@rightkit/release 0.6.5 → 0.6.7

package/suite-api.generated.mjs

@@ -13,6 +13,48 @@ export const RIGHT_SUITE_GATED_ARTIFACT_HOST = "rightapps-license-gate.adrdsouza
 export const RIGHT_SUITE_PUBLIC_ARTIFACT_HOST = "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
 export const RIGHT_SUITE_PUBLIC_INSTALLER_BASE = "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
 export const RIGHT_SUITE_ARTIFACT_PATH_PREFIX = "/{app}";
+export const RIGHT_SUITE_LICENSE_PUBLIC_KEY_HEX = "730732885355c4400c115592a42c91b8b0277d460cb2b5d59c1e2815a74d5d22";
+export const RIGHT_SUITE_UPDATER_SIGNING_KEY_ID = "29395F9FF466261D";
+export const RIGHT_SUITE_UPDATER_PUBLIC_KEYS = [
+  {
+    "kid": "29395F9FF466261D",
+    "publicKey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK",
+    "notAfter": null,
+    "notAfterUnix": null
+  }
+];
+export const RIGHT_SUITE_CLIENT_PATHS = {
+  "licenseActivate": "/v1/licenses/activate",
+  "licenseRefresh": "/v1/licenses/refresh",
+  "licenseDeactivate": "/v1/licenses/deactivate",
+  "licenseTrial": "/v1/licenses/trial",
+  "bridgeFromActivation": "/v1/licenses/bridge/from-activation",
+  "bridgeExchange": "/v1/licenses/bridge/exchange",
+  "bridgeFromPlay": "/v1/licenses/bridge/from-play",
+  "bridgeFromStorekit": "/v1/licenses/bridge/from-storekit",
+  "leaseIssue": "/v1/pro/{app}/devices/lease",
+  "leaseRenew": "/v1/pro/{app}/devices/lease/renew",
+  "leaseRemove": "/v1/pro/{app}/devices/lease/remove",
+  "windowsLinkRequest": "/v1/pro/{app}/devices/windows-link/request",
+  "windowsLinkRedeem": "/v1/pro/{app}/devices/windows-link/redeem",
+  "accountMagicLinkRequest": "/v1/shop/auth/magic-link/request",
+  "accountMagicLinkConsume": "/v1/shop/auth/magic-link/consume",
+  "accountMe": "/v1/shop/auth/me",
+  "accountLogout": "/v1/shop/auth/logout",
+  "accountDevices": "/v1/shop/account/devices",
+  "accountDelete": "/v1/shop/account",
+  "entitlement": "/v1/entitlement"
+};
+export const RIGHT_SUITE_APP_KEYS = ["coderight","cutright","genright","heardright","mailright","postright","pulse","scraperight","viewright"];
+export const RIGHT_SUITE_APP_LICENSE_HOSTS = {
+  "coderight": "coderight.cc",
+  "genright": "heardright.app",
+  "heardright": "heardright.app",
+  "mailright": "mailright.cc",
+  "scraperight": "scraperight.cc",
+  "viewright": "viewright.cc"
+};
+export const RIGHT_SUITE_PENDING_NATIVE_UPDATER = ["cutright","genright","heardright","postright","pulse","scraperight"];
 export const APP_ARTIFACT_HOSTS = {
   "coderight": [
     "rightapps-license-gate.adrdsouza.workers.dev",
@@ -36,24 +78,37 @@ export const RIGHT_SUITE_API_CONTRACT = {
       "artifactHosts": [
         "gated",
         "public"
-      ]
+      ],
+      "licenseHost": "coderight.cc"
+    },
+    "cutright": {},
+    "genright": {
+      "licenseHost": "heardright.app"
     },
     "heardright": {
       "artifactHosts": [
         "gated",
         "public"
-      ]
+      ],
+      "licenseHost": "heardright.app"
     },
     "mailright": {
       "artifactHosts": [
         "gated",
         "public"
-      ]
+      ],
+      "licenseHost": "mailright.cc"
+    },
+    "postright": {},
+    "pulse": {},
+    "scraperight": {
+      "licenseHost": "scraperight.cc"
     },
     "viewright": {
       "artifactHosts": [
         "public"
-      ]
+      ],
+      "licenseHost": "viewright.cc"
     }
   },
   "artifactHostSets": {
@@ -61,7 +116,30 @@ export const RIGHT_SUITE_API_CONTRACT = {
     "public": "pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev"
   },
   "artifactPathPrefix": "/{app}",
+  "clientPaths": {
+    "accountDelete": "/v1/shop/account",
+    "accountDevices": "/v1/shop/account/devices",
+    "accountLogout": "/v1/shop/auth/logout",
+    "accountMagicLinkConsume": "/v1/shop/auth/magic-link/consume",
+    "accountMagicLinkRequest": "/v1/shop/auth/magic-link/request",
+    "accountMe": "/v1/shop/auth/me",
+    "bridgeExchange": "/v1/licenses/bridge/exchange",
+    "bridgeFromActivation": "/v1/licenses/bridge/from-activation",
+    "bridgeFromPlay": "/v1/licenses/bridge/from-play",
+    "bridgeFromStorekit": "/v1/licenses/bridge/from-storekit",
+    "entitlement": "/v1/entitlement",
+    "leaseIssue": "/v1/pro/{app}/devices/lease",
+    "leaseRemove": "/v1/pro/{app}/devices/lease/remove",
+    "leaseRenew": "/v1/pro/{app}/devices/lease/renew",
+    "licenseActivate": "/v1/licenses/activate",
+    "licenseDeactivate": "/v1/licenses/deactivate",
+    "licenseRefresh": "/v1/licenses/refresh",
+    "licenseTrial": "/v1/licenses/trial",
+    "windowsLinkRedeem": "/v1/pro/{app}/devices/windows-link/redeem",
+    "windowsLinkRequest": "/v1/pro/{app}/devices/windows-link/request"
+  },
   "host": "api.orthiclabs.com",
+  "licensePublicKeyHex": "730732885355c4400c115592a42c91b8b0277d460cb2b5d59c1e2815a74d5d22",
   "origin": "https://api.orthiclabs.com",
   "paths": {
     "adminPatches": "/v1/admin/apps/patches",
@@ -71,8 +149,20 @@ export const RIGHT_SUITE_API_CONTRACT = {
     "updaterManifest": "/v1/apps/{app}/releases/latest.json?platform={{target}}"
   },
   "pendingNativeUpdater": [
-    "heardright"
+    "cutright",
+    "genright",
+    "heardright",
+    "postright",
+    "pulse",
+    "scraperight"
   ],
   "publicInstallerBase": "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev",
-  "schema": "right-suite-api.v1"
+  "schema": "right-suite-api.v1",
+  "updaterPublicKeys": [
+    {
+      "kid": "29395F9FF466261D",
+      "publicKey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK"
+    }
+  ],
+  "updaterSigningKeyId": "29395F9FF466261D"
 };

package/suite-trust-roots.mjs

@@ -0,0 +1,198 @@
+// The suite's trust roots have one owner, contracts/right-suite-api.v1.json (schema right-suite-api.v1). These preflight rules find
+// what an app does instead of taking them from it: a pasted copy of the licence public key (any spelling), an updater key in a
+// Tauri config that the contract does not list, and the engine reading the owner's record store itself. Pure functions over
+// (root, files), each returning [{ file, subject, problem, fix }]; packages/release/app-check.mjs registers them (lane C3, so an app's `rightkit-gate check` runs
+// them too) and an app's existing findings are ratcheted like G13-G21.
+import fs from "node:fs";
+import path from "node:path";
+import { RIGHT_SUITE_LICENSE_PUBLIC_KEY_HEX, RIGHT_SUITE_UPDATER_PUBLIC_KEYS } from "./suite-api.generated.mjs";
+
+const literal = (text) => text.replace(/[\\^$.*+?()[\]{}|/]/g, "\\$&");
+
+// Files the rules do not read: documentation and dependency trees, and test code, which pastes keys on purpose to prove them.
+// Segments of the test directories are matched without case: Swift packages call theirs Tests.
+// `docs` is documentation only at the repository root: a TypeScript app's src/docs is source. `target` stays skipped at any depth (Cargo build output sits in each crate).
+const SKIPPED_TREE = /^docs\/|(^|\/)(node_modules|target|\.git)\//;
+const TEST_SEGMENT = /(^|\/)(tests?|__tests__|test-vectors|fixtures)(\/|$)/i;
+const TEST_NAME = /\.(?:test|spec)\.|_tests?\./;
+const scanned = (file) => !SKIPPED_TREE.test(file) && !TEST_SEGMENT.test(file) && !TEST_NAME.test(path.posix.basename(file)) && !/\.md$/i.test(file);
+
+// A tauri*.conf.json carries the updater key by design (suiteUpdaterKey checks that copy), so the pasted-key rule leaves it alone.
+const TAURI_CONF = /(^|\/)tauri[^/]*\.conf\.json$/;
+
+// What the contract's owner generates from it: RightKit holds the key by definition, apps do not. RightKit is recognised by its
+// generator, which no app carries.
+const OWNER_GENERATOR = "scripts/gen-suite-api.mjs";
+const OWNER_FILES = new Set([
+  "contracts/right-suite-api.v1.json",
+  "crates/rightkit-license/src/suite_api_generated.rs",
+  "crates/rightkit-license/test-vectors/right-suite-api.v1.json",
+  "packages/app-update/src/suite-api.generated.ts",
+  "packages/release/suite-api.generated.mjs",
+  "swift/RightKitSwift/Sources/RightKitLicense/RightSuiteAPI.generated.swift",
+]);
+
+/** The text of a tracked file, or null when it cannot be read or is binary (a NUL byte: images, archives, UTF-16). */
+function textOf(root, file) {
+  let bytes;
+  try { bytes = fs.readFileSync(path.join(root, file)); } catch { return null; }
+  return bytes.includes(0) ? null : bytes.toString("utf8");
+}
+
+/** The distinct 1-based lines on which `pattern` (global) starts a match, ascending. */
+function matchLines(text, pattern) {
+  const lines = [];
+  let line = 1;
+  let at = 0;
+  for (const m of text.matchAll(pattern)) {
+    for (; at < m.index; at += 1) if (text.charCodeAt(at) === 10) line += 1;
+    if (lines.at(-1) !== line) lines.push(line);
+  }
+  return lines;
+}
+
+const listed = (lines) => `${lines.slice(0, 8).join(",")}${lines.length > 8 ? ",…" : ""}`;
+const lineAt = (text, offset) => (offset < 0 ? 1 : text.slice(0, offset).split("\n").length);
+
+// An element of a pasted byte array may carry Rust's integer suffix.
+const INT_SUFFIX = "(?:_?u8)?";
+// Whitespace and comments (`// s` after each byte, `/* s */` before a comma) may sit between elements.
+const FILL = "(?:\\s|//[^\\n]*|/\\*[\\s\\S]*?\\*/)*";
+const SEPARATOR = `${FILL},${FILL}`;
+
+/** One pattern per way an app pastes the licence key, each global: [{ subject, what, pattern }], derived from the contract's hex so
+ * a rotation changes what is found without touching this file. The 64-digit hex and the base64 forms are matched inside longer
+ * text on purpose: a PEM or a concatenation that contains the key still pastes it, and no other text contains it by chance. */
+export function licenceKeyPatterns(hex = RIGHT_SUITE_LICENSE_PUBLIC_KEY_HEX) {
+  if (!/^[0-9a-f]{64}$/i.test(hex)) throw new Error(`the suite licence public key is not 64 hex digits: ${JSON.stringify(hex)}`);
+  const key = Buffer.from(hex, "hex");
+  const bytes = [...key];
+  const array = (element) => bytes.map(element).join(SEPARATOR);
+  const decimal = array((b) => `${b}${INT_SUFFIX}`);
+  // 0x7 and 0x07 are the same byte.
+  const prefixed = array((b) => `0x${b < 16 ? "0?" : ""}${b.toString(16)}${INT_SUFFIX}`);
+  // The two base64 alphabets differ only at + / and - _, so a key whose encoding has none of them reads the same in both. The
+  // unpadded text then counts as base64url and only the padded text as base64, which keeps one paste at one finding.
+  const url = key.toString("base64url");
+  const standard = key.toString("base64").replace(/=+$/, "");
+  const same = url === standard;
+  return [
+    { subject: "licence-key:bytes", what: "as a byte array", pattern: new RegExp(`(?<![\\w.])(?:${decimal}|${prefixed})(?![\\w.])`, "gi") },
+    { subject: "licence-key:escaped", what: "as \\x escapes", pattern: new RegExp(bytes.map((b) => `\\\\x${b < 16 ? "0" : ""}${b.toString(16)}`).join(""), "gi") },
+    { subject: "licence-key:hex", what: "as 64 hex digits", pattern: new RegExp(hex, "gi") },
+    { subject: "licence-key:base64url", what: "as unpadded base64url", pattern: new RegExp(`${literal(url)}${same ? "(?!=)" : ""}`, "g") },
+    { subject: "licence-key:base64", what: "as base64", pattern: new RegExp(`${literal(standard)}${same ? "=" : "=?"}`, "g") },
+  ];
+}
+
+/** The pattern for the text of any contract updater key (the base64 a tauri.conf.json carries), or null with no keys. */
+export function updaterKeyPattern(keys = RIGHT_SUITE_UPDATER_PUBLIC_KEYS) {
+  const texts = keys.map((k) => k.publicKey);
+  // An empty alternative would match every file.
+  if (texts.some((t) => typeof t !== "string" || t === "")) throw new Error("a suite updater public key has no text");
+  return texts.length ? new RegExp(texts.map(literal).join("|"), "g") : null;
+}
+
+const KEY_SOURCES = "rightkit_license::suite_api::LICENSE_PUBLIC_KEY (Rust), the suite-api export of @rightkit/app-update (TypeScript) or RightSuiteAPI (Swift)";
+
+/** The licence public key in any spelling, or the updater key text outside a tauri*.conf.json, in a tracked non-test file. One
+ * finding per file and spelling; the line numbers are in the problem text only, so an edit above does not change the identity. */
+export function suiteKeyLiteral(root, files) {
+  const updater = updaterKeyPattern();
+  const forms = [
+    ...licenceKeyPatterns().map((form) => ({ ...form, what: `carries the suite licence public key ${form.what}`, fix: `take the key from ${KEY_SOURCES}; never paste a copy` })),
+    ...(updater ? [{ subject: "updater-key", what: "carries the suite updater public key text", pattern: updater, skipsTauriConf: true, fix: `plugins.updater.pubkey of a tauri.conf.json is the one committed copy (Tauri's plugin config requires it); anywhere else take the key from ${KEY_SOURCES}` }] : []),
+  ];
+  const owner = files.includes(OWNER_GENERATOR);
+  const out = [];
+  for (const file of files) {
+    if (!scanned(file) || (owner && OWNER_FILES.has(file))) continue;
+    const text = textOf(root, file);
+    if (text === null) continue;
+    for (const form of forms) {
+      if (form.skipsTauriConf && TAURI_CONF.test(file)) continue;
+      const lines = matchLines(text, form.pattern);
+      if (lines.length) out.push({ file, subject: form.subject, problem: `${file}:${listed(lines)} ${form.what}`, fix: form.fix });
+    }
+  }
+  return out;
+}
+
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+/** `(file, text) => boolean`: whether `text` carries a marker that the nearest placeholders.json above `file` lists for that file. A
+ * placeholders.json is a template's own ledger of what an app generated from it must replace; an app has none. */
+function declaredPlaceholders(root, files) {
+  const ledgers = new Map();
+  for (const file of files) {
+    if (path.posix.basename(file) !== "placeholders.json" || !scanned(file)) continue;
+    const text = textOf(root, file);
+    let list;
+    try { list = JSON.parse(text ?? "").replace; } catch { continue; }
+    if (!Array.isArray(list)) continue;
+    ledgers.set(path.posix.dirname(file), list.filter((e) => isObject(e) && typeof e.file === "string" && typeof e.marker === "string" && e.marker !== ""));
+  }
+  return (file, text) => {
+    for (let dir = path.posix.dirname(file); ; dir = path.posix.dirname(dir)) {
+      const list = ledgers.get(dir);
+      if (list) {
+        const relative = path.posix.relative(dir, file);
+        return list.some((entry) => entry.file === relative && text.includes(entry.marker));
+      }
+      if (dir === "." || dir === "/") return false;
+    }
+  };
+}
+
+/** Every tracked tauri*.conf.json whose plugins.updater block does not carry a copy of a contract key: a missing key, a placeholder,
+ * another key, or a file that is not JSON. A file with no plugins.updater block (a platform override) has nothing to check. */
+export function suiteUpdaterKey(root, files) {
+  const declared = declaredPlaceholders(root, files);
+  const accepted = new Set(RIGHT_SUITE_UPDATER_PUBLIC_KEYS.map((k) => k.publicKey));
+  const fix = "set plugins.updater.pubkey to a copy of a publicKey in contracts/right-suite-api.v1.json updaterPublicKeys; the conf holds a copy only because Tauri's plugin config requires one, and the app takes the key from the contract everywhere else";
+  const out = [];
+  for (const file of files) {
+    if (!TAURI_CONF.test(file) || !scanned(file)) continue;
+    const text = textOf(root, file);
+    if (text === null) continue;
+    let conf;
+    // A byte-order mark is how some Windows editors save JSON; Tauri reads it, so it is not a defect here.
+    try { conf = JSON.parse(text.replace(/^/, "")); } catch { out.push({ file, subject: "unparseable", problem: `${file} is not valid JSON, so its plugins.updater.pubkey cannot be checked`, fix }); continue; }
+    const updater = conf?.plugins?.updater;
+    if (!isObject(updater)) continue;
+    const block = text.search(/"updater"\s*:/);
+    const { pubkey } = updater;
+    // A template's marker is handled by its own placeholders.json (the template contract refuses a marker that is not listed there).
+    if (typeof pubkey === "string" && declared(file, pubkey)) continue;
+    let why;
+    let offset = block;
+    // A platform override (tauri.windows.conf.json) is merged over the base config, so it may leave the key to it.
+    if (pubkey === undefined) { if (!/(^|\/)tauri\.conf\.json$/.test(file)) continue; why = "has no plugins.updater.pubkey"; }
+    else {
+      offset = text.indexOf('"pubkey"', Math.max(block, 0));
+      if (typeof pubkey !== "string") why = "has a plugins.updater.pubkey that is not a string";
+      else if (!accepted.has(pubkey)) why = `has plugins.updater.pubkey "${pubkey.slice(0, 32)}${pubkey.length > 32 ? "…" : ""}", which is not a publicKey of the suite contract`;
+    }
+    if (why) out.push({ file, subject: "plugins.updater.pubkey", problem: `${file}:${lineAt(text, offset)} ${why}`, fix });
+  }
+  return out;
+}
+
+// The owner binary hands the engine a snapshot of the licence record (rightkit_credentials::handoff); an engine that opens the record
+// store itself reads a keychain item across binaries. Assembled so this file does not itself carry the call it refuses.
+const RECORD_STORE_READER = "from_record_store";
+const RECORD_STORE_CALL = new RegExp(literal(`${RECORD_STORE_READER}(`), "g");
+// The crate that defines the reader, and the one place that may call it.
+const RECORD_STORE_OWNER = "crates/rightkit-license/";
+
+/** A tracked non-test file outside the licence crate that calls the engine's record-store reader. */
+export function engineRecordStore(root, files) {
+  const out = [];
+  for (const file of files) {
+    if (!scanned(file) || file.startsWith(RECORD_STORE_OWNER)) continue;
+    const text = textOf(root, file);
+    if (text === null || !text.includes(`${RECORD_STORE_READER}(`)) continue;
+    out.push({ file, subject: RECORD_STORE_READER, problem: `${file}:${listed(matchLines(text, RECORD_STORE_CALL))} calls ${RECORD_STORE_READER}: the engine reads the owner's record store itself`, fix: 'have the owner binary hand the engine a snapshot through rightkit_credentials::handoff instead (rightkit-credentials README "Helpers, sidecars and CLIs")' });
+  }
+  return out;
+}

package/test-command.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // `right-release test [--config <file>] [--suite <name>[,<name>]]... [--runner <name>] [--list] [--json] [-- <args>]`
-// runs the app's declared test suites from `right-release.config.mjs`, one after another, and stops at the first failure.
+// runs the app's declared test suites from its release config (`right-release.config.json`), one after another, and stops at the first failure.
 //
 //   tests: {
 //     eventPrefix: "e2e",                       // optional; events are `<prefix>_suite_started` / `<prefix>_suite_completed`
@@ -26,6 +26,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawn } from "./background-process.mjs";
 import { CommandSpecError, loadAppConfig, resolveInvocation, validateStep } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
@@ -34,7 +35,7 @@ const PREFIX = /^[a-z][a-z0-9_]*$/;
 const uniq = (...lists) => [...new Set(lists.flatMap((list) => list ?? []))];
 
 export function parseTestArgs(argv) {
-  const opts = { config: "right-release.config.mjs", suites: [], runner: undefined, list: false, json: false, passthrough: [] };
+  const opts = { config: defaultReleaseConfigFile(), suites: [], runner: undefined, list: false, json: false, passthrough: [] };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--") { opts.passthrough = argv.slice(i + 1); break; }

package/upload-release.mjs

@@ -3,6 +3,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { authorizeGitHubUpload } from "./github-upload-gate.mjs";
 import { recordPublishedVersion } from "./artifact-storage.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
@@ -12,7 +13,7 @@ let platform = process.platform === "win32" ? "win" : process.platform === "darw
 let releaseId = "";
 let tier = "";
 let repo = "";
-let configName = "right-release.config.mjs";
+let configName = defaultReleaseConfigFile();
 let dryRun = false;
 let apply = false;
 
@@ -87,7 +88,7 @@ function writeJson(file, value) {
 }
 
 function usage(code) {
-  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update [--config right-release.config.mjs] [--repo owner/repo] [--dry-run]\n       right-release upload --platform android --release <sealed-id> [--config right-release.config.mjs] [--apply]   (Play internal track; dry run unless --apply)\n       right-release upload --platform ios --release <sealed-id> [--config right-release.config.mjs] [--apply]   (TestFlight; dry run unless --apply)");
+  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update [--config right-release.config.json] [--repo owner/repo] [--dry-run]\n       right-release upload --platform android --release <sealed-id> [--config right-release.config.json] [--apply]   (Play internal track; dry run unless --apply)\n       right-release upload --platform ios --release <sealed-id> [--config right-release.config.json] [--apply]   (TestFlight; dry run unless --apply)");
   process.exit(code);
 }
 

package/web-build.mjs

@@ -15,9 +15,10 @@
 import { pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { CommandSpecError, loadAppConfig, resolveInvocation, validateStep } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 
 export function parseWebBuildArgs(argv) {
-  const opts = { config: "right-release.config.mjs", dryRun: false };
+  const opts = { config: defaultReleaseConfigFile(), dryRun: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config") {