@rightkit/release 0.2.68 → 0.2.70

package/progress-control.test.mjs

@@ -1,56 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import { cancelAndReapManagedRequest, firstManagedRequestId, latestManagedRequestId, releaseProgressLimits, terminalResultFromOutput } from "./progress-control.mjs";
-
-test("release progress stays bounded without killing a healthy long native build at 90 minutes", () => {
-  assert.deepEqual(releaseProgressLimits({}), { inactivityMs: 600_000, absoluteMs: 14_400_000 });
-  assert.deepEqual(releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "5000" }), { inactivityMs: 1_000, absoluteMs: 5_000 });
-  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "1000" }), /must exceed/);
-  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
-});
-
-test("declared inner liveness owner always exits before the outer watchdog", () => {
-  const ownerTimeoutMs = 45 * 60 * 1000;
-  assert.deepEqual(
-    releaseProgressLimits({}, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    { inactivityMs: 50 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
-  );
-  assert.deepEqual(
-    releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: String(60 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    { inactivityMs: 60 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
-  );
-  assert.throws(
-    () => releaseProgressLimits({ RIGHT_RELEASE_ABSOLUTE_MS: String(49 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    /must exceed effective release inactivity limit/,
-  );
-  assert.throws(() => releaseProgressLimits({}, { livenessOwnerTimeoutMs: 0 }), /positive finite/);
-});
-
-test("latest managed request id follows streamed root Cargo requests", () => {
-  const first = "11111111-1111-4111-8111-111111111111";
-  const second = "22222222-2222-4222-8222-222222222222";
-  assert.equal(latestManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), second);
-  assert.equal(firstManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), first);
-  assert.equal(latestManagedRequestId("ordinary output", first), first);
-});
-
-test("managed cancellation issues CANCEL, waits for terminal RESULT, & returns reap receipt", async () => {
-  const id = "33333333-3333-4333-8333-333333333333";
-  const calls = [];
-  const run = async (args) => {
-    calls.push(args);
-    if (args[0] === "cancel") return { code: 0, output: JSON.stringify({ type: "CANCEL_REQUESTED", id }) };
-    return { code: 130, output: `compiler tail\n${JSON.stringify({ type: "RESULT", id, status: "CANCELLED", exitCode: 130, receipt: { reap: { reaped: true } } })}\n` };
-  };
-  assert.deepEqual(await cancelAndReapManagedRequest(id, { run }), {
-    status: "CANCELLED", id, exitCode: 130, receipt: { reap: { reaped: true } }, cancelExitCode: 0, attachExitCode: 130,
-  });
-  assert.deepEqual(calls, [["cancel", id], ["attach", id]]);
-});
-
-test("missing terminal broker result fails closed", async () => {
-  const run = async () => ({ code: 125, output: "broker closed", timedOut: false });
-  await assert.rejects(cancelAndReapManagedRequest("44444444-4444-4444-8444-444444444444", { run }), /lacked terminal RESULT/);
-  assert.equal(terminalResultFromOutput("noise\n"), null);
-});

package/prune-r2.test.mjs

@@ -1,12 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { isReleaseObject } from "./prune-r2.mjs";
-
-test("pruning only targets release objects for the active OS", () => {
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/mac/ViewRight.dmg"), true);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/updates/mac/current/ViewRight.app.tar.gz"), true);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/windows/ViewRight-Setup.exe"), false);
-  assert.equal(isReleaseObject("viewright", "windows", "viewright/installers/mac/ViewRight.dmg"), false);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/models/mac/model.bin"), false);
-  assert.equal(isReleaseObject("viewright", "mac", "other/installers/mac/Other.dmg"), false);
-});

package/publish-cargo.test.mjs

@@ -1,43 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import {
-  buildCargoPublishPlan,
-  packageFileViolations,
-  parseCargoPublishArgs,
-} from "./publish-cargo.mjs";
-
-test("cargo publish requires a safe explicit crate name", () => {
-  assert.throws(() => parseCargoPublishArgs([]), /--crate/);
-  assert.throws(() => parseCargoPublishArgs(["--crate", "../secret"]), /invalid crate/);
-  assert.throws(() => parseCargoPublishArgs(["--crate", "rightkit-license", "--allow-dirty"]), /only valid with --dry-run/);
-  assert.equal(parseCargoPublishArgs(["--crate", "rightkit-license"]).crate, "rightkit-license");
-});
-
-test("cargo publish plan always runs local safety gates before upload", () => {
-  const plan = buildCargoPublishPlan({ crate: "rightkit-license", crateDir: "C:/rightkit/crates/rightkit-license", dryRun: false });
-  assert.deepEqual(plan.map((step) => step.label), [
-    "secret scan",
-    "format",
-    "tests",
-    "clippy",
-    "package contents",
-    "registry dry-run",
-    "registry publish",
-  ]);
-  assert.deepEqual(plan.at(-1)?.args, ["publish", "-p", "rightkit-license"]);
-});
-
-test("dry-run plan never contains a real registry upload", () => {
-  const plan = buildCargoPublishPlan({ crate: "rightkit-logs", crateDir: "C:/rightkit/crates/rightkit-logs", dryRun: true });
-  assert.equal(plan.at(-1)?.label, "registry dry-run");
-});
-
-test("package inspection rejects secret and build-output paths", () => {
-  assert.deepEqual(packageFileViolations([
-    "Cargo.toml",
-    "src/lib.rs",
-    ".env",
-    "keys/signing.p8",
-    "target/release/app",
-  ]), [".env", "keys/signing.p8", "target/release/app"]);
-});

package/publish-swift.test.mjs

@@ -1,44 +0,0 @@
-import assert from "node:assert/strict";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-import { parseSwiftPublishArgs, buildSwiftPublishPlan, readPackageIdentity } from "./publish-swift.mjs";
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const packageDir = path.resolve(here, "../../swift/RightKitSwift");
-
-test("dry-run needs no url; publish requires one", () => {
-  assert.deepEqual(parseSwiftPublishArgs(["--dry-run"], {}), {
-    scope: "rightsuite", url: "", dryRun: true, allowDirty: false,
-  });
-  assert.throws(() => parseSwiftPublishArgs([], {}), /needs --url/);
-  assert.equal(parseSwiftPublishArgs(["--url", "https://reg.local"], {}).url, "https://reg.local");
-});
-
-test("env supplies scope and url; --allow-dirty is dry-run only", () => {
-  const parsed = parseSwiftPublishArgs([], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e", RIGHTKIT_SWIFT_REGISTRY_SCOPE: "acme" });
-  assert.deepEqual(parsed, { scope: "acme", url: "https://e", dryRun: false, allowDirty: false });
-  assert.throws(() => parseSwiftPublishArgs(["--allow-dirty"], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e" }), /only valid with --dry-run/);
-  assert.throws(() => parseSwiftPublishArgs(["--bogus"], {}), /unexpected argument/);
-});
-
-test("reads the real package identity from VERSION + Package.swift", () => {
-  const { name, version } = readPackageIdentity(packageDir);
-  assert.equal(name, "RightKitSwift");
-  assert.match(version, /^\d+\.\d+\.\d+/);
-});
-
-test("dry-run plan stops before publish; real plan ends with publish", () => {
-  const base = { packageDir, scope: "rightsuite", name: "RightKitSwift", version: "0.1.0", url: "https://reg.local" };
-  const dry = buildSwiftPublishPlan({ ...base, dryRun: true });
-  assert.equal(dry[0].internal, "secret-scan");
-  assert.ok(dry.some((s) => s.label === "tests" && s.command === "swift"));
-  assert.ok(!dry.some((s) => s.label === "registry publish"), "dry-run must not publish");
-
-  const real = buildSwiftPublishPlan({ ...base, dryRun: false });
-  const publish = real.at(-1);
-  assert.equal(publish.label, "registry publish");
-  assert.deepEqual(publish.args, [
-    "package-registry", "publish", "rightsuite.RightKitSwift", "0.1.0", "--url", "https://reg.local", "--package-path", packageDir,
-  ]);
-});

package/publish-update.test.mjs

@@ -1,207 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-
-const publisher = fileURLToPath(new URL("./publish-update.mjs", import.meta.url));
-
-function fixture({ materialize = false } = {}) {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
-        updater: {
-          artifacts: [
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/updates/windows/current/Fixture.exe" },
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-arm64", key: "fixture/updates/windows/current/Fixture.exe" },
-          ],
-        },
-      },
-    },
-  })};\n`);
-  if (materialize) {
-    writeFileSync(path.join(dir, "Fixture-Setup.exe"), "signed installer");
-    writeFileSync(path.join(dir, "Fixture.exe"), "signed updater");
-    writeFileSync(path.join(dir, "Fixture.exe.sig"), "updater signature");
-  }
-  return config;
-}
-
-function versionedFixture() {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/1.2.3/Fixture-Setup.exe" }] },
-        updater: {
-          artifacts: [
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/1.2.3/windows/Fixture.exe" },
-          ],
-        },
-      },
-    },
-  })};\n`);
-  return config;
-}
-
-function installerOnlyFixture() {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
-        updater: { artifacts: [] },
-      },
-    },
-  })};\n`);
-  return config;
-}
-
-function run(tier) {
-  const config = fixture();
-  return spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: tier },
-  });
-}
-
-function registrationBody(result) {
-  return result.stdout
-    .split(/\r?\n/)
-    .filter((line) => line.startsWith('{'))
-    .map((line) => JSON.parse(line))
-    .find((body) => body.artifactManifest);
-}
-
-test("patch registers a free updater manifest backed by public installer-path objects", () => {
-  const result = run("patch");
-  assert.equal(result.status, 0, result.stderr);
-  const patchPayloadUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture.exe");
-  const installerUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture-Setup.exe");
-  const registration = result.stdout.indexOf("/v1/admin/apps/patches");
-  assert.ok(patchPayloadUpload >= 0, "patch updater payload must upload to the public installer path");
-  assert.ok(installerUpload >= 0, "patch download installer must upload to the public installer path");
-  assert.ok(patchPayloadUpload < installerUpload, "patch should upload app-update payloads before replacing the public download installer");
-  assert.ok(installerUpload < registration, "patch should register only after uploads complete");
-  assert.doesNotMatch(result.stdout, /UPLOAD public\/fixture\/updates\//);
-  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
-  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
-  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
-  assert.match(result.stdout, /"tier":"patch"/);
-  assert.match(result.stdout, /"platform":"windows"/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
-  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 2, "patch may upload only one installer and one updater object per OS");
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
-  const body = registrationBody(result);
-  assert.deepEqual(
-    {
-      schema: body.artifactManifest.schema,
-      appKey: body.artifactManifest.appKey,
-      appVersion: body.artifactManifest.appVersion,
-      tier: body.artifactManifest.tier,
-      platform: body.artifactManifest.platform,
-    },
-    { schema: 1, appKey: 'fixture', appVersion: '1.2.3', tier: 'patch', platform: 'windows' },
-  );
-  assert.match(body.artifactManifest.pipelineVersion, /^\d+\.\d+\.\d+$/);
-  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
-    ['installer', 'fixture/installers/windows/current/Fixture-Setup.exe'],
-    ['updater', 'fixture/installers/windows/current/Fixture.exe'],
-  ]);
-  assert.match(body.artifactManifest.artifacts[1].updaterSignature, /^<signature:/);
-});
-
-test("routes feature updates to the Pro-gated release endpoint", () => {
-  const result = run("update");
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/releases/);
-  assert.match(result.stdout, /"tier":"update"/);
-  assert.match(result.stdout, /"platform":"windows"/);
-  assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
-  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 1, "feature update may upload only one updater object per OS");
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
-  const body = registrationBody(result);
-  assert.equal(body.artifactManifest.tier, 'update');
-  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
-    ['updater', 'fixture/updates/windows/current/Fixture.exe'],
-  ]);
-});
-
-test("allows an installer-only patch without registering an updater manifest", () => {
-  const config = installerOnlyFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /UPLOAD public\/fixture\/installers\/windows\/current\/Fixture-Setup\.exe/);
-  assert.match(result.stdout, /NO patch updater artifacts/);
-  assert.doesNotMatch(result.stdout, /\/v1\/admin\/apps\/patches/);
-  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-});
-
-test("refuses to publish without a valid tier", () => {
-  const result = run("");
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /RIGHT_RELEASE_TIER.*patch\|update/);
-});
-
-test("refuses versioned R2 object keys that would accumulate old releases", () => {
-  const config = versionedFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /current R2 object/);
-});
-
-test("refuses versioned updater object keys for gated feature updates", () => {
-  const config = versionedFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "update" },
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /current R2 object/);
-});
-
-test("requires the durable release credential before the first patch upload", () => {
-  const config = fixture({ materialize: true });
-  const env = {
-    ...process.env,
-    APPDATA: path.join(path.dirname(config), "empty-appdata"),
-    RIGHT_RELEASE_TIER: "patch",
-    RIGHTAPPS_RELEASE_TOKEN_FILE: path.join(path.dirname(config), "missing-release-token"),
-    RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session",
-  };
-  delete env.RIGHTAPPS_RELEASE_TOKEN;
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
-    encoding: "utf8",
-    env,
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /RIGHTAPPS_RELEASE_TOKEN/);
-  assert.doesNotMatch(result.stdout, /UPLOAD /, "credential preflight must run before R2 mutation");
-});

package/qa-contract.test.mjs

@@ -1,47 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { validateQaBackdoorContract } from "./qa-contract.mjs";
-
-function fixture({ optional = true, releaseScript = "right-release release --tier patch" } = {}) {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-qa-"));
-  mkdirSync(path.join(root, "src-tauri", "src"), { recursive: true });
-  writeFileSync(path.join(root, "right-qa.config.mjs"), "export default {};\n");
-  writeFileSync(path.join(root, "src-tauri", "Cargo.toml"), `
-[features]
-qa-native = ["dep:tauri-plugin-wdio-webdriver"]
-[dependencies]
-tauri-plugin-wdio-webdriver = { version = "1.2.0", optional = ${optional} }
-`);
-  writeFileSync(path.join(root, "src-tauri", "src", "lib.rs"), `
-#[cfg(all(not(debug_assertions), feature = "qa-native"))]
-compile_error!("qa-native must never be enabled in release builds");
-#[cfg(all(debug_assertions, feature = "qa-native"))]
-fn qa_enabled() -> bool { std::env::var("RIGHTKIT_QA_NATIVE").as_deref() == Ok("1") }
-#[cfg(all(debug_assertions, feature = "qa-native"))]
-fn add_plugin() { tauri_plugin_wdio_webdriver::init(); }
-`);
-  return { root, scripts: { "qa:native": "tauri dev --features qa-native", "release:patch:win": releaseScript } };
-}
-
-test("accepts a debug-only, runtime-gated native QA surface", () => {
-  const value = fixture();
-  assert.deepEqual(validateQaBackdoorContract(value.root, value.scripts), []);
-});
-
-test("rejects a non-optional WebDriver plugin", () => {
-  const value = fixture({ optional: false });
-  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /must be optional/);
-});
-
-test("rejects release scripts that enable native QA", () => {
-  const value = fixture({ releaseScript: "tauri build --features qa-native" });
-  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /release:patch:win/);
-});
-
-test("does not impose native QA on an app before its config lands", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-no-qa-"));
-  assert.deepEqual(validateQaBackdoorContract(root, {}), []);
-});

package/registry-parity.test.mjs

@@ -1,30 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { comparePackedTrees, verifyRegistryParity } from './registry-parity.mjs';
-
-test('registry parity rejects same-version packed-byte drift', () => {
-  assert.deepEqual(comparePackedTrees([['build-release.mjs', 'new']], [['build-release.mjs', 'old']]), {
-    equal: false,
-    differences: ['build-release.mjs'],
-  });
-});
-
-test('registry parity accepts identical packed trees', () => {
-  assert.deepEqual(comparePackedTrees([['a.mjs', 'one'], ['package.json', 'two']], [['a.mjs', 'one'], ['package.json', 'two']]), {
-    equal: true,
-    differences: [],
-  });
-});
-
-test('registry parity distinguishes an unpublished version from registry failure', async () => {
-  const notFound = async () => ({ status: 404, ok: false });
-  assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
-    status: 'UNPUBLISHED',
-    name: '@rightkit/release',
-    version: '0.2.68',
-  });
-  await assert.rejects(
-    verifyRegistryParity({ fetchImpl: notFound }),
-    /registry metadata failed: HTTP 404/,
-  );
-});

package/release-cli-contract.test.mjs

@@ -1,119 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import vm from "node:vm";
-import test from "node:test";
-
-const root = path.dirname(fileURLToPath(import.meta.url));
-const cli = path.join(root, "cli", "right-release.mjs");
-const build = path.join(root, "build-release.mjs");
-const upload = path.join(root, "upload-release.mjs");
-const signWindows = path.join(root, "sign-windows.mjs");
-
-test("CLI routes build and release only to the build state machine", () => {
-  const source = readFileSync(cli, "utf8");
-  assert.match(source, /\["build",\s*"build-release\.mjs"\]/);
-  assert.match(source, /\["release",\s*"build-release\.mjs"\]/);
-});
-
-test("CLI routes upload and legacy publish only to the upload state machine", () => {
-  const source = readFileSync(cli, "utf8");
-  assert.match(source, /\["upload",\s*"upload-release\.mjs"\]/);
-  assert.match(source, /\["publish",\s*"upload-release\.mjs"\]/);
-  assert.doesNotMatch(source, /first === "publish"[\s\S]{0,500}run\("release\.mjs"/);
-});
-
-test("upload dry-run cannot write a verified marker", () => {
-  const source = readFileSync(upload, "utf8");
-  assert.match(source, /if \(!dryRun\)\s+writeJson\(verifiedMarker,/);
-});
-
-test("build is tier-neutral and rejects a tier before touching a repository", () => {
-  const result = spawnSync(process.execPath, [build, "--platform", "win", "--tier", "patch"], {
-    cwd: mkdtempSync(path.join(os.tmpdir(), "right-build-cli-")),
-    encoding: "utf8",
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /build is tier-neutral/i);
-});
-
-test("build enforces primary-checkout and build-input cleanliness guards", () => {
-  const source = readFileSync(build, "utf8");
-  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
-  assert.match(source, /dirtyBuildInputs\(repoRoot,/);
-  assert.match(source, /dirty files can change the packaged app/i);
-});
-
-test("upload enforces the same primary-checkout vault", () => {
-  const source = readFileSync(upload, "utf8");
-  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
-});
-
-test("upload requires an explicit patch or update tier before reading a release", () => {
-  const result = spawnSync(process.execPath, [upload, "--platform", "win", "--release", "fixture-1.0.0-deadbeef"], {
-    cwd: mkdtempSync(path.join(os.tmpdir(), "right-upload-cli-")),
-    encoding: "utf8",
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /tier is required.*patch\|update/i);
-});
-
-test("GitHub upload delegates platform trust verification to the shared release lane", () => {
-  const uploadSource = readFileSync(upload, "utf8");
-  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
-  const signingSource = readFileSync(signWindows, "utf8");
-  assert.match(uploadSource, /publishGitHubRelease/);
-  assert.match(githubSource, /sign-windows\.mjs/);
-  assert.match(githubSource, /--verify-only/);
-  assert.doesNotMatch(uploadSource, /CLOUDFLARE_API_TOKEN|wrangler|R2/i);
-  assert.match(signingSource, /verifyOnly/);
-  assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
-});
-
-test("Windows signer verification accepts CRLF subjects and retains identity checks", () => {
-  const source = readFileSync(signWindows, "utf8");
-  const functionSource = source.slice(source.indexOf("function assertVerification"), source.indexOf("\nfunction fileEvidence"));
-  const assertVerification = vm.runInNewContext(`(${functionSource})`, {
-    fail(message) { throw new Error(message); },
-  });
-  const valid = "Successfully verified\r\n\tIssued to: Damned Ventures LLC  \r\nTimestamp: present\r\n";
-  assert.equal(JSON.stringify(assertVerification("fixture.exe", valid)), JSON.stringify({
-    authenticode: "Valid",
-    subject: "CN=Damned Ventures LLC",
-    timestampPresent: true,
-  }));
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Damned Ventures LLC", "Other Company")),
-    /subject must be Damned Ventures LLC/,
-  );
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Damned Ventures LLC", "damned ventures llc")),
-    /subject must be Damned Ventures LLC/,
-  );
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Timestamp: present", "")),
-    /timestamp is missing/,
-  );
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Successfully verified", "Verification failed")),
-    /did not report Valid/,
-  );
-});
-
-test("upload uses GitHub CLI and never invokes the R2 runner", () => {
-  const source = readFileSync(upload, "utf8");
-  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
-  assert.match(githubSource, /run\("gh", \["release", "upload"/);
-  assert.doesNotMatch(source, /wrangler|CLOUDFLARE_API_TOKEN|RIGHTAPPS_API_URL/i);
-  assert.doesNotMatch(source, /\bnpx\b/);
-});
-
-test("upload accepts only GitHub Releases as configured product distribution", () => {
-  const source = readFileSync(upload, "utf8");
-  assert.match(source, /distribution\.provider/);
-  assert.match(source, /github-releases/);
-  assert.match(source, /releaseConfig\?\.distribution\?\.repository/);
-});

package/release-invocation.test.mjs

@@ -1,22 +0,0 @@
-import assert from "node:assert/strict";
-import path from "node:path";
-import test from "node:test";
-import { resolvePrimaryWorktree } from "./release-invocation.mjs";
-
-test("resolves a submodule primary worktree from core.worktree", () => {
-  assert.equal(resolvePrimaryWorktree({
-    repoRoot: path.resolve("/suite/membrane"),
-    worktrees: "worktree /suite/.git/modules/membrane\nHEAD abc\n",
-    gitDir: "/suite/.git/modules/membrane",
-    coreWorktree: "../../../membrane",
-  }), path.resolve("/suite/membrane"));
-});
-
-test("preserves an ordinary primary worktree", () => {
-  assert.equal(resolvePrimaryWorktree({
-    repoRoot: "/suite/app",
-    worktrees: "worktree /suite/app\nHEAD abc\n",
-    gitDir: "/suite/app/.git",
-    coreWorktree: "",
-  }), "/suite/app");
-});