Require Clerk publishing keys in the CLI

README.md

@@ -241,8 +241,7 @@ termcade publish https://github.com/you/mygame v1.0.0 mygame.tcade
 For automated publishing, log in and run `termcade keys new <name> <username>`.
 The API asks Termcade's Clerk tenant to create an `ak_…` key restricted to that
 handle. Set it as `TERMCADE_TOKEN` when running `termcade publish`. Manage keys
-with `termcade keys list` and `termcade keys revoke <id>`. Existing `tck_…` keys
-remain usable during the transition. Publishing keys cannot sign in or manage
+with `termcade keys list` and `termcade keys revoke <id>`. Publishing keys cannot sign in or manage
 accounts; browser-approved `termcade login` continues to use separate CLI sessions.
 
 The registry fetches that asset once, validates it against the same manifest

internal/registry/client.go

@@ -265,7 +265,7 @@ func (c *Client) doContext(ctx context.Context, method, path string, body, out a
 }
 
 func (c *Client) authorizationValue() string {
-	if strings.HasPrefix(c.token, "tcc_") || strings.HasPrefix(c.token, "tck_") || strings.HasPrefix(c.token, "ak_") {
+	if strings.HasPrefix(c.token, "tcc_") || strings.HasPrefix(c.token, "ak_") {
 		return "Bearer " + c.token
 	}
 	return c.token

internal/registry/client_test.go

@@ -191,3 +191,9 @@ func TestClerkPublishingKeyUsesBearerWithoutBecomingLogin(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestLegacyPublishingKeysAreNotAccepted(t *testing.T) {
+	if IsPublishKey("tck_" + strings.Repeat("A", 43)) {
+		t.Fatal("legacy key accepted")
+	}
+}

internal/registry/device.go

@@ -28,7 +28,7 @@ var (
 	userCodeRE   = regexp.MustCompile(`^[ABCDEFGHJKMNPQRSTUVWXYZ23456789]{4}-[ABCDEFGHJKMNPQRSTUVWXYZ23456789]{4}$`)
 	deviceCodeRE = regexp.MustCompile(`^tcd_[A-Za-z0-9_-]{43}$`)
 	cliTokenRE   = regexp.MustCompile(`^tcc_[A-Za-z0-9_-]{43}$`)
-	publishKeyRE = regexp.MustCompile(`^(tck_[A-Za-z0-9_-]{43}|ak_[A-Za-z0-9_-]{20,512})$`)
+	publishKeyRE = regexp.MustCompile(`^ak_[A-Za-z0-9_-]{20,512}$`)
 )
 
 func IsCLIToken(value string) bool   { return cliTokenRE.MatchString(value) }