@byok-sdk/client 0.9.1 → 0.10.0

package/dist/daemon/auth-manager.d.ts

@@ -15,6 +15,14 @@ export interface AuthManagerOptions {
     /** Internal-only credential custody seam. Product construction uses store.credentials. */
     credentials?: DeviceCredentialStore | InMemoryDeviceCredentialStore;
     deviceName?: string;
+    /**
+     * Optional resolver for the client-hashed physical machine identity sent
+     * with `POST /byok/pair` (protocol §6.1). Resolved once per pair attempt; a
+     * resolver that yields `undefined` omits the field entirely rather than
+     * sending a placeholder, because the server treats its presence as
+     * permission to supersede this machine's prior active device rows.
+     */
+    machineId?: () => Promise<string | undefined>;
     /** Called once revocation is detected, so a caller (ConnectionManager) can stop retrying and surface the state instead of looping. */
     onRevoked?: () => void;
 }

package/dist/daemon/create-daemon.d.ts

@@ -91,6 +91,14 @@ export interface DaemonConfig {
     productId: string;
     serverUrl: string;
     deviceName?: string;
+    /**
+     * Optional override for the client-hashed physical machine identity sent
+     * with `POST /byok/pair` (protocol §6.1). Defaults to `resolveMachineId`
+     * over this product id, which probes one OS identifier and hashes it; a
+     * host that has its own machine authority can supply it here, and one that
+     * wants no supersession at all supplies `async () => undefined`.
+     */
+    machineId?: () => Promise<string | undefined>;
     workspaceRoot: string;
     /**
      * Strict Agent execution boundary. The host selects one absolute branded

package/dist/daemon/machine-id.d.ts

@@ -0,0 +1,25 @@
+import type { DeviceCommandRunner } from './device-credential-store';
+export interface ResolveMachineIdOptions {
+    /** Domain separator for the digest — the same machine yields a different value per product. */
+    readonly productId: string;
+    readonly platform?: NodeJS.Platform;
+    /** Injectable process runner, same shape as the credential store's. Tests substitute a double; production gets `runDeviceCommand`. */
+    readonly run?: DeviceCommandRunner;
+    /** Injectable file read for the Linux probe, for the same reason `run` is injectable. */
+    readonly readFile?: (path: string) => Promise<string>;
+    /**
+     * Upper bound on the whole probe, in milliseconds (default 2000). A probe
+     * that never settles — a wedged `ioreg`, a hung registry read, an NFS-backed
+     * `/etc/machine-id` — must not stall pairing, because `AuthManager` awaits
+     * this value inline before `POST /byok/pair`. On expiry the resolution is
+     * `undefined`, the same as every other failure shape.
+     */
+    readonly timeoutMs?: number;
+}
+/**
+ * The lowercase-hex digest for this machine, or `undefined` when no OS
+ * identifier is available. Never throws: every probe failure, every
+ * unsupported platform, every empty read, and a probe that exceeds
+ * `timeoutMs` all collapse to the same `undefined`.
+ */
+export declare function resolveMachineId(options: ResolveMachineIdOptions): Promise<string | undefined>;

package/dist/index.js

@@ -6275,13 +6275,15 @@ var AuthManager = class {
         }
         const keyPair = existing ? { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey } : generateDeviceKeyPair();
         const url = new URL(BYOK_PAIR_PATH, toHttpBase(this.opts.serverUrl));
+        const machineId = await this.opts.machineId?.();
         const res = await fetch(url, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({
             pairingCode,
             deviceName: this.opts.deviceName ?? os4__default.hostname(),
-            devicePublicKey: keyPair.publicKeyBase64Url
+            devicePublicKey: keyPair.publicKeyBase64Url,
+            ...machineId === void 0 ? {} : { machineId }
           })
         });
         if (!res.ok) {
@@ -6590,6 +6592,67 @@ var BlobClient = class {
     throw lastFailure;
   }
 };
+var DEFAULT_TIMEOUT_MS2 = 2e3;
+var DARWIN_UUID_RE = /"IOPlatformUUID"\s*=\s*"([^"]+)"/u;
+var WIN32_GUID_RE = /MachineGuid\s+REG_SZ\s+(\S+)/u;
+var LINUX_MACHINE_ID_PATHS = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
+async function probeDarwin(run) {
+  const result = await run("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+  if (result.exitCode !== 0) return void 0;
+  return DARWIN_UUID_RE.exec(result.stdout)?.[1];
+}
+async function probeLinux(readFile3) {
+  for (const path38 of LINUX_MACHINE_ID_PATHS) {
+    try {
+      const contents = (await readFile3(path38)).trim();
+      if (contents.length > 0) return contents;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function probeWin32(run) {
+  const result = await run("reg", [
+    "query",
+    "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
+    "/v",
+    "MachineGuid"
+  ]);
+  if (result.exitCode !== 0) return void 0;
+  return WIN32_GUID_RE.exec(result.stdout)?.[1];
+}
+async function withTimeout(probe, timeoutMs) {
+  let timer;
+  const expiry = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(void 0), timeoutMs);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([probe, expiry]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+async function resolveMachineId(options) {
+  const platform = options.platform ?? process.platform;
+  const run = options.run ?? runDeviceCommand;
+  const readFile3 = options.readFile ?? ((path38) => fs13.readFile(path38, "utf8"));
+  let probe;
+  if (platform === "darwin") probe = probeDarwin(run);
+  else if (platform === "linux") probe = probeLinux(readFile3);
+  else if (platform === "win32") probe = probeWin32(run);
+  if (probe === void 0) return void 0;
+  let raw;
+  try {
+    raw = await withTimeout(probe, options.timeoutMs ?? DEFAULT_TIMEOUT_MS2);
+  } catch {
+    return void 0;
+  }
+  const trimmed = raw?.trim();
+  if (trimmed === void 0 || trimmed.length === 0) return void 0;
+  return createHash("sha256").update(`${options.productId}
+${trimmed}`, "utf8").digest("hex");
+}
 var PRESENCE_HINTS_CAPABILITY = "presence.hints";
 var CapabilityDiscoveryError = class extends Error {
   constructor(message, options) {
@@ -11189,7 +11252,7 @@ async function readPinnedFile(directory, fileName, maxBytes = AGENT_MEMORY_MAX_F
     });
   }
 }
-async function readFile(context, relativePath, maxBytes = AGENT_MEMORY_MAX_FILE_BYTES) {
+async function readFile2(context, relativePath, maxBytes = AGENT_MEMORY_MAX_FILE_BYTES) {
   if (context.filesystem !== void 0) return context.filesystem.read(relativePath, maxBytes);
   return withMemoryParent(context, relativePath, (directory, fileName) => readPinnedFile(directory, fileName, maxBytes));
 }
@@ -11357,7 +11420,7 @@ var AgentMemoryService = class {
     const context = taskContext(this.input);
     const relativePath = validateAgentMemoryPath(input.path);
     if (input.ifRevision !== void 0 && !revision(input.ifRevision)) throw new AgentMemoryError("ifRevision must be a sha256 content revision");
-    const current = await readFile(context, relativePath);
+    const current = await readFile2(context, relativePath);
     if (!current.exists) throw new AgentMemoryError("memory file does not exist");
     if (input.ifRevision !== void 0 && current.revision !== input.ifRevision) throw new AgentMemoryRevisionConflictError(input.ifRevision, current.revision);
     const auditWarning = await exclusiveAgentMemoryHome(context.canonicalHome, () => recordAuditWarning(context, "recall", {
@@ -11444,7 +11507,7 @@ async function captureAgentMemorySnapshot(input) {
   const files = [];
   let totalBytes = 0;
   for (const relativePath of paths) {
-    const current = await readFile(context, relativePath);
+    const current = await readFile2(context, relativePath);
     if (!current.exists) {
       if (relativePath === "MEMORY.md") throw new AgentMemoryError("MEMORY.md disappeared before snapshot");
       continue;
@@ -16426,6 +16489,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       serverUrl: config.serverUrl,
       store,
       deviceName: config.deviceName,
+      machineId: config.machineId ?? (() => resolveMachineId({ productId: config.productId })),
       onRevoked: () => {
         connectionState = "revoked";
       }
@@ -17724,7 +17788,7 @@ function connectAndHandshake(endpoint, token, opts) {
     });
   });
 }
-function withTimeout(promise, ms, message) {
+function withTimeout2(promise, ms, message) {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(message)), ms);
     timer.unref?.();
@@ -17803,7 +17867,7 @@ function createControlClient(socket, reader, opts) {
     async request(method, params) {
       if (closed) throw new Error("control connection is closed");
       const { promise } = send(method, params);
-      const result = await withTimeout(promise, opts.requestTimeoutMs ?? 1e4, `control request "${method}" timed out`);
+      const result = await withTimeout2(promise, opts.requestTimeoutMs ?? 1e4, `control request "${method}" timed out`);
       return result;
     },
     subscribe(method, params, onEvent) {
@@ -18740,7 +18804,7 @@ ${args.map((a) => `    ${plistString(a)}`).join("\n")}
 }
 function createLaunchdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs29 = deps.fs ?? promises;
+  const fs30 = deps.fs ?? promises;
   const homedir = deps.homedir ?? (() => os4__default.homedir());
   const getuid = deps.getuid ?? (() => {
     if (typeof process.getuid !== "function") {
@@ -18754,7 +18818,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
     try {
-      await fs29.stat(p);
+      await fs30.stat(p);
       return true;
     } catch {
       return false;
@@ -18762,9 +18826,9 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs29.mkdir(path3__default.dirname(plistPath()), { recursive: true });
-    await fs29.mkdir(def.logDir, { recursive: true });
-    await fs29.writeFile(plistPath(), xml, "utf8");
+    await fs30.mkdir(path3__default.dirname(plistPath()), { recursive: true });
+    await fs30.mkdir(def.logDir, { recursive: true });
+    await fs30.writeFile(plistPath(), xml, "utf8");
   }
   async function install(opts = {}) {
     await writePlist(opts.program ?? def.program);
@@ -18775,7 +18839,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "launchctl", ["bootout", serviceTarget()], "launchctl bootout", LAUNCHD_NOT_LOADED);
-    await fs29.rm(plistPath(), { force: true });
+    await fs30.rm(plistPath(), { force: true });
   }
   async function start() {
     if (!await fileExists(plistPath())) {
@@ -18859,14 +18923,14 @@ WantedBy=default.target
 }
 function createSystemdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs29 = deps.fs ?? promises;
+  const fs30 = deps.fs ?? promises;
   const homedir = deps.homedir ?? (() => os4__default.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
   const unitPath = () => path3__default.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
-      await fs29.stat(p);
+      await fs30.stat(p);
       return true;
     } catch {
       return false;
@@ -18874,9 +18938,9 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs29.mkdir(path3__default.dirname(unitPath()), { recursive: true });
-    await fs29.mkdir(def.logDir, { recursive: true });
-    await fs29.writeFile(unitPath(), unit, "utf8");
+    await fs30.mkdir(path3__default.dirname(unitPath()), { recursive: true });
+    await fs30.mkdir(def.logDir, { recursive: true });
+    await fs30.writeFile(unitPath(), unit, "utf8");
   }
   async function install(opts = {}) {
     await writeUnit(opts.program ?? def.program);
@@ -18885,7 +18949,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "systemctl", ["--user", "disable", "--now", unitName], "systemctl disable --now", SYSTEMD_NOT_LOADED);
-    await fs29.rm(unitPath(), { force: true });
+    await fs30.rm(unitPath(), { force: true });
     await run("systemctl", ["--user", "daemon-reload"]);
   }
   async function start() {
@@ -18948,7 +19012,7 @@ ${argXml}${cwdXml}
 }
 function createWinswLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs29 = deps.fs ?? promises;
+  const fs30 = deps.fs ?? promises;
   const windows = def.windows;
   if (!windows) {
     throw new Error("WinSW service lifecycle requires `ServiceDefinition.windows.winswBin` (the product-bundled WinSW executable path)");
@@ -18960,7 +19024,7 @@ function createWinswLifecycle(def, deps = {}) {
   const xmlPath = path3__default.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
-      await fs29.stat(p);
+      await fs30.stat(p);
       return true;
     } catch {
       return false;
@@ -18968,10 +19032,10 @@ function createWinswLifecycle(def, deps = {}) {
   }
   async function writeFiles(program) {
     const xml = generateWinswXml({ id, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs29.mkdir(installDir, { recursive: true });
-    await fs29.mkdir(def.logDir, { recursive: true });
-    await fs29.copyFile(winswBin, exePath);
-    await fs29.writeFile(xmlPath, xml, "utf8");
+    await fs30.mkdir(installDir, { recursive: true });
+    await fs30.mkdir(def.logDir, { recursive: true });
+    await fs30.copyFile(winswBin, exePath);
+    await fs30.writeFile(xmlPath, xml, "utf8");
   }
   async function install(opts = {}) {
     await writeFiles(opts.program ?? def.program);
@@ -18981,8 +19045,8 @@ function createWinswLifecycle(def, deps = {}) {
   async function uninstall() {
     await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_NOT_INSTALLED);
     await runIdempotent(run, exePath, ["uninstall"], "winsw uninstall", WINSW_NOT_INSTALLED);
-    await fs29.rm(exePath, { force: true });
-    await fs29.rm(xmlPath, { force: true });
+    await fs30.rm(exePath, { force: true });
+    await fs30.rm(xmlPath, { force: true });
   }
   async function start() {
     if (!await fileExists(xmlPath)) {