@rightkit/release 0.2.26 → 0.2.28

package/cargo-contract.mjs

@@ -34,10 +34,12 @@ export function assertPublishedRightKitCargoDependencies(dependencies, published
   let checked = 0;
   for (const dependency of dependencies.filter(({ name }) => name.startsWith("rightkit-"))) {
     checked += 1;
-    const expected = published.get(dependency.name);
-    if (!expected) throw new Error(`${label} ${dependency.name} is not a published RightKit crate`);
-    if (!CRATES_IO_SOURCES.has(dependency.source) || dependency.path || dependency.registry || dependency.req !== `=${expected}`) {
-      throw new Error(`${label} ${dependency.name} must use the exact crates.io version "=${expected}"`);
+    const configured = published.get(dependency.name);
+    if (!configured) throw new Error(`${label} ${dependency.name} is not a published RightKit crate`);
+    const allowed = configured instanceof Set ? configured : new Set(Array.isArray(configured) ? configured : [configured]);
+    const exactVersions = new Set([...allowed].map((version) => `=${version}`));
+    if (!CRATES_IO_SOURCES.has(dependency.source) || dependency.path || dependency.registry || !exactVersions.has(dependency.req)) {
+      throw new Error(`${label} ${dependency.name} must use exact crates.io versions (${[...exactVersions].join(" or ")})`);
     }
   }
   return checked;

package/legal-contract.mjs

@@ -140,14 +140,18 @@ export function assertLegalReleaseContract(root, legal, appName, platform) {
     const tauriPath = path.resolve(appRoot, legal.tauriConfig);
     if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);
     const tauri = readJson(tauriPath, appName, "Tauri config");
+    // The in-app gate is the SINGLE assent surface (Adrian, 2026-07-17). An
+    // installer/DMG can only PRESENT the text: it cannot record who agreed, cannot
+    // ask the individual-vs-enterprise basis, and passive updaters reach neither —
+    // so a license page is duplicate presentation that captures nothing. This gate
+    // previously REQUIRED bundle.licenseFile; it now requires its absence.
     const configured = tauri.bundle?.licenseFile;
-    if (typeof configured !== "string" || !configured.trim()) {
-      fail(appName, "Windows Tauri bundle.licenseFile must point to the snapshot EULA");
-    }
-    const configuredPath = path.resolve(path.dirname(tauriPath), configured);
-    const eula = resolvedDocuments.find((document) => document.role === "eula");
-    if (!eula || path.normalize(configuredPath).toLowerCase() !== path.normalize(eula.absolutePath).toLowerCase()) {
-      fail(appName, "Windows Tauri bundle.licenseFile must point to the exact EULA snapshot");
+    if (typeof configured === "string" && configured.trim()) {
+      fail(
+        appName,
+        "Windows Tauri bundle.licenseFile must be absent: the in-app legal gate is the only assent surface, " +
+          "and an installer license page duplicates it without recording acceptance",
+      );
     }
   }
 

package/legal-contract.test.mjs

@@ -46,9 +46,11 @@ function fixture() {
     })),
   };
   writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
+  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
   writeFileSync(
     path.join(tauriDir, "tauri.conf.json"),
-    `${JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }, null, 2)}\n`,
+    `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
   );
   return {
     root,
@@ -100,8 +102,8 @@ test("rejects an explicitly unresolved release blocker even without a checkbox",
 
 test("requires Windows installer clickthrough to use the exact EULA snapshot", () => {
   const { root, legal } = fixture();
-  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/LICENSE.md" } }));
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile.*EULA/i);
+  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile must be absent/i);
 });
 
 test("requires third-party build provenance", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.26",
+  "version": "0.2.28",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/pub-upload.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import { accessSync, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = new Map([
+  ["public", "rightapps-downloads"],
+  ["private", "rightapps-updates"],
+]);
+// Wrangler always runs remotely through a package runner; which one exists is machine-specific
+// (a node install without npm/npx is normal when pnpm is the pinned package manager).
+const RUNNERS = [
+  { cmd: "npx", prefix: [] },
+  { cmd: "pnpm", prefix: ["dlx"] },
+];
+
+const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
+if (!localFile || !r2Key) {
+  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
+  process.exit(1);
+}
+
+const bucket = BUCKETS.get(bucketAlias);
+if (!bucket) {
+  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
+  process.exit(1);
+}
+
+try {
+  accessSync(localFile);
+} catch {
+  console.error(`upload-large: missing local file: ${localFile}`);
+  process.exit(1);
+}
+
+const fileSize = statSync(localFile).size;
+const object = `${bucket}/${r2Key}`;
+const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
+const env = cleanCloudflareEnv(process.env);
+
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
+console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
+
+// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
+// and that must fail here rather than after a signed build has already been produced.
+const runner = resolveRunner(env);
+if (!runner) {
+  console.error(
+    "upload-large: no package runner found. Tried: " +
+      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
+      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+  );
+  process.exit(1);
+}
+console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
+
+if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
+  process.exit(0);
+}
+
+const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
+  env,
+  stdio: "inherit",
+  shell: process.platform === "win32",
+  windowsHide: true,
+});
+
+if (result.error) {
+  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(result.status ?? 1);
+
+function resolveRunner(env) {
+  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
+  if (override) {
+    const [cmd, ...prefix] = override.split(/\s+/);
+    return { cmd, prefix };
+  }
+  for (const candidate of RUNNERS) {
+    const probe = spawnSync(candidate.cmd, ["--version"], {
+      env,
+      stdio: "ignore",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    if (!probe.error && probe.status === 0) return candidate;
+  }
+  return null;
+}
+
+function cleanCloudflareEnv(source) {
+  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
+  delete env.CLOUDFLARE_API_KEY;
+  delete env.CLOUDFLARE_EMAIL;
+  delete env.CF_API_KEY;
+  delete env.CF_EMAIL;
+  return env;
+}

package/release.mjs

@@ -14,9 +14,10 @@ const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
 const RIGHTKIT_VERSIONS = JSON.parse(readFileSync(path.resolve(TOOL_ROOT, "rightkit-versions.json"), "utf8"));
-const VERSION = RIGHTKIT_VERSIONS.npm["@rightkit/release"];
+const VERSION = RIGHTKIT_VERSIONS.stagedNpm?.["@rightkit/release"] ?? RIGHTKIT_VERSIONS.npm["@rightkit/release"];
 const TIERS = new Set(["patch", "update"]);
-const RIGHTKIT_EXPECTED = new Map(Object.entries(RIGHTKIT_VERSIONS.npm));
+const RIGHTKIT_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.npm, RIGHTKIT_VERSIONS.stagedNpm);
+const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
 const args = process.argv.slice(2);
@@ -65,7 +66,7 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
 await validateRightKitPackageContract(root, config.app);
-validateRightKitCargoContract(root, RIGHTKIT_VERSIONS.cargo, config.app ?? path.basename(root));
+validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
 const legalContract = config.legal
@@ -237,16 +238,27 @@ async function validateRightKitPackageContract(root, appName) {
     if (FORBIDDEN_RIGHTKIT_SPEC.test(String(specifier))) {
       fail(`${appName ?? pkg.name ?? "app"} ${name} must come from the published npm package, not ${specifier}`);
     }
-    const expected = RIGHTKIT_EXPECTED.get(name);
-    if (expected && specifier !== expected) {
-      fail(`${appName ?? pkg.name ?? "app"} ${name} must be ${expected}, got ${specifier}`);
+    const allowed = RIGHTKIT_ALLOWED.get(name);
+    if (allowed && !allowed.has(specifier)) {
+      fail(`${appName ?? pkg.name ?? "app"} ${name} must be one of ${[...allowed].join(", ")}, got ${specifier}`);
     }
   }
-  if (pkg.devDependencies?.["@rightkit/release"] !== RIGHTKIT_EXPECTED.get("@rightkit/release")) {
-    fail(`${appName ?? pkg.name ?? "app"} must depend on @rightkit/release ${RIGHTKIT_EXPECTED.get("@rightkit/release")} in devDependencies`);
+  const releaseAllowed = RIGHTKIT_ALLOWED.get("@rightkit/release");
+  if (!releaseAllowed?.has(pkg.devDependencies?.["@rightkit/release"])) {
+    fail(`${appName ?? pkg.name ?? "app"} must depend on a supported @rightkit/release version in devDependencies`);
   }
 }
 
+function buildAllowedVersions(published = {}, staged = {}) {
+  const allowed = new Map();
+  for (const [name, version] of [...Object.entries(published), ...Object.entries(staged)]) {
+    const versions = allowed.get(name) ?? new Set();
+    versions.add(version);
+    allowed.set(name, versions);
+  }
+  return allowed;
+}
+
 async function commandEnv(command, root) {
   const env = { ...(command.env ?? {}) };
   for (const [name, rel] of Object.entries(command.envFiles ?? {})) {