@rightkit/release 0.2.31 → 0.2.32

package/build-release.mjs

@@ -0,0 +1,384 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statfsSync,
+  statSync,
+  symlinkSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { cacheFingerprint, releaseEnvironment, runBuildStateMachine } from "./release-state.mjs";
+
+const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const WORKER = path.join(TOOL_ROOT, "release.mjs");
+const args = process.argv.slice(2);
+let configName = "right-release.config.mjs";
+let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
+let dryRun = false;
+
+for (let i = 0; i < args.length; i += 1) {
+  const arg = args[i];
+  if (arg === "--config") configName = args[++i];
+  else if (arg === "--platform") platform = args[++i];
+  else if (arg === "--dry-run") dryRun = true;
+  else if (arg === "--tier" || arg.startsWith("--tier=")) fail("build is tier-neutral; select patch or update only during upload");
+  else if (arg === "-h" || arg === "--help") usage(0);
+  else fail(`unknown argument: ${arg}`);
+}
+if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
+
+const invocationRoot = path.dirname(path.resolve(configName));
+const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
+const relativeConfig = path.relative(repoRoot, path.resolve(configName)).replaceAll("\\", "/");
+if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
+const vaultRoot = path.join(repoRoot, ".right-release");
+mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
+const lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
+let child = null;
+
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.once(signal, () => {
+    if (child?.pid) killTree(child.pid);
+    lock.release();
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  });
+}
+
+try {
+  if (!dryRun) git(repoRoot, ["fetch", "origin", "main"]);
+  const commit = git(repoRoot, ["rev-parse", dryRun ? "HEAD" : "origin/main"]);
+  const shortCommit = commit.slice(0, 8);
+  const worktree = path.join(vaultRoot, "worktrees", `${platform}-${shortCommit}`);
+  if (!existsSync(worktree)) {
+    if (dryRun) fail(`dry-run needs an existing worktree: ${worktree}`);
+    mkdirSync(path.dirname(worktree), { recursive: true });
+    runChecked("git", ["worktree", "add", "--detach", worktree, commit], repoRoot);
+  } else if (git(worktree, ["rev-parse", "HEAD"]) !== commit) {
+    fail(`release worktree exists at the wrong commit: ${worktree}`);
+  }
+
+  const worktreeConfigPath = path.join(worktree, relativeConfig);
+  const config = (await import(`${pathToFileURL(worktreeConfigPath).href}?commit=${commit}`)).default;
+  if (!config?.app || !config?.version) fail("release config must expose app and version");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
+    fail("app and version must be safe release-id components");
+  }
+  const target = config.targets?.[platform];
+  if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  const requiredInputs = inputPaths(worktree, worktreeConfigPath, target);
+  const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
+  const inputHashes = hashInputs(requiredInputs);
+  const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
+  const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
+  const cacheKey = cacheFingerprint({
+    cargoLockSha256: cargoLock ? inputHashes[path.relative(worktree, cargoLock)] : "none",
+    rustc: toolVersions.rustc,
+    target: toolVersions.rustHost,
+    features: cargoToml ? sqlCipherFeatures(readFileSync(cargoToml, "utf8")) : [],
+  });
+  const env = {
+    ...process.env,
+    ...releaseEnvironment({ root: vaultRoot, platform, cacheKey, kind: "release" }),
+  };
+  if (!commandExists("sccache")) delete env.RUSTC_WRAPPER;
+  const releaseId = `${config.app}-${config.version}-${shortCommit}`;
+  const platformDir = platform === "win" ? "windows" : "mac";
+  const buildRoot = path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
+  const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
+  const lockPayload = {
+    schema: 1,
+    releaseId,
+    app: config.app,
+    version: config.version,
+    commit,
+    platform,
+    cacheKey,
+    inputs: inputHashes,
+    tools: toolVersions,
+    createdAt: new Date().toISOString(),
+  };
+
+  const result = await runBuildStateMachine({
+    root: repoRoot,
+    app: config.app,
+    version: config.version,
+    commit,
+    platform,
+    requiredInputs,
+    ops: {
+      preflight: async () => {
+        assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
+        assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
+        for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
+        for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(worktree, command.cwd ?? "."), env);
+        mkdirSync(buildRoot, { recursive: true });
+        mkdirSync(stateRoot, { recursive: true });
+        writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
+        writeJson(path.join(stateRoot, "release-inputs.lock.json"), lockPayload);
+        checkpoint(stateRoot, "preflight_complete");
+      },
+      prepare: async () => {
+        const cacheTarget = env.CARGO_TARGET_DIR;
+        const targetLink = path.join(worktree, "src-tauri", "target");
+        mkdirSync(cacheTarget, { recursive: true });
+        if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
+        else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
+          fail(`worktree target exists and is not the release cache link: ${targetLink}`);
+        }
+        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], worktree, env, cacheTarget);
+      },
+      build: async () => {
+        await runProgress(process.execPath, [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"], worktree, env, env.CARGO_TARGET_DIR);
+        checkpoint(stateRoot, "build_complete");
+        checkpoint(stateRoot, "signed");
+        checkpoint(stateRoot, "hardened");
+      },
+      seal: async ({ sealedDir }) => {
+        sealRelease({ configRoot: path.dirname(worktreeConfigPath), sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
+        checkpoint(stateRoot, "sealed");
+      },
+    },
+  });
+  console.log(`right-release build: ${result.resumed ? "resumed" : "sealed"} ${result.releaseId}`);
+  console.log(`sealed: ${result.sealedDir}`);
+} finally {
+  lock.release();
+}
+
+function inputPaths(worktree, configPath, target) {
+  const candidates = [
+    configPath,
+    path.join(worktree, "package.json"),
+    path.join(worktree, "pnpm-lock.yaml"),
+    path.join(worktree, "src-tauri", "Cargo.toml"),
+    path.join(worktree, "src-tauri", "Cargo.lock"),
+    ...(target.preflight?.files ?? []).map((file) => path.resolve(worktree, expandEnv(file))),
+  ];
+  const required = [...new Set(candidates)];
+  for (const file of required) if (!existsSync(file)) fail(`missing required release input: ${file}`);
+  return required;
+}
+
+function hashInputs(files) {
+  return Object.fromEntries(files.map((file) => [path.relative(path.dirname(path.dirname(file)), file), hashFile(file)]));
+}
+
+function hashFile(file) {
+  return createHash("sha256").update(readFileSync(file)).digest("hex");
+}
+
+function sqlCipherFeatures(text) {
+  return [...text.matchAll(/features\s*=\s*\[([^\]]+)\]/g)]
+    .flatMap((match) => match[1].match(/"([^"]+)"/g) ?? [])
+    .map((value) => value.slice(1, -1))
+    .filter((value) => /sqlcipher|openssl/i.test(value));
+}
+
+function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey }) {
+  const sources = new Map();
+  const addSource = (source, role) => {
+    const current = sources.get(source) ?? new Set();
+    current.add(role);
+    sources.set(source, current);
+  };
+  for (const artifact of target.installer?.artifacts ?? []) addSource(path.resolve(configRoot, artifact.file), "installer");
+  for (const artifact of target.updater?.artifacts ?? []) {
+    addSource(path.resolve(configRoot, artifact.file), "updater");
+    addSource(path.resolve(configRoot, artifact.signature), "updater-signature");
+  }
+  for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
+  const temp = `${sealedDir}.tmp-${process.pid}`;
+  if (existsSync(temp)) rmSync(temp, { recursive: true, force: true });
+  mkdirSync(temp, { recursive: true });
+  const files = [];
+  const sourceNames = new Map();
+  for (const [source, roles] of sources) {
+    let name = path.basename(source);
+    if ([...sourceNames.values()].includes(name) && sourceNames.get(source) !== name) name = `${[...roles].join("-")}-${name}`;
+    sourceNames.set(source, name);
+    copyFileSync(source, path.join(temp, name));
+    files.push({ role: [...roles].sort().join("+"), name, sha256: hashFile(source), sizeBytes: statSync(source).size });
+  }
+  const routes = { patch: [], update: [] };
+  for (const artifact of target.installer?.artifacts ?? []) {
+    const source = path.resolve(configRoot, artifact.file);
+    routes.patch.push({ role: "installer", name: sourceNames.get(source), bucket: "public", key: artifact.key });
+  }
+  for (const artifact of target.updater?.artifacts ?? []) {
+    const source = path.resolve(configRoot, artifact.file);
+    const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "private", key: artifact.key, platform: artifact.platform });
+  }
+  writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
+  const manifest = {
+    schema: 1,
+    releaseId,
+    app: config.app,
+    version: config.version,
+    commit,
+    platform,
+    cacheKey,
+    files,
+    routes,
+    inputs: inputHashes,
+    tools: toolVersions,
+    checkpoints: ["preflight_complete", "build_complete", "signed", "hardened", "sealed"],
+    sealedAt: new Date().toISOString(),
+  };
+  writeJson(path.join(temp, "release-manifest.json"), manifest);
+  if (existsSync(sealedDir)) fail(`sealed directory already exists: ${sealedDir}`);
+  mkdirSync(path.dirname(sealedDir), { recursive: true });
+  renameSync(temp, sealedDir);
+  for (const item of files) {
+    const file = path.join(sealedDir, item.name);
+    try { chmodSync(file, 0o444); } catch { /* best effort; hashes are authoritative */ }
+  }
+}
+
+function collectToolVersions(packageManager) {
+  const rustcVerbose = commandOutput("rustc", ["-vV"]);
+  return {
+    node: process.version,
+    packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
+    cargo: commandOutput("cargo", ["--version"]),
+    rustc: rustcVerbose,
+    rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
+    sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
+  };
+}
+
+async function runProgress(cmd, runArgs, cwd, env, watchDir) {
+  const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+  const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
+  let lastProgress = Date.now();
+  let lastMtime = newestMtime(watchDir);
+  const started = Date.now();
+  await new Promise((resolve, reject) => {
+    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    for (const [stream, output] of [[child.stdout, process.stdout], [child.stderr, process.stderr]]) {
+      stream.on("data", (chunk) => { lastProgress = Date.now(); output.write(chunk); });
+    }
+    const monitor = setInterval(() => {
+      const mtime = newestMtime(watchDir);
+      if (mtime > lastMtime) { lastMtime = mtime; lastProgress = Date.now(); }
+      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`);
+      else if (Date.now() - lastProgress > inactivityMs) stop(`no output or file progress for ${Math.round(inactivityMs / 60000)}m`);
+    }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
+    const stop = (reason) => { clearInterval(monitor); killTree(child.pid); reject(new Error(`release step stalled: ${reason}`)); };
+    child.once("error", (error) => { clearInterval(monitor); reject(error); });
+    child.once("exit", (code) => { clearInterval(monitor); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
+  });
+}
+
+function newestMtime(dir) {
+  if (!existsSync(dir)) return 0;
+  try { return statSync(dir).mtimeMs; } catch { return 0; }
+}
+
+function checkpoint(stateRoot, name) {
+  const file = path.join(stateRoot, "checkpoints.json");
+  const state = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { schema: 1, completed: [] };
+  if (!state.completed.includes(name)) state.completed.push(name);
+  state.updatedAt = new Date().toISOString();
+  writeJson(file, state);
+}
+
+function acquireLock(file) {
+  if (existsSync(file)) {
+    try {
+      const existing = JSON.parse(readFileSync(file, "utf8"));
+      if (!processAlive(existing.pid)) unlinkSync(file);
+    } catch {
+      unlinkSync(file);
+    }
+  }
+  try {
+    const fd = openSync(file, "wx");
+    writeFileSync(fd, `${JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString(), argv: process.argv })}\n`);
+    closeSync(fd);
+    return { release: () => { try { unlinkSync(file); } catch { /* already released */ } } };
+  } catch (error) {
+    if (error.code === "EEXIST") fail(`another ${platform} release is active: ${file}`);
+    throw error;
+  }
+}
+
+function processAlive(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  try { process.kill(Number(pid), 0); return true; } catch { return false; }
+}
+
+function assertDiskSpace(dir, minimumGb) {
+  const stats = statfsSync(dir);
+  const freeGb = Number(stats.bavail * stats.bsize) / 1024 ** 3;
+  if (freeGb < minimumGb) fail(`insufficient disk space: ${freeGb.toFixed(1)} GiB free, ${minimumGb} GiB required`);
+}
+
+function assertExecutables(names) {
+  for (const name of names) if (!commandExists(name)) fail(`required executable not found: ${name}`);
+}
+
+function commandExists(name) {
+  const probe = process.platform === "win32" ? spawnSync("where.exe", [name], { stdio: "ignore", windowsHide: true }) : spawnSync("sh", ["-lc", `command -v '${name.replaceAll("'", "")}'`], { stdio: "ignore" });
+  return probe.status === 0;
+}
+
+function commandOutput(cmd, runArgs) {
+  const result = spawnSync(cmd, runArgs, { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`required command failed: ${cmd} ${runArgs.join(" ")}`);
+  return result.stdout.trim();
+}
+
+function git(cwd, runArgs) {
+  return commandOutputAt("git", runArgs, cwd);
+}
+
+function commandOutputAt(cmd, runArgs, cwd) {
+  const result = spawnSync(cmd, runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${(result.stderr ?? "").trim()}`);
+  return result.stdout.trim();
+}
+
+function runChecked(cmd, runArgs, cwd, env = process.env) {
+  const result = spawnSync(cmd, runArgs, { cwd, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (result.status !== 0) fail(`${cmd} exited ${result.status}`);
+}
+
+function killTree(pid) {
+  if (!pid) return;
+  if (process.platform === "win32") spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  else { try { process.kill(-pid, "SIGTERM"); } catch { try { process.kill(pid, "SIGTERM"); } catch { /* gone */ } } }
+}
+
+function expandEnv(value) {
+  return String(value).replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? "").replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
+}
+
+function writeJson(file, value) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function usage(code) {
+  console.log("usage: right-release build --platform win|mac [--config right-release.config.mjs] [--dry-run]");
+  process.exit(code);
+}
+
+function fail(message) {
+  console.error(`right-release build: ${message}`);
+  process.exit(1);
+}

package/cli/right-release.mjs

@@ -5,9 +5,11 @@ import { fileURLToPath } from "node:url";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const commands = new Map([
-  ["release", "release.mjs"],
-  ["build", "release.mjs"],
-  ["package", "release.mjs"],
+  ["release", "build-release.mjs"],
+  ["build", "build-release.mjs"],
+  ["package", "build-release.mjs"],
+  ["publish", "upload-release.mjs"],
+  ["upload", "upload-release.mjs"],
   ["deps", "deps.mjs"],
   ["publish-update", "publish-update.mjs"],
   ["hardening", "hardeningscan.mjs"],
@@ -47,7 +49,7 @@ if (first === "--version" || first === "-v") {
   } else if (rest[0] === "swift") {
     run("publish-swift.mjs", rest.slice(1));
   } else {
-    run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
+    run("upload-release.mjs", rest);
   }
 } else if (first === "model") {
   const rest = args.slice(1);
@@ -63,7 +65,7 @@ if (first === "--version" || first === "-v") {
 } else if (commands.has(first)) {
   run(commands.get(first), args.slice(1));
 } else if (first.startsWith("-")) {
-  run("release.mjs", args);
+  run("build-release.mjs", args);
 } else {
   console.error(`right-release: unknown command: ${first}\n`);
   printHelp();
@@ -119,8 +121,11 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
-  release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
-  publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
+  build [--platform mac|win]                         Build, sign/notarize, harden, and seal; never uploads
+  upload --release <id> --platform mac|win --tier patch|update
+                                                      Upload one sealed release; never builds
+  release                                             Compatibility alias for build
+  publish                                             Compatibility alias for upload
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish swift [--scope <s>] [--url <u>] [--dry-run] Test, archive, scan, and publish RightKitSwift to a Swift registry
   model promote --authority heardright --config <file> [--dry-run]
@@ -135,6 +140,6 @@ Commands:
   mirror-root-artifact --file <path> --package-root <dir>
                                                       Persist a worktree artifact in the primary repo root
 
-Direct flags are treated as: right-release release <flags>.
-Publishing requires an explicit tier. Unsigned/local smoke builds stay app-local unless declared in right-release.config.mjs.`);
+Direct flags are treated as: right-release build <flags>.
+Build is tier-neutral. Upload requires an explicit tier. Unsigned/local smoke builds stay app-local.`);
 }

package/legal-contract.mjs

@@ -135,8 +135,15 @@ export function assertLegalReleaseContract(root, legal, appName, platform) {
     appendices.push({ ...appendix, absolutePath: realFile });
   }
 
-  // The in-app gate is the single assent surface. An installer or DMG can only
-  // present text; it cannot record who agreed or the individual/enterprise basis.
+  // The in-app gate is the SINGLE assent surface (Adrian, 2026-07-17). An
+  // installer/DMG can only PRESENT the text: it cannot record who agreed, cannot ask
+  // the individual-vs-enterprise basis, and passive updaters reach neither — so a
+  // license page is duplicate presentation that captures nothing. This gate
+  // previously REQUIRED bundle.licenseFile; it now requires its absence.
+  //
+  // Checked on EVERY platform, not just Windows: one bundle.licenseFile drives BOTH
+  // the NSIS license page and the macOS DMG SLA (branded-dmg.mjs derives its --eula
+  // from it), so a win-only check would let a mac build reintroduce the SLA.
   if (typeof legal.tauriConfig !== "string") fail(appName, "the legal gate requires legal.tauriConfig");
   const tauriPath = path.resolve(appRoot, legal.tauriConfig);
   if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);

package/legal-contract.test.mjs

@@ -46,6 +46,8 @@ function fixture() {
     })),
   };
   writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
+  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
   writeFileSync(
     path.join(tauriDir, "tauri.conf.json"),
     `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
@@ -105,6 +107,8 @@ test("rejects a Windows installer license page: the in-app gate is the only asse
 });
 
 test("rejects a macOS DMG SLA too — one licenseFile drives both bundlers", () => {
+  // branded-dmg.mjs derives its --eula from bundle.licenseFile, so a Windows-only
+  // check would let a mac release quietly reintroduce the mount-time SLA.
   const { root, legal } = fixture();
   writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
   assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /licenseFile must be absent/i);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.31",
+  "version": "0.2.32",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/pub-upload.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import { accessSync, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = new Map([
+  ["public", "rightapps-downloads"],
+  ["private", "rightapps-updates"],
+]);
+// Wrangler always runs remotely through a package runner; which one exists is machine-specific
+// (a node install without npm/npx is normal when pnpm is the pinned package manager).
+const RUNNERS = [
+  { cmd: "npx", prefix: [] },
+  { cmd: "pnpm", prefix: ["dlx"] },
+];
+
+const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
+if (!localFile || !r2Key) {
+  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
+  process.exit(1);
+}
+
+const bucket = BUCKETS.get(bucketAlias);
+if (!bucket) {
+  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
+  process.exit(1);
+}
+
+try {
+  accessSync(localFile);
+} catch {
+  console.error(`upload-large: missing local file: ${localFile}`);
+  process.exit(1);
+}
+
+const fileSize = statSync(localFile).size;
+const object = `${bucket}/${r2Key}`;
+const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
+const env = cleanCloudflareEnv(process.env);
+
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
+console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
+
+// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
+// and that must fail here rather than after a signed build has already been produced.
+const runner = resolveRunner(env);
+if (!runner) {
+  console.error(
+    "upload-large: no package runner found. Tried: " +
+      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
+      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+  );
+  process.exit(1);
+}
+console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
+
+if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
+  process.exit(0);
+}
+
+const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
+  env,
+  stdio: "inherit",
+  shell: process.platform === "win32",
+  windowsHide: true,
+});
+
+if (result.error) {
+  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(result.status ?? 1);
+
+function resolveRunner(env) {
+  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
+  if (override) {
+    const [cmd, ...prefix] = override.split(/\s+/);
+    return { cmd, prefix };
+  }
+  for (const candidate of RUNNERS) {
+    const probe = spawnSync(candidate.cmd, ["--version"], {
+      env,
+      stdio: "ignore",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    if (!probe.error && probe.status === 0) return candidate;
+  }
+  return null;
+}
+
+function cleanCloudflareEnv(source) {
+  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
+  delete env.CLOUDFLARE_API_KEY;
+  delete env.CLOUDFLARE_EMAIL;
+  delete env.CF_API_KEY;
+  delete env.CF_EMAIL;
+  return env;
+}

package/release-cli-contract.test.mjs

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const cli = path.join(root, "cli", "right-release.mjs");
+const build = path.join(root, "build-release.mjs");
+const upload = path.join(root, "upload-release.mjs");
+
+test("CLI routes build and release only to the build state machine", () => {
+  const source = readFileSync(cli, "utf8");
+  assert.match(source, /\["build",\s*"build-release\.mjs"\]/);
+  assert.match(source, /\["release",\s*"build-release\.mjs"\]/);
+});
+
+test("CLI routes upload and legacy publish only to the upload state machine", () => {
+  const source = readFileSync(cli, "utf8");
+  assert.match(source, /\["upload",\s*"upload-release\.mjs"\]/);
+  assert.match(source, /\["publish",\s*"upload-release\.mjs"\]/);
+  assert.doesNotMatch(source, /first === "publish"[\s\S]{0,500}run\("release\.mjs"/);
+});
+
+test("build is tier-neutral and rejects a tier before touching a repository", () => {
+  const result = spawnSync(process.execPath, [build, "--platform", "win", "--tier", "patch"], {
+    cwd: mkdtempSync(path.join(os.tmpdir(), "right-build-cli-")),
+    encoding: "utf8",
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /build is tier-neutral/i);
+});
+
+test("upload requires an explicit patch or update tier before reading a release", () => {
+  const result = spawnSync(process.execPath, [upload, "--platform", "win", "--release", "fixture-1.0.0-deadbeef"], {
+    cwd: mkdtempSync(path.join(os.tmpdir(), "right-upload-cli-")),
+    encoding: "utf8",
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /tier is required.*patch\|update/i);
+});

package/release-state.mjs

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+export function cacheFingerprint({ cargoLockSha256, rustc, target, features = [] }) {
+  const payload = JSON.stringify({
+    cargoLockSha256,
+    rustc,
+    target,
+    features: [...features].sort(),
+  });
+  return createHash("sha256").update(payload).digest("hex").slice(0, 16);
+}
+export function releaseEnvironment({ root, platform, cacheKey, kind = "release" }) {
+  if (kind !== "release" && kind !== "test") throw new Error(`invalid target kind: ${kind}`);
+  const targetKind = kind === "release" ? "cargo-target" : "test-target";
+  return {
+    CARGO_TARGET_DIR: path.resolve(root, "cache", targetKind, platform, cacheKey),
+    CARGO_HOME: path.resolve(root, "cache", "cargo-home"),
+    SCCACHE_DIR: path.resolve(root, "cache", "sccache"),
+    RUSTC_WRAPPER: "sccache",
+  };
+}
+
+export function verifySealedRelease(sealedDir) {
+  const manifestPath = path.join(sealedDir, "release-manifest.json");
+  if (!existsSync(manifestPath)) throw new Error(`sealed manifest missing: ${manifestPath}`);
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  if (manifest.schema !== 1) throw new Error(`unsupported sealed manifest schema: ${manifest.schema}`);
+  if (!manifest.checkpoints?.includes("sealed")) throw new Error("release is not sealed");
+  for (const item of manifest.files ?? []) {
+    const file = path.join(sealedDir, item.name);
+    if (!existsSync(file)) throw new Error(`sealed file missing: ${item.name}`);
+    const bytes = readFileSync(file);
+    const actualHash = createHash("sha256").update(bytes).digest("hex");
+    if (actualHash !== item.sha256) throw new Error(`sealed file hash mismatch: ${item.name}`);
+    if (bytes.length !== item.sizeBytes) throw new Error(`sealed file size mismatch: ${item.name}`);
+  }
+  return { manifest, manifestPath, sealedDir };
+}
+
+export async function runBuildStateMachine({
+  root,
+  app,
+  version,
+  commit,
+  platform,
+  requiredInputs = [],
+  ops,
+}) {
+  const releaseId = `${app}-${version}-${commit.slice(0, 8)}`;
+  const platformDir = platform === "win" ? "windows" : platform === "mac" ? "mac" : platform;
+  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, platformDir);
+  if (existsSync(path.join(sealedDir, "release-manifest.json"))) {
+    const sealed = verifySealedRelease(sealedDir);
+    if (sealed.manifest.app !== app || sealed.manifest.version !== version || sealed.manifest.commit !== commit) {
+      throw new Error(`sealed release identity mismatch: ${releaseId}`);
+    }
+    return { status: "sealed", resumed: true, releaseId, sealedDir };
+  }
+  await ops.preflight?.({ root, app, version, commit, platform, requiredInputs, releaseId });
+  await ops.prepare?.({ root, app, version, commit, platform, releaseId });
+  await ops.build?.({ root, app, version, commit, platform, releaseId });
+  await ops.sign?.({ root, app, version, commit, platform, releaseId });
+  await ops.harden?.({ root, app, version, commit, platform, releaseId });
+  await ops.seal?.({ root, app, version, commit, platform, releaseId, sealedDir });
+  return { status: "sealed", resumed: false, releaseId, sealedDir };
+}
+
+export async function runUploadStateMachine({ root, releaseId, platform, tier, ops = {} }) {
+  if (tier !== "patch" && tier !== "update") throw new Error("upload tier is required (patch|update)");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(String(releaseId))) throw new Error(`invalid release id: ${releaseId}`);
+  const platformDir = platform === "win" ? "windows" : platform === "mac" ? "mac" : platform;
+  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, platformDir);
+  const sealed = verifySealedRelease(sealedDir);
+  if (sealed.manifest.platform !== platform) throw new Error("sealed release platform mismatch");
+  const routes = sealed.manifest.routes?.[tier] ?? [];
+  if (!routes.length) throw new Error(`sealed release has no ${tier} upload route`);
+  validateUploadRoutes(routes, tier, platformDir);
+
+  await ops.verifyAuthenticode?.(sealed);
+  await ops.harden?.(sealed);
+  let backedUp = false;
+  try {
+    await ops.backup?.(sealed, routes);
+    backedUp = true;
+    await ops.upload?.(sealed, routes);
+    await ops.register?.(sealed, routes);
+    await ops.verifyRemote?.(sealed, routes);
+    await ops.discardBackup?.(sealed, routes);
+  } catch (error) {
+    if (backedUp) await ops.restore?.(sealed, routes);
+    throw error;
+  }
+  return { status: "verified", releaseId, tier, sealedDir };
+}
+
+function validateUploadRoutes(routes, tier, platformDir) {
+  const expectedBucket = tier === "patch" ? "public" : "private";
+  const expectedLane = tier === "patch" ? "installers" : "updates";
+  const marker = `/${expectedLane}/${platformDir}/current/`;
+  for (const route of routes) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(String(route.key)) || String(route.key).includes("//")) {
+      throw new Error(`unsafe R2 key: ${route.key}`);
+    }
+    if (route.bucket !== expectedBucket || !String(route.key).includes(marker)) {
+      throw new Error(`${tier} route must use ${expectedBucket} ${expectedLane}/${platformDir}/current: ${route.key}`);
+    }
+    if (String(route.key).includes("..")) throw new Error(`${tier} route contains traversal: ${route.key}`);
+  }
+}

package/release-state.test.mjs

@@ -0,0 +1,224 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  cacheFingerprint,
+  releaseEnvironment,
+  runBuildStateMachine,
+  runUploadStateMachine,
+  verifySealedRelease,
+} from "./release-state.mjs";
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-state-"));
+  const sealedDir = path.join(root, ".right-release", "sealed", "fixture-1.2.3-abcdef12", "windows");
+  mkdirSync(sealedDir, { recursive: true });
+  const installer = path.join(sealedDir, "Fixture_x64-setup.exe");
+  const signature = `${installer}.sig`;
+  writeFileSync(installer, "signed-installer");
+  writeFileSync(signature, "updater-signature");
+  const manifest = {
+    schema: 1,
+    releaseId: "fixture-1.2.3-abcdef12",
+    app: "fixture",
+    version: "1.2.3",
+    commit: "abcdef1234567890",
+    platform: "win",
+    files: [
+      { role: "installer", name: path.basename(installer), sha256: sha256("signed-installer"), sizeBytes: 16 },
+      { role: "updater-signature", name: path.basename(signature), sha256: sha256("updater-signature"), sizeBytes: 17 },
+    ],
+    routes: {
+      patch: [{ role: "installer", bucket: "public", key: "fixture/installers/windows/current/Fixture_x64-setup.exe" }],
+      update: [{ role: "installer", bucket: "private", key: "fixture/updates/windows/current/Fixture_x64-setup.exe" }],
+    },
+    checkpoints: ["preflight_complete", "build_complete", "signed", "hardened", "sealed"],
+  };
+  writeFileSync(path.join(sealedDir, "release-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  return { root, sealedDir, installer, signature, manifest };
+}
+
+test("upload has no build operation and restores the previous stable object when registration fails", async () => {
+  const fx = fixture();
+  const calls = [];
+  await assert.rejects(
+    runUploadStateMachine({
+      root: fx.root,
+      releaseId: fx.manifest.releaseId,
+      platform: "win",
+      tier: "patch",
+      ops: {
+        verifyAuthenticode: async () => calls.push("verify-authenticode"),
+        harden: async () => calls.push("harden"),
+        backup: async () => calls.push("backup"),
+        upload: async () => calls.push("upload"),
+        register: async () => { calls.push("register"); throw new Error("R2/API unavailable"); },
+        verifyRemote: async () => calls.push("verify-remote"),
+        restore: async () => calls.push("restore"),
+        discardBackup: async () => calls.push("discard-backup"),
+      },
+    }),
+    /R2\/API unavailable/,
+  );
+  assert.deepEqual(calls, ["verify-authenticode", "harden", "backup", "upload", "register", "restore"]);
+});
+test("missing runtime input fails before build preparation and cannot touch an existing sealed installer", async () => {
+  const fx = fixture();
+  let prepared = false;
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: "fixture",
+      version: "1.2.4",
+      commit: "1234567890abcdef",
+      platform: "win",
+      requiredInputs: [path.join(fx.root, "missing-directml.dll")],
+      ops: {
+        preflight: async ({ requiredInputs }) => {
+          for (const file of requiredInputs) readFileSync(file);
+        },
+        prepare: async () => { prepared = true; },
+        build: async () => {},
+        sign: async () => {},
+        harden: async () => {},
+        seal: async () => {},
+      },
+    }),
+    /ENOENT/,
+  );
+  assert.equal(prepared, false);
+  assert.equal(readFileSync(fx.installer, "utf8"), "signed-installer");
+});
+
+test("an interrupted build leaves every previously sealed release untouched", async () => {
+  const fx = fixture();
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: "fixture",
+      version: "1.2.4",
+      commit: "1234567890abcdef",
+      platform: "win",
+      requiredInputs: [],
+      ops: {
+        preflight: async () => {},
+        prepare: async () => {},
+        build: async () => { throw new Error("SIGINT"); },
+        sign: async () => {},
+        harden: async () => {},
+        seal: async () => {},
+      },
+    }),
+    /SIGINT/,
+  );
+  assert.equal(readFileSync(fx.installer, "utf8"), "signed-installer");
+});
+
+test("a valid sealed release resumes without rebuilding", async () => {
+  const fx = fixture();
+  let builds = 0;
+  const result = await runBuildStateMachine({
+    root: fx.root,
+    app: "fixture",
+    version: fx.manifest.version,
+    commit: fx.manifest.commit,
+    platform: "win",
+    requiredInputs: [],
+    ops: {
+      preflight: async () => {},
+      prepare: async () => {},
+      build: async () => { builds += 1; },
+      sign: async () => {},
+      harden: async () => {},
+      seal: async () => {},
+    },
+  });
+  assert.equal(result.status, "sealed");
+  assert.equal(result.resumed, true);
+  assert.equal(builds, 0);
+});
+
+test("manifest or file tampering blocks upload before any mutation", async () => {
+  const fx = fixture();
+  writeFileSync(fx.installer, "changed");
+  assert.throws(() => verifySealedRelease(fx.sealedDir), /hash mismatch/);
+  let uploaded = false;
+  await assert.rejects(
+    runUploadStateMachine({
+      root: fx.root,
+      releaseId: fx.manifest.releaseId,
+      platform: "win",
+      tier: "patch",
+      ops: {
+        upload: async () => { uploaded = true; },
+      },
+    }),
+    /hash mismatch/,
+  );
+  assert.equal(uploaded, false);
+});
+
+test("tier or non-current route mismatch fails before R2 backup", async () => {
+  const fx = fixture();
+  fx.manifest.routes.patch[0].bucket = "private";
+  fx.manifest.routes.patch[0].key = "fixture/updates/windows/1.2.3/Fixture.exe";
+  writeFileSync(path.join(fx.sealedDir, "release-manifest.json"), `${JSON.stringify(fx.manifest, null, 2)}\n`);
+  let backedUp = false;
+  await assert.rejects(
+    runUploadStateMachine({
+      root: fx.root,
+      releaseId: fx.manifest.releaseId,
+      platform: "win",
+      tier: "patch",
+      ops: { backup: async () => { backedUp = true; } },
+    }),
+    /patch route.*public.*installers.*current/i,
+  );
+  assert.equal(backedUp, false);
+});
+
+test("release ids and R2 keys reject traversal and shell metacharacters", async () => {
+  const fx = fixture();
+  await assert.rejects(
+    runUploadStateMachine({ root: fx.root, releaseId: "../../outside", platform: "win", tier: "patch" }),
+    /invalid release id/i,
+  );
+  fx.manifest.routes.patch[0].key = "fixture/installers/windows/current/Fixture.exe&whoami";
+  writeFileSync(path.join(fx.sealedDir, "release-manifest.json"), `${JSON.stringify(fx.manifest, null, 2)}\n`);
+  await assert.rejects(
+    runUploadStateMachine({ root: fx.root, releaseId: fx.manifest.releaseId, platform: "win", tier: "patch" }),
+    /unsafe R2 key/i,
+  );
+});
+
+test("release and test Cargo targets are disjoint", () => {
+  const root = "C:/repo/.right-release";
+  const build = releaseEnvironment({ root, platform: "win", cacheKey: "deps123", kind: "release" });
+  const testEnv = releaseEnvironment({ root, platform: "win", cacheKey: "deps123", kind: "test" });
+  assert.notEqual(build.CARGO_TARGET_DIR, testEnv.CARGO_TARGET_DIR);
+  assert.match(build.CARGO_TARGET_DIR, /cache[\\/]cargo-target[\\/]win[\\/]deps123/);
+  assert.match(testEnv.CARGO_TARGET_DIR, /cache[\\/]test-target[\\/]win[\\/]deps123/);
+  assert.match(build.SCCACHE_DIR, /cache[\\/]sccache/);
+  assert.equal(build.RUSTC_WRAPPER, "sccache");
+});
+
+test("dependency cache survives source commits and invalidates only dependency/toolchain inputs", () => {
+  const base = {
+    cargoLockSha256: "lock-a",
+    rustc: "rustc 1.90.0 host x86_64-pc-windows-msvc",
+    target: "x86_64-pc-windows-msvc",
+    features: ["bundled-sqlcipher-vendored-openssl"],
+  };
+  assert.equal(cacheFingerprint({ ...base, commit: "aaa" }), cacheFingerprint({ ...base, commit: "bbb" }));
+  assert.notEqual(cacheFingerprint(base), cacheFingerprint({ ...base, cargoLockSha256: "lock-b" }));
+  assert.notEqual(cacheFingerprint(base), cacheFingerprint({ ...base, rustc: "rustc 1.91.0" }));
+  assert.notEqual(cacheFingerprint(base), cacheFingerprint({ ...base, features: ["bundled-sqlcipher"] }));
+});

package/release.mjs

@@ -59,7 +59,7 @@ for (let i = 0; i < args.length; i++) {
   else usage(2, `unknown argument: ${arg}`);
 }
 
-if (!opts.doctor && !opts.tier) usage(2, "--tier is required (patch|update)");
+if (opts.upload) fail("combined build+upload was removed; run right-release build, then right-release upload --release <id> --tier patch|update");
 if (opts.tier && !TIERS.has(opts.tier)) usage(2, `invalid --tier: ${opts.tier} (expected patch|update)`);
 
 const configPath = path.resolve(opts.config);
@@ -103,7 +103,7 @@ if (opts.doctor) {
 }
 
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
-const mode = opts.upload ? "publish" : "package";
+const mode = "package";
 const command = target.package;
 if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
@@ -111,7 +111,7 @@ if (opts.upload && !target.publish && !target.upload) {
 }
 
 const started = Date.now();
-console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier}`);
+console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier ?? "neutral"}`);
 
 if (opts.install) await runInstall(config.packageManager, workdir);
 if (!opts.skipChecks) {

package/release.test.mjs

@@ -128,10 +128,11 @@ function runRaw(config, ...args) {
   });
 }
 
-test("rejects a release without an explicit entitlement tier", () => {
+test("accepts a tier-neutral internal build", () => {
   const result = run(fixture());
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /--tier is required.*patch\|update/i);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /tier=neutral/);
+  assert.doesNotMatch(result.stdout, /RIGHT_RELEASE_TIER=/);
 });
 
 test("accepts patch and exposes it to the signed package command", () => {
@@ -233,35 +234,31 @@ test("doctor rejects a RightKit override at an ancestor repository root", () =>
   assert.match(result.stderr, /forbidden RightKit Cargo override/i);
 });
 
-test("publish runs the signed package step before the updater publication step", () => {
+test("combined build and upload is rejected before the package step", () => {
   const result = run(fixture({ publish: true }), "--tier=update", "--upload");
-  assert.equal(result.status, 0, result.stderr);
-  const packageAt = result.stdout.indexOf("node -e process.exit(0)");
-  const publishAt = result.stdout.indexOf("node publish-update.mjs");
-  assert.ok(packageAt >= 0, result.stdout);
-  assert.ok(publishAt > packageAt, result.stdout);
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /combined build\+upload was removed/i);
+  assert.doesNotMatch(result.stdout, /node -e process\.exit\(0\)/);
 });
 
-test("Windows patch signs the installer then minisigns the free updater payload", () => {
-  const result = run(fixture({ publish: true }), "--tier=patch", "--upload");
+test("Windows tier-neutral build signs the installer then minisigns the updater payload", () => {
+  const result = run(fixture({ publish: true }));
   assert.equal(result.status, 0, result.stderr);
   const azureAt = result.stdout.indexOf("sign-windows.mjs");
   const updaterAt = result.stdout.indexOf("sign-updater.mjs");
-  const publishAt = result.stdout.indexOf("publish-update.mjs");
   assert.ok(azureAt >= 0, result.stdout);
   assert.ok(updaterAt > azureAt, result.stdout);
-  assert.ok(publishAt > updaterAt, result.stdout);
+  assert.doesNotMatch(result.stdout, /publish-update\.mjs/);
 });
 
-test("Windows update re-signs the updater artifact after Azure code signing", () => {
-  const result = run(fixture({ publish: true }), "--tier=update", "--upload");
+test("legacy internal tier does not make the build worker upload", () => {
+  const result = run(fixture({ publish: true }), "--tier=update");
   assert.equal(result.status, 0, result.stderr);
   const azureAt = result.stdout.indexOf("sign-windows.mjs");
   const updaterAt = result.stdout.indexOf("sign-updater.mjs");
-  const publishAt = result.stdout.indexOf("publish-update.mjs");
   assert.ok(azureAt >= 0, result.stdout);
   assert.ok(updaterAt > azureAt, result.stdout);
-  assert.ok(publishAt > updaterAt, result.stdout);
+  assert.doesNotMatch(result.stdout, /publish-update\.mjs/);
 });
 
 test("release sweeps stale rust artifacts when a target dir exists", () => {

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.30");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.32");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -327,10 +327,9 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.31",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"],
   });
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),

package/rightkit-versions.json

@@ -7,18 +7,17 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.30",
+    "@rightkit/release": "0.2.32",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.31"
+    "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/upload-release.mjs

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { runUploadStateMachine, verifySealedRelease } from "./release-state.mjs";
+
+const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const PUBLISH_UPDATE = path.join(TOOL_ROOT, "publish-update.mjs");
+const HARDENING = path.join(TOOL_ROOT, "hardeningscan.mjs");
+const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
+const PUBLIC_BASE = (process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev").replace(/\/$/, "");
+const API_BASE = (process.env.RIGHTAPPS_API_URL || "https://api.spoares.com").replace(/\/$/, "");
+const args = process.argv.slice(2);
+let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
+let releaseId = "";
+let tier = "";
+let dryRun = false;
+
+for (let i = 0; i < args.length; i += 1) {
+  const arg = args[i];
+  if (arg === "--platform") platform = args[++i];
+  else if (arg === "--release") releaseId = args[++i];
+  else if (arg === "--tier") tier = args[++i];
+  else if (arg.startsWith("--tier=")) tier = arg.slice("--tier=".length);
+  else if (arg === "--dry-run") dryRun = true;
+  else if (arg === "-h" || arg === "--help") usage(0);
+  else fail(`unknown argument: ${arg}`);
+}
+if (tier !== "patch" && tier !== "update") fail("tier is required (patch|update)");
+if (!releaseId) fail("--release is required");
+if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
+
+const repoRoot = git(process.cwd(), ["rev-parse", "--show-toplevel"]);
+const platformDir = platform === "win" ? "windows" : "mac";
+const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir);
+const sealed = verifySealedRelease(sealedDir);
+const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
+const backupRoot = path.join(stateRoot, "rollback", tier);
+const verifiedMarker = path.join(stateRoot, `verified-${tier}.json`);
+if (existsSync(verifiedMarker)) {
+  console.log(`right-release upload: already verified ${releaseId} tier=${tier}`);
+  process.exit(0);
+}
+if (!dryRun && !process.env.CLOUDFLARE_API_TOKEN) fail("CLOUDFLARE_API_TOKEN is required before R2 mutation");
+
+await runUploadStateMachine({
+  root: repoRoot,
+  releaseId,
+  platform,
+  tier,
+  ops: {
+    verifyAuthenticode: async (release) => verifyPlatformTrust(release),
+    harden: async (release) => {
+      const files = release.manifest.files.filter((file) => file.role !== "updater-signature").map((file) => path.join(release.sealedDir, file.name));
+      runChecked(process.execPath, [HARDENING, ...files], repoRoot);
+    },
+    backup: async (release, routes) => backupStableObjects(release, routes),
+    upload: async (release) => publishSealed(release),
+    register: async () => {},
+    verifyRemote: async (release, routes) => verifyUploaded(release, routes),
+    restore: async (_release, routes) => restoreStableObjects(routes),
+    discardBackup: async () => rmSync(backupRoot, { recursive: true, force: true }),
+  },
+});
+writeJson(verifiedMarker, { schema: 1, releaseId, platform, tier, verifiedAt: new Date().toISOString() });
+console.log(`right-release upload: verified ${releaseId} tier=${tier}`);
+
+function verifyPlatformTrust(release) {
+  if (dryRun) return;
+  const artifacts = release.manifest.files.filter((file) => file.role !== "updater-signature");
+  if (platform === "win") {
+    for (const artifact of artifacts) {
+      const file = path.join(release.sealedDir, artifact.name);
+      const escaped = file.replaceAll("'", "''");
+      const status = commandOutput("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${escaped}').Status`]);
+      if (status.trim() !== "Valid") throw new Error(`Authenticode verification failed for ${artifact.name}: ${status}`);
+    }
+  } else {
+    for (const artifact of artifacts.filter((file) => /\.dmg$/i.test(file.name))) {
+      const file = path.join(release.sealedDir, artifact.name);
+      runChecked("codesign", ["--verify", "--strict", "--verbose=2", file], repoRoot);
+      runChecked("xcrun", ["stapler", "validate", file], repoRoot);
+    }
+  }
+}
+
+function backupStableObjects(release, routes) {
+  if (dryRun) return;
+  if (existsSync(path.join(backupRoot, "backup-manifest.json"))) restoreStableObjects(routes);
+  mkdirSync(backupRoot, { recursive: true });
+  const entries = [];
+  for (const route of uniqueRoutes(routes)) {
+    const bucket = bucketName(route.bucket);
+    const file = path.join(backupRoot, `${createHash("sha256").update(`${bucket}/${route.key}`).digest("hex").slice(0, 12)}.bin`);
+    const result = wrangler(["r2", "object", "get", `${bucket}/${route.key}`, "--file", file, "--remote"]);
+    if (result.status === 0) entries.push({ bucket: route.bucket, key: route.key, existed: true, file: path.basename(file), sha256: hashFile(file) });
+    else if (/not found|does not exist|404/i.test(`${result.stdout}\n${result.stderr}`)) entries.push({ bucket: route.bucket, key: route.key, existed: false, file: null, sha256: null });
+    else throw new Error(`failed to back up R2 object ${bucket}/${route.key}: ${result.stderr || result.stdout}`);
+  }
+  writeJson(path.join(backupRoot, "backup-manifest.json"), { schema: 1, releaseId: release.manifest.releaseId, entries });
+}
+
+function publishSealed(release) {
+  if (dryRun) return;
+  const generated = path.join(stateRoot, `sealed-upload-${tier}.config.mjs`);
+  const config = sealedUploadConfig(release);
+  writeFileSync(generated, `export default ${JSON.stringify(config, null, 2)};\n`);
+  runChecked(process.execPath, [PUBLISH_UPDATE, "--config", generated, "--platform", platform], repoRoot, { ...process.env, RIGHT_RELEASE_TIER: tier });
+}
+
+function sealedUploadConfig(release) {
+  const fileByName = new Map(release.manifest.files.map((file) => [file.name, path.join(release.sealedDir, file.name)]));
+  const patchRoutes = release.manifest.routes.patch ?? [];
+  const updateRoutes = release.manifest.routes.update ?? [];
+  const installers = patchRoutes.filter((route) => route.role === "installer").map((route) => ({ file: fileByName.get(route.name), key: route.key }));
+  const updaterRoutes = updateRoutes.map((route) => {
+    const patch = patchRoutes.find((candidate) => candidate.name === route.name && candidate.platform === route.platform);
+    return { file: fileByName.get(route.name), signature: fileByName.get(route.signature), platform: route.platform, key: route.key, patchKey: patch?.key };
+  });
+  return {
+    schema: 1,
+    app: release.manifest.app,
+    version: release.manifest.version,
+    channel: "stable",
+    targets: { [platform]: { installer: { artifacts: installers }, updater: { artifacts: updaterRoutes } } },
+  };
+}
+
+async function verifyUploaded(release, routes) {
+  if (dryRun) return;
+  const files = new Map(release.manifest.files.map((file) => [file.name, file]));
+  for (const route of uniqueRoutes(routes)) {
+    const expected = files.get(route.name);
+    if (!expected) throw new Error(`route references unsealed file: ${route.name}`);
+    const verifyFile = path.join(stateRoot, `remote-${createHash("sha256").update(route.key).digest("hex").slice(0, 12)}.bin`);
+    if (route.bucket === "public") {
+      const response = await fetch(`${PUBLIC_BASE}/${route.key}`, { cache: "no-store" });
+      if (!response.ok) throw new Error(`public artifact verification failed: ${response.status} ${route.key}`);
+      writeFileSync(verifyFile, Buffer.from(await response.arrayBuffer()));
+    } else {
+      const result = wrangler(["r2", "object", "get", `${bucketName(route.bucket)}/${route.key}`, "--file", verifyFile, "--remote"]);
+      if (result.status !== 0) throw new Error(`private artifact verification failed: ${route.key}`);
+    }
+    if (statSync(verifyFile).size !== expected.sizeBytes || hashFile(verifyFile) !== expected.sha256) throw new Error(`remote hash mismatch: ${route.key}`);
+    rmSync(verifyFile, { force: true });
+  }
+  if (!routes.some((route) => route.role === "updater")) return;
+  const apiPlatform = platform === "win" ? "windows-x86_64" : "darwin-aarch64";
+  const response = await fetch(`${API_BASE}/v1/apps/${release.manifest.app}/releases/latest.json?platform=${apiPlatform}`, { cache: "no-store" });
+  if (!response.ok) throw new Error(`updater API verification failed: ${response.status}`);
+  const body = await response.json();
+  if (body.version !== release.manifest.version) throw new Error(`updater API version mismatch: expected ${release.manifest.version}, got ${body.version}`);
+  const expectedRoutes = new Set(routes.map((route) => route.key));
+  const urls = Object.values(body.platforms ?? {}).map((entry) => entry.url).filter(Boolean);
+  if (!urls.some((url) => [...expectedRoutes].some((key) => url.endsWith(key)))) throw new Error("updater API returned the wrong artifact URL");
+}
+
+function restoreStableObjects(routes) {
+  const manifestPath = path.join(backupRoot, "backup-manifest.json");
+  if (!existsSync(manifestPath)) return;
+  const backup = JSON.parse(readFileSync(manifestPath, "utf8"));
+  for (const entry of backup.entries) {
+    if (entry.existed) {
+      const file = path.join(backupRoot, entry.file);
+      if (hashFile(file) !== entry.sha256) throw new Error(`rollback copy hash mismatch: ${entry.key}`);
+      runChecked(process.execPath, [UPLOAD, file, entry.key, entry.bucket], repoRoot);
+    } else {
+      const result = wrangler(["r2", "object", "delete", `${bucketName(entry.bucket)}/${entry.key}`, "--remote"]);
+      if (result.status !== 0 && !/not found|404/i.test(`${result.stdout}\n${result.stderr}`)) throw new Error(`rollback delete failed: ${entry.key}`);
+    }
+  }
+  rmSync(backupRoot, { recursive: true, force: true });
+}
+
+function uniqueRoutes(routes) {
+  return [...new Map(routes.map((route) => [`${route.bucket}/${route.key}`, route])).values()];
+}
+
+function bucketName(bucket) {
+  return bucket === "public" ? "rightapps-downloads" : "rightapps-updates";
+}
+
+function wrangler(runArgs) {
+  return spawnSync("npx", ["wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
+}
+
+function hashFile(file) {
+  return createHash("sha256").update(readFileSync(file)).digest("hex");
+}
+
+function git(cwd, runArgs) {
+  return commandOutput("git", runArgs, cwd);
+}
+
+function commandOutput(cmd, runArgs, cwd = process.cwd()) {
+  const result = spawnSync(cmd, runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${result.stderr}`);
+  return result.stdout.trim();
+}
+
+function runChecked(cmd, runArgs, cwd, env = process.env) {
+  const result = spawnSync(cmd, runArgs, { cwd, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (result.status !== 0) throw new Error(`${cmd} exited ${result.status}`);
+}
+
+function writeJson(file, value) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function usage(code) {
+  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update");
+  process.exit(code);
+}
+
+function fail(message) {
+  console.error(`right-release upload: ${message}`);
+  process.exit(1);
+}