@skrr-ai/cli 0.1.119 → 0.1.121

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/macos.js

@@ -272,17 +272,9 @@ async function readKekFromKeychain(service, account) {
     }
 }
 /**
- * Persist a master KEK to the keychain. Uses `-U` so the upsert is
- * idempotent — repeated first-use races just overwrite each other rather
- * than failing with "item already exists." We accept the second-writer-
- * wins outcome because (a) the daemon is single-tenant per profile and
- * (b) all writers are generating the same shape of secret.
- *
- * Race note: if two daemon processes both miss and both store within the
- * same TOCTOU window, the second overwrite wins and any DEKs already
- * wrapped under the first KEK become permanently unrecoverable. The
- * envelope path's caller (`credEnvelope.ts:initCredEnvelope`) handles
- * this gracefully — `unwrap` failure → log + treat as first enrollment.
+ * Create a master KEK without replacing an existing item. This key is shared
+ * by profiles, so even a first-use race in a different process must not
+ * overwrite the key protecting already wrapped credentials.
  *
  * The `service` / `account` parameters are threaded from the calling
  * `MacosKek` instance so each instance keeps its own keychain entry.
@@ -312,7 +304,6 @@ async function writeKekToKeychain(kek, service, account) {
             account,
             '-w',
             b64,
-            '-U',
             keychainPath,
         ]);
     }
@@ -410,9 +401,31 @@ async function resolveOrCreateKek(service, account) {
         return existing;
     }
     const fresh = crypto.randomBytes(KEY_LEN);
-    await writeKekToKeychain(fresh, service, account);
-    _kekCacheBySvc.set(cacheKey, fresh);
-    return fresh;
+    try {
+        try {
+            await writeKekToKeychain(fresh, service, account);
+        }
+        catch (error) {
+            // A concurrent creator may have won. Only a successful read of its
+            // existing item makes the failed create recoverable; all other errors
+            // remain failures and must not cause an update or a second write.
+            const winner = await readKekFromKeychain(service, account).catch(() => null);
+            if (!winner)
+                throw error;
+            _kekCacheBySvc.set(cacheKey, winner);
+            return winner;
+        }
+        const persisted = await readKekFromKeychain(service, account);
+        if (!persisted || !persisted.equals(fresh)) {
+            persisted?.fill(0);
+            throw new KekUnavailableError(KIND_SHELLOUT, 'created master KEK could not be verified');
+        }
+        _kekCacheBySvc.set(cacheKey, persisted);
+        return persisted;
+    }
+    finally {
+        fresh.fill(0);
+    }
 }
 /** Resolve an already-persisted master KEK without creating one. */
 async function resolveExistingKek(service, account) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/maintenanceReportWire.d.ts

@@ -0,0 +1,178 @@
+/**
+ * The maintenance report wire contract (Machine Maintenance, OSK-19107, task M24;
+ * `docs/architecture/machine-maintenance/implementation-plan-2026-10-24.md` §3.5,
+ * `phase0/m04-quiescence-evidence.md` §2.5 and §2.6).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so the
+ * capability name, the payload shape and its bounds live in this package, which
+ * every end can import (`@skrr-ai/auth-core/maintenance-report-wire`).
+ * `maintenanceReportWire.test.ts` fails on a second spelling of the capability
+ * anywhere else in the repo. The shape follows `dedicatedRuntimeBusyWire.ts`, the
+ * precedent for a positively announced, fail-closed report, and differs from it
+ * only where the owner's pause needs more.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "What does this daemon process hold right now that an update would take from
+ * the owner, and has anything been admitted since the last time you asked?" It is
+ * a LOCAL read summarised into counts, the handoff's own restart blockers, and
+ * the daemon's own update handoff phase.
+ *
+ * It is EVIDENCE, never authority. The fence does not depend on it: a daemon that
+ * lies, or one that sends nothing, cannot make a held machine accept work. Only
+ * this report can grant `ready` (a server-side source can only veto it), and a
+ * daemon that never announces the capability can only reach `ready` by the
+ * owner's attestation.
+ *
+ * FAIL CLOSED, in three places
+ * ---------------------------------------------------------------------------
+ *  1. A count is `0` only when the daemon positively counted. A source that could
+ *     not be read is `complete: 'unknown'`; a daemon that is leaving is
+ *     `complete: false`. A reader MUST treat both as busy, whatever the counts
+ *     say (`maintenanceReportIsQuiet` is the one place that says so).
+ *  2. A report that is malformed in ANY field is `null` from
+ *     `parseMaintenanceReport`, and the caller treats the machine as not quiet.
+ *     A count that is missing, negative, fractional or not a safe integer is not
+ *     "zero": it is a different, broken report. A version this parser does not
+ *     know is `null` too: a newer shape needs its own announced capability.
+ *  3. Bounds. The blocker list and every string are clamped, so one report can
+ *     never be large enough to matter, and a field that is NOT in the contract is
+ *     never copied into what the parser returns (the result is built from a
+ *     fresh object, so `__proto__` and its kin cannot ride along).
+ *
+ * `admittedTotal`
+ * ---------------------------------------------------------------------------
+ * A MONOTONIC counter of admissions since this process started. The server proves
+ * "nothing was admitted between two reports" by comparing two values, without
+ * trusting the daemon's clock. It counts at every place the daemon admits work
+ * and OVER-counts on purpose (one admission may be noted at the gate and again
+ * where the work registers): a second increment can only make the proof harder,
+ * never easier. A path that the daemon cannot count must say so in
+ * `daemon/src/maintenance-report.ts`, not hide in a zero.
+ */
+export declare const MAINTENANCE_REPORT_CAPABILITY = "maintenance_report_v1";
+/** The heartbeat (and register) key the report rides under. Sent only by a daemon that announced the capability. */
+export declare const MAINTENANCE_REPORT_HEARTBEAT_KEY = "maintenanceReport";
+export declare const MAINTENANCE_REPORT_VERSION = 1;
+/**
+ * The daemon's own update handoff phases (`daemon/src/update/handoff.ts`), and the
+ * members of `DaemonMaintenanceHandoff.phase` in `@skrr-ai/data-provider`. A phase
+ * outside this list is a newer protocol and makes the whole report `null`.
+ */
+export declare const MAINTENANCE_REPORT_HANDOFF_PHASES: readonly ["ready", "deferred", "reconnecting", "verified", "failed", "rolled-back"];
+export type MaintenanceReportHandoffPhase = (typeof MAINTENANCE_REPORT_HANDOFF_PHASES)[number];
+export declare const MAINTENANCE_REPORT_LIMITS: {
+    /** The handoff's blockers carried for the "waiting on" text; the counts, not this list, decide busy. */
+    readonly maxBlockers: 32;
+    readonly maxKindLength: 32;
+    readonly maxIdLength: 128;
+    readonly maxReasonLength: 240;
+    readonly maxHandoffIdLength: 64;
+    readonly maxHandoffReasonLength: 64;
+    readonly maxProcessStartIdLength: 64;
+    /** Hard ceiling on the serialized report. The clamps above keep a valid one well under it. */
+    readonly maxSerializedBytes: 20000;
+};
+/** What `complete` can be. Anything but `true` means the counts prove nothing. */
+export type MaintenanceReportComplete = boolean | 'unknown';
+/** The handoff's own `RestartBlocker` shape (`daemon/src/update/handoff.ts`). Reason text is the handoff's, never re-spelled. */
+export interface MaintenanceReportBlocker {
+    kind: string;
+    id?: string;
+    reason: string;
+}
+export interface MaintenanceReportInflight {
+    /** Provider sessions and their wrapper processes: in-process turns, preparing dispatches, live wrappers. */
+    sessions: number;
+    /** Tool calls running, plus background commands still running. */
+    tools: number;
+    /** Terminals the daemon holds, preservable or not. A person's open shell is work an update would interrupt. */
+    terminals: number;
+    /** Provider turns that still depend on credentials, permissions, a browser or a model connection the service owns. */
+    providerDependencies: number;
+    /** Write-ahead entries whose durability the daemon has not confirmed. */
+    walUnconfirmed: number;
+}
+export interface MaintenanceReportHandoff {
+    phase: MaintenanceReportHandoffPhase;
+    handoffId: string;
+    reason?: string;
+    /** ISO time the daemon's lease on this phase ends. */
+    expiresAt?: string;
+}
+export interface MaintenanceReport {
+    version: typeof MAINTENANCE_REPORT_VERSION;
+    /** The daemon process that read this. The server drops a report that is not its registered process's. */
+    processStartId: string;
+    /** ISO time of the daemon's own read. Informational: freshness is the server's receipt time. */
+    readAt: string;
+    /** `true`: every source was read. `'unknown'`: one could not be. `false`: the process is leaving. */
+    complete: MaintenanceReportComplete;
+    /** Monotonic count of admissions since this process started. */
+    admittedTotal: number;
+    inflight: MaintenanceReportInflight;
+    blockers: MaintenanceReportBlocker[];
+    /** True when the daemon had more blockers than it sent. */
+    blockersTruncated: boolean;
+    /** The daemon's own update handoff, only while it is live or unresolved; otherwise `null`. */
+    handoff: MaintenanceReportHandoff | null;
+}
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from a
+ * daemon that did not announce the capability, an unknown version, or oversized
+ * is `null`, and the caller must then treat the machine as NOT quiet. Never
+ * trusts a field it did not validate and never copies one it does not know.
+ */
+export declare function parseMaintenanceReport(raw: unknown): MaintenanceReport | null;
+/**
+ * A report as it was stored (JSON text on the presence row). Anything that does
+ * not parse, or does not validate, is `null`: a stored value is an input like any
+ * other and is read with the same suspicion.
+ */
+export declare function parseStoredMaintenanceReport(stored: unknown): MaintenanceReport | null;
+/**
+ * The one definition of a POSITIVE ZERO: the daemon read every source and found
+ * nothing. `complete: 'unknown'` and `complete: false` are never zero whatever
+ * the counts say, because the counts were not (all) read.
+ *
+ * A blocker that is not work (a missing restart owner, say) does not make a
+ * report non-quiet; readiness is "nothing is running", not "the daemon can
+ * restart itself".
+ */
+export declare function maintenanceReportIsQuiet(report: MaintenanceReport | null): boolean;
+export interface BuildMaintenanceReportInput {
+    processStartId: string;
+    /** Epoch ms of the daemon's own read. */
+    readAtMs: number;
+    complete: MaintenanceReportComplete;
+    admittedTotal: number;
+    inflight: MaintenanceReportInflight;
+    blockers: ReadonlyArray<{
+        kind: string;
+        id?: string;
+        reason: string;
+    }>;
+    /** `expiresAtMs` is epoch ms; the wire carries ISO. */
+    handoff: {
+        phase: MaintenanceReportHandoffPhase;
+        handoffId: string;
+        reason?: string;
+        expiresAtMs?: number;
+    } | null;
+}
+/**
+ * A report that says nothing was counted. The shape the daemon sends when it
+ * could not read an inventory source at all, and the shape `buildMaintenanceReport`
+ * falls back to when it was handed something the contract cannot carry.
+ */
+export declare function unknownMaintenanceReport(processStartId: string, readAtMs: number, admittedTotal?: number): MaintenanceReport;
+/**
+ * Build the wire report from what the daemon read. Input the contract cannot
+ * carry (a negative count, a blocker with no kind, a time that is not a time)
+ * becomes an `unknown` report rather than a throw or a report that parses to
+ * something else, so the result parses whenever `processStartId` is a real id (the
+ * daemon's always is). A builder that threw would turn a bad read into silence,
+ * and silence is the absence of a report, which the server reads the same way,
+ * but later.
+ */
+export declare function buildMaintenanceReport(input: BuildMaintenanceReportInput): MaintenanceReport;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/maintenanceReportWire.js

@@ -0,0 +1,342 @@
+/**
+ * The maintenance report wire contract (Machine Maintenance, OSK-19107, task M24;
+ * `docs/architecture/machine-maintenance/implementation-plan-2026-10-24.md` §3.5,
+ * `phase0/m04-quiescence-evidence.md` §2.5 and §2.6).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so the
+ * capability name, the payload shape and its bounds live in this package, which
+ * every end can import (`@skrr-ai/auth-core/maintenance-report-wire`).
+ * `maintenanceReportWire.test.ts` fails on a second spelling of the capability
+ * anywhere else in the repo. The shape follows `dedicatedRuntimeBusyWire.ts`, the
+ * precedent for a positively announced, fail-closed report, and differs from it
+ * only where the owner's pause needs more.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "What does this daemon process hold right now that an update would take from
+ * the owner, and has anything been admitted since the last time you asked?" It is
+ * a LOCAL read summarised into counts, the handoff's own restart blockers, and
+ * the daemon's own update handoff phase.
+ *
+ * It is EVIDENCE, never authority. The fence does not depend on it: a daemon that
+ * lies, or one that sends nothing, cannot make a held machine accept work. Only
+ * this report can grant `ready` (a server-side source can only veto it), and a
+ * daemon that never announces the capability can only reach `ready` by the
+ * owner's attestation.
+ *
+ * FAIL CLOSED, in three places
+ * ---------------------------------------------------------------------------
+ *  1. A count is `0` only when the daemon positively counted. A source that could
+ *     not be read is `complete: 'unknown'`; a daemon that is leaving is
+ *     `complete: false`. A reader MUST treat both as busy, whatever the counts
+ *     say (`maintenanceReportIsQuiet` is the one place that says so).
+ *  2. A report that is malformed in ANY field is `null` from
+ *     `parseMaintenanceReport`, and the caller treats the machine as not quiet.
+ *     A count that is missing, negative, fractional or not a safe integer is not
+ *     "zero": it is a different, broken report. A version this parser does not
+ *     know is `null` too: a newer shape needs its own announced capability.
+ *  3. Bounds. The blocker list and every string are clamped, so one report can
+ *     never be large enough to matter, and a field that is NOT in the contract is
+ *     never copied into what the parser returns (the result is built from a
+ *     fresh object, so `__proto__` and its kin cannot ride along).
+ *
+ * `admittedTotal`
+ * ---------------------------------------------------------------------------
+ * A MONOTONIC counter of admissions since this process started. The server proves
+ * "nothing was admitted between two reports" by comparing two values, without
+ * trusting the daemon's clock. It counts at every place the daemon admits work
+ * and OVER-counts on purpose (one admission may be noted at the gate and again
+ * where the work registers): a second increment can only make the proof harder,
+ * never easier. A path that the daemon cannot count must say so in
+ * `daemon/src/maintenance-report.ts`, not hide in a zero.
+ */
+export const MAINTENANCE_REPORT_CAPABILITY = 'maintenance_report_v1';
+/** The heartbeat (and register) key the report rides under. Sent only by a daemon that announced the capability. */
+export const MAINTENANCE_REPORT_HEARTBEAT_KEY = 'maintenanceReport';
+export const MAINTENANCE_REPORT_VERSION = 1;
+/**
+ * The daemon's own update handoff phases (`daemon/src/update/handoff.ts`), and the
+ * members of `DaemonMaintenanceHandoff.phase` in `@skrr-ai/data-provider`. A phase
+ * outside this list is a newer protocol and makes the whole report `null`.
+ */
+export const MAINTENANCE_REPORT_HANDOFF_PHASES = [
+    'ready',
+    'deferred',
+    'reconnecting',
+    'verified',
+    'failed',
+    'rolled-back',
+];
+export const MAINTENANCE_REPORT_LIMITS = {
+    /** The handoff's blockers carried for the "waiting on" text; the counts, not this list, decide busy. */
+    maxBlockers: 32,
+    maxKindLength: 32,
+    maxIdLength: 128,
+    maxReasonLength: 240,
+    maxHandoffIdLength: 64,
+    maxHandoffReasonLength: 64,
+    maxProcessStartIdLength: 64,
+    /** Hard ceiling on the serialized report. The clamps above keep a valid one well under it. */
+    maxSerializedBytes: 20_000,
+};
+const PROCESS_START_ID_PATTERN = /^[A-Za-z0-9_.:-]+$/;
+// C0 controls and DEL. A blocker's text is shown to an owner and logged.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * An OWN property, or `undefined`. A key the sender did not put on the object
+ * itself is never read from its prototype chain, so a polluted `Object.prototype`
+ * (or a sender that smuggles a `__proto__`) cannot supply a field the report
+ * did not carry.
+ */
+function field(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+/** ISO text for an epoch-ms value, or `''` when the value is not a representable time. */
+function isoFromMs(ms) {
+    if (typeof ms !== 'number' || !Number.isFinite(ms))
+        return '';
+    const date = new Date(ms);
+    return Number.isNaN(date.getTime()) ? '' : date.toISOString();
+}
+function count(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function clampText(value, max) {
+    if (typeof value !== 'string')
+        return null;
+    const clean = value.replace(CONTROL_CHARACTERS, ' ');
+    return clean.length > max ? clean.slice(0, max) : clean;
+}
+function isoOf(value) {
+    if (typeof value !== 'string')
+        return null;
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms))
+        return null;
+    try {
+        return new Date(ms).toISOString();
+    }
+    catch {
+        return null;
+    }
+}
+function completeOf(value) {
+    return value === true || value === false || value === 'unknown' ? value : undefined;
+}
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from a
+ * daemon that did not announce the capability, an unknown version, or oversized
+ * is `null`, and the caller must then treat the machine as NOT quiet. Never
+ * trusts a field it did not validate and never copies one it does not know.
+ */
+export function parseMaintenanceReport(raw) {
+    if (!isRecord(raw))
+        return null;
+    if (field(raw, 'version') !== MAINTENANCE_REPORT_VERSION)
+        return null;
+    const processStartId = field(raw, 'processStartId');
+    if (typeof processStartId !== 'string' ||
+        processStartId.length < 1 ||
+        processStartId.length > MAINTENANCE_REPORT_LIMITS.maxProcessStartIdLength ||
+        !PROCESS_START_ID_PATTERN.test(processStartId)) {
+        return null;
+    }
+    const readAt = isoOf(field(raw, 'readAt'));
+    if (readAt === null)
+        return null;
+    const complete = completeOf(field(raw, 'complete'));
+    if (complete === undefined)
+        return null;
+    const admittedTotal = count(field(raw, 'admittedTotal'));
+    if (admittedTotal === null)
+        return null;
+    const rawInflight = field(raw, 'inflight');
+    if (!isRecord(rawInflight))
+        return null;
+    const sessions = count(field(rawInflight, 'sessions'));
+    const tools = count(field(rawInflight, 'tools'));
+    const terminals = count(field(rawInflight, 'terminals'));
+    const providerDependencies = count(field(rawInflight, 'providerDependencies'));
+    const walUnconfirmed = count(field(rawInflight, 'walUnconfirmed'));
+    if (sessions === null ||
+        tools === null ||
+        terminals === null ||
+        providerDependencies === null ||
+        walUnconfirmed === null) {
+        return null;
+    }
+    const rawBlockers = field(raw, 'blockers');
+    if (!Array.isArray(rawBlockers))
+        return null;
+    const rawTruncated = field(raw, 'blockersTruncated');
+    if (rawTruncated !== undefined && typeof rawTruncated !== 'boolean')
+        return null;
+    const limit = MAINTENANCE_REPORT_LIMITS.maxBlockers;
+    const blockers = [];
+    // Only the first `limit` elements are looked at: the work is bounded by the
+    // contract, not by what the sender chose to send.
+    for (let index = 0; index < rawBlockers.length && blockers.length < limit; index += 1) {
+        const element = rawBlockers[index];
+        if (!isRecord(element))
+            return null;
+        const kind = clampText(field(element, 'kind'), MAINTENANCE_REPORT_LIMITS.maxKindLength);
+        const reason = clampText(field(element, 'reason'), MAINTENANCE_REPORT_LIMITS.maxReasonLength);
+        if (kind === null || kind === '' || reason === null)
+            return null;
+        const blocker = { kind, reason };
+        const rawId = field(element, 'id');
+        if (rawId !== undefined) {
+            const id = clampText(rawId, MAINTENANCE_REPORT_LIMITS.maxIdLength);
+            if (id === null)
+                return null;
+            blocker.id = id;
+        }
+        blockers.push(blocker);
+    }
+    const blockersTruncated = rawBlockers.length > limit || rawTruncated === true;
+    // The key is part of the contract: `null` says "no handoff", and an absent key
+    // says nothing, which is not a way to claim there is none.
+    const rawHandoff = field(raw, 'handoff');
+    if (rawHandoff === undefined)
+        return null;
+    let handoff = null;
+    if (rawHandoff !== null) {
+        if (!isRecord(rawHandoff))
+            return null;
+        const phase = field(rawHandoff, 'phase');
+        if (!MAINTENANCE_REPORT_HANDOFF_PHASES.includes(phase))
+            return null;
+        const handoffId = clampText(field(rawHandoff, 'handoffId'), MAINTENANCE_REPORT_LIMITS.maxHandoffIdLength);
+        if (handoffId === null || handoffId === '')
+            return null;
+        handoff = { phase: phase, handoffId };
+        const rawReason = field(rawHandoff, 'reason');
+        if (rawReason !== undefined) {
+            const reason = clampText(rawReason, MAINTENANCE_REPORT_LIMITS.maxHandoffReasonLength);
+            if (reason === null)
+                return null;
+            handoff.reason = reason;
+        }
+        const rawExpiresAt = field(rawHandoff, 'expiresAt');
+        if (rawExpiresAt !== undefined) {
+            const expiresAt = isoOf(rawExpiresAt);
+            if (expiresAt === null)
+                return null;
+            handoff.expiresAt = expiresAt;
+        }
+    }
+    const report = {
+        version: MAINTENANCE_REPORT_VERSION,
+        processStartId,
+        readAt,
+        complete,
+        admittedTotal,
+        inflight: { sessions, tools, terminals, providerDependencies, walUnconfirmed },
+        blockers,
+        blockersTruncated,
+        handoff,
+    };
+    if (JSON.stringify(report).length > MAINTENANCE_REPORT_LIMITS.maxSerializedBytes)
+        return null;
+    return report;
+}
+/**
+ * A report as it was stored (JSON text on the presence row). Anything that does
+ * not parse, or does not validate, is `null`: a stored value is an input like any
+ * other and is read with the same suspicion.
+ */
+export function parseStoredMaintenanceReport(stored) {
+    if (typeof stored !== 'string' || stored === '')
+        return null;
+    if (stored.length > MAINTENANCE_REPORT_LIMITS.maxSerializedBytes)
+        return null;
+    try {
+        return parseMaintenanceReport(JSON.parse(stored));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The one definition of a POSITIVE ZERO: the daemon read every source and found
+ * nothing. `complete: 'unknown'` and `complete: false` are never zero whatever
+ * the counts say, because the counts were not (all) read.
+ *
+ * A blocker that is not work (a missing restart owner, say) does not make a
+ * report non-quiet; readiness is "nothing is running", not "the daemon can
+ * restart itself".
+ */
+export function maintenanceReportIsQuiet(report) {
+    if (!report)
+        return false;
+    if (report.complete !== true)
+        return false;
+    const { sessions, tools, terminals, providerDependencies, walUnconfirmed } = report.inflight;
+    return (sessions === 0 &&
+        tools === 0 &&
+        terminals === 0 &&
+        providerDependencies === 0 &&
+        walUnconfirmed === 0);
+}
+/**
+ * A report that says nothing was counted. The shape the daemon sends when it
+ * could not read an inventory source at all, and the shape `buildMaintenanceReport`
+ * falls back to when it was handed something the contract cannot carry.
+ */
+export function unknownMaintenanceReport(processStartId, readAtMs, admittedTotal = 0) {
+    return {
+        version: MAINTENANCE_REPORT_VERSION,
+        processStartId,
+        readAt: isoFromMs(readAtMs) || new Date(0).toISOString(),
+        complete: 'unknown',
+        admittedTotal: count(admittedTotal) ?? 0,
+        inflight: { sessions: 0, tools: 0, terminals: 0, providerDependencies: 0, walUnconfirmed: 0 },
+        blockers: [],
+        blockersTruncated: false,
+        handoff: null,
+    };
+}
+/**
+ * Build the wire report from what the daemon read. Input the contract cannot
+ * carry (a negative count, a blocker with no kind, a time that is not a time)
+ * becomes an `unknown` report rather than a throw or a report that parses to
+ * something else, so the result parses whenever `processStartId` is a real id (the
+ * daemon's always is). A builder that threw would turn a bad read into silence,
+ * and silence is the absence of a report, which the server reads the same way,
+ * but later.
+ */
+export function buildMaintenanceReport(input) {
+    const blockers = input.blockers
+        .slice(0, MAINTENANCE_REPORT_LIMITS.maxBlockers)
+        .map((blocker) => ({
+        kind: blocker.kind,
+        ...(blocker.id !== undefined ? { id: blocker.id } : {}),
+        reason: blocker.reason,
+    }));
+    const candidate = {
+        version: MAINTENANCE_REPORT_VERSION,
+        processStartId: input.processStartId,
+        readAt: isoFromMs(input.readAtMs),
+        complete: input.complete,
+        admittedTotal: input.admittedTotal,
+        inflight: { ...input.inflight },
+        blockers,
+        blockersTruncated: input.blockers.length > MAINTENANCE_REPORT_LIMITS.maxBlockers,
+        handoff: input.handoff
+            ? {
+                phase: input.handoff.phase,
+                handoffId: input.handoff.handoffId,
+                ...(input.handoff.reason !== undefined ? { reason: input.handoff.reason } : {}),
+                ...(input.handoff.expiresAtMs !== undefined
+                    ? { expiresAt: isoFromMs(input.handoff.expiresAtMs) }
+                    : {}),
+            }
+            : null,
+    };
+    return (parseMaintenanceReport(candidate) ??
+        unknownMaintenanceReport(input.processStartId, input.readAtMs, input.admittedTotal));
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolApprovalSignature.d.ts

@@ -177,6 +177,57 @@ export declare function signToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): SignedToolApproval;
+/** A short-lived platform-signed assertion for exactly one local executor. */
+export interface PersonalDataExecutorLeasePayload {
+    v: 1;
+    leaseId: string;
+    /** The daemon identity registered for this machine. */
+    daemonId: string;
+    /** Fresh random daemon-start nonce; restart invalidates every prior lease. */
+    daemonInstanceId: string;
+    /** Account whose interactive session requested this local executor. */
+    ownerUserId: string;
+    /** Fixed, sorted set of operations this executor may make available. */
+    capabilities: string[];
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface SignedPersonalDataExecutorLease {
+    v: 1;
+    payload: string;
+    kid: string;
+    sig: string;
+}
+export type PersonalDataExecutorLeaseVerdict = {
+    ok: true;
+    leaseId: string;
+    ownerUserId: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: 'absent' | 'malformed' | 'unknown_key' | 'signature' | 'daemon_binding' | 'capabilities' | 'expired' | 'window';
+};
+/** Server-side mint. The caller must authorize the requesting user separately. */
+export declare function signPersonalDataExecutorLease(args: {
+    leaseId: string;
+    daemonId: string;
+    daemonInstanceId: string;
+    ownerUserId: string;
+    capabilities: readonly string[];
+    signer: ApprovalSigner;
+    now?: number;
+    ttlMs?: number;
+}): SignedPersonalDataExecutorLease | null;
+/**
+ * Daemon-side verifier. It trusts the same independently pinned platform
+ * keyset as v2 tool approvals, but a separate signature domain and schema.
+ */
+export declare function verifyPersonalDataExecutorLease(lease: unknown, expected: {
+    daemonId: string;
+    daemonInstanceId: string;
+    capabilities: readonly string[];
+    now?: number;
+}, keyset: ApprovalKeyset): PersonalDataExecutorLeaseVerdict;
 export interface SignedToolApprovalCall {
     toolUseId: string;
     toolName: string;