@rightkit/release 0.2.69 → 0.2.70

package/nsis-upgrade-contract.test.mjs

@@ -1,57 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
-
-function fixture(template) {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-nsis-upgrade-"));
-  const tauriDir = path.join(root, "src-tauri");
-  const windowsDir = path.join(tauriDir, "windows");
-  mkdirSync(windowsDir, { recursive: true });
-  writeFileSync(
-    path.join(tauriDir, "tauri.conf.json"),
-    `${JSON.stringify({ bundle: { windows: { nsis: { template: "windows/installer.nsi" } } } })}\n`,
-  );
-  writeFileSync(path.join(windowsDir, "installer.nsi"), template);
-  return root;
-}
-
-test("rejects an NSIS template that exposes uninstall-or-reinstall maintenance choices", () => {
-  const root = fixture(`
-    Page custom PageReinstall PageLeaveReinstall
-    Function PageReinstall
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  assert.throws(
-    () => assertNsisInPlaceUpgradeContract(root),
-    /automatic in-place upgrade|maintenance choice/i,
-  );
-});
-
-test("accepts a template that skips maintenance UI for same-version repair and upgrades", () => {
-  const root = fixture(`
-    !define RIGHTKIT_AUTOMATIC_IN_PLACE_UPGRADE
-    Function PageReinstall
-      $\{If\} $WixMode = 0
-      $\{AndIf\} $R0 >= 0
-        Abort
-      $\{EndIf\}
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  const result = assertNsisInPlaceUpgradeContract(root);
-  assert.match(result.templatePath, /installer\.nsi$/);
-});
-
-test("rejects a marker without executable skip-page logic", () => {
-  const root = fixture(`
-    !define RIGHTKIT_AUTOMATIC_IN_PLACE_UPGRADE
-    Function PageReinstall
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  assert.throws(() => assertNsisInPlaceUpgradeContract(root), /skip.*logic/i);
-});

package/pipeline-normalization-contract.test.mjs

@@ -1,140 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import path from "node:path";
-import test from "node:test";
-
-const workspace = path.resolve(
-  process.env.RIGHT_SUITE_CONTRACT_WORKSPACE
-    ?? new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"),
-);
-
-const packageRoots = [
-  "coderight/apps/coderight-tauri",
-  "cutright/apps/studio",
-  "genright",
-  "heardright/tauri-app-next",
-  "mailright",
-  "membrane/apps/membrane-hub",
-  "scraperight",
-  "viewright",
-  "voiceright",
-];
-
-const releaseConfigRoots = [
-  ...packageRoots,
-  "tools/screenright",
-];
-
-const rightGitRepos = ["cutright", "legion", "membrane"];
-const privateRepos = ["rightsites", "sellright", "workright"];
-
-function executableSource(source) {
-  return source
-    .replace(/\/\*[\s\S]*?\*\//g, "")
-    .split("\n")
-    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
-    .join("\n");
-}
-
-function pipelineScripts(root) {
-  const repo = execFileSync("git", ["-C", root, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true }).trim();
-  const prefix = path.relative(repo, root).replaceAll(path.sep, "/");
-  const tracked = execFileSync("git", ["-C", repo, "ls-files", "-z"], { encoding: "utf8", windowsHide: true })
-    .split("\0")
-    .filter(Boolean);
-  return tracked
-    .filter((entry) => {
-      const local = prefix ? entry.slice(prefix.length + 1) : entry;
-      if (prefix && !entry.startsWith(`${prefix}/`)) return false;
-      return (
-        local.startsWith("scripts/")
-        || local === "package.ps1"
-        || local === "package.sh"
-      ) && /\.(?:mjs|cjs|js|ts|ps1|sh|py)$/i.test(local)
-        && !/(?:^|[.-])test(?:[.-]|$)/i.test(path.basename(local));
-    })
-    .map((entry) => path.join(repo, entry))
-    .filter((entry) => existsSync(entry));
-}
-
-test("product package pipelines use installed RightKit commands", () => {
-  const violations = [];
-  for (const root of packageRoots) {
-    const manifestPath = path.join(workspace, root, "package.json");
-    if (!existsSync(manifestPath)) continue;
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-    for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
-      if (!/^(?:build|package|publish|release|deps|verify:rust|test:rust|lint:rust)/.test(name)) continue;
-      if (/(?:\.\.\/[\w./-]*)?tools\/right-release|tools\\right-release/i.test(command)) violations.push(`${root} ${name}: retired workspace-local right-release source`);
-      if (/(?:^|&&|\|\||;)\s*cargo\s+/i.test(command)) violations.push(`${root} ${name}: bare cargo`);
-      if (/(?:^|&&|\|\||;)\s*npx\s+/i.test(command)) violations.push(`${root} ${name}: npx`);
-      if (/(?:^|&&|\|\||;)\s*npm\s+(?:ci|install)\b/i.test(command)) violations.push(`${root} ${name}: npm install`);
-    }
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("release configs resolve Cargo output through RightKit", () => {
-  const violations = [];
-  for (const root of releaseConfigRoots) {
-    const configPath = path.join(workspace, root, "right-release.config.mjs");
-    if (!existsSync(configPath)) continue;
-    const source = executableSource(readFileSync(configPath, "utf8"));
-    const hardcodedTargetRoot = /(?:const|let|var)\s+\w+\s*=\s*["'`]src-tauri[\\/]target/i.test(source);
-    const hardcodedTargetArtifact = /(?:file|signature)\s*:\s*["'`]src-tauri[\\/]target/i.test(source);
-    if (!hardcodedTargetRoot && !hardcodedTargetArtifact) continue;
-    if (!/@rightkit\/release\/cargo-target\.mjs|\.\/scripts\/lib\/target-root\.mjs/.test(source)) violations.push(`${root}: no RightKit target resolver`);
-    if (!/resolve(?:TargetRoot|WindowsReleaseDir)\s*\(/.test(source)) violations.push(`${root}: resolver not invoked`);
-    if (hardcodedTargetRoot) violations.push(`${root}: hardcoded target root`);
-    if (hardcodedTargetArtifact) violations.push(`${root}: hardcoded target artifact`);
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("product pipeline children use managed Rust commands", () => {
-  const violations = [];
-  for (const root of packageRoots) {
-    for (const file of pipelineScripts(path.join(workspace, root))) {
-      const source = executableSource(readFileSync(file, "utf8"));
-      const label = path.relative(workspace, file);
-      if (/(?:spawnSync|spawn|execFileSync|execFile)\s*\(\s*["'`](?:cargo|rustc|rustdoc)["'`]/.test(source)) violations.push(`${label}: unmanaged JS child`);
-      if (/subprocess\.(?:run|Popen)\s*\(\s*\[\s*["'](?:cargo|rustc|rustdoc)["']/.test(source)) violations.push(`${label}: unmanaged Python child`);
-      if (/(?:^|\n)\s*(?:&\s*)?(?:cargo|rustc|rustdoc)\s+(?:build|check|clippy|metadata|test|-vV)\b/m.test(source)) violations.push(`${label}: unmanaged shell command`);
-    }
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("hosted workflows are generated by right-git", () => {
-  const violations = [];
-  for (const root of rightGitRepos) {
-    const workflowRoot = path.join(workspace, root, ".github", "workflows");
-    if (!existsSync(workflowRoot)) continue;
-    for (const entry of readdirSync(workflowRoot, { withFileTypes: true })) {
-      if (!entry.isFile() || !/\.ya?ml$/i.test(entry.name)) continue;
-      const source = readFileSync(path.join(workflowRoot, entry.name), "utf8");
-      if (!/^# Managed by right-git\b/.test(source)) violations.push(`${root}/.github/workflows/${entry.name}: not right-git managed`);
-    }
-  }
-  for (const root of privateRepos) {
-    const workflowRoot = path.join(workspace, root, ".github", "workflows");
-    const workflows = existsSync(workflowRoot)
-      ? readdirSync(workflowRoot).filter((entry) => /\.ya?ml$/i.test(entry))
-      : [];
-    if (workflows.length) violations.push(`${root}: private repo has ${workflows.join(", ")}`);
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("workspace memory pipelines route Rust through RightKit", () => {
-  for (const relative of [
-    "tools/pipelines/memory/dispatch/gate.py",
-    "tools/pipelines/memory/install-cortex.py",
-    "tools/pipelines/memory/verify-source-owner.py",
-  ]) {
-    const source = executableSource(readFileSync(path.join(workspace, relative), "utf8"));
-    assert.doesNotMatch(source, /(?:^|&&|\|\||;)\s*cargo\s+(?:metadata|build|check|clippy|test)\b/m, `${relative} invokes bare Cargo shell command`);
-    assert.doesNotMatch(source, /subprocess\.run\(\s*\[\s*["']cargo["']/m, `${relative} invokes bare Cargo subprocess`);
-  }
-});

package/preflight.test.mjs

@@ -1,123 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import path from "node:path";
-
-import {
-  buildPathPrefix,
-  collectPreflight,
-  findWindowsSdkTool,
-  formatPreflight,
-  graphVendorsOpenssl,
-  nextFreeVersion,
-  preflightFailures,
-  resolveWindowsPerl,
-  PREFLIGHT_FAIL,
-} from "./preflight.mjs";
-
-test("windows SDK lookup orders versions numerically, not as strings", () => {
-  const root = "C:\\Kits";
-  const present = new Set([
-    root,
-    path.join(root, "10.0.9.0", "x64", "makeappx.exe"),
-    path.join(root, "10.0.26100.0", "x64", "makeappx.exe"),
-  ]);
-  const found = findWindowsSdkTool("makeappx.exe", {
-    sdkRoot: root,
-    readdir: () => ["10.0.9.0", "10.0.26100.0"],
-    exists: (candidate) => present.has(candidate),
-  });
-  // String sort would pick 10.0.9.0 — that is the bug this guards.
-  assert.equal(found.version, "10.0.26100.0");
-});
-
-test("windows SDK lookup returns null when the tool is absent from every SDK", () => {
-  const found = findWindowsSdkTool("makeappx.exe", {
-    sdkRoot: "C:\\Kits",
-    readdir: () => ["10.0.26100.0"],
-    exists: (candidate) => candidate === "C:\\Kits",
-  });
-  assert.equal(found, null);
-});
-
-test("explicit OPENSSL_SRC_PERL wins over the default Strawberry location", () => {
-  const resolved = resolveWindowsPerl({
-    env: { OPENSSL_SRC_PERL: "D:\\perl\\bin\\perl.exe" },
-    exists: () => true,
-  });
-  assert.equal(resolved.perlPath, "D:\\perl\\bin\\perl.exe");
-  assert.equal(resolved.dir, "D:\\perl\\bin");
-});
-
-test("perl resolution reports nothing when no windows perl exists", () => {
-  assert.equal(resolveWindowsPerl({ env: {}, exists: () => false }), null);
-});
-
-test("vendored openssl is detected from the cargo lock", () => {
-  assert.equal(
-    graphVendorsOpenssl("Cargo.lock", { exists: () => true, read: () => 'name = "openssl-src"\n' }),
-    true,
-  );
-  assert.equal(
-    graphVendorsOpenssl("Cargo.lock", { exists: () => true, read: () => 'name = "rustls"\n' }),
-    false,
-  );
-  assert.equal(graphVendorsOpenssl("missing.lock", { exists: () => false }), false);
-});
-
-test("a sealed version collision suggests the next free patch, skipping taken ones", () => {
-  const result = nextFreeVersion("/sealed", "heardright", "0.1.33", {
-    exists: () => true,
-    readdir: () => [
-      "heardright-0.1.33-6f2f5e64",
-      "heardright-0.1.34-839ad700",
-      "heardright-0.1.36-f7035acc",
-      "viewright-0.1.35-aaaaaaaa",
-    ],
-  });
-  assert.equal(result.collision, true);
-  // 0.1.34 is taken, 0.1.35 is free — and viewright's record must not be counted.
-  assert.equal(result.suggestion, "0.1.35");
-});
-
-test("an unsealed version is reported as free", () => {
-  const result = nextFreeVersion("/sealed", "heardright", "0.1.37", {
-    exists: () => true,
-    readdir: () => ["heardright-0.1.33-6f2f5e64"],
-  });
-  assert.equal(result.collision, false);
-  assert.equal(result.suggestion, "0.1.37");
-});
-
-test("a sealed version collision is a hard failure carrying a concrete fix", () => {
-  const checks = collectPreflight({
-    platform: "linux",
-    repoRoot: process.cwd(),
-    app: "nothing-is-sealed-here",
-    version: "9.9.9",
-  });
-  // No sealed dir for this app, so the version check must pass rather than throw.
-  const version = checks.find((check) => check.name === "version");
-  assert.equal(version.status, "ok");
-});
-
-test("formatting surfaces the fix line only for non-ok checks", () => {
-  const text = formatPreflight([
-    { name: "a", status: "ok", detail: "fine", fix: "unused" },
-    { name: "b", status: PREFLIGHT_FAIL, detail: "broken", fix: "do the thing" },
-  ]);
-  assert.match(text, /\[ok {2}\] a: fine/);
-  assert.doesNotMatch(text, /fix: unused/);
-  assert.match(text, /fix: do the thing/);
-});
-
-test("failures are filtered from warnings so warnings never block a build", () => {
-  const failures = preflightFailures([
-    { name: "a", status: "warn", detail: "" },
-    { name: "b", status: PREFLIGHT_FAIL, detail: "" },
-  ]);
-  assert.deepEqual(failures.map((check) => check.name), ["b"]);
-});
-
-test("build PATH prefix is windows-only", () => {
-  assert.equal(buildPathPrefix({ platform: "mac" }), null);
-});

package/progress-control.test.mjs

@@ -1,56 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import { cancelAndReapManagedRequest, firstManagedRequestId, latestManagedRequestId, releaseProgressLimits, terminalResultFromOutput } from "./progress-control.mjs";
-
-test("release progress stays bounded without killing a healthy long native build at 90 minutes", () => {
-  assert.deepEqual(releaseProgressLimits({}), { inactivityMs: 600_000, absoluteMs: 14_400_000 });
-  assert.deepEqual(releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "5000" }), { inactivityMs: 1_000, absoluteMs: 5_000 });
-  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "1000" }), /must exceed/);
-  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
-});
-
-test("declared inner liveness owner always exits before the outer watchdog", () => {
-  const ownerTimeoutMs = 45 * 60 * 1000;
-  assert.deepEqual(
-    releaseProgressLimits({}, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    { inactivityMs: 50 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
-  );
-  assert.deepEqual(
-    releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: String(60 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    { inactivityMs: 60 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
-  );
-  assert.throws(
-    () => releaseProgressLimits({ RIGHT_RELEASE_ABSOLUTE_MS: String(49 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    /must exceed effective release inactivity limit/,
-  );
-  assert.throws(() => releaseProgressLimits({}, { livenessOwnerTimeoutMs: 0 }), /positive finite/);
-});
-
-test("latest managed request id follows streamed root Cargo requests", () => {
-  const first = "11111111-1111-4111-8111-111111111111";
-  const second = "22222222-2222-4222-8222-222222222222";
-  assert.equal(latestManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), second);
-  assert.equal(firstManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), first);
-  assert.equal(latestManagedRequestId("ordinary output", first), first);
-});
-
-test("managed cancellation issues CANCEL, waits for terminal RESULT, & returns reap receipt", async () => {
-  const id = "33333333-3333-4333-8333-333333333333";
-  const calls = [];
-  const run = async (args) => {
-    calls.push(args);
-    if (args[0] === "cancel") return { code: 0, output: JSON.stringify({ type: "CANCEL_REQUESTED", id }) };
-    return { code: 130, output: `compiler tail\n${JSON.stringify({ type: "RESULT", id, status: "CANCELLED", exitCode: 130, receipt: { reap: { reaped: true } } })}\n` };
-  };
-  assert.deepEqual(await cancelAndReapManagedRequest(id, { run }), {
-    status: "CANCELLED", id, exitCode: 130, receipt: { reap: { reaped: true } }, cancelExitCode: 0, attachExitCode: 130,
-  });
-  assert.deepEqual(calls, [["cancel", id], ["attach", id]]);
-});
-
-test("missing terminal broker result fails closed", async () => {
-  const run = async () => ({ code: 125, output: "broker closed", timedOut: false });
-  await assert.rejects(cancelAndReapManagedRequest("44444444-4444-4444-8444-444444444444", { run }), /lacked terminal RESULT/);
-  assert.equal(terminalResultFromOutput("noise\n"), null);
-});

package/prune-r2.test.mjs

@@ -1,12 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { isReleaseObject } from "./prune-r2.mjs";
-
-test("pruning only targets release objects for the active OS", () => {
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/mac/ViewRight.dmg"), true);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/updates/mac/current/ViewRight.app.tar.gz"), true);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/windows/ViewRight-Setup.exe"), false);
-  assert.equal(isReleaseObject("viewright", "windows", "viewright/installers/mac/ViewRight.dmg"), false);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/models/mac/model.bin"), false);
-  assert.equal(isReleaseObject("viewright", "mac", "other/installers/mac/Other.dmg"), false);
-});

package/publish-cargo.test.mjs

@@ -1,43 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import {
-  buildCargoPublishPlan,
-  packageFileViolations,
-  parseCargoPublishArgs,
-} from "./publish-cargo.mjs";
-
-test("cargo publish requires a safe explicit crate name", () => {
-  assert.throws(() => parseCargoPublishArgs([]), /--crate/);
-  assert.throws(() => parseCargoPublishArgs(["--crate", "../secret"]), /invalid crate/);
-  assert.throws(() => parseCargoPublishArgs(["--crate", "rightkit-license", "--allow-dirty"]), /only valid with --dry-run/);
-  assert.equal(parseCargoPublishArgs(["--crate", "rightkit-license"]).crate, "rightkit-license");
-});
-
-test("cargo publish plan always runs local safety gates before upload", () => {
-  const plan = buildCargoPublishPlan({ crate: "rightkit-license", crateDir: "C:/rightkit/crates/rightkit-license", dryRun: false });
-  assert.deepEqual(plan.map((step) => step.label), [
-    "secret scan",
-    "format",
-    "tests",
-    "clippy",
-    "package contents",
-    "registry dry-run",
-    "registry publish",
-  ]);
-  assert.deepEqual(plan.at(-1)?.args, ["publish", "-p", "rightkit-license"]);
-});
-
-test("dry-run plan never contains a real registry upload", () => {
-  const plan = buildCargoPublishPlan({ crate: "rightkit-logs", crateDir: "C:/rightkit/crates/rightkit-logs", dryRun: true });
-  assert.equal(plan.at(-1)?.label, "registry dry-run");
-});
-
-test("package inspection rejects secret and build-output paths", () => {
-  assert.deepEqual(packageFileViolations([
-    "Cargo.toml",
-    "src/lib.rs",
-    ".env",
-    "keys/signing.p8",
-    "target/release/app",
-  ]), [".env", "keys/signing.p8", "target/release/app"]);
-});

package/publish-swift.test.mjs

@@ -1,44 +0,0 @@
-import assert from "node:assert/strict";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-import { parseSwiftPublishArgs, buildSwiftPublishPlan, readPackageIdentity } from "./publish-swift.mjs";
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const packageDir = path.resolve(here, "../../swift/RightKitSwift");
-
-test("dry-run needs no url; publish requires one", () => {
-  assert.deepEqual(parseSwiftPublishArgs(["--dry-run"], {}), {
-    scope: "rightsuite", url: "", dryRun: true, allowDirty: false,
-  });
-  assert.throws(() => parseSwiftPublishArgs([], {}), /needs --url/);
-  assert.equal(parseSwiftPublishArgs(["--url", "https://reg.local"], {}).url, "https://reg.local");
-});
-
-test("env supplies scope and url; --allow-dirty is dry-run only", () => {
-  const parsed = parseSwiftPublishArgs([], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e", RIGHTKIT_SWIFT_REGISTRY_SCOPE: "acme" });
-  assert.deepEqual(parsed, { scope: "acme", url: "https://e", dryRun: false, allowDirty: false });
-  assert.throws(() => parseSwiftPublishArgs(["--allow-dirty"], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e" }), /only valid with --dry-run/);
-  assert.throws(() => parseSwiftPublishArgs(["--bogus"], {}), /unexpected argument/);
-});
-
-test("reads the real package identity from VERSION + Package.swift", () => {
-  const { name, version } = readPackageIdentity(packageDir);
-  assert.equal(name, "RightKitSwift");
-  assert.match(version, /^\d+\.\d+\.\d+/);
-});
-
-test("dry-run plan stops before publish; real plan ends with publish", () => {
-  const base = { packageDir, scope: "rightsuite", name: "RightKitSwift", version: "0.1.0", url: "https://reg.local" };
-  const dry = buildSwiftPublishPlan({ ...base, dryRun: true });
-  assert.equal(dry[0].internal, "secret-scan");
-  assert.ok(dry.some((s) => s.label === "tests" && s.command === "swift"));
-  assert.ok(!dry.some((s) => s.label === "registry publish"), "dry-run must not publish");
-
-  const real = buildSwiftPublishPlan({ ...base, dryRun: false });
-  const publish = real.at(-1);
-  assert.equal(publish.label, "registry publish");
-  assert.deepEqual(publish.args, [
-    "package-registry", "publish", "rightsuite.RightKitSwift", "0.1.0", "--url", "https://reg.local", "--package-path", packageDir,
-  ]);
-});