@zincapp/znvault-cli 2.1.0

package/dist/services/signature-verifier.js

@@ -0,0 +1,209 @@
+// Path: znvault-cli/src/services/signature-verifier.ts
+/**
+ * Signature Verification Service
+ *
+ * Verifies GPG signatures and SHA256 checksums for agent updates.
+ * Uses the openpgp library for pure JavaScript implementation.
+ */
+import * as fs from 'fs';
+import * as crypto from 'crypto';
+import * as https from 'https';
+import * as openpgp from 'openpgp';
+import { getPublicKeyUrl } from '../types/update.js';
+/**
+ * Embedded public key for verification
+ * This is the fallback key used when the remote key cannot be fetched.
+ * It should be updated when the signing key is rotated.
+ *
+ * Key ID: 8E703B1277C29EEFADA1C7AF843C39536B732281
+ * Email: agent-releases@zincapp.com
+ */
+const EMBEDDED_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGlKeYABEACoIBxF4zDNXOOxbr411yJQmGLj5LPseM3Vxh+JYSVtL4We33dq
+r4/oTDfWMmmNgga+tLvdomIWta47Dh3d3qWZ8okM7Rk7sk52tu25M4s/eGDGOxcY
+18Cbh0rUhw0pIgNu2K4AEIPhkv9V9B4phZJ2qPC+rqT0VRL05pMLSgk/NqgkSWop
+XSltQDxbafhLSJnscUN6AcYcpRZn+T6zEp2g/38NGknM0eT3xX0SpP2G8I+Jf/b9
+NF2v/OlbmYrfgXU1ZazohalrAiNXmEDbtFyBXMR5qdfBmlxgJkUjoCKYX8iSAQMH
+nL2qt04DxyCKch++nvnMpZzcwA8SSTu2WoiGOPWkWRU/s0JjrFrPD/HUFlJtO0QR
+t8fFgPUU1STvDyCpPQez790giwmyiztpMauuTAp5lyyHUjPcSkZ+z5QU+z9Eaysg
+s3bdGcLBkX3Ee056BIsE7VsBjY1HxE5494f6hrdb41TmW+zzOI5CXPGDSor1hfMq
+Fqw3Hz9LCe0UILtJHwOqSCDQQ7X4nsakVOdbhhYMjXTM2PCoO4WWPI37N3AdcM1b
+nW3sHknUSnuh+tiDLvqUDvLsRdcIAUGjNKfDiEfQzd1RxIeWLLlAM27lavtnAjwa
+feqY2Fpws5SnkdVtRS/m8QAZNtAqATTVnKP8qry8PY+fHfm+oukTeLts1QARAQAB
+tDRaTi1WYXVsdCBBZ2VudCBSZWxlYXNlcyA8YWdlbnQtcmVsZWFzZXNAemluY2Fw
+cC5jb20+iQJSBBMBCAA8FiEEjnA7EnfCnu+tocevhDw5U2tzIoEFAmlKeYADGy8E
+BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEIQ8OVNrcyKBNBAP/R4bHgck
+lALqzccuNH8NOa9MI6OMN0zETd/bm6Ea3+aFA6ScOOoOkbRqcqlTnUky2PDU7P8Q
+ei1ak7N7lKyghuIs+EcCC2aHjBpnp7eTSoB7ljXhWhLlZUjjks7GG/0PebJIJm7X
+R5/a4bDaZS/6LxCiSwz6IJcW52+VcCGQynzLm8B3cUC9cqa6l1ICciPuhWLQQDIG
+XC1gq3pkZ/uuxqtY0We8cdBSefrUp1vo/LoGa4od9T2/vZJHjZZWOYhi2LRvo38z
+bExaA30l1Z8N5WZx+suJeYDgkp3n8KRTt4mNEqqNyXiB5PAwpJ8g7Quv+ENB+mIz
+M0MGw8KH15k+0l3Z46JCVkrdW7WD/2taREB2LqfgEnVEdvZHWjvj204ixKytM2Pi
+eMQS3SDHCMMTuT8UW7IFShdhK0NT92zWxBUwm1OzhKGMR+D8Yq7rxs57lz2Ucm2Y
+PaQg3QLiTcPPNFz+CV7zEsDDpzuemDGjnUNi6SN7g8ZlCiyVU/rbMH43m/GuZlcC
+fqa2Wyxzknodp4NK/AEKuys3aurXmHPFjX8Z8MdUtdXxM1bddyzVlNcGX3f5+n7P
+EnrnDoDvDp4fWRnmk2pmFdSlg/Y7FW8m4aPGIhIn7eEWF6L3BsegwyCT2efMi6aJ
+dBlGGN/pgtvyWXp2so/xeHdoyjwI8GohUw3cuQINBGlKeYABEADpIgY7l3cXsUjI
+2lnDBZPC+GDkyPYTFw3YIrGOuBT1+W5T36rq81v71lsoBRmM6sDNuzgx/6D9D50Y
+Gca3IDtY0hU7594mQDT8uuH2AIwGTnQkWcaroyKKsKKG102C85tbCtVTsY8Up983
+CT+bJzPItNtTHVW/xAjuXweO6VGw2aICQ5ufck/goHnDG+TCorNl12vZ2CTdgm+F
+ZkIDozEV+wHj5mV2qJDBLCWA4FJVeT+KCFKEBYIchB0SWY4m6waRnAiS+47fn8xk
+uCdtYvaQ506Z2qtZPfu+L2+wEIrsDF9MeIYaQp5Fb1gkUN2Dj8NY0T93NXIQP67H
+ecsFKphVnSmIgaA917lMsw0XXQ479FaW2Pdx8zsRpEv43XgIgBVfXURNcm36E5ZQ
+vCW0nfeWDpLdi8BK//xFKHo1D5NZNOz1KVa1wfa1E+RgweHlxZ6mQxq9VbH3otYJ
+z+4giGhhtqUWW4wfZZnnscJq6650vjg4Ha/mL7lofBbDNN/LtIJZkPiSdDUwf4XS
+LosyrIRfY5tjmxF2Tsvm9MChK9oK54Pr5oCvFAYDS1px44wIUv+836Qy7oLyRxrm
+JsimNB7Deu7vmVOMWOCBAi9YY90mvMeJ7lO6cgu8gc2NME9PWyMyrFdW523JkJXB
+q5vkuvXAaI1REf4j3LoYs4eJcdLSDQARAQABiQRsBBgBCAAgFiEEjnA7EnfCnu+t
+ocevhDw5U2tzIoEFAmlKeYACGy4CQAkQhDw5U2tzIoHBdCAEGQEIAB0WIQR4f+Np
+WVt0M3B08FbCPfGlFdkqPQUCaUp5gAAKCRDCPfGlFdkqPeKXEAChwVyYlHSFqJph
+X2KnrUmkMUQS/wOp1sXrWn1YaxBSJzGF3x6a/hmoFGi6tp0F0h4mbVbu/CFHr0jG
+HXpTJEvGzTHRX831eP+HbBGfx5ZplDXrviy1/rr8A1EkZWelyVnZfq6946Wc2LZ+
+Gtd1pAqBU+SIYflnIEEA/aDWLEt98a7TpGmRJPNjiHQgNxfRKT2HCYyVcMe3UrpS
+lWxnIvxMwIRtxgRks6wZwYA08YHxFsZGCkwG3+Zqa5gsVXi9PyEmAqbA5EA8j6yV
+yn/3mOEtPlIZLJJRPAHlRnQc/epHi1178l7JTG0EAlbtPeOmsOar1B/GTystz4qR
+mvIEfUjbClvGxbNun56oqoUF5rVvR4RbLxHGBeiNkbMhyWiQLy4KlII3x7+Lkriy
+O9dwhDxXQ9uMCqDr/m5nrQ+OZVEi8o4Pem5glNxrPzktQAt4K/7vKv28hMmyVYZf
+GTaGo823UszvjP0duBmZRjjuyfV29XUfTpeS6UPOril/CfLCobUO4UKPOixgJwjp
+Eg2U5KP79zmbaK6gRz/eAae8glotKHyBt1U9dN2ejEkx0+RZiFbFONE00QavQ9e2
+LY1D7yAHmov5VEeCdjhFHhXexKQGUPEuKQABP743rmlK1Jl0GqKrXNFFr8gA2BFP
+R3xBNGZNb00eAYfHIN6WPczllNeVb8emD/0dhv8TIwfUZiw7INBuN04/qJqITius
+tBtkWElwsAiue0VXzgQfdppcIjS+8Ndi2n2WoqfXtNAJ6BrGM7bVBrftG5BtElPm
+AQa8y0KuTB8qL3J0+t/FWiJpLD7v2/e4C7escfGuxijGbr95qtVXc7xixtUHj4o2
+OF+PvvzLxEwGiQ8D0e/JrMfUtKgmr/xFFl/M6zw0LzDJjreK69pSThd2Hy1tsgxh
+5MrfrYKUG6whQvw2vJISXczIUe2Oec+IfS4UJPNRyRmwv6YjRGvxdUGq6v5m+G+s
+xaXHBRUideeYwtwiP8SU+g/tdbCaQ426+w90sjpQdSHU/2u9JNJGWIfM2iCyqa16
+8w5bkJYfM7icrHLkxHbrF1kveVsYfguqtneQTXpG21QOvivfGStdSVILvPJFebfa
+uwbPJ7DaLfFUOu1Xb8LcogHLgEKK1S6cEJHbJGBkyfGedMA2jADmLZ1Cx8GHqxxe
+kUyLqb/sHvLX6WKOqZ64KcMAj2XtMT1L6vXSGn26b+kLmP+gK85BiBw9sFr9aS6q
+iK8+HoEWg4JxEGlzF0wZDwh3JKTXomTcPceB4JNWtp5ir/5kYcrgAq8kt5kSRCKV
+Oq/n2iM57HMiXqrXOkFBeamTjldqpuifsDsZDi3k9c5/bJbm/k5jh4SE8ASeJ1dl
+WHcbEBz8WFnmLA==
+=TbOo
+-----END PGP PUBLIC KEY BLOCK-----`;
+export class SignatureVerifier {
+    publicKeyArmored = null;
+    publicKeyFetched = false;
+    /**
+     * Verify SHA256 checksum of a file
+     */
+    verifyChecksum(filePath, expectedSha256) {
+        const fileBuffer = fs.readFileSync(filePath);
+        const hash = crypto.createHash('sha256').update(fileBuffer).digest('hex');
+        return hash.toLowerCase() === expectedSha256.toLowerCase();
+    }
+    /**
+     * Calculate SHA256 checksum of a file
+     */
+    calculateChecksum(filePath) {
+        const fileBuffer = fs.readFileSync(filePath);
+        return crypto.createHash('sha256').update(fileBuffer).digest('hex');
+    }
+    /**
+     * Fetch the public key from S3
+     */
+    async fetchPublicKey() {
+        if (this.publicKeyArmored) {
+            return this.publicKeyArmored;
+        }
+        const url = getPublicKeyUrl();
+        return new Promise((resolve, reject) => {
+            https.get(url, { rejectUnauthorized: true }, (res) => {
+                if (res.statusCode !== 200) {
+                    reject(new Error(`Failed to fetch public key: HTTP ${res.statusCode}`));
+                    return;
+                }
+                let data = '';
+                res.on('data', (chunk) => { data += chunk; });
+                res.on('end', () => {
+                    this.publicKeyArmored = data;
+                    this.publicKeyFetched = true;
+                    resolve(data);
+                });
+            }).on('error', reject);
+        });
+    }
+    /**
+     * Get the public key for verification
+     * Tries to fetch from S3, falls back to embedded key
+     */
+    async getPublicKey() {
+        if (this.publicKeyArmored) {
+            return this.publicKeyArmored;
+        }
+        try {
+            return await this.fetchPublicKey();
+        }
+        catch (err) {
+            console.warn('Failed to fetch public key from S3, using embedded key');
+            this.publicKeyArmored = EMBEDDED_PUBLIC_KEY;
+            return EMBEDDED_PUBLIC_KEY;
+        }
+    }
+    /**
+     * Verify GPG signature of a file
+     *
+     * @param filePath - Path to the file to verify
+     * @param signatureBase64 - Base64-encoded detached signature
+     * @returns true if signature is valid
+     */
+    async verifySignature(filePath, signatureBase64) {
+        try {
+            const publicKeyArmored = await this.getPublicKey();
+            // Check if signature is empty (release not signed)
+            if (!signatureBase64 || signatureBase64.trim() === '') {
+                console.warn('WARNING: Release is not signed - signature verification skipped');
+                return true; // Allow unsigned releases (e.g., during development)
+            }
+            // Read the file to verify
+            const fileData = fs.readFileSync(filePath);
+            // Decode the signature from base64
+            const signatureArmored = Buffer.from(signatureBase64, 'base64').toString('utf-8');
+            // Read the public key
+            const publicKey = await openpgp.readKey({ armoredKey: publicKeyArmored });
+            // Read the signature
+            const signature = await openpgp.readSignature({ armoredSignature: signatureArmored });
+            // Create a message from the file data
+            const message = await openpgp.createMessage({ binary: fileData });
+            // Verify the signature
+            const verificationResult = await openpgp.verify({
+                message,
+                signature,
+                verificationKeys: publicKey,
+            });
+            // Check if any signature is valid
+            const { verified } = verificationResult.signatures[0];
+            await verified; // throws on invalid signature
+            return true;
+        }
+        catch (err) {
+            console.error('Signature verification failed:', err instanceof Error ? err.message : String(err));
+            return false;
+        }
+    }
+    /**
+     * Verify both checksum and signature
+     */
+    async verifyArtifact(filePath, expectedSha256, signatureBase64) {
+        // First verify checksum (fast)
+        if (!this.verifyChecksum(filePath, expectedSha256)) {
+            return { valid: false, error: 'Checksum verification failed - file may be corrupted' };
+        }
+        // Then verify signature (slower)
+        const signatureValid = await this.verifySignature(filePath, signatureBase64);
+        if (!signatureValid) {
+            return { valid: false, error: 'Signature verification failed - file may be tampered' };
+        }
+        return { valid: true };
+    }
+}
+// Singleton instance
+let verifierInstance = null;
+export function getSignatureVerifier() {
+    if (!verifierInstance) {
+        verifierInstance = new SignatureVerifier();
+    }
+    return verifierInstance;
+}
+//# sourceMappingURL=signature-verifier.js.map

package/dist/services/signature-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-verifier.js","sourceRoot":"","sources":["../../src/services/signature-verifier.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA+DO,CAAC;AAEpC,MAAM,OAAO,iBAAiB;IACpB,gBAAgB,GAAkB,IAAI,CAAC;IACvC,gBAAgB,GAAG,KAAK,CAAC;IAEjC;;OAEG;IACH,cAAc,CAAC,QAAgB,EAAE,cAAsB;QACrD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAgB;QAChC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBACxE,OAAO;gBACT,CAAC;gBAED,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;oBAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YACvE,IAAI,CAAC,gBAAgB,GAAG,mBAAmB,CAAC;YAC5C,OAAO,mBAAmB,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,eAAuB;QAC7D,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAEnD,mDAAmD;YACnD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC,CAAC,qDAAqD;YACpE,CAAC;YAED,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE3C,mCAAmC;YACnC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAElF,sBAAsB;YACtB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAE1E,qBAAqB;YACrB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAEtF,sCAAsC;YACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAElE,uBAAuB;YACvB,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;gBAC9C,OAAO;gBACP,SAAS;gBACT,gBAAgB,EAAE,SAAS;aAC5B,CAAC,CAAC;YAEH,kCAAkC;YAClC,MAAM,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,QAAQ,CAAC,CAAC,8BAA8B;YAE9C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,cAAsB,EACtB,eAAuB;QAEvB,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QACzF,CAAC;QAED,iCAAiC;QACjC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QACzF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,qBAAqB;AACrB,IAAI,gBAAgB,GAA6B,IAAI,CAAC;AAEtD,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,gBAAgB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/services/update-checker.d.ts

@@ -0,0 +1,39 @@
+import type { AgentManifest, UpdateCheckResult, UpdateChannel } from '../types/update.js';
+export declare class UpdateChecker {
+    private channel;
+    private cachedManifest;
+    private lastCheck;
+    private cacheTimeout;
+    constructor(channel?: UpdateChannel);
+    /**
+     * Set the update channel
+     */
+    setChannel(channel: UpdateChannel): void;
+    /**
+     * Fetch manifest from S3
+     */
+    private fetchManifest;
+    /**
+     * Check for available updates
+     */
+    checkForUpdates(currentVersion: string): Promise<UpdateCheckResult>;
+    /**
+     * Get the cached manifest if available
+     */
+    getCachedManifest(): AgentManifest | null;
+    /**
+     * Force refresh the manifest cache
+     */
+    refreshManifest(): Promise<AgentManifest>;
+    /**
+     * Save the last known version to cache file
+     * Used for persistent tracking between daemon restarts
+     */
+    saveLastKnownVersion(version: string): void;
+    /**
+     * Load the last known version from cache file
+     */
+    loadLastKnownVersion(): string | null;
+}
+export declare function createUpdateChecker(channel?: UpdateChannel): UpdateChecker;
+//# sourceMappingURL=update-checker.d.ts.map

package/dist/services/update-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-checker.d.ts","sourceRoot":"","sources":["../../src/services/update-checker.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EAEd,MAAM,oBAAoB,CAAC;AAwC5B,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,GAAE,aAAwB;IAI7C;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAOxC;;OAEG;YACW,aAAa;IAkC3B;;OAEG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiDzE;;OAEG;IACH,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC;IAM/C;;;OAGG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAgB3C;;OAEG;IACH,oBAAoB,IAAI,MAAM,GAAG,IAAI;CActC;AAGD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,aAAwB,GAAG,aAAa,CAEpF"}

package/dist/services/update-checker.js

@@ -0,0 +1,198 @@
+// Path: znvault-cli/src/services/update-checker.ts
+/**
+ * Update Checker Service
+ *
+ * Checks for new agent versions by fetching manifests from S3.
+ * Compares versions using semantic versioning.
+ */
+import * as https from 'https';
+import * as fs from 'fs';
+import * as path from 'path';
+import { getManifestUrl } from '../types/update.js';
+import { getPlatform, getConfigDir } from '../utils/platform.js';
+/**
+ * Parse a semantic version string into components
+ */
+function parseVersion(version) {
+    const match = version.match(/^v?(\d+)\.(\d+)\.(\d+)/);
+    if (!match) {
+        return { major: 0, minor: 0, patch: 0 };
+    }
+    return {
+        major: parseInt(match[1], 10),
+        minor: parseInt(match[2], 10),
+        patch: parseInt(match[3], 10),
+    };
+}
+/**
+ * Compare two semantic versions
+ * Returns: -1 if a < b, 0 if a == b, 1 if a > b
+ */
+function compareVersions(a, b) {
+    const va = parseVersion(a);
+    const vb = parseVersion(b);
+    if (va.major !== vb.major)
+        return va.major < vb.major ? -1 : 1;
+    if (va.minor !== vb.minor)
+        return va.minor < vb.minor ? -1 : 1;
+    if (va.patch !== vb.patch)
+        return va.patch < vb.patch ? -1 : 1;
+    return 0;
+}
+/**
+ * Check if version a is newer than version b
+ */
+function isNewerVersion(a, b) {
+    return compareVersions(a, b) > 0;
+}
+export class UpdateChecker {
+    channel;
+    cachedManifest = null;
+    lastCheck = null;
+    cacheTimeout = 60000; // 1 minute cache
+    constructor(channel = 'stable') {
+        this.channel = channel;
+    }
+    /**
+     * Set the update channel
+     */
+    setChannel(channel) {
+        if (this.channel !== channel) {
+            this.channel = channel;
+            this.cachedManifest = null; // Invalidate cache on channel change
+        }
+    }
+    /**
+     * Fetch manifest from S3
+     */
+    async fetchManifest() {
+        // Check cache
+        if (this.cachedManifest && this.lastCheck) {
+            const elapsed = Date.now() - this.lastCheck.getTime();
+            if (elapsed < this.cacheTimeout) {
+                return this.cachedManifest;
+            }
+        }
+        const url = getManifestUrl(this.channel);
+        return new Promise((resolve, reject) => {
+            https.get(url, { rejectUnauthorized: true }, (res) => {
+                if (res.statusCode !== 200) {
+                    reject(new Error(`Failed to fetch manifest: HTTP ${res.statusCode}`));
+                    return;
+                }
+                let data = '';
+                res.on('data', (chunk) => { data += chunk; });
+                res.on('end', () => {
+                    try {
+                        const manifest = JSON.parse(data);
+                        this.cachedManifest = manifest;
+                        this.lastCheck = new Date();
+                        resolve(manifest);
+                    }
+                    catch (err) {
+                        reject(new Error(`Failed to parse manifest: ${err}`));
+                    }
+                });
+            }).on('error', reject);
+        });
+    }
+    /**
+     * Check for available updates
+     */
+    async checkForUpdates(currentVersion) {
+        try {
+            const manifest = await this.fetchManifest();
+            const platform = getPlatform();
+            // Handle unsupported platform
+            if (platform === 'unsupported') {
+                return {
+                    updateAvailable: false,
+                    currentVersion,
+                    latestVersion: manifest.version,
+                    error: `Unsupported platform: ${process.platform}/${process.arch}`,
+                };
+            }
+            // Check if update is available
+            const updateAvailable = isNewerVersion(manifest.version, currentVersion);
+            // Check minimum version requirement
+            if (updateAvailable && manifest.minVersion) {
+                if (compareVersions(currentVersion, manifest.minVersion) < 0) {
+                    return {
+                        updateAvailable: false,
+                        currentVersion,
+                        latestVersion: manifest.version,
+                        error: `Current version ${currentVersion} is too old. Minimum required: ${manifest.minVersion}. Please update manually.`,
+                    };
+                }
+            }
+            const artifact = manifest.artifacts[platform];
+            return {
+                updateAvailable,
+                currentVersion,
+                latestVersion: manifest.version,
+                manifest: updateAvailable ? manifest : undefined,
+                artifact: updateAvailable ? artifact : undefined,
+            };
+        }
+        catch (err) {
+            return {
+                updateAvailable: false,
+                currentVersion,
+                latestVersion: 'unknown',
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    /**
+     * Get the cached manifest if available
+     */
+    getCachedManifest() {
+        return this.cachedManifest;
+    }
+    /**
+     * Force refresh the manifest cache
+     */
+    async refreshManifest() {
+        this.cachedManifest = null;
+        this.lastCheck = null;
+        return this.fetchManifest();
+    }
+    /**
+     * Save the last known version to cache file
+     * Used for persistent tracking between daemon restarts
+     */
+    saveLastKnownVersion(version) {
+        const cacheFile = path.join(getConfigDir(), 'last-version.json');
+        const data = {
+            version,
+            channel: this.channel,
+            checkedAt: new Date().toISOString(),
+        };
+        const dir = path.dirname(cacheFile);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(cacheFile, JSON.stringify(data, null, 2));
+    }
+    /**
+     * Load the last known version from cache file
+     */
+    loadLastKnownVersion() {
+        const cacheFile = path.join(getConfigDir(), 'last-version.json');
+        try {
+            if (fs.existsSync(cacheFile)) {
+                const data = JSON.parse(fs.readFileSync(cacheFile, 'utf-8'));
+                return data.version;
+            }
+        }
+        catch {
+            // Ignore errors reading cache
+        }
+        return null;
+    }
+}
+// Factory function
+export function createUpdateChecker(channel = 'stable') {
+    return new UpdateChecker(channel);
+}
+//# sourceMappingURL=update-checker.js.map

package/dist/services/update-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-checker.js","sourceRoot":"","sources":["../../src/services/update-checker.ts"],"names":[],"mappings":"AAAA,mDAAmD;AAEnD;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAO7B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,aAAa;IAChB,OAAO,CAAgB;IACvB,cAAc,GAAyB,IAAI,CAAC;IAC5C,SAAS,GAAgB,IAAI,CAAC;IAC9B,YAAY,GAAG,KAAK,CAAC,CAAC,iBAAiB;IAE/C,YAAY,UAAyB,QAAQ;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAsB;QAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,qCAAqC;QACnE,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa;QACzB,cAAc;QACd,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACtD,IAAI,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBAED,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;wBACnD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;wBAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;wBAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACpB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;YAE/B,8BAA8B;YAC9B,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/B,OAAO;oBACL,eAAe,EAAE,KAAK;oBACtB,cAAc;oBACd,aAAa,EAAE,QAAQ,CAAC,OAAO;oBAC/B,KAAK,EAAE,yBAAyB,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;iBACnE,CAAC;YACJ,CAAC;YAED,+BAA+B;YAC/B,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAEzE,oCAAoC;YACpC,IAAI,eAAe,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC3C,IAAI,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7D,OAAO;wBACL,eAAe,EAAE,KAAK;wBACtB,cAAc;wBACd,aAAa,EAAE,QAAQ,CAAC,OAAO;wBAC/B,KAAK,EAAE,mBAAmB,cAAc,kCAAkC,QAAQ,CAAC,UAAU,2BAA2B;qBACzH,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAoB,CAAC,CAAC;YAE1D,OAAO;gBACL,eAAe;gBACf,cAAc;gBACd,aAAa,EAAE,QAAQ,CAAC,OAAO;gBAC/B,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAChD,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aACjD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,eAAe,EAAE,KAAK;gBACtB,cAAc;gBACd,aAAa,EAAE,SAAS;gBACxB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,OAAe;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG;YACX,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAEjE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,mBAAmB;AACnB,MAAM,UAAU,mBAAmB,CAAC,UAAyB,QAAQ;IACnE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/services/update-installer.d.ts

@@ -0,0 +1,54 @@
+import type { ArtifactInfo, ProgressCallback } from '../types/update.js';
+export declare class UpdateInstaller {
+    private installPath;
+    private onProgress?;
+    constructor(installPath?: string, onProgress?: ProgressCallback);
+    /**
+     * Report progress to callback
+     */
+    private report;
+    /**
+     * Download file with progress reporting
+     */
+    private download;
+    /**
+     * Extract tarball to directory
+     */
+    private extractTarball;
+    /**
+     * Find the binary in extracted directory
+     */
+    private findBinary;
+    /**
+     * Install the update
+     *
+     * @param artifact - Artifact info with URL, checksum, and signature
+     * @param version - Version being installed
+     */
+    install(artifact: ArtifactInfo, version: string): Promise<void>;
+    /**
+     * Install a directory-based package (Node.js with dist/)
+     */
+    private installDirectory;
+    /**
+     * Recursively copy a directory
+     */
+    private copyDirectory;
+    /**
+     * Atomically replace the binary with rollback on failure
+     */
+    private atomicReplace;
+    /**
+     * Check if we have permission to install
+     */
+    canInstall(): {
+        canInstall: boolean;
+        reason?: string;
+    };
+    /**
+     * Get the install path
+     */
+    getInstallPath(): string;
+}
+export declare function createUpdateInstaller(installPath?: string, onProgress?: ProgressCallback): UpdateInstaller;
+//# sourceMappingURL=update-installer.d.ts.map

package/dist/services/update-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-installer.d.ts","sourceRoot":"","sources":["../../src/services/update-installer.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAkB,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKzF,qBAAa,eAAe;IAC1B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,UAAU,CAAC,CAAmB;gBAE1B,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB;IAK/D;;OAEG;IACH,OAAO,CAAC,MAAM;IAMd;;OAEG;YACW,QAAQ;IA4DtB;;OAEG;YACW,cAAc;IAI5B;;OAEG;IACH,OAAO,CAAC,UAAU;IA+BlB;;;;;OAKG;IACG,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiGrE;;OAEG;YACW,gBAAgB;IAkD9B;;OAEG;YACW,aAAa;IAgB3B;;OAEG;YACW,aAAa;IA0C3B;;OAEG;IACH,UAAU,IAAI;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IA2BtD;;OAEG;IACH,cAAc,IAAI,MAAM;CAGzB;AAGD,wBAAgB,qBAAqB,CACnC,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,gBAAgB,GAC5B,eAAe,CAEjB"}