@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKey.js

@@ -1,354 +1,239 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_PROOF_TYP = void 0;
-exports.generateDeviceKeyPair = generateDeviceKeyPair;
-exports.jwkThumbprint = jwkThumbprint;
-exports.publicJwkFromX = publicJwkFromX;
-exports.tokenHash = tokenHash;
-exports.normalizeHtu = normalizeHtu;
-exports.buildProof = buildProof;
-exports.signEd25519Proof = signEd25519Proof;
-exports.verifyProof = verifyProof;
-exports.verifyEd25519Proof = verifyEd25519Proof;
-/**
- * deviceKey.ts — L11 Phase 1: Ed25519 device identity + DPoP-style proofs.
- *
- * The load-bearing recommendation in `docs/daemon-auth-cc-deep-comparison-
- * 2026-04-24.md` §L11. Two-axis identity:
- *
- *   user identity  = OAuth refresh token  (server-rotated, scope-pinned, reuse-detected)
- *   device identity = Ed25519 keypair      (device-generated, server-revocable)
- *
- * Every daemon→server request carries a JWS signature over
- * `{htm, htu, iat, jti, rth?, ath?}` using the device key. Server validates
- * against the public key registered for this daemon.
- *
- * Stolen credentials require BOTH halves:
- *   - refresh token alone is useless without the device key
- *   - device key alone is useless without the refresh token
- *
- * Why DPoP-shaped (RFC 9449) rather than rolling our own JWS:
- *   - The htm/htu/iat/jti/ath claim set is well-studied. Server-side
- *     replay defenses, clock-skew handling, and audit-trail formats all
- *     have a body of prior art to copy from.
- *   - Future interop: if we ever expose OverSky as a third-party OAuth
- *     resource server, DPoP-bearer is the way clients will already
- *     understand.
- *
- * Why we extend with `rth` (refresh-token-hash):
- *   - RFC 9449 only mints `ath` (access-token-hash). The whole point of
- *     L11 is to bind the *refresh* token to the device, so the proof
- *     accompanying a refresh request must commit to the refresh token.
- *     `rth` is structurally identical to `ath`; the name disambiguates.
- *
- * What this module is NOT responsible for:
- *   - Persistence (lives in `daemon/src/deviceIdentity.ts`).
- *   - Server-side public-key registration (separate API in a later PR).
- *   - Wire-up to the daemon's outgoing HTTP path (Phase 2 of L11).
- */
-const node_crypto_1 = __importDefault(require("node:crypto"));
-// ---------------------------------------------------------------------------
-// Base64url helpers — same shape as `credentialEnvelope.ts` so the two
-// modules are visually consistent in the auth-core codebase.
-// ---------------------------------------------------------------------------
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var deviceKey_exports = {};
+__export(deviceKey_exports, {
+  DEVICE_PROOF_TYP: () => DEVICE_PROOF_TYP,
+  buildProof: () => buildProof,
+  generateDeviceKeyPair: () => generateDeviceKeyPair,
+  jwkThumbprint: () => jwkThumbprint,
+  normalizeHtu: () => normalizeHtu,
+  publicJwkFromX: () => publicJwkFromX,
+  signEd25519Proof: () => signEd25519Proof,
+  tokenHash: () => tokenHash,
+  verifyEd25519Proof: () => verifyEd25519Proof,
+  verifyProof: () => verifyProof
+});
+module.exports = __toCommonJS(deviceKey_exports);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
 function b64u(buf) {
-    return buf.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
 function b64uDecode(s) {
-    const padded = s.replace(/-/g, '+').replace(/_/g, '/');
-    const pad = padded.length % 4;
-    return Buffer.from(pad === 0 ? padded : padded + '='.repeat(4 - pad), 'base64');
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = padded.length % 4;
+  return Buffer.from(pad === 0 ? padded : padded + "=".repeat(4 - pad), "base64");
 }
-// ---------------------------------------------------------------------------
-// Key generation + canonicalization
-// ---------------------------------------------------------------------------
-/**
- * Generate a fresh Ed25519 keypair. Uses Node's native bindings —
- * `crypto.generateKeyPairSync('ed25519')` is available since Node 12 and
- * is the same primitive `crypto.sign(null, ..., privateKey)` consumes.
- *
- * Output is the JWK form (RFC 8037) so callers can serialize directly
- * without dealing with PKCS#8 or raw byte representations. The private
- * scalar `d` and public point `x` are 32 bytes each.
- */
 function generateDeviceKeyPair() {
-    const { privateKey } = node_crypto_1.default.generateKeyPairSync('ed25519');
-    // `crypto.KeyObject.export({format: 'jwk'})` for an Ed25519 private
-    // key yields {kty, crv, d, x} — both halves in one shot. Saves a
-    // separate call to derive the public form.
-    const jwk = privateKey.export({ format: 'jwk' });
-    if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
-        throw new Error(`generateDeviceKeyPair: unexpected JWK kty/crv (${jwk.kty}/${jwk.crv})`);
-    }
-    const privateJwk = { kty: 'OKP', crv: 'Ed25519', d: jwk.d, x: jwk.x };
-    const publicJwk = { kty: 'OKP', crv: 'Ed25519', x: jwk.x };
-    return {
-        publicJwk,
-        privateJwk,
-        thumbprint: jwkThumbprint(publicJwk),
-    };
+  const { privateKey } = import_node_crypto.default.generateKeyPairSync("ed25519");
+  const jwk = privateKey.export({ format: "jwk" });
+  if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") {
+    throw new Error(`generateDeviceKeyPair: unexpected JWK kty/crv (${jwk.kty}/${jwk.crv})`);
+  }
+  const privateJwk = { kty: "OKP", crv: "Ed25519", d: jwk.d, x: jwk.x };
+  const publicJwk = { kty: "OKP", crv: "Ed25519", x: jwk.x };
+  return {
+    publicJwk,
+    privateJwk,
+    thumbprint: jwkThumbprint(publicJwk)
+  };
 }
-/**
- * RFC 7638 JWK Thumbprint — SHA-256 of the canonical JSON of the
- * required members. For an OKP key those are `crv`, `kty`, and `x`,
- * lexicographically ordered with no whitespace.
- *
- * Stable across implementations: a server that derives the thumbprint
- * the same way always agrees with us. This is the value we use as the
- * `kid` in JWS headers and as the registered identifier on the server's
- * `Daemon` table.
- */
 function jwkThumbprint(publicJwk) {
-    // Manually constructed — JSON.stringify with object literal does NOT
-    // guarantee key order across Node versions, even though current V8
-    // preserves insertion order. Build the bytes ourselves to defend
-    // against a hypothetical future regression.
-    const canonical = `{"crv":"${publicJwk.crv}","kty":"${publicJwk.kty}","x":"${publicJwk.x}"}`;
-    return b64u(node_crypto_1.default.createHash('sha256').update(canonical, 'utf-8').digest());
+  const canonical = `{"crv":"${publicJwk.crv}","kty":"${publicJwk.kty}","x":"${publicJwk.x}"}`;
+  return b64u(import_node_crypto.default.createHash("sha256").update(canonical, "utf-8").digest());
 }
-/**
- * Construct an `Ed25519PublicJwk` from a base64url-encoded 32-byte
- * public point. Used by the persistence layer when reading a stored
- * public key; rejects garbage so a corrupted JWK file fails loudly
- * rather than producing a silently-broken signing key.
- */
 function publicJwkFromX(x) {
-    const raw = b64uDecode(x);
-    if (raw.length !== 32) {
-        throw new Error(`publicJwkFromX: expected 32-byte public point, got ${raw.length}`);
-    }
-    return { kty: 'OKP', crv: 'Ed25519', x };
+  const raw = b64uDecode(x);
+  if (raw.length !== 32) {
+    throw new Error(`publicJwkFromX: expected 32-byte public point, got ${raw.length}`);
+  }
+  return { kty: "OKP", crv: "Ed25519", x };
 }
-// ---------------------------------------------------------------------------
-// Token-hash and HTU normalization — RFC 9449 §4.1, §4.2
-// ---------------------------------------------------------------------------
-/**
- * `ath` / `rth` claim value: SHA-256 of the token ASCII bytes,
- * base64url-encoded (no padding). Must match exactly on both sides.
- */
 function tokenHash(token) {
-    if (typeof token !== 'string' || token.length === 0) {
-        throw new Error('tokenHash: token must be a non-empty string');
-    }
-    return b64u(node_crypto_1.default.createHash('sha256').update(token, 'utf-8').digest());
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("tokenHash: token must be a non-empty string");
+  }
+  return b64u(import_node_crypto.default.createHash("sha256").update(token, "utf-8").digest());
 }
-/**
- * Normalize a URL for the `htu` claim per RFC 9449 §4.2:
- *   - strip query string
- *   - strip fragment
- *   - strip userinfo
- *   - lowercase scheme and host
- *
- * The path is left as-is (case-sensitive per RFC 3986). Trailing slash
- * is preserved — the server compares to its own normalized form so as
- * long as both sides use the same rule the comparison holds.
- */
 function normalizeHtu(url) {
-    const u = new URL(url);
-    u.search = '';
-    u.hash = '';
-    u.username = '';
-    u.password = '';
-    return u.toString();
+  const u = new URL(url);
+  u.search = "";
+  u.hash = "";
+  u.username = "";
+  u.password = "";
+  return u.toString();
 }
-/**
- * Build a JWS Compact Serialization device-identity proof.
- *
- * Header includes the public JWK inline (RFC 9449 pattern) so the
- * server can verify the signature without prior key lookup, then
- * additionally check that the inlined JWK matches the daemon's
- * registered public key.
- *
- * Throws on invalid input (bad URL, bad method, etc.) — never produces
- * a malformed proof. A failed sign at the daemon side is a hard error,
- * not a silent fallback.
- */
 function buildProof(privateJwk, publicJwk, opts) {
-    if (publicJwk.x !== privateJwk.x) {
-        // Defensive — public and private must come from the same keypair.
-        // A mismatch indicates a corrupted in-memory state.
-        throw new Error('buildProof: public/private JWK x mismatch (corrupted keypair)');
-    }
-    // Cast to crypto's `JsonWebKey` shape — that type requires an index
-    // signature for arbitrary string keys; our narrow OKP shape doesn't
-    // declare one because the strict shape is more useful at our API
-    // boundary. Cast through `unknown` to silence the structural mismatch
-    // without losing the rest of the type safety on this surface.
-    const privateKey = node_crypto_1.default.createPrivateKey({
-        format: 'jwk',
-        key: privateJwk,
-    });
-    return signEd25519Proof(privateKey, publicJwk, exports.DEVICE_PROOF_TYP, opts);
+  if (publicJwk.x !== privateJwk.x) {
+    throw new Error("buildProof: public/private JWK x mismatch (corrupted keypair)");
+  }
+  const privateKey = import_node_crypto.default.createPrivateKey({
+    format: "jwk",
+    key: privateJwk
+  });
+  return signEd25519Proof(privateKey, publicJwk, DEVICE_PROOF_TYP, opts);
 }
-/** The header `typ` of an OverSky device-identity proof. */
-exports.DEVICE_PROOF_TYP = 'oversky-dpop+jwt';
-/**
- * Sign a DPoP-shaped proof with an Ed25519 key under the given header `typ`.
- *
- * @internal Shared by the device-identity proof (`oversky-dpop+jwt`, above)
- * and the RFC 9449 access-token proof (`dpop+jwt`, `dpop.ts`). `typ` is the
- * only thing on the wire that separates the two protocols, which is why it is
- * a required argument rather than a default: a proof signed for one must
- * never verify as the other.
- */
+const DEVICE_PROOF_TYP = "oversky-dpop+jwt";
 function signEd25519Proof(privateKey, publicJwk, typ, opts) {
-    if (typeof opts.method !== 'string' || opts.method.length === 0) {
-        throw new Error('buildProof: method must be a non-empty string');
-    }
-    if (typeof opts.url !== 'string' || opts.url.length === 0) {
-        throw new Error('buildProof: url must be a non-empty string');
-    }
-    const claims = {
-        htm: opts.method.toUpperCase(),
-        htu: normalizeHtu(opts.url),
-        iat: opts.iat ?? Math.floor(Date.now() / 1000),
-        jti: opts.jti ?? b64u(node_crypto_1.default.randomBytes(16)),
-    };
-    if (opts.refreshToken !== undefined)
-        claims.rth = tokenHash(opts.refreshToken);
-    if (opts.accessToken !== undefined)
-        claims.ath = tokenHash(opts.accessToken);
-    const header = { alg: 'EdDSA', typ, jwk: publicJwk };
-    const headerB64 = b64u(Buffer.from(JSON.stringify(header), 'utf-8'));
-    const payloadB64 = b64u(Buffer.from(JSON.stringify(claims), 'utf-8'));
-    const signingInput = `${headerB64}.${payloadB64}`;
-    // EdDSA over Ed25519 — Node's crypto.sign expects `null` as the
-    // digest algorithm because Ed25519 hashes the message internally.
-    const signature = node_crypto_1.default.sign(null, Buffer.from(signingInput, 'utf-8'), privateKey);
-    return `${signingInput}.${b64u(signature)}`;
+  if (typeof opts.method !== "string" || opts.method.length === 0) {
+    throw new Error("buildProof: method must be a non-empty string");
+  }
+  if (typeof opts.url !== "string" || opts.url.length === 0) {
+    throw new Error("buildProof: url must be a non-empty string");
+  }
+  const claims = {
+    htm: opts.method.toUpperCase(),
+    htu: normalizeHtu(opts.url),
+    iat: opts.iat ?? Math.floor(Date.now() / 1e3),
+    jti: opts.jti ?? b64u(import_node_crypto.default.randomBytes(16))
+  };
+  if (opts.refreshToken !== void 0)
+    claims.rth = tokenHash(opts.refreshToken);
+  if (opts.accessToken !== void 0)
+    claims.ath = tokenHash(opts.accessToken);
+  const header = { alg: "EdDSA", typ, jwk: publicJwk };
+  const headerB64 = b64u(Buffer.from(JSON.stringify(header), "utf-8"));
+  const payloadB64 = b64u(Buffer.from(JSON.stringify(claims), "utf-8"));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const signature = import_node_crypto.default.sign(null, Buffer.from(signingInput, "utf-8"), privateKey);
+  return `${signingInput}.${b64u(signature)}`;
 }
-/**
- * Verify a device-identity proof. Returns a discriminated union — the
- * reason is part of the failure shape so the server middleware can emit
- * structured telemetry without re-parsing.
- *
- * Critical: Node's `crypto.verify` returns false on a bad signature
- * AND throws on a structurally-broken key. Both are surfaced as
- * `sig_invalid` to keep the failure surface narrow.
- */
 function verifyProof(jws, opts = {}) {
-    return verifyEd25519Proof(jws, opts, exports.DEVICE_PROOF_TYP);
+  return verifyEd25519Proof(jws, opts, DEVICE_PROOF_TYP);
 }
-/**
- * Verify a DPoP-shaped Ed25519 proof whose header `typ` must equal `typ`.
- *
- * @internal See `signEd25519Proof`. `verifyProof` (device identity) and
- * `verifyDpopProof` (`dpop.ts`, RFC 9449) are the two public doors.
- */
 function verifyEd25519Proof(jws, opts, typ) {
-    if (typeof jws !== 'string' || jws.length === 0) {
-        return { valid: false, reason: 'malformed' };
-    }
-    const parts = jws.split('.');
-    if (parts.length !== 3) {
-        return { valid: false, reason: 'malformed' };
-    }
-    const [headerB64, payloadB64, sigB64] = parts;
-    let header;
-    let claims;
-    try {
-        header = JSON.parse(b64uDecode(headerB64).toString('utf-8'));
-        claims = JSON.parse(b64uDecode(payloadB64).toString('utf-8'));
-    }
-    catch {
-        return { valid: false, reason: 'malformed' };
-    }
-    if (!header || typeof header !== 'object' || header.alg !== 'EdDSA') {
-        return { valid: false, reason: 'bad_alg' };
-    }
-    if (header.typ !== typ) {
-        return { valid: false, reason: 'bad_typ' };
-    }
-    const headerJwk = header.jwk;
-    if (!headerJwk ||
-        typeof headerJwk !== 'object' ||
-        headerJwk.kty !== 'OKP' ||
-        headerJwk.crv !== 'Ed25519' ||
-        typeof headerJwk.x !== 'string') {
-        return { valid: false, reason: 'bad_jwk' };
-    }
-    const publicJwk = {
-        kty: 'OKP',
-        crv: 'Ed25519',
-        x: headerJwk.x,
-    };
-    // Validate the public point length — defends against an attacker who
-    // smuggles a non-32-byte `x` to confuse downstream consumers.
-    let publicKeyObj;
-    try {
-        const raw = b64uDecode(publicJwk.x);
-        if (raw.length !== 32) {
-            return { valid: false, reason: 'bad_jwk' };
-        }
-        publicKeyObj = node_crypto_1.default.createPublicKey({
-            format: 'jwk',
-            key: publicJwk,
-        });
-    }
-    catch {
-        return { valid: false, reason: 'bad_jwk' };
-    }
-    if (opts.pinnedPublicJwk && opts.pinnedPublicJwk.x !== publicJwk.x) {
-        return { valid: false, reason: 'pin_mismatch' };
-    }
-    // Verify the signature itself before validating claims — a bad
-    // signature should always be the reported failure (more important
-    // signal than a stale iat).
-    const signingInput = Buffer.from(`${headerB64}.${payloadB64}`, 'utf-8');
-    let signature;
-    try {
-        signature = b64uDecode(sigB64);
-    }
-    catch {
-        return { valid: false, reason: 'malformed' };
-    }
-    let sigOk;
-    try {
-        sigOk = node_crypto_1.default.verify(null, signingInput, publicKeyObj, signature);
-    }
-    catch {
-        sigOk = false;
-    }
-    if (!sigOk) {
-        return { valid: false, reason: 'sig_invalid' };
-    }
-    // Claim-level checks.
-    const now = Math.floor((opts.now ?? Date.now()) / 1000);
-    const maxAge = opts.maxAgeSeconds ?? 60;
-    const skew = opts.clockSkewSeconds ?? 5;
-    if (typeof claims.iat !== 'number' || !Number.isFinite(claims.iat)) {
-        return { valid: false, reason: 'malformed' };
-    }
-    if (claims.iat > now + skew) {
-        return { valid: false, reason: 'iat_future' };
-    }
-    if (claims.iat < now - maxAge) {
-        return { valid: false, reason: 'iat_old' };
-    }
-    if (typeof claims.htm !== 'string' ||
-        typeof claims.htu !== 'string' ||
-        typeof claims.jti !== 'string') {
-        return { valid: false, reason: 'malformed' };
-    }
-    if (opts.expectedHtm && claims.htm !== opts.expectedHtm.toUpperCase()) {
-        return { valid: false, reason: 'htm_mismatch' };
-    }
-    if (opts.expectedHtu && claims.htu !== normalizeHtu(opts.expectedHtu)) {
-        return { valid: false, reason: 'htu_mismatch' };
-    }
-    if (opts.expectedRth !== undefined && claims.rth !== opts.expectedRth) {
-        return { valid: false, reason: 'rth_mismatch' };
-    }
-    if (opts.expectedAth !== undefined && claims.ath !== opts.expectedAth) {
-        return { valid: false, reason: 'ath_mismatch' };
+  if (typeof jws !== "string" || jws.length === 0) {
+    return { valid: false, reason: "malformed" };
+  }
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    return { valid: false, reason: "malformed" };
+  }
+  const [headerB64, payloadB64, sigB64] = parts;
+  let header;
+  let claims;
+  try {
+    header = JSON.parse(b64uDecode(headerB64).toString("utf-8"));
+    claims = JSON.parse(b64uDecode(payloadB64).toString("utf-8"));
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  if (!header || typeof header !== "object" || header.alg !== "EdDSA") {
+    return { valid: false, reason: "bad_alg" };
+  }
+  if (header.typ !== typ) {
+    return { valid: false, reason: "bad_typ" };
+  }
+  const headerJwk = header.jwk;
+  if (!headerJwk || typeof headerJwk !== "object" || headerJwk.kty !== "OKP" || headerJwk.crv !== "Ed25519" || typeof headerJwk.x !== "string") {
+    return { valid: false, reason: "bad_jwk" };
+  }
+  const publicJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x: headerJwk.x
+  };
+  let publicKeyObj;
+  try {
+    const raw = b64uDecode(publicJwk.x);
+    if (raw.length !== 32) {
+      return { valid: false, reason: "bad_jwk" };
     }
-    return {
-        valid: true,
-        claims,
-        publicJwk,
-        thumbprint: jwkThumbprint(publicJwk),
-    };
+    publicKeyObj = import_node_crypto.default.createPublicKey({
+      format: "jwk",
+      key: publicJwk
+    });
+  } catch {
+    return { valid: false, reason: "bad_jwk" };
+  }
+  if (opts.pinnedPublicJwk && opts.pinnedPublicJwk.x !== publicJwk.x) {
+    return { valid: false, reason: "pin_mismatch" };
+  }
+  const signingInput = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
+  let signature;
+  try {
+    signature = b64uDecode(sigB64);
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  let sigOk;
+  try {
+    sigOk = import_node_crypto.default.verify(null, signingInput, publicKeyObj, signature);
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) {
+    return { valid: false, reason: "sig_invalid" };
+  }
+  const now = Math.floor((opts.now ?? Date.now()) / 1e3);
+  const maxAge = opts.maxAgeSeconds ?? 60;
+  const skew = opts.clockSkewSeconds ?? 5;
+  if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)) {
+    return { valid: false, reason: "malformed" };
+  }
+  if (claims.iat > now + skew) {
+    return { valid: false, reason: "iat_future" };
+  }
+  if (claims.iat < now - maxAge) {
+    return { valid: false, reason: "iat_old" };
+  }
+  if (typeof claims.htm !== "string" || typeof claims.htu !== "string" || typeof claims.jti !== "string") {
+    return { valid: false, reason: "malformed" };
+  }
+  if (opts.expectedHtm && claims.htm !== opts.expectedHtm.toUpperCase()) {
+    return { valid: false, reason: "htm_mismatch" };
+  }
+  if (opts.expectedHtu && claims.htu !== normalizeHtu(opts.expectedHtu)) {
+    return { valid: false, reason: "htu_mismatch" };
+  }
+  if (opts.expectedRth !== void 0 && claims.rth !== opts.expectedRth) {
+    return { valid: false, reason: "rth_mismatch" };
+  }
+  if (opts.expectedAth !== void 0 && claims.ath !== opts.expectedAth) {
+    return { valid: false, reason: "ath_mismatch" };
+  }
+  return {
+    valid: true,
+    claims,
+    publicJwk,
+    thumbprint: jwkThumbprint(publicJwk)
+  };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEVICE_PROOF_TYP,
+  buildProof,
+  generateDeviceKeyPair,
+  jwkThumbprint,
+  normalizeHtu,
+  publicJwkFromX,
+  signEd25519Proof,
+  tokenHash,
+  verifyEd25519Proof,
+  verifyProof
+});