@signenvoy/cli 0.0.0-reserved → 0.1.0

package/EULA.txt

@@ -0,0 +1,54 @@
+SignEnvoy Command-Line Client (senv) End User License Agreement
+PRE-RELEASE TEXT, version 2026-08-pre1. Pending counsel review (ADR 0006,
+SignEnvoy/signenvoy). The reviewed text will replace this file and bump the
+version; senv will ask you to accept it again.
+
+This agreement is between you and SignEnvoy ("we", "us") and covers the
+senv software in binary form ("the Software").
+
+1. License. We grant you a non-exclusive, non-transferable, revocable
+   license to install and run the Software on machines you control, solely
+   to use the SignEnvoy service under your SignEnvoy account and its terms.
+
+2. Restrictions. You may not: (a) reverse engineer, decompile, or
+   disassemble the Software, except where applicable law forbids this
+   restriction; (b) redistribute, sell, rent, sublicense, or host the
+   Software for third parties; (c) remove or alter any notice, signature,
+   or license file shipped with it; (d) use the Software to probe, overload,
+   or interfere with the SignEnvoy service or other customers.
+
+3. Ownership. The Software is licensed, not sold. We and our licensors keep
+   all rights not expressly granted. Third-party components are listed with
+   their licenses in THIRD_PARTY_NOTICES (senv legal notices).
+
+4. No telemetry. The Software sends no usage or diagnostic data to us. It
+   communicates only with the SignEnvoy API you configure and, for
+   self-update, with the release manifest host. Its user agent identifies
+   the Software version, operating system, and architecture only.
+
+5. Updates. We may publish updated versions. The Software verifies the
+   cryptographic signature of any update before installing it. You may
+   disable update checks (SENV_NO_UPDATE_CHECK=1).
+
+6. Termination. This license ends automatically if you breach it, and we
+   may end it on notice for abuse of the SignEnvoy service. On termination
+   you must stop using and delete the Software. Sections 3, 7, and 8 survive.
+
+7. Disclaimer. THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+   KIND. To the extent permitted by law we disclaim all warranties, express
+   or implied, including merchantability, fitness for a particular purpose,
+   and non-infringement.
+
+8. Limitation of liability. To the extent permitted by law, we are not
+   liable for indirect, incidental, special, consequential, or punitive
+   damages, or lost profits or data, arising from the Software, and our
+   total liability for the Software is limited to the amount you paid for
+   it, which is zero.
+
+9. General. This agreement is governed by the law stated in the SignEnvoy
+   service terms and is the entire agreement about the Software. If a
+   provision is unenforceable, the rest remains in effect.
+
+By accepting (senv prompts on first run; pass --accept-eula or set
+SENV_ACCEPT_EULA=1 in non-interactive environments) you agree to these
+terms.

package/README.md

@@ -1,3 +1,11 @@
 # @signenvoy/cli
 
-Name reserved for senv, the SignEnvoy command-line client (closed source, under the SignEnvoy EULA). The first release publishes the real package; until then there is nothing to install here. Docs: https://docs.signenvoy.com
+Installs senv, the SignEnvoy command-line client, as a platform-specific
+binary (one of the @signenvoy/cli-<os>-<cpu> optional dependencies).
+Distributed under the SignEnvoy EULA (EULA.txt); first run asks you to
+accept it. No telemetry.
+
+    npx @signenvoy/cli --version
+    npm install -g @signenvoy/cli && senv login
+
+Docs: https://docs.signenvoy.com/cli

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,103 @@
+# Third-party notices
+
+senv (the SignEnvoy command-line client) is closed-source software
+distributed under the SignEnvoy EULA. It is built with the open-source
+components below, each under a permissive license, across every shipped
+platform. Generated by `make notices` (google/go-licenses over
+darwin, linux, and windows builds); edits are overwritten.
+
+## aead.dev/minisign
+
+- License: MIT
+- Source: https://github.com/aead/minisign.git/blob/v0.2.0/LICENSE
+
+## github.com/apapsch/go-jsonmerge/v2
+
+- License: MIT
+- Source: https://github.com/apapsch/go-jsonmerge/blob/v2.0.0/LICENSE
+
+## github.com/danieljoos/wincred
+
+- License: MIT
+- Source: https://github.com/danieljoos/wincred/blob/v1.2.3/LICENSE
+
+## github.com/godbus/dbus/v5
+
+- License: BSD-2-Clause
+- Source: https://github.com/godbus/dbus/blob/v5.2.2/LICENSE
+
+## github.com/google/uuid
+
+- License: BSD-3-Clause
+- Source: https://github.com/google/uuid/blob/v1.6.0/LICENSE
+
+## github.com/inconshreveable/mousetrap
+
+- License: Apache-2.0
+- Source: https://github.com/inconshreveable/mousetrap/blob/v1.1.0/LICENSE
+
+## github.com/minio/selfupdate
+
+- License: Apache-2.0
+- Source: https://github.com/minio/selfupdate/blob/v0.6.0/LICENSE
+
+## github.com/minio/selfupdate/internal/binarydist
+
+- License: MIT
+- Source: https://github.com/minio/selfupdate/blob/v0.6.0/internal/binarydist/License
+
+## github.com/minio/selfupdate/internal/osext
+
+- License: BSD-3-Clause
+- Source: https://github.com/minio/selfupdate/blob/v0.6.0/internal/osext/LICENSE
+
+## github.com/oapi-codegen/runtime
+
+- License: Apache-2.0
+- Source: https://github.com/oapi-codegen/runtime/blob/v1.7.0/LICENSE
+
+## github.com/pkg/browser
+
+- License: BSD-2-Clause
+- Source: https://github.com/pkg/browser/blob/5ac0b6a4141c/LICENSE
+
+## github.com/spf13/cobra
+
+- License: Apache-2.0
+- Source: https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt
+
+## github.com/spf13/pflag
+
+- License: BSD-3-Clause
+- Source: https://github.com/spf13/pflag/blob/v1.0.9/LICENSE
+
+## github.com/zalando/go-keyring
+
+- License: MIT
+- Source: https://github.com/zalando/go-keyring/blob/v0.2.8/LICENSE
+
+## github.com/zalando/go-keyring/internal/shellescape
+
+- License: MIT
+- Source: https://github.com/zalando/go-keyring/blob/v0.2.8/internal/shellescape/LICENSE
+
+## golang.org/x/crypto
+
+- License: BSD-3-Clause
+- Source: https://cs.opensource.google/go/x/crypto/+/v0.46.0:LICENSE
+
+## golang.org/x/sys
+
+- License: BSD-3-Clause
+- Source: https://cs.opensource.google/go/x/sys/+/v0.47.0:LICENSE
+
+## golang.org/x/term
+
+- License: BSD-3-Clause
+- Source: https://cs.opensource.google/go/x/term/+/v0.45.0:LICENSE
+
+## gopkg.in/yaml.v3
+
+- License: MIT
+- Source: https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE
+

package/bin/senv.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// @signenvoy/cli shim: resolves the platform package installed as an
+// optional dependency and execs the senv binary with stdio inherited and
+// the exit code passed through.
+"use strict";
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+
+const os = process.platform; // darwin | linux | win32
+const cpu = process.arch; // arm64 | x64
+const pkg = `@signenvoy/cli-${os}-${cpu}`;
+const bin = os === "win32" ? "senv.exe" : "senv";
+
+let exe;
+try {
+  exe = path.join(path.dirname(require.resolve(`${pkg}/package.json`)), "bin", bin);
+} catch (e) {
+  process.stderr.write(
+    `senv: no binary for ${os}/${cpu} (${pkg} is not installed).\n` +
+      `  If you installed with --no-optional or --ignore-optional, reinstall without it,\n` +
+      `  or download a build from https://signenvoy.com/downloads\n`,
+  );
+  process.exit(2);
+}
+
+const result = spawnSync(exe, process.argv.slice(2), { stdio: "inherit" });
+if (result.error) {
+  process.stderr.write(`senv: could not start ${exe}: ${result.error.message}\n`);
+  process.exit(2);
+}
+process.exit(result.status === null ? 2 : result.status);

package/package.json

@@ -1,9 +1,27 @@
 {
+  "bin": {
+    "senv": "bin/senv.js"
+  },
+  "description": "senv: the SignEnvoy command-line client (binary distribution under the SignEnvoy EULA)",
+  "engines": {
+    "node": "\u003e=18"
+  },
+  "files": [
+    "bin",
+    "EULA.txt",
+    "THIRD_PARTY_NOTICES.md",
+    "README.md"
+  ],
+  "homepage": "https://signenvoy.com/downloads",
+  "license": "SEE LICENSE IN EULA.txt",
   "name": "@signenvoy/cli",
-  "version": "0.0.0-reserved",
-  "description": "senv, the SignEnvoy command-line client. Name reserved; the first release publishes the real package.",
-  "license": "SEE LICENSE IN EULA",
-  "homepage": "https://docs.signenvoy.com",
-  "repository": { "type": "git", "url": "https://github.com/SignEnvoy/senv-releases" },
-  "files": ["README.md", "EULA"]
+  "optionalDependencies": {
+    "@signenvoy/cli-darwin-arm64": "0.1.0",
+    "@signenvoy/cli-darwin-x64": "0.1.0",
+    "@signenvoy/cli-linux-arm64": "0.1.0",
+    "@signenvoy/cli-linux-x64": "0.1.0",
+    "@signenvoy/cli-win32-arm64": "0.1.0",
+    "@signenvoy/cli-win32-x64": "0.1.0"
+  },
+  "version": "0.1.0"
 }

package/EULA

@@ -1 +0,0 @@
-Reserved. The SignEnvoy CLI EULA ships with the first release.