@skrr-ai/cli 0.1.101 → 0.1.103

package/dist/lib/workflow-node-control.d.ts

@@ -0,0 +1,10 @@
+import type { WorkflowReviewedCancellationScope } from '@skrr-ai/data-provider';
+/** Freeze the saved canonical selection. This command performs no live reads. */
+export declare function nodeCancellationFromSnapshot(spaceId: string, runId: string, nodeKey: string, snapshot: Record<string, unknown>, reason?: string): {
+    expectedRunGeneration: number;
+    expectedGeneration: number;
+    expectedAttempt: string;
+    expectedTaskRunId: string | null;
+    expectedScopeNode: WorkflowReviewedCancellationScope['nodes'][number];
+    reason?: string;
+};

package/dist/lib/workflow-node-control.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeCancellationFromSnapshot = nodeCancellationFromSnapshot;
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function integer(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+function id(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 160;
+}
+/** Freeze the saved canonical selection. This command performs no live reads. */
+function nodeCancellationFromSnapshot(spaceId, runId, nodeKey, snapshot, reason) {
+    if (snapshot.id !== runId || snapshot.spaceId !== spaceId || !integer(snapshot.generation) || !Array.isArray(snapshot.nodes)) {
+        throw new Error('Use a saved canonical run snapshot for this exact Space and workflow run.');
+    }
+    const selected = snapshot.nodes.filter((node) => record(node) && node.nodeKey === nodeKey);
+    const node = selected[0];
+    if (selected.length !== 1 || !record(node) || !id(node.id) || node.workflowRunId !== runId
+        || !integer(node.iteration) || !integer(node.planGeneration) || !id(node.nodeType)) {
+        throw new Error('The saved snapshot must contain one exact node attempt and its generation.');
+    }
+    if (node.taskRunId != null && !id(node.taskRunId))
+        throw new Error('The saved TaskRun pin is invalid.');
+    if (reason !== undefined && reason.length > 500)
+        throw new Error('The cancellation reason must be at most 500 characters.');
+    const expectedScopeNode = {
+        id: node.id, workflowRunId: runId, iteration: node.iteration,
+        planGeneration: node.planGeneration, nodeType: node.nodeType,
+    };
+    for (const key of ['taskId', 'taskRunId', 'autonomousRunId']) {
+        const value = node[key];
+        if (value == null)
+            continue;
+        if (!id(value))
+            throw new Error(`The saved ${key} pin is invalid.`);
+        Object.assign(expectedScopeNode, { [key]: value });
+    }
+    // Explicit physical absence is a boundary. The canonical service refuses
+    // an executor that appears later rather than discovering it during a stop.
+    if (node.sessionId != null && !id(node.sessionId))
+        throw new Error('The saved session pin is invalid.');
+    expectedScopeNode.sessionId = node.sessionId == null ? null : node.sessionId;
+    const executor = (value) => {
+        if (value == null)
+            return null;
+        if (!record(value) || !id(value.kind) || !id(value.runId) || !integer(value.generation) || !integer(value.attempt)) {
+            throw new Error('The saved physical executor attempt is invalid.');
+        }
+        return { kind: value.kind, runId: value.runId, generation: value.generation, attempt: value.attempt };
+    };
+    expectedScopeNode.executorAttemptRef = executor(node.executorAttemptRef);
+    if (node.waitingFor !== undefined) {
+        const waitingFor = node.waitingFor;
+        if (!record(waitingFor))
+            throw new Error('The saved child execution scope is invalid.');
+        const keys = ['kind', 'eventKey', 'workflowRunId', 'index', 'phase', 'round', 'reviewTaskIds', 'reviseTaskId', 'executions'];
+        expectedScopeNode.waitingFor = Object.fromEntries(keys.filter((key) => waitingFor[key] !== undefined)
+            .map((key) => [key, waitingFor[key]]));
+    }
+    if (node.executorPins !== undefined) {
+        if (!Array.isArray(node.executorPins))
+            throw new Error('The saved executor set is invalid.');
+        expectedScopeNode.executorPins = node.executorPins.map((pin) => {
+            if (!record(pin) || !id(pin.taskId) || (pin.runId !== null && !id(pin.runId))
+                || (pin.sessionId != null && !id(pin.sessionId)))
+                throw new Error('The saved executor set is invalid.');
+            return { taskId: pin.taskId, runId: pin.runId, sessionId: pin.sessionId == null ? null : pin.sessionId,
+                executorAttemptRef: executor(pin.executorAttemptRef) };
+        });
+    }
+    return { expectedRunGeneration: snapshot.generation, expectedGeneration: node.planGeneration, expectedAttempt: node.id,
+        expectedTaskRunId: node.taskRunId == null ? null : node.taskRunId, expectedScopeNode,
+        ...(reason !== undefined ? { reason } : {}) };
+}

package/dist/lib/workspaces.d.ts

@@ -4,6 +4,8 @@ export interface StewardshipSource {
     status: 'available' | 'unavailable';
     truncated: boolean;
     code?: string;
+    /** `unattributedGrants` only: Grants in this workspace by Agent or Commitment that carry no workspace stamp and so are not listed. */
+    unlisted?: number;
 }
 export interface StewardshipCoverage {
     complete: boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -47,9 +47,17 @@ export declare function describeDeviceKeySplit(profile: string): {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 export declare function initDeviceIdentity(profile: string, options?: {
     recoverUnreadable?: boolean;
+    createIfMissing?: boolean;
 }): Promise<void>;
 /**
  * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -364,6 +364,13 @@ async function consolidateDeviceIdentity(profile) {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
@@ -412,6 +419,11 @@ async function initDeviceIdentity(profile, options = {}) {
         emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
         return;
     }
+    if (options.createIfMissing === false) {
+        _state = { kind: 'disabled', reason: 'no_stored_key' };
+        emit('no_stored_key', false, { profile });
+        return;
+    }
     let fresh;
     try {
         fresh = (0, deviceKey_js_1.generateDeviceKeyPair)();

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -47,9 +47,17 @@ export declare function describeDeviceKeySplit(profile: string): {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 export declare function initDeviceIdentity(profile: string, options?: {
     recoverUnreadable?: boolean;
+    createIfMissing?: boolean;
 }): Promise<void>;
 /**
  * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -344,6 +344,13 @@ async function consolidateDeviceIdentity(profile) {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 export async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
@@ -392,6 +399,11 @@ export async function initDeviceIdentity(profile, options = {}) {
         emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
         return;
     }
+    if (options.createIfMissing === false) {
+        _state = { kind: 'disabled', reason: 'no_stored_key' };
+        emit('no_stored_key', false, { profile });
+        return;
+    }
     let fresh;
     try {
         fresh = generateDeviceKeyPair();

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {