@skrr-ai/cli 0.1.123 → 0.1.125

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKeyHardware.js

@@ -0,0 +1,264 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var deviceKeyHardware_exports = {};
+__export(deviceKeyHardware_exports, {
+  HARDWARE_KEY_HELPER_NAME: () => HARDWARE_KEY_HELPER_NAME,
+  HARDWARE_KEY_PROTOCOL: () => HARDWARE_KEY_PROTOCOL,
+  HardwareDeviceKeyError: () => HardwareDeviceKeyError,
+  __resetHardwareProbeForTest: () => __resetHardwareProbeForTest,
+  __setHardwareHelperTimeoutForTest: () => __setHardwareHelperTimeoutForTest,
+  configureHardwareDeviceKeyHelper: () => configureHardwareDeviceKeyHelper,
+  createHardwareDeviceKey: () => createHardwareDeviceKey,
+  hardwareDeviceKeyHandle: () => hardwareDeviceKeyHandle,
+  parseHardwareKeyRecord: () => parseHardwareKeyRecord,
+  probeHardwareDeviceKey: () => probeHardwareDeviceKey,
+  resolveHardwareDeviceKeyHelper: () => resolveHardwareDeviceKeyHelper,
+  serializeHardwareKeyRecord: () => serializeHardwareKeyRecord
+});
+module.exports = __toCommonJS(deviceKeyHardware_exports);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var import_node_child_process = require("node:child_process");
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_deviceKey = require("./deviceKey.js");
+var import_runtime = require("./runtime.js");
+const HARDWARE_KEY_HELPER_NAME = "skrr-native-device-key";
+const HARDWARE_KEY_PROTOCOL = 1;
+const PROBE_TIMEOUT_MS = 5e3;
+const CREATE_TIMEOUT_MS = 15e3;
+const SIGN_TIMEOUT_MS = 1e4;
+const PROBE_RETRY_MS = 6e4;
+class HardwareDeviceKeyError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "HardwareDeviceKeyError";
+  }
+}
+let _resolver = null;
+function configureHardwareDeviceKeyHelper(resolver) {
+  _resolver = resolver;
+  _probe = null;
+}
+function isExecutableFile(file) {
+  try {
+    if (!import_node_fs.default.statSync(file).isFile())
+      return false;
+    import_node_fs.default.accessSync(file, import_node_fs.default.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveHardwareDeviceKeyHelper() {
+  const candidates = [];
+  try {
+    candidates.push(_resolver ? _resolver() : null);
+  } catch {
+  }
+  candidates.push(import_node_path.default.join(import_node_path.default.dirname(process.execPath), HARDWARE_KEY_HELPER_NAME));
+  try {
+    candidates.push(import_node_path.default.join((0, import_runtime.getAuthMachineConfigDir)(), "bin", HARDWARE_KEY_HELPER_NAME));
+  } catch {
+  }
+  for (const candidate of candidates) {
+    if (candidate && import_node_path.default.isAbsolute(candidate) && isExecutableFile(candidate))
+      return candidate;
+  }
+  return null;
+}
+let _timeoutOverrideMs = null;
+function __setHardwareHelperTimeoutForTest(ms) {
+  _timeoutOverrideMs = ms;
+}
+function runHelper(op, request, timeoutMs) {
+  const helper = resolveHardwareDeviceKeyHelper();
+  if (!helper) {
+    return Promise.reject(new HardwareDeviceKeyError("helper_missing", `${HARDWARE_KEY_HELPER_NAME} is not installed on this machine`));
+  }
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.execFile)(
+      helper,
+      [op],
+      // No shell, no inherited environment: the helper needs nothing from ours,
+      // and a signing process should not see session tokens it has no use for.
+      {
+        timeout: _timeoutOverrideMs ?? timeoutMs,
+        maxBuffer: 64 * 1024,
+        windowsHide: true,
+        env: {},
+        encoding: "utf8"
+      },
+      (error, stdout) => {
+        let parsed = null;
+        try {
+          parsed = JSON.parse(stdout);
+        } catch {
+          parsed = null;
+        }
+        if (error) {
+          if (error.killed) {
+            reject(new HardwareDeviceKeyError("timeout", `${op} did not finish within ${_timeoutOverrideMs ?? timeoutMs} ms`));
+            return;
+          }
+          const code = parsed?.error?.code;
+          const message = parsed?.error?.message;
+          reject(new HardwareDeviceKeyError(code === "unsupported" ? "unsupported" : "helper_failed", typeof message === "string" ? message : `${op} failed: ${error.message}`));
+          return;
+        }
+        if (!parsed || parsed.v !== HARDWARE_KEY_PROTOCOL) {
+          reject(new HardwareDeviceKeyError("bad_response", `${op} returned an unexpected response`));
+          return;
+        }
+        resolve(parsed);
+      }
+    );
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(JSON.stringify({ v: HARDWARE_KEY_PROTOCOL, ...request }));
+  });
+}
+function decodeFixed(value, bytes, what) {
+  if (typeof value !== "string")
+    throw new HardwareDeviceKeyError("bad_response", `${what} is missing`);
+  const buf = Buffer.from(value, "base64");
+  if (buf.length !== bytes) {
+    throw new HardwareDeviceKeyError("bad_response", `${what} is ${buf.length} bytes, expected ${bytes}`);
+  }
+  return buf;
+}
+let _probe = null;
+async function probeHardwareDeviceKey() {
+  if (_probe && (_probe.result.available || Date.now() - _probe.at < PROBE_RETRY_MS))
+    return _probe.result;
+  let result;
+  try {
+    const res = await runHelper("probe", {}, PROBE_TIMEOUT_MS);
+    result = res.secureEnclave === true ? { available: true } : { available: false, reason: "no_secure_hardware" };
+  } catch (err) {
+    const e = err;
+    result = {
+      available: false,
+      reason: e.code === "helper_missing" ? "helper_missing" : e.code === "unsupported" ? "no_secure_hardware" : "probe_failed",
+      message: e.message
+    };
+  }
+  _probe = { result, at: Date.now() };
+  return result;
+}
+function __resetHardwareProbeForTest() {
+  _probe = null;
+}
+function serializeHardwareKeyRecord(record, createdAt = /* @__PURE__ */ new Date()) {
+  return JSON.stringify({
+    v: 1,
+    alg: "ES256",
+    custody: "hardware",
+    blob: record.blob,
+    publicJwk: record.publicJwk,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(record.publicJwk),
+    createdAt: createdAt.toISOString()
+  });
+}
+function parseHardwareKeyRecord(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed.v !== 1 || parsed.alg !== "ES256" || typeof parsed.blob !== "string" || parsed.blob.length === 0) {
+      return null;
+    }
+    if (!(0, import_deviceKey.isDevicePublicJwk)(parsed.publicJwk) || parsed.publicJwk.kty !== "EC")
+      return null;
+    if (parsed.thumbprint !== (0, import_deviceKey.jwkThumbprint)(parsed.publicJwk))
+      return null;
+    return { blob: parsed.blob, publicJwk: parsed.publicJwk };
+  } catch {
+    return null;
+  }
+}
+function hardwareDeviceKeyHandle(record) {
+  const publicRaw = Buffer.concat([
+    Buffer.from(record.publicJwk.x, "base64url"),
+    Buffer.from(record.publicJwk.y, "base64url")
+  ]);
+  return {
+    alg: "ES256",
+    custody: "hardware",
+    publicJwk: record.publicJwk,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(record.publicJwk),
+    sign: async (signingInput) => {
+      const res = await runHelper("sign", { blob: record.blob, input: Buffer.from(signingInput).toString("base64") }, SIGN_TIMEOUT_MS);
+      const signature = decodeFixed(res.signature, 64, "signature");
+      const reported = decodeFixed(res.publicKey, 64, "publicKey");
+      if (!reported.equals(publicRaw)) {
+        throw new HardwareDeviceKeyError("key_mismatch", "the stored hardware key is not the key this record names");
+      }
+      return new Uint8Array(signature);
+    }
+  };
+}
+async function createHardwareDeviceKey() {
+  const res = await runHelper("create", {}, CREATE_TIMEOUT_MS);
+  if (typeof res.blob !== "string" || res.blob.length === 0) {
+    throw new HardwareDeviceKeyError("bad_response", "create returned no key");
+  }
+  const publicJwk = (0, import_deviceKey.p256PublicJwkFromRaw)(decodeFixed(res.publicKey, 64, "publicKey"));
+  if (!(0, import_deviceKey.isDevicePublicJwk)(publicJwk))
+    throw new HardwareDeviceKeyError("bad_response", "create returned an invalid key");
+  const record = { blob: res.blob, publicJwk };
+  const handle = hardwareDeviceKeyHandle(record);
+  const challenge = import_node_crypto.default.randomBytes(32);
+  const signature = await handle.sign(challenge);
+  const verified = import_node_crypto.default.verify("sha256", challenge, {
+    key: import_node_crypto.default.createPublicKey({
+      format: "jwk",
+      key: publicJwk
+    }),
+    dsaEncoding: "ieee-p1363"
+  }, Buffer.from(signature));
+  if (!verified) {
+    throw new HardwareDeviceKeyError("key_mismatch", "a signature from the new hardware key did not verify");
+  }
+  return { record, handle };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HARDWARE_KEY_HELPER_NAME,
+  HARDWARE_KEY_PROTOCOL,
+  HardwareDeviceKeyError,
+  __resetHardwareProbeForTest,
+  __setHardwareHelperTimeoutForTest,
+  configureHardwareDeviceKeyHelper,
+  createHardwareDeviceKey,
+  hardwareDeviceKeyHandle,
+  parseHardwareKeyRecord,
+  probeHardwareDeviceKey,
+  resolveHardwareDeviceKeyHelper,
+  serializeHardwareKeyRecord
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKeyServerSupport.d.ts

@@ -0,0 +1,31 @@
+/**
+ * deviceKeyServerSupport.ts — which device-key algorithms does THIS server pin?
+ *
+ * A hardware-bound key is ES256, and a server that predates ES256 cannot pin one:
+ * enrolling it would fail, and a profile that had swapped its working key for it
+ * would be unable to sign in at all. So a client creates a hardware key only when
+ * the server has said it will accept one, and everything else (an older server,
+ * an unreachable one, a malformed answer, a redirect) is "unknown", which means
+ * "keep the key you have". The cost of being wrong in that direction is a
+ * software key a little longer; in the other it is a machine that cannot log in.
+ *
+ * The server says it in the RFC 8414 authorization-server metadata it already
+ * publishes, in the same `_values_supported` style that document uses for its own
+ * algorithm lists.
+ */
+import { type DeviceKeyAlg } from './deviceKey.js';
+/** Path of the metadata document (RFC 8414 §3), relative to the server's origin. */
+export declare const AUTH_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+/** The metadata field listing the device-key algorithms the server will pin. */
+export declare const SERVER_DEVICE_KEY_ALGS_FIELD = "device_key_signing_alg_values_supported";
+/** @internal Test seam. */
+export declare function __resetServerDeviceKeyAlgsForTest(): void;
+/**
+ * The device-key algorithms the server at `serverUrl` accepts, or null when that
+ * is not known. Never throws and never sends a credential: it is a plain GET of a
+ * public document.
+ */
+export declare function readServerDeviceKeyAlgs(serverUrl: string, opts?: {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<readonly DeviceKeyAlg[] | null>;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKeyServerSupport.js

@@ -0,0 +1,90 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var deviceKeyServerSupport_exports = {};
+__export(deviceKeyServerSupport_exports, {
+  AUTH_SERVER_METADATA_PATH: () => AUTH_SERVER_METADATA_PATH,
+  SERVER_DEVICE_KEY_ALGS_FIELD: () => SERVER_DEVICE_KEY_ALGS_FIELD,
+  __resetServerDeviceKeyAlgsForTest: () => __resetServerDeviceKeyAlgsForTest,
+  readServerDeviceKeyAlgs: () => readServerDeviceKeyAlgs
+});
+module.exports = __toCommonJS(deviceKeyServerSupport_exports);
+var import_deviceKey = require("./deviceKey.js");
+const AUTH_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+const SERVER_DEVICE_KEY_ALGS_FIELD = "device_key_signing_alg_values_supported";
+const TIMEOUT_MS = 5e3;
+const MAX_BYTES = 64 * 1024;
+const UNKNOWN_RETRY_MS = 6e4;
+const cache = /* @__PURE__ */ new Map();
+function __resetServerDeviceKeyAlgsForTest() {
+  cache.clear();
+}
+async function readServerDeviceKeyAlgs(serverUrl, opts = {}) {
+  let origin;
+  try {
+    origin = new URL(serverUrl).origin;
+  } catch {
+    return null;
+  }
+  if (origin === "null")
+    return null;
+  const hit = cache.get(origin);
+  if (hit && (hit.algs !== null || Date.now() - hit.at < UNKNOWN_RETRY_MS))
+    return hit.algs;
+  const algs = await fetchAlgs(origin, opts);
+  cache.set(origin, { algs, at: Date.now() });
+  return algs;
+}
+async function fetchAlgs(origin, opts) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function")
+    return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${origin}${AUTH_SERVER_METADATA_PATH}`, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      // The metadata lives at the issuer. A redirect is a server we did not ask.
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (res.status !== 200)
+      return null;
+    const text = await res.text();
+    if (text.length > MAX_BYTES)
+      return null;
+    const body = JSON.parse(text);
+    const listed = body[SERVER_DEVICE_KEY_ALGS_FIELD];
+    if (!Array.isArray(listed))
+      return null;
+    const known = import_deviceKey.DEVICE_KEY_ALGS.filter((alg) => listed.includes(alg));
+    return known.length > 0 ? known : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTH_SERVER_METADATA_PATH,
+  SERVER_DEVICE_KEY_ALGS_FIELD,
+  __resetServerDeviceKeyAlgsForTest,
+  readServerDeviceKeyAlgs
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dpop.js

@@ -113,6 +113,8 @@ function verifyDpopProof(jws, opts) {
   if (!result.valid) {
     return { valid: false, reason: result.reason };
   }
+  if (result.publicJwk.kty !== "OKP")
+    return { valid: false, reason: "bad_jwk" };
   if (result.claims.jti.length === 0)
     return { valid: false, reason: "malformed" };
   if (opts.expectedAth !== void 0) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/independentMachineReservation.js

@@ -38,6 +38,7 @@ module.exports = __toCommonJS(independentMachineReservation_exports);
 var import_node_crypto = __toESM(require("node:crypto"), 1);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
+var import_liveState = require("./liveState.js");
 const INDEPENDENT_MACHINE_PROFILE_RE = /^desktop-bg-[a-f0-9]{32}$/;
 const INDEPENDENT_MACHINE_RESERVATION_FILE = "independent-machine-attempt.json";
 function canonicalOrigin(input) {
@@ -70,6 +71,7 @@ function reserveIndependentMachineProfile(options) {
     throw new Error("Background authorization secure storage is unavailable");
   }
   const profiles = import_node_path.default.join(options.root, "profiles");
+  (0, import_liveState.assertMayMutateLiveState)(profiles, "reserve a background machine profile");
   const rootExisted = import_node_fs.default.existsSync(options.root);
   const profilesExisted = import_node_fs.default.existsSync(profiles);
   import_node_fs.default.mkdirSync(profiles, { recursive: true, mode: 448 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -25,11 +25,15 @@ export { loginWithLocalhost, LoginInitError, LoginExchangeError, type BrowserOpe
 export { parseTtlDays, MIN_TTL_DAYS, MAX_TTL_DAYS, type ParseTtlResult, type ParseTtlSuccess, type ParseTtlError, } from './ttlParser.js';
 export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRecoveryCode, } from './recoveryCode.js';
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
-export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, isMasterKekKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
-export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type DaemonKeychainServiceClass, type KekStrategy, } from './kek/index.js';
+export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SERVICE_BASE, DAEMON_KEYCHAIN_SERVICE_BASE, HERMETIC_HOME_ENV, LEGACY_DAEMON_KEYCHAIN_SERVICE, LIVE_DEFAULT_PROFILE, LIVE_STATE_REFUSED_CODE, LiveStateRefusedError, accountHomeDir, assertMayMutateLiveKeychain, assertMayMutateLiveState, isLiveKeychainService, isLiveStateRefusal, isTestProcess, keychainSuffixForDir, liveKeychainServices, liveStateRoot, refusesLiveKeychainMutation, refusesLiveStateInTest, rethrowIfLiveStateRefusal, testProcessSignal, type LiveKeychainProbe, type LiveStateProbe, } from './liveState.js';
+export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyAlg, type DeviceKeyPair, type DeviceKeySigner, type DevicePublicJwk, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type P256PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { softwareEd25519Handle, type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_ALGS_FIELD, } from './deviceKeyServerSupport.js';
+export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';