contract.test.mjs

@@ -317,8 +317,8 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.24");
-  assert.equal(versions.npm["@rightkit/legal"], "0.1.0");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.26");
+  assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
   assert.equal(versions.npm["@rightkit/tauri"], "0.1.0");
@@ -326,7 +326,7 @@ test("RightKit exposes one current version manifest", () => {
   assert.equal(versions.cargo["rightkit-license"], "0.1.2");
   assert.equal(versions.cargo["rightkit-logs"], "0.1.0");
   assert.equal(versions.cargo["rightkit-tauri"], "0.1.0");
-  assert.deepEqual(versions.stagedCargo, {});
+  assert.deepEqual(versions.stagedCargo, { "rightkit-license": "0.1.3" });
   getCurrentCargoVersionContract();
 });
 

package/rightkit-versions.json

@@ -2,12 +2,12 @@
   "schema": 1,
   "packageManager": "pnpm@11.12.0",
   "npm": {
-    "@rightkit/legal": "0.1.0",
+    "@rightkit/legal": "0.2.0",
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.24",
+    "@rightkit/release": "0.2.26",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -17,7 +17,7 @@
     "rightkit-process": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
-  "stagedCargo": {},
+  "stagedCargo": { "rightkit-license": "0.1.3" },
   "swift": {
     "rightkit-swift": {
       "url": "https://github.com/bogusyogi/rightkit-swift.git",

package/upload-large.mjs

@@ -8,6 +8,12 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
+// Wrangler always runs remotely through a package runner; which one exists is machine-specific
+// (a node install without npm/npx is normal when pnpm is the pinned package manager).
+const RUNNERS = [
+  { cmd: "npx", prefix: [] },
+  { cmd: "pnpm", prefix: ["dlx"] },
+];
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -36,11 +42,24 @@ const env = cleanCloudflareEnv(process.env);
 console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
 console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
 
+// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
+// and that must fail here rather than after a signed build has already been produced.
+const runner = resolveRunner(env);
+if (!runner) {
+  console.error(
+    "upload-large: no package runner found. Tried: " +
+      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
+      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+  );
+  process.exit(1);
+}
+console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
+
 if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
   process.exit(0);
 }
 
-const result = spawnSync("npx", wranglerArgs, {
+const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
   env,
   stdio: "inherit",
   shell: process.platform === "win32",
@@ -53,6 +72,24 @@ if (result.error) {
 }
 process.exit(result.status ?? 1);
 
+function resolveRunner(env) {
+  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
+  if (override) {
+    const [cmd, ...prefix] = override.split(/\s+/);
+    return { cmd, prefix };
+  }
+  for (const candidate of RUNNERS) {
+    const probe = spawnSync(candidate.cmd, ["--version"], {
+      env,
+      stdio: "ignore",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    if (!probe.error && probe.status === 0) return candidate;
+  }
+  return null;
+}
+
 function cleanCloudflareEnv(source) {
   const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
   delete env.CLOUDFLARE_API_KEY;

package/upload-large.test.mjs

@@ -42,3 +42,44 @@ test("refuses unknown bucket aliases", () => {
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /expected public\|private/);
 });
+
+test("resolves a real package runner for wrangler on this machine", () => {
+  const result = run("public");
+  assert.equal(result.status, 0, result.stderr);
+  // A node install carrying neither npm nor npx is normal where pnpm is the pinned package
+  // manager; the uploader must find a runner that actually exists rather than assume npx.
+  assert.match(result.stdout, /^runner: (npx|pnpm dlx)$/m);
+});
+
+test("fails loudly when no package runner exists instead of skipping the upload", () => {
+  const result = spawnSync(
+    process.execPath,
+    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
+    {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        RIGHT_RELEASE_UPLOAD_DRY_RUN: "1",
+        RIGHT_RELEASE_WRANGLER_RUNNER: "",
+        PATH: path.join(os.tmpdir(), "right-upload-empty-path"),
+        Path: path.join(os.tmpdir(), "right-upload-empty-path"),
+        PATHEXT: process.env.PATHEXT ?? "",
+      },
+    },
+  );
+  assert.notEqual(result.status, 0, "a box with no runner must not report a successful upload");
+  assert.match(result.stderr, /no package runner found/);
+});
+
+test("honours an explicit runner override", () => {
+  const result = spawnSync(
+    process.execPath,
+    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
+    {
+      encoding: "utf8",
+      env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1", RIGHT_RELEASE_WRANGLER_RUNNER: "pnpm dlx" },
+    },
+  );
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /^runner: pnpm dlx$/m);
+});