@rightkit/release 0.2.30 → 0.2.32

package/build-release.mjs

@@ -0,0 +1,384 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statfsSync,
+  statSync,
+  symlinkSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { cacheFingerprint, releaseEnvironment, runBuildStateMachine } from "./release-state.mjs";
+
+const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const WORKER = path.join(TOOL_ROOT, "release.mjs");
+const args = process.argv.slice(2);
+let configName = "right-release.config.mjs";
+let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
+let dryRun = false;
+
+for (let i = 0; i < args.length; i += 1) {
+  const arg = args[i];
+  if (arg === "--config") configName = args[++i];
+  else if (arg === "--platform") platform = args[++i];
+  else if (arg === "--dry-run") dryRun = true;
+  else if (arg === "--tier" || arg.startsWith("--tier=")) fail("build is tier-neutral; select patch or update only during upload");
+  else if (arg === "-h" || arg === "--help") usage(0);
+  else fail(`unknown argument: ${arg}`);
+}
+if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
+
+const invocationRoot = path.dirname(path.resolve(configName));
+const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
+const relativeConfig = path.relative(repoRoot, path.resolve(configName)).replaceAll("\\", "/");
+if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
+const vaultRoot = path.join(repoRoot, ".right-release");
+mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
+const lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
+let child = null;
+
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.once(signal, () => {
+    if (child?.pid) killTree(child.pid);
+    lock.release();
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  });
+}
+
+try {
+  if (!dryRun) git(repoRoot, ["fetch", "origin", "main"]);
+  const commit = git(repoRoot, ["rev-parse", dryRun ? "HEAD" : "origin/main"]);
+  const shortCommit = commit.slice(0, 8);
+  const worktree = path.join(vaultRoot, "worktrees", `${platform}-${shortCommit}`);
+  if (!existsSync(worktree)) {
+    if (dryRun) fail(`dry-run needs an existing worktree: ${worktree}`);
+    mkdirSync(path.dirname(worktree), { recursive: true });
+    runChecked("git", ["worktree", "add", "--detach", worktree, commit], repoRoot);
+  } else if (git(worktree, ["rev-parse", "HEAD"]) !== commit) {
+    fail(`release worktree exists at the wrong commit: ${worktree}`);
+  }
+
+  const worktreeConfigPath = path.join(worktree, relativeConfig);
+  const config = (await import(`${pathToFileURL(worktreeConfigPath).href}?commit=${commit}`)).default;
+  if (!config?.app || !config?.version) fail("release config must expose app and version");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
+    fail("app and version must be safe release-id components");
+  }
+  const target = config.targets?.[platform];
+  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  const requiredInputs = inputPaths(worktree, worktreeConfigPath, target);
+  const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
+  const inputHashes = hashInputs(requiredInputs);
+  const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
+  const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
+  const cacheKey = cacheFingerprint({
+    cargoLockSha256: cargoLock ? inputHashes[path.relative(worktree, cargoLock)] : "none",
+    rustc: toolVersions.rustc,
+    target: toolVersions.rustHost,
+    features: cargoToml ? sqlCipherFeatures(readFileSync(cargoToml, "utf8")) : [],
+  });
+  const env = {
+    ...process.env,
+    ...releaseEnvironment({ root: vaultRoot, platform, cacheKey, kind: "release" }),
+  };
+  if (!commandExists("sccache")) delete env.RUSTC_WRAPPER;
+  const releaseId = `${config.app}-${config.version}-${shortCommit}`;
+  const platformDir = platform === "win" ? "windows" : "mac";
+  const buildRoot = path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
+  const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
+  const lockPayload = {
+    schema: 1,
+    releaseId,
+    app: config.app,
+    version: config.version,
+    commit,
+    platform,
+    cacheKey,
+    inputs: inputHashes,
+    tools: toolVersions,
+    createdAt: new Date().toISOString(),
+  };
+
+  const result = await runBuildStateMachine({
+    root: repoRoot,
+    app: config.app,
+    version: config.version,
+    commit,
+    platform,
+    requiredInputs,
+    ops: {
+      preflight: async () => {
+        assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
+        assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
+        for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
+        for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(worktree, command.cwd ?? "."), env);
+        mkdirSync(buildRoot, { recursive: true });
+        mkdirSync(stateRoot, { recursive: true });
+        writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
+        writeJson(path.join(stateRoot, "release-inputs.lock.json"), lockPayload);
+        checkpoint(stateRoot, "preflight_complete");
+      },
+      prepare: async () => {
+        const cacheTarget = env.CARGO_TARGET_DIR;
+        const targetLink = path.join(worktree, "src-tauri", "target");
+        mkdirSync(cacheTarget, { recursive: true });
+        if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
+        else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
+          fail(`worktree target exists and is not the release cache link: ${targetLink}`);
+        }
+        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], worktree, env, cacheTarget);
+      },
+      build: async () => {
+        await runProgress(process.execPath, [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"], worktree, env, env.CARGO_TARGET_DIR);
+        checkpoint(stateRoot, "build_complete");
+        checkpoint(stateRoot, "signed");
+        checkpoint(stateRoot, "hardened");
+      },
+      seal: async ({ sealedDir }) => {
+        sealRelease({ configRoot: path.dirname(worktreeConfigPath), sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
+        checkpoint(stateRoot, "sealed");
+      },
+    },
+  });
+  console.log(`right-release build: ${result.resumed ? "resumed" : "sealed"} ${result.releaseId}`);
+  console.log(`sealed: ${result.sealedDir}`);
+} finally {
+  lock.release();
+}
+
+function inputPaths(worktree, configPath, target) {
+  const candidates = [
+    configPath,
+    path.join(worktree, "package.json"),
+    path.join(worktree, "pnpm-lock.yaml"),
+    path.join(worktree, "src-tauri", "Cargo.toml"),
+    path.join(worktree, "src-tauri", "Cargo.lock"),
+    ...(target.preflight?.files ?? []).map((file) => path.resolve(worktree, expandEnv(file))),
+  ];
+  const required = [...new Set(candidates)];
+  for (const file of required) if (!existsSync(file)) fail(`missing required release input: ${file}`);
+  return required;
+}
+
+function hashInputs(files) {
+  return Object.fromEntries(files.map((file) => [path.relative(path.dirname(path.dirname(file)), file), hashFile(file)]));
+}
+
+function hashFile(file) {
+  return createHash("sha256").update(readFileSync(file)).digest("hex");
+}
+
+function sqlCipherFeatures(text) {
+  return [...text.matchAll(/features\s*=\s*\[([^\]]+)\]/g)]
+    .flatMap((match) => match[1].match(/"([^"]+)"/g) ?? [])
+    .map((value) => value.slice(1, -1))
+    .filter((value) => /sqlcipher|openssl/i.test(value));
+}
+
+function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey }) {
+  const sources = new Map();
+  const addSource = (source, role) => {
+    const current = sources.get(source) ?? new Set();
+    current.add(role);
+    sources.set(source, current);
+  };
+  for (const artifact of target.installer?.artifacts ?? []) addSource(path.resolve(configRoot, artifact.file), "installer");
+  for (const artifact of target.updater?.artifacts ?? []) {
+    addSource(path.resolve(configRoot, artifact.file), "updater");
+    addSource(path.resolve(configRoot, artifact.signature), "updater-signature");
+  }
+  for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
+  const temp = `${sealedDir}.tmp-${process.pid}`;
+  if (existsSync(temp)) rmSync(temp, { recursive: true, force: true });
+  mkdirSync(temp, { recursive: true });
+  const files = [];
+  const sourceNames = new Map();
+  for (const [source, roles] of sources) {
+    let name = path.basename(source);
+    if ([...sourceNames.values()].includes(name) && sourceNames.get(source) !== name) name = `${[...roles].join("-")}-${name}`;
+    sourceNames.set(source, name);
+    copyFileSync(source, path.join(temp, name));
+    files.push({ role: [...roles].sort().join("+"), name, sha256: hashFile(source), sizeBytes: statSync(source).size });
+  }
+  const routes = { patch: [], update: [] };
+  for (const artifact of target.installer?.artifacts ?? []) {
+    const source = path.resolve(configRoot, artifact.file);
+    routes.patch.push({ role: "installer", name: sourceNames.get(source), bucket: "public", key: artifact.key });
+  }
+  for (const artifact of target.updater?.artifacts ?? []) {
+    const source = path.resolve(configRoot, artifact.file);
+    const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "private", key: artifact.key, platform: artifact.platform });
+  }
+  writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
+  const manifest = {
+    schema: 1,
+    releaseId,
+    app: config.app,
+    version: config.version,
+    commit,
+    platform,
+    cacheKey,
+    files,
+    routes,
+    inputs: inputHashes,
+    tools: toolVersions,
+    checkpoints: ["preflight_complete", "build_complete", "signed", "hardened", "sealed"],
+    sealedAt: new Date().toISOString(),
+  };
+  writeJson(path.join(temp, "release-manifest.json"), manifest);
+  if (existsSync(sealedDir)) fail(`sealed directory already exists: ${sealedDir}`);
+  mkdirSync(path.dirname(sealedDir), { recursive: true });
+  renameSync(temp, sealedDir);
+  for (const item of files) {
+    const file = path.join(sealedDir, item.name);
+    try { chmodSync(file, 0o444); } catch { /* best effort; hashes are authoritative */ }
+  }
+}
+
+function collectToolVersions(packageManager) {
+  const rustcVerbose = commandOutput("rustc", ["-vV"]);
+  return {
+    node: process.version,
+    packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
+    cargo: commandOutput("cargo", ["--version"]),
+    rustc: rustcVerbose,
+    rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
+    sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
+  };
+}
+
+async function runProgress(cmd, runArgs, cwd, env, watchDir) {
+  const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+  const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
+  let lastProgress = Date.now();
+  let lastMtime = newestMtime(watchDir);
+  const started = Date.now();
+  await new Promise((resolve, reject) => {
+    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    for (const [stream, output] of [[child.stdout, process.stdout], [child.stderr, process.stderr]]) {
+      stream.on("data", (chunk) => { lastProgress = Date.now(); output.write(chunk); });
+    }
+    const monitor = setInterval(() => {
+      const mtime = newestMtime(watchDir);
+      if (mtime > lastMtime) { lastMtime = mtime; lastProgress = Date.now(); }
+      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`);
+      else if (Date.now() - lastProgress > inactivityMs) stop(`no output or file progress for ${Math.round(inactivityMs / 60000)}m`);
+    }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
+    const stop = (reason) => { clearInterval(monitor); killTree(child.pid); reject(new Error(`release step stalled: ${reason}`)); };
+    child.once("error", (error) => { clearInterval(monitor); reject(error); });
+    child.once("exit", (code) => { clearInterval(monitor); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
+  });
+}
+
+function newestMtime(dir) {
+  if (!existsSync(dir)) return 0;
+  try { return statSync(dir).mtimeMs; } catch { return 0; }
+}
+
+function checkpoint(stateRoot, name) {
+  const file = path.join(stateRoot, "checkpoints.json");
+  const state = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { schema: 1, completed: [] };
+  if (!state.completed.includes(name)) state.completed.push(name);
+  state.updatedAt = new Date().toISOString();
+  writeJson(file, state);
+}
+
+function acquireLock(file) {
+  if (existsSync(file)) {
+    try {
+      const existing = JSON.parse(readFileSync(file, "utf8"));
+      if (!processAlive(existing.pid)) unlinkSync(file);
+    } catch {
+      unlinkSync(file);
+    }
+  }
+  try {
+    const fd = openSync(file, "wx");
+    writeFileSync(fd, `${JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString(), argv: process.argv })}\n`);
+    closeSync(fd);
+    return { release: () => { try { unlinkSync(file); } catch { /* already released */ } } };
+  } catch (error) {
+    if (error.code === "EEXIST") fail(`another ${platform} release is active: ${file}`);
+    throw error;
+  }
+}
+
+function processAlive(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  try { process.kill(Number(pid), 0); return true; } catch { return false; }
+}
+
+function assertDiskSpace(dir, minimumGb) {
+  const stats = statfsSync(dir);
+  const freeGb = Number(stats.bavail * stats.bsize) / 1024 ** 3;
+  if (freeGb < minimumGb) fail(`insufficient disk space: ${freeGb.toFixed(1)} GiB free, ${minimumGb} GiB required`);
+}
+
+function assertExecutables(names) {
+  for (const name of names) if (!commandExists(name)) fail(`required executable not found: ${name}`);
+}
+
+function commandExists(name) {
+  const probe = process.platform === "win32" ? spawnSync("where.exe", [name], { stdio: "ignore", windowsHide: true }) : spawnSync("sh", ["-lc", `command -v '${name.replaceAll("'", "")}'`], { stdio: "ignore" });
+  return probe.status === 0;
+}
+
+function commandOutput(cmd, runArgs) {
+  const result = spawnSync(cmd, runArgs, { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`required command failed: ${cmd} ${runArgs.join(" ")}`);
+  return result.stdout.trim();
+}
+
+function git(cwd, runArgs) {
+  return commandOutputAt("git", runArgs, cwd);
+}
+
+function commandOutputAt(cmd, runArgs, cwd) {
+  const result = spawnSync(cmd, runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
+  return result.stdout.trim();
+}
+
+function runChecked(cmd, runArgs, cwd, env = process.env) {
+  const result = spawnSync(cmd, runArgs, { cwd, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (result.status !== 0) fail(`${cmd} exited ${result.status}`);
+}
+
+function killTree(pid) {
+  if (!pid) return;
+  if (process.platform === "win32") spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  else { try { process.kill(-pid, "SIGTERM"); } catch { try { process.kill(pid, "SIGTERM"); } catch { /* gone */ } } }
+}
+
+function expandEnv(value) {
+  return String(value).replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? "").replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
+}
+
+function writeJson(file, value) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function usage(code) {
+  console.log("usage: right-release build --platform win|mac [--config right-release.config.mjs] [--dry-run]");
+  process.exit(code);
+}
+
+function fail(message) {
+  console.error(`right-release build: ${message}`);
+  process.exit(1);
+}

package/cli/right-release.mjs

@@ -5,9 +5,11 @@ import { fileURLToPath } from "node:url";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const commands = new Map([
-  ["release", "release.mjs"],
-  ["build", "release.mjs"],
-  ["package", "release.mjs"],
+  ["release", "build-release.mjs"],
+  ["build", "build-release.mjs"],
+  ["package", "build-release.mjs"],
+  ["publish", "upload-release.mjs"],
+  ["upload", "upload-release.mjs"],
   ["deps", "deps.mjs"],
   ["publish-update", "publish-update.mjs"],
   ["hardening", "hardeningscan.mjs"],
@@ -47,7 +49,7 @@ if (first === "--version" || first === "-v") {
   } else if (rest[0] === "swift") {
     run("publish-swift.mjs", rest.slice(1));
   } else {
-    run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+    run("upload-release.mjs", rest);
   }
 } else if (first === "model") {
   const rest = args.slice(1);
@@ -63,7 +65,7 @@ if (first === "--version" || first === "-v") {
 } else if (commands.has(first)) {
   run(commands.get(first), args.slice(1));
 } else if (first.startsWith("-")) {
-  run("release.mjs", args);
+  run("build-release.mjs", args);
 } else {
   console.error(`right-release: unknown command: ${first}\n`);
   printHelp();
@@ -119,8 +121,11 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
-  release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
-  publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
+  build [--platform mac|win]                         Build, sign/notarize, harden, and seal; never uploads
+  upload --release <id> --platform mac|win --tier patch|update
+                                                      Upload one sealed release; never builds
+  release                                             Compatibility alias for build
+  publish                                             Compatibility alias for upload
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish swift [--scope <s>] [--url <u>] [--dry-run] Test, archive, scan, and publish RightKitSwift to a Swift registry
   model promote --authority heardright --config <file> [--dry-run]
@@ -135,6 +140,6 @@ Commands:
   mirror-root-artifact --file <path> --package-root <dir>
                                                       Persist a worktree artifact in the primary repo root
 
-Direct flags are treated as: right-release release <flags>.
-Publishing requires an explicit tier. Unsigned/local smoke builds stay app-local unless declared in right-release.config.mjs.`);
+Direct flags are treated as: right-release build <flags>.
+Build is tier-neutral. Upload requires an explicit tier. Unsigned/local smoke builds stay app-local.`);
 }

package/create-mac-updater.mjs

@@ -23,6 +23,10 @@ const outputPath = path.resolve(cwd, output);
 if (!dryRun && !existsSync(appPath)) fail(`signed app not found: ${appPath}`);
 
 const env = { ...process.env };
+// bsdtar otherwise serializes macOS extended attributes as AppleDouble `._*`
+// entries. Tauri's Rust extractor writes those entries as real bundle files,
+// invalidating the Developer ID seal and causing syspolicyd to trash the app.
+env.COPYFILE_DISABLE = "1";
 if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
   try {
     env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
@@ -50,7 +54,8 @@ run("tar", [
 run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
 
 function run(command, commandArgs) {
-  console.log(`${dryRun ? "[dry-run] " : ""}${command} ${commandArgs.join(" ")}`);
+  const envPrefix = command === "tar" ? "COPYFILE_DISABLE=1 " : "";
+  console.log(`${dryRun ? "[dry-run] " : ""}${envPrefix}${command} ${commandArgs.join(" ")}`);
   if (dryRun) return;
   const result = spawnSync(command, commandArgs, { cwd, env, stdio: "inherit" });
   if (result.status !== 0) process.exit(result.status ?? 1);

package/create-mac-updater.test.mjs

@@ -8,7 +8,7 @@ const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url
 test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
   const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
+  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
   assert.doesNotMatch(result.stdout, / Test\.app$/m);
   assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
 });

package/legal-contract.mjs

@@ -135,8 +135,15 @@ export function assertLegalReleaseContract(root, legal, appName, platform) {
     appendices.push({ ...appendix, absolutePath: realFile });
   }
 
-  // The in-app gate is the single assent surface. An installer or DMG can only
-  // present text; it cannot record who agreed or the individual/enterprise basis.
+  // The in-app gate is the SINGLE assent surface (Adrian, 2026-07-17). An
+  // installer/DMG can only PRESENT the text: it cannot record who agreed, cannot ask
+  // the individual-vs-enterprise basis, and passive updaters reach neither — so a
+  // license page is duplicate presentation that captures nothing. This gate
+  // previously REQUIRED bundle.licenseFile; it now requires its absence.
+  //
+  // Checked on EVERY platform, not just Windows: one bundle.licenseFile drives BOTH
+  // the NSIS license page and the macOS DMG SLA (branded-dmg.mjs derives its --eula
+  // from it), so a win-only check would let a mac build reintroduce the SLA.
   if (typeof legal.tauriConfig !== "string") fail(appName, "the legal gate requires legal.tauriConfig");
   const tauriPath = path.resolve(appRoot, legal.tauriConfig);
   if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);

package/legal-contract.test.mjs

@@ -46,6 +46,8 @@ function fixture() {
     })),
   };
   writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
+  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
   writeFileSync(
     path.join(tauriDir, "tauri.conf.json"),
     `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
@@ -105,6 +107,8 @@ test("rejects a Windows installer license page: the in-app gate is the only asse
 });
 
 test("rejects a macOS DMG SLA too — one licenseFile drives both bundlers", () => {
+  // branded-dmg.mjs derives its --eula from bundle.licenseFile, so a Windows-only
+  // check would let a mac release quietly reintroduce the mount-time SLA.
   const { root, legal } = fixture();
   writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
   assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /licenseFile must be absent/i);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/pub-upload.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import { accessSync, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = new Map([
+  ["public", "rightapps-downloads"],
+  ["private", "rightapps-updates"],
+]);
+// Wrangler always runs remotely through a package runner; which one exists is machine-specific
+// (a node install without npm/npx is normal when pnpm is the pinned package manager).
+const RUNNERS = [
+  { cmd: "npx", prefix: [] },
+  { cmd: "pnpm", prefix: ["dlx"] },
+];
+
+const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
+if (!localFile || !r2Key) {
+  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
+  process.exit(1);
+}
+
+const bucket = BUCKETS.get(bucketAlias);
+if (!bucket) {
+  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
+  process.exit(1);
+}
+
+try {
+  accessSync(localFile);
+} catch {
+  console.error(`upload-large: missing local file: ${localFile}`);
+  process.exit(1);
+}
+
+const fileSize = statSync(localFile).size;
+const object = `${bucket}/${r2Key}`;
+const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
+const env = cleanCloudflareEnv(process.env);
+
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
+console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
+
+// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
+// and that must fail here rather than after a signed build has already been produced.
+const runner = resolveRunner(env);
+if (!runner) {
+  console.error(
+    "upload-large: no package runner found. Tried: " +
+      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
+      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+  );
+  process.exit(1);
+}
+console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
+
+if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
+  process.exit(0);
+}
+
+const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
+  env,
+  stdio: "inherit",
+  shell: process.platform === "win32",
+  windowsHide: true,
+});
+
+if (result.error) {
+  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(result.status ?? 1);
+
+function resolveRunner(env) {
+  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
+  if (override) {
+    const [cmd, ...prefix] = override.split(/\s+/);
+    return { cmd, prefix };
+  }
+  for (const candidate of RUNNERS) {
+    const probe = spawnSync(candidate.cmd, ["--version"], {
+      env,
+      stdio: "ignore",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    if (!probe.error && probe.status === 0) return candidate;
+  }
+  return null;
+}
+
+function cleanCloudflareEnv(source) {
+  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
+  delete env.CLOUDFLARE_API_KEY;
+  delete env.CLOUDFLARE_EMAIL;
+  delete env.CF_API_KEY;
+  delete env.CF_EMAIL;
+  return env;
+}

package/release-cli-contract.test.mjs

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const cli = path.join(root, "cli", "right-release.mjs");
+const build = path.join(root, "build-release.mjs");
+const upload = path.join(root, "upload-release.mjs");
+
+test("CLI routes build and release only to the build state machine", () => {
+  const source = readFileSync(cli, "utf8");
+  assert.match(source, /\["build",\s*"build-release\.mjs"\]/);
+  assert.match(source, /\["release",\s*"build-release\.mjs"\]/);
+});
+
+test("CLI routes upload and legacy publish only to the upload state machine", () => {
+  const source = readFileSync(cli, "utf8");
+  assert.match(source, /\["upload",\s*"upload-release\.mjs"\]/);
+  assert.match(source, /\["publish",\s*"upload-release\.mjs"\]/);
+  assert.doesNotMatch(source, /first === "publish"[\s\S]{0,500}run\("release\.mjs"/);
+});
+
+test("build is tier-neutral and rejects a tier before touching a repository", () => {
+  const result = spawnSync(process.execPath, [build, "--platform", "win", "--tier", "patch"], {
+    cwd: mkdtempSync(path.join(os.tmpdir(), "right-build-cli-")),
+    encoding: "utf8",
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /build is tier-neutral/i);
+});
+
+test("upload requires an explicit patch or update tier before reading a release", () => {
+  const result = spawnSync(process.execPath, [upload, "--platform", "win", "--release", "fixture-1.0.0-deadbeef"], {
+    cwd: mkdtempSync(path.join(os.tmpdir(), "right-upload-cli-")),
+    encoding: "utf8",
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /tier is required.*patch\|update/i);
+});