@skrr-ai/cli 0.1.41 → 0.1.43

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.js

@@ -24,25 +24,40 @@
  *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
- *   5. ship the data migration, which is generic over `aliases`.
+ *   5. ship the data migration, which is generic over `aliases` and
+ *      `formerSpellings`;
+ *   6. at that rename's contract, move the spelling from `aliases` to the front
+ *      of `formerSpellings`.
  *
  * No identifier, file, env var name or workflow input moves.
  *
- * ── Three spellings, kept apart on purpose ────────────────────────────────
+ * ── Four fields, kept apart on purpose ────────────────────────────────────
  *
- * `provider`     CANONICAL. What the platform stores, returns and renders.
- * `aliases`      ACCEPTED on every ingress until contract, and normalised to
- *                canonical at the edge. Nothing new is ever written with one.
- * `wireProvider` What the server and a daemon say to EACH OTHER — the
- *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves after the flip and
- *                BEFORE contract, because a daemon on a user's machine may be
- *                any version and the server cannot tell which one sent a
- *                request: only a released daemon that already advertises the
- *                canonical capability lets the old one age out of the fleet.
+ * `provider`        CANONICAL. What the platform stores, returns and renders.
+ * `aliases`         ACCEPTED on every ingress during a rename's window, and
+ *                   normalised to canonical at the edge. Nothing new is ever
+ *                   written with one. Empty between renames.
+ * `formerSpellings` RETIRED. Accepted on NO ingress: no HTTP body, enum, Mongo
+ *                   filter, capability, wire event, CLI flag or trust table
+ *                   admits one. Recognised only where an ARTIFACT that predates
+ *                   the rename is read — a binary already installed, a checkout
+ *                   directory already on disk, a release already published
+ *                   under its prefix, a row or config key already written.
+ *                   Those exist whatever the platform accepts, and dropping a
+ *                   spelling from this list does not make them go away. Read it
+ *                   through `firstPartyHarnessArtifactSpellings`, never as an
+ *                   ingress check.
+ * `wireProvider`    What the server and a daemon say to EACH OTHER — the
+ *                   capability a daemon advertises,
+ *                   `daemon:<p>:request|response`, the `provider` of a session
+ *                   RPC. It moves after the flip and BEFORE contract, because a
+ *                   daemon on a user's machine may be any version and the
+ *                   server cannot tell which one sent a request: only a
+ *                   released daemon that already advertises the canonical
+ *                   capability lets the old one age out of the fleet.
  *
- * The old code treated those three as one string, which is why no single
- * change could rename it safely. See
+ * The old code treated these as one string, which is why no single change could
+ * rename it safely. See
  * `docs/architecture/skrr-code-identifier-rename-2026-09-13.md`.
  *
  * ── Constraints on this file ──────────────────────────────────────────────
@@ -56,38 +71,43 @@
 const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function defineIdentity(identity) {
     const spellings = [identity.provider, ...identity.aliases];
-    for (const spelling of spellings) {
+    const every = [...spellings, ...identity.formerSpellings];
+    for (const spelling of every) {
         if (!SLUG.test(spelling)) {
             throw new Error(`first-party harness spelling ${JSON.stringify(spelling)} is not a slug; it becomes a ` +
                 `directory name, a capability prefix and a wire event segment`);
         }
     }
-    if (new Set(spellings).size !== spellings.length) {
-        throw new Error('first-party harness provider and aliases must be distinct');
+    if (new Set(every).size !== every.length) {
+        throw new Error('first-party harness provider, aliases and formerSpellings must be distinct — a spelling ' +
+            'is accepted or retired, never both');
     }
     if (!spellings.includes(identity.wireProvider)) {
         throw new Error(`first-party harness wireProvider ${JSON.stringify(identity.wireProvider)} must be the ` +
             'provider or one of its aliases — a peer can only accept a spelling it knows');
     }
-    return Object.freeze({ ...identity, aliases: Object.freeze([...identity.aliases]) });
+    return Object.freeze({
+        ...identity,
+        aliases: Object.freeze([...identity.aliases]),
+        formerSpellings: Object.freeze([...identity.formerSpellings]),
+    });
 }
 /** The canonical slug. Written once, and read by every field that names the current spelling. */
 const PROVIDER = 'skrr-code';
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
- * it is now also what the server and a daemon say to each other. `sky-code` is
- * still accepted on every ingress, so a daemon released before this change
- * (which advertises and answers on `sky-code`) keeps working against a server
- * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
- * `aliases` once no connected daemon still advertises the old capability.
+ * Phase: CONTRACTED (OSK-8663). `skrr-code` is the only spelling any ingress
+ * accepts and the only one on the wire. `sky-code` is retired: nothing admits
+ * it, and it is still recognised where a binary, a checkout, a published
+ * release or a stored value written before the rename is looked for.
  */
 const IDENTITY = {
     displayName: 'skrr Code',
     command: 'skrr code',
     provider: PROVIDER,
-    aliases: ['sky-code'],
+    aliases: [],
+    formerSpellings: ['sky-code'],
     wireProvider: PROVIDER,
 };
 export const FIRST_PARTY_HARNESS = defineIdentity(IDENTITY);
@@ -98,6 +118,11 @@ const SPELLINGS = Object.freeze([
     ...FIRST_PARTY_HARNESS.aliases,
 ]);
 const SPELLING_SET = new Set(SPELLINGS);
+const ARTIFACT_SPELLINGS = Object.freeze([
+    ...SPELLINGS,
+    ...FIRST_PARTY_HARNESS.formerSpellings,
+]);
+const ARTIFACT_SPELLING_SET = new Set(ARTIFACT_SPELLINGS);
 const SESSION_SUFFIX = '_session';
 const ENVIRONMENT_PREFIX = 'local-';
 function asSlug(value) {
@@ -106,10 +131,30 @@ function asSlug(value) {
     const slug = value.trim().toLowerCase();
     return slug ? slug : null;
 }
-/** Every spelling, canonical first. The order is the resolution order. */
+/**
+ * Every ACCEPTED spelling, canonical first — what an ingress admits. The order
+ * is the resolution order.
+ */
 export function firstPartyHarnessSpellings() {
     return SPELLINGS;
 }
+/**
+ * Every spelling an ARTIFACT that already exists may carry, canonical first:
+ * the accepted spellings, then every former one.
+ *
+ * For code that LOOKS FOR what an earlier release left behind — an installed
+ * binary, a checkout directory, an immutable published release, a stored value
+ * or config key — and for the tooling that must keep recognising those
+ * (ignore lists, the identity ratchet). A machine that never ran a post-rename
+ * client still has its engine under the old name, and it must still be found.
+ *
+ * Never an ingress check: a former spelling is not accepted anywhere, and a
+ * reader that admitted one here would silently reopen what contract closed. Use
+ * `firstPartyHarnessSpellings` / `isFirstPartyHarnessProvider` for that.
+ */
+export function firstPartyHarnessArtifactSpellings() {
+    return ARTIFACT_SPELLINGS;
+}
 /** True for the canonical provider or any alias (case- and whitespace-insensitive). */
 export function isFirstPartyHarnessProvider(value) {
     const slug = asSlug(value);
@@ -123,6 +168,27 @@ export function isFirstPartyHarnessProvider(value) {
 export function canonicalHarnessProvider(value) {
     return isFirstPartyHarnessProvider(value) ? FIRST_PARTY_HARNESS.provider : value;
 }
+/**
+ * The canonical provider for a value read back from an ARTIFACT that may predate
+ * a rename — any artifact spelling (canonical, alias or FORMER) becomes the
+ * provider; every other value is returned unchanged.
+ *
+ * For values nobody migrates and nobody can refuse: a harness row's stored
+ * display NAME (the operator migration rewrites `provider`, never `name`), a
+ * daemon's config file, a harness session binding on a user's machine. Read raw
+ * after contract, each would name an unknown provider — a label that renders the
+ * retired name again, a local session silently running another backend, a live
+ * resume context reset as new — with no error anywhere.
+ *
+ * NEVER for anything a peer, a client or an operator SENDS, and never for a
+ * trust, dispatch or admission decision: a former spelling is accepted on no
+ * ingress, and canonicalising one here would reopen what contract closed. Use
+ * `canonicalHarnessProvider` for those.
+ */
+export function canonicalArtifactHarnessProvider(value) {
+    const slug = asSlug(value);
+    return slug !== null && ARTIFACT_SPELLING_SET.has(slug) ? FIRST_PARTY_HARNESS.provider : value;
+}
 /**
  * Every spelling a stored row for this provider may carry, canonical first —
  * for a Mongo `$in` filter while rows written before a flip still exist. Any
@@ -202,9 +268,18 @@ export function canonicalExecutionEnvironment(value) {
 export function firstPartyHarnessBinaryName(provider = FIRST_PARTY_HARNESS.provider, platform) {
     return platform === 'win32' ? `${provider}.exe` : provider;
 }
-/** Every binary file name, canonical first — the lookup order. */
+/**
+ * Every binary file name an install may carry, canonical first — the lookup
+ * order, and the names an install links to the canonical binary.
+ *
+ * Built from the ARTIFACT spellings, former ones included: binaries are
+ * artifacts. An engine installed before a rename is still on disk under its old
+ * name, and a platform CLI or daemon built before it still looks for that name,
+ * so resolvers try it and installers leave a link at it. Neither makes the
+ * spelling acceptable on any ingress.
+ */
 export function firstPartyHarnessBinaryNames(platform) {
-    return SPELLINGS.map((spelling) => firstPartyHarnessBinaryName(spelling, platform));
+    return ARTIFACT_SPELLINGS.map((spelling) => firstPartyHarnessBinaryName(spelling, platform));
 }
 /**
  * The engine home directory name under the skrr config root.
@@ -233,7 +308,13 @@ export const FIRST_PARTY_HARNESS_FEED_ORIGIN = 'https://updates.oversky.ai';
 export function firstPartyHarnessFeedPrefix(provider = FIRST_PARTY_HARNESS.provider) {
     return `${provider}/`;
 }
-/** Every feed prefix, canonical first. Publishing writes all of them. */
+/**
+ * Every feed prefix a publish WRITES, canonical first: the accepted spellings.
+ *
+ * A former spelling's prefix still holds every release published under it, and
+ * those stay served — their artifact URLs are inside signed manifests — but
+ * nothing new is written there, so its channel pointers stop moving at contract.
+ */
 export function firstPartyHarnessFeedPrefixes() {
     return SPELLINGS.map((spelling) => firstPartyHarnessFeedPrefix(spelling));
 }
@@ -245,66 +326,61 @@ export function firstPartyHarnessStagingPrefix(provider = FIRST_PARTY_HARNESS.pr
 export function firstPartyHarnessDefaultFeedBase(provider = FIRST_PARTY_HARNESS.provider) {
     return `${FIRST_PARTY_HARNESS_FEED_ORIGIN}/${provider}`;
 }
-function envName(name, legacy) {
-    return Object.freeze({ name, legacy: Object.freeze([...legacy]) });
+function envName(name) {
+    return Object.freeze({ name });
 }
 /**
- * Every environment variable the platform reads for the first-party harness,
- * by purpose. The neutral name wins; a legacy name is read only when the neutral
- * one is unset or blank, because a variable set in an ECS task definition, a
- * user's shell or a LaunchAgent does not change when the code does.
+ * Every environment variable the PLATFORM reads for the first-party harness, by
+ * purpose, under one brand-neutral name each — so a product rename never renames
+ * one.
+ *
+ * The product-named variables these replaced were read second until contract
+ * (OSK-8663) and are not read at all now. The ENGINE's own variables are a
+ * different namespace (`FIRST_PARTY_HARNESS_ENGINE.env`): the fork reads them,
+ * so a platform reader that must agree with the engine consults the engine's
+ * name explicitly — the engine home is the one case (`home` below).
  */
 export const FIRST_PARTY_HARNESS_ENV = Object.freeze({
     /** Absolute path to an engine binary, overriding resolution. */
-    path: envName('SKRR_FIRST_PARTY_HARNESS_PATH', ['OVERSKY_SKY_CODE_PATH']),
+    path: envName('SKRR_FIRST_PARTY_HARNESS_PATH'),
     /** Forces the CLI's managed-inference mode. */
-    managed: envName('SKRR_FIRST_PARTY_HARNESS_MANAGED', ['OVERSKY_SKY_CODE_MANAGED']),
+    managed: envName('SKRR_FIRST_PARTY_HARNESS_MANAGED'),
     /** Update channel. */
-    channel: envName('SKRR_FIRST_PARTY_HARNESS_CHANNEL', ['OVERSKY_SKY_CODE_CHANNEL']),
+    channel: envName('SKRR_FIRST_PARTY_HARNESS_CHANNEL'),
     /** Update-feed base URL override. */
-    updateFeedBase: envName('SKRR_FIRST_PARTY_HARNESS_UPDATE_FEED_BASE', [
-        'OVERSKY_SKY_CODE_UPDATE_FEED_BASE',
-    ]),
+    updateFeedBase: envName('SKRR_FIRST_PARTY_HARNESS_UPDATE_FEED_BASE'),
     /** Path to a file of development release keys. */
-    devKeys: envName('SKRR_FIRST_PARTY_HARNESS_DEV_KEYS', ['OVERSKY_SKY_CODE_DEV_KEYS']),
+    devKeys: envName('SKRR_FIRST_PARTY_HARNESS_DEV_KEYS'),
     /** Engine version the desktop build bundles. */
-    bundleVersion: envName('SKRR_FIRST_PARTY_HARNESS_BUNDLE_VERSION', ['OVERSKY_BUNDLE_SKY_CODE']),
-    /** Engine home override (the engine reads its own name too — see ENGINE env below). */
-    home: envName('SKRR_FIRST_PARTY_HARNESS_HOME', ['SKY_CODE_HOME']),
+    bundleVersion: envName('SKRR_FIRST_PARTY_HARNESS_BUNDLE_VERSION'),
+    /**
+     * Engine home override. The engine reads only its own variable
+     * (`FIRST_PARTY_HARNESS_ENGINE.env.home`), so a reader that resolves the home
+     * the engine will use reads that one second, and a launcher hands the engine
+     * the resolved path under it.
+     */
+    home: envName('SKRR_FIRST_PARTY_HARNESS_HOME'),
     /** Engine version baked into the cloud-coding image. */
-    cloudCodingVersion: envName('CLOUD_CODING_FIRST_PARTY_HARNESS_VERSION', [
-        'CLOUD_CODING_SKY_CODE_VERSION',
-    ]),
+    cloudCodingVersion: envName('CLOUD_CODING_FIRST_PARTY_HARNESS_VERSION'),
     /** Engine version baked into the Dedicated Runtime AMI. */
-    dedicatedRuntimeVersion: envName('SKRR_DEDICATED_RUNTIME_FIRST_PARTY_HARNESS_VERSION', [
-        'SKRR_DEDICATED_RUNTIME_SKY_CODE_VERSION',
-    ]),
+    dedicatedRuntimeVersion: envName('SKRR_DEDICATED_RUNTIME_FIRST_PARTY_HARNESS_VERSION'),
     /** Engine version the desktop release workflow bundles. */
-    desktopBundledVersion: envName('DESKTOP_BUNDLED_FIRST_PARTY_HARNESS_VERSION', [
-        'DESKTOP_BUNDLED_SKY_CODE_VERSION',
-    ]),
+    desktopBundledVersion: envName('DESKTOP_BUNDLED_FIRST_PARTY_HARNESS_VERSION'),
     /** Update-feed bucket used by publish and promote. */
-    updatesBucket: envName('FIRST_PARTY_HARNESS_UPDATES_BUCKET', ['SKY_CODE_UPDATES_BUCKET']),
+    updatesBucket: envName('FIRST_PARTY_HARNESS_UPDATES_BUCKET'),
     /** Release signing key (CI secret). */
-    signingKey: envName('FIRST_PARTY_HARNESS_SIGNING_KEY', ['SKY_CODE_SIGNING_KEY']),
+    signingKey: envName('FIRST_PARTY_HARNESS_SIGNING_KEY'),
     /** Release signing key id (CI secret). */
-    signingKeyId: envName('FIRST_PARTY_HARNESS_SIGNING_KEY_ID', ['SKY_CODE_SIGNING_KEY_ID']),
+    signingKeyId: envName('FIRST_PARTY_HARNESS_SIGNING_KEY_ID'),
 });
-/** Every name for one purpose, neutral first — for spawn-env forwarding and sanitisers. */
-export function firstPartyHarnessEnvNames(key) {
-    const entry = FIRST_PARTY_HARNESS_ENV[key];
-    return [entry.name, ...entry.legacy];
-}
-/** Read one purpose's variable: neutral name first, legacy names after. */
+/** Read one purpose's variable. A blank value counts as unset. */
 export function readFirstPartyHarnessEnv(env, key) {
-    const entry = FIRST_PARTY_HARNESS_ENV[key];
-    for (const name of [entry.name, ...entry.legacy]) {
-        const raw = env[name];
-        if (typeof raw === 'string' && raw.trim() !== '') {
-            return { value: raw.trim(), name, legacy: name !== entry.name };
-        }
+    const { name } = FIRST_PARTY_HARNESS_ENV[key];
+    const raw = env[name];
+    if (typeof raw === 'string' && raw.trim() !== '') {
+        return { value: raw.trim(), name };
     }
-    return { value: undefined, name: undefined, legacy: false };
+    return { value: undefined, name: undefined };
 }
 /* ── The ENGINE's own namespace (defined inside the fork) ───────────────── */
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessChannels.d.ts

@@ -108,40 +108,28 @@ export interface FirstPartyHarnessFeedCandidate {
  * Every place a manifest may be published, in the order an installer should
  * try them: the canonical spelling first, then each alias.
  *
- * Why a list: publishing writes every spelling, but an installer can ship before
- * the first release that does, and a machine can point at a feed published by
- * an older pipeline. An installer that asked only for the canonical path would
- * then find NOTHING and report "no release" on a feed that has one. Trying the
- * aliases on not-found closes that window in both directions without anyone
- * having to deploy in a particular order.
+ * Why a list: publishing writes every accepted spelling, but an installer can
+ * ship before the first release that does, and a machine can point at a feed
+ * published by an older pipeline. An installer that asked only for the canonical
+ * path would then find NOTHING and report "no release" on a feed that has one.
+ * Trying the aliases on not-found closes that window in both directions without
+ * anyone having to deploy in a particular order.
+ *
+ * WHICH spellings depends on what is being read, and the difference is the
+ * point:
+ *
+ *   - a CHANNEL pointer (`pinnedRelease` false) is current state. Only the
+ *     accepted spellings are tried: a former spelling's pointer stopped moving
+ *     when publishing stopped writing it, so falling back to one would install
+ *     whatever that channel named on the day of contract — a silent downgrade.
+ *   - a PINNED release (`pinnedRelease` true) is an immutable artifact. Former
+ *     spellings are tried too: a release published before the canonical prefix
+ *     existed lives only under the old one, and its signed bytes — artifact URLs
+ *     included — are the same wherever they are found.
  *
  * An operator override keeps its base and still tries each manifest filename,
  * since a dev feed staged by an older script names the file the old way.
  */
-export declare function firstPartyHarnessFeedCandidates(env?: NodeJS.ProcessEnv): readonly FirstPartyHarnessFeedCandidate[];
-/** @deprecated Use `FIRST_PARTY_HARNESS_CHANNELS`. */
-export declare const SKY_CODE_CHANNELS: readonly ["internal", "canary", "beta", "stable"];
-/** @deprecated Use `FirstPartyHarnessChannel`. */
-export type SkyCodeChannel = FirstPartyHarnessChannel;
-/** @deprecated Use `DEFAULT_FIRST_PARTY_HARNESS_CHANNEL`. */
-export declare const DEFAULT_SKY_CODE_CHANNEL: "stable";
-/** @deprecated Read the channel with `resolveFirstPartyHarnessChannel`; the variable has a neutral name now. */
-export declare const SKY_CODE_CHANNEL_ENV: string;
-/** @deprecated Use `firstPartyHarnessManifestFile()`. Names the legacy file. */
-export declare const SKY_CODE_MANIFEST_FILE: string;
-/** @deprecated Use `isFirstPartyHarnessChannel`. */
-export declare const isSkyCodeChannel: typeof isFirstPartyHarnessChannel;
-/** @deprecated Use `resolveFirstPartyHarnessChannel`. */
-export declare const resolveSkyCodeChannel: typeof resolveFirstPartyHarnessChannel;
-/** @deprecated Use `firstPartyHarnessChannelPrefix`. */
-export declare const skyCodeChannelPrefix: typeof firstPartyHarnessChannelPrefix;
-/** @deprecated Use `firstPartyHarnessDefaultFeedBase()`. Names the legacy feed. */
-export declare const DEFAULT_SKY_CODE_FEED_BASE: string;
-/** @deprecated Read the feed with `firstPartyHarnessFeedBase`; the variable has a neutral name now. */
-export declare const SKY_CODE_FEED_BASE_ENV: string;
-/**
- * @deprecated Use `firstPartyHarnessFeedCandidates`. Keeps the LEGACY feed as its
- * default, because that is the only feed a caller compiled against this name knows
- * how to read.
- */
-export declare function skyCodeFeedBase(env?: NodeJS.ProcessEnv): string;
+export declare function firstPartyHarnessFeedCandidates(env?: NodeJS.ProcessEnv, options?: {
+    pinnedRelease?: boolean;
+}): readonly FirstPartyHarnessFeedCandidate[];

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessChannels.js

@@ -26,7 +26,7 @@
  * Every product-named value comes from `firstPartyHarness.ts`; nothing in this
  * file spells the product.
  */
-import { FIRST_PARTY_HARNESS, FIRST_PARTY_HARNESS_ENV, firstPartyHarnessDefaultFeedBase, firstPartyHarnessManifestFile, firstPartyHarnessSpellings, readFirstPartyHarnessEnv, } from './firstPartyHarness.js';
+import { firstPartyHarnessArtifactSpellings, firstPartyHarnessDefaultFeedBase, firstPartyHarnessManifestFile, firstPartyHarnessSpellings, readFirstPartyHarnessEnv, } from './firstPartyHarness.js';
 /** Channels in promotion order. Index order IS the promotion order. */
 export const FIRST_PARTY_HARNESS_CHANNELS = ['internal', 'canary', 'beta', 'stable'];
 /**
@@ -116,61 +116,36 @@ export function firstPartyHarnessFeedBase(env = process.env) {
  * Every place a manifest may be published, in the order an installer should
  * try them: the canonical spelling first, then each alias.
  *
- * Why a list: publishing writes every spelling, but an installer can ship before
- * the first release that does, and a machine can point at a feed published by
- * an older pipeline. An installer that asked only for the canonical path would
- * then find NOTHING and report "no release" on a feed that has one. Trying the
- * aliases on not-found closes that window in both directions without anyone
- * having to deploy in a particular order.
+ * Why a list: publishing writes every accepted spelling, but an installer can
+ * ship before the first release that does, and a machine can point at a feed
+ * published by an older pipeline. An installer that asked only for the canonical
+ * path would then find NOTHING and report "no release" on a feed that has one.
+ * Trying the aliases on not-found closes that window in both directions without
+ * anyone having to deploy in a particular order.
+ *
+ * WHICH spellings depends on what is being read, and the difference is the
+ * point:
+ *
+ *   - a CHANNEL pointer (`pinnedRelease` false) is current state. Only the
+ *     accepted spellings are tried: a former spelling's pointer stopped moving
+ *     when publishing stopped writing it, so falling back to one would install
+ *     whatever that channel named on the day of contract — a silent downgrade.
+ *   - a PINNED release (`pinnedRelease` true) is an immutable artifact. Former
+ *     spellings are tried too: a release published before the canonical prefix
+ *     existed lives only under the old one, and its signed bytes — artifact URLs
+ *     included — are the same wherever they are found.
  *
  * An operator override keeps its base and still tries each manifest filename,
  * since a dev feed staged by an older script names the file the old way.
  */
-export function firstPartyHarnessFeedCandidates(env = process.env) {
+export function firstPartyHarnessFeedCandidates(env = process.env, options = {}) {
     const override = readFirstPartyHarnessEnv(env, 'updateFeedBase').value?.replace(/\/+$/, '');
-    return firstPartyHarnessSpellings().map((provider) => ({
+    const spellings = options.pinnedRelease
+        ? firstPartyHarnessArtifactSpellings()
+        : firstPartyHarnessSpellings();
+    return spellings.map((provider) => ({
         base: override || firstPartyHarnessDefaultFeedBase(provider),
         manifestFilename: firstPartyHarnessManifestFile(provider),
         provider,
     }));
 }
-/* ── Deprecated names ───────────────────────────────────────────────────────
- *
- * `@skrr-ai/auth-core` is PUBLISHED, and the released CLI resolves it with a
- * caret range. An installed CLI that picks up this version must still find the
- * names it was compiled against, or it crashes at import. These aliases leave in
- * the contract phase (OSK-8663), with a minor-version bump — never a patch.
- *
- * The ones that name a feed name the LEGACY one, the spelling a caller compiled
- * against them was built for — the retired alias, not `wireProvider`, which has
- * moved to canonical.
- */
-/** The spelling the deprecated names were written for. */
-const LEGACY_SPELLING = FIRST_PARTY_HARNESS.aliases[0] ?? FIRST_PARTY_HARNESS.provider;
-/** @deprecated Use `FIRST_PARTY_HARNESS_CHANNELS`. */
-export const SKY_CODE_CHANNELS = FIRST_PARTY_HARNESS_CHANNELS;
-/** @deprecated Use `DEFAULT_FIRST_PARTY_HARNESS_CHANNEL`. */
-export const DEFAULT_SKY_CODE_CHANNEL = DEFAULT_FIRST_PARTY_HARNESS_CHANNEL;
-/** @deprecated Read the channel with `resolveFirstPartyHarnessChannel`; the variable has a neutral name now. */
-export const SKY_CODE_CHANNEL_ENV = FIRST_PARTY_HARNESS_ENV.channel.legacy[0];
-/** @deprecated Use `firstPartyHarnessManifestFile()`. Names the legacy file. */
-export const SKY_CODE_MANIFEST_FILE = firstPartyHarnessManifestFile(LEGACY_SPELLING);
-/** @deprecated Use `isFirstPartyHarnessChannel`. */
-export const isSkyCodeChannel = isFirstPartyHarnessChannel;
-/** @deprecated Use `resolveFirstPartyHarnessChannel`. */
-export const resolveSkyCodeChannel = resolveFirstPartyHarnessChannel;
-/** @deprecated Use `firstPartyHarnessChannelPrefix`. */
-export const skyCodeChannelPrefix = firstPartyHarnessChannelPrefix;
-/** @deprecated Use `firstPartyHarnessDefaultFeedBase()`. Names the legacy feed. */
-export const DEFAULT_SKY_CODE_FEED_BASE = firstPartyHarnessDefaultFeedBase(LEGACY_SPELLING);
-/** @deprecated Read the feed with `firstPartyHarnessFeedBase`; the variable has a neutral name now. */
-export const SKY_CODE_FEED_BASE_ENV = FIRST_PARTY_HARNESS_ENV.updateFeedBase.legacy[0];
-/**
- * @deprecated Use `firstPartyHarnessFeedCandidates`. Keeps the LEGACY feed as its
- * default, because that is the only feed a caller compiled against this name knows
- * how to read.
- */
-export function skyCodeFeedBase(env = process.env) {
-    const override = readFirstPartyHarnessEnv(env, 'updateFeedBase').value;
-    return (override || firstPartyHarnessDefaultFeedBase(LEGACY_SPELLING)).replace(/\/+$/, '');
-}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessHome.d.ts

@@ -20,9 +20,15 @@
  *      leave the legacy name as a relative symlink. (No legacy app name exists
  *      yet; this step is what an engine-namespace rename will use.)
  *   2. The BINARY follows the provider. Inside `<home>/bin`, if the canonical
- *      binary does not exist and an alias binary is a real file, rename it and
- *      each companion (rollback copy, provenance sidecar), leaving a relative
- *      symlink at every old name.
+ *      binary does not exist and a binary under an older spelling is a real
+ *      file, rename it and each companion (rollback copy, provenance sidecar),
+ *      leaving a relative symlink at every old name.
+ *
+ * "Older spelling" means every ARTIFACT spelling that is not canonical — the
+ * aliases AND the former spellings (`firstPartyHarnessArtifactSpellings`). An
+ * installed binary is an artifact: a machine that never ran a post-rename client
+ * still has its engine under the old name after that name stops being accepted
+ * anywhere, and it must still be moved rather than reinstalled beside.
  *
  * The two follow different names on purpose: the home is shared with the
  * engine, which reads its config and managed `AGENTS.md` from it, so it can only
@@ -73,7 +79,9 @@ export interface FirstPartyHarnessHomeFs {
  * Move a legacy engine home and binary onto the canonical names. See the file
  * header for the exact contract. Returns what it did; never throws.
  *
- * Inside `<home>/bin` it resolves the three layouts a rename can leave:
+ * Inside `<home>/bin` it resolves the three layouts a rename can leave. An
+ * "alias" below is any non-canonical artifact spelling — an accepted alias or a
+ * former spelling alike, since the file on disk does not know which it is now:
  *
  *   - canonical ABSENT, an alias is a real file — the ordinary legacy install.
  *     The alias moves to canonical and a link is left at its name.
@@ -96,13 +104,17 @@ export declare function migrateFirstPartyHarnessHome(options?: {
     fs?: FirstPartyHarnessHomeFs;
 }): FirstPartyHarnessHomeMigration;
 /**
- * Leave a relative symlink at every alias name — binary and provenance sidecar —
+ * Leave a relative symlink at every older name — binary and provenance sidecar —
  * that does not exist yet, pointing at the canonical file.
  *
  * Call after installing the canonical binary. A platform CLI or daemon installed
  * before a rename resolves the legacy name; the link keeps it on the current
- * engine. It never replaces anything that exists, whether a real file (an older
- * engine someone may still run) or a link someone else placed. Never throws.
+ * engine. "Older" includes FORMER spellings, not only aliases: an installed CLI
+ * cannot be telemetry-gated the way a connected daemon can, and it does not stop
+ * existing when its spelling stops being accepted, so the link outlives the
+ * alias window (`firstPartyHarnessBinaryNames`). It never replaces anything that
+ * exists, whether a real file (an older engine someone may still run) or a link
+ * someone else placed. Never throws.
  */
 export declare function linkFirstPartyHarnessAliases(options?: {
     env?: NodeJS.ProcessEnv;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessHome.js

@@ -20,9 +20,15 @@
  *      leave the legacy name as a relative symlink. (No legacy app name exists
  *      yet; this step is what an engine-namespace rename will use.)
  *   2. The BINARY follows the provider. Inside `<home>/bin`, if the canonical
- *      binary does not exist and an alias binary is a real file, rename it and
- *      each companion (rollback copy, provenance sidecar), leaving a relative
- *      symlink at every old name.
+ *      binary does not exist and a binary under an older spelling is a real
+ *      file, rename it and each companion (rollback copy, provenance sidecar),
+ *      leaving a relative symlink at every old name.
+ *
+ * "Older spelling" means every ARTIFACT spelling that is not canonical — the
+ * aliases AND the former spellings (`firstPartyHarnessArtifactSpellings`). An
+ * installed binary is an artifact: a machine that never ran a post-rename client
+ * still has its engine under the old name after that name stops being accepted
+ * anywhere, and it must still be moved rather than reinstalled beside.
  *
  * The two follow different names on purpose: the home is shared with the
  * engine, which reads its config and managed `AGENTS.md` from it, so it can only
@@ -42,7 +48,11 @@
 import { lstatSync, readlinkSync, renameSync, symlinkSync } from 'node:fs';
 import path from 'node:path';
 import { resolveConfigRoot } from './configRoot.js';
-import { FIRST_PARTY_HARNESS, FIRST_PARTY_HARNESS_ENGINE, firstPartyHarnessBinaryName, firstPartyHarnessHomeDirname, } from './firstPartyHarness.js';
+import { FIRST_PARTY_HARNESS, FIRST_PARTY_HARNESS_ENGINE, firstPartyHarnessArtifactSpellings, firstPartyHarnessBinaryName, firstPartyHarnessHomeDirname, } from './firstPartyHarness.js';
+/** Every artifact spelling except the canonical one, newest first. */
+function olderSpellings() {
+    return firstPartyHarnessArtifactSpellings().filter((spelling) => spelling !== FIRST_PARTY_HARNESS.provider);
+}
 /** Suffix of the rollback copy the installer keeps beside the binary. */
 export const FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = '.previous';
 /**
@@ -108,7 +118,9 @@ const NEWER_THRESHOLD_MS = 1000;
  * Move a legacy engine home and binary onto the canonical names. See the file
  * header for the exact contract. Returns what it did; never throws.
  *
- * Inside `<home>/bin` it resolves the three layouts a rename can leave:
+ * Inside `<home>/bin` it resolves the three layouts a rename can leave. An
+ * "alias" below is any non-canonical artifact spelling — an accepted alias or a
+ * former spelling alike, since the file on disk does not know which it is now:
  *
  *   - canonical ABSENT, an alias is a real file — the ordinary legacy install.
  *     The alias moves to canonical and a link is left at its name.
@@ -171,7 +183,7 @@ export function migrateFirstPartyHarnessHome(options = {}) {
     const canonicalName = firstPartyHarnessBinaryName(canonical, platform);
     const canonicalBinary = path.join(binDir, canonicalName);
     const canonicalStat = fs.lstat(canonicalBinary);
-    const aliasNames = FIRST_PARTY_HARNESS.aliases.map((alias) => firstPartyHarnessBinaryName(alias, platform));
+    const aliasNames = olderSpellings().map((spelling) => firstPartyHarnessBinaryName(spelling, platform));
     /** Move `<from><suffix>` onto `<to><suffix>` and leave a link; `replaceable` says what may sit at the target. */
     const relocate = (fromName, suffix, replaceable) => {
         const from = path.join(binDir, `${fromName}${suffix}`);
@@ -260,13 +272,17 @@ export function migrateFirstPartyHarnessHome(options = {}) {
     return { moved, errors };
 }
 /**
- * Leave a relative symlink at every alias name — binary and provenance sidecar —
+ * Leave a relative symlink at every older name — binary and provenance sidecar —
  * that does not exist yet, pointing at the canonical file.
  *
  * Call after installing the canonical binary. A platform CLI or daemon installed
  * before a rename resolves the legacy name; the link keeps it on the current
- * engine. It never replaces anything that exists, whether a real file (an older
- * engine someone may still run) or a link someone else placed. Never throws.
+ * engine. "Older" includes FORMER spellings, not only aliases: an installed CLI
+ * cannot be telemetry-gated the way a connected daemon can, and it does not stop
+ * existing when its spelling stops being accepted, so the link outlives the
+ * alias window (`firstPartyHarnessBinaryNames`). It never replaces anything that
+ * exists, whether a real file (an older engine someone may still run) or a link
+ * someone else placed. Never throws.
  */
 export function linkFirstPartyHarnessAliases(options = {}) {
     const env = options.env ?? process.env;
@@ -282,8 +298,8 @@ export function linkFirstPartyHarnessAliases(options = {}) {
     if (!isRealFile(fs.lstat(path.join(binDir, canonicalName)))) {
         return { moved, errors };
     }
-    for (const alias of FIRST_PARTY_HARNESS.aliases) {
-        const aliasName = firstPartyHarnessBinaryName(alias, platform);
+    for (const spelling of olderSpellings()) {
+        const aliasName = firstPartyHarnessBinaryName(spelling, platform);
         // Sidecar FIRST: a verifier that finds the binary link must find its record.
         for (const suffix of [FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX, '']) {
             const target = `${canonicalName}${suffix}`;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/harnessTrust.d.ts

@@ -49,11 +49,15 @@ export type HarnessTrustTier = 1 | 2 | 3;
  * in `daemon/src/harness-trust.ts` beside the gates that read it — the argument
  * belongs where the enforcement is, not in a shared vocabulary module.
  *
- * It is entered under EVERY spelling (`firstPartyHarnessSpellings`), not only the
- * canonical one. A backend name reaches this lookup from a daemon of any version,
- * and an alias that fell through to the Tier 3 default would silently strip the
- * harness of the trust the owner granted it — a failure that looks like a
- * permission prompt storm, not like a rename.
+ * It is entered under every ACCEPTED spelling (`firstPartyHarnessSpellings`), not
+ * only the canonical one. During a rename a backend name reaches this lookup from
+ * a daemon of any version, and an alias that fell through to the Tier 3 default
+ * would silently strip the harness of the trust the owner granted it — a failure
+ * that looks like a permission prompt storm, not like a rename.
+ *
+ * A FORMER spelling is deliberately absent. Nothing dispatches under one after
+ * contract, and a name that is not accepted must never inherit Tier 1 by being
+ * remembered: it falls to the default like any unknown backend.
  */
 export declare const HARNESS_TIERS: Readonly<Record<string, HarnessTrustTier>>;
 /**