@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.__setStateForTest = __setStateForTest;
 exports.__getStateForTest = __getStateForTest;
+exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
 exports.initCredEnvelope = initCredEnvelope;
 exports.resetCredEnvelope = resetCredEnvelope;
 exports.shutdownCredEnvelope = shutdownCredEnvelope;
@@ -141,7 +142,21 @@ function atomicWrite0600(target, value) {
  * The event name passed in is the FULLY-QUALIFIED `cred_envelope.*` form
  * because daemon-side telemetry consumers (`event-log.ts`, dashboards,
  * spec assertions) key off the prefixed name. Do not strip the prefix.
+ *
+ * Identical failure warnings hit the logger only once per process.
+ * Telemetry still records every occurrence — the dedupe exists because a
+ * single unreadable envelope produced the same warning once per stored
+ * field (token, refresh token, expiry…), which read to users as three
+ * crashes rather than one stale credential (OSK-12074). The signature is
+ * event + kek identity + message, so a genuinely different failure mode
+ * still gets its own line.
  */
+const warnedSignatures = new Set();
+const MAX_WARNED_SIGNATURES = 64;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+function __clearWarnDedupeForTest() {
+    warnedSignatures.clear();
+}
 function emit(eventName, success, metadata) {
     (0, runtime_js_1.emitAuthTelemetry)({
         timestamp: new Date().toISOString(),
@@ -150,7 +165,13 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        if (!warnedSignatures.has(signature)) {
+            if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
+                warnedSignatures.clear();
+            warnedSignatures.add(signature);
+            (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+        }
     }
 }
 // ---------------------------------------------------------------------------
@@ -763,6 +784,10 @@ function maybeDecryptOnRead(stored) {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,
                 message: err?.message ?? 'unknown',
+                // The crypto error alone reads as a crash; the actionable truth is
+                // that this stored credential is unreadable by THIS binary (usually
+                // a signing-identity or profile drift) and re-login rebuilds it.
+                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.d.ts

@@ -23,9 +23,14 @@
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export declare const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
@@ -89,12 +94,31 @@ export declare function mintAttestedToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): AttestedToolApproval;
+/**
+ * Why an attestation did not approve a call — logged by the daemon, never
+ * shown to the caller beyond "absent" vs "did not verify".
+ *  - `absent`    — no attestation arrived (the server did not ask anyone)
+ *  - `malformed` — not the v1 shape
+ *  - `expired`   — past `expiresAt`, or issued implausibly far in the future
+ *  - `window`    — the issuer claimed a validity window longer than
+ *                  `ATTESTED_TOOL_APPROVAL_TTL_MS` (or an empty/negative one)
+ *  - `binding`   — minted for a different call (toolUseId, tool, or input)
+ *  - `replayed`  — this exact approval was already spent on this daemon
+ *                  (the ledger is the verifier's caller's, see the daemon's
+ *                  `permissions/attestation-ledger.ts`)
+ */
+export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed';
 export type AttestedToolApprovalVerdict = {
     ok: true;
 } | {
     ok: false;
-    reason: 'absent' | 'malformed' | 'binding' | 'expired';
+    reason: AttestedToolApprovalRefusalReason;
 };
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export declare const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS: number;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ATTESTED_TOOL_APPROVAL_TTL_MS = exports.DAEMON_TOOL_CATEGORIES = exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = void 0;
+exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = exports.ATTESTED_TOOL_APPROVAL_TTL_MS = exports.DAEMON_TOOL_CATEGORIES = exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = void 0;
 exports.categoryForDaemonTool = categoryForDaemonTool;
 exports.canonicalToolInputDigest = canonicalToolInputDigest;
 exports.mintAttestedToolApproval = mintAttestedToolApproval;
@@ -31,9 +31,14 @@ const node_crypto_1 = require("node:crypto");
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
@@ -136,6 +141,11 @@ function mintAttestedToolApproval(args) {
         expiresAt: now + (args.ttlMs ?? exports.ATTESTED_TOOL_APPROVAL_TTL_MS),
     };
 }
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1000;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain
@@ -159,9 +169,17 @@ function verifyAttestedToolApproval(approval, call) {
         return { ok: false, reason: 'malformed' };
     }
     const now = call.now ?? Date.now();
-    if (a.expiresAt <= now || a.issuedAt > now + 30_000) {
+    if (a.expiresAt <= now || a.issuedAt > now + exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
         return { ok: false, reason: 'expired' };
     }
+    // The TTL is the VERIFIER's bound, not the issuer's claim (OSK-12108): an
+    // attestation whose own window is longer than one approval may stay valid
+    // is refused whatever `expiresAt` says, so "answers one person about this
+    // call, moments ago" holds even against an issuer that set a year.
+    const window = a.expiresAt - a.issuedAt;
+    if (!(window > 0) || window > exports.ATTESTED_TOOL_APPROVAL_TTL_MS) {
+        return { ok: false, reason: 'window' };
+    }
     if (a.toolUseId !== call.toolUseId ||
         a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() ||
         a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -604,11 +604,49 @@ async function enrollWithServer(opts) {
         //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
         //     token should not enroll. Guarded at the daemon call site, this is
         //     defense-in-depth for any other opaque caller.
-        //   • 409 already-enrolled — a concurrent binary won the enrollment race
-        //     for the shared keypair; idempotent, nothing to do.
+        //   • 409 ALREADY_ENROLLED with OUR thumbprint — a concurrent binary won
+        //     the enrollment race for this keypair; idempotent, nothing to do.
+        //
+        // A 409 is NOT benign when the row is pinned to a DIFFERENT key
+        // (OSK-12063). The server keeps one pin per (user, machine) row while
+        // every local profile has its own key, so a 409 can mean "every refresh
+        // this key signs will be refused with DEVICE_PROOF_THUMBPRINT_MISMATCH".
+        // The server names the pinned thumbprint (`enrolledThumbprint`) so the
+        // two cases can be told apart. An older server that omits it keeps the
+        // old reading, because there is nothing to compare. A 409
+        // ENROLLMENT_DUPLICATE_KEY — this key is pinned on another active row —
+        // is never benign either.
+        let conflictCode = null;
+        let enrolledThumbprint = null;
+        if (response.status === 409) {
+            try {
+                const parsed = JSON.parse(responseText);
+                conflictCode = typeof parsed.code === 'string' ? parsed.code : null;
+                enrolledThumbprint =
+                    typeof parsed.enrolledThumbprint === 'string' ? parsed.enrolledThumbprint : null;
+            }
+            catch {
+                /* non-JSON 409 — treat as the legacy benign race */
+            }
+        }
+        const pinnedToOtherKey = response.status === 409 &&
+            enrolledThumbprint !== null &&
+            enrolledThumbprint !== keypair.thumbprint;
+        const keyPinnedElsewhere = response.status === 409 && conflictCode === 'ENROLLMENT_DUPLICATE_KEY';
         const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
             (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
-            response.status === 409;
+            (response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere);
+        if (pinnedToOtherKey) {
+            emit('enrollment_key_mismatch', false, {
+                profile,
+                thumbprint: keypair.thumbprint,
+                enrolledThumbprint,
+                serverUrl,
+                message: 'this machine is registered with a different device key than this profile signs ' +
+                    'with; its refreshes will be refused. An interactive daemon login (skrrd login) ' +
+                    're-registers this key.',
+            }, { logLevel: 'warn' });
+        }
         if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
             try {
                 atomicWrite0600(backoffPath, JSON.stringify({

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -29,11 +29,13 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export * from './firstPartyHarness.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = void 0;
+exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -258,7 +258,16 @@ Object.defineProperty(exports, "__enrollmentMarkerPathForTest", { enumerable: tr
 Object.defineProperty(exports, "__enrollmentBackoffPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__enrollmentBackoffPathForTest; } });
 Object.defineProperty(exports, "__setDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__setStateForTest; } });
 Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__getStateForTest; } });
+// Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
+// machine-id / MachineGuid). ONE implementation for daemon and CLI —
+// OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
+var machineUuid_js_1 = require("./machineUuid.js");
+Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
+Object.defineProperty(exports, "hostedRuntimeIdOverride", { enumerable: true, get: function () { return machineUuid_js_1.hostedRuntimeIdOverride; } });
+Object.defineProperty(exports, "HOSTED_RUNTIME_MACHINE_SOURCES", { enumerable: true, get: function () { return machineUuid_js_1.HOSTED_RUNTIME_MACHINE_SOURCES; } });
+Object.defineProperty(exports, "__resetMachineUuidCacheForTest", { enumerable: true, get: function () { return machineUuid_js_1.__resetMachineUuidCacheForTest; } });
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
+// NOT a `machineUuid` — see machineUuid.ts.
 var machineId_js_1 = require("./machineId.js");
 Object.defineProperty(exports, "ensureMachineDaemonId", { enumerable: true, get: function () { return machineId_js_1.ensureMachineDaemonId; } });
 Object.defineProperty(exports, "legacyDaemonUuids", { enumerable: true, get: function () { return machineId_js_1.legacyDaemonUuids; } });
@@ -316,6 +325,19 @@ Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
+Object.defineProperty(exports, "LOOPBACK_NO_PROXY_HOSTS", { enumerable: true, get: function () { return spawnEnv_js_1.LOOPBACK_NO_PROXY_HOSTS; } });
+Object.defineProperty(exports, "envHasProxy", { enumerable: true, get: function () { return spawnEnv_js_1.envHasProxy; } });
+Object.defineProperty(exports, "withLoopbackNoProxy", { enumerable: true, get: function () { return spawnEnv_js_1.withLoopbackNoProxy; } });
+// OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
+// Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
+// credentials and all; every loopback caller goes through this instead.
+var loopbackHttp_js_1 = require("./loopbackHttp.js");
+Object.defineProperty(exports, "loopbackFetch", { enumerable: true, get: function () { return loopbackHttp_js_1.loopbackFetch; } });
+Object.defineProperty(exports, "assertLoopbackHttpUrl", { enumerable: true, get: function () { return loopbackHttp_js_1.assertLoopbackHttpUrl; } });
+Object.defineProperty(exports, "isLoopbackHostname", { enumerable: true, get: function () { return loopbackHttp_js_1.isLoopbackHostname; } });
+Object.defineProperty(exports, "isLoopbackAddress", { enumerable: true, get: function () { return loopbackHttp_js_1.isLoopbackAddress; } });
+Object.defineProperty(exports, "LoopbackTargetRefusedError", { enumerable: true, get: function () { return loopbackHttp_js_1.LoopbackTargetRefusedError; } });
+Object.defineProperty(exports, "LOOPBACK_DEFAULT_MAX_BODY_BYTES", { enumerable: true, get: function () { return loopbackHttp_js_1.LOOPBACK_DEFAULT_MAX_BODY_BYTES; } });
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 var localIdentity_js_1 = require("./localIdentity.js");

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loopbackHttp.d.ts

@@ -0,0 +1,32 @@
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+export declare const LOOPBACK_DEFAULT_MAX_BODY_BYTES: number;
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+export declare class LoopbackTargetRefusedError extends Error {
+    readonly code = "LOOPBACK_TARGET_REFUSED";
+    constructor(message: string);
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+export declare function isLoopbackAddress(address: string): boolean;
+/** True for a host name or address this client accepts as "this machine". */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+export declare function assertLoopbackHttpUrl(input: string | URL): URL;
+/**
+ * `RequestInit`, so a `fetch` call site can switch to {@link loopbackFetch}
+ * unchanged. Only `method`, `headers`, `signal` and a string/bytes `body` are
+ * honoured; a stream, Blob or FormData body is rejected rather than guessed at.
+ */
+export interface LoopbackFetchInit extends RequestInit {
+    /** Cap on the buffered response body; exceeding it rejects. */
+    maxBodyBytes?: number;
+}
+/** A `fetch`-shaped signature, for callers that keep a `fetchImpl` seam. */
+export type LoopbackFetch = (input: string | URL, init?: LoopbackFetchInit) => Promise<Response>;
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+export declare const loopbackFetch: LoopbackFetch;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loopbackHttp.js

@@ -0,0 +1,268 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loopbackFetch = exports.LoopbackTargetRefusedError = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = void 0;
+exports.isLoopbackAddress = isLoopbackAddress;
+exports.isLoopbackHostname = isLoopbackHostname;
+exports.assertLoopbackHttpUrl = assertLoopbackHttpUrl;
+/**
+ * OSK-12134 — the ONE HTTP client for talking to a process on this machine.
+ *
+ * ── Why this is not `fetch` ────────────────────────────────────────────────
+ *
+ * The compiled daemon runs on Bun, and Bun's `fetch` routes EVERY URL through
+ * `HTTP_PROXY` / `HTTPS_PROXY` unless `NO_PROXY` names it — a `127.0.0.1`
+ * target included. Node's `fetch` does the same once `NODE_USE_ENV_PROXY=1` is
+ * set (Node 22.21+/24). On a laptop with a local proxy exported in the shell
+ * (Clash, Surge, a corporate agent, …) every loopback call the daemon, a
+ * wrapper, or the CLI made with `fetch` was delivered to that proxy instead —
+ * WITH its credential: the daemon's local secret, the CLI-handoff descriptor
+ * secret, the wrapper fan-out bearer, the browser bridge token, the extension
+ * relay token. OSK-12087 found this on the `/health` probe and moved that one
+ * caller to `node:http`; this module is that fix made the only way to do it.
+ *
+ * `node:http` never consults proxy environment variables, on Node or on Bun, so
+ * a request made through it cannot be routed off the machine by environment.
+ *
+ * ── What it refuses ────────────────────────────────────────────────────────
+ *
+ * Only `http:` URLs whose host is a loopback name or address are accepted
+ * (`127.0.0.0/8`, `::1`, `localhost`). Anything else throws BEFORE a socket is
+ * opened: a caller that builds its URL from a descriptor or an environment
+ * variable must not be turned into an SSRF primitive by a hostile value, and a
+ * credential that is only meant for this machine must not be sent anywhere
+ * else. `localhost` is resolved through a lookup that rejects any non-loopback
+ * answer, so a rewritten hosts file cannot redirect it either.
+ *
+ * ── Shape ──────────────────────────────────────────────────────────────────
+ *
+ * `loopbackFetch` is a drop-in for the subset of `fetch` these callers use —
+ * method, headers, a string/bytes body, an `AbortSignal` — and returns a real
+ * `Response`, so existing callers (and their `fetchImpl` test seams) change one
+ * identifier. Transport failures reject with `TypeError('fetch failed')` whose
+ * `cause` carries the socket error (`ECONNREFUSED`, …), and aborts reject with
+ * the signal's reason, exactly as `fetch` does, so existing error handling keeps
+ * working. The response body is buffered (bounded by `maxBodyBytes`); nothing
+ * on loopback streams through this client.
+ */
+const node_dns_1 = __importDefault(require("node:dns"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_net_1 = __importDefault(require("node:net"));
+/** Loopback host names this client will connect to, besides 127/8 and ::1 literals. */
+const LOOPBACK_NAMES = new Set(['localhost']);
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
+/** Statuses a `Response` must be constructed with a null body for. */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+class LoopbackTargetRefusedError extends Error {
+    code = 'LOOPBACK_TARGET_REFUSED';
+    constructor(message) {
+        super(message);
+        this.name = 'LoopbackTargetRefusedError';
+    }
+}
+exports.LoopbackTargetRefusedError = LoopbackTargetRefusedError;
+function stripBrackets(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+function isLoopbackAddress(address) {
+    const value = stripBrackets(address.trim().toLowerCase());
+    if (node_net_1.default.isIPv4(value))
+        return value.split('.')[0] === '127';
+    if (node_net_1.default.isIPv6(value)) {
+        if (value === '::1' || value === '0:0:0:0:0:0:0:1')
+            return true;
+        // IPv4-mapped (::ffff:127.0.0.1, which WHATWG URL normalizes to ::ffff:7f00:1).
+        if (value.startsWith('::ffff:')) {
+            const rest = value.slice('::ffff:'.length);
+            if (node_net_1.default.isIPv4(rest))
+                return isLoopbackAddress(rest);
+            const high = /^([0-9a-f]{1,4}):[0-9a-f]{1,4}$/.exec(rest);
+            return high ? parseInt(high[1], 16) >> 8 === 127 : false;
+        }
+        return false;
+    }
+    return false;
+}
+/** True for a host name or address this client accepts as "this machine". */
+function isLoopbackHostname(hostname) {
+    const value = stripBrackets(hostname.trim().toLowerCase());
+    return LOOPBACK_NAMES.has(value) || isLoopbackAddress(value);
+}
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+function assertLoopbackHttpUrl(input) {
+    let url;
+    try {
+        url = new URL(String(input));
+    }
+    catch {
+        throw new LoopbackTargetRefusedError('Loopback request refused: not a valid URL.');
+    }
+    if (url.protocol !== 'http:') {
+        throw new LoopbackTargetRefusedError(`Loopback request refused: only http: is allowed on loopback (got ${url.protocol}).`);
+    }
+    if (!isLoopbackHostname(url.hostname)) {
+        throw new LoopbackTargetRefusedError(`Loopback request refused: ${url.hostname} is not a loopback host.`);
+    }
+    if (url.username || url.password) {
+        throw new LoopbackTargetRefusedError('Loopback request refused: URL must not carry userinfo.');
+    }
+    return url;
+}
+/** A `dns.lookup` that only ever answers with a loopback address. */
+const loopbackOnlyLookup = (hostname, options, callback) => {
+    node_dns_1.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, '', 0);
+            return;
+        }
+        const list = (Array.isArray(addresses) ? addresses : []);
+        const loopback = list.filter((entry) => isLoopbackAddress(entry.address));
+        if (loopback.length === 0) {
+            const refused = Object.assign(new Error(`${hostname} did not resolve to a loopback address`), { code: 'LOOPBACK_TARGET_REFUSED' });
+            callback(refused, '', 0);
+            return;
+        }
+        if (options?.all) {
+            callback(null, loopback);
+            return;
+        }
+        callback(null, loopback[0].address, loopback[0].family);
+    });
+};
+function abortReason(signal) {
+    return signal.reason !== undefined
+        ? signal.reason
+        : new DOMException('This operation was aborted', 'AbortError');
+}
+function fetchFailed(cause) {
+    return new TypeError('fetch failed', { cause });
+}
+function toBodyBuffer(body) {
+    if (body === undefined || body === null)
+        return null;
+    if (typeof body === 'string')
+        return Buffer.from(body, 'utf8');
+    if (body instanceof ArrayBuffer)
+        return Buffer.from(body);
+    if (ArrayBuffer.isView(body))
+        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    throw new TypeError('loopbackFetch supports only string or byte bodies');
+}
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+const loopbackFetch = (input, init = {}) => {
+    let url;
+    let payload;
+    try {
+        url = assertLoopbackHttpUrl(input);
+        payload = toBodyBuffer(init.body);
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+    const signal = init.signal ?? undefined;
+    if (signal?.aborted)
+        return Promise.reject(abortReason(signal));
+    const maxBodyBytes = init.maxBodyBytes ?? exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES;
+    const method = (init.method ?? 'GET').toUpperCase();
+    const headers = {};
+    new Headers(init.headers ?? undefined).forEach((value, name) => {
+        headers[name] = value;
+    });
+    if (payload && headers['content-length'] === undefined) {
+        headers['content-length'] = String(payload.length);
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let req;
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            req?.destroy();
+            reject(abortReason(signal));
+        };
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener('abort', onAbort);
+            fn();
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        try {
+            req = node_http_1.default.request({
+                protocol: 'http:',
+                host: stripBrackets(url.hostname),
+                port: url.port ? Number(url.port) : 80,
+                path: `${url.pathname}${url.search}`,
+                method,
+                headers,
+                // No pooled agent: a short-lived command must be able to exit as soon
+                // as it has its answer, and no socket outlives its request.
+                agent: false,
+                lookup: loopbackOnlyLookup,
+            }, (res) => {
+                const chunks = [];
+                let size = 0;
+                res.on('data', (chunk) => {
+                    size += chunk.length;
+                    if (size > maxBodyBytes) {
+                        res.destroy();
+                        finish(() => reject(fetchFailed(new Error(`response larger than ${maxBodyBytes} bytes`))));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on('error', (err) => finish(() => reject(fetchFailed(err))));
+                res.on('aborted', () => finish(() => reject(fetchFailed(new Error('response aborted')))));
+                res.on('end', () => {
+                    finish(() => {
+                        const status = res.statusCode ?? 0;
+                        const responseHeaders = new Headers();
+                        for (const [name, value] of Object.entries(res.headers)) {
+                            if (value === undefined)
+                                continue;
+                            if (Array.isArray(value)) {
+                                for (const v of value)
+                                    responseHeaders.append(name, v);
+                            }
+                            else {
+                                responseHeaders.set(name, String(value));
+                            }
+                        }
+                        const body = NULL_BODY_STATUSES.has(status) ? null : Buffer.concat(chunks);
+                        try {
+                            resolve(new Response(body, {
+                                status,
+                                statusText: res.statusMessage ?? '',
+                                headers: responseHeaders,
+                            }));
+                        }
+                        catch (err) {
+                            reject(fetchFailed(err));
+                        }
+                    });
+                });
+            });
+            req.on('error', (err) => finish(() => reject(fetchFailed(err))));
+            if (payload)
+                req.write(payload);
+            req.end();
+        }
+        catch (err) {
+            finish(() => reject(fetchFailed(err)));
+        }
+    });
+};
+exports.loopbackFetch = loopbackFetch;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineId.d.ts

@@ -10,8 +10,8 @@
  * with a real UUIDv7 downstream.
  *
  * The caller may pass `machineUuidFallback` to override the default
- * hostname+platform fingerprint with a richer detector (e.g. the
- * daemon's `getMachineUuid()` from `registry.ts`).
+ * hostname+platform fingerprint with a richer detector (e.g.
+ * `getMachineUuid()` from `machineUuid.ts`).
  */
 export declare function ensureMachineDaemonId(machineUuidFallback?: () => string): string;
 /**