@skrr-ai/cli 0.1.79 → 0.1.80

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/dpop.js

@@ -0,0 +1,138 @@
+/**
+ * dpop.ts — RFC 9449 proof-of-possession for ACCESS tokens.
+ *
+ * Sibling of `deviceKey.ts`, and deliberately a different protocol on the
+ * wire. A device-identity proof (`typ: oversky-dpop+jwt`, header
+ * `OverSky-DPoP`) proves a daemon holds its ENROLLED key and authorizes
+ * minting/rotating that daemon's families. An access-token proof
+ * (`typ: dpop+jwt`, header `DPoP`) proves the presenter of an access token
+ * holds the key the token is bound to (`cnf.jkt`). The `typ` keeps either
+ * proof from ever verifying as the other.
+ *
+ * Why a SEPARATE key, never the device key (OSK-12020): the access-token key
+ * signs whatever `{htm, htu, ath}` a local caller asks of the daemon's proof
+ * oracle (`/v1/auth/cli-handoff-dpop-proof`). Handing that oracle the device
+ * key would turn it into a signer for the credential that mints families —
+ * one confused-deputy step from the workload asking for a device proof over
+ * `POST /api/daemons/cli-handoff`. A dedicated key carries no authority but
+ * the tokens bound to it, lives only in daemon memory (`createDpopKey` never
+ * exposes the private half), and dies with the family it binds.
+ *
+ * Algorithm: EdDSA / Ed25519, the same primitive as the device key. RFC 9449
+ * lets the server advertise `dpop_signing_alg_values_supported`; ours is
+ * exactly `["EdDSA"]`, and the verifier refuses anything else.
+ */
+import * as crypto from 'node:crypto';
+import { jwkThumbprint, normalizeHtu, tokenHash, verifyEd25519Proof, } from './deviceKey.js';
+/** RFC 9449 §4.2 — the proof's JOSE header `typ`. */
+export const DPOP_PROOF_TYP = 'dpop+jwt';
+/** RFC 9449 §4.1 — the request header carrying the proof. */
+export const DPOP_HEADER = 'DPoP';
+/** Default freshness window, matching the device-proof verifier. */
+export const DPOP_MAX_AGE_SECONDS = 60;
+/** Server error codes for a bound token presented without a usable proof. */
+export const DPOP_PROOF_REQUIRED = 'DPOP_PROOF_REQUIRED';
+export const DPOP_PROOF_INVALID = 'DPOP_PROOF_INVALID';
+export const DPOP_PROOF_VERIFY_UNAVAILABLE = 'DPOP_PROOF_VERIFY_UNAVAILABLE';
+export function createDpopKey() {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');
+    const exported = publicKey.export({ format: 'jwk' });
+    if (exported.kty !== 'OKP' || exported.crv !== 'Ed25519' || typeof exported.x !== 'string') {
+        throw new Error('createDpopKey: unexpected public JWK shape');
+    }
+    const publicJwk = Object.freeze({ kty: 'OKP', crv: 'Ed25519', x: exported.x });
+    const thumbprint = jwkThumbprint(publicJwk);
+    return Object.freeze({
+        publicJwk,
+        thumbprint,
+        sign(req) {
+            return buildDpopProofWithKey(privateKey, publicJwk, req);
+        },
+    });
+}
+function b64u(buf) {
+    return buf.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+/**
+ * Sign one proof. `ath` comes from the token when the signer holds it, or is
+ * taken as given — the daemon's proof oracle is handed the hash and never the
+ * token, which is the point of the oracle.
+ */
+function buildDpopProofWithKey(privateKey, publicJwk, req) {
+    if (typeof req.htm !== 'string' || !/^[A-Za-z]{3,10}$/.test(req.htm)) {
+        throw new Error('dpop: htm must be an HTTP method');
+    }
+    if (typeof req.htu !== 'string' || req.htu.length === 0) {
+        throw new Error('dpop: htu must be a URL');
+    }
+    const ath = req.accessToken !== undefined ? tokenHash(req.accessToken) : req.ath;
+    if (ath !== undefined && !isAth(ath)) {
+        throw new Error('dpop: ath must be a base64url SHA-256 digest');
+    }
+    const header = { alg: 'EdDSA', typ: DPOP_PROOF_TYP, jwk: publicJwk };
+    const claims = {
+        htm: req.htm.toUpperCase(),
+        htu: normalizeDpopHtu(req.htu),
+        iat: req.iat ?? Math.floor(Date.now() / 1000),
+        jti: req.jti ?? b64u(crypto.randomBytes(16)),
+        ...(ath !== undefined ? { ath } : {}),
+    };
+    const signingInput = `${b64u(Buffer.from(JSON.stringify(header), 'utf-8'))}.${b64u(Buffer.from(JSON.stringify(claims), 'utf-8'))}`;
+    const signature = crypto.sign(null, Buffer.from(signingInput, 'utf-8'), privateKey);
+    return `${signingInput}.${b64u(signature)}`;
+}
+/** RFC 9449 §4.2 htu normalization — identical to the device proof's. */
+export function normalizeDpopHtu(url) {
+    return normalizeHtu(url);
+}
+/** `ath` for an access token: base64url(SHA-256(ascii(token))), RFC 9449 §4.2. */
+export function accessTokenHash(accessToken) {
+    return tokenHash(accessToken);
+}
+/** True for a value shaped like an `ath` / `jkt` (43-char base64url SHA-256). */
+export function isAth(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+/** Same shape test, named for the `cnf.jkt` call sites. */
+export const isJwkThumbprint = isAth;
+/**
+ * Verify an RFC 9449 proof: `typ` dpop+jwt, `alg` EdDSA, a well-formed inline
+ * JWK, the signature, iat window, htm, htu, `ath` (when expected) and the
+ * key's thumbprint against `expectedJkt` (when given).
+ *
+ * Replay (`jti`) is NOT checked here — it needs shared state, and the caller
+ * owns that (the API's Redis jti cache). A verifier that claimed to do it in
+ * process memory would be wrong on every multi-replica deployment.
+ */
+export function verifyDpopProof(jws, opts) {
+    const result = verifyEd25519Proof(jws, {
+        expectedHtm: opts.expectedHtm,
+        expectedHtu: opts.expectedHtu,
+        ...(opts.maxAgeSeconds !== undefined ? { maxAgeSeconds: opts.maxAgeSeconds } : {}),
+        ...(opts.clockSkewSeconds !== undefined ? { clockSkewSeconds: opts.clockSkewSeconds } : {}),
+        ...(opts.now !== undefined ? { now: opts.now } : {}),
+    }, DPOP_PROOF_TYP);
+    if (!result.valid) {
+        // rth/pin are device-proof-only checks the options above never request.
+        return { valid: false, reason: result.reason };
+    }
+    // An empty jti cannot be claimed in a replay cache, so it is not a nonce.
+    if (result.claims.jti.length === 0)
+        return { valid: false, reason: 'malformed' };
+    if (opts.expectedAth !== undefined) {
+        if (typeof result.claims.ath !== 'string')
+            return { valid: false, reason: 'ath_missing' };
+        if (result.claims.ath !== opts.expectedAth)
+            return { valid: false, reason: 'ath_mismatch' };
+    }
+    if (opts.expectedJkt !== undefined && result.thumbprint !== opts.expectedJkt) {
+        return { valid: false, reason: 'jkt_mismatch' };
+    }
+    const { htm, htu, iat, jti, ath } = result.claims;
+    return {
+        valid: true,
+        claims: { htm, htu, iat, jti, ...(typeof ath === 'string' ? { ath } : {}) },
+        thumbprint: result.thumbprint,
+        publicJwk: result.publicJwk,
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -27,6 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -104,6 +104,10 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 // persistence + signing lives in `daemon/src/deviceIdentity.ts`.
 // Server-side verification middleware is a later PR.
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, } from './deviceKey.js';
+// OSK-12020 — RFC 9449 access-token binding (`cnf.jkt` + `DPoP` proof). A
+// different protocol from the device proof above (`typ: dpop+jwt`, header
+// `DPoP`), signed by a dedicated in-memory key the daemon holds.
+export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, } from './dpop.js';
 // L11/L12 — composed runtime: init, transforms, sign, enroll, locks.
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {