@skrr-ai/cli 0.1.94 → 0.1.95

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessPermissionControls.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Read-only capability wire for ordinary agent turns. This is NOT a session
+ * authorization request or an effective permission profile. In particular,
+ * an ACP approval callback is not a process sandbox, and access to a loopback
+ * inference broker is not a grant to make arbitrary outbound connections.
+ *
+ * Daemons advertise what their adapters implement; execution still validates
+ * the requested policy independently. Consumers never infer controls from a
+ * provider name, a missing report, or the unified permission-mode vocabulary.
+ */
+export interface HarnessPermissionControls {
+    version: 1;
+    plan: 'harness' | 'reported-actions' | 'unsupported' | 'unknown';
+    approval: 'harness' | 'reported-actions' | 'none' | 'unknown';
+    filesystem: 'harness-sandbox' | 'tool-path-guards' | 'reported-actions' | 'not-restricted-by-daemon' | 'unknown';
+    strictToolPolicy: {
+        modes: readonly ('none' | 'allowlist')[];
+        enforcement: 'harness' | 'negotiated' | 'unsupported' | 'unknown';
+    };
+    organizationToolDenylist: 'unsupported' | 'unknown';
+    networkEgress: 'not-restricted-by-daemon' | 'unknown';
+}
+export interface HarnessPermissionControlReport {
+    controls: HarnessPermissionControls | null;
+    source: 'daemon' | 'daemon_record' | 'unreported';
+}
+/**
+ * Presence/registration metadata is untrusted input. Copy only the v1 enum
+ * vocabulary: unknown future claims and malformed profiles yield no report,
+ * rather than a green badge. Additive fields are stripped for compatibility.
+ */
+export declare function parseHarnessPermissionControls(value: unknown): HarnessPermissionControls | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessPermissionControls.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseHarnessPermissionControls = parseHarnessPermissionControls;
+const PLAN = ['harness', 'reported-actions', 'unsupported', 'unknown'];
+const APPROVAL = ['harness', 'reported-actions', 'none', 'unknown'];
+const FILESYSTEM = [
+    'harness-sandbox',
+    'tool-path-guards',
+    'reported-actions',
+    'not-restricted-by-daemon',
+    'unknown',
+];
+const TOOL_ENFORCEMENT = ['harness', 'negotiated', 'unsupported', 'unknown'];
+/**
+ * Presence/registration metadata is untrusted input. Copy only the v1 enum
+ * vocabulary: unknown future claims and malformed profiles yield no report,
+ * rather than a green badge. Additive fields are stripped for compatibility.
+ */
+function parseHarnessPermissionControls(value) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return null;
+        const row = value;
+        const { version, plan, approval, filesystem, organizationToolDenylist, networkEgress, strictToolPolicy, } = row;
+        const strict = strictToolPolicy;
+        if (!strict || typeof strict !== 'object' || Array.isArray(strict))
+            return null;
+        const strictModes = strict.modes;
+        const enforcement = strict.enforcement;
+        if (version !== 1 ||
+            !PLAN.includes(plan) ||
+            !APPROVAL.includes(approval) ||
+            !FILESYSTEM.includes(filesystem) ||
+            !['unsupported', 'unknown'].includes(organizationToolDenylist) ||
+            !['not-restricted-by-daemon', 'unknown'].includes(networkEgress) ||
+            !TOOL_ENFORCEMENT.includes(enforcement) ||
+            !Array.isArray(strictModes) ||
+            strictModes.length > 2 ||
+            !strictModes.every((mode) => mode === 'none' || mode === 'allowlist'))
+            return null;
+        const modes = [...new Set(strictModes)];
+        if (((enforcement === 'unsupported' || enforcement === 'unknown') && modes.length > 0) ||
+            ((enforcement === 'harness' || enforcement === 'negotiated') && modes.length === 0))
+            return null;
+        return Object.freeze({
+            version: 1,
+            plan: plan,
+            approval: approval,
+            filesystem: filesystem,
+            strictToolPolicy: Object.freeze({
+                modes: Object.freeze(modes),
+                enforcement: enforcement,
+            }),
+            organizationToolDenylist: organizationToolDenylist,
+            networkEgress: networkEgress,
+        });
+    }
+    catch {
+        // Malicious accessors/proxies must not break a read surface.
+        return null;
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -46,3 +46,5 @@ export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
 export { MAX_SIGS, TRUSTED_FEED_ORIGINS, buildArtifactMessage, buildManifestMessage, getDeltaFor, isTrustedArtifactOrigin, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';
 export { PROFILES_SEGMENT, SUPERSEDED_MARKER_SUFFIX, SUPERSEDED_COPY_SUFFIX, profileStateDir, legacyProfileStateDir, resolveProfileStateDir, resolveProfileStateFile, profileStateFileLocations, profileStateFilePathsToClear, consolidateProfileState, type ResolvedProfileStateDir, type ConsolidationSpec, type ConsolidationStatus, type ConsolidationOutcome, } from './profileStateDir.js';
+export * from './harnessPermissionControls.js';
+export { compareReleaseVersions } from './releaseVersions.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -26,7 +26,7 @@ exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__rese
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
 exports.qualifyMachineUuid = exports.getMachineUuidProfile = exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
 exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
+exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -438,3 +438,6 @@ Object.defineProperty(exports, "resolveProfileStateFile", { enumerable: true, ge
 Object.defineProperty(exports, "profileStateFileLocations", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateFileLocations; } });
 Object.defineProperty(exports, "profileStateFilePathsToClear", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateFilePathsToClear; } });
 Object.defineProperty(exports, "consolidateProfileState", { enumerable: true, get: function () { return profileStateDir_js_1.consolidateProfileState; } });
+__exportStar(require("./harnessPermissionControls.js"), exports);
+var releaseVersions_js_1 = require("./releaseVersions.js");
+Object.defineProperty(exports, "compareReleaseVersions", { enumerable: true, get: function () { return releaseVersions_js_1.compareReleaseVersions; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -211,11 +211,14 @@ function setMachineUuidProfile(profile) {
 function getMachineUuidProfile() {
     return activeMachineProfile;
 }
-function readPersistedChoice(file, hardware, profile) {
+function readPersistedChoice(file, hardware, profile, requireProfile = false) {
     try {
         const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
         // A file from another machine (a restored backup, a synced home) is absent.
-        if (parsed?.version !== 1 || parsed.hardware !== hardware)
+        if (parsed?.version !== 1 ||
+            parsed.hardware !== hardware ||
+            (parsed.profile !== undefined && parsed.profile !== profile) ||
+            (requireProfile && parsed.profile !== profile))
             return null;
         // Only the two values this module can produce are accepted: a hand-edited or
         // foreign string must never become an identity.
@@ -228,11 +231,18 @@ function readPersistedChoice(file, hardware, profile) {
         return null;
     }
 }
-function persistChoice(dir, file, hardware, machineUuid, reason) {
+function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
     try {
         node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
         const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
-        const body = { version: 1, hardware, machineUuid, reason, decidedAt: new Date().toISOString() };
+        const body = {
+            version: 1,
+            hardware,
+            machineUuid,
+            profile,
+            reason,
+            decidedAt: new Date().toISOString(),
+        };
         node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
         node_fs_1.default.renameSync(tmp, file);
     }
@@ -241,6 +251,20 @@ function persistChoice(dir, file, hardware, machineUuid, reason) {
         // next process decides again from the same evidence.
     }
 }
+/** A nonsecret recovery copy survives product uninstall. Each profile has its
+ * own file, so concurrent profiles never overwrite a shared identity map. A
+ * copied home cannot adopt another machine's value: the hardware is verified
+ * and only this module's hardware/qualified values are admitted. */
+function recoveryChoicePath(profile) {
+    const name = node_crypto_1.default.createHash('sha256').update(profile).digest('hex');
+    return node_path_1.default.join(node_os_1.default.homedir(), '.local', 'state', 'skrr', 'machine-identities', `${name}.json`);
+}
+function preserveRecoveryChoice(profile, hardware, machineUuid) {
+    const file = recoveryChoicePath(profile);
+    if (readPersistedChoice(file, hardware, profile, true) === machineUuid)
+        return;
+    persistChoice(node_path_1.default.dirname(file), file, hardware, machineUuid, 'restored_profile', profile);
+}
 /** The identity a NON-default profile registers under. Never throws. */
 function resolveProfileMachineUuid(profile, hardware) {
     const cacheKey = `${hardware}\u0000${profile}`;
@@ -250,6 +274,11 @@ function resolveProfileMachineUuid(profile, hardware) {
     const dir = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile);
     const file = node_path_1.default.join(dir, exports.MACHINE_IDENTITY_FILENAME);
     let chosen = readPersistedChoice(file, hardware, profile);
+    if (!chosen) {
+        chosen = readPersistedChoice(recoveryChoicePath(profile), hardware, profile, true);
+        if (chosen)
+            persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
+    }
     if (!chosen) {
         const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
             try {
@@ -260,8 +289,9 @@ function resolveProfileMachineUuid(profile, hardware) {
             }
         });
         chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile');
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile);
     }
+    preserveRecoveryChoice(profile, hardware, chosen);
     profileChoiceCache.set(cacheKey, chosen);
     return chosen;
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releasePolicy.d.ts

@@ -0,0 +1,63 @@
+import { type ReleaseKey } from './releaseKeys.js';
+export type ReleaseChannel = 'stable' | 'canary' | 'beta' | 'internal';
+export interface ContractRange {
+    minimum: number;
+    maximum: number;
+}
+export interface ComponentReleasePolicy {
+    version: string;
+    minimumVersion?: string;
+    contracts?: Record<string, ContractRange>;
+}
+export interface ReleasePolicySignature {
+    keyId: string;
+    sig: string;
+}
+export interface SignedReleasePolicy {
+    schemaVersion: 1;
+    releaseId: string;
+    issuedAt: string;
+    expiresAt: string;
+    channel: ReleaseChannel;
+    /** Percentage in basis points (0–10000), avoiding floating-point policy. */
+    rolloutBasisPoints: number;
+    cohortSeed: string;
+    components: Record<string, ComponentReleasePolicy>;
+    keyId: string;
+    sig: string;
+    sigs?: ReleasePolicySignature[];
+}
+export type PolicyVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+} | {
+    disabled: true;
+};
+export interface ReleasePolicyAssessment {
+    valid: boolean;
+    eligible: boolean;
+    reason?: string;
+}
+/** Canonical, versioned signature message. Never sign JSON.stringify directly. */
+export declare function buildReleasePolicyMessage(policy: Omit<SignedReleasePolicy, 'sig' | 'sigs'>): string;
+export declare function verifyReleasePolicy(policy: SignedReleasePolicy, keys?: readonly ReleaseKey[]): PolicyVerifyResult;
+export declare function isReleasePolicyCohortEligible(policy: SignedReleasePolicy, subject: string): boolean;
+/**
+ * Verify expiry, daemon target binding, contract ranges, channel, and cohort.
+ * `autonomous=false` intentionally bypasses cohort gating: an operator who
+ * explicitly runs an update may recover a machine outside the staged cohort,
+ * but cannot bypass invalid signatures, an expired policy, or incompatibility.
+ */
+export declare function assessReleasePolicy(args: {
+    policy: SignedReleasePolicy;
+    targetDaemonVersion: string;
+    /** Defaults to daemon for backwards-compatible daemon policy assessment. */
+    targetComponent?: string;
+    channel: ReleaseChannel;
+    contracts: Record<string, number>;
+    cohortSubject: string;
+    autonomous: boolean;
+    now?: Date;
+}): ReleasePolicyAssessment;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releasePolicy.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReleasePolicyMessage = buildReleasePolicyMessage;
+exports.verifyReleasePolicy = verifyReleasePolicy;
+exports.isReleasePolicyCohortEligible = isReleasePolicyCohortEligible;
+exports.assessReleasePolicy = assessReleasePolicy;
+/**
+ * Signed multi-component release policy.
+ *
+ * The daemon artifact manifest authenticates a daemon binary. This envelope
+ * authenticates the *decision* to offer that binary to a cohort, and records
+ * the component contract that makes a CLI/daemon/desktop combination safe.
+ * It is separately signed so it can be added to a v1 artifact manifest without
+ * changing the legacy manifest signature bytes or blocking old daemons.
+ */
+const node_crypto_1 = require("node:crypto");
+const releaseKeys_js_1 = require("./releaseKeys.js");
+const MAX_SIGS = 8;
+function stableJson(value) {
+    if (value === null ||
+        typeof value === 'boolean' ||
+        typeof value === 'number' ||
+        typeof value === 'string') {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (!value || typeof value !== 'object')
+        throw new Error('policy contains an unsupported value');
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`)
+        .join(',')}}`;
+}
+/** Canonical, versioned signature message. Never sign JSON.stringify directly. */
+function buildReleasePolicyMessage(policy) {
+    return ['oversky-release-policy', 'v1', stableJson(policy)].join('\n');
+}
+function verifyOne(message, signature, keys) {
+    if (keys.length === 0)
+        return { disabled: true };
+    if (!signature)
+        return { ok: false, reason: 'missing signature' };
+    const messageBytes = Buffer.from(message, 'utf8');
+    const signatureBytes = Buffer.from(signature, 'base64');
+    for (const keySpec of keys) {
+        try {
+            const key = (0, node_crypto_1.createPublicKey)({
+                key: Buffer.from(keySpec.publicKeySpkiB64, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+            if ((0, node_crypto_1.verify)(null, messageBytes, key, signatureBytes))
+                return { ok: true };
+        }
+        catch {
+            /* malformed signatures and keys are a verification failure */
+        }
+    }
+    return { ok: false, reason: 'signature did not verify against any pinned key' };
+}
+function policyShapeIsValid(policy) {
+    if (!policy ||
+        typeof policy !== 'object' ||
+        policy.schemaVersion !== 1 ||
+        !/^[0-9A-Za-z._:-]+$/.test(policy.releaseId) ||
+        !['stable', 'canary', 'beta', 'internal'].includes(policy.channel) ||
+        !Number.isInteger(policy.rolloutBasisPoints) ||
+        policy.rolloutBasisPoints < 0 ||
+        policy.rolloutBasisPoints > 10_000 ||
+        typeof policy.cohortSeed !== 'string' ||
+        policy.cohortSeed.length < 8 ||
+        !policy.components ||
+        typeof policy.components !== 'object' ||
+        Array.isArray(policy.components)) {
+        return false;
+    }
+    const issued = Date.parse(policy.issuedAt);
+    const expires = Date.parse(policy.expiresAt);
+    if (!Number.isFinite(issued) || !Number.isFinite(expires) || expires <= issued)
+        return false;
+    return Object.values(policy.components).every((component) => component &&
+        typeof component === 'object' &&
+        !Array.isArray(component) &&
+        (!component.contracts ||
+            (typeof component.contracts === 'object' && !Array.isArray(component.contracts))) &&
+        typeof component.version === 'string' &&
+        component.version.length > 0 &&
+        Object.values(component.contracts ?? {}).every((range) => range &&
+            typeof range === 'object' &&
+            !Array.isArray(range) &&
+            Number.isInteger(range.minimum) &&
+            Number.isInteger(range.maximum) &&
+            range.minimum >= 0 &&
+            range.maximum >= range.minimum));
+}
+function verifyReleasePolicy(policy, keys = releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS) {
+    if (!policyShapeIsValid(policy))
+        return { ok: false, reason: 'invalid release-policy shape' };
+    const { sig, sigs, ...unsigned } = policy;
+    const message = buildReleasePolicyMessage(unsigned);
+    if (Array.isArray(sigs) && sigs.length > 0) {
+        if (keys.length === 0)
+            return { disabled: true };
+        for (const entry of sigs.slice(0, MAX_SIGS)) {
+            if (!entry || typeof entry.sig !== 'string')
+                continue;
+            const verdict = verifyOne(message, entry.sig, keys);
+            if ('ok' in verdict && verdict.ok)
+                return verdict;
+        }
+        return { ok: false, reason: 'no policy multi-signature verified against a pinned key' };
+    }
+    return verifyOne(message, sig, keys);
+}
+function isReleasePolicyCohortEligible(policy, subject) {
+    if (!subject || policy.rolloutBasisPoints === 0)
+        return false;
+    if (policy.rolloutBasisPoints === 10_000)
+        return true;
+    const bucket = (0, node_crypto_1.createHash)('sha256')
+        .update(`${policy.releaseId}\n${policy.cohortSeed}\n${subject}`, 'utf8')
+        .digest()
+        .readUInt32BE(0) % 10_000;
+    return bucket < policy.rolloutBasisPoints;
+}
+/**
+ * Verify expiry, daemon target binding, contract ranges, channel, and cohort.
+ * `autonomous=false` intentionally bypasses cohort gating: an operator who
+ * explicitly runs an update may recover a machine outside the staged cohort,
+ * but cannot bypass invalid signatures, an expired policy, or incompatibility.
+ */
+function assessReleasePolicy(args) {
+    const now = args.now ?? new Date();
+    if (Date.parse(args.policy.expiresAt) <= now.getTime()) {
+        return { valid: false, eligible: false, reason: `policy expired at ${args.policy.expiresAt}` };
+    }
+    if (args.policy.channel !== args.channel) {
+        return {
+            valid: false,
+            eligible: false,
+            reason: `policy channel ${args.policy.channel} does not match ${args.channel}`,
+        };
+    }
+    const componentName = args.targetComponent ?? 'daemon';
+    const daemon = args.policy.components[componentName];
+    if (!daemon || daemon.version !== args.targetDaemonVersion) {
+        return {
+            valid: false,
+            eligible: false,
+            reason: `policy ${componentName} component does not bind the target artifact version`,
+        };
+    }
+    for (const [name, range] of Object.entries(daemon.contracts ?? {})) {
+        const actual = args.contracts[name];
+        if (!Number.isInteger(actual) || actual < range.minimum || actual > range.maximum) {
+            return {
+                valid: false,
+                eligible: false,
+                reason: `local contract ${name}=${String(actual)} is outside policy range ${range.minimum}..${range.maximum}`,
+            };
+        }
+    }
+    const eligible = !args.autonomous || isReleasePolicyCohortEligible(args.policy, args.cohortSubject);
+    return eligible
+        ? { valid: true, eligible: true }
+        : { valid: true, eligible: false, reason: 'machine is outside rollout cohort' };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseVersions.d.ts

@@ -0,0 +1,2 @@
+/** SemVer precedence shared by every local release consumer. Invalid inputs are never ordered. */
+export declare function compareReleaseVersions(a: string, b: string): -1 | 0 | 1 | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseVersions.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareReleaseVersions = compareReleaseVersions;
+/** SemVer precedence shared by every local release consumer. Invalid inputs are never ordered. */
+function compareReleaseVersions(a, b) {
+    const parse = (value) => {
+        if (typeof value !== 'string')
+            return null;
+        const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value.trim());
+        if (!match)
+            return null;
+        const prerelease = match[4]?.split('.') ?? [];
+        if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part[0] === '0'))
+            return null;
+        return { core: match.slice(1, 4).map(BigInt), prerelease };
+    };
+    const left = parse(a);
+    const right = parse(b);
+    if (!left || !right)
+        return null;
+    for (let i = 0; i < 3; i++) {
+        if (left.core[i] !== right.core[i])
+            return left.core[i] < right.core[i] ? -1 : 1;
+    }
+    if (!left.prerelease.length || !right.prerelease.length) {
+        return left.prerelease.length === right.prerelease.length ? 0 : left.prerelease.length ? -1 : 1;
+    }
+    for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
+        const l = left.prerelease[i];
+        const r = right.prerelease[i];
+        if (l === undefined || r === undefined)
+            return l === r ? 0 : l === undefined ? -1 : 1;
+        if (l === r)
+            continue;
+        const ln = /^\d+$/.test(l);
+        const rn = /^\d+$/.test(r);
+        if (ln && rn)
+            return BigInt(l) < BigInt(r) ? -1 : 1;
+        if (ln !== rn)
+            return ln ? -1 : 1;
+        return l < r ? -1 : 1;
+    }
+    return 0;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessChannels.d.ts

@@ -18,10 +18,9 @@
  * quietly redeclaring. This follows that road rather than reopening the one it
  * replaced.
  *
- * Only the VOCABULARY lives here — channel names, the env var, the default, the
- * URL shape and the feed candidates. The installer, the signature verification
- * and the promotion machinery stay in the daemon, which is the only process that
- * performs them.
+ * Channel vocabulary stays here. The shared signed installer lives beside it
+ * in firstPartyHarnessUpdater.ts, used by CLI, Daemon and Desktop so updating
+ * a local engine needs neither a running daemon nor an account.
  *
  * Every product-named value comes from `firstPartyHarness.ts`; nothing in this
  * file spells the product.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessChannels.js

@@ -18,10 +18,9 @@
  * quietly redeclaring. This follows that road rather than reopening the one it
  * replaced.
  *
- * Only the VOCABULARY lives here — channel names, the env var, the default, the
- * URL shape and the feed candidates. The installer, the signature verification
- * and the promotion machinery stay in the daemon, which is the only process that
- * performs them.
+ * Channel vocabulary stays here. The shared signed installer lives beside it
+ * in firstPartyHarnessUpdater.ts, used by CLI, Daemon and Desktop so updating
+ * a local engine needs neither a running daemon nor an account.
  *
  * Every product-named value comes from `firstPartyHarness.ts`; nothing in this
  * file spells the product.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessReleaseKeys.d.ts

@@ -0,0 +1,82 @@
+/**
+ * WL-6.8 — ed25519 public keys that vouch for a **first-party harness binary**.
+ *
+ * ── Why this is not `daemon/src/release-keys.ts` ───────────────────────────
+ *
+ * `verifyHarnessProvenance` originally defaulted to the daemon's own
+ * self-update keys. That is convenient and wrong. Those two keys answer
+ * different questions and protect different things:
+ *
+ *   `OVERSKY_RELEASE_PUBLIC_KEYS`  — "may this binary REPLACE the daemon?"
+ *   `FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS` — "may this binary receive a
+ *                                              platform credential?"
+ *
+ * Sharing one key means a compromise of the harness signing identity is also a
+ * forged-daemon-self-update primitive: an attacker who can sign a harness can
+ * sign a manifest that the daemon installs over itself. That is a strictly
+ * larger blast radius than the harness key needs to carry, and it is
+ * unnecessary — the two artifacts have different release cadences and
+ * different publishers, so they were always going to want independent
+ * rotation.
+ *
+ * Separating them costs one more secret to provision and removes an
+ * escalation path. That trade is not close.
+ *
+ * ── Fail-closed, and in the direction that matters ─────────────────────────
+ *
+ * EMPTY means provenance can never be established. Until 2026-08-11 that also
+ * meant the first-party harness was held at Tier 2 on a scoped gateway token; that
+ * floor has since been removed, and it is DECLARED Tier 1, so an empty list no
+ * longer withholds the credential privilege from it. What an empty list still
+ * costs is the ability to say WHICH BYTES held the credential — the verdict
+ * becomes `unverifiable`, and the record is silent about the binary on disk.
+ *
+ * The fail-closed direction below still governs every OTHER
+ * OverSky-distributed harness, and remains the correct posture for this one if
+ * the floor is ever restored.
+ *
+ * Note this is the OPPOSITE posture to the daemon's own `../release-keys.ts`
+ * (same basename, different module), deliberately. There,
+ * an empty list disables verification and the updater proceeds, because a fleet
+ * that cannot update is its own outage. Here, an empty list withholds a
+ * privilege, because absence of evidence must never grant one. Getting these
+ * two backwards would mean provisioning a key *reduces* what the daemon trusts.
+ *
+ * ── Provisioning ──────────────────────────────────────────────────────────
+ *
+ *   1. Mint:   node scripts/first-party-harness/generate-signing-key.mjs   (in the fork)
+ *   2. Store the PRIVATE half as the GH Actions secret
+ *      `FIRST_PARTY_HARNESS_ENV.signingKey.name` (the only name the publish
+ *      workflow reads) + AWS Secrets Manager. It must never be committed and
+ *      never leave CI.
+ *   3. Paste the PUBLIC half below, newest first.
+ *   4. Ship a daemon build carrying it BEFORE the first signed harness
+ *      release, so the fleet can verify what it is about to be handed.
+ *
+ * Rotation is the same shape as the daemon's: add the next key ABOVE the
+ * current one, ship that build, then start dual-signing. Verification accepts
+ * any pinned key, so an overlap window has no gap.
+ */
+import type { ReleaseKey } from './releaseKeys.js';
+export type { ReleaseKey };
+/**
+ * Pinned first-party harness signing public keys, newest first.
+ *
+ * Provisioned 2026-08-07 (WL-6.8). The private half lives in the GitHub secret
+ * named by `FIRST_PARTY_HARNESS_ENV.signingKey` and in AWS Secrets Manager — a
+ * HARNESS key, deliberately a different trust domain from the daemon
+ * self-update key in `../release-keys.ts`.
+ *
+ * ── Two literals that must NOT follow a rename (contract §6) ────────────────
+ * The `keyId` below and the AWS secret path `oversky/sky-code/signing-key` are
+ * historical identifiers, not the product name. A key id is inside every
+ * signature ever issued and every provenance sidecar ever written, so changing
+ * it would make every existing release unverifiable; the secret is stateful
+ * infrastructure. Both move only at the next key ROTATION.
+ *
+ * ORDER OF OPERATIONS, and it only works one way round: this pinned build must
+ * SHIP before any harness release is signed. Backwards, the fleet receives an
+ * artifact it cannot verify and every daemon reports `invalid-signature` —
+ * which from the outside is indistinguishable from a real attack.
+ */
+export declare const FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS: ReleaseKey[];