@skrr-ai/cli 0.1.123 → 0.1.125

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceKeyHardware.js

@@ -0,0 +1,317 @@
+/**
+ * deviceKeyHardware.ts — the hardware-bound device key (ES256, non-exportable),
+ * reached through a small native helper.
+ *
+ * WHAT IS STORED. Not a key. CryptoKit's `SecureEnclave.P256.Signing.PrivateKey`
+ * hands back an opaque `dataRepresentation` (284 bytes on the machine this was
+ * measured on): the key wrapped by that machine's Secure Enclave. Only the same
+ * Secure Enclave can unwrap it, so the blob is useless on any other machine, and
+ * nothing in it is a scalar. We keep it in `device-key.se` beside the public key.
+ *
+ * Three consequences, each measured rather than assumed (2026-10-30, Apple
+ * silicon, a binary signed ad hoc with NO entitlements, NO keychain access group
+ * and NO provisioning profile; the hardened runtime made no difference):
+ *
+ *  1. It needs none of the restricted entitlements the design doc feared. That
+ *     fear was about persistent Keychain-resident Secure Enclave keys. A blob we
+ *     store ourselves is not a Keychain item.
+ *  2. It is NOT bound to the app that created it: a differently-identified
+ *     binary loaded the same blob and signed with the same public key. What the
+ *     hardware buys is that the key cannot leave the machine (a copied disk, a
+ *     backup, a restored image, malware that uploads files). It does not stop a
+ *     process running as the same user on the same machine from asking the
+ *     Enclave to sign. Binding use to one app needs a Keychain-resident key and
+ *     the entitlements; that is a further hardening, recorded in the ADR, not
+ *     a prerequisite.
+ *  3. The blob is NOT sealed under the credential envelope. Sealing it would
+ *     re-create the coupling that lost a device key on 2026-10-29 (key life tied
+ *     to the DEK, which is tied to a machine-wide KEK): it is harmless to a thief
+ *     and a liability to its owner. A lost KEK now costs the credentials, which a
+ *     sign-in rebuilds, and not the device identity, which needs a person to
+ *     re-pin.
+ *
+ * WHY A ONE-SHOT HELPER, NOT A SERVICE. Load is ~2 ms and a signature ~5 ms
+ * inside the helper; process start dominates. A device proof is signed on a
+ * refresh or a hand-off, not per request, so spawning per signature is cheap and
+ * removes a whole class of state: no long-lived child to supervise, restart, leak
+ * or race, and nothing to be stale after a daemon upgrade. The helper holds no
+ * state between calls; the blob in the request is the whole key.
+ *
+ * PROTOCOL (version 1). One JSON object on stdin, one JSON object on stdout,
+ * exit 0 on success. Binary values are standard base64.
+ *
+ *   probe   {}                          -> {v, secureEnclave: boolean}
+ *   create  {}                          -> {v, blob, publicKey}   publicKey = x||y, 64 bytes
+ *   sign    {blob, input}               -> {v, signature, publicKey}  signature = r||s, 64 bytes
+ *
+ * A failure exits non-zero with {v, error: {code, message}} on stdout. `sign`
+ * returns the public key it derived from the blob so a blob that was swapped for
+ * another machine's key, or another key's, is caught here and not at the server.
+ */
+import crypto from 'node:crypto';
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { isDevicePublicJwk, jwkThumbprint, p256PublicJwkFromRaw, } from './deviceKey.js';
+import { getAuthMachineConfigDir } from './runtime.js';
+/** File name of the helper next to the daemon binary and under `<machine root>/bin`. */
+export const HARDWARE_KEY_HELPER_NAME = 'skrr-native-device-key';
+export const HARDWARE_KEY_PROTOCOL = 1;
+const PROBE_TIMEOUT_MS = 5_000;
+const CREATE_TIMEOUT_MS = 15_000;
+const SIGN_TIMEOUT_MS = 10_000;
+/** A failed probe is looked at again after this long; a successful one never is. */
+const PROBE_RETRY_MS = 60_000;
+export class HardwareDeviceKeyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'HardwareDeviceKeyError';
+    }
+}
+// ---------------------------------------------------------------------------
+// Locating the helper
+// ---------------------------------------------------------------------------
+let _resolver = null;
+/**
+ * Tell auth-core where the helper is. The daemon calls this at boot with the
+ * path next to its own binary; a process that never does (the CLI, a test)
+ * falls back to the places the helper is installed: beside this process's
+ * executable, then `<machine root>/bin`. Pass `null` to forget a resolver.
+ */
+export function configureHardwareDeviceKeyHelper(resolver) {
+    _resolver = resolver;
+    _probe = null;
+}
+function isExecutableFile(file) {
+    try {
+        if (!fs.statSync(file).isFile())
+            return false;
+        fs.accessSync(file, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Absolute path of an executable helper, or null when this machine has none. */
+export function resolveHardwareDeviceKeyHelper() {
+    const candidates = [];
+    try {
+        candidates.push(_resolver ? _resolver() : null);
+    }
+    catch {
+        /* a resolver that throws is a resolver with no answer */
+    }
+    candidates.push(path.join(path.dirname(process.execPath), HARDWARE_KEY_HELPER_NAME));
+    try {
+        candidates.push(path.join(getAuthMachineConfigDir(), 'bin', HARDWARE_KEY_HELPER_NAME));
+    }
+    catch {
+        /* auth-core not configured yet */
+    }
+    for (const candidate of candidates) {
+        if (candidate && path.isAbsolute(candidate) && isExecutableFile(candidate))
+            return candidate;
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Running it
+// ---------------------------------------------------------------------------
+let _timeoutOverrideMs = null;
+/** @internal Test seam — bound every helper call by `ms`. `null` restores the real limits. */
+export function __setHardwareHelperTimeoutForTest(ms) {
+    _timeoutOverrideMs = ms;
+}
+function runHelper(op, request, timeoutMs) {
+    const helper = resolveHardwareDeviceKeyHelper();
+    if (!helper) {
+        return Promise.reject(new HardwareDeviceKeyError('helper_missing', `${HARDWARE_KEY_HELPER_NAME} is not installed on this machine`));
+    }
+    return new Promise((resolve, reject) => {
+        const child = execFile(helper, [op], 
+        // No shell, no inherited environment: the helper needs nothing from ours,
+        // and a signing process should not see session tokens it has no use for.
+        {
+            timeout: _timeoutOverrideMs ?? timeoutMs,
+            maxBuffer: 64 * 1024,
+            windowsHide: true,
+            env: {},
+            encoding: 'utf8',
+        }, (error, stdout) => {
+            let parsed = null;
+            try {
+                parsed = JSON.parse(stdout);
+            }
+            catch {
+                parsed = null;
+            }
+            if (error) {
+                if (error.killed) {
+                    reject(new HardwareDeviceKeyError('timeout', `${op} did not finish within ${_timeoutOverrideMs ?? timeoutMs} ms`));
+                    return;
+                }
+                const code = parsed?.error?.code;
+                const message = parsed?.error?.message;
+                reject(new HardwareDeviceKeyError(code === 'unsupported' ? 'unsupported' : 'helper_failed', typeof message === 'string' ? message : `${op} failed: ${error.message}`));
+                return;
+            }
+            if (!parsed || parsed.v !== HARDWARE_KEY_PROTOCOL) {
+                reject(new HardwareDeviceKeyError('bad_response', `${op} returned an unexpected response`));
+                return;
+            }
+            resolve(parsed);
+        });
+        child.stdin?.on('error', () => {
+            /* the helper exiting before it read stdin surfaces through the callback */
+        });
+        child.stdin?.end(JSON.stringify({ v: HARDWARE_KEY_PROTOCOL, ...request }));
+    });
+}
+function decodeFixed(value, bytes, what) {
+    if (typeof value !== 'string')
+        throw new HardwareDeviceKeyError('bad_response', `${what} is missing`);
+    const buf = Buffer.from(value, 'base64');
+    if (buf.length !== bytes) {
+        throw new HardwareDeviceKeyError('bad_response', `${what} is ${buf.length} bytes, expected ${bytes}`);
+    }
+    return buf;
+}
+let _probe = null;
+/**
+ * Can this machine create and use a hardware-bound device key right now? Looked
+ * up, never assumed: the answer needs both a helper that runs and hardware that
+ * answers. A positive result is kept for the life of the process; a negative one
+ * is retried after a minute, so a helper installed by an update is picked up
+ * without a restart and a broken one is not spawned on every proof.
+ */
+export async function probeHardwareDeviceKey() {
+    if (_probe && (_probe.result.available || Date.now() - _probe.at < PROBE_RETRY_MS))
+        return _probe.result;
+    let result;
+    try {
+        const res = await runHelper('probe', {}, PROBE_TIMEOUT_MS);
+        result =
+            res.secureEnclave === true
+                ? { available: true }
+                : { available: false, reason: 'no_secure_hardware' };
+    }
+    catch (err) {
+        const e = err;
+        result = {
+            available: false,
+            reason: e.code === 'helper_missing'
+                ? 'helper_missing'
+                : e.code === 'unsupported'
+                    ? 'no_secure_hardware'
+                    : 'probe_failed',
+            message: e.message,
+        };
+    }
+    _probe = { result, at: Date.now() };
+    return result;
+}
+/** @internal Test seam — forget the cached capability. */
+export function __resetHardwareProbeForTest() {
+    _probe = null;
+}
+export function serializeHardwareKeyRecord(record, createdAt = new Date()) {
+    return JSON.stringify({
+        v: 1,
+        alg: 'ES256',
+        custody: 'hardware',
+        blob: record.blob,
+        publicJwk: record.publicJwk,
+        thumbprint: jwkThumbprint(record.publicJwk),
+        createdAt: createdAt.toISOString(),
+    });
+}
+/**
+ * Parse `device-key.se`. Null for anything that is not a well-formed v1 record
+ * whose stored thumbprint matches its own public key: a record is trusted for
+ * exactly what it proves about itself, so a half-written or hand-edited file
+ * reads as unreadable (which never replaces it) and not as a different key.
+ */
+export function parseHardwareKeyRecord(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.v !== 1 ||
+            parsed.alg !== 'ES256' ||
+            typeof parsed.blob !== 'string' ||
+            parsed.blob.length === 0) {
+            return null;
+        }
+        if (!isDevicePublicJwk(parsed.publicJwk) || parsed.publicJwk.kty !== 'EC')
+            return null;
+        if (parsed.thumbprint !== jwkThumbprint(parsed.publicJwk))
+            return null;
+        return { blob: parsed.blob, publicJwk: parsed.publicJwk };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// The key
+// ---------------------------------------------------------------------------
+/** A handle whose `sign` asks the helper, so no scalar is ever in this process. */
+export function hardwareDeviceKeyHandle(record) {
+    const publicRaw = Buffer.concat([
+        Buffer.from(record.publicJwk.x, 'base64url'),
+        Buffer.from(record.publicJwk.y, 'base64url'),
+    ]);
+    return {
+        alg: 'ES256',
+        custody: 'hardware',
+        publicJwk: record.publicJwk,
+        thumbprint: jwkThumbprint(record.publicJwk),
+        sign: async (signingInput) => {
+            const res = await runHelper('sign', { blob: record.blob, input: Buffer.from(signingInput).toString('base64') }, SIGN_TIMEOUT_MS);
+            const signature = decodeFixed(res.signature, 64, 'signature');
+            const reported = decodeFixed(res.publicKey, 64, 'publicKey');
+            if (!reported.equals(publicRaw)) {
+                // The blob unwrapped to a different key than the record names. Signing
+                // with it would produce a proof the server pins nothing to.
+                throw new HardwareDeviceKeyError('key_mismatch', 'the stored hardware key is not the key this record names');
+            }
+            return new Uint8Array(signature);
+        },
+    };
+}
+/**
+ * Create a hardware key and PROVE it before anyone relies on it: sign random
+ * bytes and verify them with Node's own crypto against the public key the helper
+ * reported. A helper that returns a mis-encoded signature, or a public key that
+ * is not the signer's, fails here with nothing yet persisted and nothing yet sent
+ * to the server, instead of as a rejected login that leaves a pin half-moved.
+ *
+ * The returned record is NOT persisted; the caller decides when it becomes the
+ * device's identity (see `commitDeviceKeyCandidate`). Dropping it destroys the
+ * key: the Secure Enclave keeps nothing the blob does not.
+ */
+export async function createHardwareDeviceKey() {
+    const res = await runHelper('create', {}, CREATE_TIMEOUT_MS);
+    if (typeof res.blob !== 'string' || res.blob.length === 0) {
+        throw new HardwareDeviceKeyError('bad_response', 'create returned no key');
+    }
+    const publicJwk = p256PublicJwkFromRaw(decodeFixed(res.publicKey, 64, 'publicKey'));
+    if (!isDevicePublicJwk(publicJwk))
+        throw new HardwareDeviceKeyError('bad_response', 'create returned an invalid key');
+    const record = { blob: res.blob, publicJwk };
+    const handle = hardwareDeviceKeyHandle(record);
+    const challenge = crypto.randomBytes(32);
+    const signature = await handle.sign(challenge);
+    const verified = crypto.verify('sha256', challenge, {
+        key: crypto.createPublicKey({
+            format: 'jwk',
+            key: publicJwk,
+        }),
+        dsaEncoding: 'ieee-p1363',
+    }, Buffer.from(signature));
+    if (!verified) {
+        throw new HardwareDeviceKeyError('key_mismatch', 'a signature from the new hardware key did not verify');
+    }
+    return { record, handle };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceKeyServerSupport.d.ts

@@ -0,0 +1,31 @@
+/**
+ * deviceKeyServerSupport.ts — which device-key algorithms does THIS server pin?
+ *
+ * A hardware-bound key is ES256, and a server that predates ES256 cannot pin one:
+ * enrolling it would fail, and a profile that had swapped its working key for it
+ * would be unable to sign in at all. So a client creates a hardware key only when
+ * the server has said it will accept one, and everything else (an older server,
+ * an unreachable one, a malformed answer, a redirect) is "unknown", which means
+ * "keep the key you have". The cost of being wrong in that direction is a
+ * software key a little longer; in the other it is a machine that cannot log in.
+ *
+ * The server says it in the RFC 8414 authorization-server metadata it already
+ * publishes, in the same `_values_supported` style that document uses for its own
+ * algorithm lists.
+ */
+import { type DeviceKeyAlg } from './deviceKey.js';
+/** Path of the metadata document (RFC 8414 §3), relative to the server's origin. */
+export declare const AUTH_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+/** The metadata field listing the device-key algorithms the server will pin. */
+export declare const SERVER_DEVICE_KEY_ALGS_FIELD = "device_key_signing_alg_values_supported";
+/** @internal Test seam. */
+export declare function __resetServerDeviceKeyAlgsForTest(): void;
+/**
+ * The device-key algorithms the server at `serverUrl` accepts, or null when that
+ * is not known. Never throws and never sends a credential: it is a plain GET of a
+ * public document.
+ */
+export declare function readServerDeviceKeyAlgs(serverUrl: string, opts?: {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<readonly DeviceKeyAlg[] | null>;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceKeyServerSupport.js

@@ -0,0 +1,86 @@
+/**
+ * deviceKeyServerSupport.ts — which device-key algorithms does THIS server pin?
+ *
+ * A hardware-bound key is ES256, and a server that predates ES256 cannot pin one:
+ * enrolling it would fail, and a profile that had swapped its working key for it
+ * would be unable to sign in at all. So a client creates a hardware key only when
+ * the server has said it will accept one, and everything else (an older server,
+ * an unreachable one, a malformed answer, a redirect) is "unknown", which means
+ * "keep the key you have". The cost of being wrong in that direction is a
+ * software key a little longer; in the other it is a machine that cannot log in.
+ *
+ * The server says it in the RFC 8414 authorization-server metadata it already
+ * publishes, in the same `_values_supported` style that document uses for its own
+ * algorithm lists.
+ */
+import { DEVICE_KEY_ALGS } from './deviceKey.js';
+/** Path of the metadata document (RFC 8414 §3), relative to the server's origin. */
+export const AUTH_SERVER_METADATA_PATH = '/.well-known/oauth-authorization-server';
+/** The metadata field listing the device-key algorithms the server will pin. */
+export const SERVER_DEVICE_KEY_ALGS_FIELD = 'device_key_signing_alg_values_supported';
+const TIMEOUT_MS = 5_000;
+const MAX_BYTES = 64 * 1024;
+/** A positive answer is kept for the process; an unknown one is looked at again after this. */
+const UNKNOWN_RETRY_MS = 60_000;
+const cache = new Map();
+/** @internal Test seam. */
+export function __resetServerDeviceKeyAlgsForTest() {
+    cache.clear();
+}
+/**
+ * The device-key algorithms the server at `serverUrl` accepts, or null when that
+ * is not known. Never throws and never sends a credential: it is a plain GET of a
+ * public document.
+ */
+export async function readServerDeviceKeyAlgs(serverUrl, opts = {}) {
+    let origin;
+    try {
+        origin = new URL(serverUrl).origin;
+    }
+    catch {
+        return null;
+    }
+    if (origin === 'null')
+        return null;
+    const hit = cache.get(origin);
+    if (hit && (hit.algs !== null || Date.now() - hit.at < UNKNOWN_RETRY_MS))
+        return hit.algs;
+    const algs = await fetchAlgs(origin, opts);
+    cache.set(origin, { algs, at: Date.now() });
+    return algs;
+}
+async function fetchAlgs(origin, opts) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function')
+        return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? TIMEOUT_MS);
+    try {
+        const res = await fetchImpl(`${origin}${AUTH_SERVER_METADATA_PATH}`, {
+            method: 'GET',
+            headers: { Accept: 'application/json' },
+            // The metadata lives at the issuer. A redirect is a server we did not ask.
+            redirect: 'manual',
+            signal: controller.signal,
+        });
+        if (res.status !== 200)
+            return null;
+        const text = await res.text();
+        if (text.length > MAX_BYTES)
+            return null;
+        const body = JSON.parse(text);
+        const listed = body[SERVER_DEVICE_KEY_ALGS_FIELD];
+        if (!Array.isArray(listed))
+            return null;
+        // Only algorithms this build can also sign and verify; an unknown name is not
+        // evidence that the server accepts one we know.
+        const known = DEVICE_KEY_ALGS.filter((alg) => listed.includes(alg));
+        return known.length > 0 ? known : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/dpop.js

@@ -116,6 +116,10 @@ export function verifyDpopProof(jws, opts) {
         // rth/pin are device-proof-only checks the options above never request.
         return { valid: false, reason: result.reason };
     }
+    // The shared verifier was told EdDSA only, and EdDSA means an OKP key; this is
+    // the type narrowing for that guarantee, and a refusal if it is ever wrong.
+    if (result.publicJwk.kty !== 'OKP')
+        return { valid: false, reason: 'bad_jwk' };
     // An empty jti cannot be claimed in a replay cache, so it is not a nonce.
     if (result.claims.jti.length === 0)
         return { valid: false, reason: 'malformed' };

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineReservation.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { assertMayMutateLiveState } from './liveState.js';
 /** The desktop reserves a new profile for every background authorization. */
 export const INDEPENDENT_MACHINE_PROFILE_RE = /^desktop-bg-[a-f0-9]{32}$/;
 export const INDEPENDENT_MACHINE_RESERVATION_FILE = 'independent-machine-attempt.json';
@@ -42,6 +43,9 @@ export function reserveIndependentMachineProfile(options) {
         throw new Error('Background authorization secure storage is unavailable');
     }
     const profiles = path.join(options.root, 'profiles');
+    // Everything below creates directories and an O_EXCL file under `options.root`; the shared
+    // writers have no exclusive create, so the refusal is asked once, for the whole tree.
+    assertMayMutateLiveState(profiles, 'reserve a background machine profile');
     const rootExisted = fs.existsSync(options.root);
     const profilesExisted = fs.existsSync(profiles);
     fs.mkdirSync(profiles, { recursive: true, mode: 0o700 });

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -25,11 +25,15 @@ export { loginWithLocalhost, LoginInitError, LoginExchangeError, type BrowserOpe
 export { parseTtlDays, MIN_TTL_DAYS, MAX_TTL_DAYS, type ParseTtlResult, type ParseTtlSuccess, type ParseTtlError, } from './ttlParser.js';
 export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRecoveryCode, } from './recoveryCode.js';
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
-export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, isMasterKekKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
-export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type DaemonKeychainServiceClass, type KekStrategy, } from './kek/index.js';
+export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SERVICE_BASE, DAEMON_KEYCHAIN_SERVICE_BASE, HERMETIC_HOME_ENV, LEGACY_DAEMON_KEYCHAIN_SERVICE, LIVE_DEFAULT_PROFILE, LIVE_STATE_REFUSED_CODE, LiveStateRefusedError, accountHomeDir, assertMayMutateLiveKeychain, assertMayMutateLiveState, isLiveKeychainService, isLiveStateRefusal, isTestProcess, keychainSuffixForDir, liveKeychainServices, liveStateRoot, refusesLiveKeychainMutation, refusesLiveStateInTest, rethrowIfLiveStateRefusal, testProcessSignal, type LiveKeychainProbe, type LiveStateProbe, } from './liveState.js';
+export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyAlg, type DeviceKeyPair, type DeviceKeySigner, type DevicePublicJwk, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type P256PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { softwareEd25519Handle, type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_ALGS_FIELD, } from './deviceKeyServerSupport.js';
+export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -98,12 +98,22 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 // Tests that need the unavailable branch must inject `UnavailableKek`;
 // `__setKekStrategyForTest(null)` restores the PLATFORM default, which is not
 // the same thing and differs per OS.
-export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, isMasterKekKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, } from './kek/index.js';
+export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, } from './kek/index.js';
+// A test process does not mutate the state of the product installed on the machine running it.
+// The refusal lives at auth-core's write boundary (`stateFiles.ts`) so it covers every runner at
+// once; daemon, cli and desktop import the same definitions of "test process" and "real home"
+// from here (or from the `live-state` subpath) instead of keeping their own.
+export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SERVICE_BASE, DAEMON_KEYCHAIN_SERVICE_BASE, HERMETIC_HOME_ENV, LEGACY_DAEMON_KEYCHAIN_SERVICE, LIVE_DEFAULT_PROFILE, LIVE_STATE_REFUSED_CODE, LiveStateRefusedError, accountHomeDir, assertMayMutateLiveKeychain, assertMayMutateLiveState, isLiveKeychainService, isLiveStateRefusal, isTestProcess, keychainSuffixForDir, liveKeychainServices, liveStateRoot, refusesLiveKeychainMutation, refusesLiveStateInTest, rethrowIfLiveStateRefusal, testProcessSignal, } from './liveState.js';
 // L11 Phase 1 — Device identity (Ed25519) + DPoP-shaped proof JWS.
 // The crypto half of the two-axis identity story; daemon-side
 // persistence + signing lives in `daemon/src/deviceIdentity.ts`.
 // Server-side verification middleware is a later PR.
-export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, } from './deviceKey.js';
+export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, } from './deviceKey.js';
+// The handle every signing site holds instead of a private key, and the
+// hardware-bound backend behind it (docs/architecture/device-key-custody-2026-10-29.md).
+export { softwareEd25519Handle } from './deviceKeyHandle.js';
+export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_ALGS_FIELD, } from './deviceKeyServerSupport.js';
+export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, } from './deviceKeyHardware.js';
 // OSK-12020 — RFC 9449 access-token binding (`cnf.jkt` + `DPoP` proof). A
 // different protocol from the device proof above (`typ: dpop+jwt`, header
 // `DPoP`), signed by a dedicated in-memory key the daemon holds.
@@ -119,7 +129,7 @@ initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, rese
 __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, } from './credentialEnvelopeBridge.js';
 export { 
 // deviceIdentity bridge
-initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, 
+initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/index.d.ts

@@ -19,7 +19,7 @@ export { MacosKek } from './macos.js';
 export { LinuxKek } from './linux.js';
 export { WindowsKek } from './windows.js';
 export { zeroizeKekCaches, registerZeroizeHook } from './zeroize-registry.js';
-export { isMasterKekKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, } from './masterKekService.js';
+export { classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, type DaemonKeychainServiceClass, } from './masterKekService.js';
 /**
  * @internal Test-only seam — inject a synthetic KEK strategy that wraps
  * with a fixed in-memory key. Resets to platform default when called

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/index.js

@@ -7,7 +7,7 @@ export { MacosKek } from './macos.js';
 export { LinuxKek } from './linux.js';
 export { WindowsKek } from './windows.js';
 export { zeroizeKekCaches, registerZeroizeHook } from './zeroize-registry.js';
-export { isMasterKekKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, } from './masterKekService.js';
+export { classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, } from './masterKekService.js';
 /**
  * Strategy used when the current platform has no implementation. Always
  * unavailable; never throws on probe. Provides an honest `id` so fleet

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/linux.d.ts

@@ -27,6 +27,24 @@ type ReadFileSyncLike = (path: string, encoding: BufferEncoding) => string;
  * also clear the tier selection + KEK cache so the next call re-probes.
  */
 export declare function __setFsForTest(fn: ReadFileSyncLike | null): void;
+/**
+ * Write the master KEK to the Secret Service. Uses stdin (base64-encoded)
+ * as required by `secret-tool store`. Idempotent — `secret-tool store`
+ * overwrites an existing item silently.
+ *
+ * `service` and `account` are passed in (rather than read from the
+ * module-level constants) so a `LinuxKek` instance constructed with an
+ * override stores under a unique Secret Service entry.
+ *
+ * Race note: see module-level comment above.
+ */
+declare function writeKekToSecretService(kek: Buffer, service: string, account: string): Promise<void>;
+/**
+ * @internal Test seam — the Secret Service write on its own, so a spec can reach the live-state
+ * guard without the tier probe getting in the way. A spec using it empties `PATH`, so that a
+ * guard which stopped firing reaches no `secret-tool` binary.
+ */
+export declare const __writeKekToSecretServiceForTest: typeof writeKekToSecretService;
 /**
  * Zero out and drop every in-process master-KEK cache buffer (both the
  * Tier-2 by-service map and the Tier-3 single buffer).

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/linux.js

@@ -61,6 +61,7 @@ import { openBuffer, sealBuffer, deserialize as envelopeDeserialize, serialize a
 import { KekUnavailableError } from './types.js';
 import { registerZeroizeHook } from './zeroize-registry.js';
 import { MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE } from './masterKekService.js';
+import { assertMayMutateLiveKeychain, rethrowIfLiveStateRefusal } from '../liveState.js';
 /** Stable telemetry kind strings — one per backend tier. */
 const KIND_LIBSECRET = 'linux-libsecret-shellout';
 const KIND_HKDF = 'linux-machineid-hkdf';
@@ -351,6 +352,11 @@ async function writeKekToSecretService(kek, service, account) {
     if (kek.length !== KEY_LEN) {
         throw new KekUnavailableError(KIND_LIBSECRET, `writeKekToSecretService: expected ${KEY_LEN}-byte buffer, got ${kek.length}`);
     }
+    // A test that injected a fake `secret-tool` writes nothing real. One that did not is about to
+    // store the machine's master KEK in the Secret Service.
+    if (_execFileForTest === null) {
+        assertMayMutateLiveKeychain(service, `store the Secret Service item ${account} (a master KEK)`);
+    }
     const b64 = kek.toString('base64');
     try {
         await exec('secret-tool', ['store', '--label=skrr daemon master KEK', 'service', service, 'account', account], { input: b64 });
@@ -359,6 +365,12 @@ async function writeKekToSecretService(kek, service, account) {
         throw new KekUnavailableError(KIND_LIBSECRET, 'secret-tool store failed', { cause: err });
     }
 }
+/**
+ * @internal Test seam — the Secret Service write on its own, so a spec can reach the live-state
+ * guard without the tier probe getting in the way. A spec using it empties `PATH`, so that a
+ * guard which stopped firing reaches no `secret-tool` binary.
+ */
+export const __writeKekToSecretServiceForTest = writeKekToSecretService;
 // ---------------------------------------------------------------------------
 // In-process KEK cache + tier selection.
 // ---------------------------------------------------------------------------
@@ -597,6 +609,9 @@ export class LinuxKek {
         catch (err) {
             if (err instanceof KekUnavailableError)
                 throw err;
+            // A refusal is not "the KEK is unavailable": wrapping it would let the credential
+            // envelope read a test aimed at the real Keychain as a locked one and carry on.
+            rethrowIfLiveStateRefusal(err);
             throw new KekUnavailableError(this.id, err?.message ?? 'shellout wrap failed', {
                 cause: err,
             });

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/macos.d.ts

@@ -21,6 +21,28 @@ export declare function __setExecFileForTest(fn: ExecFileLike | null): void;
 export declare function __resetSecurityProbeCacheForTest(): void;
 /** @internal Test seam — clear the resolved-keychain cache. */
 export declare function __resetResolvedKeychainCacheForTest(): void;
+/**
+ * Create a master KEK without replacing an existing item. This key is shared
+ * by profiles, so even a first-use race in a different process must not
+ * overwrite the key protecting already wrapped credentials.
+ *
+ * The `service` / `account` parameters are threaded from the calling
+ * `MacosKek` instance so each instance keeps its own keychain entry.
+ *
+ * Explicit-keychain target: the resolved login-keychain path is passed
+ * as the trailing positional argument to `add-generic-password` so
+ * `security(1)` cannot fall back to a "default keychain" lookup that
+ * triggers a system-modal `Keychain Not Found` dialog. If no keychain
+ * resolves, throw `KekUnavailableError` immediately rather than
+ * shelling out at all.
+ */
+declare function writeKekToKeychain(kek: Buffer, service: string, account: string): Promise<void>;
+/**
+ * @internal Test seam — the Keychain write on its own, so a spec can reach the live-state
+ * guard without `wrap()`'s `security` probe getting in the way. A spec using it empties `PATH`,
+ * so that a guard which stopped firing reaches no `security` binary.
+ */
+export declare const __writeKekToKeychainForTest: typeof writeKekToKeychain;
 /**
  * Zero out and drop every cached master-KEK buffer.
  *