@rightkit/release 0.2.68 → 0.2.70

package/github-release.test.mjs

@@ -1,103 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { execFileSync } from "node:child_process";
-import { canonicalAddonManifest, createAddonManifest } from "./addon-contract.mjs";
-import { prepareGitHubAddonRelease, prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
-
-const sha256 = (value) => createHash("sha256").update(value).digest("hex");
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-"));
-  const releaseId = "cutright-1.2.3-abcdef12";
-  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, "windows");
-  mkdirSync(sealedDir, { recursive: true });
-  writeFileSync(path.join(sealedDir, "CutRight.exe"), "signed-installer");
-  writeFileSync(path.join(sealedDir, "release-manifest.json"), `${JSON.stringify({
-    schema: 1, releaseId, app: "cutright", version: "1.2.3", commit: "abcdef1234567890", platform: "win",
-    files: [{ role: "installer", name: "CutRight.exe", sha256: sha256("signed-installer"), sizeBytes: 16 }],
-    checkpoints: ["sealed"],
-  })}\n`);
-  return { root, releaseId };
-}
-
-function addonFixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
-  mkdirSync(path.join(root, "out"));
-  for (const [name, bytes] of [["membrane", "command"], ["membrane-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
-  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
-  execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
-  execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
-  writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
-  const files = [["command", "membrane", true], ["service", "membrane-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
-  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "membrane-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
-  const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
-  const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });
-  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, "out", file.name)));
-  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
-  return { root, config };
-}
-
-test("GitHub plan derives tag, notes, installer, manifest & checksums only from sealed bytes", () => {
-  const fx = fixture();
-  const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
-  assert.equal(plan.tag, "v1.2.3");
-  assert.equal(plan.assets.length, 3);
-  assert.match(plan.notes, /abcdef1234567890/);
-  assert.equal(readFileSync(plan.assets[2], "utf8"), `${sha256("signed-installer")}  CutRight.exe\n`);
-});
-
-test("dry-run checks public visibility without creating or uploading a release", () => {
-  const fx = fixture();
-  const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
-  const calls = [];
-  const run = (_command, args, options = {}) => {
-    calls.push(args);
-    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
-    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: false } : "";
-    throw new Error(`unexpected mutation: ${args.join(" ")}`);
-  };
-  assert.equal(publishGitHubRelease(plan, { repo: "Orthic-Labs/CutRight", dryRun: true, run }).status, "would-create");
-  assert.equal(calls.length, 2);
-});
-
-test("GitHub add-on plan uses a content-addressed platform tag and manifest URL", () => {
-  const fx = addonFixture();
-  const plan = prepareGitHubAddonRelease({ repoRoot: fx.root, config: fx.config, platform: "win", repo: "Orthic-Labs/Membrane" });
-  assert.match(plan.tag, /^addon-membrane-v0\.1\.0-win-sha256-[0-9a-f]{64}$/);
-  assert.equal(plan.assets.at(-1), plan.manifestPath);
-  assert.equal(plan.manifestUrl, `https://github.com/Orthic-Labs/Membrane/releases/download/${plan.tag}/addon-manifest.json`);
-});
-
-test("existing GitHub add-on release is verified without upload mutation", () => {
-  const asset = path.join(mkdtempSync(path.join(os.tmpdir(), "right-release-existing-")), "addon-manifest.json"); writeFileSync(asset, "sealed");
-  const calls = [];
-  const run = (_command, args, options = {}) => {
-    calls.push(args);
-    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
-    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: true } : "";
-    if (args[0] === "release" && args[1] === "download") { mkdirSync(args[args.indexOf("--dir") + 1], { recursive: true }); writeFileSync(path.join(args[args.indexOf("--dir") + 1], path.basename(asset)), "sealed"); return options.allowFailure ? { ok: true, output: "" } : ""; }
-    throw new Error(`unexpected mutation: ${args.join(" ")}`);
-  };
-  const result = publishGitHubRelease({ kind: "addon", manifest: { files: [] }, sealedDir: path.dirname(asset), tag: "immutable", assets: [asset], manifestUrl: "https://example.test/manifest" }, { repo: "Orthic-Labs/Membrane", run });
-  assert.equal(result.status, "already-verified");
-  assert.equal(calls.some((args) => args[0] === "release" && args[1] === "upload"), false);
-});
-
-test("partial GitHub add-on release uploads only missing assets then verifies all", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-resume-")); const first = path.join(root, "first"); const second = path.join(root, "second"); writeFileSync(first, "one"); writeFileSync(second, "two");
-  const remote = new Map([["first", "one"]]); const uploads = [];
-  const run = (_command, args, options = {}) => {
-    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
-    if (args[0] === "release" && args[1] === "view") return { ok: true };
-    if (args[0] === "release" && args[1] === "download") { const name = args[args.indexOf("--pattern") + 1]; if (!remote.has(name)) return { ok: false, error: "no assets match" }; const dir = args[args.indexOf("--dir") + 1]; mkdirSync(dir, { recursive: true }); writeFileSync(path.join(dir, name), remote.get(name)); return { ok: true, output: "" }; }
-    if (args[0] === "release" && args[1] === "upload") { for (const value of args.slice(3, args.indexOf("--repo"))) { uploads.push(path.basename(value)); remote.set(path.basename(value), readFileSync(value, "utf8")); } return ""; }
-    throw new Error(`unexpected call: ${args.join(" ")}`);
-  };
-  const result = publishGitHubRelease({ kind: "addon", manifest: { files: [] }, sealedDir: root, tag: "immutable", assets: [first, second], manifestUrl: "https://example.test/manifest" }, { repo: "Orthic-Labs/Membrane", run });
-  assert.equal(result.status, "resumed-verified"); assert.deepEqual(uploads, ["second"]);
-});

package/heavy-command.test.mjs

@@ -1,221 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { mkdtempSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import {
-  acquireHeavyWorkSlot,
-  formatResourceSnapshot,
-  heavyChildDetached,
-  heavyCommandEnvironment,
-  heavyWorkRoot,
-  parseMacResourceSnapshot,
-  parseWindowsResourceSnapshot,
-  resourceBlockers,
-  runHeavyCommand,
-  sweepTrackedHeavyWorkOrphan,
-  systemResourceSnapshot,
-  terminateProcessTree,
-  watchOwnedProcessTree,
-} from "./heavy-command.mjs";
-
-test("heavy-work root is machine-wide rather than repository-local", () => {
-  assert.equal(heavyWorkRoot({ platform: "mac", home: "/Users/test", env: {} }), "/Users/test/Library/Caches/RightSuite/heavy-work");
-  assert.equal(heavyWorkRoot({ platform: "win", env: { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" } }), "C:\\Users\\test\\AppData\\Local\\RightSuite\\heavy-work");
-});
-
-test("heavy-work root ignores XDG_CACHE_HOME regardless of value", () => {
-  assert.equal(
-    heavyWorkRoot({ platform: "linux", env: { XDG_CACHE_HOME: "/one/path" }, home: "/home/u" }),
-    heavyWorkRoot({ platform: "linux", env: {}, home: "/home/u" }),
-  );
-  assert.equal(heavyWorkRoot({ platform: "linux", env: {}, home: "/home/u" }), "/home/u/.cache/rightsuite/heavy-work");
-});
-
-test("heavy commands default compiler and test concurrency to two", () => {
-  const env = heavyCommandEnvironment({});
-  assert.equal(env.CARGO_BUILD_JOBS, "2");
-  assert.equal(env.RUST_TEST_THREADS, "2");
-  assert.equal(env.RIGHTSUITE_HEAVY_WORK_OWNER, "1");
-  assert.equal(heavyCommandEnvironment({ CARGO_BUILD_JOBS: "3", RUST_TEST_THREADS: "1" }).CARGO_BUILD_JOBS, "3");
-});
-
-test("only the slot owner creates a new POSIX process group", () => {
-  assert.equal(heavyChildDetached({ slot: {}, platform: "mac" }), true);
-  assert.equal(heavyChildDetached({ slot: null, platform: "mac" }), false);
-  assert.equal(heavyChildDetached({ slot: {}, platform: "win" }), false);
-});
-
-test("mac resource parser reports memory, swap and thermal limiting", () => {
-  const snapshot = parseMacResourceSnapshot({
-    memory: "System-wide memory free percentage: 9%",
-    swap: "vm.swapusage: total = 8192.00M used = 7750.62M free = 441.38M",
-    thermal: "CPU_Speed_Limit = 70",
-  });
-  assert.equal(snapshot.freePercent, 9);
-  assert.equal(Math.round(snapshot.swapUsedBytes / 1024 ** 2), 7751);
-  assert.equal(snapshot.thermalLimited, true);
-  assert.deepEqual(resourceBlockers(snapshot), ["memory free 9% < 15%", "macOS reports thermal/performance limiting"]);
-});
-
-test("Windows admission uses physical memory and CPU load with a Node memory fallback", () => {
-  const snapshot = parseWindowsResourceSnapshot({
-    system: JSON.stringify({ TotalBytes: 16 * 1024 ** 3, FreeBytes: 4 * 1024 ** 3, CpuLoadPercent: 94 }),
-  });
-  assert.equal(snapshot.freePercent, 25);
-  assert.equal(snapshot.cpuLoadPercent, 94);
-  assert.deepEqual(resourceBlockers(snapshot), ["CPU load 94% > 90%"]);
-
-  const fallback = parseWindowsResourceSnapshot({ system: "not-json", fallbackTotalBytes: 8 * 1024 ** 3, fallbackFreeBytes: 2 * 1024 ** 3 });
-  assert.equal(fallback.freePercent, 25);
-  assert.equal(fallback.cpuLoadPercent, null);
-});
-
-test("Windows resource snapshot queries PowerShell without requiring optional modules", () => {
-  const calls = [];
-  const snapshot = systemResourceSnapshot({
-    platform: "win",
-    run: (command, args) => { calls.push({ command, args }); return { status: 0, stdout: '{"TotalBytes":8589934592,"FreeBytes":1073741824,"CpuLoadPercent":42}' }; },
-    totalmem: () => 1,
-    freemem: () => 1,
-  });
-  assert.equal(calls[0].command, "powershell.exe");
-  assert.deepEqual(calls[0].args.slice(0, 3), ["-NoLogo", "-NoProfile", "-NonInteractive"]);
-  assert.equal(snapshot.freePercent, 12.5);
-  assert.equal(snapshot.cpuLoadPercent, 42);
-  assert.equal(snapshot.thermalLimited, false);
-  assert.equal(formatResourceSnapshot(snapshot), "memory-free=12.5% cpu-load=42%");
-});
-
-test("nested heavy command preserves ownership without another slot", async () => {
-  const code = await runHeavyCommand(["--", process.execPath, "-e", "process.exit(0)"], { env: { ...process.env, RIGHTSUITE_HEAVY_WORK_OWNER: "1" } });
-  assert.equal(code, 0);
-});
-
-test("owned process-tree termination targets a POSIX group or Windows task tree", () => {
-  const signals = [];
-  terminateProcessTree(202, { platform: "mac", kill: (pid, signal) => signals.push([pid, signal]), treeAlive: () => true, pause: () => {} });
-  assert.deepEqual(signals, [[-202, "SIGTERM"], [-202, "SIGKILL"]]);
-  const calls = [];
-  terminateProcessTree(303, { platform: "win", run: (command, args) => calls.push([command, args]) });
-  assert.deepEqual(calls, [["taskkill", ["/PID", "303", "/T", "/F"]]]);
-});
-
-test("slot serializes contenders and removes stale owners", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-"));
-  const quiet = () => {};
-  const snapshot = () => ({ freePercent: 50, swapUsedBytes: 0, swapTotalBytes: 0, thermalLimited: false });
-  const first = acquireHeavyWorkSlot({ root, pid: 101, alive: (pid) => pid === 101, snapshot, log: quiet });
-  assert.throws(
-    () => acquireHeavyWorkSlot({ root, pid: 202, waitMs: 1, pollMs: 1, alive: (pid) => pid === 101, pause: () => {}, snapshot, log: quiet }),
-    /holder pid 101/,
-  );
-  first.release();
-
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 303, token: "stale" }));
-  const replacement = acquireHeavyWorkSlot({ root, pid: 404, alive: () => false, snapshot, log: quiet });
-  replacement.release();
-});
-
-test("dead slot owner reaps its recorded matching child tree", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-owned-"));
-  const killed = [];
-  const options = {
-    root, snapshot: () => ({ freePercent: 50, thermalLimited: false }), log: () => {},
-    alive: (pid) => pid === 202,
-    processStartedAt: (pid) => pid === 202 ? 1234 : null,
-    terminate: (pid) => killed.push(pid),
-    startWatcher: () => {},
-  };
-  const first = acquireHeavyWorkSlot({ ...options, pid: 101 });
-  first.trackChild(202, "cargo");
-  assert.equal(JSON.parse(readFileSync(path.join(root, "slot", "child.json"), "utf8")).childPid, 202);
-  const replacement = acquireHeavyWorkSlot({ ...options, pid: 404 });
-  assert.deepEqual(killed, [202]);
-  replacement.release();
-});
-
-test("dead slot owner refuses to kill a reused child PID", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-reused-"));
-  let observedStart = 1234;
-  const options = {
-    root, snapshot: () => ({ freePercent: 50, thermalLimited: false }), log: () => {},
-    alive: (pid) => pid === 202,
-    processStartedAt: (pid) => pid === 202 ? observedStart : null,
-    terminate: () => assert.fail("reused PID must not be terminated"),
-    startWatcher: () => {},
-  };
-  const first = acquireHeavyWorkSlot({ ...options, pid: 101 });
-  first.trackChild(202, "cargo");
-  observedStart = 5678;
-  assert.throws(() => acquireHeavyWorkSlot({ ...options, pid: 404 }), /identity changed/);
-  first.release();
-});
-
-test("preflight sweep reaps only a tracked child after an owner PID is reused", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
-  const killed = [];
-  assert.equal(sweepTrackedHeavyWorkOrphan({
-    root,
-    alive: (pid) => pid === 101 || pid === 202,
-    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 200 : null,
-    terminate: (pid) => killed.push(pid),
-    log: () => {},
-  }), true);
-  assert.deepEqual(killed, [202]);
-  assert.equal(existsSync(lockDir), false);
-});
-
-test("preflight sweep refuses a reused tracked child PID instead of killing broadly", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-reused-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
-  assert.throws(() => sweepTrackedHeavyWorkOrphan({
-    root,
-    alive: (pid) => pid === 101 || pid === 202,
-    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 4_000 : null,
-    terminate: () => assert.fail("reused child PID must not be terminated"),
-    log: () => {},
-  }), /identity changed/);
-});
-
-test("preflight sweep refuses a tracked child without a verifiable start identity", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-unverified-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
-  assert.throws(() => sweepTrackedHeavyWorkOrphan({
-    root,
-    alive: (pid) => pid === 101 || pid === 202,
-    startedAt: (pid) => pid === 101 ? 5_000 : null,
-    terminate: () => assert.fail("unverified child PID must not be terminated"),
-    log: () => {},
-  }), /identity changed/);
-});
-
-test("detached watcher reaps an owned child as soon as its owner disappears", async () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-watch-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, token: "owned" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 1234 }));
-  const killed = [];
-  const result = await watchOwnedProcessTree(
-    { root, token: "owned", ownerPid: 101, childPid: 202, childStartedAtMs: 1234 },
-    { alive: (pid) => pid === 202, startedAt: () => 1234, terminate: (pid) => killed.push(pid), pause: async () => {} },
-  );
-  assert.equal(result, true);
-  assert.deepEqual(killed, [202]);
-  assert.equal(existsSync(lockDir), false);
-});

package/legal-contract.test.mjs

@@ -1,151 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { assertLegalReleaseContract } from "./legal-contract.mjs";
-
-function digest(text) {
-  return createHash("sha256").update(text).digest("hex");
-}
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-legal-contract-"));
-  const legalDir = path.join(root, "legal");
-  const tauriDir = path.join(root, "src-tauri");
-  mkdirSync(legalDir, { recursive: true });
-  mkdirSync(tauriDir, { recursive: true });
-  const definitions = [
-    ["license", "LICENSE.md", "Ownership notice\n"],
-    ["eula", "EULA.md", "End user license agreement\n"],
-    ["acceptable_use", "ACCEPTABLE_USE.md", "Acceptable use\n"],
-    ["product_schedule", "PRODUCT_SCHEDULE.md", "Product schedule\n"],
-    ["privacy_notice", "PRIVACY.md", "Privacy notice\n"],
-    ["third_party_notices", "THIRD_PARTY_NOTICES.md", "Build provenance: fixture 1.0 windows-x86_64; inputs: pnpm-lock=abc Cargo.lock=def; generated-by=fixture\n"],
-  ];
-  for (const [, file, content] of definitions) writeFileSync(path.join(legalDir, file), content);
-  const manifest = {
-    schema: 2,
-    suite: "right-suite-desktop",
-    appKey: "fixture",
-    productName: "Fixture",
-    licensor: "Damned Ventures LLC",
-    effectiveDate: "2026-07-16",
-    acceptanceVersion: "fixture-2026-07-16-v1",
-    documents: definitions.map(([role, file, content]) => ({
-      id: `fixture-${role}`,
-      role,
-      title: role,
-      version: "1.0",
-      sha256: digest(content),
-      path: file,
-      publicUrl: `https://example.test/legal/${role}`,
-      treatment: ["privacy_notice"].includes(role) ? "acknowledge" : role === "third_party_notices" ? "notice" : "agree",
-      material: !["privacy_notice", "third_party_notices"].includes(role),
-    })),
-  };
-  writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
-  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
-  writeFileSync(
-    path.join(tauriDir, "tauri.conf.json"),
-    `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
-  );
-  return {
-    root,
-    legal: { manifest: "legal/legal-manifest.json", tauriConfig: "src-tauri/tauri.conf.json" },
-    manifest,
-  };
-}
-
-test("accepts a complete, hash-bound legal snapshot", () => {
-  const { root, legal } = fixture();
-  const result = assertLegalReleaseContract(root, legal, "fixture", "win");
-  assert.equal(result.appKey, "fixture");
-  assert.equal(result.documents.length, 6);
-});
-
-test("rejects a missing legal config", () => {
-  const { root } = fixture();
-  assert.throws(() => assertLegalReleaseContract(root, null, "fixture", "win"), /must declare legal\.manifest/i);
-});
-
-test("rejects changed bytes and unsafe manifest paths", () => {
-  const changed = fixture();
-  writeFileSync(path.join(changed.root, "legal", "EULA.md"), "changed without a new manifest\n");
-  assert.throws(() => assertLegalReleaseContract(changed.root, changed.legal, "fixture", "win"), /EULA\.md.*sha-?256/i);
-
-  const traversal = fixture();
-  traversal.manifest.documents[0].path = "../outside.md";
-  writeFileSync(path.join(traversal.root, "legal", "legal-manifest.json"), `${JSON.stringify(traversal.manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(traversal.root, traversal.legal, "fixture", "win"), /path.*snapshot|traversal/i);
-});
-
-test("rejects placeholders and unresolved checklist markers", () => {
-  const { root, legal, manifest } = fixture();
-  const eula = "Terms [COUNSEL: decide later]\n- [ ] fill this in\n";
-  writeFileSync(path.join(root, "legal", "EULA.md"), eula);
-  manifest.documents.find((document) => document.role === "eula").sha256 = digest(eula);
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /placeholder|unchecked|release blocker/i);
-});
-
-test("rejects an explicitly unresolved release blocker even without a checkbox", () => {
-  const { root, legal, manifest } = fixture();
-  const notice = "Build provenance: fixture; inputs: lock=abc; generated-by=fixture\nRELEASE BLOCKER: exact model notice is unresolved.\n";
-  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
-  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /release blocker/i);
-});
-
-test("rejects a Windows installer license page: the in-app gate is the only assent surface", () => {
-  const { root, legal } = fixture();
-  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile must be absent/i);
-});
-
-test("rejects a macOS DMG SLA too — one licenseFile drives both bundlers", () => {
-  // branded-dmg.mjs derives its --eula from bundle.licenseFile, so a Windows-only
-  // check would let a mac release quietly reintroduce the mount-time SLA.
-  const { root, legal } = fixture();
-  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /licenseFile must be absent/i);
-});
-
-test("accepts an app whose installer carries no license page", () => {
-  const { root, legal } = fixture();
-  for (const platform of ["win", "mac"]) {
-    assert.doesNotThrow(() => assertLegalReleaseContract(root, legal, "fixture", platform));
-  }
-});
-
-test("requires third-party build provenance", () => {
-  const { root, legal, manifest } = fixture();
-  const notice = "Third-party software is included.\n";
-  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
-  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /third-party.*provenance/i);
-});
-
-test("manifest hash evidence is the hash of the manifest bytes", () => {
-  const { root, legal } = fixture();
-  const result = assertLegalReleaseContract(root, legal, "fixture", "mac");
-  const bytes = readFileSync(path.join(root, legal.manifest));
-  assert.equal(result.manifestSha256, createHash("sha256").update(bytes).digest("hex"));
-});
-
-test("hash-binds declared third-party appendices and rejects missing files", () => {
-  const { root, legal, manifest } = fixture();
-  const appendix = "full dependency license text\n";
-  writeFileSync(path.join(root, "legal", "RUST_LICENSES.txt"), appendix);
-  manifest.appendices = [{ id: "rust-licenses", title: "Rust licenses", path: "RUST_LICENSES.txt", sha256: digest(appendix) }];
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.equal(assertLegalReleaseContract(root, legal, "fixture", "mac").appendices.length, 1);
-
-  manifest.appendices[0].path = "missing.txt";
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /appendix.*missing/i);
-});

package/mirror-root-artifact.test.mjs

@@ -1,58 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-const helper = fileURLToPath(new URL("./mirror-root-artifact.mjs", import.meta.url));
-
-test("mirrors a nested package artifact from a linked worktree into both package roots", () => {
-  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-"));
-  const main = path.join(temp, "suite");
-  const worktree = path.join(temp, "release-worktree");
-  try {
-    mkdirSync(path.join(main, "apps", "desktop"), { recursive: true });
-    git(temp, "init", "suite");
-    git(main, "config", "user.email", "test@example.com");
-    git(main, "config", "user.name", "Right Release Test");
-    writeFileSync(path.join(main, "tracked"), "fixture\n");
-    git(main, "add", "tracked");
-    git(main, "commit", "-m", "fixture");
-    git(main, "worktree", "add", worktree, "-b", "release-test");
-
-    const packageRoot = path.join(worktree, "apps", "desktop");
-    const source = path.join(packageRoot, "target", "App_1.0.0.dmg");
-    mkdirSync(path.dirname(source), { recursive: true });
-    writeFileSync(source, "signed-dmg-fixture");
-
-    execFileSync(process.execPath, [helper, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
-
-    assert.equal(readFileSync(path.join(packageRoot, "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
-    assert.equal(readFileSync(path.join(main, "apps", "desktop", "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("copies a main-worktree artifact into its package root", () => {
-  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-main-"));
-  try {
-    git(temp, "init", "app");
-    const root = path.join(temp, "app");
-    const source = path.join(root, "target", "App_2.0.0.dmg");
-    mkdirSync(path.dirname(source), { recursive: true });
-    writeFileSync(source, "main-worktree-dmg");
-
-    execFileSync(process.execPath, [helper, "--file", source, "--package-root", root], { encoding: "utf8" });
-
-    assert.equal(readFileSync(path.join(root, "App_2.0.0.dmg"), "utf8"), "main-worktree-dmg");
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-function git(cwd, ...args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-}