@rightkit/release 0.2.28 → 0.2.30

package/create-mac-updater.mjs

@@ -38,7 +38,15 @@ env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ??= "";
 
 rmSync(outputPath, { force: true });
 rmSync(`${outputPath}.sig`, { force: true });
-run("tar", ["-czf", outputPath, "-C", path.dirname(appPath), path.basename(appPath)]);
+// Tauri 2.10 strips the first path component while extracting. Omitting the explicit
+// App.app/ directory entry prevents it from unpacking that entry onto its existing temp dir.
+run("tar", [
+  "-czf",
+  outputPath,
+  "-C",
+  path.dirname(appPath),
+  path.join(path.basename(appPath), "Contents"),
+]);
 run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
 
 function run(command, commandArgs) {

package/create-mac-updater.test.mjs

@@ -8,6 +8,7 @@ const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url
 test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
   const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /tar .*Test\.app\.tar\.gz.*Test\.app/);
+  assert.match(result.stdout, /tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
+  assert.doesNotMatch(result.stdout, / Test\.app$/m);
   assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
 });

package/legal-contract.mjs

@@ -135,24 +135,19 @@ export function assertLegalReleaseContract(root, legal, appName, platform) {
     appendices.push({ ...appendix, absolutePath: realFile });
   }
 
-  if (platform === "win") {
-    if (typeof legal.tauriConfig !== "string") fail(appName, "Windows legal gate requires legal.tauriConfig");
-    const tauriPath = path.resolve(appRoot, legal.tauriConfig);
-    if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);
-    const tauri = readJson(tauriPath, appName, "Tauri config");
-    // The in-app gate is the SINGLE assent surface (Adrian, 2026-07-17). An
-    // installer/DMG can only PRESENT the text: it cannot record who agreed, cannot
-    // ask the individual-vs-enterprise basis, and passive updaters reach neither —
-    // so a license page is duplicate presentation that captures nothing. This gate
-    // previously REQUIRED bundle.licenseFile; it now requires its absence.
-    const configured = tauri.bundle?.licenseFile;
-    if (typeof configured === "string" && configured.trim()) {
-      fail(
-        appName,
-        "Windows Tauri bundle.licenseFile must be absent: the in-app legal gate is the only assent surface, " +
-          "and an installer license page duplicates it without recording acceptance",
-      );
-    }
+  // The in-app gate is the single assent surface. An installer or DMG can only
+  // present text; it cannot record who agreed or the individual/enterprise basis.
+  if (typeof legal.tauriConfig !== "string") fail(appName, "the legal gate requires legal.tauriConfig");
+  const tauriPath = path.resolve(appRoot, legal.tauriConfig);
+  if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);
+  const tauri = readJson(tauriPath, appName, "Tauri config");
+  const configured = tauri.bundle?.licenseFile;
+  if (typeof configured === "string" && configured.trim()) {
+    fail(
+      appName,
+      "Tauri bundle.licenseFile must be absent: the in-app legal gate is the only assent surface, and an " +
+        "installer license page (NSIS) or DMG SLA duplicates it without recording acceptance",
+    );
   }
 
   return {

package/legal-contract.test.mjs

@@ -46,8 +46,6 @@ function fixture() {
     })),
   };
   writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
-  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
   writeFileSync(
     path.join(tauriDir, "tauri.conf.json"),
     `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
@@ -100,12 +98,25 @@ test("rejects an explicitly unresolved release blocker even without a checkbox",
   assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /release blocker/i);
 });
 
-test("requires Windows installer clickthrough to use the exact EULA snapshot", () => {
+test("rejects a Windows installer license page: the in-app gate is the only assent surface", () => {
   const { root, legal } = fixture();
   writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
   assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile must be absent/i);
 });
 
+test("rejects a macOS DMG SLA too — one licenseFile drives both bundlers", () => {
+  const { root, legal } = fixture();
+  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /licenseFile must be absent/i);
+});
+
+test("accepts an app whose installer carries no license page", () => {
+  const { root, legal } = fixture();
+  for (const platform of ["win", "mac"]) {
+    assert.doesNotThrow(() => assertLegalReleaseContract(root, legal, "fixture", platform));
+  }
+});
+
 test("requires third-party build provenance", () => {
   const { root, legal, manifest } = fixture();
   const notice = "Third-party software is included.\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-update.test.mjs

@@ -193,10 +193,10 @@ test("requires the durable release credential before the first patch upload", ()
     ...process.env,
     APPDATA: path.join(path.dirname(config), "empty-appdata"),
     RIGHT_RELEASE_TIER: "patch",
+    RIGHTAPPS_RELEASE_TOKEN_FILE: path.join(path.dirname(config), "missing-release-token"),
     RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session",
   };
   delete env.RIGHTAPPS_RELEASE_TOKEN;
-  delete env.RIGHTAPPS_RELEASE_TOKEN_FILE;
   const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
     encoding: "utf8",
     env,

package/release-token.mjs

@@ -23,7 +23,11 @@ export async function loadReleaseToken({ env = process.env, platform = process.p
   if (direct) return direct;
 
   if (env.RIGHTAPPS_RELEASE_TOKEN_FILE) {
-    return readTokenFile(path.resolve(env.RIGHTAPPS_RELEASE_TOKEN_FILE));
+    try {
+      return await readTokenFile(path.resolve(env.RIGHTAPPS_RELEASE_TOKEN_FILE));
+    } catch (error) {
+      throw new Error(`RIGHTAPPS_RELEASE_TOKEN is unavailable (${error.message})`);
+    }
   }
 
   if (platform === "win32") {

package/release.mjs

@@ -16,7 +16,11 @@ const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
 const RIGHTKIT_VERSIONS = JSON.parse(readFileSync(path.resolve(TOOL_ROOT, "rightkit-versions.json"), "utf8"));
 const VERSION = RIGHTKIT_VERSIONS.stagedNpm?.["@rightkit/release"] ?? RIGHTKIT_VERSIONS.npm["@rightkit/release"];
 const TIERS = new Set(["patch", "update"]);
-const RIGHTKIT_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.npm, RIGHTKIT_VERSIONS.stagedNpm);
+const RIGHTKIT_ALLOWED = buildAllowedVersions(
+  RIGHTKIT_VERSIONS.npm,
+  RIGHTKIT_VERSIONS.stagedNpm,
+  RIGHTKIT_VERSIONS.legacyNpm,
+);
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
@@ -249,11 +253,15 @@ async function validateRightKitPackageContract(root, appName) {
   }
 }
 
-function buildAllowedVersions(published = {}, staged = {}) {
+function buildAllowedVersions(published = {}, staged = {}, legacy = {}) {
   const allowed = new Map();
-  for (const [name, version] of [...Object.entries(published), ...Object.entries(staged)]) {
+  for (const [name, value] of [
+    ...Object.entries(published),
+    ...Object.entries(staged),
+    ...Object.entries(legacy),
+  ]) {
     const versions = allowed.get(name) ?? new Set();
-    versions.add(version);
+    for (const version of Array.isArray(value) ? value : [value]) versions.add(version);
     allowed.set(name, versions);
   }
   return allowed;