@rightkit/release 0.2.69 → 0.2.71

package/preflight.test.mjs

@@ -1,123 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import path from "node:path";
-
-import {
-  buildPathPrefix,
-  collectPreflight,
-  findWindowsSdkTool,
-  formatPreflight,
-  graphVendorsOpenssl,
-  nextFreeVersion,
-  preflightFailures,
-  resolveWindowsPerl,
-  PREFLIGHT_FAIL,
-} from "./preflight.mjs";
-
-test("windows SDK lookup orders versions numerically, not as strings", () => {
-  const root = "C:\\Kits";
-  const present = new Set([
-    root,
-    path.join(root, "10.0.9.0", "x64", "makeappx.exe"),
-    path.join(root, "10.0.26100.0", "x64", "makeappx.exe"),
-  ]);
-  const found = findWindowsSdkTool("makeappx.exe", {
-    sdkRoot: root,
-    readdir: () => ["10.0.9.0", "10.0.26100.0"],
-    exists: (candidate) => present.has(candidate),
-  });
-  // String sort would pick 10.0.9.0 — that is the bug this guards.
-  assert.equal(found.version, "10.0.26100.0");
-});
-
-test("windows SDK lookup returns null when the tool is absent from every SDK", () => {
-  const found = findWindowsSdkTool("makeappx.exe", {
-    sdkRoot: "C:\\Kits",
-    readdir: () => ["10.0.26100.0"],
-    exists: (candidate) => candidate === "C:\\Kits",
-  });
-  assert.equal(found, null);
-});
-
-test("explicit OPENSSL_SRC_PERL wins over the default Strawberry location", () => {
-  const resolved = resolveWindowsPerl({
-    env: { OPENSSL_SRC_PERL: "D:\\perl\\bin\\perl.exe" },
-    exists: () => true,
-  });
-  assert.equal(resolved.perlPath, "D:\\perl\\bin\\perl.exe");
-  assert.equal(resolved.dir, "D:\\perl\\bin");
-});
-
-test("perl resolution reports nothing when no windows perl exists", () => {
-  assert.equal(resolveWindowsPerl({ env: {}, exists: () => false }), null);
-});
-
-test("vendored openssl is detected from the cargo lock", () => {
-  assert.equal(
-    graphVendorsOpenssl("Cargo.lock", { exists: () => true, read: () => 'name = "openssl-src"\n' }),
-    true,
-  );
-  assert.equal(
-    graphVendorsOpenssl("Cargo.lock", { exists: () => true, read: () => 'name = "rustls"\n' }),
-    false,
-  );
-  assert.equal(graphVendorsOpenssl("missing.lock", { exists: () => false }), false);
-});
-
-test("a sealed version collision suggests the next free patch, skipping taken ones", () => {
-  const result = nextFreeVersion("/sealed", "heardright", "0.1.33", {
-    exists: () => true,
-    readdir: () => [
-      "heardright-0.1.33-6f2f5e64",
-      "heardright-0.1.34-839ad700",
-      "heardright-0.1.36-f7035acc",
-      "viewright-0.1.35-aaaaaaaa",
-    ],
-  });
-  assert.equal(result.collision, true);
-  // 0.1.34 is taken, 0.1.35 is free — and viewright's record must not be counted.
-  assert.equal(result.suggestion, "0.1.35");
-});
-
-test("an unsealed version is reported as free", () => {
-  const result = nextFreeVersion("/sealed", "heardright", "0.1.37", {
-    exists: () => true,
-    readdir: () => ["heardright-0.1.33-6f2f5e64"],
-  });
-  assert.equal(result.collision, false);
-  assert.equal(result.suggestion, "0.1.37");
-});
-
-test("a sealed version collision is a hard failure carrying a concrete fix", () => {
-  const checks = collectPreflight({
-    platform: "linux",
-    repoRoot: process.cwd(),
-    app: "nothing-is-sealed-here",
-    version: "9.9.9",
-  });
-  // No sealed dir for this app, so the version check must pass rather than throw.
-  const version = checks.find((check) => check.name === "version");
-  assert.equal(version.status, "ok");
-});
-
-test("formatting surfaces the fix line only for non-ok checks", () => {
-  const text = formatPreflight([
-    { name: "a", status: "ok", detail: "fine", fix: "unused" },
-    { name: "b", status: PREFLIGHT_FAIL, detail: "broken", fix: "do the thing" },
-  ]);
-  assert.match(text, /\[ok {2}\] a: fine/);
-  assert.doesNotMatch(text, /fix: unused/);
-  assert.match(text, /fix: do the thing/);
-});
-
-test("failures are filtered from warnings so warnings never block a build", () => {
-  const failures = preflightFailures([
-    { name: "a", status: "warn", detail: "" },
-    { name: "b", status: PREFLIGHT_FAIL, detail: "" },
-  ]);
-  assert.deepEqual(failures.map((check) => check.name), ["b"]);
-});
-
-test("build PATH prefix is windows-only", () => {
-  assert.equal(buildPathPrefix({ platform: "mac" }), null);
-});

package/progress-control.test.mjs

@@ -1,56 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import { cancelAndReapManagedRequest, firstManagedRequestId, latestManagedRequestId, releaseProgressLimits, terminalResultFromOutput } from "./progress-control.mjs";
-
-test("release progress stays bounded without killing a healthy long native build at 90 minutes", () => {
-  assert.deepEqual(releaseProgressLimits({}), { inactivityMs: 600_000, absoluteMs: 14_400_000 });
-  assert.deepEqual(releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "5000" }), { inactivityMs: 1_000, absoluteMs: 5_000 });
-  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "1000" }), /must exceed/);
-  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
-});
-
-test("declared inner liveness owner always exits before the outer watchdog", () => {
-  const ownerTimeoutMs = 45 * 60 * 1000;
-  assert.deepEqual(
-    releaseProgressLimits({}, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    { inactivityMs: 50 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
-  );
-  assert.deepEqual(
-    releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: String(60 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    { inactivityMs: 60 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
-  );
-  assert.throws(
-    () => releaseProgressLimits({ RIGHT_RELEASE_ABSOLUTE_MS: String(49 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
-    /must exceed effective release inactivity limit/,
-  );
-  assert.throws(() => releaseProgressLimits({}, { livenessOwnerTimeoutMs: 0 }), /positive finite/);
-});
-
-test("latest managed request id follows streamed root Cargo requests", () => {
-  const first = "11111111-1111-4111-8111-111111111111";
-  const second = "22222222-2222-4222-8222-222222222222";
-  assert.equal(latestManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), second);
-  assert.equal(firstManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), first);
-  assert.equal(latestManagedRequestId("ordinary output", first), first);
-});
-
-test("managed cancellation issues CANCEL, waits for terminal RESULT, & returns reap receipt", async () => {
-  const id = "33333333-3333-4333-8333-333333333333";
-  const calls = [];
-  const run = async (args) => {
-    calls.push(args);
-    if (args[0] === "cancel") return { code: 0, output: JSON.stringify({ type: "CANCEL_REQUESTED", id }) };
-    return { code: 130, output: `compiler tail\n${JSON.stringify({ type: "RESULT", id, status: "CANCELLED", exitCode: 130, receipt: { reap: { reaped: true } } })}\n` };
-  };
-  assert.deepEqual(await cancelAndReapManagedRequest(id, { run }), {
-    status: "CANCELLED", id, exitCode: 130, receipt: { reap: { reaped: true } }, cancelExitCode: 0, attachExitCode: 130,
-  });
-  assert.deepEqual(calls, [["cancel", id], ["attach", id]]);
-});
-
-test("missing terminal broker result fails closed", async () => {
-  const run = async () => ({ code: 125, output: "broker closed", timedOut: false });
-  await assert.rejects(cancelAndReapManagedRequest("44444444-4444-4444-8444-444444444444", { run }), /lacked terminal RESULT/);
-  assert.equal(terminalResultFromOutput("noise\n"), null);
-});

package/prune-r2.test.mjs

@@ -1,12 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { isReleaseObject } from "./prune-r2.mjs";
-
-test("pruning only targets release objects for the active OS", () => {
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/mac/ViewRight.dmg"), true);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/updates/mac/current/ViewRight.app.tar.gz"), true);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/windows/ViewRight-Setup.exe"), false);
-  assert.equal(isReleaseObject("viewright", "windows", "viewright/installers/mac/ViewRight.dmg"), false);
-  assert.equal(isReleaseObject("viewright", "mac", "viewright/models/mac/model.bin"), false);
-  assert.equal(isReleaseObject("viewright", "mac", "other/installers/mac/Other.dmg"), false);
-});

package/publish-cargo.test.mjs

@@ -1,43 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import {
-  buildCargoPublishPlan,
-  packageFileViolations,
-  parseCargoPublishArgs,
-} from "./publish-cargo.mjs";
-
-test("cargo publish requires a safe explicit crate name", () => {
-  assert.throws(() => parseCargoPublishArgs([]), /--crate/);
-  assert.throws(() => parseCargoPublishArgs(["--crate", "../secret"]), /invalid crate/);
-  assert.throws(() => parseCargoPublishArgs(["--crate", "rightkit-license", "--allow-dirty"]), /only valid with --dry-run/);
-  assert.equal(parseCargoPublishArgs(["--crate", "rightkit-license"]).crate, "rightkit-license");
-});
-
-test("cargo publish plan always runs local safety gates before upload", () => {
-  const plan = buildCargoPublishPlan({ crate: "rightkit-license", crateDir: "C:/rightkit/crates/rightkit-license", dryRun: false });
-  assert.deepEqual(plan.map((step) => step.label), [
-    "secret scan",
-    "format",
-    "tests",
-    "clippy",
-    "package contents",
-    "registry dry-run",
-    "registry publish",
-  ]);
-  assert.deepEqual(plan.at(-1)?.args, ["publish", "-p", "rightkit-license"]);
-});
-
-test("dry-run plan never contains a real registry upload", () => {
-  const plan = buildCargoPublishPlan({ crate: "rightkit-logs", crateDir: "C:/rightkit/crates/rightkit-logs", dryRun: true });
-  assert.equal(plan.at(-1)?.label, "registry dry-run");
-});
-
-test("package inspection rejects secret and build-output paths", () => {
-  assert.deepEqual(packageFileViolations([
-    "Cargo.toml",
-    "src/lib.rs",
-    ".env",
-    "keys/signing.p8",
-    "target/release/app",
-  ]), [".env", "keys/signing.p8", "target/release/app"]);
-});

package/publish-swift.test.mjs

@@ -1,44 +0,0 @@
-import assert from "node:assert/strict";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-import { parseSwiftPublishArgs, buildSwiftPublishPlan, readPackageIdentity } from "./publish-swift.mjs";
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const packageDir = path.resolve(here, "../../swift/RightKitSwift");
-
-test("dry-run needs no url; publish requires one", () => {
-  assert.deepEqual(parseSwiftPublishArgs(["--dry-run"], {}), {
-    scope: "rightsuite", url: "", dryRun: true, allowDirty: false,
-  });
-  assert.throws(() => parseSwiftPublishArgs([], {}), /needs --url/);
-  assert.equal(parseSwiftPublishArgs(["--url", "https://reg.local"], {}).url, "https://reg.local");
-});
-
-test("env supplies scope and url; --allow-dirty is dry-run only", () => {
-  const parsed = parseSwiftPublishArgs([], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e", RIGHTKIT_SWIFT_REGISTRY_SCOPE: "acme" });
-  assert.deepEqual(parsed, { scope: "acme", url: "https://e", dryRun: false, allowDirty: false });
-  assert.throws(() => parseSwiftPublishArgs(["--allow-dirty"], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e" }), /only valid with --dry-run/);
-  assert.throws(() => parseSwiftPublishArgs(["--bogus"], {}), /unexpected argument/);
-});
-
-test("reads the real package identity from VERSION + Package.swift", () => {
-  const { name, version } = readPackageIdentity(packageDir);
-  assert.equal(name, "RightKitSwift");
-  assert.match(version, /^\d+\.\d+\.\d+/);
-});
-
-test("dry-run plan stops before publish; real plan ends with publish", () => {
-  const base = { packageDir, scope: "rightsuite", name: "RightKitSwift", version: "0.1.0", url: "https://reg.local" };
-  const dry = buildSwiftPublishPlan({ ...base, dryRun: true });
-  assert.equal(dry[0].internal, "secret-scan");
-  assert.ok(dry.some((s) => s.label === "tests" && s.command === "swift"));
-  assert.ok(!dry.some((s) => s.label === "registry publish"), "dry-run must not publish");
-
-  const real = buildSwiftPublishPlan({ ...base, dryRun: false });
-  const publish = real.at(-1);
-  assert.equal(publish.label, "registry publish");
-  assert.deepEqual(publish.args, [
-    "package-registry", "publish", "rightsuite.RightKitSwift", "0.1.0", "--url", "https://reg.local", "--package-path", packageDir,
-  ]);
-});

package/publish-update.test.mjs

@@ -1,207 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-
-const publisher = fileURLToPath(new URL("./publish-update.mjs", import.meta.url));
-
-function fixture({ materialize = false } = {}) {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
-        updater: {
-          artifacts: [
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/updates/windows/current/Fixture.exe" },
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-arm64", key: "fixture/updates/windows/current/Fixture.exe" },
-          ],
-        },
-      },
-    },
-  })};\n`);
-  if (materialize) {
-    writeFileSync(path.join(dir, "Fixture-Setup.exe"), "signed installer");
-    writeFileSync(path.join(dir, "Fixture.exe"), "signed updater");
-    writeFileSync(path.join(dir, "Fixture.exe.sig"), "updater signature");
-  }
-  return config;
-}
-
-function versionedFixture() {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/1.2.3/Fixture-Setup.exe" }] },
-        updater: {
-          artifacts: [
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/1.2.3/windows/Fixture.exe" },
-          ],
-        },
-      },
-    },
-  })};\n`);
-  return config;
-}
-
-function installerOnlyFixture() {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
-        updater: { artifacts: [] },
-      },
-    },
-  })};\n`);
-  return config;
-}
-
-function run(tier) {
-  const config = fixture();
-  return spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: tier },
-  });
-}
-
-function registrationBody(result) {
-  return result.stdout
-    .split(/\r?\n/)
-    .filter((line) => line.startsWith('{'))
-    .map((line) => JSON.parse(line))
-    .find((body) => body.artifactManifest);
-}
-
-test("patch registers a free updater manifest backed by public installer-path objects", () => {
-  const result = run("patch");
-  assert.equal(result.status, 0, result.stderr);
-  const patchPayloadUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture.exe");
-  const installerUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture-Setup.exe");
-  const registration = result.stdout.indexOf("/v1/admin/apps/patches");
-  assert.ok(patchPayloadUpload >= 0, "patch updater payload must upload to the public installer path");
-  assert.ok(installerUpload >= 0, "patch download installer must upload to the public installer path");
-  assert.ok(patchPayloadUpload < installerUpload, "patch should upload app-update payloads before replacing the public download installer");
-  assert.ok(installerUpload < registration, "patch should register only after uploads complete");
-  assert.doesNotMatch(result.stdout, /UPLOAD public\/fixture\/updates\//);
-  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
-  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
-  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
-  assert.match(result.stdout, /"tier":"patch"/);
-  assert.match(result.stdout, /"platform":"windows"/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
-  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 2, "patch may upload only one installer and one updater object per OS");
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
-  const body = registrationBody(result);
-  assert.deepEqual(
-    {
-      schema: body.artifactManifest.schema,
-      appKey: body.artifactManifest.appKey,
-      appVersion: body.artifactManifest.appVersion,
-      tier: body.artifactManifest.tier,
-      platform: body.artifactManifest.platform,
-    },
-    { schema: 1, appKey: 'fixture', appVersion: '1.2.3', tier: 'patch', platform: 'windows' },
-  );
-  assert.match(body.artifactManifest.pipelineVersion, /^\d+\.\d+\.\d+$/);
-  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
-    ['installer', 'fixture/installers/windows/current/Fixture-Setup.exe'],
-    ['updater', 'fixture/installers/windows/current/Fixture.exe'],
-  ]);
-  assert.match(body.artifactManifest.artifacts[1].updaterSignature, /^<signature:/);
-});
-
-test("routes feature updates to the Pro-gated release endpoint", () => {
-  const result = run("update");
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/releases/);
-  assert.match(result.stdout, /"tier":"update"/);
-  assert.match(result.stdout, /"platform":"windows"/);
-  assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
-  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 1, "feature update may upload only one updater object per OS");
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
-  const body = registrationBody(result);
-  assert.equal(body.artifactManifest.tier, 'update');
-  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
-    ['updater', 'fixture/updates/windows/current/Fixture.exe'],
-  ]);
-});
-
-test("allows an installer-only patch without registering an updater manifest", () => {
-  const config = installerOnlyFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /UPLOAD public\/fixture\/installers\/windows\/current\/Fixture-Setup\.exe/);
-  assert.match(result.stdout, /NO patch updater artifacts/);
-  assert.doesNotMatch(result.stdout, /\/v1\/admin\/apps\/patches/);
-  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-});
-
-test("refuses to publish without a valid tier", () => {
-  const result = run("");
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /RIGHT_RELEASE_TIER.*patch\|update/);
-});
-
-test("refuses versioned R2 object keys that would accumulate old releases", () => {
-  const config = versionedFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /current R2 object/);
-});
-
-test("refuses versioned updater object keys for gated feature updates", () => {
-  const config = versionedFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "update" },
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /current R2 object/);
-});
-
-test("requires the durable release credential before the first patch upload", () => {
-  const config = fixture({ materialize: true });
-  const env = {
-    ...process.env,
-    APPDATA: path.join(path.dirname(config), "empty-appdata"),
-    RIGHT_RELEASE_TIER: "patch",
-    RIGHTAPPS_RELEASE_TOKEN_FILE: path.join(path.dirname(config), "missing-release-token"),
-    RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session",
-  };
-  delete env.RIGHTAPPS_RELEASE_TOKEN;
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
-    encoding: "utf8",
-    env,
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /RIGHTAPPS_RELEASE_TOKEN/);
-  assert.doesNotMatch(result.stdout, /UPLOAD /, "credential preflight must run before R2 mutation");
-});

package/qa-contract.test.mjs

@@ -1,47 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { validateQaBackdoorContract } from "./qa-contract.mjs";
-
-function fixture({ optional = true, releaseScript = "right-release release --tier patch" } = {}) {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-qa-"));
-  mkdirSync(path.join(root, "src-tauri", "src"), { recursive: true });
-  writeFileSync(path.join(root, "right-qa.config.mjs"), "export default {};\n");
-  writeFileSync(path.join(root, "src-tauri", "Cargo.toml"), `
-[features]
-qa-native = ["dep:tauri-plugin-wdio-webdriver"]
-[dependencies]
-tauri-plugin-wdio-webdriver = { version = "1.2.0", optional = ${optional} }
-`);
-  writeFileSync(path.join(root, "src-tauri", "src", "lib.rs"), `
-#[cfg(all(not(debug_assertions), feature = "qa-native"))]
-compile_error!("qa-native must never be enabled in release builds");
-#[cfg(all(debug_assertions, feature = "qa-native"))]
-fn qa_enabled() -> bool { std::env::var("RIGHTKIT_QA_NATIVE").as_deref() == Ok("1") }
-#[cfg(all(debug_assertions, feature = "qa-native"))]
-fn add_plugin() { tauri_plugin_wdio_webdriver::init(); }
-`);
-  return { root, scripts: { "qa:native": "tauri dev --features qa-native", "release:patch:win": releaseScript } };
-}
-
-test("accepts a debug-only, runtime-gated native QA surface", () => {
-  const value = fixture();
-  assert.deepEqual(validateQaBackdoorContract(value.root, value.scripts), []);
-});
-
-test("rejects a non-optional WebDriver plugin", () => {
-  const value = fixture({ optional: false });
-  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /must be optional/);
-});
-
-test("rejects release scripts that enable native QA", () => {
-  const value = fixture({ releaseScript: "tauri build --features qa-native" });
-  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /release:patch:win/);
-});
-
-test("does not impose native QA on an app before its config lands", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-no-qa-"));
-  assert.deepEqual(validateQaBackdoorContract(root, {}), []);
-});

package/registry-parity.test.mjs

@@ -1,30 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { comparePackedTrees, verifyRegistryParity } from './registry-parity.mjs';
-
-test('registry parity rejects same-version packed-byte drift', () => {
-  assert.deepEqual(comparePackedTrees([['build-release.mjs', 'new']], [['build-release.mjs', 'old']]), {
-    equal: false,
-    differences: ['build-release.mjs'],
-  });
-});
-
-test('registry parity accepts identical packed trees', () => {
-  assert.deepEqual(comparePackedTrees([['a.mjs', 'one'], ['package.json', 'two']], [['a.mjs', 'one'], ['package.json', 'two']]), {
-    equal: true,
-    differences: [],
-  });
-});
-
-test('registry parity distinguishes an unpublished version from registry failure', async () => {
-  const notFound = async () => ({ status: 404, ok: false });
-  assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
-    status: 'UNPUBLISHED',
-    name: '@rightkit/release',
-    version: '0.2.69',
-  });
-  await assert.rejects(
-    verifyRegistryParity({ fetchImpl: notFound }),
-    /registry metadata failed: HTTP 404/,
-  );
-});