@skrr-ai/cli 0.1.31 → 0.1.33

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.d.ts

@@ -0,0 +1,248 @@
+/**
+ * The first-party harness identity — the ONLY place its product name is written.
+ *
+ * "First-party harness" is the harness provider this platform builds, signs,
+ * distributes and installs itself: today a fork of OpenCode sold as skrr Code.
+ * It is a different axis from trust Tier 1 in `harnessTrust.ts`, whose
+ * "first-party" means an audited VENDOR harness such as Claude Code.
+ *
+ * ── Why a module, not a find/replace ──────────────────────────────────────
+ *
+ * The product was renamed twice ("OverSky" engine → "Sky Code" → "skrr Code"),
+ * and because its name was used as an IDENTIFIER — in file names, function
+ * names, env vars, workflow inputs, Mongo values, wire events — the second
+ * rename left 2,826 occurrences in 361 files spelled eleven ways. Every one was
+ * a place the next rename would have to find again.
+ *
+ * So the rule is: the product name is a VALUE held here, and every NAME in the
+ * codebase is brand-neutral and reads it. Renaming the product again is:
+ *
+ *   1. set `displayName` and `provider`;
+ *   2. move the old `provider` to the front of `aliases`;
+ *   3. leave `wireProvider` on the spelling installed daemons still speak;
+ *   4. regenerate `first-party-harness.json`
+ *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
+ *   5. ship the data migration, which is generic over `aliases`.
+ *
+ * No identifier, file, env var name or workflow input moves.
+ *
+ * ── Three spellings, kept apart on purpose ────────────────────────────────
+ *
+ * `provider`     CANONICAL. What the platform stores, returns and renders.
+ * `aliases`      ACCEPTED on every ingress until contract, and normalised to
+ *                canonical at the edge. Nothing new is ever written with one.
+ * `wireProvider` What the server and a daemon say to EACH OTHER — the
+ *                capability a daemon advertises, `daemon:<p>:request|response`,
+ *                the `provider` of a session RPC. It moves LAST, because a
+ *                daemon on a user's machine may be any version and the server
+ *                cannot tell which one sent a request.
+ *
+ * The old code treated those three as one string, which is why no single
+ * change could rename it safely. See
+ * `docs/architecture/skrr-code-identifier-rename-2026-09-13.md`.
+ *
+ * ── Constraints on this file ──────────────────────────────────────────────
+ *
+ * Pure: no `node:` imports, no `process` at module load. It is published as the
+ * `@skrr-ai/auth-core/first-party-harness` subpath so the browser client and
+ * the React Native app can read it, and a Node-only import here would break
+ * both bundles at a distance.
+ */
+export interface FirstPartyHarnessIdentity {
+    /** What a person reads. Lowercase brand inside a compound (naming map §1). */
+    readonly displayName: string;
+    /** The command a person types, as it appears in prose. */
+    readonly command: string;
+    /** Canonical provider slug: stored, returned by the API, rendered. */
+    readonly provider: string;
+    /** Older spellings still ACCEPTED on every ingress, newest first. */
+    readonly aliases: readonly string[];
+    /** The spelling daemons and the server exchange on the wire. */
+    readonly wireProvider: string;
+}
+/**
+ * THE identity — the only literal product name in the codebase.
+ *
+ * Phase: EXPAND. `provider` is still the spelling every stored row carries;
+ * `skrr-code` is accepted everywhere so the flip can follow once every reader
+ * has shipped.
+ */
+declare const IDENTITY: {
+    readonly displayName: "skrr Code";
+    readonly command: "skrr code";
+    readonly provider: "sky-code";
+    readonly aliases: readonly ["skrr-code"];
+    readonly wireProvider: "sky-code";
+};
+/** The canonical slug, as a literal type. */
+export type FirstPartyHarnessCanonicalProvider = typeof IDENTITY.provider;
+/** Any accepted spelling, as a literal type — for unions that must admit an alias. */
+export type FirstPartyHarnessProvider = typeof IDENTITY.provider | (typeof IDENTITY.aliases)[number];
+/** `local-<spelling>` for every accepted spelling. */
+export type FirstPartyHarnessEnvironmentName = `local-${FirstPartyHarnessProvider}`;
+/** `<spelling>_session` for every accepted spelling. */
+export type FirstPartyHarnessCapabilityName = `${FirstPartyHarnessProvider}_session`;
+export declare const FIRST_PARTY_HARNESS: FirstPartyHarnessIdentity;
+/** The canonical slug with its literal type, for `as const` tuples and keyed tables. */
+export declare const FIRST_PARTY_HARNESS_PROVIDER: FirstPartyHarnessCanonicalProvider;
+/** Every spelling, canonical first. The order is the resolution order. */
+export declare function firstPartyHarnessSpellings(): readonly string[];
+/** True for the canonical provider or any alias (case- and whitespace-insensitive). */
+export declare function isFirstPartyHarnessProvider(value: unknown): boolean;
+/**
+ * The canonical provider for any spelling of the first-party harness; every
+ * other value is returned UNCHANGED (this is not a general normaliser — the
+ * caller's own normalisation still owns case and shape for other providers).
+ */
+export declare function canonicalHarnessProvider<T>(value: T): T | string;
+/**
+ * Every spelling a stored row for this provider may carry, canonical first —
+ * for a Mongo `$in` filter while rows written before a flip still exist. Any
+ * other provider is returned as a one-element list.
+ */
+export declare function harnessProviderSpellings(value: string): string[];
+/** The spelling to put ON THE WIRE to a daemon; other providers pass through. */
+export declare function wireHarnessProvider(value: string): string;
+/** True when two provider values name the same harness, whatever spelling each uses. */
+export declare function isSameHarnessProvider(a: unknown, b: unknown): boolean;
+export declare function firstPartyHarnessCapability(provider?: string): string;
+/** Every capability spelling, canonical first. */
+export declare function firstPartyHarnessCapabilities(): readonly string[];
+/** The capability a daemon advertises. */
+export declare function firstPartyHarnessWireCapability(): string;
+export declare function isFirstPartyHarnessCapability(value: unknown): boolean;
+/** `<alias>_session` → `<provider>_session`; every other value unchanged. */
+export declare function canonicalSessionCapability<T>(value: T): T | string;
+/**
+ * Whether a capability list contains `capability` under ANY accepted spelling.
+ *
+ * A daemon advertises the capability it was built with, and a daemon on a user's
+ * machine may be any version, so around a rename the same harness arrives as
+ * more than one `<provider>_session`. An exact `includes` against the canonical
+ * spelling reads the older one as "not installed" — a card that never lights up,
+ * a dispatch refused — with no error. Every other capability compares exactly.
+ */
+export declare function advertisesSessionCapability(capabilities: readonly unknown[] | null | undefined, capability: string): boolean;
+export declare function firstPartyHarnessEnvironment(provider?: string): string;
+/** Every environment spelling, canonical first. */
+export declare function firstPartyHarnessEnvironments(): readonly string[];
+export declare function isFirstPartyHarnessEnvironment(value: unknown): boolean;
+/** `local-<alias>` → `local-<provider>`; every other value unchanged. */
+export declare function canonicalExecutionEnvironment<T>(value: T): T | string;
+/** Binary file name. `platform` is a `process.platform` value; only `win32` differs. */
+export declare function firstPartyHarnessBinaryName(provider?: string, platform?: string): string;
+/** Every binary file name, canonical first — the lookup order. */
+export declare function firstPartyHarnessBinaryNames(platform?: string): readonly string[];
+/**
+ * The engine home directory name under the skrr config root.
+ *
+ * It follows the ENGINE's namespace (`FIRST_PARTY_HARNESS_ENGINE.appName`), not
+ * the provider slug, because it is one directory with two owners: the platform
+ * installs the binary into `<home>/bin`, and the engine reads its own config and
+ * the managed `AGENTS.md` from `<home>`. Deriving it from the provider would, on
+ * a fresh install after a provider rename, create a second directory the engine
+ * never reads — managed instructions would stop applying with no error. It moves
+ * when the engine's namespace moves, and not before.
+ */
+export declare function firstPartyHarnessHomeDirname(): string;
+/** Signed release manifest file name. */
+export declare function firstPartyHarnessManifestFile(provider?: string): string;
+/**
+ * The update feed ORIGIN. Not a product name, and not moved by this identity:
+ * a feed host sits inside signed manifests (naming map §2 "Update feed").
+ */
+export declare const FIRST_PARTY_HARNESS_FEED_ORIGIN = "https://updates.oversky.ai";
+/** Object-key prefix for one spelling's feed, e.g. `skrr-code/`. */
+export declare function firstPartyHarnessFeedPrefix(provider?: string): string;
+/** Every feed prefix, canonical first. Publishing writes all of them. */
+export declare function firstPartyHarnessFeedPrefixes(): readonly string[];
+/** Object-key prefix the fork stages unsigned builds under, e.g. `skrr-code-staging/`. */
+export declare function firstPartyHarnessStagingPrefix(provider?: string): string;
+/** Default feed base URL for one spelling. */
+export declare function firstPartyHarnessDefaultFeedBase(provider?: string): string;
+export interface FirstPartyHarnessEnvName {
+    /** Brand-neutral name. Set this one. */
+    readonly name: string;
+    /** Older names still read, in precedence order, until contract. */
+    readonly legacy: readonly string[];
+}
+/**
+ * Every environment variable the platform reads for the first-party harness,
+ * by purpose. The neutral name wins; a legacy name is read only when the neutral
+ * one is unset or blank, because a variable set in an ECS task definition, a
+ * user's shell or a LaunchAgent does not change when the code does.
+ */
+export declare const FIRST_PARTY_HARNESS_ENV: Readonly<{
+    /** Absolute path to an engine binary, overriding resolution. */
+    path: FirstPartyHarnessEnvName;
+    /** Forces the CLI's managed-inference mode. */
+    managed: FirstPartyHarnessEnvName;
+    /** Update channel. */
+    channel: FirstPartyHarnessEnvName;
+    /** Update-feed base URL override. */
+    updateFeedBase: FirstPartyHarnessEnvName;
+    /** Path to a file of development release keys. */
+    devKeys: FirstPartyHarnessEnvName;
+    /** Engine version the desktop build bundles. */
+    bundleVersion: FirstPartyHarnessEnvName;
+    /** Engine home override (the engine reads its own name too — see ENGINE env below). */
+    home: FirstPartyHarnessEnvName;
+    /** Engine version baked into the cloud-coding image. */
+    cloudCodingVersion: FirstPartyHarnessEnvName;
+    /** Engine version baked into the Dedicated Runtime AMI. */
+    dedicatedRuntimeVersion: FirstPartyHarnessEnvName;
+    /** Engine version the desktop release workflow bundles. */
+    desktopBundledVersion: FirstPartyHarnessEnvName;
+    /** Update-feed bucket used by publish and promote. */
+    updatesBucket: FirstPartyHarnessEnvName;
+    /** Release signing key (CI secret). */
+    signingKey: FirstPartyHarnessEnvName;
+    /** Release signing key id (CI secret). */
+    signingKeyId: FirstPartyHarnessEnvName;
+}>;
+export type FirstPartyHarnessEnvKey = keyof typeof FIRST_PARTY_HARNESS_ENV;
+export interface FirstPartyHarnessEnvReading {
+    /** Trimmed, non-empty value, or undefined when nothing is set. */
+    readonly value: string | undefined;
+    /** The variable that supplied `value`. */
+    readonly name: string | undefined;
+    /** True when the value came from a legacy name — worth telling the operator. */
+    readonly legacy: boolean;
+}
+/** Every name for one purpose, neutral first — for spawn-env forwarding and sanitisers. */
+export declare function firstPartyHarnessEnvNames(key: FirstPartyHarnessEnvKey): readonly string[];
+/** Read one purpose's variable: neutral name first, legacy names after. */
+export declare function readFirstPartyHarnessEnv(env: Readonly<Record<string, string | undefined>>, key: FirstPartyHarnessEnvKey): FirstPartyHarnessEnvReading;
+/**
+ * Names the ENGINE itself defines and reads. The platform sets or reads them
+ * across the daemon↔engine boundary, so they are recorded here as values rather
+ * than scattered as literals — but they are the fork's to change, and moving
+ * one is a two-sided change (contract §6). Not part of this identity's rename.
+ */
+export declare const FIRST_PARTY_HARNESS_ENGINE: Readonly<{
+    /**
+     * The engine's state namespace: XDG dirs, project marker, config basename, and
+     * the engine home under the skrr root (`firstPartyHarnessHomeDirname`).
+     */
+    appName: "sky-code";
+    /**
+     * Earlier `appName`s whose home directory `migrateFirstPartyHarnessHome` moves
+     * onto the current one. Empty until the engine's namespace is renamed.
+     */
+    legacyAppNames: readonly string[];
+    /** Project-local configuration directory inside a user's repository. */
+    projectDirectory: ".sky-code";
+    /** Environment variables the engine reads. */
+    env: Readonly<{
+        serverPassword: "SKY_CODE_SERVER_PASSWORD";
+        serverUsername: "SKY_CODE_SERVER_USERNAME";
+        home: "SKY_CODE_HOME";
+        config: "SKY_CODE_CONFIG";
+        appName: "SKY_CODE_APP_NAME";
+        scriptName: "SKY_CODE_SCRIPT_NAME";
+        allowUpstreamEgress: "SKY_CODE_ALLOW_UPSTREAM_EGRESS";
+        compatOpencode: "SKY_CODE_COMPAT_OPENCODE";
+        noCompatPrompts: "SKY_CODE_NO_COMPAT_PROMPTS";
+    }>;
+}>;
+export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.js

@@ -0,0 +1,332 @@
+/**
+ * The first-party harness identity — the ONLY place its product name is written.
+ *
+ * "First-party harness" is the harness provider this platform builds, signs,
+ * distributes and installs itself: today a fork of OpenCode sold as skrr Code.
+ * It is a different axis from trust Tier 1 in `harnessTrust.ts`, whose
+ * "first-party" means an audited VENDOR harness such as Claude Code.
+ *
+ * ── Why a module, not a find/replace ──────────────────────────────────────
+ *
+ * The product was renamed twice ("OverSky" engine → "Sky Code" → "skrr Code"),
+ * and because its name was used as an IDENTIFIER — in file names, function
+ * names, env vars, workflow inputs, Mongo values, wire events — the second
+ * rename left 2,826 occurrences in 361 files spelled eleven ways. Every one was
+ * a place the next rename would have to find again.
+ *
+ * So the rule is: the product name is a VALUE held here, and every NAME in the
+ * codebase is brand-neutral and reads it. Renaming the product again is:
+ *
+ *   1. set `displayName` and `provider`;
+ *   2. move the old `provider` to the front of `aliases`;
+ *   3. leave `wireProvider` on the spelling installed daemons still speak;
+ *   4. regenerate `first-party-harness.json`
+ *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
+ *   5. ship the data migration, which is generic over `aliases`.
+ *
+ * No identifier, file, env var name or workflow input moves.
+ *
+ * ── Three spellings, kept apart on purpose ────────────────────────────────
+ *
+ * `provider`     CANONICAL. What the platform stores, returns and renders.
+ * `aliases`      ACCEPTED on every ingress until contract, and normalised to
+ *                canonical at the edge. Nothing new is ever written with one.
+ * `wireProvider` What the server and a daemon say to EACH OTHER — the
+ *                capability a daemon advertises, `daemon:<p>:request|response`,
+ *                the `provider` of a session RPC. It moves LAST, because a
+ *                daemon on a user's machine may be any version and the server
+ *                cannot tell which one sent a request.
+ *
+ * The old code treated those three as one string, which is why no single
+ * change could rename it safely. See
+ * `docs/architecture/skrr-code-identifier-rename-2026-09-13.md`.
+ *
+ * ── Constraints on this file ──────────────────────────────────────────────
+ *
+ * Pure: no `node:` imports, no `process` at module load. It is published as the
+ * `@skrr-ai/auth-core/first-party-harness` subpath so the browser client and
+ * the React Native app can read it, and a Node-only import here would break
+ * both bundles at a distance.
+ */
+/** A slug usable as a directory name, a capability prefix and an event segment. */
+const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function defineIdentity(identity) {
+    const spellings = [identity.provider, ...identity.aliases];
+    for (const spelling of spellings) {
+        if (!SLUG.test(spelling)) {
+            throw new Error(`first-party harness spelling ${JSON.stringify(spelling)} is not a slug; it becomes a ` +
+                `directory name, a capability prefix and a wire event segment`);
+        }
+    }
+    if (new Set(spellings).size !== spellings.length) {
+        throw new Error('first-party harness provider and aliases must be distinct');
+    }
+    if (!spellings.includes(identity.wireProvider)) {
+        throw new Error(`first-party harness wireProvider ${JSON.stringify(identity.wireProvider)} must be the ` +
+            'provider or one of its aliases — a peer can only accept a spelling it knows');
+    }
+    return Object.freeze({ ...identity, aliases: Object.freeze([...identity.aliases]) });
+}
+/**
+ * THE identity — the only literal product name in the codebase.
+ *
+ * Phase: EXPAND. `provider` is still the spelling every stored row carries;
+ * `skrr-code` is accepted everywhere so the flip can follow once every reader
+ * has shipped.
+ */
+const IDENTITY = {
+    displayName: 'skrr Code',
+    command: 'skrr code',
+    provider: 'sky-code',
+    aliases: ['skrr-code'],
+    wireProvider: 'sky-code',
+};
+export const FIRST_PARTY_HARNESS = defineIdentity(IDENTITY);
+/** The canonical slug with its literal type, for `as const` tuples and keyed tables. */
+export const FIRST_PARTY_HARNESS_PROVIDER = IDENTITY.provider;
+const SPELLINGS = Object.freeze([
+    FIRST_PARTY_HARNESS.provider,
+    ...FIRST_PARTY_HARNESS.aliases,
+]);
+const SPELLING_SET = new Set(SPELLINGS);
+const SESSION_SUFFIX = '_session';
+const ENVIRONMENT_PREFIX = 'local-';
+function asSlug(value) {
+    if (typeof value !== 'string')
+        return null;
+    const slug = value.trim().toLowerCase();
+    return slug ? slug : null;
+}
+/** Every spelling, canonical first. The order is the resolution order. */
+export function firstPartyHarnessSpellings() {
+    return SPELLINGS;
+}
+/** True for the canonical provider or any alias (case- and whitespace-insensitive). */
+export function isFirstPartyHarnessProvider(value) {
+    const slug = asSlug(value);
+    return slug !== null && SPELLING_SET.has(slug);
+}
+/**
+ * The canonical provider for any spelling of the first-party harness; every
+ * other value is returned UNCHANGED (this is not a general normaliser — the
+ * caller's own normalisation still owns case and shape for other providers).
+ */
+export function canonicalHarnessProvider(value) {
+    return isFirstPartyHarnessProvider(value) ? FIRST_PARTY_HARNESS.provider : value;
+}
+/**
+ * Every spelling a stored row for this provider may carry, canonical first —
+ * for a Mongo `$in` filter while rows written before a flip still exist. Any
+ * other provider is returned as a one-element list.
+ */
+export function harnessProviderSpellings(value) {
+    return isFirstPartyHarnessProvider(value) ? [...SPELLINGS] : [value];
+}
+/** The spelling to put ON THE WIRE to a daemon; other providers pass through. */
+export function wireHarnessProvider(value) {
+    return isFirstPartyHarnessProvider(value) ? FIRST_PARTY_HARNESS.wireProvider : value;
+}
+/** True when two provider values name the same harness, whatever spelling each uses. */
+export function isSameHarnessProvider(a, b) {
+    if (typeof a !== 'string' || typeof b !== 'string')
+        return false;
+    return (canonicalHarnessProvider(a.trim().toLowerCase()) ===
+        canonicalHarnessProvider(b.trim().toLowerCase()));
+}
+/* ── Derived: session capability ─────────────────────────────────────────── */
+export function firstPartyHarnessCapability(provider = FIRST_PARTY_HARNESS.provider) {
+    return `${provider}${SESSION_SUFFIX}`;
+}
+/** Every capability spelling, canonical first. */
+export function firstPartyHarnessCapabilities() {
+    return SPELLINGS.map((spelling) => firstPartyHarnessCapability(spelling));
+}
+/** The capability a daemon advertises. */
+export function firstPartyHarnessWireCapability() {
+    return firstPartyHarnessCapability(FIRST_PARTY_HARNESS.wireProvider);
+}
+export function isFirstPartyHarnessCapability(value) {
+    const slug = asSlug(value);
+    if (slug === null || !slug.endsWith(SESSION_SUFFIX))
+        return false;
+    return SPELLING_SET.has(slug.slice(0, -SESSION_SUFFIX.length));
+}
+/** `<alias>_session` → `<provider>_session`; every other value unchanged. */
+export function canonicalSessionCapability(value) {
+    return isFirstPartyHarnessCapability(value) ? firstPartyHarnessCapability() : value;
+}
+/**
+ * Whether a capability list contains `capability` under ANY accepted spelling.
+ *
+ * A daemon advertises the capability it was built with, and a daemon on a user's
+ * machine may be any version, so around a rename the same harness arrives as
+ * more than one `<provider>_session`. An exact `includes` against the canonical
+ * spelling reads the older one as "not installed" — a card that never lights up,
+ * a dispatch refused — with no error. Every other capability compares exactly.
+ */
+export function advertisesSessionCapability(capabilities, capability) {
+    if (!Array.isArray(capabilities) || capabilities.length === 0)
+        return false;
+    const wanted = canonicalSessionCapability(capability);
+    return capabilities.some((advertised) => canonicalSessionCapability(advertised) === wanted);
+}
+/* ── Derived: pinned execution environment ───────────────────────────────── */
+export function firstPartyHarnessEnvironment(provider = FIRST_PARTY_HARNESS.provider) {
+    return `${ENVIRONMENT_PREFIX}${provider}`;
+}
+/** Every environment spelling, canonical first. */
+export function firstPartyHarnessEnvironments() {
+    return SPELLINGS.map((spelling) => firstPartyHarnessEnvironment(spelling));
+}
+export function isFirstPartyHarnessEnvironment(value) {
+    const slug = asSlug(value);
+    if (slug === null || !slug.startsWith(ENVIRONMENT_PREFIX))
+        return false;
+    return SPELLING_SET.has(slug.slice(ENVIRONMENT_PREFIX.length));
+}
+/** `local-<alias>` → `local-<provider>`; every other value unchanged. */
+export function canonicalExecutionEnvironment(value) {
+    return isFirstPartyHarnessEnvironment(value) ? firstPartyHarnessEnvironment() : value;
+}
+/* ── Derived: on-disk and distribution names ─────────────────────────────── */
+/** Binary file name. `platform` is a `process.platform` value; only `win32` differs. */
+export function firstPartyHarnessBinaryName(provider = FIRST_PARTY_HARNESS.provider, platform) {
+    return platform === 'win32' ? `${provider}.exe` : provider;
+}
+/** Every binary file name, canonical first — the lookup order. */
+export function firstPartyHarnessBinaryNames(platform) {
+    return SPELLINGS.map((spelling) => firstPartyHarnessBinaryName(spelling, platform));
+}
+/**
+ * The engine home directory name under the skrr config root.
+ *
+ * It follows the ENGINE's namespace (`FIRST_PARTY_HARNESS_ENGINE.appName`), not
+ * the provider slug, because it is one directory with two owners: the platform
+ * installs the binary into `<home>/bin`, and the engine reads its own config and
+ * the managed `AGENTS.md` from `<home>`. Deriving it from the provider would, on
+ * a fresh install after a provider rename, create a second directory the engine
+ * never reads — managed instructions would stop applying with no error. It moves
+ * when the engine's namespace moves, and not before.
+ */
+export function firstPartyHarnessHomeDirname() {
+    return FIRST_PARTY_HARNESS_ENGINE.appName;
+}
+/** Signed release manifest file name. */
+export function firstPartyHarnessManifestFile(provider = FIRST_PARTY_HARNESS.provider) {
+    return `${provider}-version.json`;
+}
+/**
+ * The update feed ORIGIN. Not a product name, and not moved by this identity:
+ * a feed host sits inside signed manifests (naming map §2 "Update feed").
+ */
+export const FIRST_PARTY_HARNESS_FEED_ORIGIN = 'https://updates.oversky.ai';
+/** Object-key prefix for one spelling's feed, e.g. `skrr-code/`. */
+export function firstPartyHarnessFeedPrefix(provider = FIRST_PARTY_HARNESS.provider) {
+    return `${provider}/`;
+}
+/** Every feed prefix, canonical first. Publishing writes all of them. */
+export function firstPartyHarnessFeedPrefixes() {
+    return SPELLINGS.map((spelling) => firstPartyHarnessFeedPrefix(spelling));
+}
+/** Object-key prefix the fork stages unsigned builds under, e.g. `skrr-code-staging/`. */
+export function firstPartyHarnessStagingPrefix(provider = FIRST_PARTY_HARNESS.provider) {
+    return `${provider}-staging/`;
+}
+/** Default feed base URL for one spelling. */
+export function firstPartyHarnessDefaultFeedBase(provider = FIRST_PARTY_HARNESS.provider) {
+    return `${FIRST_PARTY_HARNESS_FEED_ORIGIN}/${provider}`;
+}
+function envName(name, legacy) {
+    return Object.freeze({ name, legacy: Object.freeze([...legacy]) });
+}
+/**
+ * Every environment variable the platform reads for the first-party harness,
+ * by purpose. The neutral name wins; a legacy name is read only when the neutral
+ * one is unset or blank, because a variable set in an ECS task definition, a
+ * user's shell or a LaunchAgent does not change when the code does.
+ */
+export const FIRST_PARTY_HARNESS_ENV = Object.freeze({
+    /** Absolute path to an engine binary, overriding resolution. */
+    path: envName('SKRR_FIRST_PARTY_HARNESS_PATH', ['OVERSKY_SKY_CODE_PATH']),
+    /** Forces the CLI's managed-inference mode. */
+    managed: envName('SKRR_FIRST_PARTY_HARNESS_MANAGED', ['OVERSKY_SKY_CODE_MANAGED']),
+    /** Update channel. */
+    channel: envName('SKRR_FIRST_PARTY_HARNESS_CHANNEL', ['OVERSKY_SKY_CODE_CHANNEL']),
+    /** Update-feed base URL override. */
+    updateFeedBase: envName('SKRR_FIRST_PARTY_HARNESS_UPDATE_FEED_BASE', [
+        'OVERSKY_SKY_CODE_UPDATE_FEED_BASE',
+    ]),
+    /** Path to a file of development release keys. */
+    devKeys: envName('SKRR_FIRST_PARTY_HARNESS_DEV_KEYS', ['OVERSKY_SKY_CODE_DEV_KEYS']),
+    /** Engine version the desktop build bundles. */
+    bundleVersion: envName('SKRR_FIRST_PARTY_HARNESS_BUNDLE_VERSION', ['OVERSKY_BUNDLE_SKY_CODE']),
+    /** Engine home override (the engine reads its own name too — see ENGINE env below). */
+    home: envName('SKRR_FIRST_PARTY_HARNESS_HOME', ['SKY_CODE_HOME']),
+    /** Engine version baked into the cloud-coding image. */
+    cloudCodingVersion: envName('CLOUD_CODING_FIRST_PARTY_HARNESS_VERSION', [
+        'CLOUD_CODING_SKY_CODE_VERSION',
+    ]),
+    /** Engine version baked into the Dedicated Runtime AMI. */
+    dedicatedRuntimeVersion: envName('SKRR_DEDICATED_RUNTIME_FIRST_PARTY_HARNESS_VERSION', [
+        'SKRR_DEDICATED_RUNTIME_SKY_CODE_VERSION',
+    ]),
+    /** Engine version the desktop release workflow bundles. */
+    desktopBundledVersion: envName('DESKTOP_BUNDLED_FIRST_PARTY_HARNESS_VERSION', [
+        'DESKTOP_BUNDLED_SKY_CODE_VERSION',
+    ]),
+    /** Update-feed bucket used by publish and promote. */
+    updatesBucket: envName('FIRST_PARTY_HARNESS_UPDATES_BUCKET', ['SKY_CODE_UPDATES_BUCKET']),
+    /** Release signing key (CI secret). */
+    signingKey: envName('FIRST_PARTY_HARNESS_SIGNING_KEY', ['SKY_CODE_SIGNING_KEY']),
+    /** Release signing key id (CI secret). */
+    signingKeyId: envName('FIRST_PARTY_HARNESS_SIGNING_KEY_ID', ['SKY_CODE_SIGNING_KEY_ID']),
+});
+/** Every name for one purpose, neutral first — for spawn-env forwarding and sanitisers. */
+export function firstPartyHarnessEnvNames(key) {
+    const entry = FIRST_PARTY_HARNESS_ENV[key];
+    return [entry.name, ...entry.legacy];
+}
+/** Read one purpose's variable: neutral name first, legacy names after. */
+export function readFirstPartyHarnessEnv(env, key) {
+    const entry = FIRST_PARTY_HARNESS_ENV[key];
+    for (const name of [entry.name, ...entry.legacy]) {
+        const raw = env[name];
+        if (typeof raw === 'string' && raw.trim() !== '') {
+            return { value: raw.trim(), name, legacy: name !== entry.name };
+        }
+    }
+    return { value: undefined, name: undefined, legacy: false };
+}
+/* ── The ENGINE's own namespace (defined inside the fork) ───────────────── */
+/**
+ * Names the ENGINE itself defines and reads. The platform sets or reads them
+ * across the daemon↔engine boundary, so they are recorded here as values rather
+ * than scattered as literals — but they are the fork's to change, and moving
+ * one is a two-sided change (contract §6). Not part of this identity's rename.
+ */
+export const FIRST_PARTY_HARNESS_ENGINE = Object.freeze({
+    /**
+     * The engine's state namespace: XDG dirs, project marker, config basename, and
+     * the engine home under the skrr root (`firstPartyHarnessHomeDirname`).
+     */
+    appName: 'sky-code',
+    /**
+     * Earlier `appName`s whose home directory `migrateFirstPartyHarnessHome` moves
+     * onto the current one. Empty until the engine's namespace is renamed.
+     */
+    legacyAppNames: Object.freeze([]),
+    /** Project-local configuration directory inside a user's repository. */
+    projectDirectory: '.sky-code',
+    /** Environment variables the engine reads. */
+    env: Object.freeze({
+        serverPassword: 'SKY_CODE_SERVER_PASSWORD',
+        serverUsername: 'SKY_CODE_SERVER_USERNAME',
+        home: 'SKY_CODE_HOME',
+        config: 'SKY_CODE_CONFIG',
+        appName: 'SKY_CODE_APP_NAME',
+        scriptName: 'SKY_CODE_SCRIPT_NAME',
+        allowUpstreamEgress: 'SKY_CODE_ALLOW_UPSTREAM_EGRESS',
+        compatOpencode: 'SKY_CODE_COMPAT_OPENCODE',
+        noCompatPrompts: 'SKY_CODE_NO_COMPAT_PROMPTS',
+    }),
+});