@skrr-ai/cli 0.1.94 → 0.1.96

package/dist/lib/usage-discovery.d.ts

@@ -23,6 +23,14 @@ import type { CommandManifest } from './command-manifest';
  * only then whether the bound is still the right size.
  */
 export declare const USAGE_OVERVIEW_TOKEN_BUDGET = 240;
+/**
+ * Topics listed under another domain instead of as their own overview line.
+ * Every command keeps its own id (`skrr proposals list`); only the discovery
+ * grouping changes, and `skrr usage <folded>` resolves to the host page, which
+ * names the folded topic in an `Includes:` line so it stays reachable.
+ * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ */
+export declare const USAGE_DOMAIN_FOLDS: Readonly<Record<string, string>>;
 export declare const USAGE_DOMAIN_TOKEN_BUDGET = 500;
 export type UsageCommand = {
     command: string;
@@ -46,6 +54,8 @@ export type UsageReference = {
     object: 'sky_usage_reference';
     generatedFrom: 'oclif.manifest.json';
     domain: string;
+    /** Topics folded into this domain (see `USAGE_DOMAIN_FOLDS`). */
+    includes?: string[];
     tokenBudget: number;
     estimatedTokens: number;
     page: number;

package/dist/lib/usage-discovery.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.USAGE_DOMAIN_TOKEN_BUDGET = exports.USAGE_OVERVIEW_TOKEN_BUDGET = void 0;
+exports.USAGE_DOMAIN_TOKEN_BUDGET = exports.USAGE_DOMAIN_FOLDS = exports.USAGE_OVERVIEW_TOKEN_BUDGET = void 0;
 exports.estimateUsageTokens = estimateUsageTokens;
 exports.usageDomains = usageDomains;
 exports.buildUsageOverview = buildUsageOverview;
@@ -34,6 +34,14 @@ const command_manifest_1 = require("./command-manifest");
  * only then whether the bound is still the right size.
  */
 exports.USAGE_OVERVIEW_TOKEN_BUDGET = 240;
+/**
+ * Topics listed under another domain instead of as their own overview line.
+ * Every command keeps its own id (`skrr proposals list`); only the discovery
+ * grouping changes, and `skrr usage <folded>` resolves to the host page, which
+ * names the folded topic in an `Includes:` line so it stays reachable.
+ * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ */
+exports.USAGE_DOMAIN_FOLDS = { proposals: 'inbox' };
 exports.USAGE_DOMAIN_TOKEN_BUDGET = 500;
 const GENERIC_FLAGS = new Set(['bare', 'help', 'json', 'token', 'workspace']);
 /**
@@ -74,7 +82,8 @@ function buildUsageOverview(manifest, bin = 'skrr') {
 }
 /** Return case-insensitive manifest domain names without inventing aliases. */
 function resolveUsageDomain(manifest, value) {
-    const needle = value.trim().toLowerCase();
+    const trimmed = value.trim().toLowerCase();
+    const needle = exports.USAGE_DOMAIN_FOLDS[trimmed] ?? trimmed;
     return usageDomains(manifest).find(({ domain }) => domain.toLowerCase() === needle)?.domain;
 }
 /**
@@ -95,10 +104,12 @@ function buildUsageReference(manifest, domainInput, options = {}) {
     if (!Number.isInteger(requested) || index < 0 || index >= pages.length)
         return undefined;
     const data = pages[index];
+    const includes = foldedTopics(manifest, domain);
     const draft = {
         object: 'sky_usage_reference',
         generatedFrom: 'oclif.manifest.json',
         domain,
+        ...(includes.length > 0 ? { includes } : {}),
         tokenBudget: exports.USAGE_DOMAIN_TOKEN_BUDGET,
         estimatedTokens: 0,
         page: requested,
@@ -122,6 +133,8 @@ function renderUsageReference(reference, bin = 'skrr') {
         `${reference.domain} commands — page ${reference.page}/${reference.pages} ` +
             `(${reference.commandCount} total; manifest-derived).`,
     ];
+    if (reference.includes?.length)
+        lines.push(`Includes: ${reference.includes.join(', ')}.`);
     for (const command of reference.data) {
         const flags = command.keyFlags.length > 0 ? ` Flags: ${command.keyFlags.join(', ')}.` : '';
         lines.push(`${bin} ${command.command} — ${command.description}.${flags} Example: ${command.example}`);
@@ -167,13 +180,21 @@ function auditUsageBudgets(manifest, bin = 'skrr') {
 function groupEntries(manifest) {
     const grouped = new Map();
     for (const entry of (0, command_manifest_1.visibleCommandEntries)(manifest)) {
-        const domain = entry.id.split(':')[0];
+        const topic = entry.id.split(':')[0];
+        const domain = exports.USAGE_DOMAIN_FOLDS[topic] ?? topic;
         const existing = grouped.get(domain) ?? [];
         existing.push(entry);
         grouped.set(domain, existing);
     }
     return grouped;
 }
+function foldedTopics(manifest, domain) {
+    const present = new Set((0, command_manifest_1.visibleCommandEntries)(manifest).map((entry) => entry.id.split(':')[0]));
+    return Object.entries(exports.USAGE_DOMAIN_FOLDS)
+        .filter(([topic, host]) => host === domain && present.has(topic))
+        .map(([topic]) => topic)
+        .sort();
+}
 function usageCommand(entry, bin) {
     const flags = Object.entries(entry.flags)
         .filter(([, value]) => !value.hidden)

package/dist/lib/workflow-run-budget.d.ts

@@ -0,0 +1,12 @@
+type RunLike = Record<string, unknown>;
+/**
+ * Human lines for a run's duration budget and for a run the budget stopped.
+ *
+ * The server derives `budget` per read and stamps `error.code =
+ * WORKFLOW_RUN_DEADLINE` on a run it cancelled; this only words them. A run with
+ * neither prints nothing: no budget is not "0 minutes left".
+ */
+export declare function describeRunBudget(run: RunLike): string[];
+/** The status cell, naming a time-limit stop where the plain status would hide it. */
+export declare function runStatusLabel(run: RunLike): string;
+export {};

package/dist/lib/workflow-run-budget.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeRunBudget = describeRunBudget;
+exports.runStatusLabel = runStatusLabel;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Human lines for a run's duration budget and for a run the budget stopped.
+ *
+ * The server derives `budget` per read and stamps `error.code =
+ * WORKFLOW_RUN_DEADLINE` on a run it cancelled; this only words them. A run with
+ * neither prints nothing: no budget is not "0 minutes left".
+ */
+function describeRunBudget(run) {
+    const lines = [];
+    const error = run.error;
+    if (error?.code === data_provider_1.WORKFLOW_RUN_DEADLINE) {
+        lines.push(`Stopped: ${error.code}${error.message ? ` - ${error.message}` : ''}`);
+    }
+    const budget = run.budget;
+    if (budget && Number.isFinite(budget.maxDurationMs)) {
+        const limit = (0, data_provider_1.describeWorkflowDuration)(budget.maxDurationMs);
+        if (budget.exceeded)
+            lines.push(`Time limit: ${limit}, exceeded (deadline ${budget.deadlineAt})`);
+        else if (budget.remainingMs > 0)
+            lines.push(`Time limit: ${limit}, ${(0, data_provider_1.describeWorkflowDuration)(budget.remainingMs)} left (deadline ${budget.deadlineAt})`);
+        else
+            lines.push(`Time limit: ${limit} (deadline ${budget.deadlineAt})`);
+    }
+    return lines;
+}
+/** The status cell, naming a time-limit stop where the plain status would hide it. */
+function runStatusLabel(run) {
+    const status = String(run.status ?? '-');
+    return run.error?.code === data_provider_1.WORKFLOW_RUN_DEADLINE
+        ? `${status} (time limit)`
+        : status;
+}

package/dist/lib/workspaces.d.ts

@@ -1,3 +1,51 @@
+import type { GrantPublic } from '@skrr-ai/data-schemas';
+export interface StewardshipSource {
+    name: string;
+    status: 'available' | 'unavailable';
+    truncated: boolean;
+    code?: string;
+}
+export interface StewardshipCoverage {
+    complete: boolean;
+    truncated: boolean;
+    sources: StewardshipSource[];
+}
+export type WorkspaceGrantMetadata = Omit<GrantPublic, 'credential' | 'createdAt' | 'updatedAt'> & {
+    ownerUserId: string;
+    credential: (NonNullable<GrantPublic['credential']> & {
+        fingerprint?: string;
+    }) | null;
+    createdAt?: string;
+    updatedAt?: string;
+    referencedBy: string[] | null;
+    referencesTruncated: boolean;
+};
+export interface WorkspaceGrantReport {
+    workspaceId: string;
+    grants: WorkspaceGrantMetadata[] | null;
+    coverage: StewardshipCoverage;
+}
+export interface StewardshipCommitmentMetadata {
+    id: string;
+    title?: string;
+    status?: string;
+    agentId?: string;
+}
+export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
+    memberUserId: string;
+    membership: {
+        status: 'active' | 'absent' | 'unavailable';
+        role?: string;
+    };
+    commitments: StewardshipCommitmentMetadata[] | null;
+    approverSeats: StewardshipCommitmentMetadata[] | null;
+    agents: Array<{
+        id: string;
+        name?: string;
+    }> | null;
+}
+export declare function getWorkspaceStewardship(workspaceId: string, memberUserId: string): Promise<WorkspaceStewardshipReport>;
+export declare function listWorkspaceGrants(workspaceId: string): Promise<WorkspaceGrantReport>;
 /**
  * The workspaces this account belongs to.
  *

package/dist/lib/workspaces.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkspaceStewardship = getWorkspaceStewardship;
+exports.listWorkspaceGrants = listWorkspaceGrants;
 exports.describeUnselectedWorkspace = describeUnselectedWorkspace;
 exports.listWorkspaces = listWorkspaces;
 exports.ambientWorkspaceId = ambientWorkspaceId;
@@ -10,6 +12,12 @@ exports.getWorkspace = getWorkspace;
 exports.matchWorkspace = matchWorkspace;
 const api_fetch_1 = require("./api-fetch");
 const triggers_1 = require("./triggers");
+async function getWorkspaceStewardship(workspaceId, memberUserId) {
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/members/${encodeURIComponent(memberUserId)}`);
+}
+async function listWorkspaceGrants(workspaceId) {
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/grants`);
+}
 /**
  * The server's workspace document can include presentation metadata such as an
  * avatar source. This CLI surface is a selector, not a workspace export: keep

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -129,3 +129,7 @@ export interface CliHandoffDpopProofResponse {
     proof: string;
 }
 export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;
+/** Persisted credential families; deployed values must not change. */
+export declare const DELEGATED_AGENT_CLI_ID_PREFIX = "oversky-daemon-agent-cli-";
+export declare const WORKLOAD_CLI_ID_PREFIX = "oversky-daemon-workload-cli-";
+export declare function classifyCliFamilyId(id: unknown): 'agent' | 'workload' | 'person';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -18,7 +18,7 @@
  * must produce the full shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
+exports.WORKLOAD_CLI_ID_PREFIX = exports.DELEGATED_AGENT_CLI_ID_PREFIX = exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
 exports.parseCliHandoffDescriptor = parseCliHandoffDescriptor;
 exports.normalizeHandoffModes = normalizeHandoffModes;
 exports.advertisedHandoffModes = advertisedHandoffModes;
@@ -26,6 +26,7 @@ exports.descriptorOffersAccessToken = descriptorOffersAccessToken;
 exports.descriptorOffersDpop = descriptorOffersDpop;
 exports.parseCliHandoffTokenResponse = parseCliHandoffTokenResponse;
 exports.parseCliHandoffDpopProofResponse = parseCliHandoffDpopProofResponse;
+exports.classifyCliFamilyId = classifyCliFamilyId;
 /**
  * What a caller may redeem the descriptor secret for.
  *  - `refresh_family`: the legacy durable mint (90-day cli-scope family).
@@ -143,3 +144,15 @@ function parseCliHandoffDpopProofResponse(value) {
         return null;
     return { proof: v.proof };
 }
+/** Persisted credential families; deployed values must not change. */
+exports.DELEGATED_AGENT_CLI_ID_PREFIX = 'oversky-daemon-agent-cli-';
+exports.WORKLOAD_CLI_ID_PREFIX = 'oversky-daemon-workload-cli-';
+function classifyCliFamilyId(id) {
+    if (typeof id !== 'string')
+        return 'person';
+    if (id.startsWith(exports.DELEGATED_AGENT_CLI_ID_PREFIX))
+        return 'agent';
+    if (id.startsWith(exports.WORKLOAD_CLI_ID_PREFIX))
+        return 'workload';
+    return 'person';
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessChannels.d.ts

@@ -18,10 +18,9 @@
  * quietly redeclaring. This follows that road rather than reopening the one it
  * replaced.
  *
- * Only the VOCABULARY lives here — channel names, the env var, the default, the
- * URL shape and the feed candidates. The installer, the signature verification
- * and the promotion machinery stay in the daemon, which is the only process that
- * performs them.
+ * Channel vocabulary stays here. The shared signed installer lives beside it
+ * in firstPartyHarnessUpdater.ts, used by CLI, Daemon and Desktop so updating
+ * a local engine needs neither a running daemon nor an account.
  *
  * Every product-named value comes from `firstPartyHarness.ts`; nothing in this
  * file spells the product.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessChannels.js

@@ -19,10 +19,9 @@
  * quietly redeclaring. This follows that road rather than reopening the one it
  * replaced.
  *
- * Only the VOCABULARY lives here — channel names, the env var, the default, the
- * URL shape and the feed candidates. The installer, the signature verification
- * and the promotion machinery stay in the daemon, which is the only process that
- * performs them.
+ * Channel vocabulary stays here. The shared signed installer lives beside it
+ * in firstPartyHarnessUpdater.ts, used by CLI, Daemon and Desktop so updating
+ * a local engine needs neither a running daemon nor an account.
  *
  * Every product-named value comes from `firstPartyHarness.ts`; nothing in this
  * file spells the product.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessReleaseKeys.d.ts

@@ -0,0 +1,82 @@
+/**
+ * WL-6.8 — ed25519 public keys that vouch for a **first-party harness binary**.
+ *
+ * ── Why this is not `daemon/src/release-keys.ts` ───────────────────────────
+ *
+ * `verifyHarnessProvenance` originally defaulted to the daemon's own
+ * self-update keys. That is convenient and wrong. Those two keys answer
+ * different questions and protect different things:
+ *
+ *   `OVERSKY_RELEASE_PUBLIC_KEYS`  — "may this binary REPLACE the daemon?"
+ *   `FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS` — "may this binary receive a
+ *                                              platform credential?"
+ *
+ * Sharing one key means a compromise of the harness signing identity is also a
+ * forged-daemon-self-update primitive: an attacker who can sign a harness can
+ * sign a manifest that the daemon installs over itself. That is a strictly
+ * larger blast radius than the harness key needs to carry, and it is
+ * unnecessary — the two artifacts have different release cadences and
+ * different publishers, so they were always going to want independent
+ * rotation.
+ *
+ * Separating them costs one more secret to provision and removes an
+ * escalation path. That trade is not close.
+ *
+ * ── Fail-closed, and in the direction that matters ─────────────────────────
+ *
+ * EMPTY means provenance can never be established. Until 2026-08-11 that also
+ * meant the first-party harness was held at Tier 2 on a scoped gateway token; that
+ * floor has since been removed, and it is DECLARED Tier 1, so an empty list no
+ * longer withholds the credential privilege from it. What an empty list still
+ * costs is the ability to say WHICH BYTES held the credential — the verdict
+ * becomes `unverifiable`, and the record is silent about the binary on disk.
+ *
+ * The fail-closed direction below still governs every OTHER
+ * OverSky-distributed harness, and remains the correct posture for this one if
+ * the floor is ever restored.
+ *
+ * Note this is the OPPOSITE posture to the daemon's own `../release-keys.ts`
+ * (same basename, different module), deliberately. There,
+ * an empty list disables verification and the updater proceeds, because a fleet
+ * that cannot update is its own outage. Here, an empty list withholds a
+ * privilege, because absence of evidence must never grant one. Getting these
+ * two backwards would mean provisioning a key *reduces* what the daemon trusts.
+ *
+ * ── Provisioning ──────────────────────────────────────────────────────────
+ *
+ *   1. Mint:   node scripts/first-party-harness/generate-signing-key.mjs   (in the fork)
+ *   2. Store the PRIVATE half as the GH Actions secret
+ *      `FIRST_PARTY_HARNESS_ENV.signingKey.name` (the only name the publish
+ *      workflow reads) + AWS Secrets Manager. It must never be committed and
+ *      never leave CI.
+ *   3. Paste the PUBLIC half below, newest first.
+ *   4. Ship a daemon build carrying it BEFORE the first signed harness
+ *      release, so the fleet can verify what it is about to be handed.
+ *
+ * Rotation is the same shape as the daemon's: add the next key ABOVE the
+ * current one, ship that build, then start dual-signing. Verification accepts
+ * any pinned key, so an overlap window has no gap.
+ */
+import type { ReleaseKey } from './releaseKeys.js';
+export type { ReleaseKey };
+/**
+ * Pinned first-party harness signing public keys, newest first.
+ *
+ * Provisioned 2026-08-07 (WL-6.8). The private half lives in the GitHub secret
+ * named by `FIRST_PARTY_HARNESS_ENV.signingKey` and in AWS Secrets Manager — a
+ * HARNESS key, deliberately a different trust domain from the daemon
+ * self-update key in `../release-keys.ts`.
+ *
+ * ── Two literals that must NOT follow a rename (contract §6) ────────────────
+ * The `keyId` below and the AWS secret path `oversky/sky-code/signing-key` are
+ * historical identifiers, not the product name. A key id is inside every
+ * signature ever issued and every provenance sidecar ever written, so changing
+ * it would make every existing release unverifiable; the secret is stateful
+ * infrastructure. Both move only at the next key ROTATION.
+ *
+ * ORDER OF OPERATIONS, and it only works one way round: this pinned build must
+ * SHIP before any harness release is signed. Backwards, the fleet receives an
+ * artifact it cannot verify and every daemon reports `invalid-signature` —
+ * which from the outside is indistinguishable from a real attack.
+ */
+export declare const FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS: ReleaseKey[];

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessReleaseKeys.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * WL-6.8 — ed25519 public keys that vouch for a **first-party harness binary**.
+ *
+ * ── Why this is not `daemon/src/release-keys.ts` ───────────────────────────
+ *
+ * `verifyHarnessProvenance` originally defaulted to the daemon's own
+ * self-update keys. That is convenient and wrong. Those two keys answer
+ * different questions and protect different things:
+ *
+ *   `OVERSKY_RELEASE_PUBLIC_KEYS`  — "may this binary REPLACE the daemon?"
+ *   `FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS` — "may this binary receive a
+ *                                              platform credential?"
+ *
+ * Sharing one key means a compromise of the harness signing identity is also a
+ * forged-daemon-self-update primitive: an attacker who can sign a harness can
+ * sign a manifest that the daemon installs over itself. That is a strictly
+ * larger blast radius than the harness key needs to carry, and it is
+ * unnecessary — the two artifacts have different release cadences and
+ * different publishers, so they were always going to want independent
+ * rotation.
+ *
+ * Separating them costs one more secret to provision and removes an
+ * escalation path. That trade is not close.
+ *
+ * ── Fail-closed, and in the direction that matters ─────────────────────────
+ *
+ * EMPTY means provenance can never be established. Until 2026-08-11 that also
+ * meant the first-party harness was held at Tier 2 on a scoped gateway token; that
+ * floor has since been removed, and it is DECLARED Tier 1, so an empty list no
+ * longer withholds the credential privilege from it. What an empty list still
+ * costs is the ability to say WHICH BYTES held the credential — the verdict
+ * becomes `unverifiable`, and the record is silent about the binary on disk.
+ *
+ * The fail-closed direction below still governs every OTHER
+ * OverSky-distributed harness, and remains the correct posture for this one if
+ * the floor is ever restored.
+ *
+ * Note this is the OPPOSITE posture to the daemon's own `../release-keys.ts`
+ * (same basename, different module), deliberately. There,
+ * an empty list disables verification and the updater proceeds, because a fleet
+ * that cannot update is its own outage. Here, an empty list withholds a
+ * privilege, because absence of evidence must never grant one. Getting these
+ * two backwards would mean provisioning a key *reduces* what the daemon trusts.
+ *
+ * ── Provisioning ──────────────────────────────────────────────────────────
+ *
+ *   1. Mint:   node scripts/first-party-harness/generate-signing-key.mjs   (in the fork)
+ *   2. Store the PRIVATE half as the GH Actions secret
+ *      `FIRST_PARTY_HARNESS_ENV.signingKey.name` (the only name the publish
+ *      workflow reads) + AWS Secrets Manager. It must never be committed and
+ *      never leave CI.
+ *   3. Paste the PUBLIC half below, newest first.
+ *   4. Ship a daemon build carrying it BEFORE the first signed harness
+ *      release, so the fleet can verify what it is about to be handed.
+ *
+ * Rotation is the same shape as the daemon's: add the next key ABOVE the
+ * current one, ship that build, then start dual-signing. Verification accepts
+ * any pinned key, so an overlap window has no gap.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS = void 0;
+/**
+ * Pinned first-party harness signing public keys, newest first.
+ *
+ * Provisioned 2026-08-07 (WL-6.8). The private half lives in the GitHub secret
+ * named by `FIRST_PARTY_HARNESS_ENV.signingKey` and in AWS Secrets Manager — a
+ * HARNESS key, deliberately a different trust domain from the daemon
+ * self-update key in `../release-keys.ts`.
+ *
+ * ── Two literals that must NOT follow a rename (contract §6) ────────────────
+ * The `keyId` below and the AWS secret path `oversky/sky-code/signing-key` are
+ * historical identifiers, not the product name. A key id is inside every
+ * signature ever issued and every provenance sidecar ever written, so changing
+ * it would make every existing release unverifiable; the secret is stateful
+ * infrastructure. Both move only at the next key ROTATION.
+ *
+ * ORDER OF OPERATIONS, and it only works one way round: this pinned build must
+ * SHIP before any harness release is signed. Backwards, the fleet receives an
+ * artifact it cannot verify and every daemon reports `invalid-signature` —
+ * which from the outside is indistinguishable from a real attack.
+ */
+exports.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS = [
+    // ── NEXT key goes ABOVE this line during a rotation (newest first). ──
+    {
+        // Literal on purpose: a key id is inside every signature issued (contract §6).
+        keyId: 'sky-code-2026-08',
+        publicKeySpkiB64: 'MCowBQYDK2VwAyEAO/5glF6bICuz5MGYgG1PJaDEgXJZkUuv2cLzguVZCvY=',
+    },
+];
+/*
+ * Dev/test escape hatch: an absolute path to a JSON file holding
+ * `[{ keyId, publicKeySpkiB64 }]`, named by `FIRST_PARTY_HARNESS_ENV.devKeys` and
+ * read in `./provenance.ts` with `readFirstPartyHarnessEnv(env, 'devKeys')` — its
+ * brand-neutral name, the only one read.
+ *
+ * Exists so a developer can build, sign, and verify a local harness end to end
+ * without minting a production key — the alternative is that the whole trust
+ * chain is only ever exercised in CI, which is how it rots.
+ *
+ * Deliberately NOT a way to weaken production: it can only ADD keys a local
+ * operator explicitly pointed at, it is read from an absolute path (a relative
+ * one would be attacker-influenced via cwd), and a build that ships with an
+ * empty pinned list still refuses to elevate without it.
+ */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessUpdater.d.ts

@@ -0,0 +1,110 @@
+import { type FirstPartyHarnessChannel } from './firstPartyHarnessChannels.js';
+import { type DaemonVersionManifest, type PlatformArtifact, type ReleaseKey } from './releaseManifest.js';
+export { FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS } from './firstPartyHarnessReleaseKeys.js';
+export { firstPartyHarnessFeedBase, firstPartyHarnessFeedCandidates, } from './firstPartyHarnessChannels.js';
+export { firstPartyHarnessManifestFile } from './firstPartyHarness.js';
+export type { ReleaseKey } from './releaseManifest.js';
+export declare const PREVIOUS_SUFFIX = ".previous";
+export declare const PROVENANCE_SUFFIX = ".oversky-provenance.json";
+export declare const MAX_ARTIFACT_BYTES: number;
+export type InstallFailureCode = 'unsupported-platform' | 'feed-unreachable' | 'manifest-malformed' | 'manifest-unverified' | 'artifact-missing' | 'artifact-unverified' | 'download-failed' | 'hash-mismatch' | 'too-large' | 'install-failed' | 'no-pinned-keys' | 'downgrade-refused' | 'version-invalid' | 'lock-busy' | 'minimum-version' | 'policy-rejected';
+export interface InstallResult {
+    ok: boolean;
+    version?: string;
+    platform?: string;
+    binaryPath?: string;
+    replaced?: boolean;
+    changed?: boolean;
+    reason?: string;
+    code?: InstallFailureCode;
+    error?: string;
+}
+export interface InstallOptions {
+    env?: NodeJS.ProcessEnv;
+    keys?: readonly ReleaseKey[];
+    fetchImpl?: typeof fetch;
+    platform?: NodeJS.Platform;
+    arch?: string;
+    onProgress?: (message: string) => void;
+    version?: string;
+    allowDowngrade?: boolean;
+    signal?: AbortSignal;
+    manifestTimeoutMs?: number;
+    autonomous?: boolean;
+    cohortSubject?: string;
+    contracts?: Record<string, number>;
+    now?: Date;
+}
+export interface HarnessProvenanceRecord {
+    version: string;
+    platform: string;
+    sha256: string;
+    url: string;
+    sig: string;
+    sigs?: PlatformArtifact['sigs'];
+    keyId?: string;
+}
+export interface FirstPartyHarnessUpdateState {
+    operation: 'install' | 'rollback';
+    status: 'running' | 'succeeded' | 'failed';
+    attemptedAt: number;
+    completedAt?: number;
+    targetVersion?: string;
+    installedVersion?: string;
+    code?: InstallFailureCode;
+    error?: string;
+    changed?: boolean;
+}
+type InstallFailure = InstallResult & {
+    ok: false;
+};
+export declare function firstPartyHarnessInstallDir(env?: NodeJS.ProcessEnv): string;
+export declare function firstPartyHarnessBinaryPath(env?: NodeJS.ProcessEnv): string;
+export declare function firstPartyHarnessPlatformKey(platform?: NodeJS.Platform, arch?: string): string | null;
+export declare function fetchVerifiedManifest(options?: InstallOptions): Promise<{
+    ok: true;
+    manifest: DaemonVersionManifest;
+} | InstallFailure>;
+export declare function isManagedFirstPartyHarnessReleasePath(binaryPath: string, env?: NodeJS.ProcessEnv): boolean;
+/** Read a single immutable binary/sidecar pair, never two different `current` targets. */
+export declare function getVerifiedInstalledFirstPartyHarness(options?: Pick<InstallOptions, 'env' | 'keys' | 'platform' | 'arch'>): {
+    binaryPath: string;
+    version: string | null;
+    verified: boolean;
+    exists: boolean;
+    provenance: HarnessProvenanceRecord | null;
+};
+export declare function readFirstPartyHarnessUpdateState(env?: NodeJS.ProcessEnv): FirstPartyHarnessUpdateState | null;
+export interface ActivateFirstPartyHarnessOptions {
+    binary: Buffer;
+    provenance: HarnessProvenanceRecord;
+    env?: NodeJS.ProcessEnv;
+    keys?: readonly ReleaseKey[];
+    platform?: NodeJS.Platform;
+    arch?: string;
+    allowDowngrade?: boolean;
+    onProgress?: (message: string) => void;
+    preserveUnknownInstalled?: boolean;
+    preserveExternalLink?: boolean;
+    /** Optional already verified signed manifest; retained as minimum-floor evidence. */
+    manifest?: DaemonVersionManifest;
+}
+/** Desktop's already-downloaded signed artifact uses the exact same transaction. */
+export declare function activateVerifiedFirstPartyHarnessArtifact(options: ActivateFirstPartyHarnessOptions): InstallResult;
+/** Signed-manifest check reads only; no lock, migration, state writes or login. */
+export declare function checkFirstPartyHarnessUpdate(options?: InstallOptions): Promise<{
+    ok: true;
+    installedVersion: string | null;
+    latestVersion: string;
+    channel: FirstPartyHarnessChannel;
+    updateAvailable: boolean;
+    binaryPath: string;
+    owner: 'managed' | 'external';
+    installedVerified: boolean;
+    minimumVersion: string;
+    lastUpdate: FirstPartyHarnessUpdateState | null;
+} | InstallFailure>;
+export declare function installFirstPartyHarness(options?: InstallOptions): Promise<InstallResult>;
+/** Rollback validates the retained immutable release and preserves its signature. */
+export declare function rollbackFirstPartyHarness(env?: NodeJS.ProcessEnv, options?: Pick<InstallOptions, 'keys'>): InstallResult;
+export declare function installedFirstPartyHarnessSize(env?: NodeJS.ProcessEnv): number | null;