@skrr-ai/cli 0.1.119 → 0.1.120

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/maintenanceReportWire.js

@@ -0,0 +1,342 @@
+/**
+ * The maintenance report wire contract (Machine Maintenance, OSK-19107, task M24;
+ * `docs/architecture/machine-maintenance/implementation-plan-2026-10-24.md` §3.5,
+ * `phase0/m04-quiescence-evidence.md` §2.5 and §2.6).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so the
+ * capability name, the payload shape and its bounds live in this package, which
+ * every end can import (`@skrr-ai/auth-core/maintenance-report-wire`).
+ * `maintenanceReportWire.test.ts` fails on a second spelling of the capability
+ * anywhere else in the repo. The shape follows `dedicatedRuntimeBusyWire.ts`, the
+ * precedent for a positively announced, fail-closed report, and differs from it
+ * only where the owner's pause needs more.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "What does this daemon process hold right now that an update would take from
+ * the owner, and has anything been admitted since the last time you asked?" It is
+ * a LOCAL read summarised into counts, the handoff's own restart blockers, and
+ * the daemon's own update handoff phase.
+ *
+ * It is EVIDENCE, never authority. The fence does not depend on it: a daemon that
+ * lies, or one that sends nothing, cannot make a held machine accept work. Only
+ * this report can grant `ready` (a server-side source can only veto it), and a
+ * daemon that never announces the capability can only reach `ready` by the
+ * owner's attestation.
+ *
+ * FAIL CLOSED, in three places
+ * ---------------------------------------------------------------------------
+ *  1. A count is `0` only when the daemon positively counted. A source that could
+ *     not be read is `complete: 'unknown'`; a daemon that is leaving is
+ *     `complete: false`. A reader MUST treat both as busy, whatever the counts
+ *     say (`maintenanceReportIsQuiet` is the one place that says so).
+ *  2. A report that is malformed in ANY field is `null` from
+ *     `parseMaintenanceReport`, and the caller treats the machine as not quiet.
+ *     A count that is missing, negative, fractional or not a safe integer is not
+ *     "zero": it is a different, broken report. A version this parser does not
+ *     know is `null` too: a newer shape needs its own announced capability.
+ *  3. Bounds. The blocker list and every string are clamped, so one report can
+ *     never be large enough to matter, and a field that is NOT in the contract is
+ *     never copied into what the parser returns (the result is built from a
+ *     fresh object, so `__proto__` and its kin cannot ride along).
+ *
+ * `admittedTotal`
+ * ---------------------------------------------------------------------------
+ * A MONOTONIC counter of admissions since this process started. The server proves
+ * "nothing was admitted between two reports" by comparing two values, without
+ * trusting the daemon's clock. It counts at every place the daemon admits work
+ * and OVER-counts on purpose (one admission may be noted at the gate and again
+ * where the work registers): a second increment can only make the proof harder,
+ * never easier. A path that the daemon cannot count must say so in
+ * `daemon/src/maintenance-report.ts`, not hide in a zero.
+ */
+export const MAINTENANCE_REPORT_CAPABILITY = 'maintenance_report_v1';
+/** The heartbeat (and register) key the report rides under. Sent only by a daemon that announced the capability. */
+export const MAINTENANCE_REPORT_HEARTBEAT_KEY = 'maintenanceReport';
+export const MAINTENANCE_REPORT_VERSION = 1;
+/**
+ * The daemon's own update handoff phases (`daemon/src/update/handoff.ts`), and the
+ * members of `DaemonMaintenanceHandoff.phase` in `@skrr-ai/data-provider`. A phase
+ * outside this list is a newer protocol and makes the whole report `null`.
+ */
+export const MAINTENANCE_REPORT_HANDOFF_PHASES = [
+    'ready',
+    'deferred',
+    'reconnecting',
+    'verified',
+    'failed',
+    'rolled-back',
+];
+export const MAINTENANCE_REPORT_LIMITS = {
+    /** The handoff's blockers carried for the "waiting on" text; the counts, not this list, decide busy. */
+    maxBlockers: 32,
+    maxKindLength: 32,
+    maxIdLength: 128,
+    maxReasonLength: 240,
+    maxHandoffIdLength: 64,
+    maxHandoffReasonLength: 64,
+    maxProcessStartIdLength: 64,
+    /** Hard ceiling on the serialized report. The clamps above keep a valid one well under it. */
+    maxSerializedBytes: 20_000,
+};
+const PROCESS_START_ID_PATTERN = /^[A-Za-z0-9_.:-]+$/;
+// C0 controls and DEL. A blocker's text is shown to an owner and logged.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * An OWN property, or `undefined`. A key the sender did not put on the object
+ * itself is never read from its prototype chain, so a polluted `Object.prototype`
+ * (or a sender that smuggles a `__proto__`) cannot supply a field the report
+ * did not carry.
+ */
+function field(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+/** ISO text for an epoch-ms value, or `''` when the value is not a representable time. */
+function isoFromMs(ms) {
+    if (typeof ms !== 'number' || !Number.isFinite(ms))
+        return '';
+    const date = new Date(ms);
+    return Number.isNaN(date.getTime()) ? '' : date.toISOString();
+}
+function count(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function clampText(value, max) {
+    if (typeof value !== 'string')
+        return null;
+    const clean = value.replace(CONTROL_CHARACTERS, ' ');
+    return clean.length > max ? clean.slice(0, max) : clean;
+}
+function isoOf(value) {
+    if (typeof value !== 'string')
+        return null;
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms))
+        return null;
+    try {
+        return new Date(ms).toISOString();
+    }
+    catch {
+        return null;
+    }
+}
+function completeOf(value) {
+    return value === true || value === false || value === 'unknown' ? value : undefined;
+}
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from a
+ * daemon that did not announce the capability, an unknown version, or oversized
+ * is `null`, and the caller must then treat the machine as NOT quiet. Never
+ * trusts a field it did not validate and never copies one it does not know.
+ */
+export function parseMaintenanceReport(raw) {
+    if (!isRecord(raw))
+        return null;
+    if (field(raw, 'version') !== MAINTENANCE_REPORT_VERSION)
+        return null;
+    const processStartId = field(raw, 'processStartId');
+    if (typeof processStartId !== 'string' ||
+        processStartId.length < 1 ||
+        processStartId.length > MAINTENANCE_REPORT_LIMITS.maxProcessStartIdLength ||
+        !PROCESS_START_ID_PATTERN.test(processStartId)) {
+        return null;
+    }
+    const readAt = isoOf(field(raw, 'readAt'));
+    if (readAt === null)
+        return null;
+    const complete = completeOf(field(raw, 'complete'));
+    if (complete === undefined)
+        return null;
+    const admittedTotal = count(field(raw, 'admittedTotal'));
+    if (admittedTotal === null)
+        return null;
+    const rawInflight = field(raw, 'inflight');
+    if (!isRecord(rawInflight))
+        return null;
+    const sessions = count(field(rawInflight, 'sessions'));
+    const tools = count(field(rawInflight, 'tools'));
+    const terminals = count(field(rawInflight, 'terminals'));
+    const providerDependencies = count(field(rawInflight, 'providerDependencies'));
+    const walUnconfirmed = count(field(rawInflight, 'walUnconfirmed'));
+    if (sessions === null ||
+        tools === null ||
+        terminals === null ||
+        providerDependencies === null ||
+        walUnconfirmed === null) {
+        return null;
+    }
+    const rawBlockers = field(raw, 'blockers');
+    if (!Array.isArray(rawBlockers))
+        return null;
+    const rawTruncated = field(raw, 'blockersTruncated');
+    if (rawTruncated !== undefined && typeof rawTruncated !== 'boolean')
+        return null;
+    const limit = MAINTENANCE_REPORT_LIMITS.maxBlockers;
+    const blockers = [];
+    // Only the first `limit` elements are looked at: the work is bounded by the
+    // contract, not by what the sender chose to send.
+    for (let index = 0; index < rawBlockers.length && blockers.length < limit; index += 1) {
+        const element = rawBlockers[index];
+        if (!isRecord(element))
+            return null;
+        const kind = clampText(field(element, 'kind'), MAINTENANCE_REPORT_LIMITS.maxKindLength);
+        const reason = clampText(field(element, 'reason'), MAINTENANCE_REPORT_LIMITS.maxReasonLength);
+        if (kind === null || kind === '' || reason === null)
+            return null;
+        const blocker = { kind, reason };
+        const rawId = field(element, 'id');
+        if (rawId !== undefined) {
+            const id = clampText(rawId, MAINTENANCE_REPORT_LIMITS.maxIdLength);
+            if (id === null)
+                return null;
+            blocker.id = id;
+        }
+        blockers.push(blocker);
+    }
+    const blockersTruncated = rawBlockers.length > limit || rawTruncated === true;
+    // The key is part of the contract: `null` says "no handoff", and an absent key
+    // says nothing, which is not a way to claim there is none.
+    const rawHandoff = field(raw, 'handoff');
+    if (rawHandoff === undefined)
+        return null;
+    let handoff = null;
+    if (rawHandoff !== null) {
+        if (!isRecord(rawHandoff))
+            return null;
+        const phase = field(rawHandoff, 'phase');
+        if (!MAINTENANCE_REPORT_HANDOFF_PHASES.includes(phase))
+            return null;
+        const handoffId = clampText(field(rawHandoff, 'handoffId'), MAINTENANCE_REPORT_LIMITS.maxHandoffIdLength);
+        if (handoffId === null || handoffId === '')
+            return null;
+        handoff = { phase: phase, handoffId };
+        const rawReason = field(rawHandoff, 'reason');
+        if (rawReason !== undefined) {
+            const reason = clampText(rawReason, MAINTENANCE_REPORT_LIMITS.maxHandoffReasonLength);
+            if (reason === null)
+                return null;
+            handoff.reason = reason;
+        }
+        const rawExpiresAt = field(rawHandoff, 'expiresAt');
+        if (rawExpiresAt !== undefined) {
+            const expiresAt = isoOf(rawExpiresAt);
+            if (expiresAt === null)
+                return null;
+            handoff.expiresAt = expiresAt;
+        }
+    }
+    const report = {
+        version: MAINTENANCE_REPORT_VERSION,
+        processStartId,
+        readAt,
+        complete,
+        admittedTotal,
+        inflight: { sessions, tools, terminals, providerDependencies, walUnconfirmed },
+        blockers,
+        blockersTruncated,
+        handoff,
+    };
+    if (JSON.stringify(report).length > MAINTENANCE_REPORT_LIMITS.maxSerializedBytes)
+        return null;
+    return report;
+}
+/**
+ * A report as it was stored (JSON text on the presence row). Anything that does
+ * not parse, or does not validate, is `null`: a stored value is an input like any
+ * other and is read with the same suspicion.
+ */
+export function parseStoredMaintenanceReport(stored) {
+    if (typeof stored !== 'string' || stored === '')
+        return null;
+    if (stored.length > MAINTENANCE_REPORT_LIMITS.maxSerializedBytes)
+        return null;
+    try {
+        return parseMaintenanceReport(JSON.parse(stored));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The one definition of a POSITIVE ZERO: the daemon read every source and found
+ * nothing. `complete: 'unknown'` and `complete: false` are never zero whatever
+ * the counts say, because the counts were not (all) read.
+ *
+ * A blocker that is not work (a missing restart owner, say) does not make a
+ * report non-quiet; readiness is "nothing is running", not "the daemon can
+ * restart itself".
+ */
+export function maintenanceReportIsQuiet(report) {
+    if (!report)
+        return false;
+    if (report.complete !== true)
+        return false;
+    const { sessions, tools, terminals, providerDependencies, walUnconfirmed } = report.inflight;
+    return (sessions === 0 &&
+        tools === 0 &&
+        terminals === 0 &&
+        providerDependencies === 0 &&
+        walUnconfirmed === 0);
+}
+/**
+ * A report that says nothing was counted. The shape the daemon sends when it
+ * could not read an inventory source at all, and the shape `buildMaintenanceReport`
+ * falls back to when it was handed something the contract cannot carry.
+ */
+export function unknownMaintenanceReport(processStartId, readAtMs, admittedTotal = 0) {
+    return {
+        version: MAINTENANCE_REPORT_VERSION,
+        processStartId,
+        readAt: isoFromMs(readAtMs) || new Date(0).toISOString(),
+        complete: 'unknown',
+        admittedTotal: count(admittedTotal) ?? 0,
+        inflight: { sessions: 0, tools: 0, terminals: 0, providerDependencies: 0, walUnconfirmed: 0 },
+        blockers: [],
+        blockersTruncated: false,
+        handoff: null,
+    };
+}
+/**
+ * Build the wire report from what the daemon read. Input the contract cannot
+ * carry (a negative count, a blocker with no kind, a time that is not a time)
+ * becomes an `unknown` report rather than a throw or a report that parses to
+ * something else, so the result parses whenever `processStartId` is a real id (the
+ * daemon's always is). A builder that threw would turn a bad read into silence,
+ * and silence is the absence of a report, which the server reads the same way,
+ * but later.
+ */
+export function buildMaintenanceReport(input) {
+    const blockers = input.blockers
+        .slice(0, MAINTENANCE_REPORT_LIMITS.maxBlockers)
+        .map((blocker) => ({
+        kind: blocker.kind,
+        ...(blocker.id !== undefined ? { id: blocker.id } : {}),
+        reason: blocker.reason,
+    }));
+    const candidate = {
+        version: MAINTENANCE_REPORT_VERSION,
+        processStartId: input.processStartId,
+        readAt: isoFromMs(input.readAtMs),
+        complete: input.complete,
+        admittedTotal: input.admittedTotal,
+        inflight: { ...input.inflight },
+        blockers,
+        blockersTruncated: input.blockers.length > MAINTENANCE_REPORT_LIMITS.maxBlockers,
+        handoff: input.handoff
+            ? {
+                phase: input.handoff.phase,
+                handoffId: input.handoff.handoffId,
+                ...(input.handoff.reason !== undefined ? { reason: input.handoff.reason } : {}),
+                ...(input.handoff.expiresAtMs !== undefined
+                    ? { expiresAt: isoFromMs(input.handoff.expiresAtMs) }
+                    : {}),
+            }
+            : null,
+    };
+    return (parseMaintenanceReport(candidate) ??
+        unknownMaintenanceReport(input.processStartId, input.readAtMs, input.admittedTotal));
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolApprovalSignature.d.ts

@@ -177,6 +177,57 @@ export declare function signToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): SignedToolApproval;
+/** A short-lived platform-signed assertion for exactly one local executor. */
+export interface PersonalDataExecutorLeasePayload {
+    v: 1;
+    leaseId: string;
+    /** The daemon identity registered for this machine. */
+    daemonId: string;
+    /** Fresh random daemon-start nonce; restart invalidates every prior lease. */
+    daemonInstanceId: string;
+    /** Account whose interactive session requested this local executor. */
+    ownerUserId: string;
+    /** Fixed, sorted set of operations this executor may make available. */
+    capabilities: string[];
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface SignedPersonalDataExecutorLease {
+    v: 1;
+    payload: string;
+    kid: string;
+    sig: string;
+}
+export type PersonalDataExecutorLeaseVerdict = {
+    ok: true;
+    leaseId: string;
+    ownerUserId: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: 'absent' | 'malformed' | 'unknown_key' | 'signature' | 'daemon_binding' | 'capabilities' | 'expired' | 'window';
+};
+/** Server-side mint. The caller must authorize the requesting user separately. */
+export declare function signPersonalDataExecutorLease(args: {
+    leaseId: string;
+    daemonId: string;
+    daemonInstanceId: string;
+    ownerUserId: string;
+    capabilities: readonly string[];
+    signer: ApprovalSigner;
+    now?: number;
+    ttlMs?: number;
+}): SignedPersonalDataExecutorLease | null;
+/**
+ * Daemon-side verifier. It trusts the same independently pinned platform
+ * keyset as v2 tool approvals, but a separate signature domain and schema.
+ */
+export declare function verifyPersonalDataExecutorLease(lease: unknown, expected: {
+    daemonId: string;
+    daemonInstanceId: string;
+    capabilities: readonly string[];
+    now?: number;
+}, keyset: ApprovalKeyset): PersonalDataExecutorLeaseVerdict;
 export interface SignedToolApprovalCall {
     toolUseId: string;
     toolName: string;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolApprovalSignature.js

@@ -44,6 +44,13 @@ export const TOOL_APPROVAL_SIGNED_CAPABILITY = 'tool_approval_signed_v1';
  */
 const ATTESTATION_SIGNING_DOMAIN = 'skrr-tool-approval-v2\n';
 const KEYSET_SIGNING_DOMAIN = 'skrr-tool-approval-keyset-v1\n';
+/**
+ * A distinct domain for the local personal-data executor. A tool approval is
+ * a user's decision about one action; an executor lease is evidence that the
+ * platform authenticated one particular trusted local process. Neither
+ * signature can be substituted for the other.
+ */
+const PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN = 'skrr-personal-data-executor-lease-v1\n';
 /** A key id: short, printable, and safe to put in a log line. */
 const KID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 /** Bounds on untrusted wire input, so a hostile document cannot cost much. */
@@ -51,6 +58,11 @@ const MAX_PAYLOAD_BYTES = 4096;
 const MAX_KEYSET_BYTES = 16 * 1024;
 const MAX_KEYSET_KEYS = 16;
 const MAX_KEYSET_SIGNATURES = 16;
+const MAX_EXECUTOR_LEASE_CAPABILITIES = 8;
+const MAX_EXECUTOR_LEASE_TTL_MS = 5 * 60 * 1000;
+const EXECUTOR_LEASE_CLOCK_SKEW_MS = 30_000;
+const EXECUTOR_LEASE_ID_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+const EXECUTOR_CAPABILITY_PATTERN = /^[a-z0-9_.:-]{1,128}$/;
 /** Derive the wire public key from a private (or public) Ed25519 KeyObject. */
 export function approvalPublicKeyFromKeyObject(kid, key) {
     const publicKey = key.type === 'private' ? createPublicKey(key) : key;
@@ -86,6 +98,24 @@ function verifySignature(domain, message, sigB64, key) {
 function signMessage(domain, message, privateKey) {
     return signEd25519(null, Buffer.from(domain + message, 'utf8'), privateKey).toString('base64');
 }
+function isExecutorLeaseId(value) {
+    return typeof value === 'string' && EXECUTOR_LEASE_ID_PATTERN.test(value);
+}
+function isExecutorLeaseText(value, max = 128) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f]/.test(value);
+}
+function canonicalExecutorCapabilities(value) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_EXECUTOR_LEASE_CAPABILITIES) {
+        return null;
+    }
+    const capabilities = value.map((entry) => typeof entry === 'string' ? entry : '');
+    if (capabilities.some((entry) => !EXECUTOR_CAPABILITY_PATTERN.test(entry)))
+        return null;
+    const sorted = [...capabilities].sort();
+    if (new Set(sorted).size !== sorted.length)
+        return null;
+    return sorted;
+}
 /** Code-unit order: the same on every runtime, unlike `localeCompare`. */
 function compareKid(a, b) {
     if (a === b)
@@ -255,6 +285,114 @@ export function signToolApproval(args) {
         sig: signMessage(ATTESTATION_SIGNING_DOMAIN, text, args.signer.privateKey),
     };
 }
+/** Server-side mint. The caller must authorize the requesting user separately. */
+export function signPersonalDataExecutorLease(args) {
+    const capabilities = canonicalExecutorCapabilities(args.capabilities);
+    const ttlMs = args.ttlMs ?? MAX_EXECUTOR_LEASE_TTL_MS;
+    const now = args.now ?? Date.now();
+    if (!isExecutorLeaseId(args.leaseId) ||
+        !isExecutorLeaseText(args.daemonId) ||
+        !isExecutorLeaseId(args.daemonInstanceId) ||
+        !isExecutorLeaseText(args.ownerUserId) ||
+        !capabilities ||
+        !Number.isSafeInteger(now) ||
+        !Number.isSafeInteger(ttlMs) ||
+        ttlMs <= 0 ||
+        ttlMs > MAX_EXECUTOR_LEASE_TTL_MS) {
+        return null;
+    }
+    const payload = {
+        v: 1,
+        leaseId: args.leaseId,
+        daemonId: args.daemonId,
+        daemonInstanceId: args.daemonInstanceId,
+        ownerUserId: args.ownerUserId,
+        capabilities,
+        issuedAt: now,
+        expiresAt: now + ttlMs,
+    };
+    const text = canonicalApprovalJson(payload);
+    return {
+        v: 1,
+        payload: text,
+        kid: args.signer.kid,
+        sig: signMessage(PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN, text, args.signer.privateKey),
+    };
+}
+/**
+ * Daemon-side verifier. It trusts the same independently pinned platform
+ * keyset as v2 tool approvals, but a separate signature domain and schema.
+ */
+export function verifyPersonalDataExecutorLease(lease, expected, keyset) {
+    if (lease === undefined || lease === null)
+        return { ok: false, reason: 'absent' };
+    if (!lease || typeof lease !== 'object' || Array.isArray(lease)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const wire = lease;
+    if (wire.v !== 1 ||
+        typeof wire.payload !== 'string' ||
+        wire.payload.length === 0 ||
+        wire.payload.length > MAX_PAYLOAD_BYTES ||
+        typeof wire.kid !== 'string' ||
+        typeof wire.sig !== 'string') {
+        return { ok: false, reason: 'malformed' };
+    }
+    const pinnedKey = keyset.keys.find((key) => key.kid === wire.kid);
+    const key = pinnedKey ? ed25519PublicKey(pinnedKey.publicKeySpkiB64) : null;
+    if (!key)
+        return { ok: false, reason: 'unknown_key' };
+    if (!verifySignature(PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN, wire.payload, wire.sig, key)) {
+        return { ok: false, reason: 'signature' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(wire.payload);
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const payload = parsed;
+    const issuedAt = payload.issuedAt;
+    const expiresAt = payload.expiresAt;
+    const capabilities = canonicalExecutorCapabilities(payload.capabilities);
+    if (payload.v !== 1 ||
+        !isExecutorLeaseId(payload.leaseId) ||
+        !isExecutorLeaseText(payload.daemonId) ||
+        !isExecutorLeaseId(payload.daemonInstanceId) ||
+        !isExecutorLeaseText(payload.ownerUserId) ||
+        !capabilities ||
+        typeof issuedAt !== 'number' ||
+        typeof expiresAt !== 'number' ||
+        !Number.isSafeInteger(issuedAt) ||
+        !Number.isSafeInteger(expiresAt)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const expectedCapabilities = canonicalExecutorCapabilities(expected.capabilities);
+    if (!expectedCapabilities || capabilities.join('\u0000') !== expectedCapabilities.join('\u0000')) {
+        return { ok: false, reason: 'capabilities' };
+    }
+    if (payload.daemonId !== expected.daemonId || payload.daemonInstanceId !== expected.daemonInstanceId) {
+        return { ok: false, reason: 'daemon_binding' };
+    }
+    const now = expected.now ?? Date.now();
+    if (expiresAt <= issuedAt ||
+        expiresAt - issuedAt > MAX_EXECUTOR_LEASE_TTL_MS ||
+        issuedAt > now + EXECUTOR_LEASE_CLOCK_SKEW_MS) {
+        return { ok: false, reason: 'window' };
+    }
+    if (expiresAt <= now)
+        return { ok: false, reason: 'expired' };
+    return {
+        ok: true,
+        leaseId: payload.leaseId,
+        ownerUserId: payload.ownerUserId,
+        expiresAt,
+    };
+}
 /**
  * Daemon side: verify a v2 attestation against the pinned keyset and the call.
  * Order matters: nothing in the payload is READ until the signature verified

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -114,6 +114,16 @@
         "default": "./dist/cjs/dedicatedRuntimeBusyWire.js"
       }
     },
+    "./maintenance-report-wire": {
+      "import": {
+        "types": "./dist/esm/maintenanceReportWire.d.ts",
+        "default": "./dist/esm/maintenanceReportWire.js"
+      },
+      "require": {
+        "types": "./dist/cjs/maintenanceReportWire.d.ts",
+        "default": "./dist/cjs/maintenanceReportWire.js"
+      }
+    },
     "./computer-wire": {
       "import": {
         "types": "./dist/esm/computerWire.d.ts",
@@ -264,6 +274,16 @@
         "default": "./dist/cjs/restartArtifact.js"
       }
     },
+    "./guided-update": {
+      "import": {
+        "types": "./dist/esm/guidedUpdate.d.ts",
+        "default": "./dist/esm/guidedUpdate.js"
+      },
+      "require": {
+        "types": "./dist/cjs/guidedUpdate.d.ts",
+        "default": "./dist/cjs/guidedUpdate.js"
+      }
+    },
     "./tool-operation-outcome": {
       "import": {
         "types": "./dist/esm/toolOperationOutcome.d.ts",