@skrr-ai/cli 0.1.119 → 0.1.121

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolApprovalSignature.js

@@ -44,6 +44,13 @@ export const TOOL_APPROVAL_SIGNED_CAPABILITY = 'tool_approval_signed_v1';
  */
 const ATTESTATION_SIGNING_DOMAIN = 'skrr-tool-approval-v2\n';
 const KEYSET_SIGNING_DOMAIN = 'skrr-tool-approval-keyset-v1\n';
+/**
+ * A distinct domain for the local personal-data executor. A tool approval is
+ * a user's decision about one action; an executor lease is evidence that the
+ * platform authenticated one particular trusted local process. Neither
+ * signature can be substituted for the other.
+ */
+const PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN = 'skrr-personal-data-executor-lease-v1\n';
 /** A key id: short, printable, and safe to put in a log line. */
 const KID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 /** Bounds on untrusted wire input, so a hostile document cannot cost much. */
@@ -51,6 +58,11 @@ const MAX_PAYLOAD_BYTES = 4096;
 const MAX_KEYSET_BYTES = 16 * 1024;
 const MAX_KEYSET_KEYS = 16;
 const MAX_KEYSET_SIGNATURES = 16;
+const MAX_EXECUTOR_LEASE_CAPABILITIES = 8;
+const MAX_EXECUTOR_LEASE_TTL_MS = 5 * 60 * 1000;
+const EXECUTOR_LEASE_CLOCK_SKEW_MS = 30_000;
+const EXECUTOR_LEASE_ID_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+const EXECUTOR_CAPABILITY_PATTERN = /^[a-z0-9_.:-]{1,128}$/;
 /** Derive the wire public key from a private (or public) Ed25519 KeyObject. */
 export function approvalPublicKeyFromKeyObject(kid, key) {
     const publicKey = key.type === 'private' ? createPublicKey(key) : key;
@@ -86,6 +98,24 @@ function verifySignature(domain, message, sigB64, key) {
 function signMessage(domain, message, privateKey) {
     return signEd25519(null, Buffer.from(domain + message, 'utf8'), privateKey).toString('base64');
 }
+function isExecutorLeaseId(value) {
+    return typeof value === 'string' && EXECUTOR_LEASE_ID_PATTERN.test(value);
+}
+function isExecutorLeaseText(value, max = 128) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f]/.test(value);
+}
+function canonicalExecutorCapabilities(value) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_EXECUTOR_LEASE_CAPABILITIES) {
+        return null;
+    }
+    const capabilities = value.map((entry) => typeof entry === 'string' ? entry : '');
+    if (capabilities.some((entry) => !EXECUTOR_CAPABILITY_PATTERN.test(entry)))
+        return null;
+    const sorted = [...capabilities].sort();
+    if (new Set(sorted).size !== sorted.length)
+        return null;
+    return sorted;
+}
 /** Code-unit order: the same on every runtime, unlike `localeCompare`. */
 function compareKid(a, b) {
     if (a === b)
@@ -255,6 +285,114 @@ export function signToolApproval(args) {
         sig: signMessage(ATTESTATION_SIGNING_DOMAIN, text, args.signer.privateKey),
     };
 }
+/** Server-side mint. The caller must authorize the requesting user separately. */
+export function signPersonalDataExecutorLease(args) {
+    const capabilities = canonicalExecutorCapabilities(args.capabilities);
+    const ttlMs = args.ttlMs ?? MAX_EXECUTOR_LEASE_TTL_MS;
+    const now = args.now ?? Date.now();
+    if (!isExecutorLeaseId(args.leaseId) ||
+        !isExecutorLeaseText(args.daemonId) ||
+        !isExecutorLeaseId(args.daemonInstanceId) ||
+        !isExecutorLeaseText(args.ownerUserId) ||
+        !capabilities ||
+        !Number.isSafeInteger(now) ||
+        !Number.isSafeInteger(ttlMs) ||
+        ttlMs <= 0 ||
+        ttlMs > MAX_EXECUTOR_LEASE_TTL_MS) {
+        return null;
+    }
+    const payload = {
+        v: 1,
+        leaseId: args.leaseId,
+        daemonId: args.daemonId,
+        daemonInstanceId: args.daemonInstanceId,
+        ownerUserId: args.ownerUserId,
+        capabilities,
+        issuedAt: now,
+        expiresAt: now + ttlMs,
+    };
+    const text = canonicalApprovalJson(payload);
+    return {
+        v: 1,
+        payload: text,
+        kid: args.signer.kid,
+        sig: signMessage(PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN, text, args.signer.privateKey),
+    };
+}
+/**
+ * Daemon-side verifier. It trusts the same independently pinned platform
+ * keyset as v2 tool approvals, but a separate signature domain and schema.
+ */
+export function verifyPersonalDataExecutorLease(lease, expected, keyset) {
+    if (lease === undefined || lease === null)
+        return { ok: false, reason: 'absent' };
+    if (!lease || typeof lease !== 'object' || Array.isArray(lease)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const wire = lease;
+    if (wire.v !== 1 ||
+        typeof wire.payload !== 'string' ||
+        wire.payload.length === 0 ||
+        wire.payload.length > MAX_PAYLOAD_BYTES ||
+        typeof wire.kid !== 'string' ||
+        typeof wire.sig !== 'string') {
+        return { ok: false, reason: 'malformed' };
+    }
+    const pinnedKey = keyset.keys.find((key) => key.kid === wire.kid);
+    const key = pinnedKey ? ed25519PublicKey(pinnedKey.publicKeySpkiB64) : null;
+    if (!key)
+        return { ok: false, reason: 'unknown_key' };
+    if (!verifySignature(PERSONAL_DATA_EXECUTOR_LEASE_SIGNING_DOMAIN, wire.payload, wire.sig, key)) {
+        return { ok: false, reason: 'signature' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(wire.payload);
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const payload = parsed;
+    const issuedAt = payload.issuedAt;
+    const expiresAt = payload.expiresAt;
+    const capabilities = canonicalExecutorCapabilities(payload.capabilities);
+    if (payload.v !== 1 ||
+        !isExecutorLeaseId(payload.leaseId) ||
+        !isExecutorLeaseText(payload.daemonId) ||
+        !isExecutorLeaseId(payload.daemonInstanceId) ||
+        !isExecutorLeaseText(payload.ownerUserId) ||
+        !capabilities ||
+        typeof issuedAt !== 'number' ||
+        typeof expiresAt !== 'number' ||
+        !Number.isSafeInteger(issuedAt) ||
+        !Number.isSafeInteger(expiresAt)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const expectedCapabilities = canonicalExecutorCapabilities(expected.capabilities);
+    if (!expectedCapabilities || capabilities.join('\u0000') !== expectedCapabilities.join('\u0000')) {
+        return { ok: false, reason: 'capabilities' };
+    }
+    if (payload.daemonId !== expected.daemonId || payload.daemonInstanceId !== expected.daemonInstanceId) {
+        return { ok: false, reason: 'daemon_binding' };
+    }
+    const now = expected.now ?? Date.now();
+    if (expiresAt <= issuedAt ||
+        expiresAt - issuedAt > MAX_EXECUTOR_LEASE_TTL_MS ||
+        issuedAt > now + EXECUTOR_LEASE_CLOCK_SKEW_MS) {
+        return { ok: false, reason: 'window' };
+    }
+    if (expiresAt <= now)
+        return { ok: false, reason: 'expired' };
+    return {
+        ok: true,
+        leaseId: payload.leaseId,
+        ownerUserId: payload.ownerUserId,
+        expiresAt,
+    };
+}
 /**
  * Daemon side: verify a v2 attestation against the pinned keyset and the call.
  * Order matters: nothing in the payload is READ until the signature verified

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,9 +1,29 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.31",
+  "version": "0.4.32",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
+    "./desktop-daemon-proof": {
+      "import": {
+        "types": "./dist/esm/desktopDaemonProof.d.ts",
+        "default": "./dist/esm/desktopDaemonProof.js"
+      },
+      "require": {
+        "types": "./dist/cjs/desktopDaemonProof.d.ts",
+        "default": "./dist/cjs/desktopDaemonProof.js"
+      }
+    },
+    "./independent-machine-scopes": {
+      "import": {
+        "types": "./dist/esm/independentMachineScopes.d.ts",
+        "default": "./dist/esm/independentMachineScopes.js"
+      },
+      "require": {
+        "types": "./dist/cjs/independentMachineScopes.d.ts",
+        "default": "./dist/cjs/independentMachineScopes.js"
+      }
+    },
     ".": {
       "import": {
         "types": "./dist/esm/index.d.ts",
@@ -114,6 +134,16 @@
         "default": "./dist/cjs/dedicatedRuntimeBusyWire.js"
       }
     },
+    "./maintenance-report-wire": {
+      "import": {
+        "types": "./dist/esm/maintenanceReportWire.d.ts",
+        "default": "./dist/esm/maintenanceReportWire.js"
+      },
+      "require": {
+        "types": "./dist/cjs/maintenanceReportWire.d.ts",
+        "default": "./dist/cjs/maintenanceReportWire.js"
+      }
+    },
     "./computer-wire": {
       "import": {
         "types": "./dist/esm/computerWire.d.ts",
@@ -264,6 +294,26 @@
         "default": "./dist/cjs/restartArtifact.js"
       }
     },
+    "./daemon-consent-proof": {
+      "import": {
+        "types": "./dist/esm/daemonConsentProof.d.ts",
+        "default": "./dist/esm/daemonConsentProof.js"
+      },
+      "require": {
+        "types": "./dist/cjs/daemonConsentProof.d.ts",
+        "default": "./dist/cjs/daemonConsentProof.js"
+      }
+    },
+    "./guided-update": {
+      "import": {
+        "types": "./dist/esm/guidedUpdate.d.ts",
+        "default": "./dist/esm/guidedUpdate.js"
+      },
+      "require": {
+        "types": "./dist/cjs/guidedUpdate.d.ts",
+        "default": "./dist/cjs/guidedUpdate.js"
+      }
+    },
     "./tool-operation-outcome": {
       "import": {
         "types": "./dist/esm/toolOperationOutcome.d.ts",