@skrr-ai/cli 0.1.129 → 0.1.131

package/dist/lib/task-schedule-notes.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * What a schedule command did to the schedule, as sentences.
+ *
+ * The server already knows these things and reports them as response-only fields
+ * (`schedulePaused`, `scheduleChange`, `scheduleResume`, `scheduleElapsedWhileArchived`).
+ * The commands printed "Scheduled ..." / "Resumed ..." / "unarchived" regardless, so a
+ * person could not tell that a time was recorded but nothing was armed (OSK-21521), that
+ * a slot which fell inside their pause was skipped (OSK-21513), or that a time which
+ * passed while a Task was archived was dropped rather than run (OSK-21494).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scheduleResultLines = scheduleResultLines;
+exports.resumeResultLines = resumeResultLines;
+exports.unarchiveResultLines = unarchiveResultLines;
+exports.archiveResultLines = archiveResultLines;
+function iso(value) {
+    if (!value)
+        return null;
+    const at = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(at.getTime()) ? String(value) : at.toISOString();
+}
+/**
+ * Lines to print under `Scheduled task ...`. A paused series is told as such, with the one
+ * command that un-pauses it, because `schedule` never does.
+ */
+function scheduleResultLines(result, taskRef, bin = 'skrr') {
+    const lines = [];
+    if (result?.scheduleChange?.changed === false) {
+        lines.push('Already scheduled exactly like this; nothing changed.');
+    }
+    if (result?.schedulePaused) {
+        lines.push('The recurring series is PAUSED: this time is recorded, but nothing is armed and nothing will run.', `Resume it with \`${bin} tasks resume-schedule ${taskRef}\` (\`schedule\` never resumes a paused series).`);
+    }
+    return lines;
+}
+/** What resuming did to the slot that fell inside the pause, or nothing when none did. */
+function resumeResultLines(result) {
+    const resume = result?.scheduleResume;
+    if (!resume)
+        return [];
+    const skipped = iso(resume.skippedScheduledFor);
+    const next = iso(resume.nextRunAt);
+    return [
+        `Skipped the run that came due while paused (${skipped}); it is not replayed.`,
+        next ? `Next run: ${next}` : 'The series has no further run.',
+    ];
+}
+/** What unarchiving did to a schedule that came due while the Task was archived. */
+function unarchiveResultLines(result, taskRef, bin = 'skrr') {
+    const elapsed = result?.scheduleElapsedWhileArchived;
+    if (!elapsed)
+        return [];
+    const skipped = iso(elapsed.skippedScheduledFor);
+    const next = iso(elapsed.nextRunAt);
+    return [
+        `Its scheduled time (${skipped}) passed while it was archived, so it was skipped, not run.`,
+        next
+            ? `Next run: ${next}`
+            : `It is no longer scheduled; set a new time with \`${bin} tasks schedule ${taskRef} --at <time>\`.`,
+    ];
+}
+/** At archive time: a kept time that will not fire while archived. */
+function archiveResultLines(result) {
+    const kept = iso(result?.scheduledFor);
+    return kept
+        ? [
+            `Its scheduled time (${kept}) is kept but will not fire while archived; a time that passes meanwhile is skipped on unarchive.`,
+        ]
+        : [];
+}

package/dist/lib/triggers.d.ts

@@ -143,6 +143,16 @@ export interface TriggerDefinition {
         recordedAt?: string;
         retiredAt?: string;
     };
+    /**
+     * Server-DERIVED and only present when the list was asked for it (`?include=autonomy`), and
+     * only on a self-reflection loop: whether its scheduled fires RUN (`runs`) or stop short of
+     * running because the agent's initiative mode applies to them (`suggests_only`, with
+     * `autonomyNote` saying why). It is the verdict `triggers preflight` prints at its initiative
+     * gate. A server that predates it, or a verdict it could not reach, sends neither field, which
+     * means UNKNOWN: a reader must never take an absent `autonomy` for `runs` (OSK-21606).
+     */
+    autonomy?: 'runs' | 'suggests_only';
+    autonomyNote?: string;
     createdAt?: string;
     updatedAt?: string;
 }
@@ -457,6 +467,14 @@ export declare function scopeLabel(trigger: TriggerDefinition): string;
  * `triggers show` said `Armed: yes` with no time (OSK-15416).
  */
 export declare function onceDueAt(trigger: TriggerDefinition): string | null;
+/**
+ * When a trigger WILL fire next: its scheduled time, and only while it is enabled. A disabled
+ * trigger keeps the `schedule.nextRunAt` it had when it was paused, and nothing will ever run
+ * at that time — `agents reflect` and `agents schedule-overview` printed it as the next run of
+ * a paused loop while `agents upcoming` correctly listed nothing (OSK-21605). Null when
+ * nothing is scheduled; never the last fire.
+ */
+export declare function scheduledRunAt(trigger: TriggerDefinition): string | null;
 export declare function nextRunLabel(trigger: TriggerDefinition): string;
 /**
  * Whether a trigger will actually fire — not merely whether someone left it on.

package/dist/lib/triggers.js

@@ -39,6 +39,7 @@ exports.agentRefEntity = agentRefEntity;
 exports.fetchAgentScopedTrigger = fetchAgentScopedTrigger;
 exports.scopeLabel = scopeLabel;
 exports.onceDueAt = onceDueAt;
+exports.scheduledRunAt = scheduledRunAt;
 exports.nextRunLabel = nextRunLabel;
 exports.armedLabel = armedLabel;
 exports.degradedMarker = degradedMarker;
@@ -1078,12 +1079,21 @@ function onceDueAt(trigger) {
     const due = once.runAt ?? once.at;
     return due ? String(due) : null;
 }
+/**
+ * When a trigger WILL fire next: its scheduled time, and only while it is enabled. A disabled
+ * trigger keeps the `schedule.nextRunAt` it had when it was paused, and nothing will ever run
+ * at that time — `agents reflect` and `agents schedule-overview` printed it as the next run of
+ * a paused loop while `agents upcoming` correctly listed nothing (OSK-21605). Null when
+ * nothing is scheduled; never the last fire.
+ */
+function scheduledRunAt(trigger) {
+    if (trigger.enabled === false)
+        return null;
+    const next = trigger.schedule?.nextRunAt ?? trigger.selfScheduled?.nextRunAt ?? onceDueAt(trigger);
+    return next ? String(next) : null;
+}
 function nextRunLabel(trigger) {
-    const next = trigger.schedule?.nextRunAt ??
-        trigger.selfScheduled?.nextRunAt ??
-        onceDueAt(trigger) ??
-        trigger.audit?.lastFiredAt ??
-        '';
+    const next = scheduledRunAt(trigger) ?? trigger.audit?.lastFiredAt ?? '';
     return next ? String(next) : '-';
 }
 /**
@@ -1438,7 +1448,7 @@ function renderTriggerSummary(trigger, log, options = {}) {
     const next = nextRunLabel(trigger);
     if (next !== '-') {
         // `nextRunLabel` falls back to the last fire when nothing is scheduled; say which it is.
-        const upcoming = Boolean(trigger.schedule?.nextRunAt ?? trigger.selfScheduled?.nextRunAt ?? onceDueAt(trigger));
+        const upcoming = Boolean(scheduledRunAt(trigger));
         log(`${upcoming ? 'Next run:' : 'Last run:'}${next.length > 0 ? ` ${next}` : ''}`);
     }
     /*

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -1,5 +1,6 @@
 import { type DeviceKeyAlg, type DevicePublicJwk } from './deviceKey.js';
 import { type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+import { type ExecutorStopReceipt, type ExecutorStopReceiptBody } from './executorStopReceipt.js';
 import { type HardwareKeyCapability, type HardwareKeyRecord } from './deviceKeyHardware.js';
 /**
  * The `cred_envelope.read.decrypt_failed` hint for the device PRIVATE key
@@ -235,6 +236,14 @@ export declare function signServerRequest(opts: {
     refreshToken?: string;
     accessToken?: string;
 }): Promise<string | null>;
+/**
+ * Sign an executor stop receipt (OSK-20777 Gate 1) with the device key: the signed proof that a
+ * scheduled session stopped, which the server verifies against the key pinned on this machine's row.
+ * Returns null when device identity is not active or the key cannot sign right now. NEVER throws: a
+ * failed sign emits a telemetry event and the caller sends the response without a receipt, which the
+ * server treats as an unproven stop rather than as a failure of the session.
+ */
+export declare function signExecutorStopReceiptWithDeviceKey(body: ExecutorStopReceiptBody): Promise<ExecutorStopReceipt | null>;
 /** @internal Test seams — file path resolvers. */
 export declare function __publicKeyPathForTest(profile: string): string;
 export declare function __privateKeyPathForTest(profile: string): string;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -51,6 +51,7 @@ __export(deviceIdentityBridge_exports, {
   persistPendingHardwareKey: () => persistPendingHardwareKey,
   prepareHardwareKeyCandidate: () => prepareHardwareKeyCandidate,
   resetDeviceIdentity: () => resetDeviceIdentity,
+  signExecutorStopReceiptWithDeviceKey: () => signExecutorStopReceiptWithDeviceKey,
   signServerRequest: () => signServerRequest,
   signWithCandidate: () => signWithCandidate
 });
@@ -60,6 +61,7 @@ var import_node_path = __toESM(require("node:path"), 1);
 var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_deviceKey = require("./deviceKey.js");
 var import_deviceKeyHandle = require("./deviceKeyHandle.js");
+var import_executorStopReceipt = require("./executorStopReceipt.js");
 var import_deviceKeyHardware = require("./deviceKeyHardware.js");
 var import_credentialEnvelopeBridge = require("./credentialEnvelopeBridge.js");
 var import_profileStateDir = require("./profileStateDir.js");
@@ -827,6 +829,25 @@ async function signServerRequest(opts) {
     return null;
   }
 }
+async function signExecutorStopReceiptWithDeviceKey(body) {
+  reloadIfRecovered();
+  const state = _state;
+  if (state.kind !== "active")
+    return null;
+  try {
+    return await (0, import_executorStopReceipt.signExecutorStopReceipt)(state.key, body);
+  } catch (err) {
+    emit("sign_failed", false, {
+      profile: state.profile,
+      thumbprint: state.key.thumbprint,
+      custody: state.key.custody,
+      method: "executor_stop_receipt",
+      ...err instanceof import_deviceKeyHardware.HardwareDeviceKeyError ? { hardwareFailure: err.code } : {},
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+}
 function __publicKeyPathForTest(profile) {
   return publicKeyPath(profile);
 }
@@ -1040,6 +1061,7 @@ async function enrollWithServer(opts) {
   persistPendingHardwareKey,
   prepareHardwareKeyCandidate,
   resetDeviceIdentity,
+  signExecutorStopReceiptWithDeviceKey,
   signServerRequest,
   signWithCandidate
 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -34,7 +34,7 @@ export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_A
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -316,6 +316,7 @@ __export(index_exports, {
   setMachineUuidProfile: () => import_machineUuid.setMachineUuidProfile,
   shutdownCredEnvelope: () => import_credentialEnvelopeBridge.shutdownCredEnvelope,
   signExecutorStopReceipt: () => import_executorStopReceipt.signExecutorStopReceipt,
+  signExecutorStopReceiptWithDeviceKey: () => import_deviceIdentityBridge.signExecutorStopReceiptWithDeviceKey,
   signProofWith: () => import_deviceKey.signProofWith,
   signServerRequest: () => import_deviceIdentityBridge.signServerRequest,
   signWithCandidate: () => import_deviceIdentityBridge.signWithCandidate,
@@ -686,6 +687,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   setMachineUuidProfile,
   shutdownCredEnvelope,
   signExecutorStopReceipt,
+  signExecutorStopReceiptWithDeviceKey,
   signProofWith,
   signServerRequest,
   signWithCandidate,

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -1,5 +1,6 @@
 import { type DeviceKeyAlg, type DevicePublicJwk } from './deviceKey.js';
 import { type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+import { type ExecutorStopReceipt, type ExecutorStopReceiptBody } from './executorStopReceipt.js';
 import { type HardwareKeyCapability, type HardwareKeyRecord } from './deviceKeyHardware.js';
 /**
  * The `cred_envelope.read.decrypt_failed` hint for the device PRIVATE key
@@ -235,6 +236,14 @@ export declare function signServerRequest(opts: {
     refreshToken?: string;
     accessToken?: string;
 }): Promise<string | null>;
+/**
+ * Sign an executor stop receipt (OSK-20777 Gate 1) with the device key: the signed proof that a
+ * scheduled session stopped, which the server verifies against the key pinned on this machine's row.
+ * Returns null when device identity is not active or the key cannot sign right now. NEVER throws: a
+ * failed sign emits a telemetry event and the caller sends the response without a receipt, which the
+ * server treats as an unproven stop rather than as a failure of the session.
+ */
+export declare function signExecutorStopReceiptWithDeviceKey(body: ExecutorStopReceiptBody): Promise<ExecutorStopReceipt | null>;
 /** @internal Test seams — file path resolvers. */
 export declare function __publicKeyPathForTest(profile: string): string;
 export declare function __privateKeyPathForTest(profile: string): string;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -34,6 +34,7 @@ import path from 'node:path';
 import lockfile from 'proper-lockfile';
 import { generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, signProofWith, } from './deviceKey.js';
 import { softwareEd25519Handle } from './deviceKeyHandle.js';
+import { signExecutorStopReceipt, } from './executorStopReceipt.js';
 import { createHardwareDeviceKey, hardwareDeviceKeyHandle, parseHardwareKeyRecord, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, serializeHardwareKeyRecord, HardwareDeviceKeyError, } from './deviceKeyHardware.js';
 import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, splitKeyConvergencePolicy, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
 import { consolidateProfileState, profileStateFilePathsToClear, profileStateDir, resolveProfileStateDir, RETIRED_COPY_SUFFIX, } from './profileStateDir.js';
@@ -1133,6 +1134,33 @@ export async function signServerRequest(opts) {
         return null;
     }
 }
+/**
+ * Sign an executor stop receipt (OSK-20777 Gate 1) with the device key: the signed proof that a
+ * scheduled session stopped, which the server verifies against the key pinned on this machine's row.
+ * Returns null when device identity is not active or the key cannot sign right now. NEVER throws: a
+ * failed sign emits a telemetry event and the caller sends the response without a receipt, which the
+ * server treats as an unproven stop rather than as a failure of the session.
+ */
+export async function signExecutorStopReceiptWithDeviceKey(body) {
+    reloadIfRecovered();
+    const state = _state;
+    if (state.kind !== 'active')
+        return null;
+    try {
+        return await signExecutorStopReceipt(state.key, body);
+    }
+    catch (err) {
+        emit('sign_failed', false, {
+            profile: state.profile,
+            thumbprint: state.key.thumbprint,
+            custody: state.key.custody,
+            method: 'executor_stop_receipt',
+            ...(err instanceof HardwareDeviceKeyError ? { hardwareFailure: err.code } : {}),
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+}
 /** @internal Test seams — file path resolvers. */
 export function __publicKeyPathForTest(profile) {
     return publicKeyPath(profile);

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -34,7 +34,7 @@ export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_A
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -131,7 +131,7 @@ initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, rese
 __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, } from './credentialEnvelopeBridge.js';
 export { 
 // deviceIdentity bridge
-initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, 
+initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /