@skrr-ai/cli 0.1.123 → 0.1.125

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKey.d.ts

@@ -50,6 +50,33 @@ export interface Ed25519PublicJwk {
 export interface Ed25519PrivateJwk extends Ed25519PublicJwk {
     readonly d: string;
 }
+/**
+ * NIST P-256 public JSON Web Key — RFC 7518 §6.2 ("Key Type 'EC'").
+ *
+ * The only curve a Secure Enclave or TPM will sign with, which is why a
+ * hardware-bound device key is a different `alg` (ES256) rather than a
+ * different storage backend for the same algorithm. `x` and `y` are the
+ * 32-byte affine coordinates in base64url-no-padding. There is deliberately
+ * no private form: a P-256 device key in this codebase is non-exportable, so
+ * nothing here ever holds its scalar.
+ */
+export interface P256PublicJwk {
+    readonly kty: 'EC';
+    readonly crv: 'P-256';
+    readonly x: string;
+    readonly y: string;
+}
+/** Any public key a device proof may be signed with. */
+export type DevicePublicJwk = Ed25519PublicJwk | P256PublicJwk;
+/**
+ * The JWS algorithms a device proof may use. `EdDSA` is the software key every
+ * install has had since L11; `ES256` is the hardware-bound key. A server pins
+ * ONE per device and never requires a client to use an algorithm it did not
+ * announce.
+ */
+export type DeviceKeyAlg = 'EdDSA' | 'ES256';
+/** Every algorithm this build can verify, in the order a client prefers them. */
+export declare const DEVICE_KEY_ALGS: readonly DeviceKeyAlg[];
 /**
  * The full keypair returned at generation time. Holding both forms here
  * is convenient for the daemon-side bridge — the public form is what we
@@ -57,6 +84,11 @@ export interface Ed25519PrivateJwk extends Ed25519PublicJwk {
  *
  * `thumbprint` is the RFC 7638 JWK thumbprint of the public key — the
  * canonical stable id we use as the device handle on the server.
+ *
+ * This is the SOFTWARE Ed25519 key only, and only the sealed-file store and
+ * key generation touch its private half. Everything that signs holds a
+ * `DeviceKeyHandle` (deviceKeyHandle.ts) instead, which cannot return the
+ * private scalar and so works unchanged for a key that has none.
  */
 export interface DeviceKeyPair {
     readonly publicJwk: Ed25519PublicJwk;
@@ -83,7 +115,23 @@ export declare function generateDeviceKeyPair(): DeviceKeyPair;
  * `kid` in JWS headers and as the registered identifier on the server's
  * `Daemon` table.
  */
-export declare function jwkThumbprint(publicJwk: Ed25519PublicJwk): string;
+export declare function jwkThumbprint(publicJwk: DevicePublicJwk): string;
+/**
+ * Structural check for a public device key: the right `kty`/`crv` pair, and
+ * coordinates that are exactly 32 bytes of base64url. It does not prove the
+ * point is on the curve (importing the key does that); it proves the value is
+ * safe to build a thumbprint from.
+ */
+export declare function isDevicePublicJwk(value: unknown): value is DevicePublicJwk;
+/** The JWS algorithm a public key signs with. */
+export declare function algForJwk(jwk: DevicePublicJwk): DeviceKeyAlg;
+/**
+ * A P-256 public JWK from the 64-byte `x || y` form a Secure Enclave reports
+ * (CryptoKit's `rawRepresentation`). Rejects any other length so a helper that
+ * returns an x9.63 point (65 bytes, leading 0x04) fails loudly instead of being
+ * mis-split into a key nothing can verify.
+ */
+export declare function p256PublicJwkFromRaw(raw: Uint8Array): P256PublicJwk;
 /**
  * Construct an `Ed25519PublicJwk` from a base64url-encoded 32-byte
  * public point. Used by the persistence layer when reading a stored
@@ -124,13 +172,13 @@ export interface DeviceProofClaims {
     ath?: string;
 }
 export interface DeviceProofHeader {
-    alg: 'EdDSA';
+    alg: DeviceKeyAlg;
     /** Custom `typ` so the server can refuse generic JWTs that happen
-     *  to be EdDSA-signed by a stolen device key. RFC 9449 uses
+     *  to be signed by a stolen device key. RFC 9449 uses
      *  `dpop+jwt`; we differentiate so OverSky proofs can't be
      *  cross-replayed into a generic DPoP resource server. */
     typ: 'oversky-dpop+jwt';
-    jwk: Ed25519PublicJwk;
+    jwk: DevicePublicJwk;
 }
 export interface BuildProofOptions {
     method: string;
@@ -172,11 +220,35 @@ export declare const DEVICE_PROOF_TYP = "oversky-dpop+jwt";
  * never verify as the other.
  */
 export declare function signEd25519Proof(privateKey: crypto.KeyObject, publicJwk: Ed25519PublicJwk, typ: string, opts: BuildProofOptions): string;
+/**
+ * The `header.payload` half of a proof: everything the key signs. Split out so
+ * a key that cannot be handed to this process (a Secure Enclave key signs
+ * inside a helper) signs the very same bytes a software key does, and nothing
+ * about the wire format depends on where the signature came from.
+ *
+ * @internal Shared by `signEd25519Proof` and `signProofWith`.
+ */
+export declare function proofSigningInput(alg: DeviceKeyAlg, publicJwk: DevicePublicJwk, typ: string, opts: BuildProofOptions): string;
+/**
+ * Anything that can sign a device proof (a `DeviceKeySigner`): a software key held in this process,
+ * or a hardware key that signs elsewhere. `sign` returns the JWS signature for
+ * `alg` (RFC 7515 §A.3 / RFC 8037: raw r||s for ES256, the 64 bytes for EdDSA),
+ * never DER.
+ */
+export interface DeviceKeySigner {
+    readonly alg: DeviceKeyAlg;
+    readonly publicJwk: DevicePublicJwk;
+    sign(signingInput: Uint8Array): Promise<Uint8Array>;
+}
+/** Sign a device-identity proof with any `DeviceKeySigner`. */
+export declare function signProofWith(signer: DeviceKeySigner, opts: BuildProofOptions, typ?: string): Promise<string>;
 export type VerifyFailureReason = 'malformed' | 'bad_alg' | 'bad_typ' | 'bad_jwk' | 'sig_invalid' | 'iat_old' | 'iat_future' | 'htm_mismatch' | 'htu_mismatch' | 'rth_mismatch' | 'ath_mismatch' | 'pin_mismatch';
 export interface VerifySuccess {
     valid: true;
     claims: DeviceProofClaims;
-    publicJwk: Ed25519PublicJwk;
+    publicJwk: DevicePublicJwk;
+    /** The algorithm the proof was signed with; always one `allowedAlgs` admitted. */
+    alg: DeviceKeyAlg;
     thumbprint: string;
 }
 export interface VerifyFailure {
@@ -199,8 +271,17 @@ export interface VerifyOptions {
     expectedAth?: string;
     /** Public JWK pinned at the server side. When provided, the proof's
      *  inlined JWK MUST equal this — defends against a stolen valid
-     *  proof signed by a different (e.g., revoked) device. */
-    pinnedPublicJwk?: Ed25519PublicJwk;
+     *  proof signed by a different (e.g., revoked) device. Compared by
+     *  thumbprint, so a pin on one algorithm never admits a key of another. */
+    pinnedPublicJwk?: DevicePublicJwk;
+    /**
+     * The algorithms this verification admits. Defaults to `['EdDSA']`: a caller
+     * that has not decided it accepts hardware-bound keys keeps exactly the
+     * behaviour it had before ES256 existed. A server that pins a device to ES256
+     * passes the algorithm of the PIN, not `DEVICE_KEY_ALGS`, so a proof cannot
+     * choose a weaker algorithm than the device enrolled with.
+     */
+    allowedAlgs?: readonly DeviceKeyAlg[];
     /** Override the wall clock — testing hook. Defaults to `Date.now()`. */
     now?: number;
 }
@@ -217,7 +298,25 @@ export declare function verifyProof(jws: string, opts?: VerifyOptions): VerifySu
 /**
  * Verify a DPoP-shaped Ed25519 proof whose header `typ` must equal `typ`.
  *
+ * Always EdDSA, whatever `opts.allowedAlgs` says: the RFC 9449 access-token
+ * proof (`dpop.ts`) is signed by the CLI's own in-memory Ed25519 key, which is a
+ * different key from the device key and deliberately stays software.
+ *
  * @internal See `signEd25519Proof`. `verifyProof` (device identity) and
  * `verifyDpopProof` (`dpop.ts`, RFC 9449) are the two public doors.
  */
 export declare function verifyEd25519Proof(jws: string, opts: VerifyOptions, typ: string): VerifySuccess | VerifyFailure;
+/**
+ * Verify a DPoP-shaped proof signed by an Ed25519 or P-256 key, whose header
+ * `typ` must equal `typ` and whose `alg` must be in `opts.allowedAlgs`.
+ *
+ * The algorithm comes from the header and is checked twice before any key is
+ * built: it must be one the caller admitted, and it must be the algorithm the
+ * header's own key type signs with. Without the second check a header could
+ * pair `alg: ES256` with an Ed25519 key (or the reverse) and steer the
+ * verifier into a code path nobody tested; with it, the only thing an attacker
+ * controls about the algorithm is a choice among the caller's own allow-list.
+ *
+ * @internal
+ */
+export declare function verifyDevicePublicKeyProof(jws: string, opts: VerifyOptions, typ: string): VerifySuccess | VerifyFailure;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKey.js

@@ -28,19 +28,27 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var deviceKey_exports = {};
 __export(deviceKey_exports, {
+  DEVICE_KEY_ALGS: () => DEVICE_KEY_ALGS,
   DEVICE_PROOF_TYP: () => DEVICE_PROOF_TYP,
+  algForJwk: () => algForJwk,
   buildProof: () => buildProof,
   generateDeviceKeyPair: () => generateDeviceKeyPair,
+  isDevicePublicJwk: () => isDevicePublicJwk,
   jwkThumbprint: () => jwkThumbprint,
   normalizeHtu: () => normalizeHtu,
+  p256PublicJwkFromRaw: () => p256PublicJwkFromRaw,
+  proofSigningInput: () => proofSigningInput,
   publicJwkFromX: () => publicJwkFromX,
   signEd25519Proof: () => signEd25519Proof,
+  signProofWith: () => signProofWith,
   tokenHash: () => tokenHash,
+  verifyDevicePublicKeyProof: () => verifyDevicePublicKeyProof,
   verifyEd25519Proof: () => verifyEd25519Proof,
   verifyProof: () => verifyProof
 });
 module.exports = __toCommonJS(deviceKey_exports);
 var import_node_crypto = __toESM(require("node:crypto"), 1);
+const DEVICE_KEY_ALGS = ["ES256", "EdDSA"];
 function b64u(buf) {
   return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
@@ -64,9 +72,32 @@ function generateDeviceKeyPair() {
   };
 }
 function jwkThumbprint(publicJwk) {
-  const canonical = `{"crv":"${publicJwk.crv}","kty":"${publicJwk.kty}","x":"${publicJwk.x}"}`;
+  const canonical = publicJwk.kty === "EC" ? `{"crv":"${publicJwk.crv}","kty":"${publicJwk.kty}","x":"${publicJwk.x}","y":"${publicJwk.y}"}` : `{"crv":"${publicJwk.crv}","kty":"${publicJwk.kty}","x":"${publicJwk.x}"}`;
   return b64u(import_node_crypto.default.createHash("sha256").update(canonical, "utf-8").digest());
 }
+const B64URL_32 = /^[A-Za-z0-9_-]{43}$/;
+function isDevicePublicJwk(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const jwk = value;
+  if (jwk.kty === "OKP") {
+    return jwk.crv === "Ed25519" && typeof jwk.x === "string" && B64URL_32.test(jwk.x);
+  }
+  if (jwk.kty === "EC") {
+    return jwk.crv === "P-256" && typeof jwk.x === "string" && typeof jwk.y === "string" && B64URL_32.test(jwk.x) && B64URL_32.test(jwk.y);
+  }
+  return false;
+}
+function algForJwk(jwk) {
+  return jwk.kty === "EC" ? "ES256" : "EdDSA";
+}
+function p256PublicJwkFromRaw(raw) {
+  if (raw.length !== 64) {
+    throw new Error(`p256PublicJwkFromRaw: expected 64 bytes (x||y), got ${raw.length}`);
+  }
+  const buf = Buffer.from(raw);
+  return { kty: "EC", crv: "P-256", x: b64u(buf.subarray(0, 32)), y: b64u(buf.subarray(32)) };
+}
 function publicJwkFromX(x) {
   const raw = b64uDecode(x);
   if (raw.length !== 32) {
@@ -100,12 +131,20 @@ function buildProof(privateJwk, publicJwk, opts) {
 }
 const DEVICE_PROOF_TYP = "oversky-dpop+jwt";
 function signEd25519Proof(privateKey, publicJwk, typ, opts) {
+  const signingInput = proofSigningInput("EdDSA", publicJwk, typ, opts);
+  const signature = import_node_crypto.default.sign(null, Buffer.from(signingInput, "utf-8"), privateKey);
+  return `${signingInput}.${b64u(signature)}`;
+}
+function proofSigningInput(alg, publicJwk, typ, opts) {
   if (typeof opts.method !== "string" || opts.method.length === 0) {
     throw new Error("buildProof: method must be a non-empty string");
   }
   if (typeof opts.url !== "string" || opts.url.length === 0) {
     throw new Error("buildProof: url must be a non-empty string");
   }
+  if (algForJwk(publicJwk) !== alg) {
+    throw new Error(`buildProof: alg ${alg} does not match a ${publicJwk.kty} key`);
+  }
   const claims = {
     htm: opts.method.toUpperCase(),
     htu: normalizeHtu(opts.url),
@@ -116,17 +155,23 @@ function signEd25519Proof(privateKey, publicJwk, typ, opts) {
     claims.rth = tokenHash(opts.refreshToken);
   if (opts.accessToken !== void 0)
     claims.ath = tokenHash(opts.accessToken);
-  const header = { alg: "EdDSA", typ, jwk: publicJwk };
+  const header = { alg, typ, jwk: publicJwk };
   const headerB64 = b64u(Buffer.from(JSON.stringify(header), "utf-8"));
   const payloadB64 = b64u(Buffer.from(JSON.stringify(claims), "utf-8"));
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const signature = import_node_crypto.default.sign(null, Buffer.from(signingInput, "utf-8"), privateKey);
-  return `${signingInput}.${b64u(signature)}`;
+  return `${headerB64}.${payloadB64}`;
+}
+async function signProofWith(signer, opts, typ = DEVICE_PROOF_TYP) {
+  const signingInput = proofSigningInput(signer.alg, signer.publicJwk, typ, opts);
+  const signature = await signer.sign(Buffer.from(signingInput, "utf-8"));
+  return `${signingInput}.${b64u(Buffer.from(signature))}`;
 }
 function verifyProof(jws, opts = {}) {
-  return verifyEd25519Proof(jws, opts, DEVICE_PROOF_TYP);
+  return verifyDevicePublicKeyProof(jws, opts, DEVICE_PROOF_TYP);
 }
 function verifyEd25519Proof(jws, opts, typ) {
+  return verifyDevicePublicKeyProof(jws, { ...opts, allowedAlgs: ["EdDSA"] }, typ);
+}
+function verifyDevicePublicKeyProof(jws, opts, typ) {
   if (typeof jws !== "string" || jws.length === 0) {
     return { valid: false, reason: "malformed" };
   }
@@ -143,27 +188,24 @@ function verifyEd25519Proof(jws, opts, typ) {
   } catch {
     return { valid: false, reason: "malformed" };
   }
-  if (!header || typeof header !== "object" || header.alg !== "EdDSA") {
+  const allowedAlgs = opts.allowedAlgs ?? ["EdDSA"];
+  const headerAlg = header && typeof header === "object" ? header.alg : void 0;
+  if (headerAlg !== "EdDSA" && headerAlg !== "ES256" || !allowedAlgs.includes(headerAlg)) {
     return { valid: false, reason: "bad_alg" };
   }
   if (header.typ !== typ) {
     return { valid: false, reason: "bad_typ" };
   }
   const headerJwk = header.jwk;
-  if (!headerJwk || typeof headerJwk !== "object" || headerJwk.kty !== "OKP" || headerJwk.crv !== "Ed25519" || typeof headerJwk.x !== "string") {
+  if (!isDevicePublicJwk(headerJwk)) {
     return { valid: false, reason: "bad_jwk" };
   }
-  const publicJwk = {
-    kty: "OKP",
-    crv: "Ed25519",
-    x: headerJwk.x
-  };
+  const publicJwk = headerJwk.kty === "EC" ? { kty: "EC", crv: "P-256", x: headerJwk.x, y: headerJwk.y } : { kty: "OKP", crv: "Ed25519", x: headerJwk.x };
+  if (algForJwk(publicJwk) !== headerAlg) {
+    return { valid: false, reason: "bad_alg" };
+  }
   let publicKeyObj;
   try {
-    const raw = b64uDecode(publicJwk.x);
-    if (raw.length !== 32) {
-      return { valid: false, reason: "bad_jwk" };
-    }
     publicKeyObj = import_node_crypto.default.createPublicKey({
       format: "jwk",
       key: publicJwk
@@ -171,7 +213,7 @@ function verifyEd25519Proof(jws, opts, typ) {
   } catch {
     return { valid: false, reason: "bad_jwk" };
   }
-  if (opts.pinnedPublicJwk && opts.pinnedPublicJwk.x !== publicJwk.x) {
+  if (opts.pinnedPublicJwk && jwkThumbprint(opts.pinnedPublicJwk) !== jwkThumbprint(publicJwk)) {
     return { valid: false, reason: "pin_mismatch" };
   }
   const signingInput = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
@@ -183,7 +225,15 @@ function verifyEd25519Proof(jws, opts, typ) {
   }
   let sigOk;
   try {
-    sigOk = import_node_crypto.default.verify(null, signingInput, publicKeyObj, signature);
+    sigOk = headerAlg === "ES256" ? (
+      // JWS ES256 is the fixed-width r||s form, never DER (RFC 7518 §3.4).
+      // Node's 'ieee-p1363' encoding is that form and already refuses any
+      // other width (removing the explicit length check changes no test
+      // result), so the check below states the requirement instead of
+      // inheriting it: a DER or truncated signature must fail here rather
+      // than be re-encoded into validity, even under a Node that changes.
+      signature.length === 64 && import_node_crypto.default.verify("sha256", signingInput, { key: publicKeyObj, dsaEncoding: "ieee-p1363" }, signature)
+    ) : import_node_crypto.default.verify(null, signingInput, publicKeyObj, signature);
   } catch {
     sigOk = false;
   }
@@ -221,19 +271,27 @@ function verifyEd25519Proof(jws, opts, typ) {
     valid: true,
     claims,
     publicJwk,
+    alg: headerAlg,
     thumbprint: jwkThumbprint(publicJwk)
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEVICE_KEY_ALGS,
   DEVICE_PROOF_TYP,
+  algForJwk,
   buildProof,
   generateDeviceKeyPair,
+  isDevicePublicJwk,
   jwkThumbprint,
   normalizeHtu,
+  p256PublicJwkFromRaw,
+  proofSigningInput,
   publicJwkFromX,
   signEd25519Proof,
+  signProofWith,
   tokenHash,
+  verifyDevicePublicKeyProof,
   verifyEd25519Proof,
   verifyProof
 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKeyHandle.d.ts

@@ -0,0 +1,33 @@
+import { type DeviceKeyPair, type DeviceKeySigner } from './deviceKey.js';
+/**
+ * Where the private half lives.
+ *
+ *  - `software`: an exportable scalar, sealed in a file under the credential
+ *    envelope. Anything that can read that file and the envelope key owns the
+ *    device identity.
+ *  - `hardware`: a non-exportable key inside a Secure Enclave / TPM. A copy of
+ *    every file on the disk is still not the key.
+ */
+export type DeviceKeyCustody = 'software' | 'hardware';
+export interface DeviceKeyHandle extends DeviceKeySigner {
+    readonly custody: DeviceKeyCustody;
+    /** RFC 7638 thumbprint of `publicJwk`; the id the server pins. */
+    readonly thumbprint: string;
+}
+/**
+ * A handle over a software Ed25519 key. Throws if the pair is internally
+ * inconsistent (public and private halves from different keys, or a private
+ * JWK Node cannot import) so a corrupted identity fails at load, where the
+ * caller already handles it, rather than at the first signature.
+ */
+export declare function softwareEd25519Handle(pair: DeviceKeyPair): DeviceKeyHandle;
+/**
+ * A software P-256 handle with a fresh key. NOT a device-key backend: a
+ * software P-256 key gives up exactly what P-256 is for, and nothing in the
+ * product creates one. It exists so the ES256 wire format (sign, verify, pin)
+ * can be exercised end to end without a Secure Enclave, and so a fake hardware
+ * helper in a test signs with the real algorithm instead of a stub.
+ *
+ * @internal
+ */
+export declare function generateSoftwareP256Handle(): DeviceKeyHandle;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKeyHandle.js

@@ -0,0 +1,77 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var deviceKeyHandle_exports = {};
+__export(deviceKeyHandle_exports, {
+  generateSoftwareP256Handle: () => generateSoftwareP256Handle,
+  softwareEd25519Handle: () => softwareEd25519Handle
+});
+module.exports = __toCommonJS(deviceKeyHandle_exports);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var import_deviceKey = require("./deviceKey.js");
+function softwareEd25519Handle(pair) {
+  if (pair.publicJwk.x !== pair.privateJwk.x) {
+    throw new Error("softwareEd25519Handle: public/private JWK x mismatch (corrupted keypair)");
+  }
+  const privateKey = import_node_crypto.default.createPrivateKey({
+    format: "jwk",
+    key: pair.privateJwk
+  });
+  const publicJwk = pair.publicJwk;
+  return {
+    alg: "EdDSA",
+    custody: "software",
+    publicJwk,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(publicJwk),
+    // Ed25519 hashes the message itself, so Node takes `null` for the digest.
+    sign: async (signingInput) => new Uint8Array(import_node_crypto.default.sign(null, Buffer.from(signingInput), privateKey))
+  };
+}
+function generateSoftwareP256Handle() {
+  const { privateKey, publicKey } = import_node_crypto.default.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  const jwk = publicKey.export({ format: "jwk" });
+  const publicJwk = { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+  return {
+    alg: "ES256",
+    custody: "software",
+    publicJwk,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(publicJwk),
+    sign: async (signingInput) => new Uint8Array(
+      // 'ieee-p1363' is the JWS (r||s) form; the default would be DER.
+      import_node_crypto.default.sign("sha256", Buffer.from(signingInput), {
+        key: privateKey,
+        dsaEncoding: "ieee-p1363"
+      })
+    )
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  generateSoftwareP256Handle,
+  softwareEd25519Handle
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKeyHardware.d.ts

@@ -0,0 +1,68 @@
+import { type P256PublicJwk } from './deviceKey.js';
+import type { DeviceKeyHandle } from './deviceKeyHandle.js';
+/** File name of the helper next to the daemon binary and under `<machine root>/bin`. */
+export declare const HARDWARE_KEY_HELPER_NAME = "skrr-native-device-key";
+export declare const HARDWARE_KEY_PROTOCOL = 1;
+export type HardwareDeviceKeyErrorCode = 'helper_missing' | 'helper_failed' | 'timeout' | 'bad_response' | 'key_mismatch' | 'unsupported';
+export declare class HardwareDeviceKeyError extends Error {
+    readonly code: HardwareDeviceKeyErrorCode;
+    constructor(code: HardwareDeviceKeyErrorCode, message: string);
+}
+/**
+ * Tell auth-core where the helper is. The daemon calls this at boot with the
+ * path next to its own binary; a process that never does (the CLI, a test)
+ * falls back to the places the helper is installed: beside this process's
+ * executable, then `<machine root>/bin`. Pass `null` to forget a resolver.
+ */
+export declare function configureHardwareDeviceKeyHelper(resolver: (() => string | null) | null): void;
+/** Absolute path of an executable helper, or null when this machine has none. */
+export declare function resolveHardwareDeviceKeyHelper(): string | null;
+/** @internal Test seam — bound every helper call by `ms`. `null` restores the real limits. */
+export declare function __setHardwareHelperTimeoutForTest(ms: number | null): void;
+export type HardwareKeyCapability = {
+    available: true;
+} | {
+    available: false;
+    reason: 'helper_missing' | 'no_secure_hardware' | 'probe_failed';
+    message?: string;
+};
+/**
+ * Can this machine create and use a hardware-bound device key right now? Looked
+ * up, never assumed: the answer needs both a helper that runs and hardware that
+ * answers. A positive result is kept for the life of the process; a negative one
+ * is retried after a minute, so a helper installed by an update is picked up
+ * without a restart and a broken one is not spawned on every proof.
+ */
+export declare function probeHardwareDeviceKey(): Promise<HardwareKeyCapability>;
+/** @internal Test seam — forget the cached capability. */
+export declare function __resetHardwareProbeForTest(): void;
+/** Contents of `device-key.se`. The blob is opaque and machine-bound; see the file header. */
+export interface HardwareKeyRecord {
+    readonly blob: string;
+    readonly publicJwk: P256PublicJwk;
+}
+export declare function serializeHardwareKeyRecord(record: HardwareKeyRecord, createdAt?: Date): string;
+/**
+ * Parse `device-key.se`. Null for anything that is not a well-formed v1 record
+ * whose stored thumbprint matches its own public key: a record is trusted for
+ * exactly what it proves about itself, so a half-written or hand-edited file
+ * reads as unreadable (which never replaces it) and not as a different key.
+ */
+export declare function parseHardwareKeyRecord(text: string): HardwareKeyRecord | null;
+/** A handle whose `sign` asks the helper, so no scalar is ever in this process. */
+export declare function hardwareDeviceKeyHandle(record: HardwareKeyRecord): DeviceKeyHandle;
+/**
+ * Create a hardware key and PROVE it before anyone relies on it: sign random
+ * bytes and verify them with Node's own crypto against the public key the helper
+ * reported. A helper that returns a mis-encoded signature, or a public key that
+ * is not the signer's, fails here with nothing yet persisted and nothing yet sent
+ * to the server, instead of as a rejected login that leaves a pin half-moved.
+ *
+ * The returned record is NOT persisted; the caller decides when it becomes the
+ * device's identity (see `commitDeviceKeyCandidate`). Dropping it destroys the
+ * key: the Secure Enclave keeps nothing the blob does not.
+ */
+export declare function createHardwareDeviceKey(): Promise<{
+    record: HardwareKeyRecord;
+    handle: DeviceKeyHandle;
+}>;