@skrr-ai/cli 0.1.65 → 0.1.67

package/dist/lib/auth-core-init.js

@@ -17,11 +17,10 @@ exports.__resetPrefetchCliAuthForTest = __resetPrefetchCliAuthForTest;
  * Runs as a side-effect import from base-command.ts so every command path
  * (including future ones) gets the same DI setup. Idempotent and cheap.
  *
- * Phase A scope:
+ * Runtime scope:
  *   - Logger: a thin shim over `console`. CLI is a one-shot process; we
  *     don't ship winston for this.
- *   - configDir: still ~/.sky/ in Phase A. Phase D will repoint to
- *     ~/.skrr/ with a one-shot read-shim migration.
+ *   - configDir: the shared ~/.skrr/ root, with profile state below it.
  *   - Kill switches: respect OVERSKY_DISABLE_REFRESH_SCHEDULER for parity
  *     with the daemon's rollback knob.
  *   - binaryName: 'skrr' so reauth banners say `skrr login` not `oversky login`.
@@ -42,6 +41,7 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
 const auth_storage_1 = require("./auth-storage");
+const keychain_1 = require("./keychain");
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
@@ -165,12 +165,6 @@ const cliLogger = {
     },
     error: (...args) => console.error('[auth-core error]', ...args),
 };
-/**
- * Profile name in shared on-disk paths. Pre-Phase-K every consumer
- * resolves to `'default'`; matches `daemon/src/auth.ts:DEFAULT_PROFILE`
- * so cross-binary file paths align byte-for-byte.
- */
-const DEFAULT_PROFILE = 'default';
 const DEDICATED_AUTH_GENERATION_MARKER = 'dedicated-runtime-auth-generation';
 /**
  * A Dedicated Runtime's workspace survives replacement but `/etc/machine-id`
@@ -192,7 +186,11 @@ async function prepareDedicatedRuntimeAuthGeneration(options = {}) {
         return false;
     const configDir = options.configDir ?? (0, auth_core_1.resolveConfigRoot)();
     node_fs_1.default.mkdirSync(configDir, { recursive: true, mode: 0o700 });
-    const markerPath = node_path_1.default.join(configDir, DEDICATED_AUTH_GENERATION_MARKER);
+    const profile = (0, keychain_1.getActiveProfile)();
+    const markerName = profile === keychain_1.DEFAULT_PROFILE
+        ? DEDICATED_AUTH_GENERATION_MARKER
+        : `${DEDICATED_AUTH_GENERATION_MARKER}.${profile}`;
+    const markerPath = node_path_1.default.join(configDir, markerName);
     const release = await proper_lockfile_1.default.lock(configDir, {
         lockfilePath: `${markerPath}.lock`,
         realpath: false,
@@ -212,12 +210,12 @@ async function prepareDedicatedRuntimeAuthGeneration(options = {}) {
         (options.clearStoredAuth ?? auth_storage_1.clearAllBackends)();
         await (options.clearDeviceIdentity ??
             (() => (0, device_identity_1.resetDeviceIdentity)({
-                profile: DEFAULT_PROFILE,
+                profile,
                 clearOnDisk: true,
             })))();
         await (options.clearCredentialEnvelope ??
             (() => (0, cred_envelope_1.resetCredEnvelope)({
-                profile: DEFAULT_PROFILE,
+                profile,
                 clearOnDisk: true,
             })))();
         const temporary = `${markerPath}.tmp.${process.pid}.${Date.now()}`;
@@ -298,6 +296,7 @@ function ensureAuthCoreConfigured() {
 let _prefetchPromise = null;
 let _credEnvelopeInitPromise = null;
 let _credEnvelopeInitStartedAt = 0;
+let _prefetchProfile = null;
 class CliCredentialInitializationError extends Error {
     code = 'CREDENTIAL_INITIALIZATION_UNAVAILABLE';
     exitCode = 75;
@@ -342,15 +341,21 @@ function encryptedCredentialInitError(timedOut, cause) {
         'The credential remains protected; unlock or repair the OS credential store and retry.');
 }
 function ensureCliAuthPrefetchStarted() {
-    if (_prefetchPromise)
+    const profile = (0, keychain_1.getActiveProfile)();
+    if (_prefetchPromise) {
+        if (_prefetchProfile !== profile) {
+            throw new CliCredentialInitializationError(`Credential initialization already belongs to profile ${_prefetchProfile}; start a new skrr process for profile ${profile}.`);
+        }
         return;
+    }
+    _prefetchProfile = profile;
     _credEnvelopeInitStartedAt = Date.now();
-    const envelopeInit = (0, cred_envelope_1.initCredEnvelope)(DEFAULT_PROFILE);
+    const envelopeInit = (0, cred_envelope_1.initCredEnvelope)(profile);
     _credEnvelopeInitPromise = envelopeInit;
     _prefetchPromise = (async () => {
         try {
             await envelopeInit;
-            await (0, device_identity_1.initDeviceIdentity)(DEFAULT_PROFILE);
+            await (0, device_identity_1.initDeviceIdentity)(profile);
             // The CLI deliberately does NOT enroll a device key with the server
             // (OSK-12063). Enrollment pins the FIRST key presented on a machine's
             // Daemon row, and every later refresh signed by a different key is
@@ -431,6 +436,7 @@ function __resetPrefetchCliAuthForTest() {
     _prefetchPromise = null;
     _credEnvelopeInitPromise = null;
     _credEnvelopeInitStartedAt = 0;
+    _prefetchProfile = null;
 }
 // Eager-configure on first import. Cheap and avoids ordering pitfalls in
 // any future command that calls auth-core helpers from outside a Command.

package/dist/lib/keychain.d.ts

@@ -1,4 +1,4 @@
-/** Pre-Phase-K namespace; reserved for a future migration helper. */
+/** Default profile when no profile flag or environment override is present. */
 export declare const DEFAULT_PROFILE = "default";
 export declare function setActiveProfile(profile: string): void;
 /**
@@ -102,11 +102,13 @@ export declare function deleteRefreshToken(): void;
  * Returns the services it actually removed something from, so the caller can
  * say what happened instead of destroying credentials silently.
  *
- * NOTE this also signs out the retired `oversky` binary, if one is still
- * installed. That is the intent — same account, same machine — and the cutover
- * runbook already lists these items for removal.
+ * Ordinary logout removes only retired CLI slots. Machine credentials and
+ * KEKs are shared with the daemon and are removed only by --all-devices.
+ * That broader mode also signs out an installed retired `oversky` daemon.
  */
-export declare function deleteLegacyBrandEntries(): string[];
+export declare function deleteLegacyBrandEntries(options?: {
+    includeMachineCredentials?: boolean;
+}): string[];
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.
  * Safe to call on a clean system — missing items are not an error.

package/dist/lib/keychain.js

@@ -67,10 +67,8 @@ exports.resolveProfileFromArgv = resolveProfileFromArgv;
  * Mirrors `daemon/src/keychain.ts` but simpler:
  *   - No prefetch: the CLI is a short-lived foreground process; parallelizing
  *     the keychain probe with other startup work isn't worth the code.
- *   - Namespaced `ai.skrr.cli.<profile>` from day one. Before Phase K
- *     ships profile switching, `<profile>` is always `default`, but baking
- *     the suffix in now makes the future migration a rename instead of a
- *     schema change.
+ *   - Namespaced `ai.skrr.cli.<profile>` so each selected profile keeps
+ *     its own CLI refresh family.
  *   - Distinct service from the daemon (`ai.skrr.cli.*` vs.
  *     `ai.skrr.daemon.*`). The CLI holds `scope: 'cli'` tokens; the
  *     daemon holds `scope: 'daemon'`. They must never read each other's
@@ -121,7 +119,7 @@ const cred_envelope_1 = require("./cred-envelope");
 const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
 const SERVICE_BASE = 'ai.skrr.cli';
-/** Pre-Phase-K namespace; reserved for a future migration helper. */
+/** Default profile when no profile flag or environment override is present. */
 exports.DEFAULT_PROFILE = 'default';
 const ACCOUNT_TOKEN = 'cli-token';
 const ACCOUNT_EXPIRES = 'cli-token-expires';
@@ -619,14 +617,16 @@ function deleteEntireService(service) {
  * Returns the services it actually removed something from, so the caller can
  * say what happened instead of destroying credentials silently.
  *
- * NOTE this also signs out the retired `oversky` binary, if one is still
- * installed. That is the intent — same account, same machine — and the cutover
- * runbook already lists these items for removal.
+ * Ordinary logout removes only retired CLI slots. Machine credentials and
+ * KEKs are shared with the daemon and are removed only by --all-devices.
+ * That broader mode also signs out an installed retired `oversky` daemon.
  */
-function deleteLegacyBrandEntries() {
+function deleteLegacyBrandEntries(options = {}) {
     if (!isAvailable())
         return [];
-    return discoverLegacyBrandServices().filter((service) => deleteEntireService(service));
+    return discoverLegacyBrandServices()
+        .filter((service) => options.includeMachineCredentials === true || /^(?:ai|com)\.oversky\.cli\./.test(service))
+        .filter((service) => deleteEntireService(service));
 }
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.

package/dist/lib/refresh.d.ts

@@ -45,6 +45,8 @@ export interface EnsureFreshCliCredentialResult {
     /** True when we adopted a fresher token another process already wrote. */
     adoptedStoredToken?: boolean;
     pair?: TokenPair;
+    /** Stable diagnostic code; never contains token or server response text. */
+    refreshFailureCode?: string;
     skippedReason?: 'no_token' | 'ci_token' | 'external_source' | 'env_override' | 'bare_mode' | 'fresh' | 'no_refresh_token' | 'refresh_failed';
 }
 /**

package/dist/lib/refresh.js

@@ -58,6 +58,7 @@ class CliRefreshUnavailableError extends Error {
 }
 exports.CliRefreshUnavailableError = CliRefreshUnavailableError;
 let ensureInFlight = null;
+let reportedPermanentRefreshFailure = false;
 function expiryFromToken(token) {
     if (!token)
         return undefined;
@@ -158,8 +159,25 @@ async function ensureFreshCliCredential(opts = {}) {
                 pair,
             };
         }
-        catch {
-            return { credential, refreshed: false, skippedReason: 'refresh_failed' };
+        catch (err) {
+            const refreshFailureCode = err instanceof auth_core_1.PermanentAuthFailure
+                ? err.code
+                : err instanceof auth_core_1.TransientAuthFailure
+                    ? 'TRANSIENT_REFRESH_FAILURE'
+                    : err instanceof CliRefreshUnavailableError
+                        ? 'LOCAL_REFRESH_UNAVAILABLE'
+                        : 'LOCAL_REFRESH_ERROR';
+            if (err instanceof auth_core_1.PermanentAuthFailure && !reportedPermanentRefreshFailure) {
+                reportedPermanentRefreshFailure = true;
+                console.error(`[skrr/auth] Stored CLI session refresh was rejected (${refreshFailureCode}). ` +
+                    'The background service may still provide access; run `skrr login` if it cannot.');
+            }
+            return {
+                credential,
+                refreshed: false,
+                skippedReason: 'refresh_failed',
+                refreshFailureCode,
+            };
         }
         finally {
             ensureInFlight = null;

package/dist/lib/scoped-memory-command.d.ts

@@ -1,10 +1,12 @@
-import { type MemoryMount as SharedMemoryMount, type MemoryStore as SharedMemoryStore } from '@skrr-ai/data-schemas';
+import type { MemoryMount as SharedMemoryMount, MemoryStore as SharedMemoryStore } from '@skrr-ai/data-schemas';
 import { BaseCommand } from '../base-command';
 import { ApiFetchError, type ApiFetchOptions } from './api-fetch';
 export type MemoryMount = SharedMemoryMount;
 export type MemoryStore = SharedMemoryStore & {
-    mount?: SharedMemoryMount;
+    mount: SharedMemoryMount;
 };
+export declare function parseMemoryMount(value: unknown): MemoryMount;
+export declare function parseMountedMemoryStore(value: unknown): MemoryStore;
 export declare const scopedMemoryFlags: {
     agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
     space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/lib/scoped-memory-command.js

@@ -1,12 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ScopedMemoryCommand = exports.versionedMutationFlags = exports.mutationFlags = exports.scopedMemoryFlags = void 0;
+exports.parseMemoryMount = parseMemoryMount;
+exports.parseMountedMemoryStore = parseMountedMemoryStore;
 exports.parseMemoryApiError = parseMemoryApiError;
 const core_1 = require("@oclif/core");
-const data_schemas_1 = require("@skrr-ai/data-schemas");
 const node_crypto_1 = require("node:crypto");
 const base_command_1 = require("../base-command");
 const api_fetch_1 = require("./api-fetch");
+// The public CLI must not load the private data-schemas package at runtime.
+// The API validates the full wire contract; check the fields used by CLI commands
+// before treating a response as a mounted Store or mount.
+function parseMemoryMount(value) {
+    const mount = value;
+    if (!mount || typeof mount !== 'object' || typeof mount.storeId !== 'string' ||
+        typeof mount.uri !== 'string' || typeof mount.authorizationGeneration !== 'number' ||
+        !['read_only', 'read_write'].includes(String(mount.access)) ||
+        !['agent', 'current_space', 'ancestor_space'].includes(String(mount.source))) {
+        throw new Error('Invalid Memory mount response from server');
+    }
+    return mount;
+}
+function parseMountedMemoryStore(value) {
+    const store = value;
+    if (!store || typeof store !== 'object' || typeof store.id !== 'string' ||
+        typeof store.revision !== 'number' || typeof store.authorizationGeneration !== 'number' ||
+        !store.owner || !['agent', 'space'].includes(String(store.owner.kind)) ||
+        typeof store.owner.id !== 'string') {
+        throw new Error('Invalid Memory Store response from server');
+    }
+    return { ...store, mount: parseMemoryMount(store.mount) };
+}
 exports.scopedMemoryFlags = {
     agent: core_1.Flags.string({ description: 'Act through this Agent', required: true }),
     space: core_1.Flags.string({ description: 'Current Space context (required for Space scopes)' }),
@@ -126,7 +150,7 @@ class ScopedMemoryCommand extends base_command_1.BaseCommand {
     async resolveStore(flags, { write = false } = {}) {
         if (flags.store) {
             const rawStore = await this.memoryApi(flags.agent, `/stores/${encodeURIComponent(flags.store)}${this.query(flags)}`);
-            const store = data_schemas_1.MountedMemoryStoreSchema.parse(rawStore);
+            const store = parseMountedMemoryStore(rawStore);
             if (write && store.mount?.access !== 'read_write') {
                 this.error('MEMORY_STORE_READ_ONLY: selected Store is read-only', { exit: 5 });
             }
@@ -143,7 +167,7 @@ class ScopedMemoryCommand extends base_command_1.BaseCommand {
             this.error(`MEMORY_SPACE_CONTEXT_REQUIRED: --space ${id} is required when selecting ${flags.scope}.`, { exit: 2, code: 'MEMORY_SPACE_CONTEXT_REQUIRED' });
         }
         const response = await this.memoryApi(flags.agent, `/stores${this.query(flags)}`);
-        const stores = response.stores.map((store) => data_schemas_1.MountedMemoryStoreSchema.parse(store));
+        const stores = response.stores.map(parseMountedMemoryStore);
         const store = stores.find((candidate) => candidate.owner.kind === kind && candidate.owner.id === id);
         if (!store)
             this.error(`MEMORY_NOT_MOUNTED: ${flags.scope}`, { exit: 5 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -42,11 +42,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-export declare function initDeviceIdentity(profile: string): Promise<void>;
+export declare function initDeviceIdentity(profile: string, options?: {
+    recoverUnreadable?: boolean;
+}): Promise<void>;
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 export declare function resetDeviceIdentity(opts?: {
     profile?: string;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -100,6 +100,26 @@ function publicKeyPath(profile) {
 function privateKeyPath(profile) {
     return node_path_1.default.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
 }
+function storedKeyMaterialExists(profile) {
+    let files;
+    try {
+        files = [publicKeyPath(profile), privateKeyPath(profile), enrollmentMarkerPath(profile)];
+    }
+    catch {
+        return true;
+    }
+    for (const file of files) {
+        try {
+            node_fs_1.default.lstatSync(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return true;
+        }
+    }
+    return false;
+}
 function enrollmentMarkerPath(profile) {
     return node_path_1.default.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
 }
@@ -339,7 +359,7 @@ async function consolidateDeviceIdentity(profile) {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-async function initDeviceIdentity(profile) {
+async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
         return;
     if (typeof profile !== 'string' || profile.length === 0) {
@@ -374,6 +394,18 @@ async function initDeviceIdentity(profile) {
         });
         return;
     }
+    // A first install has neither file. If either file already exists, a null
+    // load is a lost, corrupt or temporarily unreadable identity. Replacing it
+    // during ordinary boot would make the next refresh sign with a key the
+    // server has never pinned, turning a local read failure into an unexpected
+    // DEVICE_KEY_MISMATCH. Only an explicit interactive login may replace it;
+    // that login proves the new key and re-pins it before issuing credentials.
+    const hasStoredKey = storedKeyMaterialExists(profile);
+    if (hasStoredKey && !options.recoverUnreadable) {
+        _state = { kind: 'disabled', reason: 'unreadable_key' };
+        emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
+        return;
+    }
     let fresh;
     try {
         fresh = (0, deviceKey_js_1.generateDeviceKeyPair)();
@@ -413,9 +445,9 @@ async function initDeviceIdentity(profile) {
     });
 }
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 async function resetDeviceIdentity(opts) {
     if (opts?.clearOnDisk && opts.profile) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -42,11 +42,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-export declare function initDeviceIdentity(profile: string): Promise<void>;
+export declare function initDeviceIdentity(profile: string, options?: {
+    recoverUnreadable?: boolean;
+}): Promise<void>;
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 export declare function resetDeviceIdentity(opts?: {
     profile?: string;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -80,6 +80,26 @@ function publicKeyPath(profile) {
 function privateKeyPath(profile) {
     return path.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
 }
+function storedKeyMaterialExists(profile) {
+    let files;
+    try {
+        files = [publicKeyPath(profile), privateKeyPath(profile), enrollmentMarkerPath(profile)];
+    }
+    catch {
+        return true;
+    }
+    for (const file of files) {
+        try {
+            fs.lstatSync(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return true;
+        }
+    }
+    return false;
+}
 function enrollmentMarkerPath(profile) {
     return path.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
 }
@@ -319,7 +339,7 @@ async function consolidateDeviceIdentity(profile) {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-export async function initDeviceIdentity(profile) {
+export async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
         return;
     if (typeof profile !== 'string' || profile.length === 0) {
@@ -354,6 +374,18 @@ export async function initDeviceIdentity(profile) {
         });
         return;
     }
+    // A first install has neither file. If either file already exists, a null
+    // load is a lost, corrupt or temporarily unreadable identity. Replacing it
+    // during ordinary boot would make the next refresh sign with a key the
+    // server has never pinned, turning a local read failure into an unexpected
+    // DEVICE_KEY_MISMATCH. Only an explicit interactive login may replace it;
+    // that login proves the new key and re-pins it before issuing credentials.
+    const hasStoredKey = storedKeyMaterialExists(profile);
+    if (hasStoredKey && !options.recoverUnreadable) {
+        _state = { kind: 'disabled', reason: 'unreadable_key' };
+        emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
+        return;
+    }
     let fresh;
     try {
         fresh = generateDeviceKeyPair();
@@ -393,9 +425,9 @@ export async function initDeviceIdentity(profile) {
     });
 }
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 export async function resetDeviceIdentity(opts) {
     if (opts?.clearOnDisk && opts.profile) {

package/dist/node_modules/@skrr-ai/data-provider/index.js

@@ -44752,6 +44752,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   return oR.get(e2 ? "".concat(vr(), "?workspaceId=").concat(encodeURIComponent(e2)) : vr());
 }, getStorePublisherFollowOverlay: function(e2) {
   return oR.get(xr(e2));
+}, getStorePublisherFollows: function(e2) {
+  return oR.get((function(e3) {
+    return "".concat(er(), "/publisher-follows").concat(e3 ? "?cursor=".concat(encodeURIComponent(e3)) : "");
+  })(e2));
 }, getStorePublisherNamespaces: function(e2) {
   return oR.get(hr(e2));
 }, getStorePublisherProfileEditor: function(e2) {
@@ -44767,7 +44771,7 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
 }, getStoreReleaseAdmissions: function(e2) {
   return oR.get((function(e3) {
     var t2 = new URLSearchParams();
-    (null == e3 ? void 0 : e3.state) && t2.set("state", e3.state), (null == e3 ? void 0 : e3.limit) && t2.set("limit", String(e3.limit));
+    (null == e3 ? void 0 : e3.state) && t2.set("state", e3.state), (null == e3 ? void 0 : e3.limit) && t2.set("limit", String(e3.limit)), (null == e3 ? void 0 : e3.artifactAfter) && t2.set("artifactAfter", e3.artifactAfter);
     var n2 = t2.toString();
     return "".concat(er(), "/admissions").concat(n2 ? "?".concat(n2) : "");
   })(e2));
@@ -46542,10 +46546,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
 }, setAgentUsageCap: function(e2, t2) {
   return oR.put(Nn(e2), t2);
 }, setAgentVisibility: function(e2) {
-  var t2 = e2.agentId, n2 = e2.isPublic, o2 = e2.price, r2 = e2.shareMode, a2 = e2.changelog, i2 = e2.versionMajor, s2 = e2.versionMinor, c2 = e2.capabilityRationales, l2 = e2.supportedLanguages, u2 = e2.license, d2 = e2.sourceVisibility, p2 = { isPublic: n2 };
-  return void 0 !== o2 && (p2.price = o2), void 0 !== r2 && (p2.shareMode = r2), void 0 !== a2 && (p2.changelog = a2), void 0 !== i2 && (p2.versionMajor = i2), void 0 !== s2 && (p2.versionMinor = s2), void 0 !== c2 && (p2.capabilityRationales = c2), void 0 !== l2 && (p2.supportedLanguages = l2), void 0 !== u2 && (p2.license = u2), void 0 !== d2 && (p2.sourceVisibility = d2), oR.post((function(e3) {
+  var t2 = e2.agentId, n2 = e2.isPublic, o2 = e2.price, r2 = e2.shareMode, a2 = e2.changelog, i2 = e2.versionMajor, s2 = e2.versionMinor, c2 = e2.capabilityRationales, l2 = e2.supportedLanguages, u2 = e2.dependencies, d2 = e2.license, p2 = e2.sourceVisibility, m2 = { isPublic: n2 };
+  return void 0 !== o2 && (m2.price = o2), void 0 !== r2 && (m2.shareMode = r2), void 0 !== a2 && (m2.changelog = a2), void 0 !== i2 && (m2.versionMajor = i2), void 0 !== s2 && (m2.versionMinor = s2), void 0 !== c2 && (m2.capabilityRationales = c2), void 0 !== l2 && (m2.supportedLanguages = l2), void 0 !== u2 && (m2.dependencies = u2), void 0 !== d2 && (m2.license = d2), void 0 !== p2 && (m2.sourceVisibility = p2), oR.post((function(e3) {
     return "".concat(en, "/api/agents/").concat(e3, "/visibility");
-  })(t2), p2);
+  })(t2), m2);
 }, setAlwaysOnDesired: function(e2, t2) {
   return oR.put((n2 = e2, "".concat(en, "/api/agents/").concat(encodeURIComponent(n2), "/always-on")), t2);
   var n2;
@@ -46890,6 +46894,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   return oR.patch(Aa(e2), { unarchive: true });
 }, unfollowStorePublisherByHandle: function(e2) {
   return oR.delete(xr(e2));
+}, unfollowStorePublisherById: function(e2) {
+  return oR.delete((function(e3) {
+    return "".concat(er(), "/publisher-follows/").concat(encodeURIComponent(e3));
+  })(e2));
 }, uninstallStoreAgent: function(e2) {
   var t2 = e2.agentId, n2 = e2.erase;
   return oR.post((function(e3) {