@rightkit/release 0.2.43 → 0.2.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.43",
+  "version": "0.2.44",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-state.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, watch } from "node:fs";
+import { existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import path from "node:path";
 import { DEFAULT_SCCACHE_MAX_BYTES, resolveCacheLayout } from "./cache-policy.mjs";
 
@@ -118,6 +118,24 @@ export async function runBuildStateMachine({
   const releaseId = `${app}-${version}-${commit.slice(0, 8)}`;
   const platformDir = platform === "win" ? "windows" : platform === "mac" ? "mac" : platform;
   const sealedDir = path.join(root, ".right-release", "sealed", releaseId, platformDir);
+  const sealedRoot = path.join(root, ".right-release", "sealed");
+  if (existsSync(sealedRoot)) {
+    for (const releaseEntry of readdirSync(sealedRoot, { withFileTypes: true })) {
+      if (!releaseEntry.isDirectory()) continue;
+      const releaseRoot = path.join(sealedRoot, releaseEntry.name);
+      for (const platformEntry of readdirSync(releaseRoot, { withFileTypes: true })) {
+        if (!platformEntry.isDirectory()) continue;
+        const manifestPath = path.join(releaseRoot, platformEntry.name, "release-manifest.json");
+        if (!existsSync(manifestPath)) continue;
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+        if (manifest.app === app && manifest.version === version && manifest.commit !== commit) {
+          throw new Error(
+            `${app} version ${version} is already sealed from commit ${manifest.commit} (${manifest.releaseId}); bump the version before rebuilding`,
+          );
+        }
+      }
+    }
+  }
   if (existsSync(path.join(sealedDir, "release-manifest.json"))) {
     const sealed = verifySealedRelease(sealedDir);
     if (sealed.manifest.app !== app || sealed.manifest.version !== version || sealed.manifest.commit !== commit) {

package/release-state.test.mjs

@@ -150,6 +150,31 @@ test("missing runtime input fails before build preparation and cannot touch an e
   assert.equal(readFileSync(fx.installer, "utf8"), "signed-installer");
 });
 
+test("a version already sealed from another commit cannot be rebuilt", async () => {
+  const fx = fixture();
+  let prepared = false;
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: "fixture",
+      version: fx.manifest.version,
+      commit: "1234567890abcdef",
+      platform: "win",
+      requiredInputs: [],
+      ops: {
+        preflight: async () => {},
+        prepare: async () => { prepared = true; },
+        build: async () => {},
+        sign: async () => {},
+        harden: async () => {},
+        seal: async () => {},
+      },
+    }),
+    /version 1\.2\.3 is already sealed from commit abcdef1234567890/,
+  );
+  assert.equal(prepared, false);
+});
+
 test("an interrupted build leaves every previously sealed release untouched", async () => {
   const fx = fixture();
   await assert.rejects(

package/right-suite-contract.test.mjs

@@ -432,7 +432,7 @@ test("every app platform requires effective non-empty build inputs", () => {
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.43");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.44");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -444,11 +444,11 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/license": "0.1.6",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
-    "the previously published @rightkit/release 0.2.42 must remain accepted during the 0.2.43 rollout",
+    "the previously published @rightkit/release 0.2.42 must remain accepted during the 0.2.44 rollout",
   );
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.43",
+    "@rightkit/release": "0.2.44",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -17,7 +17,7 @@
     "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",