@theappagency/valinor 10.26.0 → 10.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +9 -9
  2. package/package.json +2 -2
package/README.md CHANGED
@@ -1,17 +1,17 @@
1
1
  # @theappagency/valinor
2
2
 
3
- The public launcher for the **Valinor CLI** — Camber's CI-native quality-governance tool.
3
+ The public launcher for the **Jigawatt CLI** — Camber's CI-native quality-governance tool.
4
4
 
5
5
  ```sh
6
6
  npx @theappagency/valinor@latest --version
7
7
  npx @theappagency/valinor@3.1.0 claims-verify claims.yml
8
8
  ```
9
9
 
10
- The launcher is **trivial by design** and contains no Valinor functionality itself. On each run it:
10
+ The launcher is **trivial by design** and contains no Jigawatt functionality itself. On each run it:
11
11
 
12
- 1. resolves the requested version against the Valinor downloads endpoint
12
+ 1. resolves the requested version against the Jigawatt downloads endpoint
13
13
  (`https://downloads.valinorci.com/manifest.json`) — the launcher's own version pins the bundle
14
- version (the pipeline publishes them in lockstep), so `@theappagency/valinor@X.Y.Z` runs Valinor `X.Y.Z`;
14
+ version (the pipeline publishes them in lockstep), so `@theappagency/valinor@X.Y.Z` runs Jigawatt `X.Y.Z`;
15
15
  2. fetches the version's bundle (`/v/<version>/valinor.tgz`) and **verifies its SHA-256 against the
16
16
  published `SHA256SUMS`, failing closed** — a mismatched artifact is deleted, never executed;
17
17
  3. caches the verified bundle at `~/.valinor/cache/<version>/` — an already-cached, exactly-pinned
@@ -29,7 +29,7 @@ Actions and allow-listed networks. An HTTP 401 or 403 is never retried; the erro
29
29
  `pull_request` run from a fork cannot mint an OIDC token, so it needs `VALINOR_DOWNLOADS_TOKEN` once the
30
30
  endpoint requires authentication.
31
31
 
32
- **Dependabot and fork runs.** Every bundle-fetching step Valinor renders passes
32
+ **Dependabot and fork runs.** Every bundle-fetching step Jigawatt renders passes
33
33
  `VALINOR_DOWNLOADS_TOKEN: ${{ secrets.VALINOR_DOWNLOADS_TOKEN }}` in its own `env:` (never the job's, where a
34
34
  Dependabot pull request's install scripts would see it), so a run that cannot mint still authenticates. Only the
35
35
  download reads it: the rendered step unsets it once the download has its credential, and the launcher runs the CLI
@@ -40,9 +40,9 @@ run or a fork pull request and names that secret. A fork pull request gets no se
40
40
  rather than skip the check. The rendered verify step stops on a 401 or 403 instead of falling back to `npx`, which
41
41
  would ask the same endpoint and be refused the same way; an endpoint it cannot reach still falls back.
42
42
 
43
- **Getting a downloads token.** Ask whoever runs your Valinor downloads endpoint for a personal token: each
43
+ **Getting a downloads token.** Ask whoever runs your Jigawatt downloads endpoint for a personal token: each
44
44
  person gets their own, so one person's access can be withdrawn without touching anyone else's. Keep it in
45
- your secret store and export it as `VALINOR_DOWNLOADS_TOKEN` in the shell that runs Valinor; never commit
45
+ your secret store and export it as `VALINOR_DOWNLOADS_TOKEN` in the shell that runs Jigawatt; never commit
46
46
  it.
47
47
 
48
48
  **Which 403 you got.** A 403 is named by who sent it. "The endpoint verified the GitHub OIDC token, but this
@@ -51,7 +51,7 @@ does not serve. "HTTP 403 from Cloudflare's firewall in front of the downloads e
51
51
  never reached the endpoint: without a credential, set `VALINOR_DOWNLOADS_TOKEN`; with one, retry from
52
52
  another network and report the Ray ID the message gives.
53
53
 
54
- **A failed download is a hard stop.** Valinor does not run, and nothing runs in its place: there is no
54
+ **A failed download is a hard stop.** Jigawatt does not run, and nothing runs in its place: there is no
55
55
  switch, variable or flag that skips the download, and no other cached, local or `npx` copy stands in.
56
56
  A cache hit runs offline only after the kept tarball re-hashes to the SHA-256 recorded when it was first
57
57
  verified; a cache entry that fails that check is refused, and the error says to delete it and run again
@@ -83,6 +83,6 @@ GitHub Actions with `id-token: write`, minting the OIDC token it fetches with).
83
83
 
84
84
  ## Licensing
85
85
 
86
- This launcher is MIT-licensed. **The Valinor CLI bundle it downloads is proprietary software of
86
+ This launcher is MIT-licensed. **The Jigawatt CLI bundle it downloads is proprietary software of
87
87
  Camber–The App Agency**, licensed under the terms shipped inside the downloaded artifact (the
88
88
  `LICENSE` file in the bundle). Installing this launcher conveys no rights to the bundle.
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@theappagency/valinor",
3
- "version": "10.26.0",
4
- "description": "Public launcher for the Valinor CLI — fetches, SHA-256-verifies, caches, and runs the proprietary Valinor bundle from downloads.valinorci.com. Zero setup, zero secrets, zero npm auth.",
3
+ "version": "10.27.0",
4
+ "description": "Public launcher for the Jigawatt CLI — fetches, SHA-256-verifies, caches, and runs the proprietary Jigawatt bundle. Zero setup, zero secrets, zero npm auth.",
5
5
  "repository": {
6
6
  "type": "git",
7
7
  "url": "https://github.com/cambercreative/valinor.git",