@skrr-ai/cli 0.1.42 → 0.1.43

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessChannels.js

@@ -28,14 +28,13 @@
  * file spells the product.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SKY_CODE_FEED_BASE_ENV = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.DEFAULT_SKY_CODE_CHANNEL = exports.SKY_CODE_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.FIRST_PARTY_HARNESS_CHANNELS = void 0;
+exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.FIRST_PARTY_HARNESS_CHANNELS = void 0;
 exports.isFirstPartyHarnessChannel = isFirstPartyHarnessChannel;
 exports.resolveFirstPartyHarnessChannel = resolveFirstPartyHarnessChannel;
 exports.firstPartyHarnessChannelPrefix = firstPartyHarnessChannelPrefix;
 exports.resolveChannelManifestUrl = resolveChannelManifestUrl;
 exports.firstPartyHarnessFeedBase = firstPartyHarnessFeedBase;
 exports.firstPartyHarnessFeedCandidates = firstPartyHarnessFeedCandidates;
-exports.skyCodeFeedBase = skyCodeFeedBase;
 const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
 /** Channels in promotion order. Index order IS the promotion order. */
 exports.FIRST_PARTY_HARNESS_CHANNELS = ['internal', 'canary', 'beta', 'stable'];
@@ -126,61 +125,36 @@ function firstPartyHarnessFeedBase(env = process.env) {
  * Every place a manifest may be published, in the order an installer should
  * try them: the canonical spelling first, then each alias.
  *
- * Why a list: publishing writes every spelling, but an installer can ship before
- * the first release that does, and a machine can point at a feed published by
- * an older pipeline. An installer that asked only for the canonical path would
- * then find NOTHING and report "no release" on a feed that has one. Trying the
- * aliases on not-found closes that window in both directions without anyone
- * having to deploy in a particular order.
+ * Why a list: publishing writes every accepted spelling, but an installer can
+ * ship before the first release that does, and a machine can point at a feed
+ * published by an older pipeline. An installer that asked only for the canonical
+ * path would then find NOTHING and report "no release" on a feed that has one.
+ * Trying the aliases on not-found closes that window in both directions without
+ * anyone having to deploy in a particular order.
+ *
+ * WHICH spellings depends on what is being read, and the difference is the
+ * point:
+ *
+ *   - a CHANNEL pointer (`pinnedRelease` false) is current state. Only the
+ *     accepted spellings are tried: a former spelling's pointer stopped moving
+ *     when publishing stopped writing it, so falling back to one would install
+ *     whatever that channel named on the day of contract — a silent downgrade.
+ *   - a PINNED release (`pinnedRelease` true) is an immutable artifact. Former
+ *     spellings are tried too: a release published before the canonical prefix
+ *     existed lives only under the old one, and its signed bytes — artifact URLs
+ *     included — are the same wherever they are found.
  *
  * An operator override keeps its base and still tries each manifest filename,
  * since a dev feed staged by an older script names the file the old way.
  */
-function firstPartyHarnessFeedCandidates(env = process.env) {
+function firstPartyHarnessFeedCandidates(env = process.env, options = {}) {
     const override = (0, firstPartyHarness_js_1.readFirstPartyHarnessEnv)(env, 'updateFeedBase').value?.replace(/\/+$/, '');
-    return (0, firstPartyHarness_js_1.firstPartyHarnessSpellings)().map((provider) => ({
+    const spellings = options.pinnedRelease
+        ? (0, firstPartyHarness_js_1.firstPartyHarnessArtifactSpellings)()
+        : (0, firstPartyHarness_js_1.firstPartyHarnessSpellings)();
+    return spellings.map((provider) => ({
         base: override || (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(provider),
         manifestFilename: (0, firstPartyHarness_js_1.firstPartyHarnessManifestFile)(provider),
         provider,
     }));
 }
-/* ── Deprecated names ───────────────────────────────────────────────────────
- *
- * `@skrr-ai/auth-core` is PUBLISHED, and the released CLI resolves it with a
- * caret range. An installed CLI that picks up this version must still find the
- * names it was compiled against, or it crashes at import. These aliases leave in
- * the contract phase (OSK-8663), with a minor-version bump — never a patch.
- *
- * The ones that name a feed name the LEGACY one, the spelling a caller compiled
- * against them was built for — the retired alias, not `wireProvider`, which has
- * moved to canonical.
- */
-/** The spelling the deprecated names were written for. */
-const LEGACY_SPELLING = firstPartyHarness_js_1.FIRST_PARTY_HARNESS.aliases[0] ?? firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider;
-/** @deprecated Use `FIRST_PARTY_HARNESS_CHANNELS`. */
-exports.SKY_CODE_CHANNELS = exports.FIRST_PARTY_HARNESS_CHANNELS;
-/** @deprecated Use `DEFAULT_FIRST_PARTY_HARNESS_CHANNEL`. */
-exports.DEFAULT_SKY_CODE_CHANNEL = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL;
-/** @deprecated Read the channel with `resolveFirstPartyHarnessChannel`; the variable has a neutral name now. */
-exports.SKY_CODE_CHANNEL_ENV = firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.channel.legacy[0];
-/** @deprecated Use `firstPartyHarnessManifestFile()`. Names the legacy file. */
-exports.SKY_CODE_MANIFEST_FILE = (0, firstPartyHarness_js_1.firstPartyHarnessManifestFile)(LEGACY_SPELLING);
-/** @deprecated Use `isFirstPartyHarnessChannel`. */
-exports.isSkyCodeChannel = isFirstPartyHarnessChannel;
-/** @deprecated Use `resolveFirstPartyHarnessChannel`. */
-exports.resolveSkyCodeChannel = resolveFirstPartyHarnessChannel;
-/** @deprecated Use `firstPartyHarnessChannelPrefix`. */
-exports.skyCodeChannelPrefix = firstPartyHarnessChannelPrefix;
-/** @deprecated Use `firstPartyHarnessDefaultFeedBase()`. Names the legacy feed. */
-exports.DEFAULT_SKY_CODE_FEED_BASE = (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(LEGACY_SPELLING);
-/** @deprecated Read the feed with `firstPartyHarnessFeedBase`; the variable has a neutral name now. */
-exports.SKY_CODE_FEED_BASE_ENV = firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.updateFeedBase.legacy[0];
-/**
- * @deprecated Use `firstPartyHarnessFeedCandidates`. Keeps the LEGACY feed as its
- * default, because that is the only feed a caller compiled against this name knows
- * how to read.
- */
-function skyCodeFeedBase(env = process.env) {
-    const override = (0, firstPartyHarness_js_1.readFirstPartyHarnessEnv)(env, 'updateFeedBase').value;
-    return (override || (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(LEGACY_SPELLING)).replace(/\/+$/, '');
-}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessHome.d.ts

@@ -20,9 +20,15 @@
  *      leave the legacy name as a relative symlink. (No legacy app name exists
  *      yet; this step is what an engine-namespace rename will use.)
  *   2. The BINARY follows the provider. Inside `<home>/bin`, if the canonical
- *      binary does not exist and an alias binary is a real file, rename it and
- *      each companion (rollback copy, provenance sidecar), leaving a relative
- *      symlink at every old name.
+ *      binary does not exist and a binary under an older spelling is a real
+ *      file, rename it and each companion (rollback copy, provenance sidecar),
+ *      leaving a relative symlink at every old name.
+ *
+ * "Older spelling" means every ARTIFACT spelling that is not canonical — the
+ * aliases AND the former spellings (`firstPartyHarnessArtifactSpellings`). An
+ * installed binary is an artifact: a machine that never ran a post-rename client
+ * still has its engine under the old name after that name stops being accepted
+ * anywhere, and it must still be moved rather than reinstalled beside.
  *
  * The two follow different names on purpose: the home is shared with the
  * engine, which reads its config and managed `AGENTS.md` from it, so it can only
@@ -73,7 +79,9 @@ export interface FirstPartyHarnessHomeFs {
  * Move a legacy engine home and binary onto the canonical names. See the file
  * header for the exact contract. Returns what it did; never throws.
  *
- * Inside `<home>/bin` it resolves the three layouts a rename can leave:
+ * Inside `<home>/bin` it resolves the three layouts a rename can leave. An
+ * "alias" below is any non-canonical artifact spelling — an accepted alias or a
+ * former spelling alike, since the file on disk does not know which it is now:
  *
  *   - canonical ABSENT, an alias is a real file — the ordinary legacy install.
  *     The alias moves to canonical and a link is left at its name.
@@ -96,13 +104,17 @@ export declare function migrateFirstPartyHarnessHome(options?: {
     fs?: FirstPartyHarnessHomeFs;
 }): FirstPartyHarnessHomeMigration;
 /**
- * Leave a relative symlink at every alias name — binary and provenance sidecar —
+ * Leave a relative symlink at every older name — binary and provenance sidecar —
  * that does not exist yet, pointing at the canonical file.
  *
  * Call after installing the canonical binary. A platform CLI or daemon installed
  * before a rename resolves the legacy name; the link keeps it on the current
- * engine. It never replaces anything that exists, whether a real file (an older
- * engine someone may still run) or a link someone else placed. Never throws.
+ * engine. "Older" includes FORMER spellings, not only aliases: an installed CLI
+ * cannot be telemetry-gated the way a connected daemon can, and it does not stop
+ * existing when its spelling stops being accepted, so the link outlives the
+ * alias window (`firstPartyHarnessBinaryNames`). It never replaces anything that
+ * exists, whether a real file (an older engine someone may still run) or a link
+ * someone else placed. Never throws.
  */
 export declare function linkFirstPartyHarnessAliases(options?: {
     env?: NodeJS.ProcessEnv;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessHome.js

@@ -21,9 +21,15 @@
  *      leave the legacy name as a relative symlink. (No legacy app name exists
  *      yet; this step is what an engine-namespace rename will use.)
  *   2. The BINARY follows the provider. Inside `<home>/bin`, if the canonical
- *      binary does not exist and an alias binary is a real file, rename it and
- *      each companion (rollback copy, provenance sidecar), leaving a relative
- *      symlink at every old name.
+ *      binary does not exist and a binary under an older spelling is a real
+ *      file, rename it and each companion (rollback copy, provenance sidecar),
+ *      leaving a relative symlink at every old name.
+ *
+ * "Older spelling" means every ARTIFACT spelling that is not canonical — the
+ * aliases AND the former spellings (`firstPartyHarnessArtifactSpellings`). An
+ * installed binary is an artifact: a machine that never ran a post-rename client
+ * still has its engine under the old name after that name stops being accepted
+ * anywhere, and it must still be moved rather than reinstalled beside.
  *
  * The two follow different names on purpose: the home is shared with the
  * engine, which reads its config and managed `AGENTS.md` from it, so it can only
@@ -54,6 +60,10 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const configRoot_js_1 = require("./configRoot.js");
 const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
+/** Every artifact spelling except the canonical one, newest first. */
+function olderSpellings() {
+    return (0, firstPartyHarness_js_1.firstPartyHarnessArtifactSpellings)().filter((spelling) => spelling !== firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider);
+}
 /** Suffix of the rollback copy the installer keeps beside the binary. */
 exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = '.previous';
 /**
@@ -119,7 +129,9 @@ const NEWER_THRESHOLD_MS = 1000;
  * Move a legacy engine home and binary onto the canonical names. See the file
  * header for the exact contract. Returns what it did; never throws.
  *
- * Inside `<home>/bin` it resolves the three layouts a rename can leave:
+ * Inside `<home>/bin` it resolves the three layouts a rename can leave. An
+ * "alias" below is any non-canonical artifact spelling — an accepted alias or a
+ * former spelling alike, since the file on disk does not know which it is now:
  *
  *   - canonical ABSENT, an alias is a real file — the ordinary legacy install.
  *     The alias moves to canonical and a link is left at its name.
@@ -182,7 +194,7 @@ function migrateFirstPartyHarnessHome(options = {}) {
     const canonicalName = (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(canonical, platform);
     const canonicalBinary = node_path_1.default.join(binDir, canonicalName);
     const canonicalStat = fs.lstat(canonicalBinary);
-    const aliasNames = firstPartyHarness_js_1.FIRST_PARTY_HARNESS.aliases.map((alias) => (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(alias, platform));
+    const aliasNames = olderSpellings().map((spelling) => (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(spelling, platform));
     /** Move `<from><suffix>` onto `<to><suffix>` and leave a link; `replaceable` says what may sit at the target. */
     const relocate = (fromName, suffix, replaceable) => {
         const from = node_path_1.default.join(binDir, `${fromName}${suffix}`);
@@ -271,13 +283,17 @@ function migrateFirstPartyHarnessHome(options = {}) {
     return { moved, errors };
 }
 /**
- * Leave a relative symlink at every alias name — binary and provenance sidecar —
+ * Leave a relative symlink at every older name — binary and provenance sidecar —
  * that does not exist yet, pointing at the canonical file.
  *
  * Call after installing the canonical binary. A platform CLI or daemon installed
  * before a rename resolves the legacy name; the link keeps it on the current
- * engine. It never replaces anything that exists, whether a real file (an older
- * engine someone may still run) or a link someone else placed. Never throws.
+ * engine. "Older" includes FORMER spellings, not only aliases: an installed CLI
+ * cannot be telemetry-gated the way a connected daemon can, and it does not stop
+ * existing when its spelling stops being accepted, so the link outlives the
+ * alias window (`firstPartyHarnessBinaryNames`). It never replaces anything that
+ * exists, whether a real file (an older engine someone may still run) or a link
+ * someone else placed. Never throws.
  */
 function linkFirstPartyHarnessAliases(options = {}) {
     const env = options.env ?? process.env;
@@ -293,8 +309,8 @@ function linkFirstPartyHarnessAliases(options = {}) {
     if (!isRealFile(fs.lstat(node_path_1.default.join(binDir, canonicalName)))) {
         return { moved, errors };
     }
-    for (const alias of firstPartyHarness_js_1.FIRST_PARTY_HARNESS.aliases) {
-        const aliasName = (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(alias, platform);
+    for (const spelling of olderSpellings()) {
+        const aliasName = (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(spelling, platform);
         // Sidecar FIRST: a verifier that finds the binary link must find its record.
         for (const suffix of [exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX, '']) {
             const target = `${canonicalName}${suffix}`;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessTrust.d.ts

@@ -49,11 +49,15 @@ export type HarnessTrustTier = 1 | 2 | 3;
  * in `daemon/src/harness-trust.ts` beside the gates that read it — the argument
  * belongs where the enforcement is, not in a shared vocabulary module.
  *
- * It is entered under EVERY spelling (`firstPartyHarnessSpellings`), not only the
- * canonical one. A backend name reaches this lookup from a daemon of any version,
- * and an alias that fell through to the Tier 3 default would silently strip the
- * harness of the trust the owner granted it — a failure that looks like a
- * permission prompt storm, not like a rename.
+ * It is entered under every ACCEPTED spelling (`firstPartyHarnessSpellings`), not
+ * only the canonical one. During a rename a backend name reaches this lookup from
+ * a daemon of any version, and an alias that fell through to the Tier 3 default
+ * would silently strip the harness of the trust the owner granted it — a failure
+ * that looks like a permission prompt storm, not like a rename.
+ *
+ * A FORMER spelling is deliberately absent. Nothing dispatches under one after
+ * contract, and a name that is not accepted must never inherit Tier 1 by being
+ * remembered: it falls to the default like any unknown backend.
  */
 export declare const HARNESS_TIERS: Readonly<Record<string, HarnessTrustTier>>;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessTrust.js

@@ -54,11 +54,15 @@ const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
  * in `daemon/src/harness-trust.ts` beside the gates that read it — the argument
  * belongs where the enforcement is, not in a shared vocabulary module.
  *
- * It is entered under EVERY spelling (`firstPartyHarnessSpellings`), not only the
- * canonical one. A backend name reaches this lookup from a daemon of any version,
- * and an alias that fell through to the Tier 3 default would silently strip the
- * harness of the trust the owner granted it — a failure that looks like a
- * permission prompt storm, not like a rename.
+ * It is entered under every ACCEPTED spelling (`firstPartyHarnessSpellings`), not
+ * only the canonical one. During a rename a backend name reaches this lookup from
+ * a daemon of any version, and an alias that fell through to the Tier 3 default
+ * would silently strip the harness of the trust the owner granted it — a failure
+ * that looks like a permission prompt storm, not like a rename.
+ *
+ * A FORMER spelling is deliberately absent. Nothing dispatches under one after
+ * contract, and a name that is not accepted must never inherit Tier 1 by being
+ * remembered: it falls to the default like any unknown backend.
  */
 exports.HARNESS_TIERS = Object.freeze({
     // --- Tier 1: vendor first-party / audited ---

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -37,7 +37,7 @@ export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATI
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export * from './firstPartyHarness.js';
 export { FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX, FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX, firstPartyHarnessBinDir, firstPartyHarnessHomeDir, firstPartyHarnessInstalledBinaryPath, linkFirstPartyHarnessAliases, migrateFirstPartyHarnessHome, type FirstPartyHarnessHomeFs, type FirstPartyHarnessHomeMigration, } from './firstPartyHarnessHome.js';
-export { DEFAULT_FIRST_PARTY_HARNESS_CHANNEL, FIRST_PARTY_HARNESS_CHANNELS, firstPartyHarnessChannelPrefix, firstPartyHarnessFeedBase, firstPartyHarnessFeedCandidates, isFirstPartyHarnessChannel, resolveChannelManifestUrl, resolveFirstPartyHarnessChannel, type FirstPartyHarnessChannel, type FirstPartyHarnessFeedCandidate, DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './firstPartyHarnessChannels.js';
+export { DEFAULT_FIRST_PARTY_HARNESS_CHANNEL, FIRST_PARTY_HARNESS_CHANNELS, firstPartyHarnessChannelPrefix, firstPartyHarnessFeedBase, firstPartyHarnessFeedCandidates, isFirstPartyHarnessChannel, resolveChannelManifestUrl, resolveFirstPartyHarnessChannel, type FirstPartyHarnessChannel, type FirstPartyHarnessFeedCandidate, } from './firstPartyHarnessChannels.js';
 export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
 export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -25,7 +25,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -341,18 +341,6 @@ Object.defineProperty(exports, "firstPartyHarnessFeedCandidates", { enumerable:
 Object.defineProperty(exports, "isFirstPartyHarnessChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.isFirstPartyHarnessChannel; } });
 Object.defineProperty(exports, "resolveChannelManifestUrl", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveChannelManifestUrl; } });
 Object.defineProperty(exports, "resolveFirstPartyHarnessChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveFirstPartyHarnessChannel; } });
-// Deprecated names kept for installed CLIs that resolve this published package
-// with a caret range. Removed in the contract phase with a minor bump.
-Object.defineProperty(exports, "DEFAULT_SKY_CODE_CHANNEL", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.DEFAULT_SKY_CODE_CHANNEL; } });
-Object.defineProperty(exports, "DEFAULT_SKY_CODE_FEED_BASE", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.DEFAULT_SKY_CODE_FEED_BASE; } });
-Object.defineProperty(exports, "SKY_CODE_CHANNELS", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_CHANNELS; } });
-Object.defineProperty(exports, "SKY_CODE_CHANNEL_ENV", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_CHANNEL_ENV; } });
-Object.defineProperty(exports, "SKY_CODE_MANIFEST_FILE", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_MANIFEST_FILE; } });
-Object.defineProperty(exports, "isSkyCodeChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.isSkyCodeChannel; } });
-Object.defineProperty(exports, "resolveSkyCodeChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveSkyCodeChannel; } });
-Object.defineProperty(exports, "skyCodeChannelPrefix", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.skyCodeChannelPrefix; } });
-Object.defineProperty(exports, "skyCodeFeedBase", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.skyCodeFeedBase; } });
-Object.defineProperty(exports, "SKY_CODE_FEED_BASE_ENV", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_FEED_BASE_ENV; } });
 // Daemon release trust: the pinned ed25519 keys and the canonical signature
 // messages. Shared because BOTH the daemon (self-update) and the CLI
 // (`skrr daemon install`, which runs when there is no daemon to ask) verify the

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.d.ts

@@ -24,25 +24,40 @@
  *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
- *   5. ship the data migration, which is generic over `aliases`.
+ *   5. ship the data migration, which is generic over `aliases` and
+ *      `formerSpellings`;
+ *   6. at that rename's contract, move the spelling from `aliases` to the front
+ *      of `formerSpellings`.
  *
  * No identifier, file, env var name or workflow input moves.
  *
- * ── Three spellings, kept apart on purpose ────────────────────────────────
- *
- * `provider`     CANONICAL. What the platform stores, returns and renders.
- * `aliases`      ACCEPTED on every ingress until contract, and normalised to
- *                canonical at the edge. Nothing new is ever written with one.
- * `wireProvider` What the server and a daemon say to EACH OTHER — the
- *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves after the flip and
- *                BEFORE contract, because a daemon on a user's machine may be
- *                any version and the server cannot tell which one sent a
- *                request: only a released daemon that already advertises the
- *                canonical capability lets the old one age out of the fleet.
- *
- * The old code treated those three as one string, which is why no single
- * change could rename it safely. See
+ * ── Four fields, kept apart on purpose ────────────────────────────────────
+ *
+ * `provider`        CANONICAL. What the platform stores, returns and renders.
+ * `aliases`         ACCEPTED on every ingress during a rename's window, and
+ *                   normalised to canonical at the edge. Nothing new is ever
+ *                   written with one. Empty between renames.
+ * `formerSpellings` RETIRED. Accepted on NO ingress: no HTTP body, enum, Mongo
+ *                   filter, capability, wire event, CLI flag or trust table
+ *                   admits one. Recognised only where an ARTIFACT that predates
+ *                   the rename is read — a binary already installed, a checkout
+ *                   directory already on disk, a release already published
+ *                   under its prefix, a row or config key already written.
+ *                   Those exist whatever the platform accepts, and dropping a
+ *                   spelling from this list does not make them go away. Read it
+ *                   through `firstPartyHarnessArtifactSpellings`, never as an
+ *                   ingress check.
+ * `wireProvider`    What the server and a daemon say to EACH OTHER — the
+ *                   capability a daemon advertises,
+ *                   `daemon:<p>:request|response`, the `provider` of a session
+ *                   RPC. It moves after the flip and BEFORE contract, because a
+ *                   daemon on a user's machine may be any version and the
+ *                   server cannot tell which one sent a request: only a
+ *                   released daemon that already advertises the canonical
+ *                   capability lets the old one age out of the fleet.
+ *
+ * The old code treated these as one string, which is why no single change could
+ * rename it safely. See
  * `docs/architecture/skrr-code-identifier-rename-2026-09-13.md`.
  *
  * ── Constraints on this file ──────────────────────────────────────────────
@@ -61,24 +76,28 @@ export interface FirstPartyHarnessIdentity {
     readonly provider: string;
     /** Older spellings still ACCEPTED on every ingress, newest first. */
     readonly aliases: readonly string[];
+    /**
+     * Retired spellings, newest first: accepted on NO ingress, recognised only in
+     * artifacts that predate their retirement (see the file header).
+     */
+    readonly formerSpellings: readonly string[];
     /** The spelling daemons and the server exchange on the wire. */
     readonly wireProvider: string;
 }
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
- * it is now also what the server and a daemon say to each other. `sky-code` is
- * still accepted on every ingress, so a daemon released before this change
- * (which advertises and answers on `sky-code`) keeps working against a server
- * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
- * `aliases` once no connected daemon still advertises the old capability.
+ * Phase: CONTRACTED (OSK-8663). `skrr-code` is the only spelling any ingress
+ * accepts and the only one on the wire. `sky-code` is retired: nothing admits
+ * it, and it is still recognised where a binary, a checkout, a published
+ * release or a stored value written before the rename is looked for.
  */
 declare const IDENTITY: {
     readonly displayName: "skrr Code";
     readonly command: "skrr code";
     readonly provider: "skrr-code";
-    readonly aliases: readonly ["sky-code"];
+    readonly aliases: readonly [];
+    readonly formerSpellings: readonly ["sky-code"];
     readonly wireProvider: "skrr-code";
 };
 /** The canonical slug, as a literal type. */
@@ -92,8 +111,26 @@ export type FirstPartyHarnessCapabilityName = `${FirstPartyHarnessProvider}_sess
 export declare const FIRST_PARTY_HARNESS: FirstPartyHarnessIdentity;
 /** The canonical slug with its literal type, for `as const` tuples and keyed tables. */
 export declare const FIRST_PARTY_HARNESS_PROVIDER: FirstPartyHarnessCanonicalProvider;
-/** Every spelling, canonical first. The order is the resolution order. */
+/**
+ * Every ACCEPTED spelling, canonical first — what an ingress admits. The order
+ * is the resolution order.
+ */
 export declare function firstPartyHarnessSpellings(): readonly string[];
+/**
+ * Every spelling an ARTIFACT that already exists may carry, canonical first:
+ * the accepted spellings, then every former one.
+ *
+ * For code that LOOKS FOR what an earlier release left behind — an installed
+ * binary, a checkout directory, an immutable published release, a stored value
+ * or config key — and for the tooling that must keep recognising those
+ * (ignore lists, the identity ratchet). A machine that never ran a post-rename
+ * client still has its engine under the old name, and it must still be found.
+ *
+ * Never an ingress check: a former spelling is not accepted anywhere, and a
+ * reader that admitted one here would silently reopen what contract closed. Use
+ * `firstPartyHarnessSpellings` / `isFirstPartyHarnessProvider` for that.
+ */
+export declare function firstPartyHarnessArtifactSpellings(): readonly string[];
 /** True for the canonical provider or any alias (case- and whitespace-insensitive). */
 export declare function isFirstPartyHarnessProvider(value: unknown): boolean;
 /**
@@ -102,6 +139,24 @@ export declare function isFirstPartyHarnessProvider(value: unknown): boolean;
  * caller's own normalisation still owns case and shape for other providers).
  */
 export declare function canonicalHarnessProvider<T>(value: T): T | string;
+/**
+ * The canonical provider for a value read back from an ARTIFACT that may predate
+ * a rename — any artifact spelling (canonical, alias or FORMER) becomes the
+ * provider; every other value is returned unchanged.
+ *
+ * For values nobody migrates and nobody can refuse: a harness row's stored
+ * display NAME (the operator migration rewrites `provider`, never `name`), a
+ * daemon's config file, a harness session binding on a user's machine. Read raw
+ * after contract, each would name an unknown provider — a label that renders the
+ * retired name again, a local session silently running another backend, a live
+ * resume context reset as new — with no error anywhere.
+ *
+ * NEVER for anything a peer, a client or an operator SENDS, and never for a
+ * trust, dispatch or admission decision: a former spelling is accepted on no
+ * ingress, and canonicalising one here would reopen what contract closed. Use
+ * `canonicalHarnessProvider` for those.
+ */
+export declare function canonicalArtifactHarnessProvider<T>(value: T): T | string;
 /**
  * Every spelling a stored row for this provider may carry, canonical first —
  * for a Mongo `$in` filter while rows written before a flip still exist. Any
@@ -138,7 +193,16 @@ export declare function isFirstPartyHarnessEnvironment(value: unknown): boolean;
 export declare function canonicalExecutionEnvironment<T>(value: T): T | string;
 /** Binary file name. `platform` is a `process.platform` value; only `win32` differs. */
 export declare function firstPartyHarnessBinaryName(provider?: string, platform?: string): string;
-/** Every binary file name, canonical first — the lookup order. */
+/**
+ * Every binary file name an install may carry, canonical first — the lookup
+ * order, and the names an install links to the canonical binary.
+ *
+ * Built from the ARTIFACT spellings, former ones included: binaries are
+ * artifacts. An engine installed before a rename is still on disk under its old
+ * name, and a platform CLI or daemon built before it still looks for that name,
+ * so resolvers try it and installers leave a link at it. Neither makes the
+ * spelling acceptable on any ingress.
+ */
 export declare function firstPartyHarnessBinaryNames(platform?: string): readonly string[];
 /**
  * The engine home directory name under the skrr config root.
@@ -161,23 +225,32 @@ export declare function firstPartyHarnessManifestFile(provider?: string): string
 export declare const FIRST_PARTY_HARNESS_FEED_ORIGIN = "https://updates.oversky.ai";
 /** Object-key prefix for one spelling's feed, e.g. `skrr-code/`. */
 export declare function firstPartyHarnessFeedPrefix(provider?: string): string;
-/** Every feed prefix, canonical first. Publishing writes all of them. */
+/**
+ * Every feed prefix a publish WRITES, canonical first: the accepted spellings.
+ *
+ * A former spelling's prefix still holds every release published under it, and
+ * those stay served — their artifact URLs are inside signed manifests — but
+ * nothing new is written there, so its channel pointers stop moving at contract.
+ */
 export declare function firstPartyHarnessFeedPrefixes(): readonly string[];
 /** Object-key prefix the fork stages unsigned builds under, e.g. `skrr-code-staging/`. */
 export declare function firstPartyHarnessStagingPrefix(provider?: string): string;
 /** Default feed base URL for one spelling. */
 export declare function firstPartyHarnessDefaultFeedBase(provider?: string): string;
 export interface FirstPartyHarnessEnvName {
-    /** Brand-neutral name. Set this one. */
+    /** Brand-neutral name — the only one the platform reads. */
     readonly name: string;
-    /** Older names still read, in precedence order, until contract. */
-    readonly legacy: readonly string[];
 }
 /**
- * Every environment variable the platform reads for the first-party harness,
- * by purpose. The neutral name wins; a legacy name is read only when the neutral
- * one is unset or blank, because a variable set in an ECS task definition, a
- * user's shell or a LaunchAgent does not change when the code does.
+ * Every environment variable the PLATFORM reads for the first-party harness, by
+ * purpose, under one brand-neutral name each — so a product rename never renames
+ * one.
+ *
+ * The product-named variables these replaced were read second until contract
+ * (OSK-8663) and are not read at all now. The ENGINE's own variables are a
+ * different namespace (`FIRST_PARTY_HARNESS_ENGINE.env`): the fork reads them,
+ * so a platform reader that must agree with the engine consults the engine's
+ * name explicitly — the engine home is the one case (`home` below).
  */
 export declare const FIRST_PARTY_HARNESS_ENV: Readonly<{
     /** Absolute path to an engine binary, overriding resolution. */
@@ -192,7 +265,12 @@ export declare const FIRST_PARTY_HARNESS_ENV: Readonly<{
     devKeys: FirstPartyHarnessEnvName;
     /** Engine version the desktop build bundles. */
     bundleVersion: FirstPartyHarnessEnvName;
-    /** Engine home override (the engine reads its own name too — see ENGINE env below). */
+    /**
+     * Engine home override. The engine reads only its own variable
+     * (`FIRST_PARTY_HARNESS_ENGINE.env.home`), so a reader that resolves the home
+     * the engine will use reads that one second, and a launcher hands the engine
+     * the resolved path under it.
+     */
     home: FirstPartyHarnessEnvName;
     /** Engine version baked into the cloud-coding image. */
     cloudCodingVersion: FirstPartyHarnessEnvName;
@@ -213,12 +291,8 @@ export interface FirstPartyHarnessEnvReading {
     readonly value: string | undefined;
     /** The variable that supplied `value`. */
     readonly name: string | undefined;
-    /** True when the value came from a legacy name — worth telling the operator. */
-    readonly legacy: boolean;
 }
-/** Every name for one purpose, neutral first — for spawn-env forwarding and sanitisers. */
-export declare function firstPartyHarnessEnvNames(key: FirstPartyHarnessEnvKey): readonly string[];
-/** Read one purpose's variable: neutral name first, legacy names after. */
+/** Read one purpose's variable. A blank value counts as unset. */
 export declare function readFirstPartyHarnessEnv(env: Readonly<Record<string, string | undefined>>, key: FirstPartyHarnessEnvKey): FirstPartyHarnessEnvReading;
 /**
  * Names the ENGINE itself defines and reads. The platform sets or reads them