@rightkit/release 0.2.9 → 0.2.11

package/cli/right-release.mjs

@@ -16,6 +16,7 @@ const commands = new Map([
   ["sign-windows", "sign-windows.mjs"],
   ["sign-updater", "sign-updater.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
+  ["mirror-root-artifact", "mirror-root-artifact.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -39,6 +40,8 @@ if (first === "--version" || first === "-v") {
   run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
 } else if (first === "lsclean") {
   runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
+} else if (first === "generate-dmg-background") {
+  runBinary("python3", [path.join(packageRoot, "generate-dmg-background.py"), ...args.slice(1)]);
 } else if (commands.has(first)) {
   run(commands.get(first), args.slice(1));
 } else if (first.startsWith("-")) {
@@ -102,6 +105,9 @@ Commands:
   deps --check|--audit|--update                      Shared dependency lane
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
+  generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
+  mirror-root-artifact --file <path> --package-root <dir>
+                                                      Persist a worktree artifact in the primary repo root
 
 Direct flags are treated as: right-release release <flags>.
 Publishing requires an explicit tier. Unsigned/local smoke builds stay app-local unless declared in right-release.config.mjs.`);

package/generate-dmg-background.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import subprocess
+from pathlib import Path
+from PIL import Image, ImageDraw, ImageFilter
+
+
+def rgb(value: str) -> tuple[int, int, int]:
+    value = value.removeprefix("#")
+    if len(value) != 6:
+        raise argparse.ArgumentTypeError("colors must be six-digit hex values")
+    return tuple(int(value[i:i + 2], 16) for i in (0, 2, 4))
+
+
+def make(width: int, height: int, scale: int, background: tuple[int, int, int], header: tuple[int, int, int], accent: tuple[int, int, int], icon_path: Path) -> Image.Image:
+    image = Image.new("RGBA", (width, height), (*background, 255))
+    draw = ImageDraw.Draw(image)
+    band = 86 * scale
+    draw.rectangle((0, 0, width, band), fill=(*header, 255))
+    draw.rectangle((0, band - 2 * scale, width, band), fill=(*accent, 255))
+    arrow = Image.new("RGBA", (width, height), (0, 0, 0, 0))
+    ad = ImageDraw.Draw(arrow)
+    stroke = 4 * scale
+    ad.line([(315 * scale, 231 * scale), (463 * scale, 231 * scale)], fill=(*accent, 255), width=stroke)
+    ad.line([(438 * scale, 205 * scale), (466 * scale, 231 * scale), (438 * scale, 257 * scale)], fill=(*accent, 255), width=stroke, joint="curve")
+    image.alpha_composite(arrow.filter(ImageFilter.GaussianBlur(scale)))
+    image.alpha_composite(arrow)
+    if icon_path.exists():
+        icon = Image.open(icon_path).convert("RGBA").resize((48 * scale, 48 * scale), Image.Resampling.LANCZOS)
+        image.alpha_composite(icon, (34 * scale, 20 * scale))
+    return image.convert("RGB")
+
+
+def main() -> None:
+    p = argparse.ArgumentParser()
+    p.add_argument("--output-dir", required=True, type=Path)
+    p.add_argument("--icon", required=True, type=Path)
+    p.add_argument("--background", required=True, type=rgb)
+    p.add_argument("--header", required=True, type=rgb)
+    p.add_argument("--accent", required=True, type=rgb)
+    a = p.parse_args()
+    a.output_dir.mkdir(parents=True, exist_ok=True)
+    low, high, tiff = (a.output_dir / name for name in ("background.png", "background@2x.png", "background.tiff"))
+    make(660, 400, 1, a.background, a.header, a.accent, a.icon).save(low)
+    make(1320, 800, 2, a.background, a.header, a.accent, a.icon).save(high)
+    subprocess.run(["tiffutil", "-cathidpicheck", str(low), str(high), "-out", str(tiff)], check=True)
+    print(tiff)
+
+
+if __name__ == "__main__":
+    main()

package/mirror-root-artifact.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { copyFileSync, mkdirSync, realpathSync, renameSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+
+const args = parseArgs(process.argv.slice(2));
+if (!args.file || !args.packageRoot) {
+  console.error("Usage: right-release mirror-root-artifact --file <artifact> --package-root <dir> [--name <filename>]");
+  process.exit(2);
+}
+
+const packageRoot = realpathSync(path.resolve(args.packageRoot));
+const source = path.resolve(packageRoot, args.file);
+const name = args.name || path.basename(source);
+const repoRoot = git(packageRoot, "rev-parse", "--show-toplevel");
+const commonDir = git(packageRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+const canonicalRepoRoot = path.basename(commonDir) === ".git" ? path.dirname(commonDir) : repoRoot;
+const relativePackageRoot = path.relative(repoRoot, packageRoot);
+const destinations = new Set([
+  path.join(packageRoot, name),
+  path.join(canonicalRepoRoot, relativePackageRoot, name),
+]);
+
+for (const destination of destinations) {
+  if (path.resolve(destination) === source) continue;
+  atomicCopy(source, destination);
+}
+
+const canonicalArtifact = path.join(canonicalRepoRoot, relativePackageRoot, name);
+console.log(`right-release: repository-root artifact -> ${canonicalArtifact}`);
+
+function git(cwd, ...commandArgs) {
+  return execFileSync("git", commandArgs, { cwd, encoding: "utf8" }).trim();
+}
+
+function atomicCopy(from, to) {
+  mkdirSync(path.dirname(to), { recursive: true });
+  const temporary = `${to}.tmp-${process.pid}`;
+  rmSync(temporary, { force: true });
+  try {
+    copyFileSync(from, temporary);
+    renameSync(temporary, to);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+
+function parseArgs(values) {
+  const parsed = {};
+  for (let i = 0; i < values.length; i += 1) {
+    const key = values[i];
+    if (!key.startsWith("--")) continue;
+    parsed[key.slice(2).replace(/-([a-z])/g, (_, letter) => letter.toUpperCase())] = values[++i];
+  }
+  return parsed;
+}

package/mirror-root-artifact.test.mjs

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+const helper = new URL("./mirror-root-artifact.mjs", import.meta.url);
+
+test("mirrors a nested package artifact from a linked worktree into both package roots", () => {
+  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-"));
+  const main = path.join(temp, "suite");
+  const worktree = path.join(temp, "release-worktree");
+  try {
+    mkdirSync(path.join(main, "apps", "desktop"), { recursive: true });
+    git(temp, "init", "suite");
+    git(main, "config", "user.email", "test@example.com");
+    git(main, "config", "user.name", "Right Release Test");
+    writeFileSync(path.join(main, "tracked"), "fixture\n");
+    git(main, "add", "tracked");
+    git(main, "commit", "-m", "fixture");
+    git(main, "worktree", "add", worktree, "-b", "release-test");
+
+    const packageRoot = path.join(worktree, "apps", "desktop");
+    const source = path.join(packageRoot, "target", "App_1.0.0.dmg");
+    mkdirSync(path.dirname(source), { recursive: true });
+    writeFileSync(source, "signed-dmg-fixture");
+
+    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
+
+    assert.equal(readFileSync(path.join(packageRoot, "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
+    assert.equal(readFileSync(path.join(main, "apps", "desktop", "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("copies a main-worktree artifact into its package root", () => {
+  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-main-"));
+  try {
+    git(temp, "init", "app");
+    const root = path.join(temp, "app");
+    const source = path.join(root, "target", "App_2.0.0.dmg");
+    mkdirSync(path.dirname(source), { recursive: true });
+    writeFileSync(source, "main-worktree-dmg");
+
+    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", root], { encoding: "utf8" });
+
+    assert.equal(readFileSync(path.join(root, "App_2.0.0.dmg"), "utf8"), "main-worktree-dmg");
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+function git(cwd, ...args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}

package/notary-auth.mjs

@@ -0,0 +1,21 @@
+import os from "node:os";
+import path from "node:path";
+
+export function notarytoolAuthArgs({ profile = "apple-dev-notary" } = {}) {
+  const keyPath = process.env.APPLE_API_KEY_PATH?.trim();
+  const keyId = process.env.APPLE_API_KEY?.trim();
+  const issuer = process.env.APPLE_API_ISSUER?.trim();
+  const apiValues = [keyPath, keyId, issuer];
+
+  if (apiValues.every(Boolean)) {
+    return ["--key", expandHome(keyPath), "--key-id", keyId, "--issuer", issuer];
+  }
+  if (apiValues.some(Boolean)) {
+    throw new Error("Notarization API auth requires APPLE_API_KEY_PATH, APPLE_API_KEY, and APPLE_API_ISSUER together");
+  }
+  return ["--keychain-profile", profile];
+}
+
+function expandHome(value) {
+  return value === "~" ? os.homedir() : value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
+}

package/notary-auth.test.mjs

@@ -0,0 +1,30 @@
+import assert from "node:assert/strict";
+import os from "node:os";
+import test from "node:test";
+import { notarytoolAuthArgs } from "./notary-auth.mjs";
+
+test("prefers a complete App Store Connect API credential set", () => {
+  const before = { ...process.env };
+  try {
+    process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
+    process.env.APPLE_API_KEY = "KEY123";
+    process.env.APPLE_API_ISSUER = "ISSUER123";
+    assert.deepEqual(notarytoolAuthArgs(), ["--key", `${os.homedir()}/AuthKey.p8`, "--key-id", "KEY123", "--issuer", "ISSUER123"]);
+  } finally {
+    process.env = before;
+  }
+});
+
+test("falls back to the device keychain profile and rejects partial API auth", () => {
+  const before = { ...process.env };
+  try {
+    delete process.env.APPLE_API_KEY_PATH;
+    delete process.env.APPLE_API_KEY;
+    delete process.env.APPLE_API_ISSUER;
+    assert.deepEqual(notarytoolAuthArgs(), ["--keychain-profile", "apple-dev-notary"]);
+    process.env.APPLE_API_KEY = "KEY123";
+    assert.throws(() => notarytoolAuthArgs(), /requires APPLE_API_KEY_PATH.*APPLE_API_ISSUER/);
+  } finally {
+    process.env = before;
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -9,7 +9,8 @@
   "files": [
     "cli",
     "*.mjs",
-    "*.sh"
+    "*.sh",
+    "*.py"
   ],
   "sideEffects": false,
   "scripts": {
@@ -20,5 +21,10 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
-  "packageManager": "pnpm@11.9.0"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adrdsouza/claude.git",
+    "directory": "tools/rightkit/packages/release"
+  },
+  "packageManager": "pnpm@11.12.0"
 }

package/prune-r2.mjs

@@ -0,0 +1,56 @@
+const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID || "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = { public: "rightapps-downloads", private: "rightapps-updates" };
+
+export async function pruneReleaseObjects({ app, platform, keep, dryRun = false }) {
+  if (!new Set(["mac", "windows"]).has(platform)) throw new Error(`invalid R2 prune platform: ${platform}`);
+  for (const [alias, bucket] of Object.entries(BUCKETS)) {
+    const retained = new Set(keep[alias] ?? []);
+    if (dryRun) {
+      console.log(`[dry-run] PRUNE ${bucket}/${app}/${platform} keep=${[...retained].sort().join(",") || "<none>"}`);
+      continue;
+    }
+    const token = process.env.CLOUDFLARE_API_TOKEN;
+    if (!token) throw new Error("CLOUDFLARE_API_TOKEN is required to prune stale R2 release objects");
+    for (const key of await listObjects(bucket, app, token)) {
+      if (!isReleaseObject(app, platform, key) || retained.has(key)) continue;
+      console.log(`DELETE ${bucket}/${key}`);
+      await deleteObject(bucket, key, token);
+    }
+  }
+}
+
+export function isReleaseObject(app, platform, key) {
+  if (!key.startsWith(`${app}/`)) return false;
+  const relative = key.slice(app.length + 1);
+  const segments = relative.split("/");
+  if (!segments.includes(platform)) return false;
+  if (/^(?:installers|updates|updaters|releases)\//.test(relative)) return true;
+  return /^v?\d+\.\d+\.\d+(?:[-+][^/]+)?\//.test(relative);
+}
+
+async function listObjects(bucket, app, token) {
+  const objects = [];
+  let cursor = "";
+  do {
+    const url = new URL(`https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/r2/buckets/${bucket}/objects`);
+    url.searchParams.set("prefix", `${app}/`);
+    if (cursor) url.searchParams.set("cursor", cursor);
+    const response = await fetch(url, { headers: { authorization: `Bearer ${token}` } });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || body.success === false) throw new Error(`R2 list failed for ${bucket}: ${response.status}`);
+    const page = Array.isArray(body.result) ? body.result : body.result?.objects ?? [];
+    objects.push(...page.map((entry) => entry.key).filter(Boolean));
+    cursor = body.result_info?.cursor || body.result?.cursor || "";
+  } while (cursor);
+  return objects;
+}
+
+async function deleteObject(bucket, key, token) {
+  const encoded = key.split("/").map(encodeURIComponent).join("/");
+  const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/r2/buckets/${bucket}/objects/${encoded}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` },
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || body.success === false) throw new Error(`R2 delete failed for ${bucket}/${key}: ${response.status}`);
+}

package/prune-r2.test.mjs

@@ -0,0 +1,12 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { isReleaseObject } from "./prune-r2.mjs";
+
+test("pruning only targets release objects for the active OS", () => {
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/mac/ViewRight.dmg"), true);
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/updates/mac/current/ViewRight.app.tar.gz"), true);
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/windows/ViewRight-Setup.exe"), false);
+  assert.equal(isReleaseObject("viewright", "windows", "viewright/installers/mac/ViewRight.dmg"), false);
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/models/mac/model.bin"), false);
+  assert.equal(isReleaseObject("viewright", "mac", "other/installers/mac/Other.dmg"), false);
+});

package/publish-update.mjs

@@ -4,6 +4,7 @@ import { access, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
+import { pruneReleaseObjects } from "./prune-r2.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
@@ -45,6 +46,7 @@ if (tier === "patch") {
   const platforms = {};
   const registrations = new Map();
   const uploadedKeys = new Set();
+  const uploadedSignatures = new Set();
   for (const artifact of artifacts) {
     assertCurrentKey(artifact.key, "updater");
     const installerKey = patchInstallerKey(artifact);
@@ -60,6 +62,11 @@ if (tier === "patch") {
       if (!dryRun) await run(process.execPath, [UPLOAD, file, installerKey, "public"], root);
       uploadedKeys.add(installerKey);
     }
+    if (!uploadedSignatures.has(`${installerKey}.sig`)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}.sig`);
+      if (!dryRun) await run(process.execPath, [UPLOAD, signatureFile, `${installerKey}.sig`, "public"], root);
+      uploadedSignatures.add(`${installerKey}.sig`);
+    }
     const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
@@ -79,6 +86,15 @@ if (tier === "patch") {
   }
   if (!artifacts.length) {
     console.log(`${dryRun ? "[dry-run] " : ""}NO patch updater artifacts; skipping patch manifest registration`);
+    await pruneReleaseObjects({
+      app: config.app,
+      platform: platform === "mac" ? "mac" : "windows",
+      dryRun,
+      keep: {
+        public: installers.map((artifact) => artifact.key),
+        private: target.updater.artifacts.flatMap((artifact) => [artifact.key, `${artifact.key}.sig`]),
+      },
+    });
     process.exit(0);
   }
   const version = config.version || target.updater.version;
@@ -87,7 +103,7 @@ if (tier === "patch") {
     appKey: config.app,
     version,
     channel: config.channel || "stable",
-    platform: null,
+    platform: platform === "mac" ? "darwin" : "windows",
     manifest: {
       version,
       tier,
@@ -100,6 +116,15 @@ if (tier === "patch") {
   console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}/v1/admin/apps/patches`);
   console.log(JSON.stringify(body));
   if (!dryRun) await register("/v1/admin/apps/patches", body);
+  await pruneReleaseObjects({
+    app: config.app,
+    platform: platform === "mac" ? "mac" : "windows",
+    dryRun,
+    keep: {
+      public: [...installers.map((artifact) => artifact.key), ...registrations.keys(), ...[...registrations.keys()].map((key) => `${key}.sig`)],
+      private: [],
+    },
+  });
   process.exit(0);
 }
 
@@ -108,6 +133,7 @@ if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no u
 const platforms = {};
 const registrations = new Map();
 const uploadedKeys = new Set();
+const uploadedSignatures = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = path.resolve(root, artifact.file);
@@ -121,6 +147,11 @@ for (const artifact of artifacts) {
     if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);
     uploadedKeys.add(artifact.key);
   }
+  if (!uploadedSignatures.has(`${artifact.key}.sig`)) {
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}.sig`);
+    if (!dryRun) await run(process.execPath, [UPLOAD, signatureFile, `${artifact.key}.sig`, "private"], root);
+    uploadedSignatures.add(`${artifact.key}.sig`);
+  }
 
   const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
@@ -138,7 +169,7 @@ const body = {
   appKey: config.app,
   version,
   channel: config.channel || "stable",
-  platform: null,
+  platform: platform === "mac" ? "darwin" : "windows",
   manifest: {
     version,
     tier,
@@ -153,6 +184,15 @@ console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
 console.log(JSON.stringify(body));
 
 if (!dryRun) await register(route, body);
+await pruneReleaseObjects({
+  app: config.app,
+  platform: platform === "mac" ? "mac" : "windows",
+  dryRun,
+  keep: {
+    public: installers.map((artifact) => artifact.key),
+    private: [...registrations.keys(), ...[...registrations.keys()].map((key) => `${key}.sig`)],
+  },
+});
 
 async function fileMetadata(file) {
   const bytes = await readFile(file);

package/publish-update.test.mjs

@@ -91,6 +91,10 @@ test("patch registers a free updater manifest backed by public installer-path ob
   assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
   assert.match(result.stdout, /"tier":"patch"/);
+  assert.match(result.stdout, /"platform":"windows"/);
+  assert.equal((result.stdout.match(/UPLOAD public\/fixture\/installers\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
+  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
+  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
 });
 
 test("routes feature updates to the Pro-gated release endpoint", () => {
@@ -98,8 +102,12 @@ test("routes feature updates to the Pro-gated release endpoint", () => {
   assert.equal(result.status, 0, result.stderr);
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/releases/);
   assert.match(result.stdout, /"tier":"update"/);
+  assert.match(result.stdout, /"platform":"windows"/);
   assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
-  assert.doesNotMatch(result.stdout, /Fixture-Setup\.exe/);
+  assert.equal((result.stdout.match(/UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
+  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
+  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
+  assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
 });
 
 test("allows an installer-only patch without registering an updater manifest", () => {
@@ -113,6 +121,7 @@ test("allows an installer-only patch without registering an updater manifest", (
   assert.match(result.stdout, /NO patch updater artifacts/);
   assert.doesNotMatch(result.stdout, /\/v1\/admin\/apps\/patches/);
   assert.doesNotMatch(result.stdout, /UPLOAD private\//);
+  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
 });
 
 test("refuses to publish without a valid tier", () => {

package/release.mjs

@@ -10,7 +10,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.9";
+const VERSION = "0.2.11";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.5"],
@@ -181,8 +181,8 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
-  if (JSON.stringify(scripts).includes("../tools/right-release")) {
-    fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not ../tools/right-release/*`);
+  if (JSON.stringify(scripts).includes("../tools/right-release") || JSON.stringify(scripts).includes("../tools/rightkit/packages/release")) {
+    fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not parent-workspace release source`);
   }
   const rightKitDeps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
   for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {

package/release.test.mjs

@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.9" },
+        devDependencies: { "@rightkit/release": "^0.2.11" },
       },
       null,
       2,
@@ -57,7 +57,7 @@ function lockFixture() {
         name: "fixture-lock",
         scripts: { "release:patch:mac": "right-release --platform mac --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.9" },
+        devDependencies: { "@rightkit/release": "^0.2.11" },
       },
       null,
       2,

package/right-suite-contract.test.mjs

@@ -1,20 +1,20 @@
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import test from "node:test";
 
-const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.5";
 const logsPackage = "^0.1.3";
-const releasePackage = "^0.2.9";
+const releasePackage = "^0.2.11";
 const apps = [
-  { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
-  { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },
-  { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", host: "heardright.app" },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", host: "mailright.cc" },
-  { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", host: "coderight.cc" },
+  { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
+  { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
+  { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
+  { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
 for (const app of apps) {
@@ -29,6 +29,7 @@ for (const app of apps) {
     if (rightKitDeps["@rightkit/logs"]) assert.equal(rightKitDeps["@rightkit/logs"], logsPackage);
     assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
+    assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/rightkit/packages/release"));
     assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
     assert.equal(pkg.scripts["release:mac"], "right-release --platform mac");
@@ -43,7 +44,9 @@ for (const app of apps) {
     assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
+    assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /mac|dmg/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} must not expose an unsigned macOS DMG mode`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/right-release"), `${app.key} scripts must not depend on the parent Claude workspace`);
+    assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/rightkit/packages/release"), `${app.key} scripts must not depend on the parent Claude workspace`);
 
     const config = (await import(`${pathToFileURL(path.join(root, "right-release.config.mjs"))}?contract=${Date.now()}`)).default;
     assert.equal(config.app, app.key);
@@ -63,6 +66,10 @@ for (const app of apps) {
         assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
       }
     }
+    assert.match(config.targets.mac.package.args.join(" "), /mac:dmg:notarized|--notarize/, `${app.key} publish packaging must use the notarized macOS lane`);
+    for (const installer of config.targets.mac.installer.artifacts) {
+      assert.equal(path.dirname(installer.file), ".", `${app.key} macOS installer must be copied to the app package root before upload`);
+    }
     assert.ok(config.targets.win.sign.files.length);
     const winUpdaterFiles = new Set(config.targets.win.updater.artifacts.map((artifact) => artifact.file));
     for (const signed of config.targets.win.sign.files) assert.ok(winUpdaterFiles.has(signed), `${signed} must be both Azure-signed and updater-signed`);
@@ -70,10 +77,17 @@ for (const app of apps) {
     const tauri = JSON.parse(readFileSync(path.join(root, app.tauri), "utf8"));
     assert.equal(tauri.plugins.updater.pubkey, pubkey);
     assert.deepEqual(tauri.plugins.updater.endpoints, [
-      `https://${app.host}/releases/patches.json`,
-      `https://${app.host}/releases/latest.json`,
+      `https://api.spoares.com/v1/apps/${app.key}/releases/latest.json?platform={{target}}`,
     ]);
     assert.equal(tauri.bundle.createUpdaterArtifacts, true);
+    for (const releaseFile of app.releaseFiles) {
+      const source = readFileSync(path.join(root, releaseFile), "utf8");
+      assert.doesNotMatch(source, /(?:\.\.\/)+tools\/right-release|tools\/right-release\//, `${app.key} ${releaseFile} must consume the installed package`);
+      assert.match(source, /right-release["']?,?\s*["']mirror-root-artifact|right-release mirror-root-artifact/, `${app.key} ${releaseFile} must mirror the final DMG to the canonical package root`);
+    }
+    for (const forbidden of ["scripts/build-mac-unsigned.sh", "package-unsigned.sh"]) {
+      assert.equal(existsSync(path.join(root, forbidden)), false, `${app.key} must not ship ${forbidden}`);
+    }
   });
 }