@skrr-ai/cli 0.1.119 → 0.1.120

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/maintenanceReportWire.d.ts

@@ -0,0 +1,178 @@
+/**
+ * The maintenance report wire contract (Machine Maintenance, OSK-19107, task M24;
+ * `docs/architecture/machine-maintenance/implementation-plan-2026-10-24.md` §3.5,
+ * `phase0/m04-quiescence-evidence.md` §2.5 and §2.6).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so the
+ * capability name, the payload shape and its bounds live in this package, which
+ * every end can import (`@skrr-ai/auth-core/maintenance-report-wire`).
+ * `maintenanceReportWire.test.ts` fails on a second spelling of the capability
+ * anywhere else in the repo. The shape follows `dedicatedRuntimeBusyWire.ts`, the
+ * precedent for a positively announced, fail-closed report, and differs from it
+ * only where the owner's pause needs more.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "What does this daemon process hold right now that an update would take from
+ * the owner, and has anything been admitted since the last time you asked?" It is
+ * a LOCAL read summarised into counts, the handoff's own restart blockers, and
+ * the daemon's own update handoff phase.
+ *
+ * It is EVIDENCE, never authority. The fence does not depend on it: a daemon that
+ * lies, or one that sends nothing, cannot make a held machine accept work. Only
+ * this report can grant `ready` (a server-side source can only veto it), and a
+ * daemon that never announces the capability can only reach `ready` by the
+ * owner's attestation.
+ *
+ * FAIL CLOSED, in three places
+ * ---------------------------------------------------------------------------
+ *  1. A count is `0` only when the daemon positively counted. A source that could
+ *     not be read is `complete: 'unknown'`; a daemon that is leaving is
+ *     `complete: false`. A reader MUST treat both as busy, whatever the counts
+ *     say (`maintenanceReportIsQuiet` is the one place that says so).
+ *  2. A report that is malformed in ANY field is `null` from
+ *     `parseMaintenanceReport`, and the caller treats the machine as not quiet.
+ *     A count that is missing, negative, fractional or not a safe integer is not
+ *     "zero": it is a different, broken report. A version this parser does not
+ *     know is `null` too: a newer shape needs its own announced capability.
+ *  3. Bounds. The blocker list and every string are clamped, so one report can
+ *     never be large enough to matter, and a field that is NOT in the contract is
+ *     never copied into what the parser returns (the result is built from a
+ *     fresh object, so `__proto__` and its kin cannot ride along).
+ *
+ * `admittedTotal`
+ * ---------------------------------------------------------------------------
+ * A MONOTONIC counter of admissions since this process started. The server proves
+ * "nothing was admitted between two reports" by comparing two values, without
+ * trusting the daemon's clock. It counts at every place the daemon admits work
+ * and OVER-counts on purpose (one admission may be noted at the gate and again
+ * where the work registers): a second increment can only make the proof harder,
+ * never easier. A path that the daemon cannot count must say so in
+ * `daemon/src/maintenance-report.ts`, not hide in a zero.
+ */
+export declare const MAINTENANCE_REPORT_CAPABILITY = "maintenance_report_v1";
+/** The heartbeat (and register) key the report rides under. Sent only by a daemon that announced the capability. */
+export declare const MAINTENANCE_REPORT_HEARTBEAT_KEY = "maintenanceReport";
+export declare const MAINTENANCE_REPORT_VERSION = 1;
+/**
+ * The daemon's own update handoff phases (`daemon/src/update/handoff.ts`), and the
+ * members of `DaemonMaintenanceHandoff.phase` in `@skrr-ai/data-provider`. A phase
+ * outside this list is a newer protocol and makes the whole report `null`.
+ */
+export declare const MAINTENANCE_REPORT_HANDOFF_PHASES: readonly ["ready", "deferred", "reconnecting", "verified", "failed", "rolled-back"];
+export type MaintenanceReportHandoffPhase = (typeof MAINTENANCE_REPORT_HANDOFF_PHASES)[number];
+export declare const MAINTENANCE_REPORT_LIMITS: {
+    /** The handoff's blockers carried for the "waiting on" text; the counts, not this list, decide busy. */
+    readonly maxBlockers: 32;
+    readonly maxKindLength: 32;
+    readonly maxIdLength: 128;
+    readonly maxReasonLength: 240;
+    readonly maxHandoffIdLength: 64;
+    readonly maxHandoffReasonLength: 64;
+    readonly maxProcessStartIdLength: 64;
+    /** Hard ceiling on the serialized report. The clamps above keep a valid one well under it. */
+    readonly maxSerializedBytes: 20000;
+};
+/** What `complete` can be. Anything but `true` means the counts prove nothing. */
+export type MaintenanceReportComplete = boolean | 'unknown';
+/** The handoff's own `RestartBlocker` shape (`daemon/src/update/handoff.ts`). Reason text is the handoff's, never re-spelled. */
+export interface MaintenanceReportBlocker {
+    kind: string;
+    id?: string;
+    reason: string;
+}
+export interface MaintenanceReportInflight {
+    /** Provider sessions and their wrapper processes: in-process turns, preparing dispatches, live wrappers. */
+    sessions: number;
+    /** Tool calls running, plus background commands still running. */
+    tools: number;
+    /** Terminals the daemon holds, preservable or not. A person's open shell is work an update would interrupt. */
+    terminals: number;
+    /** Provider turns that still depend on credentials, permissions, a browser or a model connection the service owns. */
+    providerDependencies: number;
+    /** Write-ahead entries whose durability the daemon has not confirmed. */
+    walUnconfirmed: number;
+}
+export interface MaintenanceReportHandoff {
+    phase: MaintenanceReportHandoffPhase;
+    handoffId: string;
+    reason?: string;
+    /** ISO time the daemon's lease on this phase ends. */
+    expiresAt?: string;
+}
+export interface MaintenanceReport {
+    version: typeof MAINTENANCE_REPORT_VERSION;
+    /** The daemon process that read this. The server drops a report that is not its registered process's. */
+    processStartId: string;
+    /** ISO time of the daemon's own read. Informational: freshness is the server's receipt time. */
+    readAt: string;
+    /** `true`: every source was read. `'unknown'`: one could not be. `false`: the process is leaving. */
+    complete: MaintenanceReportComplete;
+    /** Monotonic count of admissions since this process started. */
+    admittedTotal: number;
+    inflight: MaintenanceReportInflight;
+    blockers: MaintenanceReportBlocker[];
+    /** True when the daemon had more blockers than it sent. */
+    blockersTruncated: boolean;
+    /** The daemon's own update handoff, only while it is live or unresolved; otherwise `null`. */
+    handoff: MaintenanceReportHandoff | null;
+}
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from a
+ * daemon that did not announce the capability, an unknown version, or oversized
+ * is `null`, and the caller must then treat the machine as NOT quiet. Never
+ * trusts a field it did not validate and never copies one it does not know.
+ */
+export declare function parseMaintenanceReport(raw: unknown): MaintenanceReport | null;
+/**
+ * A report as it was stored (JSON text on the presence row). Anything that does
+ * not parse, or does not validate, is `null`: a stored value is an input like any
+ * other and is read with the same suspicion.
+ */
+export declare function parseStoredMaintenanceReport(stored: unknown): MaintenanceReport | null;
+/**
+ * The one definition of a POSITIVE ZERO: the daemon read every source and found
+ * nothing. `complete: 'unknown'` and `complete: false` are never zero whatever
+ * the counts say, because the counts were not (all) read.
+ *
+ * A blocker that is not work (a missing restart owner, say) does not make a
+ * report non-quiet; readiness is "nothing is running", not "the daemon can
+ * restart itself".
+ */
+export declare function maintenanceReportIsQuiet(report: MaintenanceReport | null): boolean;
+export interface BuildMaintenanceReportInput {
+    processStartId: string;
+    /** Epoch ms of the daemon's own read. */
+    readAtMs: number;
+    complete: MaintenanceReportComplete;
+    admittedTotal: number;
+    inflight: MaintenanceReportInflight;
+    blockers: ReadonlyArray<{
+        kind: string;
+        id?: string;
+        reason: string;
+    }>;
+    /** `expiresAtMs` is epoch ms; the wire carries ISO. */
+    handoff: {
+        phase: MaintenanceReportHandoffPhase;
+        handoffId: string;
+        reason?: string;
+        expiresAtMs?: number;
+    } | null;
+}
+/**
+ * A report that says nothing was counted. The shape the daemon sends when it
+ * could not read an inventory source at all, and the shape `buildMaintenanceReport`
+ * falls back to when it was handed something the contract cannot carry.
+ */
+export declare function unknownMaintenanceReport(processStartId: string, readAtMs: number, admittedTotal?: number): MaintenanceReport;
+/**
+ * Build the wire report from what the daemon read. Input the contract cannot
+ * carry (a negative count, a blocker with no kind, a time that is not a time)
+ * becomes an `unknown` report rather than a throw or a report that parses to
+ * something else, so the result parses whenever `processStartId` is a real id (the
+ * daemon's always is). A builder that threw would turn a bad read into silence,
+ * and silence is the absence of a report, which the server reads the same way,
+ * but later.
+ */
+export declare function buildMaintenanceReport(input: BuildMaintenanceReportInput): MaintenanceReport;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/maintenanceReportWire.js

@@ -0,0 +1,262 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var maintenanceReportWire_exports = {};
+__export(maintenanceReportWire_exports, {
+  MAINTENANCE_REPORT_CAPABILITY: () => MAINTENANCE_REPORT_CAPABILITY,
+  MAINTENANCE_REPORT_HANDOFF_PHASES: () => MAINTENANCE_REPORT_HANDOFF_PHASES,
+  MAINTENANCE_REPORT_HEARTBEAT_KEY: () => MAINTENANCE_REPORT_HEARTBEAT_KEY,
+  MAINTENANCE_REPORT_LIMITS: () => MAINTENANCE_REPORT_LIMITS,
+  MAINTENANCE_REPORT_VERSION: () => MAINTENANCE_REPORT_VERSION,
+  buildMaintenanceReport: () => buildMaintenanceReport,
+  maintenanceReportIsQuiet: () => maintenanceReportIsQuiet,
+  parseMaintenanceReport: () => parseMaintenanceReport,
+  parseStoredMaintenanceReport: () => parseStoredMaintenanceReport,
+  unknownMaintenanceReport: () => unknownMaintenanceReport
+});
+module.exports = __toCommonJS(maintenanceReportWire_exports);
+const MAINTENANCE_REPORT_CAPABILITY = "maintenance_report_v1";
+const MAINTENANCE_REPORT_HEARTBEAT_KEY = "maintenanceReport";
+const MAINTENANCE_REPORT_VERSION = 1;
+const MAINTENANCE_REPORT_HANDOFF_PHASES = [
+  "ready",
+  "deferred",
+  "reconnecting",
+  "verified",
+  "failed",
+  "rolled-back"
+];
+const MAINTENANCE_REPORT_LIMITS = {
+  /** The handoff's blockers carried for the "waiting on" text; the counts, not this list, decide busy. */
+  maxBlockers: 32,
+  maxKindLength: 32,
+  maxIdLength: 128,
+  maxReasonLength: 240,
+  maxHandoffIdLength: 64,
+  maxHandoffReasonLength: 64,
+  maxProcessStartIdLength: 64,
+  /** Hard ceiling on the serialized report. The clamps above keep a valid one well under it. */
+  maxSerializedBytes: 2e4
+};
+const PROCESS_START_ID_PATTERN = /^[A-Za-z0-9_.:-]+$/;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function field(record, key) {
+  return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : void 0;
+}
+function isoFromMs(ms) {
+  if (typeof ms !== "number" || !Number.isFinite(ms))
+    return "";
+  const date = new Date(ms);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString();
+}
+function count(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function clampText(value, max) {
+  if (typeof value !== "string")
+    return null;
+  const clean = value.replace(CONTROL_CHARACTERS, " ");
+  return clean.length > max ? clean.slice(0, max) : clean;
+}
+function isoOf(value) {
+  if (typeof value !== "string")
+    return null;
+  const ms = Date.parse(value);
+  if (!Number.isFinite(ms))
+    return null;
+  try {
+    return new Date(ms).toISOString();
+  } catch {
+    return null;
+  }
+}
+function completeOf(value) {
+  return value === true || value === false || value === "unknown" ? value : void 0;
+}
+function parseMaintenanceReport(raw) {
+  if (!isRecord(raw))
+    return null;
+  if (field(raw, "version") !== MAINTENANCE_REPORT_VERSION)
+    return null;
+  const processStartId = field(raw, "processStartId");
+  if (typeof processStartId !== "string" || processStartId.length < 1 || processStartId.length > MAINTENANCE_REPORT_LIMITS.maxProcessStartIdLength || !PROCESS_START_ID_PATTERN.test(processStartId)) {
+    return null;
+  }
+  const readAt = isoOf(field(raw, "readAt"));
+  if (readAt === null)
+    return null;
+  const complete = completeOf(field(raw, "complete"));
+  if (complete === void 0)
+    return null;
+  const admittedTotal = count(field(raw, "admittedTotal"));
+  if (admittedTotal === null)
+    return null;
+  const rawInflight = field(raw, "inflight");
+  if (!isRecord(rawInflight))
+    return null;
+  const sessions = count(field(rawInflight, "sessions"));
+  const tools = count(field(rawInflight, "tools"));
+  const terminals = count(field(rawInflight, "terminals"));
+  const providerDependencies = count(field(rawInflight, "providerDependencies"));
+  const walUnconfirmed = count(field(rawInflight, "walUnconfirmed"));
+  if (sessions === null || tools === null || terminals === null || providerDependencies === null || walUnconfirmed === null) {
+    return null;
+  }
+  const rawBlockers = field(raw, "blockers");
+  if (!Array.isArray(rawBlockers))
+    return null;
+  const rawTruncated = field(raw, "blockersTruncated");
+  if (rawTruncated !== void 0 && typeof rawTruncated !== "boolean")
+    return null;
+  const limit = MAINTENANCE_REPORT_LIMITS.maxBlockers;
+  const blockers = [];
+  for (let index = 0; index < rawBlockers.length && blockers.length < limit; index += 1) {
+    const element = rawBlockers[index];
+    if (!isRecord(element))
+      return null;
+    const kind = clampText(field(element, "kind"), MAINTENANCE_REPORT_LIMITS.maxKindLength);
+    const reason = clampText(field(element, "reason"), MAINTENANCE_REPORT_LIMITS.maxReasonLength);
+    if (kind === null || kind === "" || reason === null)
+      return null;
+    const blocker = { kind, reason };
+    const rawId = field(element, "id");
+    if (rawId !== void 0) {
+      const id = clampText(rawId, MAINTENANCE_REPORT_LIMITS.maxIdLength);
+      if (id === null)
+        return null;
+      blocker.id = id;
+    }
+    blockers.push(blocker);
+  }
+  const blockersTruncated = rawBlockers.length > limit || rawTruncated === true;
+  const rawHandoff = field(raw, "handoff");
+  if (rawHandoff === void 0)
+    return null;
+  let handoff = null;
+  if (rawHandoff !== null) {
+    if (!isRecord(rawHandoff))
+      return null;
+    const phase = field(rawHandoff, "phase");
+    if (!MAINTENANCE_REPORT_HANDOFF_PHASES.includes(phase))
+      return null;
+    const handoffId = clampText(field(rawHandoff, "handoffId"), MAINTENANCE_REPORT_LIMITS.maxHandoffIdLength);
+    if (handoffId === null || handoffId === "")
+      return null;
+    handoff = { phase, handoffId };
+    const rawReason = field(rawHandoff, "reason");
+    if (rawReason !== void 0) {
+      const reason = clampText(rawReason, MAINTENANCE_REPORT_LIMITS.maxHandoffReasonLength);
+      if (reason === null)
+        return null;
+      handoff.reason = reason;
+    }
+    const rawExpiresAt = field(rawHandoff, "expiresAt");
+    if (rawExpiresAt !== void 0) {
+      const expiresAt = isoOf(rawExpiresAt);
+      if (expiresAt === null)
+        return null;
+      handoff.expiresAt = expiresAt;
+    }
+  }
+  const report = {
+    version: MAINTENANCE_REPORT_VERSION,
+    processStartId,
+    readAt,
+    complete,
+    admittedTotal,
+    inflight: { sessions, tools, terminals, providerDependencies, walUnconfirmed },
+    blockers,
+    blockersTruncated,
+    handoff
+  };
+  if (JSON.stringify(report).length > MAINTENANCE_REPORT_LIMITS.maxSerializedBytes)
+    return null;
+  return report;
+}
+function parseStoredMaintenanceReport(stored) {
+  if (typeof stored !== "string" || stored === "")
+    return null;
+  if (stored.length > MAINTENANCE_REPORT_LIMITS.maxSerializedBytes)
+    return null;
+  try {
+    return parseMaintenanceReport(JSON.parse(stored));
+  } catch {
+    return null;
+  }
+}
+function maintenanceReportIsQuiet(report) {
+  if (!report)
+    return false;
+  if (report.complete !== true)
+    return false;
+  const { sessions, tools, terminals, providerDependencies, walUnconfirmed } = report.inflight;
+  return sessions === 0 && tools === 0 && terminals === 0 && providerDependencies === 0 && walUnconfirmed === 0;
+}
+function unknownMaintenanceReport(processStartId, readAtMs, admittedTotal = 0) {
+  return {
+    version: MAINTENANCE_REPORT_VERSION,
+    processStartId,
+    readAt: isoFromMs(readAtMs) || (/* @__PURE__ */ new Date(0)).toISOString(),
+    complete: "unknown",
+    admittedTotal: count(admittedTotal) ?? 0,
+    inflight: { sessions: 0, tools: 0, terminals: 0, providerDependencies: 0, walUnconfirmed: 0 },
+    blockers: [],
+    blockersTruncated: false,
+    handoff: null
+  };
+}
+function buildMaintenanceReport(input) {
+  const blockers = input.blockers.slice(0, MAINTENANCE_REPORT_LIMITS.maxBlockers).map((blocker) => ({
+    kind: blocker.kind,
+    ...blocker.id !== void 0 ? { id: blocker.id } : {},
+    reason: blocker.reason
+  }));
+  const candidate = {
+    version: MAINTENANCE_REPORT_VERSION,
+    processStartId: input.processStartId,
+    readAt: isoFromMs(input.readAtMs),
+    complete: input.complete,
+    admittedTotal: input.admittedTotal,
+    inflight: { ...input.inflight },
+    blockers,
+    blockersTruncated: input.blockers.length > MAINTENANCE_REPORT_LIMITS.maxBlockers,
+    handoff: input.handoff ? {
+      phase: input.handoff.phase,
+      handoffId: input.handoff.handoffId,
+      ...input.handoff.reason !== void 0 ? { reason: input.handoff.reason } : {},
+      ...input.handoff.expiresAtMs !== void 0 ? { expiresAt: isoFromMs(input.handoff.expiresAtMs) } : {}
+    } : null
+  };
+  return parseMaintenanceReport(candidate) ?? unknownMaintenanceReport(input.processStartId, input.readAtMs, input.admittedTotal);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAINTENANCE_REPORT_CAPABILITY,
+  MAINTENANCE_REPORT_HANDOFF_PHASES,
+  MAINTENANCE_REPORT_HEARTBEAT_KEY,
+  MAINTENANCE_REPORT_LIMITS,
+  MAINTENANCE_REPORT_VERSION,
+  buildMaintenanceReport,
+  maintenanceReportIsQuiet,
+  parseMaintenanceReport,
+  parseStoredMaintenanceReport,
+  unknownMaintenanceReport
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/toolApprovalSignature.d.ts

@@ -177,6 +177,57 @@ export declare function signToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): SignedToolApproval;
+/** A short-lived platform-signed assertion for exactly one local executor. */
+export interface PersonalDataExecutorLeasePayload {
+    v: 1;
+    leaseId: string;
+    /** The daemon identity registered for this machine. */
+    daemonId: string;
+    /** Fresh random daemon-start nonce; restart invalidates every prior lease. */
+    daemonInstanceId: string;
+    /** Account whose interactive session requested this local executor. */
+    ownerUserId: string;
+    /** Fixed, sorted set of operations this executor may make available. */
+    capabilities: string[];
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface SignedPersonalDataExecutorLease {
+    v: 1;
+    payload: string;
+    kid: string;
+    sig: string;
+}
+export type PersonalDataExecutorLeaseVerdict = {
+    ok: true;
+    leaseId: string;
+    ownerUserId: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: 'absent' | 'malformed' | 'unknown_key' | 'signature' | 'daemon_binding' | 'capabilities' | 'expired' | 'window';
+};
+/** Server-side mint. The caller must authorize the requesting user separately. */
+export declare function signPersonalDataExecutorLease(args: {
+    leaseId: string;
+    daemonId: string;
+    daemonInstanceId: string;
+    ownerUserId: string;
+    capabilities: readonly string[];
+    signer: ApprovalSigner;
+    now?: number;
+    ttlMs?: number;
+}): SignedPersonalDataExecutorLease | null;
+/**
+ * Daemon-side verifier. It trusts the same independently pinned platform
+ * keyset as v2 tool approvals, but a separate signature domain and schema.
+ */
+export declare function verifyPersonalDataExecutorLease(lease: unknown, expected: {
+    daemonId: string;
+    daemonInstanceId: string;
+    capabilities: readonly string[];
+    now?: number;
+}, keyset: ApprovalKeyset): PersonalDataExecutorLeaseVerdict;
 export interface SignedToolApprovalCall {
     toolUseId: string;
     toolName: string;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/toolApprovalSignature.js

@@ -24,8 +24,10 @@ __export(toolApprovalSignature_exports, {
   canonicalApprovalKeysetText: () => canonicalApprovalKeysetText,
   endorseApprovalKeysetText: () => endorseApprovalKeysetText,
   parseApprovalKeysetText: () => parseApprovalKeysetText,
+  signPersonalDataExecutorLease: () => signPersonalDataExecutorLease,
   signToolApproval: () => signToolApproval,
   verifyApprovalKeysetDocument: () => verifyApprovalKeysetDocument,
+  verifyPersonalDataExecutorLease: () => verifyPersonalDataExecutorLease,
   verifySignedToolApproval: () => verifySignedToolApproval,
   verifyToolApprovalAttestation: () => verifyToolApprovalAttestation
 });
@@ -35,11 +37,17 @@ var import_daemonToolApproval = require("./daemonToolApproval.js");
 const TOOL_APPROVAL_SIGNED_CAPABILITY = "tool_approval_signed_v1";
 const ATTESTATION_SIGNING_DOMAIN = "skrr-tool-approval-v2\n";
 const KEYSET_SIGNING_DOMAIN = "skrr-tool-approval-keyset-v1\n";
+const PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN = "skrr-personal-data-executor-lease-v1\n";
 const KID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 const MAX_PAYLOAD_BYTES = 4096;
 const MAX_KEYSET_BYTES = 16 * 1024;
 const MAX_KEYSET_KEYS = 16;
 const MAX_KEYSET_SIGNATURES = 16;
+const MAX_EXECUTOR_LEASE_CAPABILITIES = 8;
+const MAX_EXECUTOR_LEASE_TTL_MS = 5 * 60 * 1e3;
+const EXECUTOR_LEASE_CLOCK_SKEW_MS = 3e4;
+const EXECUTOR_LEASE_ID_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+const EXECUTOR_CAPABILITY_PATTERN = /^[a-z0-9_.:-]{1,128}$/;
 function approvalPublicKeyFromKeyObject(kid, key) {
   const publicKey = key.type === "private" ? (0, import_node_crypto.createPublicKey)(key) : key;
   const der = publicKey.export({ format: "der", type: "spki" });
@@ -70,6 +78,24 @@ function verifySignature(domain, message, sigB64, key) {
 function signMessage(domain, message, privateKey) {
   return (0, import_node_crypto.sign)(null, Buffer.from(domain + message, "utf8"), privateKey).toString("base64");
 }
+function isExecutorLeaseId(value) {
+  return typeof value === "string" && EXECUTOR_LEASE_ID_PATTERN.test(value);
+}
+function isExecutorLeaseText(value, max = 128) {
+  return typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f]/.test(value);
+}
+function canonicalExecutorCapabilities(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_EXECUTOR_LEASE_CAPABILITIES) {
+    return null;
+  }
+  const capabilities = value.map((entry) => typeof entry === "string" ? entry : "");
+  if (capabilities.some((entry) => !EXECUTOR_CAPABILITY_PATTERN.test(entry)))
+    return null;
+  const sorted = [...capabilities].sort();
+  if (new Set(sorted).size !== sorted.length)
+    return null;
+  return sorted;
+}
 function compareKid(a, b) {
   if (a === b)
     return 0;
@@ -199,6 +225,84 @@ function signToolApproval(args) {
     sig: signMessage(ATTESTATION_SIGNING_DOMAIN, text, args.signer.privateKey)
   };
 }
+function signPersonalDataExecutorLease(args) {
+  const capabilities = canonicalExecutorCapabilities(args.capabilities);
+  const ttlMs = args.ttlMs ?? MAX_EXECUTOR_LEASE_TTL_MS;
+  const now = args.now ?? Date.now();
+  if (!isExecutorLeaseId(args.leaseId) || !isExecutorLeaseText(args.daemonId) || !isExecutorLeaseId(args.daemonInstanceId) || !isExecutorLeaseText(args.ownerUserId) || !capabilities || !Number.isSafeInteger(now) || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_EXECUTOR_LEASE_TTL_MS) {
+    return null;
+  }
+  const payload = {
+    v: 1,
+    leaseId: args.leaseId,
+    daemonId: args.daemonId,
+    daemonInstanceId: args.daemonInstanceId,
+    ownerUserId: args.ownerUserId,
+    capabilities,
+    issuedAt: now,
+    expiresAt: now + ttlMs
+  };
+  const text = (0, import_daemonToolApproval.canonicalApprovalJson)(payload);
+  return {
+    v: 1,
+    payload: text,
+    kid: args.signer.kid,
+    sig: signMessage(PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN, text, args.signer.privateKey)
+  };
+}
+function verifyPersonalDataExecutorLease(lease, expected, keyset) {
+  if (lease === void 0 || lease === null)
+    return { ok: false, reason: "absent" };
+  if (!lease || typeof lease !== "object" || Array.isArray(lease)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const wire = lease;
+  if (wire.v !== 1 || typeof wire.payload !== "string" || wire.payload.length === 0 || wire.payload.length > MAX_PAYLOAD_BYTES || typeof wire.kid !== "string" || typeof wire.sig !== "string") {
+    return { ok: false, reason: "malformed" };
+  }
+  const pinnedKey = keyset.keys.find((key2) => key2.kid === wire.kid);
+  const key = pinnedKey ? ed25519PublicKey(pinnedKey.publicKeySpkiB64) : null;
+  if (!key)
+    return { ok: false, reason: "unknown_key" };
+  if (!verifySignature(PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN, wire.payload, wire.sig, key)) {
+    return { ok: false, reason: "signature" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(wire.payload);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const payload = parsed;
+  const issuedAt = payload.issuedAt;
+  const expiresAt = payload.expiresAt;
+  const capabilities = canonicalExecutorCapabilities(payload.capabilities);
+  if (payload.v !== 1 || !isExecutorLeaseId(payload.leaseId) || !isExecutorLeaseText(payload.daemonId) || !isExecutorLeaseId(payload.daemonInstanceId) || !isExecutorLeaseText(payload.ownerUserId) || !capabilities || typeof issuedAt !== "number" || typeof expiresAt !== "number" || !Number.isSafeInteger(issuedAt) || !Number.isSafeInteger(expiresAt)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const expectedCapabilities = canonicalExecutorCapabilities(expected.capabilities);
+  if (!expectedCapabilities || capabilities.join("\0") !== expectedCapabilities.join("\0")) {
+    return { ok: false, reason: "capabilities" };
+  }
+  if (payload.daemonId !== expected.daemonId || payload.daemonInstanceId !== expected.daemonInstanceId) {
+    return { ok: false, reason: "daemon_binding" };
+  }
+  const now = expected.now ?? Date.now();
+  if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_EXECUTOR_LEASE_TTL_MS || issuedAt > now + EXECUTOR_LEASE_CLOCK_SKEW_MS) {
+    return { ok: false, reason: "window" };
+  }
+  if (expiresAt <= now)
+    return { ok: false, reason: "expired" };
+  return {
+    ok: true,
+    leaseId: payload.leaseId,
+    ownerUserId: payload.ownerUserId,
+    expiresAt
+  };
+}
 function verifySignedToolApproval(approval, call, keyset) {
   if (approval === void 0 || approval === null)
     return { ok: false, reason: "absent" };
@@ -271,8 +375,10 @@ function verifyToolApprovalAttestation(approval, call, pin) {
   canonicalApprovalKeysetText,
   endorseApprovalKeysetText,
   parseApprovalKeysetText,
+  signPersonalDataExecutorLease,
   signToolApproval,
   verifyApprovalKeysetDocument,
+  verifyPersonalDataExecutorLease,
   verifySignedToolApproval,
   verifyToolApprovalAttestation
 });

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/computerWire.d.ts

@@ -185,6 +185,14 @@ export type DaemonComputerEventKey = keyof typeof DAEMON_COMPUTER_EVENTS;
 export type DaemonComputerEventName = (typeof DAEMON_COMPUTER_EVENTS)[DaemonComputerEventKey];
 export declare const COMPUTER_EVENT_NAMES: readonly ComputerEventName[];
 export declare const DAEMON_COMPUTER_EVENT_NAMES: readonly DaemonComputerEventName[];
+/**
+ * API → daemon: an authorized person observes, configures, stops or recovers
+ * the machine's Computer Use provider. Answered with `daemon:computer:ack`. It
+ * is deliberately outside `DAEMON_COMPUTER_EVENTS`, which lists the events the
+ * attachment protocol itself speaks, so the registry parity over that table
+ * does not move.
+ */
+export declare const DAEMON_COMPUTER_USE_CONTROL_EVENT: "daemon:computer:use-control";
 /** The daemon → API events; every other `daemon:computer:*` event flows API → daemon. */
 export declare const DAEMON_COMPUTER_REPORT_EVENT_KEYS: readonly ["ack", "manifest", "data", "activity", "detached", "filesChanged", "diagnostics"];
 /** The API → client events; every other `computer:*` event flows client → API. */
@@ -362,7 +370,7 @@ export declare const COMPUTER_CAPABILITY_VALUES: [ComputerCapability, ...Compute
  * Every refusal and limit the computer protocol can answer with. Callers branch
  * on the code; a message beside it is free text and may change.
  */
-export declare const COMPUTER_REFUSAL_CODES: readonly ["human_control", "stale_epoch", "stale_generation", "file_changed", "capability_missing", "unauthorized", "control_denied", "not_holder", "attachment_limit", "observer_limit", "watch_limit", "grant_limit", "browser_limit", "rate_limited", "not_found", "surface_ended", "machine_unavailable", "daemon_unreachable", "relay_error", "timeout", "invalid_request", "consent_missing", "path_withheld", "too_large", "service_limit"];
+export declare const COMPUTER_REFUSAL_CODES: readonly ["human_control", "stale_epoch", "stale_generation", "file_changed", "capability_missing", "unauthorized", "control_denied", "not_holder", "attachment_limit", "observer_limit", "watch_limit", "grant_limit", "browser_limit", "rate_limited", "not_found", "surface_ended", "machine_unavailable", "daemon_unreachable", "relay_error", "timeout", "invalid_request", "consent_missing", "path_withheld", "too_large", "service_limit", "maintenance_hold"];
 export type ComputerRefusalCode = (typeof COMPUTER_REFUSAL_CODES)[number];
 /**
  * The code when it is a computer refusal, else `null`. There is one spelling