@moneysiren/cli 0.1.0-alpha.2 → 0.1.0-alpha.3

package/README.md

@@ -67,7 +67,7 @@ Install the generated tarball into a temporary project:
 mkdir -p /tmp/moneysiren-alpha-review
 cd /tmp/moneysiren-alpha-review
 npm init -y
-npm install /path/to/moneysiren-cli-0.1.0-alpha.2.tgz
+npm install /path/to/moneysiren-cli-0.1.0-alpha.3.tgz
 npm exec moneysiren
 npm exec moneysiren -- --version
 npm exec moneysiren -- /version
@@ -83,7 +83,7 @@ PowerShell equivalent for the temporary project:
 New-Item -ItemType Directory -Force -Path $env:TEMP\moneysiren-alpha-review
 Set-Location $env:TEMP\moneysiren-alpha-review
 npm init -y
-npm install C:\path\to\moneysiren-cli-0.1.0-alpha.2.tgz
+npm install C:\path\to\moneysiren-cli-0.1.0-alpha.3.tgz
 npm exec moneysiren
 npm exec moneysiren -- --version
 npm exec moneysiren -- modes

package/dist/apps/cli/src/commands/install.js

@@ -229,7 +229,16 @@ function writeReleaseInstallSummary(context, result) {
     for (const asset of result.assets) {
         context.stdout(`Downloaded ${asset.surface}: ${asset.name}`);
         context.stdout(`  SHA256 verified: ${asset.checksumVerified ? "yes" : "checksum unavailable"}`);
-        context.stdout(`  Signature verified: ${asset.signatureVerified ? "yes" : "not required"}`);
+        context.stdout(`  Signature status: ${formatSignatureStatus(asset)}`);
     }
 }
+function formatSignatureStatus(asset) {
+    if (asset.signatureVerified) {
+        return "verified";
+    }
+    if (asset.signatureStatus === "unsigned-prerelease-accepted") {
+        return "unsigned alpha accepted";
+    }
+    return "not required";
+}
 //# sourceMappingURL=install.js.map

package/dist/apps/cli/src/release-installer.d.ts

@@ -1,6 +1,6 @@
 import type { InstallSurface } from "./install-profile.js";
 export declare const DEFAULT_RELEASE_REPOSITORY = "ztwz11/moneysiren";
-export declare const DEFAULT_RELEASE_TAG = "v0.1.0-alpha.2";
+export declare const DEFAULT_RELEASE_TAG = "v0.1.0-alpha.3";
 export interface ReleaseInstallOptions {
     env?: Record<string, string | undefined>;
     fetchImpl: typeof fetch;
@@ -28,16 +28,19 @@ export interface InstalledReleaseAsset {
     sha256: string;
     checksumVerified: boolean;
     signatureVerified: boolean;
+    signatureStatus: string;
 }
 export interface ReleaseAssetSignatureVerifier {
     verify(input: ReleaseAssetSignatureVerificationInput): Promise<ReleaseAssetSignatureVerificationResult>;
 }
 export interface ReleaseAssetSignatureVerificationInput {
     assetName: string;
+    env: Record<string, string | undefined>;
     expectedSignerThumbprints?: readonly string[];
     path: string;
     platform: NodeJS.Platform;
     surface: Exclude<InstallSurface, "cli">;
+    tag: string;
 }
 export interface ReleaseAssetSignatureVerificationResult {
     verified: boolean;

package/dist/apps/cli/src/release-installer.js

@@ -7,12 +7,13 @@ import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 export const DEFAULT_RELEASE_REPOSITORY = "ztwz11/moneysiren";
 // Keep the source-free installer pinned to the latest published desktop/web release tag.
-export const DEFAULT_RELEASE_TAG = "v0.1.0-alpha.2";
+export const DEFAULT_RELEASE_TAG = "v0.1.0-alpha.3";
 const RELEASE_REPOSITORY_ENV_KEY = "MONEYSIREN_RELEASE_REPOSITORY";
 const RELEASE_TAG_ENV_KEY = "MONEYSIREN_RELEASE_TAG";
 const RELEASE_INSTALL_DIR_ENV_KEY = "MONEYSIREN_RELEASE_INSTALL_DIR";
 const RELEASE_PLATFORM_ENV_KEY = "MONEYSIREN_RELEASE_PLATFORM";
 const WINDOWS_SIGNER_THUMBPRINTS_ENV_KEY = "MONEYSIREN_WINDOWS_SIGNER_THUMBPRINTS";
+const ALLOW_UNSIGNED_HUD_ENV_KEY = "MONEYSIREN_ALLOW_UNSIGNED_HUD";
 export async function installReleaseAssets(options) {
     const env = options.env ?? process.env;
     const repository = normalizeRepository(options.repository ?? env[RELEASE_REPOSITORY_ENV_KEY] ?? DEFAULT_RELEASE_REPOSITORY);
@@ -65,6 +66,7 @@ export async function installReleaseAssets(options) {
                 platform,
                 releaseAssets,
                 surface,
+                tag,
                 ...(options.signatureVerifier === undefined ? {} : { signatureVerifier: options.signatureVerifier }),
                 ...(options.trustedWindowsSignerThumbprints === undefined
                     ? {}
@@ -86,7 +88,8 @@ export async function installReleaseAssets(options) {
             size: downloaded.byteLength,
             sha256,
             checksumVerified: checksum !== null,
-            signatureVerified: signature.status !== "not-required",
+            signatureVerified: isVerifiedSignatureStatus(signature.status),
+            signatureStatus: signature.status,
         });
     }
     await writeFile(join(installDir, "install-manifest.json"), `${JSON.stringify({
@@ -104,6 +107,7 @@ export async function installReleaseAssets(options) {
             sha256: asset.sha256,
             checksumVerified: asset.checksumVerified,
             signatureVerified: asset.signatureVerified,
+            signatureStatus: asset.signatureStatus,
         })),
     }, null, 2)}\n`, "utf8");
     return {
@@ -249,10 +253,12 @@ async function verifyReleaseAssetSignature(input) {
     });
     return verifier.verify({
         assetName: input.assetName,
+        env: input.env,
         ...(expectedSignerThumbprints === null ? {} : { expectedSignerThumbprints }),
         path: input.path,
         platform: input.platform,
         surface: input.surface,
+        tag: input.tag,
     });
 }
 const defaultReleaseAssetSignatureVerifier = {
@@ -272,6 +278,13 @@ const defaultReleaseAssetSignatureVerifier = {
             };
         }
         if (input.expectedSignerThumbprints === undefined || input.expectedSignerThumbprints.length === 0) {
+            if (isUnsignedPrereleaseHudAllowed(input.env, input.tag)) {
+                return {
+                    verified: true,
+                    status: "unsigned-prerelease-accepted",
+                    message: "Unsigned Windows HUD artifact accepted for alpha prerelease.",
+                };
+            }
             return {
                 verified: false,
                 status: "missing-signature-metadata",
@@ -306,6 +319,16 @@ async function findExpectedSignerThumbprints(input) {
     }
     return null;
 }
+function isVerifiedSignatureStatus(status) {
+    return status !== "not-required" && status !== "unsigned-prerelease-accepted";
+}
+function isUnsignedPrereleaseHudAllowed(env, tag) {
+    const configured = env[ALLOW_UNSIGNED_HUD_ENV_KEY]?.trim().toLowerCase();
+    if (configured !== undefined && configured.length > 0) {
+        return ["1", "true", "yes", "on"].includes(configured);
+    }
+    return /-(?:alpha|beta|rc)(?:[.\d-]*)?$/i.test(tag);
+}
 async function verifyWindowsAuthenticodeSignature(path, expectedSignerThumbprints) {
     const literalPath = powerShellSingleQuotedString(path);
     try {

package/dist/apps/cli/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.0-alpha.2";
+export declare const CLI_VERSION = "0.1.0-alpha.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/apps/cli/src/version.js

@@ -1,2 +1,2 @@
-export const CLI_VERSION = "0.1.0-alpha.2";
+export const CLI_VERSION = "0.1.0-alpha.3";
 //# sourceMappingURL=version.js.map

package/dist/packages/local-api/src/server.js

@@ -3,7 +3,7 @@ import { parseNotificationPreferences, readNotificationDigest, readNotificationP
 import { assertLoopbackHost, isLoopbackHost, removeRuntimeLock, writeRuntimeLock, } from "../../runtime/src/index.js";
 const DEFAULT_HOST = "127.0.0.1";
 const DEFAULT_PORT = 47831;
-const DEFAULT_VERSION = "0.1.0-alpha.2";
+const DEFAULT_VERSION = "0.1.0-alpha.3";
 export async function startLocalApiServer(options = {}) {
     const host = options.host ?? DEFAULT_HOST;
     const requestedPort = options.port ?? DEFAULT_PORT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moneysiren/cli",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Local-first cloud/SaaS usage, status, and expected billing CLI for MoneySiren.",
   "private": false,
   "license": "MIT",