@skrr-ai/cli 0.1.8 → 0.1.10

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/skyCodeChannels.d.ts

@@ -0,0 +1,96 @@
+/**
+ * skrr Code update channels — the vocabulary, in the ONE place both readers resolve.
+ *
+ * It lived in `daemon/src/sky-code/channels.ts`, whose only importer was the
+ * daemon's own installer. That was fine while the daemon was the only thing that
+ * needed it, and it stopped being fine the moment a user could be told to go
+ * looking: `skrr code`'s not-installed message promised that `skrr code doctor`
+ * would name "which channel this machine follows and whether that channel has a
+ * published release", and the CLI had no access to any of it — so the sentence
+ * described a diagnosis nobody had written (dogfood OSK-274).
+ *
+ * A MIRROR in the CLI was the obvious alternative and is the wrong answer here,
+ * with precedent: OSK-3894 shipped exactly that for the harness trust tiers and
+ * OSK-3897 removed it, because a mirror proves two copies agree rather than
+ * proving there is one copy. `harnessTrust.ts` moved into this package for that
+ * reason, the daemon re-exports it, and a static check keeps the daemon from
+ * quietly redeclaring. This follows that road rather than reopening the one it
+ * replaced.
+ *
+ * Only the VOCABULARY moves — channel names, the env var, the default, and the
+ * URL shape. The installer, the signature verification and the promotion
+ * machinery stay in the daemon, which is the only process that performs them.
+ */
+/** Channels in promotion order. Index order IS the promotion order. */
+export declare const SKY_CODE_CHANNELS: readonly ["internal", "canary", "beta", "stable"];
+export type SkyCodeChannel = (typeof SKY_CODE_CHANNELS)[number];
+/**
+ * The channel a build without an explicit setting follows.
+ *
+ * `stable`, and never inferred from anything else. A default that drifted with
+ * the build (say, dev builds silently on `canary`) would mean a user's update
+ * path depended on how their binary happened to be produced.
+ */
+export declare const DEFAULT_SKY_CODE_CHANNEL: SkyCodeChannel;
+/** Env var selecting the channel. Explicit opt-in; never set implicitly. */
+export declare const SKY_CODE_CHANNEL_ENV = "OVERSKY_SKY_CODE_CHANNEL";
+/** Manifest filename, under a channel prefix or an immutable release prefix. */
+export declare const SKY_CODE_MANIFEST_FILE = "sky-code-version.json";
+export declare function isSkyCodeChannel(value: unknown): value is SkyCodeChannel;
+/**
+ * The channel this process should follow.
+ *
+ * An unrecognised value falls back to the default rather than throwing. A
+ * typo'd channel must not brick updates altogether — that turns a harmless
+ * mistake into an un-updatable machine, which is the failure the updater exists
+ * to prevent. The caller is handed `invalid` so it can say so out loud.
+ */
+export declare function resolveSkyCodeChannel(env?: NodeJS.ProcessEnv): {
+    channel: SkyCodeChannel;
+    invalid?: string;
+};
+/**
+ * Where a channel's signed manifest lives.
+ *
+ * `stable` is NOT special-cased to `latest/`. Two paths that must always agree
+ * is a pair that eventually will not, and the one that disagrees silently is
+ * the one serving production. `latest/` remains for the daemon feed and for
+ * anything already pointing at it; skrr Code channel clients read
+ * `channels/<name>/` uniformly.
+ */
+export declare function skyCodeChannelPrefix(channel: SkyCodeChannel): string;
+/**
+ * Manifest URL for a channel, or for a pinned version.
+ *
+ * A pinned version wins over the channel and reads its immutable per-release
+ * copy: pinning means "this exact build", and a channel pointer that moved
+ * underneath would make the pin a suggestion.
+ *
+ * Builds only MANIFEST urls, never artifact ones. `buildManifestMessage` signs
+ * version, minimum, forceUpdate and the per-platform sha256s; `buildArtifactMessage`
+ * signs the artifact URL. Neither signs a channel — so artifact URLs stay
+ * channel-independent and promotion is a COPY OF AN ALREADY-SIGNED OBJECT that
+ * never needs the release key. Put the channel in the artifact URL instead and
+ * every promotion becomes a re-signing ceremony, which decides whether the
+ * ed25519 key has to be reachable from routine automation. A helper here that
+ * adjusted artifact urls would silently reintroduce exactly that coupling.
+ */
+export declare function resolveChannelManifestUrl(input: {
+    base: string;
+    manifestFilename: string;
+    channel: SkyCodeChannel;
+    pinnedVersion?: string | null;
+}): string;
+/** Default public feed. Mirrors the daemon's `updates.oversky.ai/daemon` prefix. */
+export declare const DEFAULT_SKY_CODE_FEED_BASE = "https://updates.oversky.ai/sky-code";
+/**
+ * Feed override, read at call time rather than module load so a test or an
+ * operator can repoint it without re-importing.
+ *
+ * Explicit-only: a production user must never be silently enrolled onto a
+ * different feed. Selecting a feed changes WHICH signed manifest is read, never
+ * WHETHER the signature is checked — every artifact is verified against the
+ * pinned keys regardless of where it came from.
+ */
+export declare const SKY_CODE_FEED_BASE_ENV = "OVERSKY_SKY_CODE_UPDATE_FEED_BASE";
+export declare function skyCodeFeedBase(env?: NodeJS.ProcessEnv): string;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/skyCodeChannels.js

@@ -0,0 +1,107 @@
+/**
+ * skrr Code update channels — the vocabulary, in the ONE place both readers resolve.
+ *
+ * It lived in `daemon/src/sky-code/channels.ts`, whose only importer was the
+ * daemon's own installer. That was fine while the daemon was the only thing that
+ * needed it, and it stopped being fine the moment a user could be told to go
+ * looking: `skrr code`'s not-installed message promised that `skrr code doctor`
+ * would name "which channel this machine follows and whether that channel has a
+ * published release", and the CLI had no access to any of it — so the sentence
+ * described a diagnosis nobody had written (dogfood OSK-274).
+ *
+ * A MIRROR in the CLI was the obvious alternative and is the wrong answer here,
+ * with precedent: OSK-3894 shipped exactly that for the harness trust tiers and
+ * OSK-3897 removed it, because a mirror proves two copies agree rather than
+ * proving there is one copy. `harnessTrust.ts` moved into this package for that
+ * reason, the daemon re-exports it, and a static check keeps the daemon from
+ * quietly redeclaring. This follows that road rather than reopening the one it
+ * replaced.
+ *
+ * Only the VOCABULARY moves — channel names, the env var, the default, and the
+ * URL shape. The installer, the signature verification and the promotion
+ * machinery stay in the daemon, which is the only process that performs them.
+ */
+/** Channels in promotion order. Index order IS the promotion order. */
+export const SKY_CODE_CHANNELS = ['internal', 'canary', 'beta', 'stable'];
+/**
+ * The channel a build without an explicit setting follows.
+ *
+ * `stable`, and never inferred from anything else. A default that drifted with
+ * the build (say, dev builds silently on `canary`) would mean a user's update
+ * path depended on how their binary happened to be produced.
+ */
+export const DEFAULT_SKY_CODE_CHANNEL = 'stable';
+/** Env var selecting the channel. Explicit opt-in; never set implicitly. */
+export const SKY_CODE_CHANNEL_ENV = 'OVERSKY_SKY_CODE_CHANNEL';
+/** Manifest filename, under a channel prefix or an immutable release prefix. */
+export const SKY_CODE_MANIFEST_FILE = 'sky-code-version.json';
+export function isSkyCodeChannel(value) {
+    return typeof value === 'string' && SKY_CODE_CHANNELS.includes(value);
+}
+/**
+ * The channel this process should follow.
+ *
+ * An unrecognised value falls back to the default rather than throwing. A
+ * typo'd channel must not brick updates altogether — that turns a harmless
+ * mistake into an un-updatable machine, which is the failure the updater exists
+ * to prevent. The caller is handed `invalid` so it can say so out loud.
+ */
+export function resolveSkyCodeChannel(env = process.env) {
+    const raw = env[SKY_CODE_CHANNEL_ENV]?.trim();
+    if (!raw)
+        return { channel: DEFAULT_SKY_CODE_CHANNEL };
+    if (isSkyCodeChannel(raw))
+        return { channel: raw };
+    return { channel: DEFAULT_SKY_CODE_CHANNEL, invalid: raw };
+}
+/**
+ * Where a channel's signed manifest lives.
+ *
+ * `stable` is NOT special-cased to `latest/`. Two paths that must always agree
+ * is a pair that eventually will not, and the one that disagrees silently is
+ * the one serving production. `latest/` remains for the daemon feed and for
+ * anything already pointing at it; skrr Code channel clients read
+ * `channels/<name>/` uniformly.
+ */
+export function skyCodeChannelPrefix(channel) {
+    return `channels/${channel}/`;
+}
+/**
+ * Manifest URL for a channel, or for a pinned version.
+ *
+ * A pinned version wins over the channel and reads its immutable per-release
+ * copy: pinning means "this exact build", and a channel pointer that moved
+ * underneath would make the pin a suggestion.
+ *
+ * Builds only MANIFEST urls, never artifact ones. `buildManifestMessage` signs
+ * version, minimum, forceUpdate and the per-platform sha256s; `buildArtifactMessage`
+ * signs the artifact URL. Neither signs a channel — so artifact URLs stay
+ * channel-independent and promotion is a COPY OF AN ALREADY-SIGNED OBJECT that
+ * never needs the release key. Put the channel in the artifact URL instead and
+ * every promotion becomes a re-signing ceremony, which decides whether the
+ * ed25519 key has to be reachable from routine automation. A helper here that
+ * adjusted artifact urls would silently reintroduce exactly that coupling.
+ */
+export function resolveChannelManifestUrl(input) {
+    const base = input.base.replace(/\/+$/, '');
+    if (input.pinnedVersion) {
+        return `${base}/releases/${input.pinnedVersion}/${input.manifestFilename}`;
+    }
+    return `${base}/${skyCodeChannelPrefix(input.channel)}${input.manifestFilename}`;
+}
+/** Default public feed. Mirrors the daemon's `updates.oversky.ai/daemon` prefix. */
+export const DEFAULT_SKY_CODE_FEED_BASE = 'https://updates.oversky.ai/sky-code';
+/**
+ * Feed override, read at call time rather than module load so a test or an
+ * operator can repoint it without re-importing.
+ *
+ * Explicit-only: a production user must never be silently enrolled onto a
+ * different feed. Selecting a feed changes WHICH signed manifest is read, never
+ * WHETHER the signature is checked — every artifact is verified against the
+ * pinned keys regardless of where it came from.
+ */
+export const SKY_CODE_FEED_BASE_ENV = 'OVERSKY_SKY_CODE_UPDATE_FEED_BASE';
+export function skyCodeFeedBase(env = process.env) {
+    const override = (env[SKY_CODE_FEED_BASE_ENV] || '').trim();
+    return (override || DEFAULT_SKY_CODE_FEED_BASE).replace(/\/+$/, '');
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {