@serfab/cadre-host 0.7.1 → 0.9.0

package/dist/ui/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="color-scheme" content="light dark" />
     <title>cadre-host</title>
-    <script type="module" crossorigin src="./assets/index-C9uChk2P.js"></script>
+    <script type="module" crossorigin src="./assets/index-BlMXQPSw.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-BwU5mJGF.css">
   </head>
   <body>

package/dist/update/apply.d.ts

@@ -33,5 +33,27 @@ export interface ApplyOptions {
  * success but restart failure, returns a result with the restart error set.
  */
 export declare function applyUpdate(opts: ApplyOptions): Promise<UpdateApplyResult>;
-/** Default executor: spawn `npm` with the given args. Adds a hard timeout. */
+/**
+ * Default executor: spawn `npm` with the given args. Adds a hard timeout.
+ *
+ * On Windows, npm ships as `npm.cmd` (a batch file). CreateProcess can't run
+ * batch files directly, so a shell is required — but Node's DEP0190 warns
+ * against `spawn(cmd, args, { shell: true })` because args are concatenated
+ * (not escaped) into the resulting command line. To dodge the deprecation we
+ * pre-quote each arg ourselves and pass the result as a single command string
+ * with an empty args array. Inputs come from a signed manifest after
+ * regex-validated package + semver checks, so injection surface is minimal;
+ * quoting is defense in depth.
+ */
 export declare function defaultNpmExecutor(timeoutMs: number): NpmExecutor;
+/**
+ * Build the `(command, args, shell)` triple passed to `spawn`. Exported for
+ * tests — the spawn shape differs per platform and the quoting matters.
+ */
+export declare function buildNpmSpawnSpec(args: string[]): {
+    command: string;
+    args: string[];
+    shell: boolean;
+};
+/** cmd.exe quoting — wrap args containing whitespace or shell metachars. */
+export declare function quoteWindowsArg(arg: string): string;

package/dist/update/apply.js

@@ -72,12 +72,25 @@ async function tryRollback(pkg, fromVersion, executor) {
         return `npm install threw: ${err.message}`;
     }
 }
-/** Default executor: spawn `npm` with the given args. Adds a hard timeout. */
+/**
+ * Default executor: spawn `npm` with the given args. Adds a hard timeout.
+ *
+ * On Windows, npm ships as `npm.cmd` (a batch file). CreateProcess can't run
+ * batch files directly, so a shell is required — but Node's DEP0190 warns
+ * against `spawn(cmd, args, { shell: true })` because args are concatenated
+ * (not escaped) into the resulting command line. To dodge the deprecation we
+ * pre-quote each arg ourselves and pass the result as a single command string
+ * with an empty args array. Inputs come from a signed manifest after
+ * regex-validated package + semver checks, so injection surface is minimal;
+ * quoting is defense in depth.
+ */
 export function defaultNpmExecutor(timeoutMs) {
     return (args) => new Promise((resolveExec) => {
-        // Windows resolves `npm` via `npm.cmd`; using shell:true is the
-        // simplest cross-platform answer that still works with PATH lookup.
-        const child = spawn('npm', args, { shell: process.platform === 'win32', windowsHide: true });
+        const spawnSpec = buildNpmSpawnSpec(args);
+        const child = spawn(spawnSpec.command, spawnSpec.args, {
+            shell: spawnSpec.shell,
+            windowsHide: true,
+        });
         let stdout = '';
         let stderr = '';
         child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
@@ -96,6 +109,35 @@ export function defaultNpmExecutor(timeoutMs) {
         });
     });
 }
+/**
+ * Build the `(command, args, shell)` triple passed to `spawn`. Exported for
+ * tests — the spawn shape differs per platform and the quoting matters.
+ */
+export function buildNpmSpawnSpec(args) {
+    if (process.platform === 'win32') {
+        const commandLine = ['npm', ...args.map(quoteWindowsArg)].join(' ');
+        return { command: commandLine, args: [], shell: true };
+    }
+    return { command: 'npm', args, shell: false };
+}
+/** cmd.exe quoting — wrap args containing whitespace or shell metachars. */
+export function quoteWindowsArg(arg) {
+    // \x00 is an intentional security guard: reject NUL/CR/LF in args before they
+    // reach the cmd.exe command line. The control char is the point of the check.
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00\r\n]/.test(arg)) {
+        throw new Error('refusing to spawn npm with control character in argument');
+    }
+    if (arg.length === 0)
+        return '""';
+    if (!/[\s"&|<>^()%!]/.test(arg))
+        return arg;
+    // Escape backslashes preceding a quote per MSVCRT/cmd rules, then double the
+    // quote itself (the cmd-friendly form rather than backslash-quote).
+    const escaped = arg.replace(/(\\*)"/g, (_m, slashes) => slashes + slashes + '\\"');
+    const trailing = escaped.replace(/(\\*)$/, (_m, slashes) => slashes + slashes);
+    return `"${trailing}"`;
+}
 function tail(s, n) {
     return s.length <= n ? s : '…' + s.slice(-n);
 }

package/dist/update/apply.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/update/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,oBAAoB,GAErB,MAAM,YAAY,CAAC;AAEpB,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAuB7C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IAElG,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9E,IAAI,aAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAC5B,iBAAiB,EACjB,4BAA4B,aAAa,CAAC,QAAQ,4BAA4B,WAAW,qBAAqB,UAAU,EAAE,CAC3H,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,4BAA4B,aAAa,CAAC,QAAQ,MAAM,UAAU,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,gCAAgC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvE,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAI,GAAa,CAAC,OAAO,CAAC;QACxC,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QACnE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,QAAqB;IAErB,GAAG,CAAC,uBAAuB,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,oBAAoB,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACnG,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,OAAO,CAAY,CAAC,WAAW,EAAE,EAAE;QAChE,gEAAgE;QAChE,oEAAoE;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,IAAI,8CAA8C,SAAS,aAAa,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/update/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,oBAAoB,GAErB,MAAM,YAAY,CAAC;AAEpB,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAuB7C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IAElG,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9E,IAAI,aAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAC5B,iBAAiB,EACjB,4BAA4B,aAAa,CAAC,QAAQ,4BAA4B,WAAW,qBAAqB,UAAU,EAAE,CAC3H,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,4BAA4B,aAAa,CAAC,QAAQ,MAAM,UAAU,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,gCAAgC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvE,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAI,GAAa,CAAC,OAAO,CAAC;QACxC,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QACnE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,QAAqB;IAErB,GAAG,CAAC,uBAAuB,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,oBAAoB,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACnG,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,OAAO,CAAY,CAAC,WAAW,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE;YACrD,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,IAAI,8CAA8C,SAAS,aAAa,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,8EAA8E;IAC9E,8EAA8E;IAC9E,4CAA4C;IAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5C,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,OAAe,EAAE,EAAE,CAAC,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAe,EAAE,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;IACvF,OAAO,IAAI,QAAQ,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/update/index.d.ts

@@ -57,6 +57,16 @@ export declare class UpdateService {
     /** Persisted settings changes are bubbled out via this callback (wired in cadre-host start). */
     private onSettingsChange?;
     constructor(opts: UpdateServiceOptions);
+    /**
+     * If `update-state.json` still records an in-flight apply at construction
+     * time, the previous cadre-host process died mid-apply (OOM, power loss,
+     * sigkill). Without intervention, every subsequent `apply()` would short-
+     * circuit on `apply_in_progress` forever. We clear the marker and surface a
+     * `lastError` so the UI banner can flag that an apply was interrupted —
+     * the npm install may or may not have completed, so the operator should
+     * verify with `npm ls -g`.
+     */
+    private recoverInterruptedApply;
     /** Read the persisted state for UI consumption. */
     getState(): Promise<UpdateState>;
     /** Current settings (in-memory). */
@@ -92,10 +102,11 @@ export declare class UpdateService {
  * `createNatHandlers`. The local-UI ticket consumes these.
  */
 export declare function createUpdateHandlers(service: UpdateService): UpdateHandlers;
-export type { UpdateState, UpdateApplyResult, UpdateSettings, UpdateManifest } from './types.js';
+export type { UpdateState, UpdateApplyResult, UpdateSettings, UpdateManifest, SignedManifest } from './types.js';
 export { UpdateErrorException, type UpdateErrorCode } from './types.js';
 export { compareVersions, parseVersion } from './version.js';
-export { fetchManifest, verifyManifest, canonicalJson, signManifestForTesting } from './manifest.js';
+export { fetchManifest, verifyManifest, canonicalJson, signManifest, validateManifestFields } from './manifest.js';
 export { UpdateStateStore } from './store.js';
 export { applyUpdate, defaultNpmExecutor, type NpmExecutor, type ServiceRestarter } from './apply.js';
-export { getReleasePublicKey, getReleasePublicKeyBase64, ed25519FromRaw } from './release-key.js';
+export { getReleasePublicKey, getReleasePublicKeyBase64, ed25519FromRaw, isPlaceholderReleaseKey, } from './release-key.js';
+export { buildManifest, derivePublicKeyBase64, signAndSelfVerify, type ManifestFields } from './sign.js';

package/dist/update/index.js

@@ -13,6 +13,7 @@
 import debug from 'debug';
 import { applyUpdate, defaultNpmExecutor, } from './apply.js';
 import { DEFAULT_MANIFEST_URL, fetchManifest, } from './manifest.js';
+import { isPlaceholderReleaseKey } from './release-key.js';
 import { UpdateStateStore } from './store.js';
 import { UpdateErrorException, } from './types.js';
 import { compareVersions } from './version.js';
@@ -32,6 +33,31 @@ export class UpdateService {
         this.checkIntervalMs = opts.checkIntervalMs ?? DEFAULT_CHECK_INTERVAL_MS;
         this.settings = opts.settings ?? { autoApply: false };
         this.manifestUrl = resolveManifestUrl(opts.manifestUrl, this.settings.manifestUrl);
+        this.recoverInterruptedApply();
+    }
+    /**
+     * If `update-state.json` still records an in-flight apply at construction
+     * time, the previous cadre-host process died mid-apply (OOM, power loss,
+     * sigkill). Without intervention, every subsequent `apply()` would short-
+     * circuit on `apply_in_progress` forever. We clear the marker and surface a
+     * `lastError` so the UI banner can flag that an apply was interrupted —
+     * the npm install may or may not have completed, so the operator should
+     * verify with `npm ls -g`.
+     */
+    recoverInterruptedApply() {
+        const state = this.store.load();
+        if (!state.applyInProgress)
+            return;
+        const { fromVersion, toVersion } = state.applyInProgress;
+        log('clearing stale applyInProgress (%s → %s); previous apply was interrupted', fromVersion, toVersion);
+        this.store.update({
+            applyInProgress: undefined,
+            lastError: {
+                code: 'apply_failed',
+                message: `previous apply (${fromVersion} → ${toVersion}) was interrupted (cadre-host restarted before it completed); the install may or may not have succeeded — verify with 'npm ls -g'`,
+                at: new Date().toISOString(),
+            },
+        });
     }
     /** Read the persisted state for UI consumption. */
     async getState() {
@@ -64,6 +90,12 @@ export class UpdateService {
      * debug; signature failures are recorded as `lastError` so the UI can warn.
      */
     async check() {
+        if (isPlaceholderReleaseKey()) {
+            // A build that shipped the all-zeros placeholder rejects every authentic
+            // manifest as signature_invalid; surface that here so it's diagnosable
+            // from logs rather than only as an opaque verification failure.
+            log('release verification key is the all-zeros placeholder; production manifests will fail signature_invalid (set CADRE_HOST_UPDATE_DEV_KEY for dev/CI only)');
+        }
         let manifest;
         try {
             manifest = await fetchManifest({
@@ -221,8 +253,9 @@ function resolveManifestUrl(explicit, fromSettings) {
 }
 export { UpdateErrorException } from './types.js';
 export { compareVersions, parseVersion } from './version.js';
-export { fetchManifest, verifyManifest, canonicalJson, signManifestForTesting } from './manifest.js';
+export { fetchManifest, verifyManifest, canonicalJson, signManifest, validateManifestFields } from './manifest.js';
 export { UpdateStateStore } from './store.js';
 export { applyUpdate, defaultNpmExecutor } from './apply.js';
-export { getReleasePublicKey, getReleasePublicKeyBase64, ed25519FromRaw } from './release-key.js';
+export { getReleasePublicKey, getReleasePublicKeyBase64, ed25519FromRaw, isPlaceholderReleaseKey, } from './release-key.js';
+export { buildManifest, derivePublicKeyBase64, signAndSelfVerify } from './sign.js';
 //# sourceMappingURL=index.js.map

package/dist/update/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/update/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,kBAAkB,GAGnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,oBAAoB,GAKrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAE/C,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA+B7C,MAAM,OAAO,aAAa;IAiBxB,YAAY,IAA0B;QAN9B,UAAK,GAA0C,IAAI,CAAC;QACpD,aAAQ,GAAG,KAAK,CAAC;QAMvB,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrF,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,oCAAoC;IACpC,WAAW;QACT,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAoD;QACpE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAC7E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACnF,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,iBAAiB,CAAC,OAAuD;QACvE,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,WAAW;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC5E,GAAG,CAAC,gCAAgC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;iBAClF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,2CAA2C;YAC3C,GAAG,CAAC,2BAA2B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,2DAA2D;YAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE;gBACT,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF;YACD,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAExE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,GAAG,CAAC,uBAAuB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;gBACnC,GAAG,EAAE,IAAI,CAAC,WAAW;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,oBAAoB,CAC5B,qBAAqB,EACrB,WAAW,IAAI,CAAC,cAAc,wBAAwB,QAAQ,CAAC,OAAO,EAAE,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,kBAAkB,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzG,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,EACtB,WAAW,IAAI,CAAC,cAAc,gCAAgC,QAAQ,CAAC,kBAAkB,yCAAyC,CACnI,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,eAAe,EAAE;oBACf,WAAW,EAAE,IAAI,CAAC,cAAc;oBAChC,SAAS,EAAE,QAAQ,CAAC,OAAO;oBAC3B,SAAS;iBACV;aACF,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;oBAC/B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO;oBACzC,WAAW,EAAE,IAAI,CAAC,cAAc;oBAChC,SAAS,EAAE,QAAQ,CAAC,OAAO;oBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,SAAS,EAAE,IAAI,CAAC,YAAY;iBAC7B,CAAC,CAAC;gBACH,6CAA6C;gBAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,eAAe,EAAE,SAAS;oBAC1B,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC7E,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,eAAe,EAAE,SAAS;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;iBAC3D,CAAC,CAAC;gBACH,MAAM,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,+CAA+C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACjH,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACzB,uDAAuD;QACvD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzE,IAAI,CAAC,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO;QACL,KAAK,CAAC,QAAQ,KAAK,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,WAAW,KAAK,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACrD,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA4B,EAAE,YAAgC;IACxF,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,QAAQ,IAAI,YAAY,IAAI,oBAAoB,CAAC;AAC1D,CAAC;AAGD,OAAO,EAAE,oBAAoB,EAAwB,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAA2C,MAAM,YAAY,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/update/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,kBAAkB,GAGnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,oBAAoB,GAKrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAE/C,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA+B7C,MAAM,OAAO,aAAa;IAiBxB,YAAY,IAA0B;QAN9B,UAAK,GAA0C,IAAI,CAAC;QACpD,aAAQ,GAAG,KAAK,CAAC;QAMvB,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACK,uBAAuB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,eAAe;YAAE,OAAO;QACnC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;QACzD,GAAG,CAAC,0EAA0E,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,eAAe,EAAE,SAAS;YAC1B,SAAS,EAAE;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,mBAAmB,WAAW,MAAM,SAAS,mIAAmI;gBACzL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,oCAAoC;IACpC,WAAW;QACT,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAoD;QACpE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAC7E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACnF,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,iBAAiB,CAAC,OAAuD;QACvE,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,uBAAuB,EAAE,EAAE,CAAC;YAC9B,yEAAyE;YACzE,uEAAuE;YACvE,gEAAgE;YAChE,GAAG,CAAC,yJAAyJ,CAAC,CAAC;QACjK,CAAC;QACD,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,WAAW;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC5E,GAAG,CAAC,gCAAgC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;iBAClF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,2CAA2C;YAC3C,GAAG,CAAC,2BAA2B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,2DAA2D;YAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE;gBACT,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF;YACD,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAExE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,GAAG,CAAC,uBAAuB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;gBACnC,GAAG,EAAE,IAAI,CAAC,WAAW;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,oBAAoB,CAC5B,qBAAqB,EACrB,WAAW,IAAI,CAAC,cAAc,wBAAwB,QAAQ,CAAC,OAAO,EAAE,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,kBAAkB,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzG,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,EACtB,WAAW,IAAI,CAAC,cAAc,gCAAgC,QAAQ,CAAC,kBAAkB,yCAAyC,CACnI,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,eAAe,EAAE;oBACf,WAAW,EAAE,IAAI,CAAC,cAAc;oBAChC,SAAS,EAAE,QAAQ,CAAC,OAAO;oBAC3B,SAAS;iBACV;aACF,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;oBAC/B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO;oBACzC,WAAW,EAAE,IAAI,CAAC,cAAc;oBAChC,SAAS,EAAE,QAAQ,CAAC,OAAO;oBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,SAAS,EAAE,IAAI,CAAC,YAAY;iBAC7B,CAAC,CAAC;gBACH,6CAA6C;gBAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,eAAe,EAAE,SAAS;oBAC1B,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC7E,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,eAAe,EAAE,SAAS;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;iBAC3D,CAAC,CAAC;gBACH,MAAM,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,+CAA+C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACjH,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACzB,uDAAuD;QACvD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzE,IAAI,CAAC,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO;QACL,KAAK,CAAC,QAAQ,KAAK,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,WAAW,KAAK,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACrD,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA4B,EAAE,YAAgC;IACxF,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,QAAQ,IAAI,YAAY,IAAI,oBAAoB,CAAC;AAC1D,CAAC;AAGD,OAAO,EAAE,oBAAoB,EAAwB,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAA2C,MAAM,YAAY,CAAC;AACtG,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,iBAAiB,EAAuB,MAAM,WAAW,CAAC"}

package/dist/update/manifest.d.ts

@@ -5,9 +5,9 @@
  * detached Ed25519 signature of `canonicalJson(manifest)`. cadre-host only
  * trusts manifests whose signature matches the embedded release public key.
  *
- * Canonical serialization is a tiny local impl — depending on
- * `json-canonicalize` (or similar) for a single call site is overkill, and
- * the shape is fixed (`UpdateManifest`).
+ * Canonical serialization (`canonicalJson`) is shared from `@serfab/cadre-core`
+ * so the seed-signing path and this manifest-signing path agree on the signed
+ * byte representation; the shape we sign here is fixed (`UpdateManifest`).
  */
 import { type KeyObject } from 'node:crypto';
 import { ed25519FromRaw } from './release-key.js';
@@ -34,15 +34,34 @@ export declare function fetchManifest(opts: FetchManifestOptions): Promise<Updat
  * exercise this directly.
  */
 export declare function verifyManifest(body: unknown, env?: NodeJS.ProcessEnv): UpdateManifest;
-/** Exposed for test signers. */
-export declare function signManifestForTesting(manifest: UpdateManifest, privateKey: KeyObject): SignedManifest;
+/**
+ * Sign a manifest with the release private key, producing the `{ manifest, sig }`
+ * envelope published as `latest.json`. This is the production signing operation:
+ * it canonicalizes with the same `canonicalJson` that `verifyManifest` consumes
+ * and emits a detached `ed25519:<base64>` signature. The private key never ships
+ * in the binary — signing runs offline on the release operator's machine (see
+ * `scripts/sign-manifest.mjs`).
+ */
+export declare function signManifest(manifest: UpdateManifest, privateKey: KeyObject): SignedManifest;
 /** Used by `apply.ts` to detect which key the signer matches. */
 export declare function publicKeyMatchesEmbedded(rawBase64: string, env?: NodeJS.ProcessEnv): boolean;
 /** Wrapper for `getReleasePublicKey`, re-exported for parity with `ed25519FromRaw`. */
 export { ed25519FromRaw };
 /**
- * Canonical JSON: recursively sort object keys, no whitespace, no trailing
- * newline. Matches a typical RFC 8785 subset for the fixed shape we sign.
- * Arrays preserve order.
+ * Field-level validation that goes beyond the structural `isUpdateManifest`
+ * type guard: enforces semver on version strings, ISO-8601 round-tripping on
+ * the publish timestamp, and the npm naming regex on the package name. A
+ * signed-but-malformed manifest would otherwise surface as a confusing
+ * `compareVersions` throw further downstream.
+ *
+ * Exported so the offline signing tool (`sign.ts` / `sign-manifest.mjs`) runs
+ * the *exact same* rules before it signs — the signer can never emit a
+ * manifest that `verifyManifest` would later reject as `manifest_invalid`.
+ */
+export declare function validateManifestFields(m: UpdateManifest): void;
+/**
+ * Canonical JSON serializer used to define the signed byte representation.
+ * The implementation lives in `@serfab/cadre-core` (cadre-host depends on
+ * cadre-core); re-exported here so existing import sites stay stable.
  */
-export declare function canonicalJson(value: unknown): string;
+export { canonicalJson } from '@serfab/cadre-core';

package/dist/update/manifest.js

@@ -5,13 +5,17 @@
  * detached Ed25519 signature of `canonicalJson(manifest)`. cadre-host only
  * trusts manifests whose signature matches the embedded release public key.
  *
- * Canonical serialization is a tiny local impl — depending on
- * `json-canonicalize` (or similar) for a single call site is overkill, and
- * the shape is fixed (`UpdateManifest`).
+ * Canonical serialization (`canonicalJson`) is shared from `@serfab/cadre-core`
+ * so the seed-signing path and this manifest-signing path agree on the signed
+ * byte representation; the shape we sign here is fixed (`UpdateManifest`).
  */
 import { sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
+import { canonicalJson } from '@serfab/cadre-core';
 import { ed25519FromRaw, getReleasePublicKey, getReleasePublicKeyBase64 } from './release-key.js';
 import { UpdateErrorException, } from './types.js';
+import { parseVersion } from './version.js';
+/** npm package naming rule — slightly looser than the official one (we don't enforce length here other than the 214-char total). */
+const NPM_PACKAGE_NAME_RE = /^(?:@[a-z0-9-_.]+\/)?[a-z0-9-_.]+$/;
 /** Default release-manifest URL. Overridable via env var on the caller. */
 export const DEFAULT_MANIFEST_URL = 'https://releases.serfab.io/cadre-host/latest.json';
 /**
@@ -57,6 +61,7 @@ export function verifyManifest(body, env = process.env) {
     if (!isUpdateManifest(body.manifest)) {
         throw new UpdateErrorException('manifest_invalid', 'manifest payload is missing required fields');
     }
+    validateManifestFields(body.manifest);
     const sig = parseSignature(body.sig);
     const canonical = Buffer.from(canonicalJson(body.manifest), 'utf8');
     const key = getReleasePublicKey(env);
@@ -72,8 +77,15 @@ export function verifyManifest(body, env = process.env) {
     }
     return body.manifest;
 }
-/** Exposed for test signers. */
-export function signManifestForTesting(manifest, privateKey) {
+/**
+ * Sign a manifest with the release private key, producing the `{ manifest, sig }`
+ * envelope published as `latest.json`. This is the production signing operation:
+ * it canonicalizes with the same `canonicalJson` that `verifyManifest` consumes
+ * and emits a detached `ed25519:<base64>` signature. The private key never ships
+ * in the binary — signing runs offline on the release operator's machine (see
+ * `scripts/sign-manifest.mjs`).
+ */
+export function signManifest(manifest, privateKey) {
     const canonical = Buffer.from(canonicalJson(manifest), 'utf8');
     const sig = cryptoSign(null, canonical, privateKey).toString('base64');
     return { manifest, sig: `ed25519:${sig}` };
@@ -102,6 +114,41 @@ function isSignedManifest(v) {
     const obj = v;
     return typeof obj.sig === 'string' && obj.manifest !== undefined && typeof obj.manifest === 'object';
 }
+/**
+ * Field-level validation that goes beyond the structural `isUpdateManifest`
+ * type guard: enforces semver on version strings, ISO-8601 round-tripping on
+ * the publish timestamp, and the npm naming regex on the package name. A
+ * signed-but-malformed manifest would otherwise surface as a confusing
+ * `compareVersions` throw further downstream.
+ *
+ * Exported so the offline signing tool (`sign.ts` / `sign-manifest.mjs`) runs
+ * the *exact same* rules before it signs — the signer can never emit a
+ * manifest that `verifyManifest` would later reject as `manifest_invalid`.
+ */
+export function validateManifestFields(m) {
+    try {
+        parseVersion(m.version);
+    }
+    catch (err) {
+        throw new UpdateErrorException('manifest_invalid', `manifest version "${m.version}" is not a valid semver: ${err.message}`);
+    }
+    if (m.minPreviousVersion !== undefined) {
+        try {
+            parseVersion(m.minPreviousVersion);
+        }
+        catch (err) {
+            throw new UpdateErrorException('manifest_invalid', `manifest minPreviousVersion "${m.minPreviousVersion}" is not a valid semver: ${err.message}`);
+        }
+    }
+    const parsed = new Date(m.publishedAt);
+    if (Number.isNaN(parsed.getTime()) || parsed.toISOString() !== m.publishedAt) {
+        throw new UpdateErrorException('manifest_invalid', `manifest publishedAt "${m.publishedAt}" is not a round-trippable ISO-8601 string`);
+    }
+    const pkg = m.channels.npm.package;
+    if (!NPM_PACKAGE_NAME_RE.test(pkg) || pkg.length > 214) {
+        throw new UpdateErrorException('manifest_invalid', `manifest channels.npm.package "${pkg}" is not a valid npm package name`);
+    }
+}
 function isUpdateManifest(v) {
     if (!v || typeof v !== 'object')
         return false;
@@ -124,29 +171,9 @@ function isUpdateManifest(v) {
     return true;
 }
 /**
- * Canonical JSON: recursively sort object keys, no whitespace, no trailing
- * newline. Matches a typical RFC 8785 subset for the fixed shape we sign.
- * Arrays preserve order.
+ * Canonical JSON serializer used to define the signed byte representation.
+ * The implementation lives in `@serfab/cadre-core` (cadre-host depends on
+ * cadre-core); re-exported here so existing import sites stay stable.
  */
-export function canonicalJson(value) {
-    if (value === null)
-        return 'null';
-    if (typeof value === 'number') {
-        if (!Number.isFinite(value))
-            throw new Error('cannot serialize non-finite number');
-        return JSON.stringify(value);
-    }
-    if (typeof value === 'string' || typeof value === 'boolean') {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return '[' + value.map((v) => canonicalJson(v)).join(',') + ']';
-    }
-    if (typeof value === 'object') {
-        const obj = value;
-        const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
-        return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(obj[k])).join(',') + '}';
-    }
-    throw new Error(`cannot serialize value of type ${typeof value}`);
-}
+export { canonicalJson } from '@serfab/cadre-core';
 //# sourceMappingURL=manifest.js.map

package/dist/update/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/update/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAkB,MAAM,aAAa,CAAC;AAEzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EACL,oBAAoB,GAGrB,MAAM,YAAY,CAAC;AAEpB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,mDAAmD,CAAC;AASxF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,KAAM,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,+BAAgC,GAAa,CAAC,OAAO,EAAE,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,EACnB,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,sBAAsB,CAAC,QAAwB,EAAE,UAAqB;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC9F,OAAO,SAAS,KAAK,yBAAyB,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,uFAAuF;AACvF,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,0BAA0B;AAE1B,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,iCAAiC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,2CAA2C,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,OAAO,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,GAAG,GAAI,CAAC,CAAC,QAAoC,CAAC,GAA0C,CAAC;IAC/F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,KAAK,EAAE,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/update/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAkB,MAAM,aAAa,CAAC;AAEzF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EACL,oBAAoB,GAGrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,oIAAoI;AACpI,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,mDAAmD,CAAC;AASxF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,KAAM,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,+BAAgC,GAAa,CAAC,OAAO,EAAE,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IACpG,CAAC;IACD,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,EACnB,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,QAAwB,EAAE,UAAqB;IAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC9F,OAAO,SAAS,KAAK,yBAAyB,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,uFAAuF;AACvF,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,0BAA0B;AAE1B,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,iCAAiC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,2CAA2C,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,OAAO,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACvG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAiB;IACtD,IAAI,CAAC;QACH,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,qBAAqB,CAAC,CAAC,OAAO,4BAA6B,GAAa,CAAC,OAAO,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,gCAAgC,CAAC,CAAC,kBAAkB,4BAA6B,GAAa,CAAC,OAAO,EAAE,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7E,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,yBAAyB,CAAC,CAAC,WAAW,4CAA4C,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,kCAAkC,GAAG,mCAAmC,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,GAAG,GAAI,CAAC,CAAC,QAAoC,CAAC,GAA0C,CAAC;IAC/F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/update/release-key.d.ts

@@ -2,14 +2,12 @@
  * Production Ed25519 public key used to verify the update manifest.
  *
  * The signing key lives offline with the release operator; only the public
- * half ever ships in the binary.
- *
- * **Provisional key.** The placeholder below is regenerated whenever the
- * release tooling is rotated — the key in this file is replaced atomically
- * by the release build. CI keys differ from prod keys; for dev/CI overrides
- * see `CADRE_HOST_UPDATE_DEV_KEY`.
+ * half ever ships in the binary. The release operator generates the keypair
+ * and embeds the public half with `scripts/release-keygen.mjs --write-source`;
+ * see the "Release signing & key management" runbook in `docs/cadre-host.md`.
+ * For dev/CI/staging overrides see `CADRE_HOST_UPDATE_DEV_KEY`.
  */
-import { KeyObject } from 'node:crypto';
+import type { KeyObject } from 'node:crypto';
 /**
  * Public key (32 raw bytes, base64) — env override beats the embedded one.
  * Used by both production and CI smoke tests.
@@ -17,6 +15,19 @@ import { KeyObject } from 'node:crypto';
 export declare function getReleasePublicKeyBase64(env?: NodeJS.ProcessEnv): string;
 /** Lazily build the KeyObject used by `crypto.verify`. */
 export declare function getReleasePublicKey(env?: NodeJS.ProcessEnv): KeyObject;
+/**
+ * True when the *effective* release key (after the `CADRE_HOST_UPDATE_DEV_KEY`
+ * override) decodes to 32 zero bytes — i.e. the all-zeros placeholder that
+ * ships in source until the release operator embeds a real public key.
+ *
+ * Consumers:
+ *  - the publish guard (`scripts/publish-package.js`) refuses to ship a build
+ *    whose embedded key is still the placeholder, so a real release can never
+ *    silently ship the dead key;
+ *  - `UpdateService.check()` logs a diagnostic breadcrumb so a misbuilt binary
+ *    is recognizable from logs rather than only as opaque `signature_invalid`.
+ */
+export declare function isPlaceholderReleaseKey(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Build an Ed25519 KeyObject from a raw 32-byte base64 public key by wrapping
  * it in the SubjectPublicKeyInfo DER prefix Node expects.

package/dist/update/release-key.js

@@ -2,25 +2,22 @@
  * Production Ed25519 public key used to verify the update manifest.
  *
  * The signing key lives offline with the release operator; only the public
- * half ever ships in the binary.
- *
- * **Provisional key.** The placeholder below is regenerated whenever the
- * release tooling is rotated — the key in this file is replaced atomically
- * by the release build. CI keys differ from prod keys; for dev/CI overrides
- * see `CADRE_HOST_UPDATE_DEV_KEY`.
+ * half ever ships in the binary. The release operator generates the keypair
+ * and embeds the public half with `scripts/release-keygen.mjs --write-source`;
+ * see the "Release signing & key management" runbook in `docs/cadre-host.md`.
+ * For dev/CI/staging overrides see `CADRE_HOST_UPDATE_DEV_KEY`.
  */
 import { createPublicKey } from 'node:crypto';
 /**
- * Raw 32-byte Ed25519 public key, base64-encoded. Placeholder pending key
- * generation by the release op. Mismatch with the real signer will surface
- * as `signature_invalid`, which the UI treats as "update available but
+ * Raw 32-byte Ed25519 public key, base64-encoded. This is the real production
+ * public key embedded by the release operator (see the "Release signing"
+ * runbook in `docs/cadre-host.md`). Before a real key was embedded the source
+ * shipped an all-zeros placeholder; `isPlaceholderReleaseKey` still detects that
+ * state and the publish guard refuses to ship it. Mismatch with the real signer
+ * surfaces as `signature_invalid`, which the UI treats as "update available but
  * unverifiable" rather than auto-applying.
- *
- * The real key generation/publication procedure is tracked in the
- * release-tooling backlog; until then, the dev override below is the only
- * supported path for CI + local manifest testing.
  */
-const PROD_KEY_BASE64 = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
+const PROD_KEY_BASE64 = 'XyRVnOY9DVgU6xdMgJIguOsc9B2L1o2KoU9626Nk+OE=';
 /**
  * Public key (32 raw bytes, base64) — env override beats the embedded one.
  * Used by both production and CI smoke tests.
@@ -35,6 +32,24 @@ export function getReleasePublicKeyBase64(env = process.env) {
 export function getReleasePublicKey(env = process.env) {
     return ed25519FromRaw(getReleasePublicKeyBase64(env));
 }
+/**
+ * True when the *effective* release key (after the `CADRE_HOST_UPDATE_DEV_KEY`
+ * override) decodes to 32 zero bytes — i.e. the all-zeros placeholder that
+ * ships in source until the release operator embeds a real public key.
+ *
+ * Consumers:
+ *  - the publish guard (`scripts/publish-package.js`) refuses to ship a build
+ *    whose embedded key is still the placeholder, so a real release can never
+ *    silently ship the dead key;
+ *  - `UpdateService.check()` logs a diagnostic breadcrumb so a misbuilt binary
+ *    is recognizable from logs rather than only as opaque `signature_invalid`.
+ */
+export function isPlaceholderReleaseKey(env = process.env) {
+    const raw = Buffer.from(getReleasePublicKeyBase64(env), 'base64');
+    if (raw.length !== 32)
+        return false;
+    return raw.every((b) => b === 0);
+}
 /**
  * Build an Ed25519 KeyObject from a raw 32-byte base64 public key by wrapping
  * it in the SubjectPublicKeyInfo DER prefix Node expects.

package/dist/update/release-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-key.js","sourceRoot":"","sources":["../../src/update/release-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAa,MAAM,aAAa,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"release-key.js","sourceRoot":"","sources":["../../src/update/release-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC"}