@rightkit/release 0.2.68 → 0.2.70

package/model-promote.test.mjs

@@ -1,284 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash, generateKeyPairSync, sign } from "node:crypto";
-import { spawnSync } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-import {
-  RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
-  defaultWindowsRuntimeArtifactSigningKeyFile,
-  loadRuntimeArtifactSigningKey,
-  promoteRuntimeArtifact,
-  runtimeArtifactUploadEnv,
-} from "./model-promote.mjs";
-const { privateKey } = generateKeyPairSync("ed25519");
-const artifactDigest = "a".repeat(64);
-const evidenceDigest = "b".repeat(64);
-const packageRoot = path.dirname(fileURLToPath(import.meta.url));
-const candidateCommit = "a".repeat(40);
-
-// Source identity as build/upload/promote read it: the exact commit, plus the
-// porcelain status that must be empty for the promotion to run.
-function verificationFixture(commit = candidateCommit, status = "") {
-  return { candidateCommit: commit, status };
-}
-
-function request(overrides = {}) {
-  return {
-    authority: "heardright",
-    privateKey,
-    keyId: RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
-    artifactFile: "C:/fixtures/parakeet.onnx",
-    evidenceFile: "C:/fixtures/eval.json",
-    config: {
-      artifact: {
-        filename: "parakeet.onnx",
-        sha256: artifactDigest,
-        sizeBytes: 42,
-      },
-      evidence: { sha256: evidenceDigest },
-      manifest: {
-        artifactKind: "asr-model",
-        entitlement: { appKey: "scraperight", tier: "pro" },
-        distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
-        target: { os: "windows", arch: "x86_64" },
-        versions: {
-          runtime: "rightkit-asr-0.1.0",
-          model: "parakeet-tdt-0.6b-v3",
-          tokenizer: "sentencepiece-2026-07-14",
-          preprocessing: "rightkit-asr-0.1.0",
-          license: "cc-by-4.0",
-          provenance: "heardright-approved-2026-07-14",
-        },
-        provenance: {
-          source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
-          sourceRevision: "0123456789abcdef",
-          licenseId: "CC-BY-4.0",
-          noticeSha256: "c".repeat(64),
-        },
-        promotion: {
-          promotionId: "hr-asr-2026-07-14-001",
-          promotedAt: "2026-07-14T12:00:00.000Z",
-        },
-      },
-    },
-    verification: verificationFixture(),
-    ...overrides,
-  };
-}
-
-function boundaries(events) {
-  return {
-    metadata: async (file) => file.endsWith("eval.json")
-      ? { sha256: evidenceDigest, sizeBytes: 10 }
-      : { sha256: artifactDigest, sizeBytes: 42 },
-    upload: async ({ purpose }) => { events.push(`upload:${purpose}`); },
-    register: async () => { events.push("register"); },
-  };
-}
-
-test("uploads immutable object, registers signed envelope, then replaces stable pointer", async () => {
-  const events = [];
-  const result = await promoteRuntimeArtifact(request(), boundaries(events));
-
-  assert.deepEqual(events, ["upload:object", "register", "upload:pointer"]);
-  assert.equal(result.envelope.signature.keyId, RUNTIME_ARTIFACT_TRUSTED_KEY_ID);
-  assert.equal(result.envelope.manifest.object.sha256, artifactDigest);
-  assert.equal(result.envelope.manifest.promotion.evidenceSha256, evidenceDigest);
-  assert.match(result.envelope.manifest.pointerKey, /\/current\/manifest\.json$/);
-});
-
-test("dry-run validates and signs without invoking process or network boundaries", async () => {
-  const events = [];
-  const result = await promoteRuntimeArtifact(request({ dryRun: true }), boundaries(events));
-  assert.deepEqual(events, []);
-  assert.deepEqual(result.steps, ["upload immutable object", "register signed envelope", "replace stable pointer"]);
-  assert.equal(result.envelope.signature.algorithm, "Ed25519");
-});
-
-test("model promotion refuses a dirty working tree", async () => {
-  const events = [];
-  const verification = verificationFixture(candidateCommit, " M packages/release/model-promote.mjs\0");
-  await assert.rejects(
-    promoteRuntimeArtifact(request({ verification, dryRun: true }), boundaries(events)),
-    /clean working tree/,
-  );
-  assert.deepEqual(events, []);
-});
-
-test("model promotion requires source identity", async () => {
-  const events = [];
-  await assert.rejects(
-    promoteRuntimeArtifact(request({ verification: undefined, dryRun: true }), boundaries(events)),
-    /source identity is required/,
-  );
-  assert.deepEqual(events, []);
-});
-
-test("never registers or publishes a pointer after immutable upload failure", async () => {
-  const events = [];
-  const deps = boundaries(events);
-  deps.upload = async ({ purpose }) => {
-    events.push(`upload:${purpose}`);
-    throw new Error("R2 failed");
-  };
-  await assert.rejects(promoteRuntimeArtifact(request(), deps), /R2 failed/);
-  assert.deepEqual(events, ["upload:object"]);
-});
-
-test("never publishes a pointer when RightApps registration fails", async () => {
-  const events = [];
-  const deps = boundaries(events);
-  deps.register = async () => {
-    events.push("register");
-    throw new Error("registration failed");
-  };
-  await assert.rejects(promoteRuntimeArtifact(request(), deps), /registration failed/);
-  assert.deepEqual(events, ["upload:object", "register"]);
-});
-
-test("fails before mutation on digest, authority, key-id, or lane contradiction", async () => {
-  const badRequests = [
-    request({ authority: "scraperight" }),
-    request({ keyId: "untrusted-key" }),
-    request({ config: { ...request().config, artifact: { ...request().config.artifact, sha256: "d".repeat(64) } } }),
-    request({ config: {
-      ...request().config,
-      manifest: {
-        ...request().config.manifest,
-        entitlement: { appKey: "scraperight", tier: "public" },
-        distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
-      },
-    } }),
-    request({ config: {
-      ...request().config,
-      manifest: {
-        ...request().config.manifest,
-        promotion: {
-          ...request().config.manifest.promotion,
-          authorityAppKey: "scraperight",
-        },
-      },
-    } }),
-  ];
-  for (const input of badRequests) {
-    const events = [];
-    await assert.rejects(promoteRuntimeArtifact(input, boundaries(events)));
-    assert.deepEqual(events, []);
-  }
-});
-
-test("right-release routes model promote to the portable promotion lane", () => {
-  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--authority", "heardright"], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  assert.equal(result.status, 1);
-  assert.match(result.stderr, /model promote requires --config/);
-  assert.doesNotMatch(result.stderr, /unknown command/);
-});
-
-test("model promote help documents the portable config and secure key inputs", () => {
-  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--help"], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /artifact\.file/);
-  assert.match(result.stdout, /evidence\.sha256/);
-  assert.match(result.stdout, /RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE/);
-  assert.match(result.stdout, /RIGHTAPPS_RELEASE_TOKEN/);
-});
-
-test("portable CLI promotes from a clean checkout, refuses a dirty one, and rejects injected trust flags", async () => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "rightkit-model-promote-test-"));
-  try {
-    const artifact = Buffer.from("tiny model fixture");
-    const evidence = Buffer.from('{"certified":true}');
-    const testKeys = generateKeyPairSync("ed25519");
-    const keyPem = testKeys.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
-    await Promise.all([
-      writeFile(path.join(root, "model.onnx"), artifact),
-      writeFile(path.join(root, "evidence.json"), evidence),
-      writeFile(path.join(root, "key.pem"), keyPem, { mode: 0o600 }),
-    ]);
-    spawnSync("git", ["init"], { cwd: root, encoding: "utf8" });
-    spawnSync("git", ["add", "."], { cwd: root, encoding: "utf8" });
-    const committed = spawnSync("git", ["-c", "user.name=fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "fixture"], { cwd: root, encoding: "utf8" });
-    assert.equal(committed.status, 0, committed.stderr);
-    const config = {
-      artifact: {
-        file: "model.onnx",
-        filename: "model.onnx",
-        sha256: createHash("sha256").update(artifact).digest("hex"),
-        sizeBytes: artifact.length,
-      },
-      evidence: {
-        file: "evidence.json",
-        sha256: createHash("sha256").update(evidence).digest("hex"),
-      },
-      manifest: request().config.manifest,
-    };
-    await writeFile(path.join(root, "promotion.json"), JSON.stringify(config));
-    spawnSync("git", ["add", "."], { cwd: root, encoding: "utf8" });
-    spawnSync("git", ["-c", "user.name=fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "config"], { cwd: root, encoding: "utf8" });
-
-    const promoteArgs = [
-      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
-      "--authority", "heardright",
-      "--config", path.join(root, "promotion.json"),
-      "--signing-key-file", path.join(root, "key.pem"),
-      "--dry-run",
-    ];
-    const result = spawnSync(process.execPath, promoteArgs, { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(result.status, 0, result.stderr);
-
-    await writeFile(path.join(root, "untracked.txt"), "dirty");
-    const dirty = spawnSync(process.execPath, promoteArgs, { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(dirty.status, 1);
-    assert.match(dirty.stderr, /clean working tree/);
-
-    const attacker = spawnSync(process.execPath, [
-      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
-      "--authority", "heardright", "--config", path.join(root, "promotion.json"),
-      "--verification-public-key", path.join(root, "verification-public.pem"),
-    ], { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(attacker.status, 1);
-    assert.match(attacker.stderr, /unknown model promote argument: --verification-public-key/);
-    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /BEGIN PRIVATE KEY/);
-    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /Uploading|POST https:/);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test("uses the canonical Windows signing-key path and supports a Keychain-fed PEM environment value", async () => {
-  assert.equal(
-    defaultWindowsRuntimeArtifactSigningKeyFile({ APPDATA: "C:/Users/test/AppData/Roaming" }),
-    path.join("C:/Users/test/AppData/Roaming", "RightKit", "runtime-artifact-signing-key.pem"),
-  );
-  assert.equal(
-    await loadRuntimeArtifactSigningKey({ env: { RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "line1\\nline2" }, platform: "darwin" }),
-    "line1\nline2",
-  );
-});
-
-test("does not forward signing or RightApps credentials into the Wrangler uploader process", () => {
-  const env = runtimeArtifactUploadEnv({
-    CLOUDFLARE_API_TOKEN: "cloudflare-token",
-    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "private-pem",
-    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE: "key.pem",
-    RIGHTAPPS_RELEASE_TOKEN: "release-token",
-    RIGHTAPPS_RELEASE_TOKEN_FILE: "release.token",
-  });
-  assert.equal(env.CLOUDFLARE_API_TOKEN, "cloudflare-token");
-  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY, undefined);
-  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE, undefined);
-  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN, undefined);
-  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN_FILE, undefined);
-});

package/notary-auth.test.mjs

@@ -1,31 +0,0 @@
-import assert from "node:assert/strict";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { notarytoolAuthArgs } from "./notary-auth.mjs";
-
-test("prefers a complete App Store Connect API credential set", () => {
-  const before = { ...process.env };
-  try {
-    process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
-    process.env.APPLE_API_KEY = "KEY123";
-    process.env.APPLE_API_ISSUER = "ISSUER123";
-    assert.deepEqual(notarytoolAuthArgs(), ["--key", path.join(os.homedir(), "AuthKey.p8"), "--key-id", "KEY123", "--issuer", "ISSUER123"]);
-  } finally {
-    process.env = before;
-  }
-});
-
-test("falls back to the device keychain profile and rejects partial API auth", () => {
-  const before = { ...process.env };
-  try {
-    delete process.env.APPLE_API_KEY_PATH;
-    delete process.env.APPLE_API_KEY;
-    delete process.env.APPLE_API_ISSUER;
-    assert.deepEqual(notarytoolAuthArgs(), ["--keychain-profile", "apple-dev-notary"]);
-    process.env.APPLE_API_KEY = "KEY123";
-    assert.throws(() => notarytoolAuthArgs(), /requires APPLE_API_KEY_PATH.*APPLE_API_ISSUER/);
-  } finally {
-    process.env = before;
-  }
-});

package/nsis-payload.test.mjs

@@ -1,139 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import test, { after } from "node:test";
-import { listNsisPayload, parseSevenZipListing, resolveSevenZip, verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
-
-const workspace = mkdtempSync(path.join(tmpdir(), "rightkit-nsis-"));
-after(() => rmSync(workspace, { recursive: true, force: true }));
-
-// 7-Zip's technical listing: an archive record, a rule, then one record per member.
-// The blank `Attributes` and absent timestamps are what the column-aligned listing
-// gets wrong, so they are reproduced here deliberately.
-const LISTING = [
-  "Path = D:\\out\\App_1.2.3_x64-setup.exe",
-  "Type = Nsis",
-  "",
-  "----------",
-  "Path = $PLUGINSDIR\\System.dll",
-  "Size = 12288",
-  "Attributes = ",
-  "",
-  "Path = app with spaces.exe",
-  "Size = 13750736",
-  "Attributes = ",
-  "",
-  "Path = legal",
-  "Size = 0",
-  "Folder = +",
-  "Attributes = D",
-  "",
-  "Path = legal\\EULA.md",
-  "Size = 16723",
-  "Attributes = A",
-  "",
-].join("\n");
-
-test("parses 7-Zip technical listings, including blank dates and spaced names", () => {
-  const entries = parseSevenZipListing(LISTING);
-  assert.deepEqual(entries.map((entry) => entry.name), [
-    "$PLUGINSDIR/System.dll",
-    "app with spaces.exe",
-    "legal/EULA.md",
-  ]);
-  assert.equal(entries[1].sizeBytes, 13_750_736);
-});
-
-test("ignores the archive's own record above the rule", () => {
-  const entries = parseSevenZipListing(LISTING);
-  assert.equal(entries.some((entry) => entry.name.endsWith("setup.exe")), false);
-});
-
-test("listNsisPayload surfaces the 7-Zip failure instead of reporting an empty payload", () => {
-  assert.throws(
-    () => listNsisPayload("installer.exe", {
-      sevenZip: "7z",
-      run: () => ({ status: 2, stdout: "", stderr: "Cannot open the file as archive" }),
-    }),
-    /could not read the NSIS payload.*Cannot open the file as archive/s,
-  );
-});
-
-test("verifyNsisEmbeddedBinary accepts a payload whose bytes match the signed EXE", () => {
-  const installer = path.join(workspace, "setup.exe");
-  writeFileSync(installer, "installer-container");
-  const payload = Buffer.from("signed-executable-bytes");
-  const sha256 = createHash("sha256").update(payload).digest("hex");
-
-  const receipt = verifyNsisEmbeddedBinary({
-    installer,
-    entryName: "app.exe",
-    expectedSha256: sha256,
-    sevenZip: "7z",
-    run: (_command, args) => {
-      const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
-      writeFileSync(path.join(destination, "app.exe"), payload);
-      return { status: 0, stdout: "Everything is Ok", stderr: "" };
-    },
-  });
-
-  assert.equal(receipt.sha256, sha256);
-  assert.equal(receipt.entry, "app.exe");
-  assert.equal(receipt.sizeBytes, payload.length);
-  assert.equal(receipt.installerSha256, createHash("sha256").update(readFileSync(installer)).digest("hex"));
-});
-
-test("verifyNsisEmbeddedBinary rejects a payload that drifted from the signed EXE", () => {
-  const installer = path.join(workspace, "setup-drifted.exe");
-  writeFileSync(installer, "installer-container");
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({
-      installer,
-      entryName: "app.exe",
-      expectedSha256: createHash("sha256").update("signed-executable-bytes").digest("hex"),
-      sevenZip: "7z",
-      run: (_command, args) => {
-        const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
-        writeFileSync(path.join(destination, "app.exe"), "rewritten-after-signing");
-        return { status: 0, stdout: "Everything is Ok", stderr: "" };
-      },
-    }),
-    /does not embed the signed app\.exe.*Authenticode signature is invalid/s,
-  );
-});
-
-test("verifyNsisEmbeddedBinary fails when the entry is absent rather than passing vacuously", () => {
-  const installer = path.join(workspace, "setup-missing.exe");
-  writeFileSync(installer, "installer-container");
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({
-      installer,
-      entryName: "app.exe",
-      expectedSha256: "a".repeat(64),
-      sevenZip: "7z",
-      run: () => ({ status: 2, stdout: "", stderr: "No files to process" }),
-    }),
-    /could not extract app\.exe/,
-  );
-});
-
-test("verifyNsisEmbeddedBinary refuses a caller that has no digest to compare against", () => {
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({ installer: "setup.exe", entryName: "app.exe", expectedSha256: undefined, sevenZip: "7z", run: () => ({ status: 0 }) }),
-    /expected a sha256 digest/,
-  );
-});
-
-test("resolveSevenZip names the fix when 7-Zip is absent", () => {
-  assert.throws(
-    () => resolveSevenZip({ env: {}, exists: () => false, which: () => null }),
-    /install 7-Zip.*RIGHT_RELEASE_SEVENZIP/s,
-  );
-});
-
-test("resolveSevenZip honours an explicit override and rejects a bad one", () => {
-  assert.equal(resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\tools\\7z.exe" }, exists: () => true }), "C:\\tools\\7z.exe");
-  assert.throws(() => resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\gone\\7z.exe" }, exists: () => false }), /does not exist/);
-});

package/nsis-upgrade-contract.test.mjs

@@ -1,57 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
-
-function fixture(template) {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-nsis-upgrade-"));
-  const tauriDir = path.join(root, "src-tauri");
-  const windowsDir = path.join(tauriDir, "windows");
-  mkdirSync(windowsDir, { recursive: true });
-  writeFileSync(
-    path.join(tauriDir, "tauri.conf.json"),
-    `${JSON.stringify({ bundle: { windows: { nsis: { template: "windows/installer.nsi" } } } })}\n`,
-  );
-  writeFileSync(path.join(windowsDir, "installer.nsi"), template);
-  return root;
-}
-
-test("rejects an NSIS template that exposes uninstall-or-reinstall maintenance choices", () => {
-  const root = fixture(`
-    Page custom PageReinstall PageLeaveReinstall
-    Function PageReinstall
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  assert.throws(
-    () => assertNsisInPlaceUpgradeContract(root),
-    /automatic in-place upgrade|maintenance choice/i,
-  );
-});
-
-test("accepts a template that skips maintenance UI for same-version repair and upgrades", () => {
-  const root = fixture(`
-    !define RIGHTKIT_AUTOMATIC_IN_PLACE_UPGRADE
-    Function PageReinstall
-      $\{If\} $WixMode = 0
-      $\{AndIf\} $R0 >= 0
-        Abort
-      $\{EndIf\}
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  const result = assertNsisInPlaceUpgradeContract(root);
-  assert.match(result.templatePath, /installer\.nsi$/);
-});
-
-test("rejects a marker without executable skip-page logic", () => {
-  const root = fixture(`
-    !define RIGHTKIT_AUTOMATIC_IN_PLACE_UPGRADE
-    Function PageReinstall
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  assert.throws(() => assertNsisInPlaceUpgradeContract(root), /skip.*logic/i);
-});

package/preflight.test.mjs

@@ -1,123 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import path from "node:path";
-
-import {
-  buildPathPrefix,
-  collectPreflight,
-  findWindowsSdkTool,
-  formatPreflight,
-  graphVendorsOpenssl,
-  nextFreeVersion,
-  preflightFailures,
-  resolveWindowsPerl,
-  PREFLIGHT_FAIL,
-} from "./preflight.mjs";
-
-test("windows SDK lookup orders versions numerically, not as strings", () => {
-  const root = "C:\\Kits";
-  const present = new Set([
-    root,
-    path.join(root, "10.0.9.0", "x64", "makeappx.exe"),
-    path.join(root, "10.0.26100.0", "x64", "makeappx.exe"),
-  ]);
-  const found = findWindowsSdkTool("makeappx.exe", {
-    sdkRoot: root,
-    readdir: () => ["10.0.9.0", "10.0.26100.0"],
-    exists: (candidate) => present.has(candidate),
-  });
-  // String sort would pick 10.0.9.0 — that is the bug this guards.
-  assert.equal(found.version, "10.0.26100.0");
-});
-
-test("windows SDK lookup returns null when the tool is absent from every SDK", () => {
-  const found = findWindowsSdkTool("makeappx.exe", {
-    sdkRoot: "C:\\Kits",
-    readdir: () => ["10.0.26100.0"],
-    exists: (candidate) => candidate === "C:\\Kits",
-  });
-  assert.equal(found, null);
-});
-
-test("explicit OPENSSL_SRC_PERL wins over the default Strawberry location", () => {
-  const resolved = resolveWindowsPerl({
-    env: { OPENSSL_SRC_PERL: "D:\\perl\\bin\\perl.exe" },
-    exists: () => true,
-  });
-  assert.equal(resolved.perlPath, "D:\\perl\\bin\\perl.exe");
-  assert.equal(resolved.dir, "D:\\perl\\bin");
-});
-
-test("perl resolution reports nothing when no windows perl exists", () => {
-  assert.equal(resolveWindowsPerl({ env: {}, exists: () => false }), null);
-});
-
-test("vendored openssl is detected from the cargo lock", () => {
-  assert.equal(
-    graphVendorsOpenssl("Cargo.lock", { exists: () => true, read: () => 'name = "openssl-src"\n' }),
-    true,
-  );
-  assert.equal(
-    graphVendorsOpenssl("Cargo.lock", { exists: () => true, read: () => 'name = "rustls"\n' }),
-    false,
-  );
-  assert.equal(graphVendorsOpenssl("missing.lock", { exists: () => false }), false);
-});
-
-test("a sealed version collision suggests the next free patch, skipping taken ones", () => {
-  const result = nextFreeVersion("/sealed", "heardright", "0.1.33", {
-    exists: () => true,
-    readdir: () => [
-      "heardright-0.1.33-6f2f5e64",
-      "heardright-0.1.34-839ad700",
-      "heardright-0.1.36-f7035acc",
-      "viewright-0.1.35-aaaaaaaa",
-    ],
-  });
-  assert.equal(result.collision, true);
-  // 0.1.34 is taken, 0.1.35 is free — and viewright's record must not be counted.
-  assert.equal(result.suggestion, "0.1.35");
-});
-
-test("an unsealed version is reported as free", () => {
-  const result = nextFreeVersion("/sealed", "heardright", "0.1.37", {
-    exists: () => true,
-    readdir: () => ["heardright-0.1.33-6f2f5e64"],
-  });
-  assert.equal(result.collision, false);
-  assert.equal(result.suggestion, "0.1.37");
-});
-
-test("a sealed version collision is a hard failure carrying a concrete fix", () => {
-  const checks = collectPreflight({
-    platform: "linux",
-    repoRoot: process.cwd(),
-    app: "nothing-is-sealed-here",
-    version: "9.9.9",
-  });
-  // No sealed dir for this app, so the version check must pass rather than throw.
-  const version = checks.find((check) => check.name === "version");
-  assert.equal(version.status, "ok");
-});
-
-test("formatting surfaces the fix line only for non-ok checks", () => {
-  const text = formatPreflight([
-    { name: "a", status: "ok", detail: "fine", fix: "unused" },
-    { name: "b", status: PREFLIGHT_FAIL, detail: "broken", fix: "do the thing" },
-  ]);
-  assert.match(text, /\[ok {2}\] a: fine/);
-  assert.doesNotMatch(text, /fix: unused/);
-  assert.match(text, /fix: do the thing/);
-});
-
-test("failures are filtered from warnings so warnings never block a build", () => {
-  const failures = preflightFailures([
-    { name: "a", status: "warn", detail: "" },
-    { name: "b", status: PREFLIGHT_FAIL, detail: "" },
-  ]);
-  assert.deepEqual(failures.map((check) => check.name), ["b"]);
-});
-
-test("build PATH prefix is windows-only", () => {
-  assert.equal(buildPathPrefix({ platform: "mac" }), null);
-});