@rightkit/release 0.2.69 → 0.2.70

package/legal-contract.test.mjs

@@ -1,151 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { assertLegalReleaseContract } from "./legal-contract.mjs";
-
-function digest(text) {
-  return createHash("sha256").update(text).digest("hex");
-}
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-legal-contract-"));
-  const legalDir = path.join(root, "legal");
-  const tauriDir = path.join(root, "src-tauri");
-  mkdirSync(legalDir, { recursive: true });
-  mkdirSync(tauriDir, { recursive: true });
-  const definitions = [
-    ["license", "LICENSE.md", "Ownership notice\n"],
-    ["eula", "EULA.md", "End user license agreement\n"],
-    ["acceptable_use", "ACCEPTABLE_USE.md", "Acceptable use\n"],
-    ["product_schedule", "PRODUCT_SCHEDULE.md", "Product schedule\n"],
-    ["privacy_notice", "PRIVACY.md", "Privacy notice\n"],
-    ["third_party_notices", "THIRD_PARTY_NOTICES.md", "Build provenance: fixture 1.0 windows-x86_64; inputs: pnpm-lock=abc Cargo.lock=def; generated-by=fixture\n"],
-  ];
-  for (const [, file, content] of definitions) writeFileSync(path.join(legalDir, file), content);
-  const manifest = {
-    schema: 2,
-    suite: "right-suite-desktop",
-    appKey: "fixture",
-    productName: "Fixture",
-    licensor: "Damned Ventures LLC",
-    effectiveDate: "2026-07-16",
-    acceptanceVersion: "fixture-2026-07-16-v1",
-    documents: definitions.map(([role, file, content]) => ({
-      id: `fixture-${role}`,
-      role,
-      title: role,
-      version: "1.0",
-      sha256: digest(content),
-      path: file,
-      publicUrl: `https://example.test/legal/${role}`,
-      treatment: ["privacy_notice"].includes(role) ? "acknowledge" : role === "third_party_notices" ? "notice" : "agree",
-      material: !["privacy_notice", "third_party_notices"].includes(role),
-    })),
-  };
-  writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
-  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
-  writeFileSync(
-    path.join(tauriDir, "tauri.conf.json"),
-    `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
-  );
-  return {
-    root,
-    legal: { manifest: "legal/legal-manifest.json", tauriConfig: "src-tauri/tauri.conf.json" },
-    manifest,
-  };
-}
-
-test("accepts a complete, hash-bound legal snapshot", () => {
-  const { root, legal } = fixture();
-  const result = assertLegalReleaseContract(root, legal, "fixture", "win");
-  assert.equal(result.appKey, "fixture");
-  assert.equal(result.documents.length, 6);
-});
-
-test("rejects a missing legal config", () => {
-  const { root } = fixture();
-  assert.throws(() => assertLegalReleaseContract(root, null, "fixture", "win"), /must declare legal\.manifest/i);
-});
-
-test("rejects changed bytes and unsafe manifest paths", () => {
-  const changed = fixture();
-  writeFileSync(path.join(changed.root, "legal", "EULA.md"), "changed without a new manifest\n");
-  assert.throws(() => assertLegalReleaseContract(changed.root, changed.legal, "fixture", "win"), /EULA\.md.*sha-?256/i);
-
-  const traversal = fixture();
-  traversal.manifest.documents[0].path = "../outside.md";
-  writeFileSync(path.join(traversal.root, "legal", "legal-manifest.json"), `${JSON.stringify(traversal.manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(traversal.root, traversal.legal, "fixture", "win"), /path.*snapshot|traversal/i);
-});
-
-test("rejects placeholders and unresolved checklist markers", () => {
-  const { root, legal, manifest } = fixture();
-  const eula = "Terms [COUNSEL: decide later]\n- [ ] fill this in\n";
-  writeFileSync(path.join(root, "legal", "EULA.md"), eula);
-  manifest.documents.find((document) => document.role === "eula").sha256 = digest(eula);
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /placeholder|unchecked|release blocker/i);
-});
-
-test("rejects an explicitly unresolved release blocker even without a checkbox", () => {
-  const { root, legal, manifest } = fixture();
-  const notice = "Build provenance: fixture; inputs: lock=abc; generated-by=fixture\nRELEASE BLOCKER: exact model notice is unresolved.\n";
-  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
-  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /release blocker/i);
-});
-
-test("rejects a Windows installer license page: the in-app gate is the only assent surface", () => {
-  const { root, legal } = fixture();
-  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile must be absent/i);
-});
-
-test("rejects a macOS DMG SLA too — one licenseFile drives both bundlers", () => {
-  // branded-dmg.mjs derives its --eula from bundle.licenseFile, so a Windows-only
-  // check would let a mac release quietly reintroduce the mount-time SLA.
-  const { root, legal } = fixture();
-  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /licenseFile must be absent/i);
-});
-
-test("accepts an app whose installer carries no license page", () => {
-  const { root, legal } = fixture();
-  for (const platform of ["win", "mac"]) {
-    assert.doesNotThrow(() => assertLegalReleaseContract(root, legal, "fixture", platform));
-  }
-});
-
-test("requires third-party build provenance", () => {
-  const { root, legal, manifest } = fixture();
-  const notice = "Third-party software is included.\n";
-  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
-  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /third-party.*provenance/i);
-});
-
-test("manifest hash evidence is the hash of the manifest bytes", () => {
-  const { root, legal } = fixture();
-  const result = assertLegalReleaseContract(root, legal, "fixture", "mac");
-  const bytes = readFileSync(path.join(root, legal.manifest));
-  assert.equal(result.manifestSha256, createHash("sha256").update(bytes).digest("hex"));
-});
-
-test("hash-binds declared third-party appendices and rejects missing files", () => {
-  const { root, legal, manifest } = fixture();
-  const appendix = "full dependency license text\n";
-  writeFileSync(path.join(root, "legal", "RUST_LICENSES.txt"), appendix);
-  manifest.appendices = [{ id: "rust-licenses", title: "Rust licenses", path: "RUST_LICENSES.txt", sha256: digest(appendix) }];
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.equal(assertLegalReleaseContract(root, legal, "fixture", "mac").appendices.length, 1);
-
-  manifest.appendices[0].path = "missing.txt";
-  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
-  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /appendix.*missing/i);
-});

package/mirror-root-artifact.test.mjs

@@ -1,58 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-const helper = fileURLToPath(new URL("./mirror-root-artifact.mjs", import.meta.url));
-
-test("mirrors a nested package artifact from a linked worktree into both package roots", () => {
-  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-"));
-  const main = path.join(temp, "suite");
-  const worktree = path.join(temp, "release-worktree");
-  try {
-    mkdirSync(path.join(main, "apps", "desktop"), { recursive: true });
-    git(temp, "init", "suite");
-    git(main, "config", "user.email", "test@example.com");
-    git(main, "config", "user.name", "Right Release Test");
-    writeFileSync(path.join(main, "tracked"), "fixture\n");
-    git(main, "add", "tracked");
-    git(main, "commit", "-m", "fixture");
-    git(main, "worktree", "add", worktree, "-b", "release-test");
-
-    const packageRoot = path.join(worktree, "apps", "desktop");
-    const source = path.join(packageRoot, "target", "App_1.0.0.dmg");
-    mkdirSync(path.dirname(source), { recursive: true });
-    writeFileSync(source, "signed-dmg-fixture");
-
-    execFileSync(process.execPath, [helper, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
-
-    assert.equal(readFileSync(path.join(packageRoot, "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
-    assert.equal(readFileSync(path.join(main, "apps", "desktop", "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("copies a main-worktree artifact into its package root", () => {
-  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-main-"));
-  try {
-    git(temp, "init", "app");
-    const root = path.join(temp, "app");
-    const source = path.join(root, "target", "App_2.0.0.dmg");
-    mkdirSync(path.dirname(source), { recursive: true });
-    writeFileSync(source, "main-worktree-dmg");
-
-    execFileSync(process.execPath, [helper, "--file", source, "--package-root", root], { encoding: "utf8" });
-
-    assert.equal(readFileSync(path.join(root, "App_2.0.0.dmg"), "utf8"), "main-worktree-dmg");
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-function git(cwd, ...args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-}

package/model-promote.test.mjs

@@ -1,284 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash, generateKeyPairSync, sign } from "node:crypto";
-import { spawnSync } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-import {
-  RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
-  defaultWindowsRuntimeArtifactSigningKeyFile,
-  loadRuntimeArtifactSigningKey,
-  promoteRuntimeArtifact,
-  runtimeArtifactUploadEnv,
-} from "./model-promote.mjs";
-const { privateKey } = generateKeyPairSync("ed25519");
-const artifactDigest = "a".repeat(64);
-const evidenceDigest = "b".repeat(64);
-const packageRoot = path.dirname(fileURLToPath(import.meta.url));
-const candidateCommit = "a".repeat(40);
-
-// Source identity as build/upload/promote read it: the exact commit, plus the
-// porcelain status that must be empty for the promotion to run.
-function verificationFixture(commit = candidateCommit, status = "") {
-  return { candidateCommit: commit, status };
-}
-
-function request(overrides = {}) {
-  return {
-    authority: "heardright",
-    privateKey,
-    keyId: RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
-    artifactFile: "C:/fixtures/parakeet.onnx",
-    evidenceFile: "C:/fixtures/eval.json",
-    config: {
-      artifact: {
-        filename: "parakeet.onnx",
-        sha256: artifactDigest,
-        sizeBytes: 42,
-      },
-      evidence: { sha256: evidenceDigest },
-      manifest: {
-        artifactKind: "asr-model",
-        entitlement: { appKey: "scraperight", tier: "pro" },
-        distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
-        target: { os: "windows", arch: "x86_64" },
-        versions: {
-          runtime: "rightkit-asr-0.1.0",
-          model: "parakeet-tdt-0.6b-v3",
-          tokenizer: "sentencepiece-2026-07-14",
-          preprocessing: "rightkit-asr-0.1.0",
-          license: "cc-by-4.0",
-          provenance: "heardright-approved-2026-07-14",
-        },
-        provenance: {
-          source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
-          sourceRevision: "0123456789abcdef",
-          licenseId: "CC-BY-4.0",
-          noticeSha256: "c".repeat(64),
-        },
-        promotion: {
-          promotionId: "hr-asr-2026-07-14-001",
-          promotedAt: "2026-07-14T12:00:00.000Z",
-        },
-      },
-    },
-    verification: verificationFixture(),
-    ...overrides,
-  };
-}
-
-function boundaries(events) {
-  return {
-    metadata: async (file) => file.endsWith("eval.json")
-      ? { sha256: evidenceDigest, sizeBytes: 10 }
-      : { sha256: artifactDigest, sizeBytes: 42 },
-    upload: async ({ purpose }) => { events.push(`upload:${purpose}`); },
-    register: async () => { events.push("register"); },
-  };
-}
-
-test("uploads immutable object, registers signed envelope, then replaces stable pointer", async () => {
-  const events = [];
-  const result = await promoteRuntimeArtifact(request(), boundaries(events));
-
-  assert.deepEqual(events, ["upload:object", "register", "upload:pointer"]);
-  assert.equal(result.envelope.signature.keyId, RUNTIME_ARTIFACT_TRUSTED_KEY_ID);
-  assert.equal(result.envelope.manifest.object.sha256, artifactDigest);
-  assert.equal(result.envelope.manifest.promotion.evidenceSha256, evidenceDigest);
-  assert.match(result.envelope.manifest.pointerKey, /\/current\/manifest\.json$/);
-});
-
-test("dry-run validates and signs without invoking process or network boundaries", async () => {
-  const events = [];
-  const result = await promoteRuntimeArtifact(request({ dryRun: true }), boundaries(events));
-  assert.deepEqual(events, []);
-  assert.deepEqual(result.steps, ["upload immutable object", "register signed envelope", "replace stable pointer"]);
-  assert.equal(result.envelope.signature.algorithm, "Ed25519");
-});
-
-test("model promotion refuses a dirty working tree", async () => {
-  const events = [];
-  const verification = verificationFixture(candidateCommit, " M packages/release/model-promote.mjs\0");
-  await assert.rejects(
-    promoteRuntimeArtifact(request({ verification, dryRun: true }), boundaries(events)),
-    /clean working tree/,
-  );
-  assert.deepEqual(events, []);
-});
-
-test("model promotion requires source identity", async () => {
-  const events = [];
-  await assert.rejects(
-    promoteRuntimeArtifact(request({ verification: undefined, dryRun: true }), boundaries(events)),
-    /source identity is required/,
-  );
-  assert.deepEqual(events, []);
-});
-
-test("never registers or publishes a pointer after immutable upload failure", async () => {
-  const events = [];
-  const deps = boundaries(events);
-  deps.upload = async ({ purpose }) => {
-    events.push(`upload:${purpose}`);
-    throw new Error("R2 failed");
-  };
-  await assert.rejects(promoteRuntimeArtifact(request(), deps), /R2 failed/);
-  assert.deepEqual(events, ["upload:object"]);
-});
-
-test("never publishes a pointer when RightApps registration fails", async () => {
-  const events = [];
-  const deps = boundaries(events);
-  deps.register = async () => {
-    events.push("register");
-    throw new Error("registration failed");
-  };
-  await assert.rejects(promoteRuntimeArtifact(request(), deps), /registration failed/);
-  assert.deepEqual(events, ["upload:object", "register"]);
-});
-
-test("fails before mutation on digest, authority, key-id, or lane contradiction", async () => {
-  const badRequests = [
-    request({ authority: "scraperight" }),
-    request({ keyId: "untrusted-key" }),
-    request({ config: { ...request().config, artifact: { ...request().config.artifact, sha256: "d".repeat(64) } } }),
-    request({ config: {
-      ...request().config,
-      manifest: {
-        ...request().config.manifest,
-        entitlement: { appKey: "scraperight", tier: "public" },
-        distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
-      },
-    } }),
-    request({ config: {
-      ...request().config,
-      manifest: {
-        ...request().config.manifest,
-        promotion: {
-          ...request().config.manifest.promotion,
-          authorityAppKey: "scraperight",
-        },
-      },
-    } }),
-  ];
-  for (const input of badRequests) {
-    const events = [];
-    await assert.rejects(promoteRuntimeArtifact(input, boundaries(events)));
-    assert.deepEqual(events, []);
-  }
-});
-
-test("right-release routes model promote to the portable promotion lane", () => {
-  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--authority", "heardright"], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  assert.equal(result.status, 1);
-  assert.match(result.stderr, /model promote requires --config/);
-  assert.doesNotMatch(result.stderr, /unknown command/);
-});
-
-test("model promote help documents the portable config and secure key inputs", () => {
-  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--help"], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /artifact\.file/);
-  assert.match(result.stdout, /evidence\.sha256/);
-  assert.match(result.stdout, /RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE/);
-  assert.match(result.stdout, /RIGHTAPPS_RELEASE_TOKEN/);
-});
-
-test("portable CLI promotes from a clean checkout, refuses a dirty one, and rejects injected trust flags", async () => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "rightkit-model-promote-test-"));
-  try {
-    const artifact = Buffer.from("tiny model fixture");
-    const evidence = Buffer.from('{"certified":true}');
-    const testKeys = generateKeyPairSync("ed25519");
-    const keyPem = testKeys.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
-    await Promise.all([
-      writeFile(path.join(root, "model.onnx"), artifact),
-      writeFile(path.join(root, "evidence.json"), evidence),
-      writeFile(path.join(root, "key.pem"), keyPem, { mode: 0o600 }),
-    ]);
-    spawnSync("git", ["init"], { cwd: root, encoding: "utf8" });
-    spawnSync("git", ["add", "."], { cwd: root, encoding: "utf8" });
-    const committed = spawnSync("git", ["-c", "user.name=fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "fixture"], { cwd: root, encoding: "utf8" });
-    assert.equal(committed.status, 0, committed.stderr);
-    const config = {
-      artifact: {
-        file: "model.onnx",
-        filename: "model.onnx",
-        sha256: createHash("sha256").update(artifact).digest("hex"),
-        sizeBytes: artifact.length,
-      },
-      evidence: {
-        file: "evidence.json",
-        sha256: createHash("sha256").update(evidence).digest("hex"),
-      },
-      manifest: request().config.manifest,
-    };
-    await writeFile(path.join(root, "promotion.json"), JSON.stringify(config));
-    spawnSync("git", ["add", "."], { cwd: root, encoding: "utf8" });
-    spawnSync("git", ["-c", "user.name=fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "config"], { cwd: root, encoding: "utf8" });
-
-    const promoteArgs = [
-      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
-      "--authority", "heardright",
-      "--config", path.join(root, "promotion.json"),
-      "--signing-key-file", path.join(root, "key.pem"),
-      "--dry-run",
-    ];
-    const result = spawnSync(process.execPath, promoteArgs, { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(result.status, 0, result.stderr);
-
-    await writeFile(path.join(root, "untracked.txt"), "dirty");
-    const dirty = spawnSync(process.execPath, promoteArgs, { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(dirty.status, 1);
-    assert.match(dirty.stderr, /clean working tree/);
-
-    const attacker = spawnSync(process.execPath, [
-      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
-      "--authority", "heardright", "--config", path.join(root, "promotion.json"),
-      "--verification-public-key", path.join(root, "verification-public.pem"),
-    ], { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(attacker.status, 1);
-    assert.match(attacker.stderr, /unknown model promote argument: --verification-public-key/);
-    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /BEGIN PRIVATE KEY/);
-    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /Uploading|POST https:/);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test("uses the canonical Windows signing-key path and supports a Keychain-fed PEM environment value", async () => {
-  assert.equal(
-    defaultWindowsRuntimeArtifactSigningKeyFile({ APPDATA: "C:/Users/test/AppData/Roaming" }),
-    path.join("C:/Users/test/AppData/Roaming", "RightKit", "runtime-artifact-signing-key.pem"),
-  );
-  assert.equal(
-    await loadRuntimeArtifactSigningKey({ env: { RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "line1\\nline2" }, platform: "darwin" }),
-    "line1\nline2",
-  );
-});
-
-test("does not forward signing or RightApps credentials into the Wrangler uploader process", () => {
-  const env = runtimeArtifactUploadEnv({
-    CLOUDFLARE_API_TOKEN: "cloudflare-token",
-    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "private-pem",
-    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE: "key.pem",
-    RIGHTAPPS_RELEASE_TOKEN: "release-token",
-    RIGHTAPPS_RELEASE_TOKEN_FILE: "release.token",
-  });
-  assert.equal(env.CLOUDFLARE_API_TOKEN, "cloudflare-token");
-  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY, undefined);
-  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE, undefined);
-  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN, undefined);
-  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN_FILE, undefined);
-});

package/notary-auth.test.mjs

@@ -1,31 +0,0 @@
-import assert from "node:assert/strict";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { notarytoolAuthArgs } from "./notary-auth.mjs";
-
-test("prefers a complete App Store Connect API credential set", () => {
-  const before = { ...process.env };
-  try {
-    process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
-    process.env.APPLE_API_KEY = "KEY123";
-    process.env.APPLE_API_ISSUER = "ISSUER123";
-    assert.deepEqual(notarytoolAuthArgs(), ["--key", path.join(os.homedir(), "AuthKey.p8"), "--key-id", "KEY123", "--issuer", "ISSUER123"]);
-  } finally {
-    process.env = before;
-  }
-});
-
-test("falls back to the device keychain profile and rejects partial API auth", () => {
-  const before = { ...process.env };
-  try {
-    delete process.env.APPLE_API_KEY_PATH;
-    delete process.env.APPLE_API_KEY;
-    delete process.env.APPLE_API_ISSUER;
-    assert.deepEqual(notarytoolAuthArgs(), ["--keychain-profile", "apple-dev-notary"]);
-    process.env.APPLE_API_KEY = "KEY123";
-    assert.throws(() => notarytoolAuthArgs(), /requires APPLE_API_KEY_PATH.*APPLE_API_ISSUER/);
-  } finally {
-    process.env = before;
-  }
-});

package/nsis-payload.test.mjs

@@ -1,139 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import test, { after } from "node:test";
-import { listNsisPayload, parseSevenZipListing, resolveSevenZip, verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
-
-const workspace = mkdtempSync(path.join(tmpdir(), "rightkit-nsis-"));
-after(() => rmSync(workspace, { recursive: true, force: true }));
-
-// 7-Zip's technical listing: an archive record, a rule, then one record per member.
-// The blank `Attributes` and absent timestamps are what the column-aligned listing
-// gets wrong, so they are reproduced here deliberately.
-const LISTING = [
-  "Path = D:\\out\\App_1.2.3_x64-setup.exe",
-  "Type = Nsis",
-  "",
-  "----------",
-  "Path = $PLUGINSDIR\\System.dll",
-  "Size = 12288",
-  "Attributes = ",
-  "",
-  "Path = app with spaces.exe",
-  "Size = 13750736",
-  "Attributes = ",
-  "",
-  "Path = legal",
-  "Size = 0",
-  "Folder = +",
-  "Attributes = D",
-  "",
-  "Path = legal\\EULA.md",
-  "Size = 16723",
-  "Attributes = A",
-  "",
-].join("\n");
-
-test("parses 7-Zip technical listings, including blank dates and spaced names", () => {
-  const entries = parseSevenZipListing(LISTING);
-  assert.deepEqual(entries.map((entry) => entry.name), [
-    "$PLUGINSDIR/System.dll",
-    "app with spaces.exe",
-    "legal/EULA.md",
-  ]);
-  assert.equal(entries[1].sizeBytes, 13_750_736);
-});
-
-test("ignores the archive's own record above the rule", () => {
-  const entries = parseSevenZipListing(LISTING);
-  assert.equal(entries.some((entry) => entry.name.endsWith("setup.exe")), false);
-});
-
-test("listNsisPayload surfaces the 7-Zip failure instead of reporting an empty payload", () => {
-  assert.throws(
-    () => listNsisPayload("installer.exe", {
-      sevenZip: "7z",
-      run: () => ({ status: 2, stdout: "", stderr: "Cannot open the file as archive" }),
-    }),
-    /could not read the NSIS payload.*Cannot open the file as archive/s,
-  );
-});
-
-test("verifyNsisEmbeddedBinary accepts a payload whose bytes match the signed EXE", () => {
-  const installer = path.join(workspace, "setup.exe");
-  writeFileSync(installer, "installer-container");
-  const payload = Buffer.from("signed-executable-bytes");
-  const sha256 = createHash("sha256").update(payload).digest("hex");
-
-  const receipt = verifyNsisEmbeddedBinary({
-    installer,
-    entryName: "app.exe",
-    expectedSha256: sha256,
-    sevenZip: "7z",
-    run: (_command, args) => {
-      const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
-      writeFileSync(path.join(destination, "app.exe"), payload);
-      return { status: 0, stdout: "Everything is Ok", stderr: "" };
-    },
-  });
-
-  assert.equal(receipt.sha256, sha256);
-  assert.equal(receipt.entry, "app.exe");
-  assert.equal(receipt.sizeBytes, payload.length);
-  assert.equal(receipt.installerSha256, createHash("sha256").update(readFileSync(installer)).digest("hex"));
-});
-
-test("verifyNsisEmbeddedBinary rejects a payload that drifted from the signed EXE", () => {
-  const installer = path.join(workspace, "setup-drifted.exe");
-  writeFileSync(installer, "installer-container");
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({
-      installer,
-      entryName: "app.exe",
-      expectedSha256: createHash("sha256").update("signed-executable-bytes").digest("hex"),
-      sevenZip: "7z",
-      run: (_command, args) => {
-        const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
-        writeFileSync(path.join(destination, "app.exe"), "rewritten-after-signing");
-        return { status: 0, stdout: "Everything is Ok", stderr: "" };
-      },
-    }),
-    /does not embed the signed app\.exe.*Authenticode signature is invalid/s,
-  );
-});
-
-test("verifyNsisEmbeddedBinary fails when the entry is absent rather than passing vacuously", () => {
-  const installer = path.join(workspace, "setup-missing.exe");
-  writeFileSync(installer, "installer-container");
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({
-      installer,
-      entryName: "app.exe",
-      expectedSha256: "a".repeat(64),
-      sevenZip: "7z",
-      run: () => ({ status: 2, stdout: "", stderr: "No files to process" }),
-    }),
-    /could not extract app\.exe/,
-  );
-});
-
-test("verifyNsisEmbeddedBinary refuses a caller that has no digest to compare against", () => {
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({ installer: "setup.exe", entryName: "app.exe", expectedSha256: undefined, sevenZip: "7z", run: () => ({ status: 0 }) }),
-    /expected a sha256 digest/,
-  );
-});
-
-test("resolveSevenZip names the fix when 7-Zip is absent", () => {
-  assert.throws(
-    () => resolveSevenZip({ env: {}, exists: () => false, which: () => null }),
-    /install 7-Zip.*RIGHT_RELEASE_SEVENZIP/s,
-  );
-});
-
-test("resolveSevenZip honours an explicit override and rejects a bad one", () => {
-  assert.equal(resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\tools\\7z.exe" }, exists: () => true }), "C:\\tools\\7z.exe");
-  assert.throws(() => resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\gone\\7z.exe" }, exists: () => false }), /does not exist/);
-});