@skrr-ai/cli 0.1.42 → 0.1.43

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarness.d.ts

@@ -24,25 +24,40 @@
  *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
- *   5. ship the data migration, which is generic over `aliases`.
+ *   5. ship the data migration, which is generic over `aliases` and
+ *      `formerSpellings`;
+ *   6. at that rename's contract, move the spelling from `aliases` to the front
+ *      of `formerSpellings`.
  *
  * No identifier, file, env var name or workflow input moves.
  *
- * ── Three spellings, kept apart on purpose ────────────────────────────────
- *
- * `provider`     CANONICAL. What the platform stores, returns and renders.
- * `aliases`      ACCEPTED on every ingress until contract, and normalised to
- *                canonical at the edge. Nothing new is ever written with one.
- * `wireProvider` What the server and a daemon say to EACH OTHER — the
- *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves after the flip and
- *                BEFORE contract, because a daemon on a user's machine may be
- *                any version and the server cannot tell which one sent a
- *                request: only a released daemon that already advertises the
- *                canonical capability lets the old one age out of the fleet.
- *
- * The old code treated those three as one string, which is why no single
- * change could rename it safely. See
+ * ── Four fields, kept apart on purpose ────────────────────────────────────
+ *
+ * `provider`        CANONICAL. What the platform stores, returns and renders.
+ * `aliases`         ACCEPTED on every ingress during a rename's window, and
+ *                   normalised to canonical at the edge. Nothing new is ever
+ *                   written with one. Empty between renames.
+ * `formerSpellings` RETIRED. Accepted on NO ingress: no HTTP body, enum, Mongo
+ *                   filter, capability, wire event, CLI flag or trust table
+ *                   admits one. Recognised only where an ARTIFACT that predates
+ *                   the rename is read — a binary already installed, a checkout
+ *                   directory already on disk, a release already published
+ *                   under its prefix, a row or config key already written.
+ *                   Those exist whatever the platform accepts, and dropping a
+ *                   spelling from this list does not make them go away. Read it
+ *                   through `firstPartyHarnessArtifactSpellings`, never as an
+ *                   ingress check.
+ * `wireProvider`    What the server and a daemon say to EACH OTHER — the
+ *                   capability a daemon advertises,
+ *                   `daemon:<p>:request|response`, the `provider` of a session
+ *                   RPC. It moves after the flip and BEFORE contract, because a
+ *                   daemon on a user's machine may be any version and the
+ *                   server cannot tell which one sent a request: only a
+ *                   released daemon that already advertises the canonical
+ *                   capability lets the old one age out of the fleet.
+ *
+ * The old code treated these as one string, which is why no single change could
+ * rename it safely. See
  * `docs/architecture/skrr-code-identifier-rename-2026-09-13.md`.
  *
  * ── Constraints on this file ──────────────────────────────────────────────
@@ -61,24 +76,28 @@ export interface FirstPartyHarnessIdentity {
     readonly provider: string;
     /** Older spellings still ACCEPTED on every ingress, newest first. */
     readonly aliases: readonly string[];
+    /**
+     * Retired spellings, newest first: accepted on NO ingress, recognised only in
+     * artifacts that predate their retirement (see the file header).
+     */
+    readonly formerSpellings: readonly string[];
     /** The spelling daemons and the server exchange on the wire. */
     readonly wireProvider: string;
 }
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
- * it is now also what the server and a daemon say to each other. `sky-code` is
- * still accepted on every ingress, so a daemon released before this change
- * (which advertises and answers on `sky-code`) keeps working against a server
- * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
- * `aliases` once no connected daemon still advertises the old capability.
+ * Phase: CONTRACTED (OSK-8663). `skrr-code` is the only spelling any ingress
+ * accepts and the only one on the wire. `sky-code` is retired: nothing admits
+ * it, and it is still recognised where a binary, a checkout, a published
+ * release or a stored value written before the rename is looked for.
  */
 declare const IDENTITY: {
     readonly displayName: "skrr Code";
     readonly command: "skrr code";
     readonly provider: "skrr-code";
-    readonly aliases: readonly ["sky-code"];
+    readonly aliases: readonly [];
+    readonly formerSpellings: readonly ["sky-code"];
     readonly wireProvider: "skrr-code";
 };
 /** The canonical slug, as a literal type. */
@@ -92,8 +111,26 @@ export type FirstPartyHarnessCapabilityName = `${FirstPartyHarnessProvider}_sess
 export declare const FIRST_PARTY_HARNESS: FirstPartyHarnessIdentity;
 /** The canonical slug with its literal type, for `as const` tuples and keyed tables. */
 export declare const FIRST_PARTY_HARNESS_PROVIDER: FirstPartyHarnessCanonicalProvider;
-/** Every spelling, canonical first. The order is the resolution order. */
+/**
+ * Every ACCEPTED spelling, canonical first — what an ingress admits. The order
+ * is the resolution order.
+ */
 export declare function firstPartyHarnessSpellings(): readonly string[];
+/**
+ * Every spelling an ARTIFACT that already exists may carry, canonical first:
+ * the accepted spellings, then every former one.
+ *
+ * For code that LOOKS FOR what an earlier release left behind — an installed
+ * binary, a checkout directory, an immutable published release, a stored value
+ * or config key — and for the tooling that must keep recognising those
+ * (ignore lists, the identity ratchet). A machine that never ran a post-rename
+ * client still has its engine under the old name, and it must still be found.
+ *
+ * Never an ingress check: a former spelling is not accepted anywhere, and a
+ * reader that admitted one here would silently reopen what contract closed. Use
+ * `firstPartyHarnessSpellings` / `isFirstPartyHarnessProvider` for that.
+ */
+export declare function firstPartyHarnessArtifactSpellings(): readonly string[];
 /** True for the canonical provider or any alias (case- and whitespace-insensitive). */
 export declare function isFirstPartyHarnessProvider(value: unknown): boolean;
 /**
@@ -102,6 +139,24 @@ export declare function isFirstPartyHarnessProvider(value: unknown): boolean;
  * caller's own normalisation still owns case and shape for other providers).
  */
 export declare function canonicalHarnessProvider<T>(value: T): T | string;
+/**
+ * The canonical provider for a value read back from an ARTIFACT that may predate
+ * a rename — any artifact spelling (canonical, alias or FORMER) becomes the
+ * provider; every other value is returned unchanged.
+ *
+ * For values nobody migrates and nobody can refuse: a harness row's stored
+ * display NAME (the operator migration rewrites `provider`, never `name`), a
+ * daemon's config file, a harness session binding on a user's machine. Read raw
+ * after contract, each would name an unknown provider — a label that renders the
+ * retired name again, a local session silently running another backend, a live
+ * resume context reset as new — with no error anywhere.
+ *
+ * NEVER for anything a peer, a client or an operator SENDS, and never for a
+ * trust, dispatch or admission decision: a former spelling is accepted on no
+ * ingress, and canonicalising one here would reopen what contract closed. Use
+ * `canonicalHarnessProvider` for those.
+ */
+export declare function canonicalArtifactHarnessProvider<T>(value: T): T | string;
 /**
  * Every spelling a stored row for this provider may carry, canonical first —
  * for a Mongo `$in` filter while rows written before a flip still exist. Any
@@ -138,7 +193,16 @@ export declare function isFirstPartyHarnessEnvironment(value: unknown): boolean;
 export declare function canonicalExecutionEnvironment<T>(value: T): T | string;
 /** Binary file name. `platform` is a `process.platform` value; only `win32` differs. */
 export declare function firstPartyHarnessBinaryName(provider?: string, platform?: string): string;
-/** Every binary file name, canonical first — the lookup order. */
+/**
+ * Every binary file name an install may carry, canonical first — the lookup
+ * order, and the names an install links to the canonical binary.
+ *
+ * Built from the ARTIFACT spellings, former ones included: binaries are
+ * artifacts. An engine installed before a rename is still on disk under its old
+ * name, and a platform CLI or daemon built before it still looks for that name,
+ * so resolvers try it and installers leave a link at it. Neither makes the
+ * spelling acceptable on any ingress.
+ */
 export declare function firstPartyHarnessBinaryNames(platform?: string): readonly string[];
 /**
  * The engine home directory name under the skrr config root.
@@ -161,23 +225,32 @@ export declare function firstPartyHarnessManifestFile(provider?: string): string
 export declare const FIRST_PARTY_HARNESS_FEED_ORIGIN = "https://updates.oversky.ai";
 /** Object-key prefix for one spelling's feed, e.g. `skrr-code/`. */
 export declare function firstPartyHarnessFeedPrefix(provider?: string): string;
-/** Every feed prefix, canonical first. Publishing writes all of them. */
+/**
+ * Every feed prefix a publish WRITES, canonical first: the accepted spellings.
+ *
+ * A former spelling's prefix still holds every release published under it, and
+ * those stay served — their artifact URLs are inside signed manifests — but
+ * nothing new is written there, so its channel pointers stop moving at contract.
+ */
 export declare function firstPartyHarnessFeedPrefixes(): readonly string[];
 /** Object-key prefix the fork stages unsigned builds under, e.g. `skrr-code-staging/`. */
 export declare function firstPartyHarnessStagingPrefix(provider?: string): string;
 /** Default feed base URL for one spelling. */
 export declare function firstPartyHarnessDefaultFeedBase(provider?: string): string;
 export interface FirstPartyHarnessEnvName {
-    /** Brand-neutral name. Set this one. */
+    /** Brand-neutral name — the only one the platform reads. */
     readonly name: string;
-    /** Older names still read, in precedence order, until contract. */
-    readonly legacy: readonly string[];
 }
 /**
- * Every environment variable the platform reads for the first-party harness,
- * by purpose. The neutral name wins; a legacy name is read only when the neutral
- * one is unset or blank, because a variable set in an ECS task definition, a
- * user's shell or a LaunchAgent does not change when the code does.
+ * Every environment variable the PLATFORM reads for the first-party harness, by
+ * purpose, under one brand-neutral name each — so a product rename never renames
+ * one.
+ *
+ * The product-named variables these replaced were read second until contract
+ * (OSK-8663) and are not read at all now. The ENGINE's own variables are a
+ * different namespace (`FIRST_PARTY_HARNESS_ENGINE.env`): the fork reads them,
+ * so a platform reader that must agree with the engine consults the engine's
+ * name explicitly — the engine home is the one case (`home` below).
  */
 export declare const FIRST_PARTY_HARNESS_ENV: Readonly<{
     /** Absolute path to an engine binary, overriding resolution. */
@@ -192,7 +265,12 @@ export declare const FIRST_PARTY_HARNESS_ENV: Readonly<{
     devKeys: FirstPartyHarnessEnvName;
     /** Engine version the desktop build bundles. */
     bundleVersion: FirstPartyHarnessEnvName;
-    /** Engine home override (the engine reads its own name too — see ENGINE env below). */
+    /**
+     * Engine home override. The engine reads only its own variable
+     * (`FIRST_PARTY_HARNESS_ENGINE.env.home`), so a reader that resolves the home
+     * the engine will use reads that one second, and a launcher hands the engine
+     * the resolved path under it.
+     */
     home: FirstPartyHarnessEnvName;
     /** Engine version baked into the cloud-coding image. */
     cloudCodingVersion: FirstPartyHarnessEnvName;
@@ -213,12 +291,8 @@ export interface FirstPartyHarnessEnvReading {
     readonly value: string | undefined;
     /** The variable that supplied `value`. */
     readonly name: string | undefined;
-    /** True when the value came from a legacy name — worth telling the operator. */
-    readonly legacy: boolean;
 }
-/** Every name for one purpose, neutral first — for spawn-env forwarding and sanitisers. */
-export declare function firstPartyHarnessEnvNames(key: FirstPartyHarnessEnvKey): readonly string[];
-/** Read one purpose's variable: neutral name first, legacy names after. */
+/** Read one purpose's variable. A blank value counts as unset. */
 export declare function readFirstPartyHarnessEnv(env: Readonly<Record<string, string | undefined>>, key: FirstPartyHarnessEnvKey): FirstPartyHarnessEnvReading;
 /**
  * Names the ENGINE itself defines and reads. The platform sets or reads them

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarness.js

@@ -25,25 +25,40 @@
  *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
- *   5. ship the data migration, which is generic over `aliases`.
+ *   5. ship the data migration, which is generic over `aliases` and
+ *      `formerSpellings`;
+ *   6. at that rename's contract, move the spelling from `aliases` to the front
+ *      of `formerSpellings`.
  *
  * No identifier, file, env var name or workflow input moves.
  *
- * ── Three spellings, kept apart on purpose ────────────────────────────────
+ * ── Four fields, kept apart on purpose ────────────────────────────────────
  *
- * `provider`     CANONICAL. What the platform stores, returns and renders.
- * `aliases`      ACCEPTED on every ingress until contract, and normalised to
- *                canonical at the edge. Nothing new is ever written with one.
- * `wireProvider` What the server and a daemon say to EACH OTHER — the
- *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves after the flip and
- *                BEFORE contract, because a daemon on a user's machine may be
- *                any version and the server cannot tell which one sent a
- *                request: only a released daemon that already advertises the
- *                canonical capability lets the old one age out of the fleet.
+ * `provider`        CANONICAL. What the platform stores, returns and renders.
+ * `aliases`         ACCEPTED on every ingress during a rename's window, and
+ *                   normalised to canonical at the edge. Nothing new is ever
+ *                   written with one. Empty between renames.
+ * `formerSpellings` RETIRED. Accepted on NO ingress: no HTTP body, enum, Mongo
+ *                   filter, capability, wire event, CLI flag or trust table
+ *                   admits one. Recognised only where an ARTIFACT that predates
+ *                   the rename is read — a binary already installed, a checkout
+ *                   directory already on disk, a release already published
+ *                   under its prefix, a row or config key already written.
+ *                   Those exist whatever the platform accepts, and dropping a
+ *                   spelling from this list does not make them go away. Read it
+ *                   through `firstPartyHarnessArtifactSpellings`, never as an
+ *                   ingress check.
+ * `wireProvider`    What the server and a daemon say to EACH OTHER — the
+ *                   capability a daemon advertises,
+ *                   `daemon:<p>:request|response`, the `provider` of a session
+ *                   RPC. It moves after the flip and BEFORE contract, because a
+ *                   daemon on a user's machine may be any version and the
+ *                   server cannot tell which one sent a request: only a
+ *                   released daemon that already advertises the canonical
+ *                   capability lets the old one age out of the fleet.
  *
- * The old code treated those three as one string, which is why no single
- * change could rename it safely. See
+ * The old code treated these as one string, which is why no single change could
+ * rename it safely. See
  * `docs/architecture/skrr-code-identifier-rename-2026-09-13.md`.
  *
  * ── Constraints on this file ──────────────────────────────────────────────
@@ -56,8 +71,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FIRST_PARTY_HARNESS_ENGINE = exports.FIRST_PARTY_HARNESS_ENV = exports.FIRST_PARTY_HARNESS_FEED_ORIGIN = exports.FIRST_PARTY_HARNESS_PROVIDER = exports.FIRST_PARTY_HARNESS = void 0;
 exports.firstPartyHarnessSpellings = firstPartyHarnessSpellings;
+exports.firstPartyHarnessArtifactSpellings = firstPartyHarnessArtifactSpellings;
 exports.isFirstPartyHarnessProvider = isFirstPartyHarnessProvider;
 exports.canonicalHarnessProvider = canonicalHarnessProvider;
+exports.canonicalArtifactHarnessProvider = canonicalArtifactHarnessProvider;
 exports.harnessProviderSpellings = harnessProviderSpellings;
 exports.wireHarnessProvider = wireHarnessProvider;
 exports.isSameHarnessProvider = isSameHarnessProvider;
@@ -79,44 +96,48 @@ exports.firstPartyHarnessFeedPrefix = firstPartyHarnessFeedPrefix;
 exports.firstPartyHarnessFeedPrefixes = firstPartyHarnessFeedPrefixes;
 exports.firstPartyHarnessStagingPrefix = firstPartyHarnessStagingPrefix;
 exports.firstPartyHarnessDefaultFeedBase = firstPartyHarnessDefaultFeedBase;
-exports.firstPartyHarnessEnvNames = firstPartyHarnessEnvNames;
 exports.readFirstPartyHarnessEnv = readFirstPartyHarnessEnv;
 /** A slug usable as a directory name, a capability prefix and an event segment. */
 const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function defineIdentity(identity) {
     const spellings = [identity.provider, ...identity.aliases];
-    for (const spelling of spellings) {
+    const every = [...spellings, ...identity.formerSpellings];
+    for (const spelling of every) {
         if (!SLUG.test(spelling)) {
             throw new Error(`first-party harness spelling ${JSON.stringify(spelling)} is not a slug; it becomes a ` +
                 `directory name, a capability prefix and a wire event segment`);
         }
     }
-    if (new Set(spellings).size !== spellings.length) {
-        throw new Error('first-party harness provider and aliases must be distinct');
+    if (new Set(every).size !== every.length) {
+        throw new Error('first-party harness provider, aliases and formerSpellings must be distinct — a spelling ' +
+            'is accepted or retired, never both');
     }
     if (!spellings.includes(identity.wireProvider)) {
         throw new Error(`first-party harness wireProvider ${JSON.stringify(identity.wireProvider)} must be the ` +
             'provider or one of its aliases — a peer can only accept a spelling it knows');
     }
-    return Object.freeze({ ...identity, aliases: Object.freeze([...identity.aliases]) });
+    return Object.freeze({
+        ...identity,
+        aliases: Object.freeze([...identity.aliases]),
+        formerSpellings: Object.freeze([...identity.formerSpellings]),
+    });
 }
 /** The canonical slug. Written once, and read by every field that names the current spelling. */
 const PROVIDER = 'skrr-code';
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
- * it is now also what the server and a daemon say to each other. `sky-code` is
- * still accepted on every ingress, so a daemon released before this change
- * (which advertises and answers on `sky-code`) keeps working against a server
- * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
- * `aliases` once no connected daemon still advertises the old capability.
+ * Phase: CONTRACTED (OSK-8663). `skrr-code` is the only spelling any ingress
+ * accepts and the only one on the wire. `sky-code` is retired: nothing admits
+ * it, and it is still recognised where a binary, a checkout, a published
+ * release or a stored value written before the rename is looked for.
  */
 const IDENTITY = {
     displayName: 'skrr Code',
     command: 'skrr code',
     provider: PROVIDER,
-    aliases: ['sky-code'],
+    aliases: [],
+    formerSpellings: ['sky-code'],
     wireProvider: PROVIDER,
 };
 exports.FIRST_PARTY_HARNESS = defineIdentity(IDENTITY);
@@ -127,6 +148,11 @@ const SPELLINGS = Object.freeze([
     ...exports.FIRST_PARTY_HARNESS.aliases,
 ]);
 const SPELLING_SET = new Set(SPELLINGS);
+const ARTIFACT_SPELLINGS = Object.freeze([
+    ...SPELLINGS,
+    ...exports.FIRST_PARTY_HARNESS.formerSpellings,
+]);
+const ARTIFACT_SPELLING_SET = new Set(ARTIFACT_SPELLINGS);
 const SESSION_SUFFIX = '_session';
 const ENVIRONMENT_PREFIX = 'local-';
 function asSlug(value) {
@@ -135,10 +161,30 @@ function asSlug(value) {
     const slug = value.trim().toLowerCase();
     return slug ? slug : null;
 }
-/** Every spelling, canonical first. The order is the resolution order. */
+/**
+ * Every ACCEPTED spelling, canonical first — what an ingress admits. The order
+ * is the resolution order.
+ */
 function firstPartyHarnessSpellings() {
     return SPELLINGS;
 }
+/**
+ * Every spelling an ARTIFACT that already exists may carry, canonical first:
+ * the accepted spellings, then every former one.
+ *
+ * For code that LOOKS FOR what an earlier release left behind — an installed
+ * binary, a checkout directory, an immutable published release, a stored value
+ * or config key — and for the tooling that must keep recognising those
+ * (ignore lists, the identity ratchet). A machine that never ran a post-rename
+ * client still has its engine under the old name, and it must still be found.
+ *
+ * Never an ingress check: a former spelling is not accepted anywhere, and a
+ * reader that admitted one here would silently reopen what contract closed. Use
+ * `firstPartyHarnessSpellings` / `isFirstPartyHarnessProvider` for that.
+ */
+function firstPartyHarnessArtifactSpellings() {
+    return ARTIFACT_SPELLINGS;
+}
 /** True for the canonical provider or any alias (case- and whitespace-insensitive). */
 function isFirstPartyHarnessProvider(value) {
     const slug = asSlug(value);
@@ -152,6 +198,27 @@ function isFirstPartyHarnessProvider(value) {
 function canonicalHarnessProvider(value) {
     return isFirstPartyHarnessProvider(value) ? exports.FIRST_PARTY_HARNESS.provider : value;
 }
+/**
+ * The canonical provider for a value read back from an ARTIFACT that may predate
+ * a rename — any artifact spelling (canonical, alias or FORMER) becomes the
+ * provider; every other value is returned unchanged.
+ *
+ * For values nobody migrates and nobody can refuse: a harness row's stored
+ * display NAME (the operator migration rewrites `provider`, never `name`), a
+ * daemon's config file, a harness session binding on a user's machine. Read raw
+ * after contract, each would name an unknown provider — a label that renders the
+ * retired name again, a local session silently running another backend, a live
+ * resume context reset as new — with no error anywhere.
+ *
+ * NEVER for anything a peer, a client or an operator SENDS, and never for a
+ * trust, dispatch or admission decision: a former spelling is accepted on no
+ * ingress, and canonicalising one here would reopen what contract closed. Use
+ * `canonicalHarnessProvider` for those.
+ */
+function canonicalArtifactHarnessProvider(value) {
+    const slug = asSlug(value);
+    return slug !== null && ARTIFACT_SPELLING_SET.has(slug) ? exports.FIRST_PARTY_HARNESS.provider : value;
+}
 /**
  * Every spelling a stored row for this provider may carry, canonical first —
  * for a Mongo `$in` filter while rows written before a flip still exist. Any
@@ -231,9 +298,18 @@ function canonicalExecutionEnvironment(value) {
 function firstPartyHarnessBinaryName(provider = exports.FIRST_PARTY_HARNESS.provider, platform) {
     return platform === 'win32' ? `${provider}.exe` : provider;
 }
-/** Every binary file name, canonical first — the lookup order. */
+/**
+ * Every binary file name an install may carry, canonical first — the lookup
+ * order, and the names an install links to the canonical binary.
+ *
+ * Built from the ARTIFACT spellings, former ones included: binaries are
+ * artifacts. An engine installed before a rename is still on disk under its old
+ * name, and a platform CLI or daemon built before it still looks for that name,
+ * so resolvers try it and installers leave a link at it. Neither makes the
+ * spelling acceptable on any ingress.
+ */
 function firstPartyHarnessBinaryNames(platform) {
-    return SPELLINGS.map((spelling) => firstPartyHarnessBinaryName(spelling, platform));
+    return ARTIFACT_SPELLINGS.map((spelling) => firstPartyHarnessBinaryName(spelling, platform));
 }
 /**
  * The engine home directory name under the skrr config root.
@@ -262,7 +338,13 @@ exports.FIRST_PARTY_HARNESS_FEED_ORIGIN = 'https://updates.oversky.ai';
 function firstPartyHarnessFeedPrefix(provider = exports.FIRST_PARTY_HARNESS.provider) {
     return `${provider}/`;
 }
-/** Every feed prefix, canonical first. Publishing writes all of them. */
+/**
+ * Every feed prefix a publish WRITES, canonical first: the accepted spellings.
+ *
+ * A former spelling's prefix still holds every release published under it, and
+ * those stay served — their artifact URLs are inside signed manifests — but
+ * nothing new is written there, so its channel pointers stop moving at contract.
+ */
 function firstPartyHarnessFeedPrefixes() {
     return SPELLINGS.map((spelling) => firstPartyHarnessFeedPrefix(spelling));
 }
@@ -274,66 +356,61 @@ function firstPartyHarnessStagingPrefix(provider = exports.FIRST_PARTY_HARNESS.p
 function firstPartyHarnessDefaultFeedBase(provider = exports.FIRST_PARTY_HARNESS.provider) {
     return `${exports.FIRST_PARTY_HARNESS_FEED_ORIGIN}/${provider}`;
 }
-function envName(name, legacy) {
-    return Object.freeze({ name, legacy: Object.freeze([...legacy]) });
+function envName(name) {
+    return Object.freeze({ name });
 }
 /**
- * Every environment variable the platform reads for the first-party harness,
- * by purpose. The neutral name wins; a legacy name is read only when the neutral
- * one is unset or blank, because a variable set in an ECS task definition, a
- * user's shell or a LaunchAgent does not change when the code does.
+ * Every environment variable the PLATFORM reads for the first-party harness, by
+ * purpose, under one brand-neutral name each — so a product rename never renames
+ * one.
+ *
+ * The product-named variables these replaced were read second until contract
+ * (OSK-8663) and are not read at all now. The ENGINE's own variables are a
+ * different namespace (`FIRST_PARTY_HARNESS_ENGINE.env`): the fork reads them,
+ * so a platform reader that must agree with the engine consults the engine's
+ * name explicitly — the engine home is the one case (`home` below).
  */
 exports.FIRST_PARTY_HARNESS_ENV = Object.freeze({
     /** Absolute path to an engine binary, overriding resolution. */
-    path: envName('SKRR_FIRST_PARTY_HARNESS_PATH', ['OVERSKY_SKY_CODE_PATH']),
+    path: envName('SKRR_FIRST_PARTY_HARNESS_PATH'),
     /** Forces the CLI's managed-inference mode. */
-    managed: envName('SKRR_FIRST_PARTY_HARNESS_MANAGED', ['OVERSKY_SKY_CODE_MANAGED']),
+    managed: envName('SKRR_FIRST_PARTY_HARNESS_MANAGED'),
     /** Update channel. */
-    channel: envName('SKRR_FIRST_PARTY_HARNESS_CHANNEL', ['OVERSKY_SKY_CODE_CHANNEL']),
+    channel: envName('SKRR_FIRST_PARTY_HARNESS_CHANNEL'),
     /** Update-feed base URL override. */
-    updateFeedBase: envName('SKRR_FIRST_PARTY_HARNESS_UPDATE_FEED_BASE', [
-        'OVERSKY_SKY_CODE_UPDATE_FEED_BASE',
-    ]),
+    updateFeedBase: envName('SKRR_FIRST_PARTY_HARNESS_UPDATE_FEED_BASE'),
     /** Path to a file of development release keys. */
-    devKeys: envName('SKRR_FIRST_PARTY_HARNESS_DEV_KEYS', ['OVERSKY_SKY_CODE_DEV_KEYS']),
+    devKeys: envName('SKRR_FIRST_PARTY_HARNESS_DEV_KEYS'),
     /** Engine version the desktop build bundles. */
-    bundleVersion: envName('SKRR_FIRST_PARTY_HARNESS_BUNDLE_VERSION', ['OVERSKY_BUNDLE_SKY_CODE']),
-    /** Engine home override (the engine reads its own name too — see ENGINE env below). */
-    home: envName('SKRR_FIRST_PARTY_HARNESS_HOME', ['SKY_CODE_HOME']),
+    bundleVersion: envName('SKRR_FIRST_PARTY_HARNESS_BUNDLE_VERSION'),
+    /**
+     * Engine home override. The engine reads only its own variable
+     * (`FIRST_PARTY_HARNESS_ENGINE.env.home`), so a reader that resolves the home
+     * the engine will use reads that one second, and a launcher hands the engine
+     * the resolved path under it.
+     */
+    home: envName('SKRR_FIRST_PARTY_HARNESS_HOME'),
     /** Engine version baked into the cloud-coding image. */
-    cloudCodingVersion: envName('CLOUD_CODING_FIRST_PARTY_HARNESS_VERSION', [
-        'CLOUD_CODING_SKY_CODE_VERSION',
-    ]),
+    cloudCodingVersion: envName('CLOUD_CODING_FIRST_PARTY_HARNESS_VERSION'),
     /** Engine version baked into the Dedicated Runtime AMI. */
-    dedicatedRuntimeVersion: envName('SKRR_DEDICATED_RUNTIME_FIRST_PARTY_HARNESS_VERSION', [
-        'SKRR_DEDICATED_RUNTIME_SKY_CODE_VERSION',
-    ]),
+    dedicatedRuntimeVersion: envName('SKRR_DEDICATED_RUNTIME_FIRST_PARTY_HARNESS_VERSION'),
     /** Engine version the desktop release workflow bundles. */
-    desktopBundledVersion: envName('DESKTOP_BUNDLED_FIRST_PARTY_HARNESS_VERSION', [
-        'DESKTOP_BUNDLED_SKY_CODE_VERSION',
-    ]),
+    desktopBundledVersion: envName('DESKTOP_BUNDLED_FIRST_PARTY_HARNESS_VERSION'),
     /** Update-feed bucket used by publish and promote. */
-    updatesBucket: envName('FIRST_PARTY_HARNESS_UPDATES_BUCKET', ['SKY_CODE_UPDATES_BUCKET']),
+    updatesBucket: envName('FIRST_PARTY_HARNESS_UPDATES_BUCKET'),
     /** Release signing key (CI secret). */
-    signingKey: envName('FIRST_PARTY_HARNESS_SIGNING_KEY', ['SKY_CODE_SIGNING_KEY']),
+    signingKey: envName('FIRST_PARTY_HARNESS_SIGNING_KEY'),
     /** Release signing key id (CI secret). */
-    signingKeyId: envName('FIRST_PARTY_HARNESS_SIGNING_KEY_ID', ['SKY_CODE_SIGNING_KEY_ID']),
+    signingKeyId: envName('FIRST_PARTY_HARNESS_SIGNING_KEY_ID'),
 });
-/** Every name for one purpose, neutral first — for spawn-env forwarding and sanitisers. */
-function firstPartyHarnessEnvNames(key) {
-    const entry = exports.FIRST_PARTY_HARNESS_ENV[key];
-    return [entry.name, ...entry.legacy];
-}
-/** Read one purpose's variable: neutral name first, legacy names after. */
+/** Read one purpose's variable. A blank value counts as unset. */
 function readFirstPartyHarnessEnv(env, key) {
-    const entry = exports.FIRST_PARTY_HARNESS_ENV[key];
-    for (const name of [entry.name, ...entry.legacy]) {
-        const raw = env[name];
-        if (typeof raw === 'string' && raw.trim() !== '') {
-            return { value: raw.trim(), name, legacy: name !== entry.name };
-        }
+    const { name } = exports.FIRST_PARTY_HARNESS_ENV[key];
+    const raw = env[name];
+    if (typeof raw === 'string' && raw.trim() !== '') {
+        return { value: raw.trim(), name };
     }
-    return { value: undefined, name: undefined, legacy: false };
+    return { value: undefined, name: undefined };
 }
 /* ── The ENGINE's own namespace (defined inside the fork) ───────────────── */
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessChannels.d.ts

@@ -108,40 +108,28 @@ export interface FirstPartyHarnessFeedCandidate {
  * Every place a manifest may be published, in the order an installer should
  * try them: the canonical spelling first, then each alias.
  *
- * Why a list: publishing writes every spelling, but an installer can ship before
- * the first release that does, and a machine can point at a feed published by
- * an older pipeline. An installer that asked only for the canonical path would
- * then find NOTHING and report "no release" on a feed that has one. Trying the
- * aliases on not-found closes that window in both directions without anyone
- * having to deploy in a particular order.
+ * Why a list: publishing writes every accepted spelling, but an installer can
+ * ship before the first release that does, and a machine can point at a feed
+ * published by an older pipeline. An installer that asked only for the canonical
+ * path would then find NOTHING and report "no release" on a feed that has one.
+ * Trying the aliases on not-found closes that window in both directions without
+ * anyone having to deploy in a particular order.
+ *
+ * WHICH spellings depends on what is being read, and the difference is the
+ * point:
+ *
+ *   - a CHANNEL pointer (`pinnedRelease` false) is current state. Only the
+ *     accepted spellings are tried: a former spelling's pointer stopped moving
+ *     when publishing stopped writing it, so falling back to one would install
+ *     whatever that channel named on the day of contract — a silent downgrade.
+ *   - a PINNED release (`pinnedRelease` true) is an immutable artifact. Former
+ *     spellings are tried too: a release published before the canonical prefix
+ *     existed lives only under the old one, and its signed bytes — artifact URLs
+ *     included — are the same wherever they are found.
  *
  * An operator override keeps its base and still tries each manifest filename,
  * since a dev feed staged by an older script names the file the old way.
  */
-export declare function firstPartyHarnessFeedCandidates(env?: NodeJS.ProcessEnv): readonly FirstPartyHarnessFeedCandidate[];
-/** @deprecated Use `FIRST_PARTY_HARNESS_CHANNELS`. */
-export declare const SKY_CODE_CHANNELS: readonly ["internal", "canary", "beta", "stable"];
-/** @deprecated Use `FirstPartyHarnessChannel`. */
-export type SkyCodeChannel = FirstPartyHarnessChannel;
-/** @deprecated Use `DEFAULT_FIRST_PARTY_HARNESS_CHANNEL`. */
-export declare const DEFAULT_SKY_CODE_CHANNEL: "stable";
-/** @deprecated Read the channel with `resolveFirstPartyHarnessChannel`; the variable has a neutral name now. */
-export declare const SKY_CODE_CHANNEL_ENV: string;
-/** @deprecated Use `firstPartyHarnessManifestFile()`. Names the legacy file. */
-export declare const SKY_CODE_MANIFEST_FILE: string;
-/** @deprecated Use `isFirstPartyHarnessChannel`. */
-export declare const isSkyCodeChannel: typeof isFirstPartyHarnessChannel;
-/** @deprecated Use `resolveFirstPartyHarnessChannel`. */
-export declare const resolveSkyCodeChannel: typeof resolveFirstPartyHarnessChannel;
-/** @deprecated Use `firstPartyHarnessChannelPrefix`. */
-export declare const skyCodeChannelPrefix: typeof firstPartyHarnessChannelPrefix;
-/** @deprecated Use `firstPartyHarnessDefaultFeedBase()`. Names the legacy feed. */
-export declare const DEFAULT_SKY_CODE_FEED_BASE: string;
-/** @deprecated Read the feed with `firstPartyHarnessFeedBase`; the variable has a neutral name now. */
-export declare const SKY_CODE_FEED_BASE_ENV: string;
-/**
- * @deprecated Use `firstPartyHarnessFeedCandidates`. Keeps the LEGACY feed as its
- * default, because that is the only feed a caller compiled against this name knows
- * how to read.
- */
-export declare function skyCodeFeedBase(env?: NodeJS.ProcessEnv): string;
+export declare function firstPartyHarnessFeedCandidates(env?: NodeJS.ProcessEnv, options?: {
+    pinnedRelease?: boolean;
+}): readonly FirstPartyHarnessFeedCandidate[];