@skrr-ai/cli 0.1.128 → 0.1.130

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/executorStopReceipt.js

@@ -0,0 +1,173 @@
+/**
+ * executorStopReceipt.ts — a daemon-signed proof that a scheduled session stopped.
+ *
+ * OSK-20777, Gate 1 (docs/architecture/scheduled-publication-custody-enrollment-2026-11-01.md).
+ * Today the executor's terminal proof is the daemon reporting about itself over its own socket: the
+ * dispatch tuple is checked for consistency but nothing is signed, nothing covers descendant
+ * processes, and nothing says what was erased. A receipt is that report, signed with the device key
+ * the server already pins on the daemon's row, so a settlement that depends on it depends on the
+ * machine and not on whoever reached the socket.
+ *
+ * No new cryptography. A receipt is a DPoP-shaped device proof (`deviceKey.ts`) under its OWN header
+ * `typ`, so the two can never stand in for each other: a request proof fails here with `bad_typ`, and a
+ * receipt fails the request verifier the same way. The proof's `ath` commits to the SHA-256 of the
+ * canonical receipt body, its `htu` names the dispatch, and the pin decides which key may sign it.
+ *
+ * Verification is deliberately strict and returns a reason, never a boolean:
+ *   - a pin is REQUIRED (a receipt with no key to compare against has no authority);
+ *   - the algorithm admitted is the algorithm of the pin, never a list, so a receipt cannot choose a
+ *     weaker algorithm than the device enrolled with;
+ *   - the body is a closed shape with bounded fields;
+ *   - every field the caller expects (the dispatch the server issued) must match exactly;
+ *   - a descendant that survived is `not_quiescent`, not a valid receipt with a footnote;
+ *   - erasure is claimed only for the one scope the owner allowed, `session_temp`.
+ *
+ * Freshness is the caller's decision (`maxAgeSeconds`). A receipt can legitimately arrive hours after it
+ * was signed, replayed from the daemon's response WAL after a reconnect, so it has no short window of its
+ * own. Replay protection is the dispatch binding: the server accepts one receipt per `dispatchId`.
+ */
+import { algForJwk, isDevicePublicJwk, jwkThumbprint, signProofWith, tokenHash, verifyDevicePublicKeyProof, } from './deviceKey.js';
+/** Header `typ` of an executor stop receipt. Distinct from `DEVICE_PROOF_TYP` on purpose. */
+export const EXECUTOR_STOP_RECEIPT_TYP = 'skrr-executor-stop-receipt+jwt';
+/** What the daemon may claim to have erased. One scope, decided by the owner (2026-11-01). */
+export const EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES = ['session_temp'];
+/** Default ceiling on a receipt's age, for a caller that does not decide: one day. */
+export const EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS = 24 * 60 * 60;
+const MAX_ID_LENGTH = 160;
+const BODY_KEYS = [
+    'version',
+    'daemonId',
+    'sourceId',
+    'sessionId',
+    'requestId',
+    'dispatchId',
+    'status',
+    'stoppedAt',
+    'descendants',
+    'erasure',
+];
+const BINDING_KEYS = ['daemonId', 'sourceId', 'sessionId', 'requestId', 'dispatchId'];
+const isPlainObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const hasExactKeys = (value, keys) => Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+const isId = (value) => typeof value === 'string' && value.length > 0 && value.length <= MAX_ID_LENGTH;
+const isCount = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+/**
+ * Stable JSON: object keys sorted at every level, no whitespace. The signer and the verifier must
+ * produce the same bytes from the same body, whatever order a transport reordered its keys into.
+ */
+export function canonicalReceiptJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalReceiptJson).join(',')}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonicalReceiptJson(record[key])}`)
+        .join(',')}}`;
+}
+/** The URI a receipt's proof names. Reserved `.invalid` host: it can never be a real request target. */
+export function executorStopReceiptHtu(dispatchId) {
+    return `https://executor-stop-receipt.skrr.invalid/v1/${encodeURIComponent(dispatchId)}`;
+}
+/** Shape check only. Returns the body as typed, or null when it is not exactly a v1 receipt body. */
+export function parseExecutorStopReceiptBody(value) {
+    if (!isPlainObject(value) || !hasExactKeys(value, BODY_KEYS) || value.version !== 1)
+        return null;
+    if (!BINDING_KEYS.every((key) => isId(value[key])))
+        return null;
+    if (value.status !== 'completed' && value.status !== 'failed' && value.status !== 'cancelled')
+        return null;
+    if (typeof value.stoppedAt !== 'string' || Number.isNaN(Date.parse(value.stoppedAt)))
+        return null;
+    const d = value.descendants;
+    if (!isPlainObject(d) || !hasExactKeys(d, ['observed', 'stopped', 'survivors']))
+        return null;
+    if (!isCount(d.observed) || !isCount(d.stopped) || !isCount(d.survivors))
+        return null;
+    if (d.observed !== d.stopped + d.survivors)
+        return null;
+    const e = value.erasure;
+    if (!isPlainObject(e))
+        return null;
+    if (e.performed === false) {
+        if (!hasExactKeys(e, ['performed']))
+            return null;
+    }
+    else if (e.performed === true) {
+        if (!hasExactKeys(e, ['performed', 'scope', 'artifacts', 'bytes']))
+            return null;
+        if (!EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES.includes(e.scope))
+            return null;
+        if (!isCount(e.artifacts) || !isCount(e.bytes))
+            return null;
+    }
+    else {
+        return null;
+    }
+    return value;
+}
+/**
+ * Sign a receipt with any `DeviceKeySigner` (a software key, or a hardware handle). Throws on a body
+ * that is not exactly a v1 receipt body, so a daemon bug cannot produce a signed receipt the server
+ * would only reject later.
+ */
+export async function signExecutorStopReceipt(signer, body, options = {}) {
+    const parsed = parseExecutorStopReceiptBody(body);
+    if (!parsed)
+        throw new Error('signExecutorStopReceipt: body is not a v1 executor stop receipt body');
+    const proof = await signProofWith(signer, {
+        method: 'POST',
+        url: executorStopReceiptHtu(parsed.dispatchId),
+        // `accessToken` is hashed inline into the `ath` claim: the commitment to the body.
+        accessToken: canonicalReceiptJson(parsed),
+        ...(options.iat !== undefined ? { iat: options.iat } : {}),
+        ...(options.jti !== undefined ? { jti: options.jti } : {}),
+    }, EXECUTOR_STOP_RECEIPT_TYP);
+    return { body: parsed, proof };
+}
+/**
+ * Verify a receipt against the pinned key. Order matters: shape, then signature and pin, then the
+ * binding to the dispatch, then what the body claims. A forged receipt is reported as the forgery it
+ * is (`sig_invalid`, `pin_mismatch`, `ath_mismatch`), not as a quiescence failure.
+ */
+export function verifyExecutorStopReceipt(receipt, options) {
+    if (!isPlainObject(receipt) || !hasExactKeys(receipt, ['body', 'proof'])) {
+        return { valid: false, reason: 'bad_receipt' };
+    }
+    const body = parseExecutorStopReceiptBody(receipt.body);
+    if (!body || typeof receipt.proof !== 'string')
+        return { valid: false, reason: 'bad_receipt' };
+    const pin = options.pinnedPublicJwk;
+    if (!pin || !isDevicePublicJwk(pin))
+        return { valid: false, reason: 'no_pin' };
+    const result = verifyDevicePublicKeyProof(receipt.proof, {
+        expectedHtm: 'POST',
+        expectedHtu: executorStopReceiptHtu(body.dispatchId),
+        expectedAth: tokenHash(canonicalReceiptJson(body)),
+        pinnedPublicJwk: pin,
+        // The algorithm of the PIN, never a list: a receipt cannot pick a weaker one.
+        allowedAlgs: [algForJwk(pin)],
+        maxAgeSeconds: options.maxAgeSeconds ?? EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+        ...(options.clockSkewSeconds !== undefined
+            ? { clockSkewSeconds: options.clockSkewSeconds }
+            : {}),
+        ...(options.now !== undefined ? { now: options.now } : {}),
+    }, EXECUTOR_STOP_RECEIPT_TYP);
+    if (!result.valid)
+        return { valid: false, reason: result.reason };
+    for (const key of BINDING_KEYS) {
+        const want = options.expected?.[key];
+        if (want !== undefined && body[key] !== want)
+            return { valid: false, reason: 'binding_mismatch' };
+    }
+    if (body.descendants.survivors > 0)
+        return { valid: false, reason: 'not_quiescent' };
+    return {
+        valid: true,
+        body,
+        alg: result.alg,
+        thumbprint: jwkThumbprint(result.publicJwk),
+        signedAtSeconds: result.claims.iat,
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -28,12 +28,13 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type DaemonKeychainServiceClass, type KekStrategy, } from './kek/index.js';
 export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SERVICE_BASE, DAEMON_KEYCHAIN_SERVICE_BASE, HERMETIC_HOME_ENV, LEGACY_DAEMON_KEYCHAIN_SERVICE, LIVE_DEFAULT_PROFILE, LIVE_STATE_REFUSED_CODE, LiveStateRefusedError, accountHomeDir, assertMayMutateLiveKeychain, assertMayMutateLiveState, isLiveKeychainService, isLiveStateRefusal, isTestProcess, keychainSuffixForDir, liveKeychainServices, liveStateRoot, refusesLiveKeychainMutation, refusesLiveStateInTest, rethrowIfLiveStateRefusal, testProcessSignal, type LiveKeychainProbe, type LiveStateProbe, } from './liveState.js';
 export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyAlg, type DeviceKeyPair, type DeviceKeySigner, type DevicePublicJwk, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type P256PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { canonicalReceiptJson, EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS, EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES, EXECUTOR_STOP_RECEIPT_TYP, executorStopReceiptHtu, parseExecutorStopReceiptBody, signExecutorStopReceipt, verifyExecutorStopReceipt, type ExecutorStopReceipt, type ExecutorStopReceiptBody, type ExecutorStopReceiptErasureScope, type ExecutorStopReceiptFailureReason, type ExecutorStopReceiptStatus, type SignExecutorStopReceiptOptions, type VerifyExecutorStopReceiptOptions, type VerifyExecutorStopReceiptResult, } from './executorStopReceipt.js';
 export { softwareEd25519Handle, type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
 export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_ALGS_FIELD, } from './deviceKeyServerSupport.js';
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -109,6 +109,8 @@ export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SER
 // persistence + signing lives in `daemon/src/deviceIdentity.ts`.
 // Server-side verification middleware is a later PR.
 export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, } from './deviceKey.js';
+// OSK-20777 Gate 1 — a daemon-signed proof that a scheduled session stopped, under its own proof `typ`.
+export { canonicalReceiptJson, EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS, EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES, EXECUTOR_STOP_RECEIPT_TYP, executorStopReceiptHtu, parseExecutorStopReceiptBody, signExecutorStopReceipt, verifyExecutorStopReceipt, } from './executorStopReceipt.js';
 // The handle every signing site holds instead of a private key, and the
 // hardware-bound backend behind it (docs/architecture/device-key-custody-2026-10-29.md).
 export { softwareEd25519Handle } from './deviceKeyHandle.js';
@@ -129,7 +131,7 @@ initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, rese
 __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, } from './credentialEnvelopeBridge.js';
 export { 
 // deviceIdentity bridge
-initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, 
+initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.33",
+  "version": "0.4.34",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {