@skrr-ai/auth-core 0.1.2

package/dist/cjs/index.js

@@ -0,0 +1,305 @@
+"use strict";
+/**
+ * @skrr-ai/auth-core — shared auth substrate.
+ *
+ * Public surface for the OverSky daemon, Sky CLI, and Electron main
+ * process. Each consumer calls `configureAuthCore()` once at startup to
+ * wire up its logger, config dir, kill switches, and binary name — then
+ * uses the rest of the API uniformly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
+exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
+exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
+exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+// Daemon scope vocabulary — single source of truth for non-Mongoose tiers
+// (daemon, desktop, cli). Schema-bound canonical lives in
+// `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
+// by the api-side parity test. See daemonScopes.ts header for details.
+var daemonScopes_js_1 = require("./daemonScopes.js");
+Object.defineProperty(exports, "SCOPES", { enumerable: true, get: function () { return daemonScopes_js_1.SCOPES; } });
+Object.defineProperty(exports, "ALL_DAEMON_SCOPES", { enumerable: true, get: function () { return daemonScopes_js_1.ALL_DAEMON_SCOPES; } });
+Object.defineProperty(exports, "VALID_DAEMON_SCOPE_SET", { enumerable: true, get: function () { return daemonScopes_js_1.VALID_DAEMON_SCOPE_SET; } });
+Object.defineProperty(exports, "isDaemonScope", { enumerable: true, get: function () { return daemonScopes_js_1.isDaemonScope; } });
+Object.defineProperty(exports, "OAUTH_CLI_SCOPE", { enumerable: true, get: function () { return daemonScopes_js_1.OAUTH_CLI_SCOPE; } });
+// Runtime / DI
+var runtime_js_1 = require("./runtime.js");
+Object.defineProperty(exports, "configureAuthCore", { enumerable: true, get: function () { return runtime_js_1.configureAuthCore; } });
+Object.defineProperty(exports, "getAuthLogger", { enumerable: true, get: function () { return runtime_js_1.getAuthLogger; } });
+Object.defineProperty(exports, "getAuthConfigDir", { enumerable: true, get: function () { return runtime_js_1.getAuthConfigDir; } });
+Object.defineProperty(exports, "getAuthKillSwitches", { enumerable: true, get: function () { return runtime_js_1.getAuthKillSwitches; } });
+Object.defineProperty(exports, "getAuthBinaryName", { enumerable: true, get: function () { return runtime_js_1.getAuthBinaryName; } });
+Object.defineProperty(exports, "emitAuthTelemetry", { enumerable: true, get: function () { return runtime_js_1.emitAuthTelemetry; } });
+// Types
+var types_js_1 = require("./types.js");
+Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get: function () { return types_js_1.PermanentAuthFailure; } });
+Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return types_js_1.TransientAuthFailure; } });
+// JWT helpers
+var jwtUtils_js_1 = require("./jwtUtils.js");
+Object.defineProperty(exports, "decodeJwtExpiry", { enumerable: true, get: function () { return jwtUtils_js_1.decodeJwtExpiry; } });
+Object.defineProperty(exports, "decodeJwtPayload", { enumerable: true, get: function () { return jwtUtils_js_1.decodeJwtPayload; } });
+// Mid-stream auth-expired SSE detector — recognises terminal "auth_expired"
+// events from long-lived SSE / Socket.IO streams and orchestrates a
+// refresher-driven recovery. Mobile RN keeps a byte-equal mirror; see file
+// header.
+var authExpiredDetector_js_1 = require("./authExpiredDetector.js");
+Object.defineProperty(exports, "isAuthExpiredSseEvent", { enumerable: true, get: function () { return authExpiredDetector_js_1.isAuthExpiredSseEvent; } });
+Object.defineProperty(exports, "handleMidStreamAuthExpiry", { enumerable: true, get: function () { return authExpiredDetector_js_1.handleMidStreamAuthExpiry; } });
+// Reauth messaging
+var messages_js_1 = require("./messages.js");
+Object.defineProperty(exports, "formatReauthMessage", { enumerable: true, get: function () { return messages_js_1.formatReauthMessage; } });
+Object.defineProperty(exports, "EXIT_NEEDS_REAUTH", { enumerable: true, get: function () { return messages_js_1.EXIT_NEEDS_REAUTH; } });
+// Pure HTTP→{Permanent, Transient, Success} response classification —
+// exposed so RN-side clients can apply the same mapping daemon uses.
+var refreshClassification_js_1 = require("./refreshClassification.js");
+Object.defineProperty(exports, "classifyRefreshResponse", { enumerable: true, get: function () { return refreshClassification_js_1.classifyRefreshResponse; } });
+// Refresh
+var refresh_js_1 = require("./refresh.js");
+Object.defineProperty(exports, "refreshDaemonToken", { enumerable: true, get: function () { return refresh_js_1.refreshDaemonToken; } });
+Object.defineProperty(exports, "revokeDaemonRefreshSession", { enumerable: true, get: function () { return refresh_js_1.revokeDaemonRefreshSession; } });
+Object.defineProperty(exports, "withAuthLock", { enumerable: true, get: function () { return refresh_js_1.withAuthLock; } });
+Object.defineProperty(exports, "persistReauthState", { enumerable: true, get: function () { return refresh_js_1.persistReauthState; } });
+Object.defineProperty(exports, "needsReauthState", { enumerable: true, get: function () { return refresh_js_1.needsReauthState; } });
+Object.defineProperty(exports, "clearReauthState", { enumerable: true, get: function () { return refresh_js_1.clearReauthState; } });
+Object.defineProperty(exports, "installLockExitHandlers", { enumerable: true, get: function () { return refresh_js_1.installLockExitHandlers; } });
+// H1 — Test-only diagnostic counters that prove every outgoing
+// refresh request mints a fresh proof. Production code never reads
+// this; tests use it to assert the per-attempt invariant.
+Object.defineProperty(exports, "__refreshDiagnostics", { enumerable: true, get: function () { return refresh_js_1.__refreshDiagnostics; } });
+// Finding 4 — Test-only reset for the per-daemonId unknown-shape-401
+// retry budget. Lets tests start each case with a clean streak.
+Object.defineProperty(exports, "__resetUnknown401StreaksForTest", { enumerable: true, get: function () { return refresh_js_1.__resetUnknown401StreaksForTest; } });
+// Finding 4 follow-up (BOOT-BUDGET COUPLING) — consumed by the daemon's
+// startup-recovery loop to statically assert
+// `STARTUP_RECOVERY_MAX_ATTEMPTS >= UNKNOWN_401_BUDGET` so the in-process
+// unknown-401 latch always fires before the boot loop yields to the
+// supervisor. See daemon/src/auth.ts.
+Object.defineProperty(exports, "UNKNOWN_401_BUDGET", { enumerable: true, get: function () { return refresh_js_1.UNKNOWN_401_BUDGET; } });
+// Refresh scheduler
+var refreshScheduler_js_1 = require("./refreshScheduler.js");
+Object.defineProperty(exports, "createRefreshScheduler", { enumerable: true, get: function () { return refreshScheduler_js_1.createRefreshScheduler; } });
+// Fd handoff
+var fdToken_js_1 = require("./fdToken.js");
+Object.defineProperty(exports, "readAuthFromFd", { enumerable: true, get: function () { return fdToken_js_1.readAuthFromFd; } });
+Object.defineProperty(exports, "__setFdReaderForTest", { enumerable: true, get: function () { return fdToken_js_1.__setFdReaderForTest; } });
+// Credential resolver — Phase H precedence chain + Phase I tokenKind
+var credentialResolver_js_1 = require("./credentialResolver.js");
+Object.defineProperty(exports, "CredentialResolver", { enumerable: true, get: function () { return credentialResolver_js_1.CredentialResolver; } });
+Object.defineProperty(exports, "CREDENTIAL_PRECEDENCE", { enumerable: true, get: function () { return credentialResolver_js_1.CREDENTIAL_PRECEDENCE; } });
+Object.defineProperty(exports, "__resetCredentialResolverForTest", { enumerable: true, get: function () { return credentialResolver_js_1.__resetCredentialResolverForTest; } });
+// H3-6 — public seam 401 handlers call to bust the helper cache so
+// the next resolve re-invokes OVERSKY_AUTH_HELPER immediately
+// instead of serving the stale cached token for up to its TTL.
+Object.defineProperty(exports, "invalidateAuthHelperCache", { enumerable: true, get: function () { return credentialResolver_js_1.invalidateAuthHelperCache; } });
+Object.defineProperty(exports, "classifyTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.classifyTokenKind; } });
+Object.defineProperty(exports, "CI_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.CI_TOKEN_PREFIX; } });
+// L6.1 / L6.3 — fail-closed errors thrown by the auth-helper slot.
+Object.defineProperty(exports, "AuthHelperUntrustedError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUntrustedError; } });
+Object.defineProperty(exports, "AuthHelperUnavailableError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUnavailableError; } });
+// Auth helper — invocation contract for OVERSKY_AUTH_HELPER
+var authHelper_js_1 = require("./authHelper.js");
+Object.defineProperty(exports, "invokeAuthHelper", { enumerable: true, get: function () { return authHelper_js_1.invokeAuthHelper; } });
+Object.defineProperty(exports, "getDefaultHelperTtlMs", { enumerable: true, get: function () { return authHelper_js_1.getDefaultHelperTtlMs; } });
+Object.defineProperty(exports, "getLastAuthHelperFailureReason", { enumerable: true, get: function () { return authHelper_js_1.getLastAuthHelperFailureReason; } });
+Object.defineProperty(exports, "__resetAuthHelperFailureReasonForTest", { enumerable: true, get: function () { return authHelper_js_1.__resetAuthHelperFailureReasonForTest; } });
+Object.defineProperty(exports, "SENTINEL_TRIGGERING_FAILURES", { enumerable: true, get: function () { return authHelper_js_1.SENTINEL_TRIGGERING_FAILURES; } });
+// Headers helper — invocation contract for OVERSKY_HEADERS_HELPER
+// (authenticates OverSky to outbound MCP servers)
+var headers_helper_js_1 = require("./headers-helper.js");
+Object.defineProperty(exports, "runHeadersHelper", { enumerable: true, get: function () { return headers_helper_js_1.runHeadersHelper; } });
+Object.defineProperty(exports, "invalidateHeadersHelperCache", { enumerable: true, get: function () { return headers_helper_js_1.invalidateHeadersHelperCache; } });
+// PKCE — RFC 7636 primitives for the Phase H.0 localhost-callback login.
+// Keep `safeEqual` and `verifyChallenge` exported even though they are
+// server-side concerns: server code consumes auth-core via the same
+// public surface and the alternative (a separate server-only module)
+// fragments the spec implementation across two locations.
+var pkce_js_1 = require("./pkce.js");
+Object.defineProperty(exports, "generateVerifier", { enumerable: true, get: function () { return pkce_js_1.generateVerifier; } });
+Object.defineProperty(exports, "challenge", { enumerable: true, get: function () { return pkce_js_1.challenge; } });
+Object.defineProperty(exports, "generateState", { enumerable: true, get: function () { return pkce_js_1.generateState; } });
+Object.defineProperty(exports, "safeEqual", { enumerable: true, get: function () { return pkce_js_1.safeEqual; } });
+Object.defineProperty(exports, "verifyChallenge", { enumerable: true, get: function () { return pkce_js_1.verifyChallenge; } });
+// Local 127.0.0.1 callback server — Phase H.0.2.
+// Keep error classes exported; callers branch on them to decide
+// fallback behavior (BindError → retry on different port; TimeoutError
+// → fall back to device-code; StateMismatchError → fail loudly).
+var loginLocalhost_js_1 = require("./loginLocalhost.js");
+Object.defineProperty(exports, "startLocalCallback", { enumerable: true, get: function () { return loginLocalhost_js_1.startLocalCallback; } });
+Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return loginLocalhost_js_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
+Object.defineProperty(exports, "LocalCallbackError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackError; } });
+Object.defineProperty(exports, "LocalCallbackBindError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackBindError; } });
+Object.defineProperty(exports, "LocalCallbackTimeoutError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackTimeoutError; } });
+Object.defineProperty(exports, "LocalCallbackStateMismatchError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackStateMismatchError; } });
+Object.defineProperty(exports, "LocalCallbackDeniedError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackDeniedError; } });
+Object.defineProperty(exports, "LocalCallbackMalformedError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackMalformedError; } });
+// Phase H.0.2.b — single-call orchestrator that ties PKCE + local
+// callback + server endpoints into the daemon-style token bundle.
+// Daemon/CLI consume this; auth-core is platform-agnostic via the
+// caller-injected `openBrowser` and `fetchImpl`.
+var loginWithLocalhost_js_1 = require("./loginWithLocalhost.js");
+Object.defineProperty(exports, "loginWithLocalhost", { enumerable: true, get: function () { return loginWithLocalhost_js_1.loginWithLocalhost; } });
+Object.defineProperty(exports, "LoginInitError", { enumerable: true, get: function () { return loginWithLocalhost_js_1.LoginInitError; } });
+Object.defineProperty(exports, "LoginExchangeError", { enumerable: true, get: function () { return loginWithLocalhost_js_1.LoginExchangeError; } });
+// ADD-CLI1 — shared `--ttl` parser for `create-token`. Both the
+// daemon CLI (`oversky create-token`) and the oclif CLI (`sky
+// create-token`) import from here to prevent grammar drift.
+var ttlParser_js_1 = require("./ttlParser.js");
+Object.defineProperty(exports, "parseTtlDays", { enumerable: true, get: function () { return ttlParser_js_1.parseTtlDays; } });
+Object.defineProperty(exports, "MIN_TTL_DAYS", { enumerable: true, get: function () { return ttlParser_js_1.MIN_TTL_DAYS; } });
+Object.defineProperty(exports, "MAX_TTL_DAYS", { enumerable: true, get: function () { return ttlParser_js_1.MAX_TTL_DAYS; } });
+// Tier 1 #3 — printable account-recovery code format (1Password-style
+// 11-group base32). Server, CLI, and daemon-side helper all import from here.
+var recoveryCode_js_1 = require("./recoveryCode.js");
+Object.defineProperty(exports, "formatRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.formatRecoveryCode; } });
+Object.defineProperty(exports, "parseRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.parseRecoveryCode; } });
+Object.defineProperty(exports, "normalizeRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.normalizeRecoveryCode; } });
+Object.defineProperty(exports, "isValidRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.isValidRecoveryCode; } });
+// L12 Layer 0 — at-rest credential envelope encryption primitives.
+// Pure crypto, no platform code. Daemon and CLI both consume.
+var credentialEnvelope_js_1 = require("./credentialEnvelope.js");
+Object.defineProperty(exports, "buildCredentialAad", { enumerable: true, get: function () { return credentialEnvelope_js_1.buildCredentialAad; } });
+Object.defineProperty(exports, "credEnvelopeDecrypt", { enumerable: true, get: function () { return credentialEnvelope_js_1.decrypt; } });
+Object.defineProperty(exports, "credEnvelopeDeserialize", { enumerable: true, get: function () { return credentialEnvelope_js_1.deserialize; } });
+Object.defineProperty(exports, "credEnvelopeEncrypt", { enumerable: true, get: function () { return credentialEnvelope_js_1.encrypt; } });
+Object.defineProperty(exports, "CRED_ENVELOPE_MAGIC", { enumerable: true, get: function () { return credentialEnvelope_js_1.ENVELOPE_MAGIC; } });
+Object.defineProperty(exports, "generateDek", { enumerable: true, get: function () { return credentialEnvelope_js_1.generateDek; } });
+Object.defineProperty(exports, "isCredEnvelopeString", { enumerable: true, get: function () { return credentialEnvelope_js_1.isEnvelopeString; } });
+Object.defineProperty(exports, "CRED_KEY_LEN", { enumerable: true, get: function () { return credentialEnvelope_js_1.KEY_LEN; } });
+Object.defineProperty(exports, "credOpenBuffer", { enumerable: true, get: function () { return credentialEnvelope_js_1.openBuffer; } });
+Object.defineProperty(exports, "credSealBuffer", { enumerable: true, get: function () { return credentialEnvelope_js_1.sealBuffer; } });
+Object.defineProperty(exports, "credEnvelopeSerialize", { enumerable: true, get: function () { return credentialEnvelope_js_1.serialize; } });
+Object.defineProperty(exports, "credEnvelopeUnwrap", { enumerable: true, get: function () { return credentialEnvelope_js_1.unwrap; } });
+Object.defineProperty(exports, "credEnvelopeWrap", { enumerable: true, get: function () { return credentialEnvelope_js_1.wrap; } });
+// L12 Layer 1 — KEK platform-strategy interface and implementations.
+//
+// This block used to claim "today every strategy reports available=false so
+// the daemon falls through to legacy plaintext". That has not been true since
+// the macOS `security(1)` backend (C5) and the Linux tier-3 machine-id HKDF
+// fallback shipped: on Linux `available()` is now essentially always true, and
+// on macOS it is true whenever a login keychain resolves. The stale note is
+// worth calling out rather than deleting, because four daemon suites were
+// written against it and only failed once CI first ran them on Linux.
+//
+// Tests that need the unavailable branch must inject `UnavailableKek`;
+// `__setKekStrategyForTest(null)` restores the PLATFORM default, which is not
+// the same thing and differs per OS.
+var index_js_1 = require("./kek/index.js");
+Object.defineProperty(exports, "__setKekStrategyForTest", { enumerable: true, get: function () { return index_js_1.__setKekStrategyForTest; } });
+Object.defineProperty(exports, "getKekStrategy", { enumerable: true, get: function () { return index_js_1.getKekStrategy; } });
+Object.defineProperty(exports, "InMemoryKek", { enumerable: true, get: function () { return index_js_1.InMemoryKek; } });
+Object.defineProperty(exports, "UnavailableKek", { enumerable: true, get: function () { return index_js_1.UnavailableKek; } });
+Object.defineProperty(exports, "KekUnavailableError", { enumerable: true, get: function () { return index_js_1.KekUnavailableError; } });
+Object.defineProperty(exports, "LinuxKek", { enumerable: true, get: function () { return index_js_1.LinuxKek; } });
+Object.defineProperty(exports, "MacosKek", { enumerable: true, get: function () { return index_js_1.MacosKek; } });
+Object.defineProperty(exports, "registerZeroizeHook", { enumerable: true, get: function () { return index_js_1.registerZeroizeHook; } });
+Object.defineProperty(exports, "WindowsKek", { enumerable: true, get: function () { return index_js_1.WindowsKek; } });
+Object.defineProperty(exports, "zeroizeKekCaches", { enumerable: true, get: function () { return index_js_1.zeroizeKekCaches; } });
+// L11 Phase 1 — Device identity (Ed25519) + DPoP-shaped proof JWS.
+// The crypto half of the two-axis identity story; daemon-side
+// persistence + signing lives in `daemon/src/deviceIdentity.ts`.
+// Server-side verification middleware is a later PR.
+var deviceKey_js_1 = require("./deviceKey.js");
+Object.defineProperty(exports, "buildDeviceProof", { enumerable: true, get: function () { return deviceKey_js_1.buildProof; } });
+Object.defineProperty(exports, "generateDeviceKeyPair", { enumerable: true, get: function () { return deviceKey_js_1.generateDeviceKeyPair; } });
+Object.defineProperty(exports, "jwkThumbprint", { enumerable: true, get: function () { return deviceKey_js_1.jwkThumbprint; } });
+Object.defineProperty(exports, "normalizeHtu", { enumerable: true, get: function () { return deviceKey_js_1.normalizeHtu; } });
+Object.defineProperty(exports, "publicJwkFromX", { enumerable: true, get: function () { return deviceKey_js_1.publicJwkFromX; } });
+Object.defineProperty(exports, "tokenHash", { enumerable: true, get: function () { return deviceKey_js_1.tokenHash; } });
+Object.defineProperty(exports, "verifyDeviceProof", { enumerable: true, get: function () { return deviceKey_js_1.verifyProof; } });
+// L11/L12 — composed runtime: init, transforms, sign, enroll, locks.
+// Daemon and CLI consume these; the underlying primitives live above.
+var credentialEnvelopeBridge_js_1 = require("./credentialEnvelopeBridge.js");
+// credEnvelope bridge
+Object.defineProperty(exports, "initCredEnvelope", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.initCredEnvelope; } });
+Object.defineProperty(exports, "resetCredEnvelope", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.resetCredEnvelope; } });
+Object.defineProperty(exports, "shutdownCredEnvelope", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.shutdownCredEnvelope; } });
+Object.defineProperty(exports, "isCredEnvelopeActive", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.isCredEnvelopeActive; } });
+Object.defineProperty(exports, "describeCredEnvelopeState", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.describeCredEnvelopeState; } });
+Object.defineProperty(exports, "maybeEncryptForWrite", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeEncryptForWrite; } });
+Object.defineProperty(exports, "maybeDecryptOnRead", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeDecryptOnRead; } });
+// Test seams — `__`-prefixed so consumers don't import them in
+// production code paths. Re-exported here so CLI/daemon spec files
+// can resolve the wrapped-DEK path against the same module instance.
+Object.defineProperty(exports, "__wrappedDekFilePathForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__wrappedDekFilePathForTest; } });
+Object.defineProperty(exports, "__setCredEnvelopeStateForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__setStateForTest; } });
+Object.defineProperty(exports, "__getCredEnvelopeStateForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__getStateForTest; } });
+Object.defineProperty(exports, "__resetShutdownGuardForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__resetShutdownGuardForTest; } });
+var deviceIdentityBridge_js_1 = require("./deviceIdentityBridge.js");
+// deviceIdentity bridge
+Object.defineProperty(exports, "initDeviceIdentity", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.initDeviceIdentity; } });
+Object.defineProperty(exports, "resetDeviceIdentity", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.resetDeviceIdentity; } });
+Object.defineProperty(exports, "signServerRequest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.signServerRequest; } });
+Object.defineProperty(exports, "enrollWithServer", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.enrollWithServer; } });
+Object.defineProperty(exports, "clearEnrollmentMarker", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.clearEnrollmentMarker; } });
+Object.defineProperty(exports, "isDeviceIdentityActive", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.isDeviceIdentityActive; } });
+Object.defineProperty(exports, "getDevicePublicKey", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.getDevicePublicKey; } });
+Object.defineProperty(exports, "describeDeviceIdentityState", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.describeDeviceIdentityState; } });
+// Test seams — file path resolvers + state setters for spec files.
+Object.defineProperty(exports, "__publicKeyPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__publicKeyPathForTest; } });
+Object.defineProperty(exports, "__privateKeyPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__privateKeyPathForTest; } });
+Object.defineProperty(exports, "__enrollmentMarkerPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__enrollmentMarkerPathForTest; } });
+Object.defineProperty(exports, "__enrollmentBackoffPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__enrollmentBackoffPathForTest; } });
+Object.defineProperty(exports, "__setDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__setStateForTest; } });
+Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__getStateForTest; } });
+// Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
+var machineId_js_1 = require("./machineId.js");
+Object.defineProperty(exports, "ensureMachineDaemonId", { enumerable: true, get: function () { return machineId_js_1.ensureMachineDaemonId; } });
+Object.defineProperty(exports, "legacyDaemonUuids", { enumerable: true, get: function () { return machineId_js_1.legacyDaemonUuids; } });
+Object.defineProperty(exports, "__resetCachedDaemonIdForTest", { enumerable: true, get: function () { return machineId_js_1.__resetCachedDaemonIdForTest; } });
+// Tier 1 #2 — daemon QR pairing primitives. Pure crypto + AAD framing,
+// shared between the daemon CLI orchestrator (`daemon/src/pair.ts`) and
+// any future native-app callers. The mobile RN client mirrors the same
+// shapes locally because it can't pull a Node-shaped package.
+var daemonPair_js_1 = require("./daemonPair.js");
+Object.defineProperty(exports, "PAIR_AAD_PREFIX", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_AAD_PREFIX; } });
+Object.defineProperty(exports, "PAIR_AAD_MAX_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_AAD_MAX_LEN; } });
+Object.defineProperty(exports, "PAIR_BUNDLE_MAX_BASE64_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_BUNDLE_MAX_BASE64_LEN; } });
+Object.defineProperty(exports, "PAIR_NONCE_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_NONCE_LEN; } });
+Object.defineProperty(exports, "PAIR_PUBKEY_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_PUBKEY_LEN; } });
+Object.defineProperty(exports, "PAIR_SECRET_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_SECRET_LEN; } });
+Object.defineProperty(exports, "PairBundleError", { enumerable: true, get: function () { return daemonPair_js_1.PairBundleError; } });
+Object.defineProperty(exports, "assemblePairBundleBase64", { enumerable: true, get: function () { return daemonPair_js_1.assemblePairBundleBase64; } });
+Object.defineProperty(exports, "pairBase64ToUint8Array", { enumerable: true, get: function () { return daemonPair_js_1.base64ToUint8Array; } });
+Object.defineProperty(exports, "pairBase64UrlToUint8Array", { enumerable: true, get: function () { return daemonPair_js_1.base64UrlToUint8Array; } });
+Object.defineProperty(exports, "buildPairAad", { enumerable: true, get: function () { return daemonPair_js_1.buildPairAad; } });
+Object.defineProperty(exports, "buildPairUrl", { enumerable: true, get: function () { return daemonPair_js_1.buildPairUrl; } });
+Object.defineProperty(exports, "generatePairKeyPair", { enumerable: true, get: function () { return daemonPair_js_1.generatePairKeyPair; } });
+Object.defineProperty(exports, "openPairBundleBase64", { enumerable: true, get: function () { return daemonPair_js_1.openPairBundleBase64; } });
+Object.defineProperty(exports, "parsePairBundle", { enumerable: true, get: function () { return daemonPair_js_1.parsePairBundle; } });
+Object.defineProperty(exports, "parsePairPlaintext", { enumerable: true, get: function () { return daemonPair_js_1.parsePairPlaintext; } });
+Object.defineProperty(exports, "parsePairUrl", { enumerable: true, get: function () { return daemonPair_js_1.parsePairUrl; } });
+Object.defineProperty(exports, "pairUint8ArrayToBase64", { enumerable: true, get: function () { return daemonPair_js_1.uint8ArrayToBase64; } });
+Object.defineProperty(exports, "pairUint8ArrayToBase64Url", { enumerable: true, get: function () { return daemonPair_js_1.uint8ArrayToBase64Url; } });
+// OSK-3897 — harness trust tiers, shared by the daemon (the authority) and the
+// CLI (which publishes the fact in `sky code doctor`). The PROVENANCE half stays
+// in the daemon on purpose: a tier is a published fact, provenance is evidence
+// about bytes on disk that only the spawning process can gather.
+var harnessTrust_js_1 = require("./harnessTrust.js");
+Object.defineProperty(exports, "HARNESS_TIERS", { enumerable: true, get: function () { return harnessTrust_js_1.HARNESS_TIERS; } });
+Object.defineProperty(exports, "getHarnessTier", { enumerable: true, get: function () { return harnessTrust_js_1.getHarnessTier; } });
+Object.defineProperty(exports, "credentialPolicyForTier", { enumerable: true, get: function () { return harnessTrust_js_1.credentialPolicyForTier; } });
+Object.defineProperty(exports, "tierPermitsConfiguredAutoMode", { enumerable: true, get: function () { return harnessTrust_js_1.tierPermitsConfiguredAutoMode; } });
+// OSK-3892 — spawn-env sanitization, shared by the daemon (which has stripped
+// its own credentials before every harness spawn all along) and the CLI (which
+// spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
+// these so its own importers are unchanged, and keeps `filterCustomEnv` — that
+// governs SERVER-PROVIDED env, which no other process is handed.
+var spawnEnv_js_1 = require("./spawnEnv.js");
+Object.defineProperty(exports, "sanitizeSpawnEnv", { enumerable: true, get: function () { return spawnEnv_js_1.sanitizeSpawnEnv; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_VARS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_VARS; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIXES; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
+/* Local-machine identity — the names this product leaves on a disk. Exported so
+   the CLI, daemon and Desktop share one definition instead of 47 literals. */
+var localIdentity_js_1 = require("./localIdentity.js");
+Object.defineProperty(exports, "CONFIG_DIR_NAME", { enumerable: true, get: function () { return localIdentity_js_1.CONFIG_DIR_NAME; } });
+Object.defineProperty(exports, "LEGACY_CONFIG_DIR_NAMES", { enumerable: true, get: function () { return localIdentity_js_1.LEGACY_CONFIG_DIR_NAMES; } });
+Object.defineProperty(exports, "NATIVE_ID_PREFIX", { enumerable: true, get: function () { return localIdentity_js_1.NATIVE_ID_PREFIX; } });
+Object.defineProperty(exports, "LEGACY_NATIVE_ID_PREFIXES", { enumerable: true, get: function () { return localIdentity_js_1.LEGACY_NATIVE_ID_PREFIXES; } });
+Object.defineProperty(exports, "DEFAULT_BINARY_NAME", { enumerable: true, get: function () { return localIdentity_js_1.DEFAULT_BINARY_NAME; } });
+/* Pre-rename state detection. Callers REFUSE on a positive result; nothing here
+   reads, copies or removes what it finds (§7.2, §8.4). */
+var legacyStatePreflight_js_1 = require("./legacyStatePreflight.js");
+Object.defineProperty(exports, "findLegacyLocalState", { enumerable: true, get: function () { return legacyStatePreflight_js_1.findLegacyLocalState; } });
+Object.defineProperty(exports, "describeLegacyState", { enumerable: true, get: function () { return legacyStatePreflight_js_1.describeLegacyState; } });

package/dist/cjs/jwtUtils.d.ts

@@ -0,0 +1,35 @@
+/**
+ * jwtUtils.ts — signature-less JWT payload inspection.
+ *
+ * Used by the proactive refresh scheduler to read the `exp` claim off an
+ * access token without round-tripping to the server. We do NOT verify the
+ * signature here — the token is one the server just issued to us, and any
+ * tampering would surface as a 401 on the next API call anyway.
+ *
+ * THEREFORE: NOTHING THESE FUNCTIONS RETURN MAY DECIDE WHAT THE HOLDER IS
+ * ALLOWED TO DO.
+ *
+ * The reasoning above is only sound because the decoded values are used to
+ * schedule work (when to refresh) and to pick a local code path — never to
+ * grant anything. A claim read here is attacker-controlled input in the exact
+ * case that matters: anyone who can write the credential file, set the env var,
+ * or hand us a token over an fd can put any `scope`, `role`, `exp` or `sub` in
+ * it, because forging a payload requires no key when nobody checks the
+ * signature. "It would 401 later" is not a control if the decision was already
+ * made locally before any call went out.
+ *
+ * Safe: refresh timing, telemetry, diagnostics, choosing which resolver branch
+ * to take. Unsafe: gating a capability, trusting an identity, skipping a check,
+ * widening a scope. If you need a claim you can trust, verify the signature or
+ * ask the server.
+ *
+ * `credentialResolver.classifyTokenKind` is the one non-`exp` reader today; see
+ * the note there for why routing on `scope` is not an authorization decision.
+ */
+/** Base64url-decode the middle segment of a JWT and JSON-parse it. */
+export declare function decodeJwtPayload(token: string): unknown | null;
+/**
+ * Decode the `exp` (expiry) claim from a JWT without verifying the signature.
+ * @returns The `exp` value in Unix seconds, or `null` if unparseable / missing.
+ */
+export declare function decodeJwtExpiry(token: string): number | null;

package/dist/cjs/jwtUtils.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * jwtUtils.ts — signature-less JWT payload inspection.
+ *
+ * Used by the proactive refresh scheduler to read the `exp` claim off an
+ * access token without round-tripping to the server. We do NOT verify the
+ * signature here — the token is one the server just issued to us, and any
+ * tampering would surface as a 401 on the next API call anyway.
+ *
+ * THEREFORE: NOTHING THESE FUNCTIONS RETURN MAY DECIDE WHAT THE HOLDER IS
+ * ALLOWED TO DO.
+ *
+ * The reasoning above is only sound because the decoded values are used to
+ * schedule work (when to refresh) and to pick a local code path — never to
+ * grant anything. A claim read here is attacker-controlled input in the exact
+ * case that matters: anyone who can write the credential file, set the env var,
+ * or hand us a token over an fd can put any `scope`, `role`, `exp` or `sub` in
+ * it, because forging a payload requires no key when nobody checks the
+ * signature. "It would 401 later" is not a control if the decision was already
+ * made locally before any call went out.
+ *
+ * Safe: refresh timing, telemetry, diagnostics, choosing which resolver branch
+ * to take. Unsafe: gating a capability, trusting an identity, skipping a check,
+ * widening a scope. If you need a claim you can trust, verify the signature or
+ * ask the server.
+ *
+ * `credentialResolver.classifyTokenKind` is the one non-`exp` reader today; see
+ * the note there for why routing on `scope` is not an authorization decision.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwtPayload = decodeJwtPayload;
+exports.decodeJwtExpiry = decodeJwtExpiry;
+/** Base64url-decode the middle segment of a JWT and JSON-parse it. */
+function decodeJwtPayload(token) {
+    if (typeof token !== 'string' || token.length === 0)
+        return null;
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[1])
+        return null;
+    try {
+        const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decode the `exp` (expiry) claim from a JWT without verifying the signature.
+ * @returns The `exp` value in Unix seconds, or `null` if unparseable / missing.
+ */
+function decodeJwtExpiry(token) {
+    const payload = decodeJwtPayload(token);
+    if (payload !== null &&
+        typeof payload === 'object' &&
+        'exp' in payload &&
+        typeof payload.exp === 'number') {
+        return payload.exp;
+    }
+    return null;
+}

package/dist/cjs/kek/index.d.ts

@@ -0,0 +1,89 @@
+/**
+ * kek/index.ts — platform selector for the Key Encryption Key strategy.
+ *
+ * Resolves a single KEK implementation based on `process.platform` at
+ * call time. The returned strategy may report `available=false` (e.g.,
+ * the native binding hasn't shipped on the current platform yet) — the
+ * daemon's integration code MUST honor that and fall through to the
+ * legacy plaintext path with a `cred_envelope.kek_unavailable` event.
+ *
+ * Test seam: `__setKekStrategyForTest()` lets unit tests inject a
+ * synthetic strategy with a deterministic in-memory KEK so the
+ * dual-read / re-encrypt-on-migration paths can be exercised without a
+ * real platform binding.
+ */
+import type { KekStrategy } from './types.js';
+export type { KekStrategy } from './types.js';
+export { KekUnavailableError } from './types.js';
+export { MacosKek } from './macos.js';
+export { LinuxKek } from './linux.js';
+export { WindowsKek } from './windows.js';
+export { zeroizeKekCaches, registerZeroizeHook } from './zeroize-registry.js';
+/**
+ * @internal Test-only seam — inject a synthetic KEK strategy that wraps
+ * with a fixed in-memory key. Resets to platform default when called
+ * with `null`.
+ */
+export declare function __setKekStrategyForTest(strategy: KekStrategy | null): void;
+/**
+ * Resolve the KEK strategy for the current process. Returns the test
+ * override when set; otherwise selects by `process.platform`.
+ *
+ * Idempotent and side-effect-free — the strategy is constructed fresh
+ * on each call. Implementations must keep their own caches if probing
+ * is expensive (none of the current stubs do).
+ */
+export declare function getKekStrategy(): KekStrategy;
+/**
+ * In-memory KEK strategy backed by a fixed buffer. Useful for tests and
+ * for a future `--kek=file:<path>` opt-in for users who explicitly
+ * waive platform-native protection (e.g., headless CI on a hardened
+ * VM where DPAPI isn't reachable). Do NOT default to this in production
+ * paths — it provides no protection beyond filesystem permissions on
+ * whatever holds the buffer.
+ */
+export declare class InMemoryKek implements KekStrategy {
+    readonly id = "in-memory-test";
+    private readonly key;
+    constructor(key: Buffer);
+    /**
+     * Stable backend identifier surfaced via `KekStrategy.kind`. Distinct
+     * from the MacosKek shellout / NAPI kinds so telemetry filters can
+     * exclude in-memory test traffic from fleet dashboards.
+     */
+    get kind(): string;
+    available(): Promise<boolean>;
+    wrap(dek: Buffer, aad?: Buffer): Promise<Buffer>;
+    unwrap(wrapped: Buffer, aad?: Buffer): Promise<Buffer>;
+    unwrapExisting(wrapped: Buffer, aad?: Buffer): Promise<Buffer>;
+    describe(): string;
+}
+/**
+ * Test double for the KEK-UNAVAILABLE branch — the twin of `InMemoryKek`.
+ *
+ * It exists because "no KEK on this platform" cannot be expressed by passing
+ * `null` to `__setKekStrategyForTest`. `null` means "use the platform
+ * default", and the platform defaults do not agree: `LinuxKek` essentially
+ * always resolves (tier-3 derives a KEK from machine identity when libsecret
+ * is absent), `MacosKek` resolves only when a login keychain can be found —
+ * which a test that sandboxes `HOME` accidentally prevents — and `WindowsKek`
+ * is still a stub. A suite that wants the unavailable branch and passes `null`
+ * is therefore not testing that branch; it is testing which machine it landed
+ * on, and it flips from green to red when the machine changes.
+ *
+ * That is not hypothetical: four daemon suites asserting fail-closed behaviour
+ * passed on macOS purely because their temp `HOME` hid the keychain, and went
+ * red the first time CI ever executed them on Linux.
+ *
+ * `wrap`/`unwrap` throw rather than returning junk, matching the contract in
+ * `types.ts`: a strategy that reports unavailable must never silently produce
+ * ciphertext a caller could mistake for protected material.
+ */
+export declare class UnavailableKek implements KekStrategy {
+    readonly id = "unavailable-test";
+    get kind(): string;
+    available(): Promise<boolean>;
+    wrap(): Promise<Buffer>;
+    unwrap(): Promise<Buffer>;
+    describe(): string;
+}