@skrr-ai/auth-core 0.1.4 → 0.1.6

package/dist/cjs/releaseManifest.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_SIGS = void 0;
+exports.buildArtifactMessage = buildArtifactMessage;
+exports.buildManifestMessage = buildManifestMessage;
+exports.verifyArtifact = verifyArtifact;
+exports.verifyManifest = verifyManifest;
+exports.getDeltaFor = getDeltaFor;
+/**
+ * release-manifest.ts — signed daemon release manifest: types, canonical
+ * signature messages, and offline ed25519 verification.
+ *
+ * PURE: depends only on `node:crypto` (plus the sibling `release-keys.ts` for
+ * the pinned trust anchors). No Electron, no logger, no fs — so it is
+ * unit-testable in isolation and safe to import from the CI release signer.
+ *
+ * SINGLE SOURCE OF TRUTH: `buildArtifactMessage` and `buildManifestMessage`
+ * define the exact bytes that get signed. The CI signer MUST import these
+ * functions rather than reimplement them — that is what eliminates
+ * signer/verifier drift. Any change here is a wire-format change and must bump
+ * the embedded `v1` tag.
+ *
+ * Mechanics mirror `desktop/src/main/updater/policySignature.ts`: the public
+ * key is base64 DER-SPKI, verified with `crypto.verify(null, ...)` (ed25519
+ * takes no digest algorithm).
+ *
+ * WHY IT LIVES IN auth-core NOW
+ *
+ * It lived in `daemon/src/release-manifest.ts`, and `skyCodeChannels.ts` beside
+ * it recorded the reason for stopping there: "the installer, the signature
+ * verification and the promotion machinery stay in the daemon, which is the
+ * only process that performs them." That premise held exactly until the CLI
+ * had to install the daemon — `skrr daemon install` on a machine with no
+ * `skrrd` cannot ask the daemon to verify the daemon.
+ *
+ * So this is the same road that move was on, not a reversal of it. A MIRROR in
+ * the CLI is the alternative and is the wrong one, with precedent: OSK-3894
+ * shipped a mirrored harness-trust table and OSK-3897 removed it, because a
+ * mirror proves two copies agree rather than proving there is one copy. For a
+ * TRUST ROOT that argument is not stylistic — a second copy of the pinned keys
+ * is a second thing that can be edited, and the edit that matters (emptying the
+ * array) disables verification silently.
+ *
+ * `SignedReleasePolicy` did NOT move. It is the daemon's own decision envelope,
+ * so the manifest is generic over it and the daemon narrows it back.
+ */
+const node_crypto_1 = require("node:crypto");
+const releaseKeys_js_1 = require("./releaseKeys.js");
+// ---------------------------------------------------------------------------
+// Canonical signature messages — THE contract. Do not reformat casually.
+// ---------------------------------------------------------------------------
+/**
+ * Canonical bytes signed for a single platform artifact. Newline-joined, fixed
+ * field order, `v1` tag. `sha256` is lowercased so the message is stable
+ * regardless of the hex casing the caller supplies.
+ */
+function buildArtifactMessage(a) {
+    return [
+        'oversky-daemon-artifact',
+        'v1',
+        a.platform,
+        a.version,
+        a.sha256.toLowerCase(),
+        a.url,
+    ].join('\n');
+}
+/**
+ * Canonical bytes signed for the whole manifest (excluding the top-level
+ * `sig`). Platform keys are sorted so the message is independent of JSON key
+ * order; each contributes `<platform>=<sha256-lower>`. `forceUpdate` is
+ * serialized strictly (`String(forceUpdate === true)` → `"true"`/`"false"`).
+ */
+function buildManifestMessage(m) {
+    return [
+        'oversky-daemon-manifest',
+        'v1',
+        m.version,
+        m.minimum,
+        String(m.forceUpdate === true),
+        ...Object.keys(m.platforms)
+            .sort()
+            .map((p) => p + '=' + m.platforms[p].sha256.toLowerCase()),
+    ].join('\n');
+}
+/**
+ * Try `sigB64` against every pinned key (supports key rotation: current +
+ * next). Never throws — a malformed key or signature is just a failed attempt.
+ * Empty key set ⇒ `{ disabled: true }` so the caller can warn-and-proceed
+ * (mirrors desktop `MANIFEST_PUBLIC_KEY=''`).
+ */
+function verifyWithKeys(message, sigB64, keys) {
+    if (keys.length === 0)
+        return { disabled: true };
+    if (!sigB64)
+        return { ok: false, reason: 'missing signature' };
+    const msg = Buffer.from(message, 'utf8');
+    const sig = Buffer.from(sigB64, 'base64');
+    for (const k of keys) {
+        try {
+            const key = (0, node_crypto_1.createPublicKey)({
+                key: Buffer.from(k.publicKeySpkiB64, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+            if ((0, node_crypto_1.verify)(null, msg, key, sig)) {
+                return { ok: true };
+            }
+        }
+        catch {
+            // Malformed key material or verify error → try the next pinned key.
+        }
+    }
+    return { ok: false, reason: 'signature did not verify against any pinned key' };
+}
+/**
+ * Upper bound on signatures we will trial-verify per artifact/manifest. A
+ * rotation window needs at most 2–3 (current + next). `sigs[]` is NOT part of
+ * the signed bytes, so an attacker can pad it; this cap bounds the verify work
+ * they can force to O(MAX_SIGS × pinnedKeys) — a few hundred microseconds even
+ * at the cap. A valid signature placed beyond the cap is treated as absent.
+ */
+exports.MAX_SIGS = 8;
+/**
+ * v2 acceptance: `{ ok: true }` if ANY provided signature verifies against ANY
+ * pinned key. This composes the two rotation axes — verifyWithKeys already
+ * loops every pinned KEY (key rotation); this adds the every-SIGNATURE loop —
+ * so a release dual-signed by [old, new] verifies for a daemon pinning only
+ * [old], only [new], or both. That is what makes rotation zero-downtime.
+ *
+ * Posture is identical to v1:
+ *  - empty pinned-key set ⇒ `{ disabled: true }` (fail-OPEN, unconfigured);
+ *  - keys present but nothing verifies ⇒ `{ ok: false }` (fail-CLOSED);
+ * and it never throws (per-key errors are swallowed inside verifyWithKeys).
+ *
+ * Security: `sigs[]` is attacker-malleable (not in the signed bytes), so trust
+ * comes SOLELY from a real ed25519 verify against a pinned key. Padding with
+ * garbage is inert; stripping every entry is at worst a denial-of-update
+ * (liveness), never a forged accept. keyId is never consulted → no keyId
+ * substitution. Each sig independently binds version/minimum/forceUpdate/
+ * platform-shas, so cross-manifest splicing is blocked exactly as in v1.
+ */
+function verifyWithKeysMulti(message, sigs, keys) {
+    if (keys.length === 0)
+        return { disabled: true };
+    let sawSignature = false;
+    // Bound attacker-supplied work; a real rotation never needs more than a few.
+    for (const entry of sigs.slice(0, exports.MAX_SIGS)) {
+        const sigB64 = typeof entry?.sig === 'string' ? entry.sig : '';
+        if (!sigB64)
+            continue;
+        sawSignature = true;
+        const r = verifyWithKeys(message, sigB64, keys); // keys non-empty ⇒ never {disabled}
+        if ('ok' in r && r.ok)
+            return { ok: true };
+    }
+    return {
+        ok: false,
+        reason: sawSignature
+            ? 'no provided signature verified against any pinned key'
+            : 'missing signature',
+    };
+}
+/**
+ * Verify a single platform artifact's `sig` over buildArtifactMessage(...).
+ * `platform` is the `<platform>-<arch>` key; `version` is the manifest version
+ * the artifact belongs to. Defaults to the baked-in pinned keys.
+ */
+function verifyArtifact(platform, version, artifact, keys = releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS) {
+    let message;
+    try {
+        message = buildArtifactMessage({
+            platform,
+            version,
+            sha256: artifact.sha256,
+            url: artifact.url,
+        });
+    }
+    catch (err) {
+        // A malformed artifact (missing string fields) must fail-closed as a clean
+        // verification failure, never an uncaught throw.
+        return { ok: false, reason: `malformed artifact: ${err.message}` };
+    }
+    // v2: a present `sigs[]` is authoritative (any-of-N). Otherwise the v1 scalar
+    // path — byte-for-byte the prior behavior.
+    if (Array.isArray(artifact.sigs) && artifact.sigs.length > 0) {
+        return verifyWithKeysMulti(message, artifact.sigs, keys);
+    }
+    return verifyWithKeys(message, artifact.sig, keys);
+}
+/**
+ * Verify the manifest's top-level `sig` over buildManifestMessage(this).
+ * Defaults to the baked-in pinned keys.
+ */
+function verifyManifest(manifest, keys = releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS) {
+    let message;
+    try {
+        message = buildManifestMessage(manifest);
+    }
+    catch (err) {
+        // A malformed manifest (e.g. a platform entry missing sha256) must
+        // fail-closed as a clean verification failure, never an uncaught throw.
+        return { ok: false, reason: `malformed manifest: ${err.message}` };
+    }
+    // v2: a present `sigs[]` is authoritative (any-of-N). Otherwise the v1 scalar
+    // path — byte-for-byte the prior behavior.
+    if (Array.isArray(manifest.sigs) && manifest.sigs.length > 0) {
+        return verifyWithKeysMulti(message, manifest.sigs, keys);
+    }
+    return verifyWithKeys(message, manifest.sig, keys);
+}
+// ---------------------------------------------------------------------------
+// Differential updates (delta metadata lookup) — UNSIGNED, optimization only.
+// ---------------------------------------------------------------------------
+/**
+ * Look up a delta patch that transforms `fromVersion`'s binary into this
+ * artifact's binary. Returns null when none is advertised or the descriptor is
+ * malformed — the caller then does a full download. PURE; validates shape only
+ * (the delta is UNSIGNED, so trust comes from verifying the RECONSTRUCTED binary
+ * against the signed `artifact.sha256`, not from this metadata).
+ */
+function getDeltaFor(artifact, fromVersion) {
+    const deltas = artifact.deltas;
+    if (!deltas || typeof deltas !== 'object')
+        return null;
+    const d = deltas[fromVersion];
+    if (!d ||
+        typeof d.url !== 'string' ||
+        typeof d.sha256 !== 'string' ||
+        typeof d.size !== 'number' ||
+        !Number.isFinite(d.size) ||
+        d.size <= 0) {
+        return null;
+    }
+    return d;
+}

package/dist/esm/index.d.ts

@@ -36,4 +36,6 @@ export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';
+export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
+export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/esm/index.js

@@ -143,6 +143,13 @@ export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATI
    reads, copies or removes what it finds (§7.2, §8.4). */
 export { findLegacyLocalState, describeLegacyState, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, } from './skyCodeChannels.js';
+// Daemon release trust: the pinned ed25519 keys and the canonical signature
+// messages. Shared because BOTH the daemon (self-update) and the CLI
+// (`skrr daemon install`, which runs when there is no daemon to ask) verify the
+// same manifest against the same root. See releaseManifest.ts for why a mirror
+// would be the wrong shape here.
+export { OVERSKY_RELEASE_PUBLIC_KEYS } from './releaseKeys.js';
+export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, } from './releaseManifest.js';
 // The one definition of the skrr root, shared by `skrr` and `skrrd`. See the
 // module for why re-deriving it kept producing divergences.
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/esm/kek/linux.js

@@ -54,7 +54,6 @@
  * cleaning up the corresponding Secret Service entry when finished.
  */
 import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import crypto from 'node:crypto';
 import os from 'node:os';
 import fs from 'node:fs';
@@ -94,7 +93,6 @@ const HKDF_INFO = Buffer.from('oversky-cred-kek-v1');
 /** Filesystem paths for Tier-3 IKM components. */
 const PATH_LOGINUID = '/proc/self/loginuid';
 const PATH_MACHINE_ID = '/etc/machine-id';
-const execFileAsync = promisify(execFile);
 let _execFileForTest = null;
 /**
  * @internal Test seam — inject a mock execFile for hermetic tests so the
@@ -108,23 +106,38 @@ export function __setExecFileForTest(fn) {
     _secretToolProbeCache = undefined;
     _tierSelection = null;
 }
-/** Default execFile wrapper used when no test override is installed. */
-const defaultExec = async (file, args, options) => {
-    const result = await execFileAsync(file, args, {
-        encoding: 'utf-8',
-        ...(options ?? {}),
+/**
+ * Default execFile wrapper used when no test override is installed.
+ *
+ * `input` is WRITTEN to the child's stdin here, and stdin is always closed. The
+ * previous version forwarded `input` as an execFile option — but only the SYNC
+ * child_process functions honour `input`; async `execFile` ignores it. So
+ * `secret-tool store`, which reads the secret from stdin, got neither the secret
+ * nor EOF and waited forever: Tier-2 enrollment could not complete on any Linux
+ * desktop with a working Secret Service. Closing stdin also means no other call
+ * can block on a tool that unexpectedly reads it.
+ */
+const defaultExec = (file, args, options) => new Promise((resolve, reject) => {
+    const { input, ...execOptions } = options ?? {};
+    const child = execFile(file, args, { encoding: 'utf-8', ...execOptions }, (err, stdout, stderr) => {
+        // Defensive coercion — when callers override the encoding, output may
+        // surface as Buffer; normalize both shapes.
+        const out = typeof stdout === 'string' ? stdout : Buffer.from(stdout).toString('utf-8');
+        const errOut = typeof stderr === 'string' ? stderr : Buffer.from(stderr).toString('utf-8');
+        if (err) {
+            // Same shape promisify(execFile) produced, which the probe reads.
+            reject(Object.assign(err, { stdout: out, stderr: errOut }));
+            return;
+        }
+        resolve({ stdout: out, stderr: errOut });
     });
-    // Defensive coercion — when callers override the encoding, stdout may
-    // surface as Buffer/Uint8Array; the typeof guard keeps both shapes safe.
-    return {
-        stdout: typeof result.stdout === 'string'
-            ? result.stdout
-            : Buffer.from(result.stdout).toString('utf-8'),
-        stderr: typeof result.stderr === 'string'
-            ? result.stderr
-            : Buffer.from(result.stderr).toString('utf-8'),
-    };
-};
+    if (child.stdin) {
+        // A child that exits without reading stdin makes the write fail with EPIPE;
+        // the exit status is what reports that, not this stream.
+        child.stdin.on('error', () => undefined);
+        child.stdin.end(input ?? '');
+    }
+});
 function exec(file, args, options) {
     const impl = _execFileForTest ?? defaultExec;
     return impl(file, args, { encoding: 'utf-8', ...options });
@@ -156,6 +169,41 @@ function readFileTrimmed(path) {
 // ---------------------------------------------------------------------------
 /** `undefined` = not yet probed; `boolean` = cached probe outcome. */
 let _secretToolProbeCache;
+/**
+ * True when `secret-tool` never started, as opposed to starting and exiting
+ * non-zero.
+ *
+ * `execFile` reports the two differently: a process that ran and failed carries
+ * its numeric exit code, and a spawn that failed carries a STRING errno. Only
+ * `ENOENT` used to count as "missing", so every other spawn failure read as a
+ * working binary — and the probe then picked the libsecret tier, whose `store`
+ * cannot succeed either, which disables the credential envelope and makes the CLI
+ * refuse to persist any credential at all.
+ *
+ * The case that found it: a PATH entry the process may not search. execvp
+ * reports EACCES rather than ENOENT once it has met one, and a systemd unit that
+ * makes /snap inaccessible while PATH still lists /snap/bin (the Dedicated Runtime
+ * daemon sandbox did) turns every missing binary into EACCES.
+ */
+function secretToolDidNotRun(err) {
+    const { code, status } = err;
+    return (typeof code === 'string' && SECRET_TOOL_UNRUNNABLE.has(code)) || status === 127;
+}
+/**
+ * Spawn errnos that mean the binary cannot be executed from here, permanently
+ * for this process. Deliberately NOT every string errno: EAGAIN, EMFILE or ENOMEM
+ * are transient, and caching "absent" on one of those would move a machine whose
+ * libsecret works onto the machine-id tier for the rest of the process — where the
+ * existing wrapped key cannot be opened and would be re-enrolled over.
+ */
+const SECRET_TOOL_UNRUNNABLE = new Set([
+    'ENOENT',
+    'EACCES',
+    'ENOTDIR',
+    'ELOOP',
+    'ENOEXEC',
+    'EPERM',
+]);
 /**
  * Probe secret-tool availability. Two checks:
  *   1. `secret-tool --version` — ENOENT or exit 127 means binary missing.
@@ -173,9 +221,7 @@ async function probeSecretTool() {
         await exec('secret-tool', ['--version']);
     }
     catch (err) {
-        const code = err.code;
-        const status = err.status;
-        if (code === 'ENOENT' || status === 127) {
+        if (secretToolDidNotRun(err)) {
             _secretToolProbeCache = false;
             return false;
         }
@@ -189,6 +235,10 @@ async function probeSecretTool() {
         _secretToolProbeCache = true;
     }
     catch (err) {
+        if (secretToolDidNotRun(err)) {
+            _secretToolProbeCache = false;
+            return false;
+        }
         const stderr = err.stderr ?? '';
         const isTransportError = DBUS_TRANSPORT_ERRORS.some((s) => stderr.includes(s));
         if (isTransportError) {

package/dist/esm/refreshClassification.js

@@ -23,8 +23,9 @@ import { PermanentAuthFailure, TransientAuthFailure } from './types.js';
 export { PermanentAuthFailure, TransientAuthFailure };
 /**
  * Maps server-supplied error codes to the canonical PermanentAuthReason values
- * exported from types.ts. Only the four values present in PermanentAuthReason
- * are listed; anything else falls through to 'REFRESH_INVALID'.
+ * exported from types.ts. `REFRESH_MISSING` is a server protocol code rather
+ * than a user-facing reason; it maps to `REFRESH_INVALID` because an identical
+ * retry cannot gain the credential the server says was absent.
  */
 const PERMANENT_CODE_SET = new Set([
     'REFRESH_INVALID',
@@ -64,6 +65,12 @@ export function classifyRefreshResponse(status, body) {
     }
     // 401 — auth failure; check for known permanent code
     if (status === 401) {
+        if (body?.code === 'REFRESH_MISSING') {
+            return {
+                kind: 'failure',
+                failure: new PermanentAuthFailure('REFRESH_INVALID', body.message ?? 'Refresh token missing'),
+            };
+        }
         const code = body?.code;
         if (code && PERMANENT_CODE_SET.has(code)) {
             return {

package/dist/esm/releaseKeys.d.ts

@@ -0,0 +1,87 @@
+/**
+ * releaseKeys.ts — ed25519 public keys pinned into the daemon binary AND the
+ * CLI that installs it.
+ *
+ * These are the trust anchors the self-updater (`update.ts`) uses to verify
+ * the signed release manifest (`daemon/latest/daemon-version.json`) and the
+ * downloaded binary artifact OFFLINE, before swapping its own binary. The
+ * matching PRIVATE half lives ONLY in CI as the Secrets Manager secret
+ * `OVERSKY_RELEASE_SIGNING_KEY` (ed25519, base64 PKCS8) — it is never checked
+ * into the repo and never shipped in the binary.
+ *
+ * CURRENT STATE: a key is pinned (`daemon-2026-07`, provisioned 2026-07-13), so
+ * self-update signature verification is FAIL-CLOSED — an unsigned or
+ * badly-signed manifest or binary aborts the update.
+ *
+ * READ THE NEXT PARAGRAPH BEFORE EMPTYING THIS ARRAY.
+ *
+ * The empty array is not a safe default; it is a DISABLED SECURITY CONTROL.
+ * With no key pinned, `update.ts` logs a warning and proceeds on TLS + SHA256
+ * only — and the SHA256 comes from the same manifest fetched over the same
+ * channel, so it defends against corruption in transit, not against a
+ * compromised or spoofed update feed. That posture (mirrored from the desktop
+ * `MANIFEST_PUBLIC_KEY=''` default) existed because the keypair had not been
+ * minted yet. It has been minted. Removing the last entry below silently
+ * re-disables offline verification on every daemon that ships the change, and
+ * nothing in the build fails to tell you.
+ *
+ * To add a key (rotation, or re-provisioning after a compromise) run
+ * `node scripts/generate-release-keypair.mjs`. It mints the ed25519 keypair,
+ * prints the ready-to-paste `{ keyId, publicKeySpkiB64 }` line for the array
+ * below, and prints the commands to store the PRIVATE half in the GitHub
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager. Never commit the
+ * private half; the CI signer reads `OVERSKY_RELEASE_SIGNING_KEY` and MUST
+ * import `buildArtifactMessage` / `buildManifestMessage` from
+ * `release-manifest.ts` rather than reimplementing them, so signer and verifier
+ * can never drift. Add the *next* key alongside the current one BEFORE
+ * rotating, so an in-flight rotation verifies against either — the full
+ * procedure is the rotation runbook on the array below.
+ */
+export interface ReleaseKey {
+    /** Human-readable key identifier, e.g. `daemon-2026-07`. Mirrors manifest `keyId`. */
+    keyId: string;
+    /** base64-encoded DER-SPKI ed25519 public key. */
+    publicKeySpkiB64: string;
+}
+/**
+ * Pinned release-signing public keys, newest first. Verification tries each
+ * key in turn (key rotation: keep current + next together during a rotation
+ * window). Non-empty → fail-closed, which is the state today. Empty →
+ * verification DISABLED with only a logged warning; see the file header before
+ * ever letting this array become empty.
+ *
+ * ZERO-DOWNTIME KEY-ROTATION RUNBOOK (config-only, no code change):
+ *   1. Mint the next keypair: `node scripts/generate-release-keypair.mjs --force`.
+ *   2. Pin its public half ABOVE the current key in the array below, and ship
+ *      that daemon build so the fleet trusts BOTH keys.
+ *   3. Store the new private half as the GH Actions secret
+ *      OVERSKY_RELEASE_SIGNING_KEY_NEXT (+ optional OVERSKY_RELEASE_KEY_ID_NEXT
+ *      label) — the signer then DUAL-SIGNS every release, emitting the additive
+ *      v2 `sigs[]` envelope (scalar `sig` stays = the current/primary key so
+ *      daemons that haven't picked up step 2 yet still verify).
+ *   4. Cut one release during the overlap window; it verifies for daemons
+ *      pinning the old key, the new key, or both (see release-manifest.test.ts
+ *      "ROTATION headroom").
+ *   5. Once the new-key build has saturated the fleet: promote NEXT→primary
+ *      (rename the secret to OVERSKY_RELEASE_SIGNING_KEY), drop the old key from
+ *      the array, and remove OVERSKY_RELEASE_SIGNING_KEY_NEXT. No downtime, and
+ *      no further code change — the multi-sig machinery is already shipped.
+ */
+/**
+ * NOT ROTATED FOR THE skrr RENAME. Owner decision, 2026-08-31.
+ *
+ * A rename is not a compromise. Custody is already established (GH Actions
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager), the keyId
+ * `daemon-2026-07` is a date, not a brand, and no user ever sees any of it.
+ *
+ * The rotation procedure documented above is shipped and correct — it just has
+ * nothing to do here. Running it would cost a fleet-saturation window (step 5)
+ * and buy nothing, and the window is exactly when a self-update path is most
+ * fragile. Rotate on a compromise or an expiry, not on a rename.
+ *
+ * The signed message prefix (`oversky-daemon-manifest`) stays for the same
+ * reason: it lives inside the signed bytes, so changing it breaks verification
+ * between old and new peers with zero user-visible benefit — the same call made
+ * for `X-Oversky-Origin`.
+ */
+export declare const OVERSKY_RELEASE_PUBLIC_KEYS: ReleaseKey[];

package/dist/esm/releaseKeys.js

@@ -0,0 +1,91 @@
+/**
+ * releaseKeys.ts — ed25519 public keys pinned into the daemon binary AND the
+ * CLI that installs it.
+ *
+ * These are the trust anchors the self-updater (`update.ts`) uses to verify
+ * the signed release manifest (`daemon/latest/daemon-version.json`) and the
+ * downloaded binary artifact OFFLINE, before swapping its own binary. The
+ * matching PRIVATE half lives ONLY in CI as the Secrets Manager secret
+ * `OVERSKY_RELEASE_SIGNING_KEY` (ed25519, base64 PKCS8) — it is never checked
+ * into the repo and never shipped in the binary.
+ *
+ * CURRENT STATE: a key is pinned (`daemon-2026-07`, provisioned 2026-07-13), so
+ * self-update signature verification is FAIL-CLOSED — an unsigned or
+ * badly-signed manifest or binary aborts the update.
+ *
+ * READ THE NEXT PARAGRAPH BEFORE EMPTYING THIS ARRAY.
+ *
+ * The empty array is not a safe default; it is a DISABLED SECURITY CONTROL.
+ * With no key pinned, `update.ts` logs a warning and proceeds on TLS + SHA256
+ * only — and the SHA256 comes from the same manifest fetched over the same
+ * channel, so it defends against corruption in transit, not against a
+ * compromised or spoofed update feed. That posture (mirrored from the desktop
+ * `MANIFEST_PUBLIC_KEY=''` default) existed because the keypair had not been
+ * minted yet. It has been minted. Removing the last entry below silently
+ * re-disables offline verification on every daemon that ships the change, and
+ * nothing in the build fails to tell you.
+ *
+ * To add a key (rotation, or re-provisioning after a compromise) run
+ * `node scripts/generate-release-keypair.mjs`. It mints the ed25519 keypair,
+ * prints the ready-to-paste `{ keyId, publicKeySpkiB64 }` line for the array
+ * below, and prints the commands to store the PRIVATE half in the GitHub
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager. Never commit the
+ * private half; the CI signer reads `OVERSKY_RELEASE_SIGNING_KEY` and MUST
+ * import `buildArtifactMessage` / `buildManifestMessage` from
+ * `release-manifest.ts` rather than reimplementing them, so signer and verifier
+ * can never drift. Add the *next* key alongside the current one BEFORE
+ * rotating, so an in-flight rotation verifies against either — the full
+ * procedure is the rotation runbook on the array below.
+ */
+/**
+ * Pinned release-signing public keys, newest first. Verification tries each
+ * key in turn (key rotation: keep current + next together during a rotation
+ * window). Non-empty → fail-closed, which is the state today. Empty →
+ * verification DISABLED with only a logged warning; see the file header before
+ * ever letting this array become empty.
+ *
+ * ZERO-DOWNTIME KEY-ROTATION RUNBOOK (config-only, no code change):
+ *   1. Mint the next keypair: `node scripts/generate-release-keypair.mjs --force`.
+ *   2. Pin its public half ABOVE the current key in the array below, and ship
+ *      that daemon build so the fleet trusts BOTH keys.
+ *   3. Store the new private half as the GH Actions secret
+ *      OVERSKY_RELEASE_SIGNING_KEY_NEXT (+ optional OVERSKY_RELEASE_KEY_ID_NEXT
+ *      label) — the signer then DUAL-SIGNS every release, emitting the additive
+ *      v2 `sigs[]` envelope (scalar `sig` stays = the current/primary key so
+ *      daemons that haven't picked up step 2 yet still verify).
+ *   4. Cut one release during the overlap window; it verifies for daemons
+ *      pinning the old key, the new key, or both (see release-manifest.test.ts
+ *      "ROTATION headroom").
+ *   5. Once the new-key build has saturated the fleet: promote NEXT→primary
+ *      (rename the secret to OVERSKY_RELEASE_SIGNING_KEY), drop the old key from
+ *      the array, and remove OVERSKY_RELEASE_SIGNING_KEY_NEXT. No downtime, and
+ *      no further code change — the multi-sig machinery is already shipped.
+ */
+/**
+ * NOT ROTATED FOR THE skrr RENAME. Owner decision, 2026-08-31.
+ *
+ * A rename is not a compromise. Custody is already established (GH Actions
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager), the keyId
+ * `daemon-2026-07` is a date, not a brand, and no user ever sees any of it.
+ *
+ * The rotation procedure documented above is shipped and correct — it just has
+ * nothing to do here. Running it would cost a fleet-saturation window (step 5)
+ * and buy nothing, and the window is exactly when a self-update path is most
+ * fragile. Rotate on a compromise or an expiry, not on a rename.
+ *
+ * The signed message prefix (`oversky-daemon-manifest`) stays for the same
+ * reason: it lives inside the signed bytes, so changing it breaks verification
+ * between old and new peers with zero user-visible benefit — the same call made
+ * for `X-Oversky-Origin`.
+ */
+export const OVERSKY_RELEASE_PUBLIC_KEYS = [
+    // ── NEXT key goes ABOVE this line during a rotation (newest first). ──
+    // Provisioned 2026-07-13. Private half: GH Actions secret
+    // OVERSKY_RELEASE_SIGNING_KEY + AWS Secrets Manager
+    // (us-east-1: oversky/daemon/release-signing-key). Self-update signature
+    // verification is now FAIL-CLOSED.
+    {
+        keyId: 'daemon-2026-07',
+        publicKeySpkiB64: 'MCowBQYDK2VwAyEA7ArbRnkbRW354XZ4MNS1MRLCwrTFauQzsw4GP27mMfI=',
+    },
+];