@skrr-ai/cli 0.1.102 → 0.1.103

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -47,9 +47,17 @@ export declare function describeDeviceKeySplit(profile: string): {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 export declare function initDeviceIdentity(profile: string, options?: {
     recoverUnreadable?: boolean;
+    createIfMissing?: boolean;
 }): Promise<void>;
 /**
  * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -364,6 +364,13 @@ async function consolidateDeviceIdentity(profile) {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
@@ -412,6 +419,11 @@ async function initDeviceIdentity(profile, options = {}) {
         emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
         return;
     }
+    if (options.createIfMissing === false) {
+        _state = { kind: 'disabled', reason: 'no_stored_key' };
+        emit('no_stored_key', false, { profile });
+        return;
+    }
     let fresh;
     try {
         fresh = (0, deviceKey_js_1.generateDeviceKeyPair)();

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -47,9 +47,17 @@ export declare function describeDeviceKeySplit(profile: string): {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 export declare function initDeviceIdentity(profile: string, options?: {
     recoverUnreadable?: boolean;
+    createIfMissing?: boolean;
 }): Promise<void>;
 /**
  * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -344,6 +344,13 @@ async function consolidateDeviceIdentity(profile) {
  *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
+ *
+ * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
+ * never replaces anything: for a short-lived process that must only READ the
+ * daemon's key while the daemon itself may be creating it (OSK-15990's
+ * `skrrd device-proof`). The persist below is not an exclusive create, so a
+ * second creator racing the daemon could leave the daemon holding one key in
+ * memory and the disk another.
  */
 export async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
@@ -392,6 +399,11 @@ export async function initDeviceIdentity(profile, options = {}) {
         emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
         return;
     }
+    if (options.createIfMissing === false) {
+        _state = { kind: 'disabled', reason: 'no_stored_key' };
+        emit('no_stored_key', false, { profile });
+        return;
+    }
     let fresh;
     try {
         fresh = generateDeviceKeyPair();

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.21",
+  "version": "0.4.22",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {