@skrr-ai/auth-core 0.1.2

package/dist/esm/daemonScopes.d.ts

@@ -0,0 +1,74 @@
+/**
+ * daemonScopes.ts — daemon-capability scope vocabulary for the
+ * non-Mongoose tier.
+ *
+ * The schema-bound canonical home is
+ * `@skrr-ai/data-schemas/common/daemonScopes` — that file owns the
+ * Mongoose validators (`VALID_SCOPE_SET`, schema enum allowlists), the
+ * consent-screen group metadata (`SCOPE_GROUPS`), and the helper
+ * functions that the API server depends on at runtime.
+ *
+ * This file is the parallel home for tiers that cannot import
+ * `@skrr-ai/data-schemas` without dragging Mongoose into their
+ * bundle:
+ *   - `daemon/` (Node CLI / standalone binary, ships via Bun compile)
+ *   - `desktop/` (Electron main process, lean bundle)
+ *   - `cli/` (oclif Sky CLI)
+ *
+ * The two homes are kept byte-equal at CI time by
+ * `api/server/services/Auth/__tests__/daemonScopes.parity.spec.js`.
+ * A new scope MUST be added in BOTH files; the parity test fails on
+ * any drift before merge.
+ *
+ * # Vocabulary stability
+ *
+ * The six strings are user-visible (consent screens) and persisted
+ * (JWT claims, Mongo column values, Redis hash fields, audit logs).
+ * Renaming a scope is a breaking change for every credential already
+ * minted with the old value. Add new scopes, deprecate old ones —
+ * never rename in place.
+ */
+/**
+ * The canonical daemon scope vocabulary. Six strings, frozen.
+ *
+ *   - `daemon:tools:bash`        — bash tool execution
+ *   - `daemon:tools:fs:read`     — Read tool (file read)
+ *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
+ *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:session:replay`    — `daemon:session:replay` socket event
+ *   - `daemon:offline-queue`     — daemon-initiated offline queue
+ *
+ * Order is the consent-screen render order: tools-first, I/O second,
+ * control-flow last.
+ */
+export declare const SCOPES: Readonly<{
+    readonly TOOLS_BASH: "daemon:tools:bash";
+    readonly TOOLS_FS_READ: "daemon:tools:fs:read";
+    readonly TOOLS_FS_WRITE: "daemon:tools:fs:write";
+    readonly BROWSER_CDP: "daemon:browser:cdp";
+    readonly SESSION_REPLAY: "daemon:session:replay";
+    readonly OFFLINE_QUEUE: "daemon:offline-queue";
+}>;
+export type DaemonScope = (typeof SCOPES)[keyof typeof SCOPES];
+/**
+ * The six daemon scopes in canonical order. Frozen so consumers can
+ * pass it directly to OAuth `scope` parameters without defensive
+ * copies.
+ */
+export declare const ALL_DAEMON_SCOPES: readonly DaemonScope[];
+/**
+ * Set form of `ALL_DAEMON_SCOPES` for O(1) membership checks.
+ */
+export declare const VALID_DAEMON_SCOPE_SET: ReadonlySet<string>;
+/** Type guard for canonical daemon-scope strings. */
+export declare function isDaemonScope(s: unknown): s is DaemonScope;
+/**
+ * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
+ * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * the `oversky-cli` client. See the data-schemas canonical for the
+ * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
+ * grandfather sentinel `expandScopes(undefined)` would over-grant).
+ */
+export declare const OAUTH_CLI_SCOPE: "cli";
+export type OAuthCliScope = typeof OAUTH_CLI_SCOPE;
+export type OAuthScope = DaemonScope | OAuthCliScope;

package/dist/esm/daemonScopes.js

@@ -0,0 +1,80 @@
+/**
+ * daemonScopes.ts — daemon-capability scope vocabulary for the
+ * non-Mongoose tier.
+ *
+ * The schema-bound canonical home is
+ * `@skrr-ai/data-schemas/common/daemonScopes` — that file owns the
+ * Mongoose validators (`VALID_SCOPE_SET`, schema enum allowlists), the
+ * consent-screen group metadata (`SCOPE_GROUPS`), and the helper
+ * functions that the API server depends on at runtime.
+ *
+ * This file is the parallel home for tiers that cannot import
+ * `@skrr-ai/data-schemas` without dragging Mongoose into their
+ * bundle:
+ *   - `daemon/` (Node CLI / standalone binary, ships via Bun compile)
+ *   - `desktop/` (Electron main process, lean bundle)
+ *   - `cli/` (oclif Sky CLI)
+ *
+ * The two homes are kept byte-equal at CI time by
+ * `api/server/services/Auth/__tests__/daemonScopes.parity.spec.js`.
+ * A new scope MUST be added in BOTH files; the parity test fails on
+ * any drift before merge.
+ *
+ * # Vocabulary stability
+ *
+ * The six strings are user-visible (consent screens) and persisted
+ * (JWT claims, Mongo column values, Redis hash fields, audit logs).
+ * Renaming a scope is a breaking change for every credential already
+ * minted with the old value. Add new scopes, deprecate old ones —
+ * never rename in place.
+ */
+/**
+ * The canonical daemon scope vocabulary. Six strings, frozen.
+ *
+ *   - `daemon:tools:bash`        — bash tool execution
+ *   - `daemon:tools:fs:read`     — Read tool (file read)
+ *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
+ *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:session:replay`    — `daemon:session:replay` socket event
+ *   - `daemon:offline-queue`     — daemon-initiated offline queue
+ *
+ * Order is the consent-screen render order: tools-first, I/O second,
+ * control-flow last.
+ */
+export const SCOPES = Object.freeze({
+    TOOLS_BASH: 'daemon:tools:bash',
+    TOOLS_FS_READ: 'daemon:tools:fs:read',
+    TOOLS_FS_WRITE: 'daemon:tools:fs:write',
+    BROWSER_CDP: 'daemon:browser:cdp',
+    SESSION_REPLAY: 'daemon:session:replay',
+    OFFLINE_QUEUE: 'daemon:offline-queue',
+});
+/**
+ * The six daemon scopes in canonical order. Frozen so consumers can
+ * pass it directly to OAuth `scope` parameters without defensive
+ * copies.
+ */
+export const ALL_DAEMON_SCOPES = Object.freeze([
+    SCOPES.TOOLS_BASH,
+    SCOPES.TOOLS_FS_READ,
+    SCOPES.TOOLS_FS_WRITE,
+    SCOPES.BROWSER_CDP,
+    SCOPES.SESSION_REPLAY,
+    SCOPES.OFFLINE_QUEUE,
+]);
+/**
+ * Set form of `ALL_DAEMON_SCOPES` for O(1) membership checks.
+ */
+export const VALID_DAEMON_SCOPE_SET = new Set(ALL_DAEMON_SCOPES);
+/** Type guard for canonical daemon-scope strings. */
+export function isDaemonScope(s) {
+    return typeof s === 'string' && VALID_DAEMON_SCOPE_SET.has(s);
+}
+/**
+ * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
+ * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * the `oversky-cli` client. See the data-schemas canonical for the
+ * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
+ * grandfather sentinel `expandScopes(undefined)` would over-grant).
+ */
+export const OAUTH_CLI_SCOPE = 'cli';

package/dist/esm/deviceIdentityBridge.d.ts

@@ -0,0 +1,113 @@
+import { type DeviceKeyPair, type Ed25519PublicJwk } from './deviceKey.js';
+type DeviceIdentityState = {
+    kind: 'uninit';
+} | {
+    kind: 'disabled';
+    reason: DisabledReason;
+} | {
+    kind: 'active';
+    keypair: DeviceKeyPair;
+    profile: string;
+    envelopeProtected: boolean;
+};
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
+/** @internal Test seam — force-set state. */
+export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
+/** @internal Test seam — read state. */
+export declare function __getStateForTest(): DeviceIdentityState;
+/**
+ * Initialize device identity. Idempotent.
+ *
+ * Order:
+ *   1. Try to load existing keypair from disk.
+ *      - Success → state = active.
+ *      - Missing files / corruption / decrypt failure → step 2.
+ *   2. Generate fresh keypair and persist. Failure to persist is a hard
+ *      error landing in disabled+persist_failed.
+ */
+export declare function initDeviceIdentity(profile: string): Promise<void>;
+/**
+ * Reset state. With `clearOnDisk=true` deletes both keypair files —
+ * used by `oversky logout` / `sky logout` so a freshly-logged-in user
+ * gets a fresh device identity that the daemon will see on its next start.
+ */
+export declare function resetDeviceIdentity(opts?: {
+    profile?: string;
+    clearOnDisk?: boolean;
+}): Promise<void>;
+/** True iff init has completed and a keypair is in memory. */
+export declare function isDeviceIdentityActive(): boolean;
+/**
+ * Export the public key for server enrollment / dashboard display.
+ * Returns null when not active so callers know to skip the JWS header
+ * on the in-flight request.
+ */
+export declare function getDevicePublicKey(): {
+    jwk: Ed25519PublicJwk;
+    thumbprint: string;
+} | null;
+/**
+ * Operator-readable summary of device-identity state. Used by
+ * `oversky status` and CLI debug commands. Never includes the private key.
+ */
+export declare function describeDeviceIdentityState(): {
+    kind: DeviceIdentityState['kind'];
+    reason?: DisabledReason;
+    thumbprint?: string;
+    profile?: string;
+    envelopeProtected?: boolean;
+};
+/**
+ * Sign an outgoing request with the device key. Returns the JWS Compact
+ * Serialization, or null when device identity is not active. NEVER
+ * throws — a failed sign returns null and emits a telemetry event so
+ * the caller can fall back to bearer-only auth without an outage.
+ *
+ * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
+ * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
+ */
+export declare function signServerRequest(opts: {
+    method: string;
+    url: string;
+    refreshToken?: string;
+    accessToken?: string;
+}): string | null;
+/** @internal Test seams — file path resolvers. */
+export declare function __publicKeyPathForTest(profile: string): string;
+export declare function __privateKeyPathForTest(profile: string): string;
+export declare function __enrollmentMarkerPathForTest(profile: string): string;
+export declare function __enrollmentBackoffPathForTest(profile: string): string;
+/** Remove the enrollment marker so re-login gets a fresh enrollment. */
+export declare function clearEnrollmentMarker(profile: string): void;
+export type EnrollmentResult = {
+    enrolled: true;
+    thumbprint: string;
+} | {
+    enrolled: false;
+    reason: 'not_active' | 'already_persisted' | 'backoff_active' | 'http_error' | 'network_error';
+    status?: number;
+    body?: string;
+    message?: string;
+};
+/**
+ * POST the device public key to the server for enrollment.
+ *
+ * Idempotent across boots — the marker file short-circuits subsequent
+ * calls. The marker stores serverUrl + thumbprint so a URL change
+ * (staging → prod swap) forces fresh enrollment.
+ *
+ * Fire-and-forget contract — callers should `.catch()` so a network
+ * partition at startup cannot stall the consumer's command path.
+ *
+ * NOTE: Both `sky` and `oversky` may race to enroll the same shared
+ * keypair. The server's `enroll-device-key` route is idempotent on
+ * `(machineUuid, publicJwkX)` so a duplicate POST is safe; whichever
+ * binary writes its marker file first short-circuits the other.
+ */
+export declare function enrollWithServer(opts: {
+    serverUrl: string;
+    accessToken: string;
+    machineUuid: string;
+    signal?: AbortSignal;
+}): Promise<EnrollmentResult>;
+export {};