[KirbyInGitHub]

Source-Level CLI Rename

Rename the command to lca-background-data for LCA background-database search and process-dataset matching, version 0.5.0. The name covers individual inventory items and supported query batches, not just BOMs. The plugin revision is a separate PR after the real native release is available.

• Rename the bin/package build identity, scriptName/help/errors, HTTP User-Agent and MCP client, OAuth agent_id/agent_name/client_skill, runtime and installer environment variables, login directory, archive members/filenames and CDN namespace. No old executable alias, old environment fallback or old credential-store import.
• LCA_BACKGROUND_DATA_API_KEY wins over only this CLI's native store; login uses $XDG_CONFIG_HOME/lca-background-data/credentials.json (absolute XDG home), otherwise ~/.config/lca-background-data/credentials.json. Existing credential files are untouched; users sign in again.
• Preserve service wire routes, auth header contracts, cortex_data consent scope and source-repository URLs. The credential remains full SSO state, not a technically restricted read-only token. New OAuth identity/consent presentation is not live-verified.

Why Binaries-Only

Consumers receive five self-contained binaries, with no Node/Python runtime prerequisite. The renamed npm identity has no established bootstrap/Trusted Publisher evidence; do not add npm permissions or secrets to force it through. Make package metadata private and remove active npm packing/publication and npm OIDC from the new release workflow. npm ci/build/test and local package integrity tests remain developer tooling, not npm distribution.

The existing verified private draft handoff and exact file/platform/digest contracts remain. GitHub publication receives only five archives plus checksums and keeps its byte-identical rerun gate. Historical npm publisher/generic handoff helpers remain unused by this release workflow; old npm versions, GitHub releases and CDN objects are not changed or deleted. Historical old-tag workflows are not retagged or modified.

Removing npm must not remove the old tag/version gate: add exact stable version-tag plus main-ancestry checks before build/publication. Add five-archive checksum/member/Mach-O/ELF/PE checks and isolated native-host version/help/missing-credential doctor before the private handoff. This is not native execution on all five targets.

The CDN mirror verifies checksums and uses conditional-create/identical-replay gates for the new namespace, including stable installer/latest keys. Different existing bytes or denied metadata access fail closed; no clobber or credential fallback. Later channel-pointer updates require separate review. Installer checksum verification is mandatory and tied to exactly one filename. Post-publication installer checks pin and compare the exact version, rather than trusting a moving latest version.

Verification

• npm test with fresh HOME/XDG config and no real credential environment: 13/13 pass. Covers new help/version, ignored old environment/store fixtures, new API-key precedence, OAuth client identity and selected storage, and a clean local package with only the new bin key.
• Offline handoff tests: 15 cases pass. Publication/cleanup mocks and the exact tag/main guard tests pass. New CDN mirror mock tests pass for first create, identical replay, conflict, denied metadata access and corrupt checksum; no network/authentication in those mocks.
• Five native binaries compiled locally; all archive SHA256/member sets and target architecture headers pass. Native darwin-arm64 version=0.5.0, help and empty-store doctor exit 2 pass.
• Renamed shell installer tested against local compiled archives in a fresh temporary install/profile only; checksum/version/doctor checks pass. No global install or user PATH/credential changes.
• Shell syntax and git diff --check pass. No live authenticated business query, EPD review, model calculation or notification performed. Other target binaries have not been executed locally.
• Prior separate transport acceptance evidence: run 38340143859 passed authenticated retrieval/source checks, anonymous denial and consumer-only rerun using synthetic transfer fixtures. This is transport evidence, not product binary acceptance; retain its draft and all old artifacts.

Merge only after CI is green and no review thread remains unresolved. Release only from the reviewed merged commit; no direct main push, forced tag or permission bypass.

🤖 Generated with Claude Code