@aarmos/bridge 0.1.11 → 0.1.12

package/dist/index.js

@@ -1506,7 +1506,7 @@ attest.command("verify").description("Verify an attestation bundle offline \u201
   await runAttestVerify({ file: opts.file, trustedPubkey: opts.trustedPubkey });
 });
 program.command("verify").description("Verify an AVAR bundle offline (.avar.zip)").argument("<bundle>", "Path to a .avar.zip bundle").option("--json", "Emit the VerificationReport as JSON on stdout").option("--quiet", "Suppress all human-readable output").option("--strict", "Exit non-zero on 'valid-with-warnings'").action(async (bundle, opts) => {
-  const { runVerify } = await import("./verify-O6X7MFEE.js");
+  const { runVerify } = await import("./verify-SP35SK2G.js");
   const code = await runVerify({
     file: bundle,
     json: !!opts.json(),

package/dist/{verify-O6X7MFEE.js → verify-SP35SK2G.js}

@@ -132,9 +132,19 @@ async function computeDeviceFingerprint(publicKeyB64u) {
   return hex.slice(0, 12);
 }
 function signedBodyOf(entry) {
-  const { signature: _sig, devicePubKey: _pk, ...rest } = entry;
+  const {
+    signature: _sig,
+    devicePubKey: _pk,
+    deviceFingerprint: _fp,
+    prevHash: _prev,
+    entryHash: _eh,
+    ...rest
+  } = entry;
   void _sig;
   void _pk;
+  void _fp;
+  void _prev;
+  void _eh;
   return rest;
 }
 var SPEC_VERSION = "avar/1";
@@ -201,14 +211,20 @@ async function verifyBundle(bundle) {
   let chainOk = true;
   let unchainedCount = 0;
   let expectedPrev = GENESIS_PREV_HASH;
+  let seededPrev = false;
   for (let i = 0; i < entries.length; i++) {
     const e = entries[i];
     const isLegacyUnchained = !e.entryHash || !e.prevHash;
     if (isLegacyUnchained) {
       unchainedCount++;
       expectedPrev = GENESIS_PREV_HASH;
+      seededPrev = false;
       continue;
     }
+    if (!seededPrev) {
+      expectedPrev = e.prevHash;
+      seededPrev = true;
+    }
     if (e.prevHash !== expectedPrev) {
       chainOk = false;
       issues.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarmos/bridge",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Aarmos CLI bridge — local WebSocket host that gives the Aarmos PWA scoped, deny-by-default access to files, shell, git, and read-only Postgres on the developer's machine. The PWA stays the brain; this is the arms.",
   "keywords": [
     "aarmos",
@@ -21,6 +21,8 @@
     "dev": "tsx src/index.ts dev",
     "start": "node dist/index.js",
     "test": "tsx test/e2e.ts && tsx test/sample-smoke.ts && tsx test/daemon-e2e.ts && node test/crash-handling.mjs && tsx --test test/llm-test.test.mjs",
+    "prepack": "node ../../scripts/scrub-private-devdeps.mjs",
+    "postpack": "node ../../scripts/scrub-private-devdeps.mjs --restore",
     "prepublishOnly": "npm run build && npm test && node ../../scripts/check-npm-tarball.mjs"
   },
   "files": [
@@ -49,7 +51,6 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@aarmos/runtime-core": "workspace:*",
     "@types/node": "^22.5.0",
     "@types/ws": "^8.5.12",
     "tsup": "^8.5.1",