@rightkit/release 0.6.3 → 0.6.4

package/rightkit-drift.mjs

@@ -91,7 +91,7 @@ export function applyRightkitAdoption(appRoot, versions = loadRightkitVersions()
     for (const file of byFile.keys()) {
       const dir = path.join(appRoot, path.dirname(file));
       if (file.endsWith("package.json")) run("pnpm", ["install", "--lockfile-only", "--ignore-scripts"], dir);
-      else run("rightkit", ["cargo", "metadata", "--format-version", "1", "--manifest-path", path.join(appRoot, file)], dir);
+      else run("rustright", ["cargo", "metadata", "--format-version", "1", "--manifest-path", path.join(appRoot, file)], dir);
     }
   }
   return drift;

package/rightkit-ownership.json

@@ -1023,7 +1023,7 @@
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
-        "Discovery alias so `rightkit owns docx` resolves to the document-io owner; carries no fingerprints of its own."
+        "Discovery alias so `rustright owns docx` resolves to the document-io owner; carries no fingerprints of its own."
       ]
     },
     {
@@ -1033,7 +1033,7 @@
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
-        "Discovery alias so `rightkit owns xlsx` resolves to the document-io owner; carries no fingerprints of its own."
+        "Discovery alias so `rustright owns xlsx` resolves to the document-io owner; carries no fingerprints of its own."
       ]
     },
     {
@@ -1043,7 +1043,7 @@
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
-        "Discovery alias so `rightkit owns document` resolves to the document-io owner; carries no fingerprints of its own."
+        "Discovery alias so `rustright owns document` resolves to the document-io owner; carries no fingerprints of its own."
       ]
     },
     {
@@ -1053,7 +1053,7 @@
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
-        "Discovery alias so `rightkit owns spreadsheet` resolves to the document-io owner; carries no fingerprints of its own."
+        "Discovery alias so `rustright owns spreadsheet` resolves to the document-io owner; carries no fingerprints of its own."
       ]
     },
     {
@@ -1661,6 +1661,16 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-license",
+      "capability": "right-suite-api",
+      "summary": "The Right Suite API host and endpoint contract (contracts/right-suite-api.v1.json): canonical API host, updater and release-status paths, per-app artifact hosts. Rust projection rightkit_license::suite_api, TS @rightkit/app-update/suite-api; apps never write the host.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Enforcement: the @rightkit/release pre-build gate suite-api-literal ships with this contract and is wired into the build after the app migrations (L1-L5); no ownership fingerprint."
+      ]
+    },
     {
       "package": "rightkit-llm",
       "capability": "llm-providers",
@@ -2469,7 +2479,7 @@
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
-        "Discovery alias so `rightkit owns pdf` resolves to the PDF owner; carries no fingerprints of its own."
+        "Discovery alias so `rustright owns pdf` resolves to the PDF owner; carries no fingerprints of its own."
       ]
     },
     {

package/rightkit-versions.json

@@ -1,6 +1,6 @@
 {
   "schema": 2,
-  "packageManager": "pnpm@11.24.0",
+  "packageManager": "pnpm@11.25.0",
   "npm": {
     "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.2.0",
@@ -13,7 +13,7 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/app-update": "0.4.1",
+    "@rightkit/app-update": "0.4.2",
     "@rightkit/ax": "0.3.2",
     "@rightkit/ci": "0.3.0",
     "@rightkit/doc-render": "0.2.1",
@@ -32,10 +32,10 @@
     "@rightkit/qa": "0.6.1",
     "@rightkit/qa-chrome": "0.1.11",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.3",
+    "@rightkit/release": "0.6.4",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
-    "@rightkit/tauri-shell": "0.1.2",
+    "@rightkit/tauri-shell": "0.1.3",
     "@rightkit/theme": "0.3.1"
   },
   "legacyNpm": {
@@ -229,7 +229,8 @@
       "0.5.1",
       "0.6.0",
       "0.6.1",
-      "0.6.2"
+      "0.6.2",
+      "0.6.3"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -407,14 +408,16 @@
     "@rightkit/app-update": [
       "0.2.5",
       "0.3.0",
-      "0.4.0"
+      "0.4.0",
+      "0.4.1"
     ],
     "@rightkit/logs": [
       "0.1.4",
       "0.1.5"
     ],
     "@rightkit/tauri-shell": [
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ]
   },
   "cargo": {
@@ -441,11 +444,11 @@
     "rightkit-app-settings": "0.3.0",
     "rightkit-asr": "0.3.0",
     "rightkit-audio": "0.3.1",
-    "rightkit-automation": "0.6.0",
+    "rightkit-automation": "0.6.1",
     "rightkit-browser": "0.3.6",
     "rightkit-cache": "0.2.3",
     "rightkit-channel-memory": "0.2.1",
-    "rightkit-child-process": "0.5.5",
+    "rightkit-child-process": "0.5.6",
     "rightkit-compose": "0.2.0",
     "rightkit-contracts": "0.1.7",
     "rightkit-crash": "0.3.6",
@@ -458,15 +461,15 @@
     "rightkit-embed": "0.6.1",
     "rightkit-ffmpeg": "0.2.10",
     "rightkit-file-watch": "0.4.1",
-    "rightkit-fs": "0.4.6",
+    "rightkit-fs": "0.4.7",
     "rightkit-fsindex": "0.5.0",
     "rightkit-google-identity": "0.2.0",
     "rightkit-hooks": "0.2.0",
     "rightkit-hotkeys": "0.1.2",
     "rightkit-http": "0.3.8",
     "rightkit-identity": "0.1.0",
-    "rightkit-job-queue": "0.5.0",
-    "rightkit-license": "0.2.4",
+    "rightkit-job-queue": "0.5.1",
+    "rightkit-license": "0.2.5",
     "rightkit-llm": "0.3.1",
     "rightkit-logs": "0.3.5",
     "rightkit-mcp": "0.7.0",
@@ -477,11 +480,11 @@
     "rightkit-onnx": "0.2.7",
     "rightkit-overlay": "0.2.0",
     "rightkit-overlay-win": "0.1.0",
-    "rightkit-ownership": "0.4.1",
+    "rightkit-ownership": "0.4.2",
     "rightkit-pdf": "0.3.3",
     "rightkit-platform-rules": "0.1.0",
     "rightkit-playback": "0.3.0",
-    "rightkit-qa": "0.8.0",
+    "rightkit-qa": "0.9.0",
     "rightkit-qa-driver": "0.7.0",
     "rightkit-record": "0.3.3",
     "rightkit-review": "0.4.0",
@@ -492,7 +495,7 @@
     "rightkit-speech-client": "0.4.0",
     "rightkit-spend": "0.2.0",
     "rightkit-sync": "0.2.2",
-    "rightkit-tauri-shell": "0.5.1",
+    "rightkit-tauri-shell": "0.6.0",
     "rightkit-time": "0.1.0",
     "rightkit-transcript": "0.4.0",
     "rightkit-tts": "0.2.3",
@@ -524,7 +527,7 @@
       "rightkit-app-settings": "0.3.0",
       "rightkit-asr": "0.3.0",
       "rightkit-audio": "0.3.1",
-      "rightkit-automation": "0.6.0",
+      "rightkit-automation": "0.6.1",
       "rightkit-browser": "0.3.6",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
@@ -543,16 +546,16 @@
       "rightkit-ffmpeg": "0.2.10",
       "rightkit-file-watch": "0.4.1",
       "rightkit-framed-sidecar": "0.2.0",
-      "rightkit-fs": "0.4.6",
+      "rightkit-fs": "0.4.7",
       "rightkit-fsindex": "0.5.0",
       "rightkit-google-identity": "0.2.0",
       "rightkit-hooks": "0.2.0",
       "rightkit-hotkeys": "0.1.2",
       "rightkit-http": "0.3.8",
       "rightkit-identity": "0.1.0",
-      "rightkit-job-queue": "0.5.0",
+      "rightkit-job-queue": "0.5.1",
       "rightkit-jobs": "0.3.0",
-      "rightkit-license": "0.2.4",
+      "rightkit-license": "0.2.5",
       "rightkit-llm": "0.3.1",
       "rightkit-logs": "0.3.5",
       "rightkit-mcp": "0.7.0",
@@ -565,7 +568,7 @@
       "rightkit-ort": "0.2.3",
       "rightkit-overlay": "0.2.0",
       "rightkit-overlay-win": "0.1.0",
-      "rightkit-ownership": "0.4.1",
+      "rightkit-ownership": "0.4.2",
       "rightkit-pdf": "0.3.3",
       "rightkit-platform-rules": "0.1.0",
       "rightkit-playback": "0.3.0",
@@ -589,7 +592,7 @@
       "rightkit-spend": "0.2.0",
       "rightkit-sync": "0.2.2",
       "rightkit-tauri": "0.1.3",
-      "rightkit-tauri-shell": "0.5.1",
+      "rightkit-tauri-shell": "0.6.0",
       "rightkit-time": "0.1.0",
       "rightkit-transcript": "0.4.0",
       "rightkit-tts": "0.2.3",
@@ -603,7 +606,7 @@
     },
     "npm": {
       "@rightkit/app-shell": "0.6.2",
-      "@rightkit/app-update": "0.4.1",
+      "@rightkit/app-update": "0.4.2",
       "@rightkit/ax": "0.3.2",
       "@rightkit/ci": "0.3.0",
       "@rightkit/doc-render": "0.2.1",
@@ -623,11 +626,11 @@
       "@rightkit/qa": "0.6.1",
       "@rightkit/qa-chrome": "0.1.11",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.6.2",
+      "@rightkit/release": "0.6.3",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
-      "@rightkit/tauri-shell": "0.1.2",
+      "@rightkit/tauri-shell": "0.1.3",
       "@rightkit/theme": "0.3.1",
       "@rightkit/updates": "0.2.5"
     }
@@ -637,7 +640,8 @@
       "0.2.0",
       "0.2.1",
       "0.3.1",
-      "0.4.0"
+      "0.4.0",
+      "0.4.1"
     ],
     "rightkit-browser": [
       "0.2.0",
@@ -755,7 +759,8 @@
       "0.6.1",
       "0.6.4",
       "0.7.0",
-      "0.7.1"
+      "0.7.1",
+      "0.8.0"
     ],
     "rightkit-sandbox": [
       "0.1.0",
@@ -828,7 +833,8 @@
       "0.4.1",
       "0.4.3",
       "0.4.4",
-      "0.4.5"
+      "0.4.5",
+      "0.4.6"
     ],
     "rightkit-service": [
       "0.1.0",
@@ -936,7 +942,8 @@
       "0.3.0",
       "0.3.1",
       "0.3.2",
-      "0.4.0"
+      "0.4.0",
+      "0.5.0"
     ],
     "rightkit-qa-driver": [
       "0.3.0",
@@ -958,7 +965,8 @@
       "0.4.0",
       "0.4.1",
       "0.4.4",
-      "0.5.0"
+      "0.5.0",
+      "0.6.0"
     ],
     "rightkit-child-process": [
       "0.4.0",
@@ -968,7 +976,8 @@
       "0.5.1",
       "0.5.2",
       "0.5.3",
-      "0.5.4"
+      "0.5.4",
+      "0.5.5"
     ],
     "rightkit-hotkeys": [
       "0.1.0",
@@ -1007,7 +1016,8 @@
     "rightkit-license": [
       "0.2.0",
       "0.2.2",
-      "0.2.3"
+      "0.2.3",
+      "0.2.4"
     ],
     "rightkit-credentials": [
       "0.2.0",
@@ -1065,7 +1075,8 @@
       "0.3.2",
       "0.3.3",
       "0.4.0",
-      "0.5.0"
+      "0.5.0",
+      "0.5.1"
     ],
     "rightkit-android": [
       "0.2.0"

package/stage-sidecar.mjs

@@ -1,6 +1,6 @@
 // Declarative engine and sidecar staging for Tauri externalBin (bogusyogi/rightkit#345).
 //
-// Eight apps hand-rolled the same script: build an engine through `rightkit cargo`, find the executable, copy it to
+// Eight apps hand-rolled the same script: build an engine through `rustright cargo`, find the executable, copy it to
 // src-tauri/binaries/<name>-<target-triple>[.exe], stage ffmpeg, stage onnxruntime, copy model resources. This module is
 // that script, driven by a `sidecars` list in right-release.config.mjs:
 //
@@ -19,7 +19,7 @@
 // then not an externalBin. `clean: true` removes a stale file at the destination before staging. The wrapper key
 // `wipeStageDir: true` removes stale files named exactly `<name>-<current triple>[.exe]` for a declared name this run no longer produces.
 //
-// `catalog` is a relative path, an absolute path, { crate: "rightkit-ffmpeg", file? } (resolved through `rightkit cargo
+// `catalog` is a relative path, an absolute path, { crate: "rightkit-ffmpeg", file? } (resolved through `rustright cargo
 // metadata`) or { npm: "<pkg>/<file>" }. The wrapper form { sidecars, profiles: { dev, release } } sets the default cargo
 // profile pair; RIGHTKIT_BUILD_MODE (dev|release, default release) selects. The target `universal-apple-darwin` builds
 // both slices of a cargo-bin and lipo-creates `<name>-universal-apple-darwin`. `ffmpeg` and `onnxruntime` do the same from their
@@ -122,13 +122,13 @@ export function parseTargetTriple(target) {
   return { triple: target, ...row };
 }
 
-/** `--target`, then TAURI_ENV_TARGET_TRIPLE, then the host triple from `rightkit rustc -vV`. */
+/** `--target`, then TAURI_ENV_TARGET_TRIPLE, then the host triple from `rustright rustc -vV`. */
 export function resolveTargetTriple({ target, env = process.env, run = defaultRun, cwd = process.cwd() } = {}) {
   if (target) return target;
   if (env.TAURI_ENV_TARGET_TRIPLE) return env.TAURI_ENV_TARGET_TRIPLE;
-  const result = run("rightkit", ["rustc", "-vV"], { cwd, env });
+  const result = run("rustright", ["rustc", "-vV"], { cwd, env });
   const host = result?.stdout?.match(/^host:\s*(.+)$/m)?.[1]?.trim();
-  if (!host || result.status !== 0) fail("STAGE_SIDECAR_TARGET_UNKNOWN", "cannot determine the host triple (rightkit rustc -vV failed); pass a target");
+  if (!host || result.status !== 0) fail("STAGE_SIDECAR_TARGET_UNKNOWN", "cannot determine the host triple (rustright rustc -vV failed); pass a target");
   return host;
 }
 
@@ -354,7 +354,8 @@ export function validateSidecarManifest(raw, { target, mode = "release" } = {})
       Object.assign(entry, { package: item.package, bin, name, profile, features: [...features], ...(manifestPath ? { manifestPath } : {}), ...(item.sha256 ? { sha256: item.sha256 } : {}), ...(dest ? { dest } : {}), ...(clean ? { clean } : {}) });
     } else if (item.kind === "ffmpeg") {
       const { kind: _kind, platforms: _platforms, catalog: rawCatalog, sources: rawSources, probe: rawProbe, ...rest } = item;
-      if (rest.stage !== undefined && isObject(rest.stage) && rest.stage.cmd === "cargo") errors.push(`${where}: stage.cmd must not be bare cargo; use { cmd: "rightkit", args: ["cargo", ...] }`);
+      if (rest.stage !== undefined && isObject(rest.stage) && rest.stage.cmd === "cargo") errors.push(`${where}: stage.cmd must not be bare cargo; use { cmd: "rustright", args: ["cargo", ...] }`);
+      if (rest.stage !== undefined && isObject(rest.stage) && rest.stage.cmd === "rightkit") errors.push(`${where}: stage.cmd "rightkit" is the retired name of the RustRight client (rustright#91); use { cmd: "rustright", args: ["cargo", ...] }`);
       const catalogSpec = parseCatalogSpec(rawCatalog, `${where}: catalog`, errors, "ffmpeg");
       if (catalogSpec) entry.catalogSpec = catalogSpec;
       if (rawProbe !== undefined && typeof rawProbe !== "boolean") errors.push(`${where}: probe must be a boolean`);
@@ -513,9 +514,10 @@ function catalogContentDigest(bytes, arch) {
 const profileDirectory = (profile) => (profile === "dev" || profile === "test" ? "debug" : profile === "bench" ? "release" : profile);
 const tail = (text, lines = 12) => String(text ?? "").trim().split("\n").slice(-lines).join("\n");
 
-/** Default process runner: `rightkit` resolves through the installed runtime client (as the apps' scripts did). */
+/** Default process runner: `rustright` resolves through the installed runtime client (its Windows shim is rustright.cmd). */
 export function defaultRun(command, args, { cwd, env = process.env } = {}) {
-  const launch = command === "rightkit" ? resolveCommand("rightkit", args, { root: cwd, env }) : { command, args };
+  if (command === "rightkit") throw new Error("`rightkit` is the retired name of the RustRight client (rustright#91); use rustright (stage: { cmd: \"rustright\" })");
+  const launch = command === "rustright" ? resolveCommand(command, args, { root: cwd, env }) : { command, args };
   return nodeSpawnSync(launch.command, launch.args, {
     cwd, env: { ...env, ...(launch.env ?? {}) }, encoding: "utf8", maxBuffer: 512 * 1024 * 1024, shell: false, windowsHide: true, stdio: ["inherit", "pipe", "inherit"],
   });
@@ -561,7 +563,7 @@ function resolveCatalogFile(spec, ctx, kind) {
   if (spec.via === "absolute") return spec.file;
   if (spec.via === "path") return path.resolve(ctx.appRoot, spec.file);
   if (spec.via === "crate") {
-    const meta = ctx.run("rightkit", ["cargo", "metadata", "--format-version", "1"], { cwd: ctx.appRoot, env: ctx.env });
+    const meta = ctx.run("rustright", ["cargo", "metadata", "--format-version", "1"], { cwd: ctx.appRoot, env: ctx.env });
     let packages;
     try { packages = JSON.parse(meta.stdout).packages; } catch { /* refused below */ }
     if (meta?.status !== 0 || !Array.isArray(packages)) fail("STAGE_SIDECAR_CATALOG_UNREADABLE", `the ${label} catalog crate ${spec.crate} cannot be located: the workspace metadata query failed`, { crate: spec.crate });
@@ -737,18 +739,18 @@ function stageCargoSlice(entry, ctx, triple, { dest }) {
   return [{ kind: "cargo-bin", name: entry.name, path: rel(ctx, dest), ...copied, sourceSha256, package: entry.package, bin: entry.bin, profile: entry.profile, features: entry.features, externalBin: !entry.dest }];
 }
 
-/** Build one slice through `rightkit cargo` and locate the executable. Returns { source, sourceSha256 }. */
+/** Build one slice through `rustright cargo` and locate the executable. Returns { source, sourceSha256 }. */
 function stageCargoBuild(entry, ctx, triple) {
   const { run, appRoot, env, fs } = ctx;
   const args = ["cargo", "build", "--locked", ...(entry.manifestPath ? ["--manifest-path", path.resolve(appRoot, entry.manifestPath)] : []),
     "-p", entry.package, "--bin", entry.bin, "--target", triple, "--profile", entry.profile,
     ...(entry.features.length ? ["--features", entry.features.join(",")] : []), "--message-format=json-render-diagnostics"];
   ctx.log(`stage-sidecar: rightkit ${args.join(" ")}`);
-  const built = run("rightkit", args, { cwd: appRoot, env });
-  if (built?.error || built?.status !== 0) fail("STAGE_SIDECAR_BUILD_FAILED", `rightkit cargo build of ${entry.package} failed (${built?.error?.message ?? `exit ${built?.status}`})`, { package: entry.package, stderr: tail(built?.stderr) });
+  const built = run("rustright", args, { cwd: appRoot, env });
+  if (built?.error || built?.status !== 0) fail("STAGE_SIDECAR_BUILD_FAILED", `rustright cargo build of ${entry.package} failed (${built?.error?.message ?? `exit ${built?.status}`})`, { package: entry.package, stderr: tail(built?.stderr) });
   let source = artifactFromStream(built.stdout, entry.bin);
   if (!source || !fs.existsSync(source)) {
-    const meta = run("rightkit", ["cargo", "metadata", "--format-version", "1", "--no-deps", ...(entry.manifestPath ? ["--manifest-path", path.resolve(appRoot, entry.manifestPath)] : [])], { cwd: appRoot, env });
+    const meta = run("rustright", ["cargo", "metadata", "--format-version", "1", "--no-deps", ...(entry.manifestPath ? ["--manifest-path", path.resolve(appRoot, entry.manifestPath)] : [])], { cwd: appRoot, env });
     let targetDir;
     try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
     if (meta?.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) targetDir = undefined;
@@ -1378,12 +1380,12 @@ export function isNestedBrokerContext(env = process.env) {
   return insideTauri && (managedHost(env ?? {}) || env?.RIGHTSUITE_HEAVY_WORK_OWNER === "1");
 }
 
-/** True when staging would call `rightkit cargo` for a non-skipped entry. */
+/** True when staging would call `rustright cargo` for a non-skipped entry. */
 const needsBroker = (plan) => plan.entries.some((entry) => !entry.skipped && (entry.kind === "cargo-bin" || entry.catalogSpec?.via === "crate"));
 
 function assertNotNested(plan, env) {
   if (needsBroker(plan) && isNestedBrokerContext(env)) {
-    fail(NESTED_BROKER_CODE, "stage-sidecar needs `rightkit cargo`, but it is running inside an outer broker build (a Tauri beforeBuildCommand/beforeDevCommand on a managed host), where a nested broker call exits 125. Run stage-sidecar in the recipe `prepare` step, before the Tauri build (or call it from your own script before `tauri build`), not from beforeBuildCommand.");
+    fail(NESTED_BROKER_CODE, "stage-sidecar needs `rustright cargo`, but it is running inside an outer broker build (a Tauri beforeBuildCommand/beforeDevCommand on a managed host), where a nested broker call exits 125. Run stage-sidecar in the recipe `prepare` step, before the Tauri build (or call it from your own script before `tauri build`), not from beforeBuildCommand.");
   }
 }
 

package/suite-api-literal.mjs

@@ -0,0 +1,109 @@
+// Pre-build gate `suite-api-literal`: an app must not carry a Right Suite API host literal. The owner (RightKit) supplies
+// the host, the updater endpoint and the artifact allowlists through @rightkit/app-update/suite-api and the native shell.
+// Source of truth: contracts/right-suite-api.v1.json, read here through its generated projection.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import {
+  RIGHT_SUITE_API_CONTRACT,
+  RIGHT_SUITE_API_HOST,
+  RIGHT_SUITE_API_ORIGIN,
+  RIGHT_SUITE_GATED_ARTIFACT_HOST,
+  RIGHT_SUITE_LEGACY_HOSTS,
+  RIGHT_SUITE_PUBLIC_ARTIFACT_HOST,
+  RIGHT_SUITE_UPDATER_MANIFEST_PATH,
+} from "./suite-api.generated.mjs";
+
+/** Every host the contract names: the API host, its legacy hosts, and both artifact hosts. */
+export const SUITE_API_CONTRACT_HOSTS = Object.freeze([
+  RIGHT_SUITE_API_HOST,
+  ...RIGHT_SUITE_LEGACY_HOSTS,
+  RIGHT_SUITE_GATED_ARTIFACT_HOST,
+  RIGHT_SUITE_PUBLIC_ARTIFACT_HOST,
+]);
+
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+// A host literal is refused as a whole name: a neighbouring label or hyphen does not make a different host.
+const HOST_PATTERNS = SUITE_API_CONTRACT_HOSTS.map((host) => ({
+  host,
+  pattern: new RegExp(`(?<![A-Za-z0-9-])${escapeRegExp(host)}(?![A-Za-z0-9-])`, "giu"),
+}));
+
+/** The one updater endpoint a pending app may keep in its tauri conf (contract pendingNativeUpdater). */
+export function pendingUpdaterEndpoint(appKey) {
+  return `${RIGHT_SUITE_API_ORIGIN}${RIGHT_SUITE_UPDATER_MANIFEST_PATH.split("{app}").join(appKey)}`;
+}
+
+function trackedFiles(root) {
+  const result = spawnSync("git", ["ls-files", "-z"], { cwd: root, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(`suite-api-literal: cannot list tracked files under ${root}: ${(result.stderr ?? "").trim()}`);
+  return result.stdout.split("\0").filter(Boolean).map((file) => file.split(path.sep).join("/"));
+}
+
+const isExcluded = (file) => /\.md$/iu.test(file) || file === "docs" || file.startsWith("docs/");
+
+/**
+ * Scan the app's tracked, non-Markdown files for Right Suite API host literals.
+ * `appKey` is the app's identity (right-release config `app`). Returns findings `{ file, line, host, kind, detail }`;
+ * `file` is relative to `root` with forward slashes. Empty array means the app carries no literal.
+ *
+ * Refused: (a) any contract host in any tracked file; (b) `plugins.updater.endpoints` in a `tauri*.conf.json` of an app the
+ * contract lists under `apps`; (c) a host in a Tauri capability JSON scope (`capabilities/*.json`).
+ * Exception: for an app in `pendingNativeUpdater`, its conf may keep `plugins.updater.endpoints` when that array is exactly
+ * the one contract updater endpoint for the app. Only that exact string is exempt from the host scan.
+ */
+export function suiteApiLiteralFindings({ root, appKey, contract = RIGHT_SUITE_API_CONTRACT }) {
+  const findings = [];
+  const inContract = typeof appKey === "string" && Object.hasOwn(contract.apps ?? {}, appKey);
+  const pending = typeof appKey === "string" && (contract.pendingNativeUpdater ?? []).includes(appKey);
+  const allowedEndpoint = typeof appKey === "string" ? pendingUpdaterEndpoint(appKey) : null;
+
+  for (const file of trackedFiles(root)) {
+    if (isExcluded(file)) continue;
+    const absolute = path.join(root, file);
+    if (!existsSync(absolute) || !statSync(absolute).isFile()) continue;
+    const buffer = readFileSync(absolute);
+    if (buffer.includes(0)) continue;
+    let text = buffer.toString("utf8");
+    const base = path.posix.basename(file);
+    const isTauriConf = /^tauri.*\.conf\.json$/iu.test(base);
+    const isCapability = /(^|\/)capabilities\/[^/]+\.json$/iu.test(file);
+
+    if (isTauriConf && inContract && text.includes("endpoints")) {
+      let endpoints;
+      let parsed = true;
+      try { endpoints = JSON.parse(text)?.plugins?.updater?.endpoints; } catch { parsed = false; }
+      if (!parsed) {
+        findings.push({ file, line: 1, host: "(unparseable)", kind: "updater-endpoints", detail: "tauri conf cannot be parsed, so its updater endpoints cannot be verified" });
+      } else if (endpoints !== undefined) {
+        const exact = pending && Array.isArray(endpoints) && endpoints.length === 1 && endpoints[0] === allowedEndpoint;
+        if (exact) {
+          // Remove only the exact contract string; line count is unchanged because the string has no newline.
+          text = text.split(allowedEndpoint).join("");
+        } else {
+          const line = text.split("\n").findIndex((candidate) => candidate.includes("endpoints")) + 1 || 1;
+          findings.push({ file, line, host: "plugins.updater.endpoints", kind: "updater-endpoints", detail: "updater endpoints must be absent; the shell supplies the endpoint from @rightkit/app-update/suite-api" });
+        }
+      }
+    }
+
+    const lines = text.split("\n");
+    lines.forEach((content, index) => {
+      for (const { host, pattern } of HOST_PATTERNS) {
+        pattern.lastIndex = 0;
+        if (!pattern.test(content)) continue;
+        pattern.lastIndex = 0;
+        const kind = isCapability && file.endsWith(".json") ? "capability-scope" : "host-literal";
+        findings.push({ file, line: index + 1, host, kind, detail: kind === "capability-scope" ? "capability scope names a Right Suite API host" : "Right Suite API host literal" });
+      }
+    });
+  }
+  return findings;
+}
+
+/** The gate's refusal text: one line per finding, `file:line` and the host, so the author can fix each site. */
+export function suiteApiLiteralDetail(appKey, findings) {
+  return `${appKey ?? "app"} carries Right Suite API host literals (contract right-suite-api.v1); use @rightkit/app-update/suite-api or the native update host:\n${findings
+    .map((finding) => `- ${finding.file}:${finding.line}: ${finding.host} (${finding.kind})`)
+    .join("\n")}`;
+}

package/suite-api.generated.mjs

@@ -0,0 +1,78 @@
+// GENERATED by scripts/gen-suite-api.mjs from contracts/right-suite-api.v1.json; do not edit.
+// Right Suite API host constants (contract right-suite-api.v1) for @rightkit/release.
+
+export const RIGHT_SUITE_API_HOST = "api.orthiclabs.com";
+export const RIGHT_SUITE_API_ORIGIN = "https://api.orthiclabs.com";
+export const RIGHT_SUITE_LEGACY_HOSTS = ["api.spoares.com"];
+export const RIGHT_SUITE_UPDATER_MANIFEST_PATH = "/v1/apps/{app}/releases/latest.json?platform={{target}}";
+export const RIGHT_SUITE_RELEASE_STATUS_PATH = "/v1/apps/{app}/releases/status.json";
+export const RIGHT_SUITE_ADMIN_PATCHES_PATH = "/v1/admin/apps/patches";
+export const RIGHT_SUITE_ADMIN_RELEASES_PATH = "/v1/admin/apps/releases";
+export const RIGHT_SUITE_ADMIN_RUNTIME_ARTIFACTS_PATH = "/v1/admin/apps/runtime-artifacts";
+export const RIGHT_SUITE_GATED_ARTIFACT_HOST = "rightapps-license-gate.adrdsouza.workers.dev";
+export const RIGHT_SUITE_PUBLIC_ARTIFACT_HOST = "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
+export const RIGHT_SUITE_PUBLIC_INSTALLER_BASE = "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
+export const RIGHT_SUITE_ARTIFACT_PATH_PREFIX = "/{app}";
+export const APP_ARTIFACT_HOSTS = {
+  "coderight": [
+    "rightapps-license-gate.adrdsouza.workers.dev",
+    "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev"
+  ],
+  "heardright": [
+    "rightapps-license-gate.adrdsouza.workers.dev",
+    "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev"
+  ],
+  "mailright": [
+    "rightapps-license-gate.adrdsouza.workers.dev",
+    "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev"
+  ],
+  "viewright": [
+    "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev"
+  ]
+};
+export const RIGHT_SUITE_API_CONTRACT = {
+  "apps": {
+    "coderight": {
+      "artifactHosts": [
+        "gated",
+        "public"
+      ]
+    },
+    "heardright": {
+      "artifactHosts": [
+        "gated",
+        "public"
+      ]
+    },
+    "mailright": {
+      "artifactHosts": [
+        "gated",
+        "public"
+      ]
+    },
+    "viewright": {
+      "artifactHosts": [
+        "public"
+      ]
+    }
+  },
+  "artifactHostSets": {
+    "gated": "rightapps-license-gate.adrdsouza.workers.dev",
+    "public": "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev"
+  },
+  "artifactPathPrefix": "/{app}",
+  "host": "api.orthiclabs.com",
+  "origin": "https://api.orthiclabs.com",
+  "paths": {
+    "adminPatches": "/v1/admin/apps/patches",
+    "adminReleases": "/v1/admin/apps/releases",
+    "adminRuntimeArtifacts": "/v1/admin/apps/runtime-artifacts",
+    "releaseStatus": "/v1/apps/{app}/releases/status.json",
+    "updaterManifest": "/v1/apps/{app}/releases/latest.json?platform={{target}}"
+  },
+  "pendingNativeUpdater": [
+    "heardright"
+  ],
+  "publicInstallerBase": "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev",
+  "schema": "right-suite-api.v1"
+};

package/swap-helper-bundle.mjs

@@ -37,7 +37,7 @@ export function isSwapHelperSigned(file, { execFileSync = nodeExecFileSync } = {
 }
 
 /**
- * Local-pack step. darwin: build through the managed cargo wrapper (`run("cargo", ...)` is `rightkit cargo` in
+ * Local-pack step. darwin: build through the managed cargo wrapper (`run("cargo", ...)` is `rustright cargo` in
  * local-publish), copy to <packageDir>/bin/darwin/rightkit-swap, Developer ID sign with the shared identity
  * resolver and `macCodesignArgs` (--options runtime --timestamp), verify strictly, write a sha256 receipt.
  * Anywhere else: refuse unless the helper is present and its receipt matches its bytes. Fails closed with SwapHelperError.
@@ -66,7 +66,7 @@ export function prepareSwapHelper({
   }
   const fail = (code, message) => { throw new SwapHelperError(code, message); };
   const built = run("cargo", SWAP_HELPER_CARGO_ARGS, { cwd: workspaceRoot, env });
-  if (built.error || built.status !== 0) fail("SWAP_HELPER_BUILD_FAILED", `rightkit cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} failed (${built.error?.message ?? `exit ${built.status}`})\n${tail(`${built.stdout ?? ""}\n${built.stderr ?? ""}`)}`);
+  if (built.error || built.status !== 0) fail("SWAP_HELPER_BUILD_FAILED", `rustright cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} failed (${built.error?.message ?? `exit ${built.status}`})\n${tail(`${built.stdout ?? ""}\n${built.stderr ?? ""}`)}`);
   const meta = run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
   let targetDir;
   try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }