@theappagency/valinor 8.6.0 → 8.8.0

package/lib/launcher.js

@@ -19,8 +19,32 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * THE DOWNLOAD HOST — MIRRORS src/launcherBundle/resolveSha.ts (the launcher is a zero-dependency
+ * standalone package published to a different registry and cannot import across the `src` boundary;
+ * `src/launcherBundle/downloadsHostMirror.test.ts` asserts the two sides byte-match, so the mirror is
+ * gate-enforced rather than remembered).
+ *
+ * CANONICAL is where the endpoint is moving; LEGACY is what already-published launcher versions — and
+ * every already-pinned consumer workflow — carry. A PUBLISHED launcher is immutable: an npm version
+ * already on disk in someone's CI keeps requesting whatever host it shipped with, forever. That is
+ * why LEGACY keeps resolving indefinitely, and why flipping DEFAULT only affects launcher versions
+ * published AFTER the flip.
+ */
+export const CANONICAL_DOWNLOADS_HOST = "downloads.theappagency.com";
+
+/** The host already-published launcher versions request. Kept serving indefinitely. */
+export const LEGACY_DOWNLOADS_HOST = "downloads.valinorci.com";
+
+/**
+ * The host THIS launcher version requests when VALINOR_DOWNLOADS_URL is unset.
+ * ⚠️ THE FLIP: change to `CANONICAL_DOWNLOADS_HOST` at cutover step 6, in lockstep with the CLI-side
+ * constant. It is LEGACY today because the canonical host does not resolve yet.
+ */
+export const DEFAULT_DOWNLOADS_HOST = LEGACY_DOWNLOADS_HOST;
+
 /** The production downloads endpoint (override with VALINOR_DOWNLOADS_URL — staging/fixtures/tests). */
-export const DEFAULT_DOWNLOADS_URL = "https://downloads.valinorci.com";
+export const DEFAULT_DOWNLOADS_URL = `https://${DEFAULT_DOWNLOADS_HOST}`;
 
 const SEMVER_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
 
@@ -253,5 +277,7 @@ function offlineHint(base, root) {
     cached.length > 0
       ? `Cached versions available OFFLINE at ${root}: ${cached.join(", ")} — pin one to run without the network (e.g. VALINOR_VERSION=${cached[cached.length - 1]} or npx @theappagency/valinor@${cached[cached.length - 1]}).`
       : `No versions are cached locally at ${root}, so nothing can run offline.`;
-  return `The Valinor downloads endpoint (${base}) is unreachable or missing the requested artifact.\n${cacheLine}\nIf this persists, check https://downloads.valinorci.com and your network/proxy configuration.`;
+  // Name the base the run ACTUALLY used, not a second hard-coded host: if the endpoint moved and this
+  // launcher is pinned to the old one, the useful diagnostic is the host it just failed to reach.
+  return `The Valinor downloads endpoint (${base}) is unreachable or missing the requested artifact.\n${cacheLine}\nIf this persists, check ${base} and your network/proxy configuration.`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theappagency/valinor",
-  "version": "8.6.0",
+  "version": "8.8.0",
   "description": "Public launcher for the Valinor CLI — fetches, SHA-256-verifies, caches, and runs the proprietary Valinor bundle from downloads.valinorci.com. Zero setup, zero secrets, zero npm auth.",
   "repository": {
     "type": "git",