@rightkit/release 0.2.69 → 0.2.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.69",
+  "version": "0.2.71",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -12,16 +12,11 @@
     "*.mjs",
     "*.json",
     "*.sh",
-    "*.py"
+    "*.py",
+    "!*.test.mjs",
+    "!standalone-clone-evidence.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "prepublishOnly": "pnpm test && pnpm test:registry-parity",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -31,5 +26,10 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "packageManager": "pnpm@11.24.0"
-}
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  }
+}

package/preflight.mjs

@@ -170,6 +170,8 @@ export function collectPreflight({
   version,
   configPath,
   cargoLockPaths = [],
+  nativeLayout,
+  targetLink,
   minFreeGb = 25,
   env = process.env,
 } = {}) {
@@ -177,7 +179,8 @@ export function collectPreflight({
   const windows = platform === "win" || platform === "win32";
 
   if (appRoot) {
-    const target = path.join(appRoot, "src-tauri", "target");
+    const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
+    const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
     try {
       entry = lstatSync(target);
@@ -186,7 +189,7 @@ export function collectPreflight({
     }
     checks.push(
       !entry || entry.isSymbolicLink()
-        ? ok("target-bridge", entry ? "src-tauri/target is a symbolic link" : "src-tauri/target is ready for the shared cache bridge")
+        ? ok("target-bridge", entry ? `${targetLabel} is a symbolic link` : `${targetLabel} is ready for the shared cache bridge`)
         // A real directory here is not corruption on a broker-managed host: the
         // build broker owns CARGO_TARGET_DIR and this is its own output (or a
         // leftover from before it took ownership), not Cache V2's bridge target.
@@ -210,7 +213,7 @@ export function collectPreflight({
         ? fail(
             "version",
             `${app} ${version} is already sealed at ${sealedDir}; right-release will refuse to rebuild it`,
-            `bump to ${sealed.suggestion} in package.json, src-tauri/tauri.conf.json and src-tauri/Cargo.toml, then re-run the legal notices generator`,
+            `bump to ${sealed.suggestion} in package.json and ${nativeLayout?.manifestPrefix ?? "src-tauri/"}Cargo.toml, then re-run the legal notices generator`,
           )
         : ok("version", `${version} is free to build`),
     );

package/registry-parity.mjs

@@ -4,7 +4,7 @@ import { execFileSync } from 'node:child_process';
 import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const packageRoot = fileURLToPath(new URL('.', import.meta.url));
 
@@ -72,7 +72,7 @@ export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   verifyRegistryParity({ allowUnpublished: process.argv.includes('--allow-unpublished') })
     .then((result) => process.stdout.write(`${JSON.stringify(result)}\n`))
     .catch((error) => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });

package/release-invocation.mjs

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
+import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 
 function git(cwd, args) {
   const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
@@ -53,12 +54,18 @@ export function resolveConfiguredBuildInputs(config, target, label = "release co
 }
 
 export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
+  const nativeLayout = resolveNativeCargoLayout({
+    appRoot,
+    config,
+    requireManifest: true,
+    requireLock: true,
+  });
   const requiredInputs = [
     configPath,
     path.join(appRoot, "package.json"),
     path.join(appRoot, "pnpm-lock.yaml"),
-    path.join(appRoot, "src-tauri", "Cargo.toml"),
-    path.join(appRoot, "src-tauri", "Cargo.lock"),
+    nativeLayout.manifestPath,
+    nativeLayout.lockPath,
     ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
   ].filter((file, index, files) => files.indexOf(file) === index);
   for (const file of requiredInputs) {
@@ -77,6 +84,7 @@ export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, confi
 
   return {
     requiredInputs,
+    nativeLayout,
     buildInputs: {
       include: configured.include.map(qualify),
       exclude: (configured.exclude ?? []).map(qualify),

package/release-state.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import path from "node:path";
 import { readCachePolicy, resolveCacheLayout } from "./cache-policy.mjs";
+import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 
 export function cacheFingerprint({ cargoLockSha256, rustc, target, architecture, features = [] }) {
   const payload = JSON.stringify({
@@ -15,14 +16,16 @@ export function cacheFingerprint({ cargoLockSha256, rustc, target, architecture,
   return createHash("sha256").update(payload).digest("hex").slice(0, 16);
 }
 
-export function resolveReleaseLayout({ repoRoot, configPath }) {
+export function resolveReleaseLayout({ repoRoot, configPath, config, nativeLayout }) {
   const resolvedRepoRoot = path.resolve(repoRoot);
   const appRoot = path.dirname(path.resolve(configPath));
+  const resolvedNativeLayout = nativeLayout ?? resolveNativeCargoLayout({ appRoot, config });
   return {
     repoRoot: resolvedRepoRoot,
     appRoot,
     vaultRoot: path.join(resolvedRepoRoot, ".right-release"),
-    targetLink: path.join(appRoot, "src-tauri", "target"),
+    targetLink: resolvedNativeLayout.targetLink,
+    nativeLayout: resolvedNativeLayout,
   };
 }
 

package/release.mjs

@@ -9,6 +9,14 @@ import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import {
+  canonicalPackageIdentity,
+  createNativeFinalizationReceipt,
+  mintNativeProvenance,
+  resolveNativeFinalizerConfig,
+  validateNativeFinalizationOutput,
+} from "./native-release-finalization.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
@@ -92,6 +100,9 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
+const nativeLayout = resolveNativeCargoLayout({ appRoot: root, config });
+const nativeAssembly = config.nativeAssembly;
+const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
 await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
@@ -118,7 +129,7 @@ if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.pl
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, configPath, root, repoRoot, platform }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -128,10 +139,9 @@ function releasePreflight({ config, configPath, root, repoRoot, platform }) {
   // Every Cargo.lock the build compiles from; a vendored-OpenSSL edge in any of
   // them means the build needs a real Windows Perl.
   const cargoLockPaths = [
-    path.join(root, "src-tauri", "Cargo.lock"),
-    path.join(root, "Cargo.lock"),
+    ...(suppliedNativeLayout?.lockCandidates ?? []),
     ...(config.cargoLocks ?? []).map((entry) => path.resolve(root, entry)),
-  ];
+  ].filter((entry, index, entries) => entries.indexOf(entry) === index);
   return collectPreflight({
     platform,
     appRoot: root,
@@ -140,11 +150,13 @@ function releasePreflight({ config, configPath, root, repoRoot, platform }) {
     version,
     configPath,
     cargoLockPaths,
+    nativeLayout: suppliedNativeLayout,
+    targetLink: suppliedNativeLayout?.targetLink,
   });
 }
 
 if (opts.doctor) {
-  const { buildInputs } = resolveReleaseBuildInputs({
+  const { buildInputs, nativeLayout: resolvedNativeLayout } = resolveReleaseBuildInputs({
     repoRoot: doctorInvocation.repoRoot,
     appRoot: root,
     configPath,
@@ -174,7 +186,7 @@ if (opts.doctor) {
 
   // Config above, MACHINE below. Printing config never told anyone whether this
   // box could finish a build; these checks do.
-  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform });
+  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform, nativeLayout: resolvedNativeLayout });
   console.log("preflight:");
   console.log(formatPreflight(checks));
   const failures = preflightFailures(checks);
@@ -200,6 +212,7 @@ if (!opts.skipChecks) {
   for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
 }
 
+let nativeFinalization = null;
 let bundleMarkerReceipts = [];
 if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
@@ -215,6 +228,29 @@ if (opts.platform === "win") {
     console.log(`right-release: bundle marker ${receipt.bundle} ${receipt.alreadyPatched ? "already applied" : "applied"} at offset ${receipt.offset} in ${path.basename(receipt.file)}`);
   }
   await signWindows(rawFiles, "raw-exe", root);
+  if (nativeAssembly?.packageHook && !hasNativeTargetSpecificPrePackage(target, nativeAssembly.packageHook)) {
+    await runCommand(nativeAssembly.packageHook, root);
+  }
+  if (nativeFinalizer) {
+    nativeFinalization = await runNativeFinalizer({
+      finalizer: nativeFinalizer,
+      nativeAssembly,
+      target,
+      root,
+      signedFiles: rawFiles,
+    });
+  }
+} else if (nativeAssembly) {
+  if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
+  if (nativeFinalizer) {
+    nativeFinalization = await runNativeFinalizer({
+      finalizer: nativeFinalizer,
+      nativeAssembly,
+      target,
+      root,
+      signedFiles: target.sign?.prePackageFiles ?? target.sign?.files ?? [],
+    });
+  }
 }
 
 await runCommand(command, root);
@@ -223,6 +259,8 @@ for (const rel of target.artifacts ?? []) {
   await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
 }
 
+if (nativeFinalization) await completeNativeFinalization(nativeFinalization, { root, target, nativeAssembly });
+
 if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
@@ -311,13 +349,180 @@ async function mustExist(file, message) {
   await access(file).catch(() => fail(message));
 }
 
+async function runNativeFinalizer({ finalizer, nativeAssembly, target, root, signedFiles }) {
+  if (!finalizer?.cmd) fail(`${config.app} ${opts.platform} nativeAssembly.finalizer must declare a command`);
+  const signedArtifacts = nativeSignedArtifacts(signedFiles, root);
+  const packageIdentity = nativePackageIdentity({ nativeAssembly, target });
+  const provenance = mintNativeProvenance({
+    app: config.app,
+    version: config.version,
+    platform: opts.platform,
+    architecture: target.selectedArchitecture ?? target.architecture ?? nativeAssembly?.architecture ?? process.arch,
+    targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
+    signedArtifacts,
+    packageIdentity,
+  });
+  const outputPath = nativeFinalizerOutputPath({ finalizer, target, root });
+  const finalizerCommand = {
+    ...finalizer,
+    args: finalizer.args.map((arg) => expandFinalizerToken(arg, { provenance, outputPath, packageIdentity })),
+  };
+  const stdout = await runCommand(finalizerCommand, root, {
+    captureStdout: true,
+    env: {
+      RIGHT_RELEASE_NATIVE_PROVENANCE: provenance,
+      RIGHT_RELEASE_NATIVE_FINALIZATION_RECEIPT: outputPath,
+      RIGHT_RELEASE_NATIVE_PACKAGE_IDENTITY: JSON.stringify(packageIdentity),
+      RIGHT_RELEASE_NATIVE_SIGNED_ARTIFACTS: JSON.stringify(signedArtifacts),
+    },
+  });
+  if (opts.dryRun) return { outputPath, provenance, signedArtifacts, packageIdentity, output: null };
+
+  let output = null;
+  if (existsSync(outputPath)) {
+    try { output = JSON.parse(readFileSync(outputPath, "utf8")); } catch (error) { fail(`native finalizer output is not valid JSON: ${outputPath}: ${error.message}`); }
+  } else if (stdout?.trim()) {
+    try { output = JSON.parse(stdout); } catch { fail(`native finalizer output missing: ${outputPath}`); }
+  } else {
+    fail(`native finalizer output missing: ${outputPath}`);
+  }
+  output = enrichNativeFinalizerOutput(output, root);
+  try {
+    output = validateNativeFinalizationOutput(output, { expectedProvenance: provenance });
+  } catch (error) {
+    fail(`invalid native finalizer output: ${error.message}`);
+  }
+  return { outputPath, provenance, signedArtifacts, packageIdentity, output };
+}
+
+function enrichNativeFinalizerOutput(output, root) {
+  if (output?.provenance) return output;
+  if (output?.runtime?.provenance) return { ...output, provenance: output.runtime.provenance };
+  if (!output?.output) return output;
+  const manifestPath = path.join(path.resolve(root, output.output), "share", "legion", "release.json");
+  if (!existsSync(manifestPath)) return output;
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const provenance = manifest.runtime?.provenance;
+    if (provenance) return { ...output, provenance };
+  } catch {
+    return output;
+  }
+  return output;
+}
+
+async function completeNativeFinalization(finalization, { root, target, nativeAssembly }) {
+  if (opts.dryRun) {
+    console.log(`dry-run: native finalization receipt binds archive identity at ${finalization.outputPath}`);
+    return;
+  }
+  const archivePath = nativeArchiveCandidates({ root, target, nativeAssembly }).find((file) => existsSync(file));
+  if (!archivePath) fail(`${config.app} ${opts.platform} native finalization cannot find final archive`);
+  let receipt;
+  try {
+    receipt = createNativeFinalizationReceipt({
+      app: config.app,
+      version: config.version,
+      platform: opts.platform,
+      architecture: target.selectedArchitecture ?? target.architecture ?? nativeAssembly?.architecture ?? process.arch,
+      targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
+      signedArtifacts: finalization.signedArtifacts,
+      packageIdentity: finalization.packageIdentity,
+      archivePath,
+      finalizerOutput: finalization.output,
+      root,
+    });
+  } catch (error) {
+    fail(`native finalization archive binding failed: ${error.message}`);
+  }
+  mkdirSync(path.dirname(finalization.outputPath), { recursive: true });
+  writeFileSync(finalization.outputPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  console.log(`right-release: native finalization verified ${receipt.provenance} archive=${receipt.archiveSha256}`);
+}
+
+function nativeSignedArtifacts(files, root) {
+  const values = Array.isArray(files) ? files : [];
+  return values.map((value) => {
+    const declared = typeof value === "string" ? value : value?.path ?? value?.file;
+    if (!declared) fail("native finalizer signed artifact path is missing");
+    const absolute = path.resolve(root, declared);
+    if (opts.dryRun) return { path: path.relative(root, absolute).replaceAll("\\", "/") };
+    if (!existsSync(absolute)) fail(`native finalizer signed artifact missing: ${absolute}`);
+    return {
+      path: path.relative(root, absolute).replaceAll("\\", "/"),
+      sha256: createHash("sha256").update(readFileSync(absolute)).digest("hex"),
+      sizeBytes: readFileSync(absolute).length,
+    };
+  });
+}
+
+function nativePackageIdentity({ nativeAssembly, target }) {
+  const declared = nativeAssembly?.packageIdentity ?? target.packageIdentity;
+  if (declared) return canonicalPackageIdentity(declared);
+  const artifacts = [
+    ...(target.artifacts ?? []),
+    ...(target.installer?.artifacts ?? []).map((artifact) => artifact.file),
+    ...(target.updater?.artifacts ?? []).map((artifact) => artifact.file),
+  ].filter(Boolean);
+  return canonicalPackageIdentity({
+    kind: target.packageKind ?? "release",
+    platform: opts.platform,
+    architecture: target.selectedArchitecture ?? target.architecture ?? nativeAssembly?.architecture ?? process.arch,
+    ...(artifacts.length ? { artifacts } : {}),
+  });
+}
+
+function nativeArchiveCandidates({ root, target, nativeAssembly }) {
+  const declared = [
+    nativeAssembly?.archive,
+    nativeAssembly?.archivePath,
+    nativeAssembly?.packageIdentity?.path,
+    target.archive,
+    target.archivePath,
+    ...(target.artifacts ?? []),
+    ...(target.installer?.artifacts ?? []).map((artifact) => artifact.file),
+    ...(target.updater?.artifacts ?? []).map((artifact) => artifact.file),
+  ].filter((value) => typeof value === "string" && value.trim());
+  return [...new Set(declared.map((value) => path.resolve(root, value)))];
+}
+
+function nativeFinalizerOutputPath({ finalizer, target, root }) {
+  const declared = finalizer.output
+    ?? target.evidence?.provenance
+    ?? target.provenance
+    ?? `.right-release/receipts/native-finalization-${opts.platform}.json`;
+  return path.resolve(root, declared);
+}
+
+function expandFinalizerToken(value, { provenance, outputPath, packageIdentity }) {
+  const replacements = {
+    "{{provenance}}": provenance,
+    "{provenance}": provenance,
+    "${RIGHT_RELEASE_NATIVE_PROVENANCE}": provenance,
+    "$RIGHT_RELEASE_NATIVE_PROVENANCE": provenance,
+    "{{receipt}}": outputPath,
+    "{receipt}": outputPath,
+    "${RIGHT_RELEASE_NATIVE_FINALIZATION_RECEIPT}": outputPath,
+    "$RIGHT_RELEASE_NATIVE_FINALIZATION_RECEIPT": outputPath,
+    "{{packageIdentity}}": JSON.stringify(packageIdentity),
+    "{packageIdentity}": JSON.stringify(packageIdentity),
+  };
+  return Object.entries(replacements).reduce((result, [token, replacement]) => result.replaceAll(token, replacement), String(value));
+}
+
+function hasNativeTargetSpecificPrePackage(target, packageHook) {
+  if (!target?.prePackage || !packageHook || target.prePackage.cmd !== packageHook.cmd) return false;
+  const args = target.prePackage.args ?? [];
+  return args.some((arg) => ["--platform", "--architecture", "--target", "--out"].includes(arg));
+}
+
 // Post-release target/ hygiene: `cargo sweep --installed` deletes artifacts left
 // by toolchains rustup no longer has (each update orphans a multi-GB pile per
 // app) and never touches anything the current toolchains produced. Runs after
 // publish so it cannot race an artifact, and is best-effort: a missing
 // cargo-sweep or a sweep failure must never fail a release.
 function sweepStaleRustArtifacts() {
-  const candidates = [...new Set([root, workdir].flatMap((base) => [base, path.join(base, "src-tauri")]))];
+  const candidates = [...new Set([root, workdir, nativeLayout.manifestDir, nativeLayout.workspaceRoot])];
   const projects = candidates.filter((dir) => existsSync(path.join(dir, "target")));
   for (const dir of projects) {
     if (opts.dryRun) {
@@ -348,10 +553,11 @@ async function runPackageScript(pm, script, cwd) {
   await run(pm, ["run", script], cwd);
 }
 
-async function runCommand(command, root) {
+async function runCommand(command, root, { env = {}, captureStdout = false } = {}) {
   const cwd = path.resolve(root, command.cwd ?? ".");
-  await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), {
+  return run(command.cmd, command.args ?? [], cwd, { ...(await commandEnv(command, root)), ...env }, {
     ...command,
+    captureStdout,
     timeoutMs: commandTimeoutMs(command),
   });
 }
@@ -550,7 +756,7 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
     const timeout = options.timeoutMs ? ` timeout=${options.timeoutMs}ms` : "";
     const tier = opts.tier ? `RIGHT_RELEASE_TIER=${opts.tier} ` : "";
     console.log(`dry-run: (${cwd}) ${tier}${printable}${timeout}`);
-    return Promise.resolve();
+    return Promise.resolve("");
   }
   const started = Date.now();
   return new Promise((resolve) => {
@@ -558,10 +764,12 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
     const child = spawn(cmd, runArgs, {
       cwd,
       env: { ...process.env, ...releaseEnv, ...env },
-      stdio: "inherit",
+      stdio: options.captureStdout ? ["inherit", "pipe", "inherit"] : "inherit",
       shell: useShell,
       windowsHide: true,
     });
+    let stdout = "";
+    if (options.captureStdout) child.stdout?.on("data", (chunk) => { stdout += String(chunk); });
     const timer = options.timeoutMs
       ? setTimeout(() => {
           killProcessTree(child.pid);
@@ -579,7 +787,7 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
       if (timer) clearTimeout(timer);
       console.log(`right-release step: ${printable} (${Date.now() - started}ms)`);
       if (code !== 0) process.exit(code ?? 1);
-      resolve();
+      resolve(options.captureStdout ? stdout : "");
     });
   });
 }

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.69",
+    "@rightkit/release": "0.2.71",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -64,7 +64,9 @@
       "0.2.65",
       "0.2.66",
       "0.2.67",
-      "0.2.68"
+      "0.2.68",
+      "0.2.69",
+      "0.2.70"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/addon-command.test.mjs

@@ -1,54 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import test from "node:test";
-import { createAddonManifest, addonManifestSha256, canonicalAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl } from "./addon-contract.mjs";
-
-const command = fileURLToPath(new URL("./addon-command.mjs", import.meta.url));
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-command-"));
-  mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
-  for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
-  writeFileSync(path.join(root, "assets", "tab.png"), "icon");
-  const files = [["command", "membrane", "out/membrane", true], ["service", "membrane-service", "out/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
-  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
-  return root;
-}
-test("add-on dry-run creates no release state and never executes build", () => {
-  const root = fixture(); const result = spawnSync(process.execPath, [command, "build", "--config", "right-addon.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr); assert.match(result.stdout, /would run: false/); assert.equal(existsSync(path.join(root, ".right-release")), false);
-});
-
-test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
-  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const sealed = path.join(root, "sealed"); mkdirSync(sealed);
-  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
-  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
-  const digest = addonManifestSha256(manifest); const lock = path.join(root, "membrane.lock.json"); writeFileSync(lock, JSON.stringify({ targets: { mac: { manifestUrl: `https://example.test/membrane/addons/mac/sha256/${digest}/addon-manifest.json`, manifestSha256: digest } } }));
-  const output = path.join(root, "addons"); const unsigned = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", `${output}-unsigned`, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "" } });
-  assert.notEqual(unsigned.status, 0); assert.match(unsigned.stderr, /unexpected mac signing contract/);
-  const result = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", output, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "1" } });
-  assert.equal(result.status, 0, result.stderr);
-  assert.equal(readFileSync(path.join(output, "membrane", "bin", "membrane-aarch64-apple-darwin"), "utf8"), "command");
-  assert.equal(readFileSync(path.join(output, "membrane", "resources", "LICENSE"), "utf8"), "LICENSE");
-  const receipt = JSON.parse(readFileSync(path.join(root, ".right-release", "addons", "adoptions", "membrane-mac.json"), "utf8"));
-  assert.equal(receipt.manifestSha256, digest);
-  assert.deepEqual(receipt.files.map((file) => [file.role, file.sealedSha256, file.adoptedSha256]), [["command", manifest.files.find((file) => file.role === "command").sha256, manifest.files.find((file) => file.role === "command").sha256], ["service", manifest.files.find((file) => file.role === "service").sha256, manifest.files.find((file) => file.role === "service").sha256]]);
-});
-
-test("remote downloader accepts only immutable manifest plus file routes", async () => {
-  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
-  const destination = path.join(root, "remote"); mkdirSync(destination);
-  await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
-  assert.equal(readFileSync(path.join(destination, "membrane-service"), "utf8"), "service");
-  assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
-});

package/addon-contract.test.mjs

@@ -1,48 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
-  mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
-  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/membrane-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
-  const files = [
-    ["command", "membrane", "bin/membrane", true], ["service", "membrane-service", "bin/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
-    ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
-  ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
-}
-
-test("add-on manifest has portable immutable identity and routes", () => {
-  const { root, config } = fixture();
-  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "a".repeat(40), signedAt: "2026-08-11T00:00:00.000Z", signing });
-  assert.deepEqual(Object.keys(manifest), ["schema", "kind", "addon", "version", "commit", "platform", "targetTriple", "consumer", "files", "signedAt"]);
-  const digest = addonManifestSha256(manifest); const routes = addonRoutes(manifest);
-  assert.equal(routes.at(-1).manifest, true);
-  assert.match(routes[0].key, new RegExp(`^membrane/addons/mac/sha256/${digest}/`));
-  assert.ok(routes.slice(0, -1).every((route) => !route.manifest));
-});
-
-test("add-on contract rejects unsafe, incomplete, duplicate, and unsigned inputs", () => {
-  const { root, config } = fixture();
-  const broken = structuredClone(config); broken.targets.mac.files[0].source = "../escape";
-  assert.throws(() => validateAddonConfig(broken, { root, platform: "mac" }), /unsafe add-on source/);
-  const duplicate = structuredClone(config); duplicate.targets.mac.files[1].role = "command";
-  assert.throws(() => validateAddonConfig(duplicate, { root, platform: "mac" }), /duplicate/);
-  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "b".repeat(40), signing });
-  manifest.files.find((file) => file.role === "command").signing = null;
-  assert.throws(() => validateAddonManifest(manifest), /unsigned executable/);
-});
-
-test("manifest excludes source and mutable transport fields", () => {
-  const { root, config } = fixture();
-  const manifest = createAddonManifest({ config, root, platform: "win", commit: "c".repeat(40), signing: { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } } });
-  const text = JSON.stringify(manifest);
-  assert.doesNotMatch(text, /source|path|url|token/i);
-  assert.equal(readFileSync(path.join(root, "bin", "membrane"), "utf8"), "membrane");
-});