@skrr-ai/cli 0.1.79 → 0.1.80

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialSession.js

@@ -14,6 +14,20 @@
  * Deliberately thin: no persistence, no retry policy, no logging. Callers
  * own their store and their error surfaces; this owns the cache/single-
  * flight/invalidate invariants so they cannot drift between surfaces.
+ *
+ * Two policies are options because mechanisms genuinely need different ones,
+ * and both default to the original behaviour:
+ *
+ *   - `forcedAcquire: 'join'` — a forced acquire joins whatever is in flight,
+ *     for a mechanism where a second concurrent renewal is itself the hazard
+ *     (a refresh-family rotation or a family mint);
+ *   - `classifyAcquireError` — stale-on-degrade: a TRANSIENT failure serves the
+ *     still-unexpired cached credential instead of failing, a PERMANENT one
+ *     drops it.
+ *
+ * Mechanism-specific limits — how often a new family may be minted, which
+ * failures retire it — stay in the mechanism. The daemon's task token broker
+ * (`daemon/src/task/token-broker.ts`) is the consumer that uses both options.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCredentialSession = createCredentialSession;
@@ -21,6 +35,8 @@ const DEFAULT_SKEW_MS = 30_000;
 function createCredentialSession(opts) {
     const skewMs = opts.skewMs ?? DEFAULT_SKEW_MS;
     const now = opts.now ?? Date.now;
+    const forcedJoins = opts.forcedAcquire === 'join';
+    const classify = opts.classifyAcquireError;
     let cached = null;
     let inFlight = null;
     let inFlightForced = false;
@@ -29,17 +45,26 @@ function createCredentialSession(opts) {
     // result back over the newer one.
     let generation = 0;
     const fresh = (t) => t.expiresAtMs == null || now() < t.expiresAtMs - skewMs;
+    /** Not yet actually expired — the bar for serving a stale credential. */
+    const unexpired = (t) => t.expiresAtMs == null || now() < t.expiresAtMs;
     const acquireShared = (force) => {
-        // A forced acquire must not join a non-forced in-flight one — that would
-        // serve the very credential a 401 just invalidated. A forced in-flight
-        // DOES satisfy non-forced waiters: it is already renewing.
-        if (inFlight && (inFlightForced || !force))
+        // Under 'supersede', a forced acquire must not join a non-forced in-flight
+        // one — that would serve the very credential a 401 just invalidated. A
+        // forced in-flight DOES satisfy non-forced waiters: it is already renewing.
+        // Under 'join', everything joins (see `forcedAcquire`).
+        if (inFlight && (forcedJoins || inFlightForced || !force))
             return inFlight;
         const gen = ++generation;
         const p = opts.acquire(force).then((t) => {
             if (gen === generation)
                 cached = t;
             return t;
+        }, (err) => {
+            // Settled before any waiter resumes, so a waiter's stale check below
+            // already sees a permanent failure's dropped cache.
+            if (gen === generation && classify?.(err) === 'permanent')
+                cached = null;
+            throw err;
         });
         inFlight = p;
         inFlightForced = force;
@@ -54,13 +79,26 @@ function createCredentialSession(opts) {
         p.then(cleanup, cleanup);
         return p;
     };
+    const getCredential = async (forceRefresh = false) => {
+        if (forceRefresh)
+            cached = null;
+        if (cached && fresh(cached))
+            return cached;
+        try {
+            return await acquireShared(forceRefresh);
+        }
+        catch (err) {
+            // Stale-on-degrade: read `cached` AFTER the failure, so an invalidate()
+            // or a forced discard that happened meanwhile is honoured.
+            if (classify?.(err) === 'transient' && cached && unexpired(cached))
+                return cached;
+            throw err;
+        }
+    };
     return {
+        getCredential,
         async getToken(forceRefresh = false) {
-            if (forceRefresh)
-                cached = null;
-            if (cached && fresh(cached))
-                return cached.accessToken;
-            return (await acquireShared(forceRefresh)).accessToken;
+            return (await getCredential(forceRefresh)).accessToken;
         },
         invalidate() {
             cached = null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKey.d.ts

@@ -1,3 +1,40 @@
+/**
+ * deviceKey.ts — L11 Phase 1: Ed25519 device identity + DPoP-style proofs.
+ *
+ * The load-bearing recommendation in `docs/daemon-auth-cc-deep-comparison-
+ * 2026-04-24.md` §L11. Two-axis identity:
+ *
+ *   user identity  = OAuth refresh token  (server-rotated, scope-pinned, reuse-detected)
+ *   device identity = Ed25519 keypair      (device-generated, server-revocable)
+ *
+ * Every daemon→server request carries a JWS signature over
+ * `{htm, htu, iat, jti, rth?, ath?}` using the device key. Server validates
+ * against the public key registered for this daemon.
+ *
+ * Stolen credentials require BOTH halves:
+ *   - refresh token alone is useless without the device key
+ *   - device key alone is useless without the refresh token
+ *
+ * Why DPoP-shaped (RFC 9449) rather than rolling our own JWS:
+ *   - The htm/htu/iat/jti/ath claim set is well-studied. Server-side
+ *     replay defenses, clock-skew handling, and audit-trail formats all
+ *     have a body of prior art to copy from.
+ *   - Future interop: if we ever expose OverSky as a third-party OAuth
+ *     resource server, DPoP-bearer is the way clients will already
+ *     understand.
+ *
+ * Why we extend with `rth` (refresh-token-hash):
+ *   - RFC 9449 only mints `ath` (access-token-hash). The whole point of
+ *     L11 is to bind the *refresh* token to the device, so the proof
+ *     accompanying a refresh request must commit to the refresh token.
+ *     `rth` is structurally identical to `ath`; the name disambiguates.
+ *
+ * What this module is NOT responsible for:
+ *   - Persistence (lives in `daemon/src/deviceIdentity.ts`).
+ *   - Server-side public-key registration (separate API in a later PR).
+ *   - Wire-up to the daemon's outgoing HTTP path (Phase 2 of L11).
+ */
+import crypto from 'node:crypto';
 /**
  * Ed25519 JSON Web Key — RFC 8037 §2 ("Key Type 'OKP'").
  *
@@ -123,6 +160,18 @@ export interface BuildProofOptions {
  * not a silent fallback.
  */
 export declare function buildProof(privateJwk: Ed25519PrivateJwk, publicJwk: Ed25519PublicJwk, opts: BuildProofOptions): string;
+/** The header `typ` of an OverSky device-identity proof. */
+export declare const DEVICE_PROOF_TYP = "oversky-dpop+jwt";
+/**
+ * Sign a DPoP-shaped proof with an Ed25519 key under the given header `typ`.
+ *
+ * @internal Shared by the device-identity proof (`oversky-dpop+jwt`, above)
+ * and the RFC 9449 access-token proof (`dpop+jwt`, `dpop.ts`). `typ` is the
+ * only thing on the wire that separates the two protocols, which is why it is
+ * a required argument rather than a default: a proof signed for one must
+ * never verify as the other.
+ */
+export declare function signEd25519Proof(privateKey: crypto.KeyObject, publicJwk: Ed25519PublicJwk, typ: string, opts: BuildProofOptions): string;
 export type VerifyFailureReason = 'malformed' | 'bad_alg' | 'bad_typ' | 'bad_jwk' | 'sig_invalid' | 'iat_old' | 'iat_future' | 'htm_mismatch' | 'htu_mismatch' | 'rth_mismatch' | 'ath_mismatch' | 'pin_mismatch';
 export interface VerifySuccess {
     valid: true;
@@ -165,3 +214,10 @@ export interface VerifyOptions {
  * `sig_invalid` to keep the failure surface narrow.
  */
 export declare function verifyProof(jws: string, opts?: VerifyOptions): VerifySuccess | VerifyFailure;
+/**
+ * Verify a DPoP-shaped Ed25519 proof whose header `typ` must equal `typ`.
+ *
+ * @internal See `signEd25519Proof`. `verifyProof` (device identity) and
+ * `verifyDpopProof` (`dpop.ts`, RFC 9449) are the two public doors.
+ */
+export declare function verifyEd25519Proof(jws: string, opts: VerifyOptions, typ: string): VerifySuccess | VerifyFailure;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceKey.js

@@ -3,13 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_PROOF_TYP = void 0;
 exports.generateDeviceKeyPair = generateDeviceKeyPair;
 exports.jwkThumbprint = jwkThumbprint;
 exports.publicJwkFromX = publicJwkFromX;
 exports.tokenHash = tokenHash;
 exports.normalizeHtu = normalizeHtu;
 exports.buildProof = buildProof;
+exports.signEd25519Proof = signEd25519Proof;
 exports.verifyProof = verifyProof;
+exports.verifyEd25519Proof = verifyEd25519Proof;
 /**
  * deviceKey.ts — L11 Phase 1: Ed25519 device identity + DPoP-style proofs.
  *
@@ -164,17 +167,40 @@ function normalizeHtu(url) {
  * not a silent fallback.
  */
 function buildProof(privateJwk, publicJwk, opts) {
+    if (publicJwk.x !== privateJwk.x) {
+        // Defensive — public and private must come from the same keypair.
+        // A mismatch indicates a corrupted in-memory state.
+        throw new Error('buildProof: public/private JWK x mismatch (corrupted keypair)');
+    }
+    // Cast to crypto's `JsonWebKey` shape — that type requires an index
+    // signature for arbitrary string keys; our narrow OKP shape doesn't
+    // declare one because the strict shape is more useful at our API
+    // boundary. Cast through `unknown` to silence the structural mismatch
+    // without losing the rest of the type safety on this surface.
+    const privateKey = node_crypto_1.default.createPrivateKey({
+        format: 'jwk',
+        key: privateJwk,
+    });
+    return signEd25519Proof(privateKey, publicJwk, exports.DEVICE_PROOF_TYP, opts);
+}
+/** The header `typ` of an OverSky device-identity proof. */
+exports.DEVICE_PROOF_TYP = 'oversky-dpop+jwt';
+/**
+ * Sign a DPoP-shaped proof with an Ed25519 key under the given header `typ`.
+ *
+ * @internal Shared by the device-identity proof (`oversky-dpop+jwt`, above)
+ * and the RFC 9449 access-token proof (`dpop+jwt`, `dpop.ts`). `typ` is the
+ * only thing on the wire that separates the two protocols, which is why it is
+ * a required argument rather than a default: a proof signed for one must
+ * never verify as the other.
+ */
+function signEd25519Proof(privateKey, publicJwk, typ, opts) {
     if (typeof opts.method !== 'string' || opts.method.length === 0) {
         throw new Error('buildProof: method must be a non-empty string');
     }
     if (typeof opts.url !== 'string' || opts.url.length === 0) {
         throw new Error('buildProof: url must be a non-empty string');
     }
-    if (publicJwk.x !== privateJwk.x) {
-        // Defensive — public and private must come from the same keypair.
-        // A mismatch indicates a corrupted in-memory state.
-        throw new Error('buildProof: public/private JWK x mismatch (corrupted keypair)');
-    }
     const claims = {
         htm: opts.method.toUpperCase(),
         htu: normalizeHtu(opts.url),
@@ -185,23 +211,10 @@ function buildProof(privateJwk, publicJwk, opts) {
         claims.rth = tokenHash(opts.refreshToken);
     if (opts.accessToken !== undefined)
         claims.ath = tokenHash(opts.accessToken);
-    const header = {
-        alg: 'EdDSA',
-        typ: 'oversky-dpop+jwt',
-        jwk: publicJwk,
-    };
+    const header = { alg: 'EdDSA', typ, jwk: publicJwk };
     const headerB64 = b64u(Buffer.from(JSON.stringify(header), 'utf-8'));
     const payloadB64 = b64u(Buffer.from(JSON.stringify(claims), 'utf-8'));
     const signingInput = `${headerB64}.${payloadB64}`;
-    // Cast to crypto's `JsonWebKey` shape — that type requires an index
-    // signature for arbitrary string keys; our narrow OKP shape doesn't
-    // declare one because the strict shape is more useful at our API
-    // boundary. Cast through `unknown` to silence the structural mismatch
-    // without losing the rest of the type safety on this surface.
-    const privateKey = node_crypto_1.default.createPrivateKey({
-        format: 'jwk',
-        key: privateJwk,
-    });
     // EdDSA over Ed25519 — Node's crypto.sign expects `null` as the
     // digest algorithm because Ed25519 hashes the message internally.
     const signature = node_crypto_1.default.sign(null, Buffer.from(signingInput, 'utf-8'), privateKey);
@@ -217,6 +230,15 @@ function buildProof(privateJwk, publicJwk, opts) {
  * `sig_invalid` to keep the failure surface narrow.
  */
 function verifyProof(jws, opts = {}) {
+    return verifyEd25519Proof(jws, opts, exports.DEVICE_PROOF_TYP);
+}
+/**
+ * Verify a DPoP-shaped Ed25519 proof whose header `typ` must equal `typ`.
+ *
+ * @internal See `signEd25519Proof`. `verifyProof` (device identity) and
+ * `verifyDpopProof` (`dpop.ts`, RFC 9449) are the two public doors.
+ */
+function verifyEd25519Proof(jws, opts, typ) {
     if (typeof jws !== 'string' || jws.length === 0) {
         return { valid: false, reason: 'malformed' };
     }
@@ -237,7 +259,7 @@ function verifyProof(jws, opts = {}) {
     if (!header || typeof header !== 'object' || header.alg !== 'EdDSA') {
         return { valid: false, reason: 'bad_alg' };
     }
-    if (header.typ !== 'oversky-dpop+jwt') {
+    if (header.typ !== typ) {
         return { valid: false, reason: 'bad_typ' };
     }
     const headerJwk = header.jwk;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dpop.d.ts

@@ -0,0 +1,101 @@
+/**
+ * dpop.ts — RFC 9449 proof-of-possession for ACCESS tokens.
+ *
+ * Sibling of `deviceKey.ts`, and deliberately a different protocol on the
+ * wire. A device-identity proof (`typ: oversky-dpop+jwt`, header
+ * `OverSky-DPoP`) proves a daemon holds its ENROLLED key and authorizes
+ * minting/rotating that daemon's families. An access-token proof
+ * (`typ: dpop+jwt`, header `DPoP`) proves the presenter of an access token
+ * holds the key the token is bound to (`cnf.jkt`). The `typ` keeps either
+ * proof from ever verifying as the other.
+ *
+ * Why a SEPARATE key, never the device key (OSK-12020): the access-token key
+ * signs whatever `{htm, htu, ath}` a local caller asks of the daemon's proof
+ * oracle (`/v1/auth/cli-handoff-dpop-proof`). Handing that oracle the device
+ * key would turn it into a signer for the credential that mints families —
+ * one confused-deputy step from the workload asking for a device proof over
+ * `POST /api/daemons/cli-handoff`. A dedicated key carries no authority but
+ * the tokens bound to it, lives only in daemon memory (`createDpopKey` never
+ * exposes the private half), and dies with the family it binds.
+ *
+ * Algorithm: EdDSA / Ed25519, the same primitive as the device key. RFC 9449
+ * lets the server advertise `dpop_signing_alg_values_supported`; ours is
+ * exactly `["EdDSA"]`, and the verifier refuses anything else.
+ */
+import { type DeviceProofClaims, type Ed25519PublicJwk, type VerifyFailureReason } from './deviceKey.js';
+/** RFC 9449 §4.2 — the proof's JOSE header `typ`. */
+export declare const DPOP_PROOF_TYP = "dpop+jwt";
+/** RFC 9449 §4.1 — the request header carrying the proof. */
+export declare const DPOP_HEADER = "DPoP";
+/** Default freshness window, matching the device-proof verifier. */
+export declare const DPOP_MAX_AGE_SECONDS = 60;
+/** Server error codes for a bound token presented without a usable proof. */
+export declare const DPOP_PROOF_REQUIRED = "DPOP_PROOF_REQUIRED";
+export declare const DPOP_PROOF_INVALID = "DPOP_PROOF_INVALID";
+export declare const DPOP_PROOF_VERIFY_UNAVAILABLE = "DPOP_PROOF_VERIFY_UNAVAILABLE";
+/** A proof's claims: RFC 9449's `{htm, htu, iat, jti, ath?}`. */
+export type DpopProofClaims = Pick<DeviceProofClaims, 'htm' | 'htu' | 'iat' | 'jti' | 'ath'>;
+export interface DpopProofRequest {
+    /** HTTP method of the request the proof will accompany. */
+    htm: string;
+    /** Target URI; query and fragment are stripped (RFC 9449 §4.2). */
+    htu: string;
+    /** The access token the proof commits to (hashed into `ath`). Omitted only
+     *  at the token endpoint, where the token does not exist yet. */
+    accessToken?: string;
+    /** Pre-computed `ath`, for a signer that never sees the token itself. */
+    ath?: string;
+    /** Test hooks. */
+    iat?: number;
+    jti?: string;
+}
+/**
+ * An in-memory DPoP key. The private half lives in this closure and nowhere
+ * else: there is no accessor, no serializer, and it is never written to disk.
+ */
+export interface DpopKey {
+    readonly publicJwk: Ed25519PublicJwk;
+    /** RFC 7638 thumbprint — the value a bound token carries as `cnf.jkt`. */
+    readonly thumbprint: string;
+    sign(req: DpopProofRequest): string;
+}
+export declare function createDpopKey(): DpopKey;
+/** RFC 9449 §4.2 htu normalization — identical to the device proof's. */
+export declare function normalizeDpopHtu(url: string): string;
+/** `ath` for an access token: base64url(SHA-256(ascii(token))), RFC 9449 §4.2. */
+export declare function accessTokenHash(accessToken: string): string;
+/** True for a value shaped like an `ath` / `jkt` (43-char base64url SHA-256). */
+export declare function isAth(value: unknown): value is string;
+/** Same shape test, named for the `cnf.jkt` call sites. */
+export declare const isJwkThumbprint: typeof isAth;
+export type DpopVerifyFailureReason = Exclude<VerifyFailureReason, 'rth_mismatch' | 'pin_mismatch'> | 'ath_missing' | 'jkt_mismatch';
+export interface DpopVerifyOptions {
+    expectedHtm: string;
+    expectedHtu: string;
+    /** `ath` the proof must carry. Required for a resource request. */
+    expectedAth?: string;
+    /** Thumbprint the proof's key must have — the token's `cnf.jkt`. */
+    expectedJkt?: string;
+    maxAgeSeconds?: number;
+    clockSkewSeconds?: number;
+    now?: number;
+}
+export type DpopVerifyResult = {
+    valid: true;
+    claims: DpopProofClaims;
+    thumbprint: string;
+    publicJwk: Ed25519PublicJwk;
+} | {
+    valid: false;
+    reason: DpopVerifyFailureReason;
+};
+/**
+ * Verify an RFC 9449 proof: `typ` dpop+jwt, `alg` EdDSA, a well-formed inline
+ * JWK, the signature, iat window, htm, htu, `ath` (when expected) and the
+ * key's thumbprint against `expectedJkt` (when given).
+ *
+ * Replay (`jti`) is NOT checked here — it needs shared state, and the caller
+ * owns that (the API's Redis jti cache). A verifier that claimed to do it in
+ * process memory would be wrong on every multi-replica deployment.
+ */
+export declare function verifyDpopProof(jws: string, opts: DpopVerifyOptions): DpopVerifyResult;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dpop.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * dpop.ts — RFC 9449 proof-of-possession for ACCESS tokens.
+ *
+ * Sibling of `deviceKey.ts`, and deliberately a different protocol on the
+ * wire. A device-identity proof (`typ: oversky-dpop+jwt`, header
+ * `OverSky-DPoP`) proves a daemon holds its ENROLLED key and authorizes
+ * minting/rotating that daemon's families. An access-token proof
+ * (`typ: dpop+jwt`, header `DPoP`) proves the presenter of an access token
+ * holds the key the token is bound to (`cnf.jkt`). The `typ` keeps either
+ * proof from ever verifying as the other.
+ *
+ * Why a SEPARATE key, never the device key (OSK-12020): the access-token key
+ * signs whatever `{htm, htu, ath}` a local caller asks of the daemon's proof
+ * oracle (`/v1/auth/cli-handoff-dpop-proof`). Handing that oracle the device
+ * key would turn it into a signer for the credential that mints families —
+ * one confused-deputy step from the workload asking for a device proof over
+ * `POST /api/daemons/cli-handoff`. A dedicated key carries no authority but
+ * the tokens bound to it, lives only in daemon memory (`createDpopKey` never
+ * exposes the private half), and dies with the family it binds.
+ *
+ * Algorithm: EdDSA / Ed25519, the same primitive as the device key. RFC 9449
+ * lets the server advertise `dpop_signing_alg_values_supported`; ours is
+ * exactly `["EdDSA"]`, and the verifier refuses anything else.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isJwkThumbprint = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_INVALID = exports.DPOP_PROOF_REQUIRED = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.DPOP_PROOF_TYP = void 0;
+exports.createDpopKey = createDpopKey;
+exports.normalizeDpopHtu = normalizeDpopHtu;
+exports.accessTokenHash = accessTokenHash;
+exports.isAth = isAth;
+exports.verifyDpopProof = verifyDpopProof;
+const crypto = __importStar(require("node:crypto"));
+const deviceKey_js_1 = require("./deviceKey.js");
+/** RFC 9449 §4.2 — the proof's JOSE header `typ`. */
+exports.DPOP_PROOF_TYP = 'dpop+jwt';
+/** RFC 9449 §4.1 — the request header carrying the proof. */
+exports.DPOP_HEADER = 'DPoP';
+/** Default freshness window, matching the device-proof verifier. */
+exports.DPOP_MAX_AGE_SECONDS = 60;
+/** Server error codes for a bound token presented without a usable proof. */
+exports.DPOP_PROOF_REQUIRED = 'DPOP_PROOF_REQUIRED';
+exports.DPOP_PROOF_INVALID = 'DPOP_PROOF_INVALID';
+exports.DPOP_PROOF_VERIFY_UNAVAILABLE = 'DPOP_PROOF_VERIFY_UNAVAILABLE';
+function createDpopKey() {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');
+    const exported = publicKey.export({ format: 'jwk' });
+    if (exported.kty !== 'OKP' || exported.crv !== 'Ed25519' || typeof exported.x !== 'string') {
+        throw new Error('createDpopKey: unexpected public JWK shape');
+    }
+    const publicJwk = Object.freeze({ kty: 'OKP', crv: 'Ed25519', x: exported.x });
+    const thumbprint = (0, deviceKey_js_1.jwkThumbprint)(publicJwk);
+    return Object.freeze({
+        publicJwk,
+        thumbprint,
+        sign(req) {
+            return buildDpopProofWithKey(privateKey, publicJwk, req);
+        },
+    });
+}
+function b64u(buf) {
+    return buf.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+/**
+ * Sign one proof. `ath` comes from the token when the signer holds it, or is
+ * taken as given — the daemon's proof oracle is handed the hash and never the
+ * token, which is the point of the oracle.
+ */
+function buildDpopProofWithKey(privateKey, publicJwk, req) {
+    if (typeof req.htm !== 'string' || !/^[A-Za-z]{3,10}$/.test(req.htm)) {
+        throw new Error('dpop: htm must be an HTTP method');
+    }
+    if (typeof req.htu !== 'string' || req.htu.length === 0) {
+        throw new Error('dpop: htu must be a URL');
+    }
+    const ath = req.accessToken !== undefined ? (0, deviceKey_js_1.tokenHash)(req.accessToken) : req.ath;
+    if (ath !== undefined && !isAth(ath)) {
+        throw new Error('dpop: ath must be a base64url SHA-256 digest');
+    }
+    const header = { alg: 'EdDSA', typ: exports.DPOP_PROOF_TYP, jwk: publicJwk };
+    const claims = {
+        htm: req.htm.toUpperCase(),
+        htu: normalizeDpopHtu(req.htu),
+        iat: req.iat ?? Math.floor(Date.now() / 1000),
+        jti: req.jti ?? b64u(crypto.randomBytes(16)),
+        ...(ath !== undefined ? { ath } : {}),
+    };
+    const signingInput = `${b64u(Buffer.from(JSON.stringify(header), 'utf-8'))}.${b64u(Buffer.from(JSON.stringify(claims), 'utf-8'))}`;
+    const signature = crypto.sign(null, Buffer.from(signingInput, 'utf-8'), privateKey);
+    return `${signingInput}.${b64u(signature)}`;
+}
+/** RFC 9449 §4.2 htu normalization — identical to the device proof's. */
+function normalizeDpopHtu(url) {
+    return (0, deviceKey_js_1.normalizeHtu)(url);
+}
+/** `ath` for an access token: base64url(SHA-256(ascii(token))), RFC 9449 §4.2. */
+function accessTokenHash(accessToken) {
+    return (0, deviceKey_js_1.tokenHash)(accessToken);
+}
+/** True for a value shaped like an `ath` / `jkt` (43-char base64url SHA-256). */
+function isAth(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+/** Same shape test, named for the `cnf.jkt` call sites. */
+exports.isJwkThumbprint = isAth;
+/**
+ * Verify an RFC 9449 proof: `typ` dpop+jwt, `alg` EdDSA, a well-formed inline
+ * JWK, the signature, iat window, htm, htu, `ath` (when expected) and the
+ * key's thumbprint against `expectedJkt` (when given).
+ *
+ * Replay (`jti`) is NOT checked here — it needs shared state, and the caller
+ * owns that (the API's Redis jti cache). A verifier that claimed to do it in
+ * process memory would be wrong on every multi-replica deployment.
+ */
+function verifyDpopProof(jws, opts) {
+    const result = (0, deviceKey_js_1.verifyEd25519Proof)(jws, {
+        expectedHtm: opts.expectedHtm,
+        expectedHtu: opts.expectedHtu,
+        ...(opts.maxAgeSeconds !== undefined ? { maxAgeSeconds: opts.maxAgeSeconds } : {}),
+        ...(opts.clockSkewSeconds !== undefined ? { clockSkewSeconds: opts.clockSkewSeconds } : {}),
+        ...(opts.now !== undefined ? { now: opts.now } : {}),
+    }, exports.DPOP_PROOF_TYP);
+    if (!result.valid) {
+        // rth/pin are device-proof-only checks the options above never request.
+        return { valid: false, reason: result.reason };
+    }
+    // An empty jti cannot be claimed in a replay cache, so it is not a nonce.
+    if (result.claims.jti.length === 0)
+        return { valid: false, reason: 'malformed' };
+    if (opts.expectedAth !== undefined) {
+        if (typeof result.claims.ath !== 'string')
+            return { valid: false, reason: 'ath_missing' };
+        if (result.claims.ath !== opts.expectedAth)
+            return { valid: false, reason: 'ath_mismatch' };
+    }
+    if (opts.expectedJkt !== undefined && result.thumbprint !== opts.expectedJkt) {
+        return { valid: false, reason: 'jkt_mismatch' };
+    }
+    const { htm, htu, iat, jti, ath } = result.claims;
+    return {
+        valid: true,
+        claims: { htm, htu, iat, jti, ...(typeof ath === 'string' ? { ath } : {}) },
+        thumbprint: result.thumbprint,
+        publicJwk: result.publicJwk,
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -27,6 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = void 0;
+exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -222,6 +222,22 @@ Object.defineProperty(exports, "normalizeHtu", { enumerable: true, get: function
 Object.defineProperty(exports, "publicJwkFromX", { enumerable: true, get: function () { return deviceKey_js_1.publicJwkFromX; } });
 Object.defineProperty(exports, "tokenHash", { enumerable: true, get: function () { return deviceKey_js_1.tokenHash; } });
 Object.defineProperty(exports, "verifyDeviceProof", { enumerable: true, get: function () { return deviceKey_js_1.verifyProof; } });
+// OSK-12020 — RFC 9449 access-token binding (`cnf.jkt` + `DPoP` proof). A
+// different protocol from the device proof above (`typ: dpop+jwt`, header
+// `DPoP`), signed by a dedicated in-memory key the daemon holds.
+var dpop_js_1 = require("./dpop.js");
+Object.defineProperty(exports, "DPOP_HEADER", { enumerable: true, get: function () { return dpop_js_1.DPOP_HEADER; } });
+Object.defineProperty(exports, "DPOP_MAX_AGE_SECONDS", { enumerable: true, get: function () { return dpop_js_1.DPOP_MAX_AGE_SECONDS; } });
+Object.defineProperty(exports, "DPOP_PROOF_INVALID", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_INVALID; } });
+Object.defineProperty(exports, "DPOP_PROOF_REQUIRED", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_REQUIRED; } });
+Object.defineProperty(exports, "DPOP_PROOF_TYP", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_TYP; } });
+Object.defineProperty(exports, "DPOP_PROOF_VERIFY_UNAVAILABLE", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_VERIFY_UNAVAILABLE; } });
+Object.defineProperty(exports, "accessTokenHash", { enumerable: true, get: function () { return dpop_js_1.accessTokenHash; } });
+Object.defineProperty(exports, "createDpopKey", { enumerable: true, get: function () { return dpop_js_1.createDpopKey; } });
+Object.defineProperty(exports, "isAth", { enumerable: true, get: function () { return dpop_js_1.isAth; } });
+Object.defineProperty(exports, "isJwkThumbprint", { enumerable: true, get: function () { return dpop_js_1.isJwkThumbprint; } });
+Object.defineProperty(exports, "normalizeDpopHtu", { enumerable: true, get: function () { return dpop_js_1.normalizeDpopHtu; } });
+Object.defineProperty(exports, "verifyDpopProof", { enumerable: true, get: function () { return dpop_js_1.verifyDpopProof; } });
 // L11/L12 — composed runtime: init, transforms, sign, enroll, locks.
 // Daemon and CLI consume these; the underlying primitives live above.
 var credentialEnvelopeBridge_js_1 = require("./credentialEnvelopeBridge.js");