@skrr-ai/cli 0.1.79 → 0.1.81

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceKey.js

@@ -152,17 +152,40 @@ export function normalizeHtu(url) {
  * not a silent fallback.
  */
 export function buildProof(privateJwk, publicJwk, opts) {
+    if (publicJwk.x !== privateJwk.x) {
+        // Defensive — public and private must come from the same keypair.
+        // A mismatch indicates a corrupted in-memory state.
+        throw new Error('buildProof: public/private JWK x mismatch (corrupted keypair)');
+    }
+    // Cast to crypto's `JsonWebKey` shape — that type requires an index
+    // signature for arbitrary string keys; our narrow OKP shape doesn't
+    // declare one because the strict shape is more useful at our API
+    // boundary. Cast through `unknown` to silence the structural mismatch
+    // without losing the rest of the type safety on this surface.
+    const privateKey = crypto.createPrivateKey({
+        format: 'jwk',
+        key: privateJwk,
+    });
+    return signEd25519Proof(privateKey, publicJwk, DEVICE_PROOF_TYP, opts);
+}
+/** The header `typ` of an OverSky device-identity proof. */
+export const DEVICE_PROOF_TYP = 'oversky-dpop+jwt';
+/**
+ * Sign a DPoP-shaped proof with an Ed25519 key under the given header `typ`.
+ *
+ * @internal Shared by the device-identity proof (`oversky-dpop+jwt`, above)
+ * and the RFC 9449 access-token proof (`dpop+jwt`, `dpop.ts`). `typ` is the
+ * only thing on the wire that separates the two protocols, which is why it is
+ * a required argument rather than a default: a proof signed for one must
+ * never verify as the other.
+ */
+export function signEd25519Proof(privateKey, publicJwk, typ, opts) {
     if (typeof opts.method !== 'string' || opts.method.length === 0) {
         throw new Error('buildProof: method must be a non-empty string');
     }
     if (typeof opts.url !== 'string' || opts.url.length === 0) {
         throw new Error('buildProof: url must be a non-empty string');
     }
-    if (publicJwk.x !== privateJwk.x) {
-        // Defensive — public and private must come from the same keypair.
-        // A mismatch indicates a corrupted in-memory state.
-        throw new Error('buildProof: public/private JWK x mismatch (corrupted keypair)');
-    }
     const claims = {
         htm: opts.method.toUpperCase(),
         htu: normalizeHtu(opts.url),
@@ -173,23 +196,10 @@ export function buildProof(privateJwk, publicJwk, opts) {
         claims.rth = tokenHash(opts.refreshToken);
     if (opts.accessToken !== undefined)
         claims.ath = tokenHash(opts.accessToken);
-    const header = {
-        alg: 'EdDSA',
-        typ: 'oversky-dpop+jwt',
-        jwk: publicJwk,
-    };
+    const header = { alg: 'EdDSA', typ, jwk: publicJwk };
     const headerB64 = b64u(Buffer.from(JSON.stringify(header), 'utf-8'));
     const payloadB64 = b64u(Buffer.from(JSON.stringify(claims), 'utf-8'));
     const signingInput = `${headerB64}.${payloadB64}`;
-    // Cast to crypto's `JsonWebKey` shape — that type requires an index
-    // signature for arbitrary string keys; our narrow OKP shape doesn't
-    // declare one because the strict shape is more useful at our API
-    // boundary. Cast through `unknown` to silence the structural mismatch
-    // without losing the rest of the type safety on this surface.
-    const privateKey = crypto.createPrivateKey({
-        format: 'jwk',
-        key: privateJwk,
-    });
     // EdDSA over Ed25519 — Node's crypto.sign expects `null` as the
     // digest algorithm because Ed25519 hashes the message internally.
     const signature = crypto.sign(null, Buffer.from(signingInput, 'utf-8'), privateKey);
@@ -205,6 +215,15 @@ export function buildProof(privateJwk, publicJwk, opts) {
  * `sig_invalid` to keep the failure surface narrow.
  */
 export function verifyProof(jws, opts = {}) {
+    return verifyEd25519Proof(jws, opts, DEVICE_PROOF_TYP);
+}
+/**
+ * Verify a DPoP-shaped Ed25519 proof whose header `typ` must equal `typ`.
+ *
+ * @internal See `signEd25519Proof`. `verifyProof` (device identity) and
+ * `verifyDpopProof` (`dpop.ts`, RFC 9449) are the two public doors.
+ */
+export function verifyEd25519Proof(jws, opts, typ) {
     if (typeof jws !== 'string' || jws.length === 0) {
         return { valid: false, reason: 'malformed' };
     }
@@ -225,7 +244,7 @@ export function verifyProof(jws, opts = {}) {
     if (!header || typeof header !== 'object' || header.alg !== 'EdDSA') {
         return { valid: false, reason: 'bad_alg' };
     }
-    if (header.typ !== 'oversky-dpop+jwt') {
+    if (header.typ !== typ) {
         return { valid: false, reason: 'bad_typ' };
     }
     const headerJwk = header.jwk;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/dpop.d.ts

@@ -0,0 +1,101 @@
+/**
+ * dpop.ts — RFC 9449 proof-of-possession for ACCESS tokens.
+ *
+ * Sibling of `deviceKey.ts`, and deliberately a different protocol on the
+ * wire. A device-identity proof (`typ: oversky-dpop+jwt`, header
+ * `OverSky-DPoP`) proves a daemon holds its ENROLLED key and authorizes
+ * minting/rotating that daemon's families. An access-token proof
+ * (`typ: dpop+jwt`, header `DPoP`) proves the presenter of an access token
+ * holds the key the token is bound to (`cnf.jkt`). The `typ` keeps either
+ * proof from ever verifying as the other.
+ *
+ * Why a SEPARATE key, never the device key (OSK-12020): the access-token key
+ * signs whatever `{htm, htu, ath}` a local caller asks of the daemon's proof
+ * oracle (`/v1/auth/cli-handoff-dpop-proof`). Handing that oracle the device
+ * key would turn it into a signer for the credential that mints families —
+ * one confused-deputy step from the workload asking for a device proof over
+ * `POST /api/daemons/cli-handoff`. A dedicated key carries no authority but
+ * the tokens bound to it, lives only in daemon memory (`createDpopKey` never
+ * exposes the private half), and dies with the family it binds.
+ *
+ * Algorithm: EdDSA / Ed25519, the same primitive as the device key. RFC 9449
+ * lets the server advertise `dpop_signing_alg_values_supported`; ours is
+ * exactly `["EdDSA"]`, and the verifier refuses anything else.
+ */
+import { type DeviceProofClaims, type Ed25519PublicJwk, type VerifyFailureReason } from './deviceKey.js';
+/** RFC 9449 §4.2 — the proof's JOSE header `typ`. */
+export declare const DPOP_PROOF_TYP = "dpop+jwt";
+/** RFC 9449 §4.1 — the request header carrying the proof. */
+export declare const DPOP_HEADER = "DPoP";
+/** Default freshness window, matching the device-proof verifier. */
+export declare const DPOP_MAX_AGE_SECONDS = 60;
+/** Server error codes for a bound token presented without a usable proof. */
+export declare const DPOP_PROOF_REQUIRED = "DPOP_PROOF_REQUIRED";
+export declare const DPOP_PROOF_INVALID = "DPOP_PROOF_INVALID";
+export declare const DPOP_PROOF_VERIFY_UNAVAILABLE = "DPOP_PROOF_VERIFY_UNAVAILABLE";
+/** A proof's claims: RFC 9449's `{htm, htu, iat, jti, ath?}`. */
+export type DpopProofClaims = Pick<DeviceProofClaims, 'htm' | 'htu' | 'iat' | 'jti' | 'ath'>;
+export interface DpopProofRequest {
+    /** HTTP method of the request the proof will accompany. */
+    htm: string;
+    /** Target URI; query and fragment are stripped (RFC 9449 §4.2). */
+    htu: string;
+    /** The access token the proof commits to (hashed into `ath`). Omitted only
+     *  at the token endpoint, where the token does not exist yet. */
+    accessToken?: string;
+    /** Pre-computed `ath`, for a signer that never sees the token itself. */
+    ath?: string;
+    /** Test hooks. */
+    iat?: number;
+    jti?: string;
+}
+/**
+ * An in-memory DPoP key. The private half lives in this closure and nowhere
+ * else: there is no accessor, no serializer, and it is never written to disk.
+ */
+export interface DpopKey {
+    readonly publicJwk: Ed25519PublicJwk;
+    /** RFC 7638 thumbprint — the value a bound token carries as `cnf.jkt`. */
+    readonly thumbprint: string;
+    sign(req: DpopProofRequest): string;
+}
+export declare function createDpopKey(): DpopKey;
+/** RFC 9449 §4.2 htu normalization — identical to the device proof's. */
+export declare function normalizeDpopHtu(url: string): string;
+/** `ath` for an access token: base64url(SHA-256(ascii(token))), RFC 9449 §4.2. */
+export declare function accessTokenHash(accessToken: string): string;
+/** True for a value shaped like an `ath` / `jkt` (43-char base64url SHA-256). */
+export declare function isAth(value: unknown): value is string;
+/** Same shape test, named for the `cnf.jkt` call sites. */
+export declare const isJwkThumbprint: typeof isAth;
+export type DpopVerifyFailureReason = Exclude<VerifyFailureReason, 'rth_mismatch' | 'pin_mismatch'> | 'ath_missing' | 'jkt_mismatch';
+export interface DpopVerifyOptions {
+    expectedHtm: string;
+    expectedHtu: string;
+    /** `ath` the proof must carry. Required for a resource request. */
+    expectedAth?: string;
+    /** Thumbprint the proof's key must have — the token's `cnf.jkt`. */
+    expectedJkt?: string;
+    maxAgeSeconds?: number;
+    clockSkewSeconds?: number;
+    now?: number;
+}
+export type DpopVerifyResult = {
+    valid: true;
+    claims: DpopProofClaims;
+    thumbprint: string;
+    publicJwk: Ed25519PublicJwk;
+} | {
+    valid: false;
+    reason: DpopVerifyFailureReason;
+};
+/**
+ * Verify an RFC 9449 proof: `typ` dpop+jwt, `alg` EdDSA, a well-formed inline
+ * JWK, the signature, iat window, htm, htu, `ath` (when expected) and the
+ * key's thumbprint against `expectedJkt` (when given).
+ *
+ * Replay (`jti`) is NOT checked here — it needs shared state, and the caller
+ * owns that (the API's Redis jti cache). A verifier that claimed to do it in
+ * process memory would be wrong on every multi-replica deployment.
+ */
+export declare function verifyDpopProof(jws: string, opts: DpopVerifyOptions): DpopVerifyResult;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/dpop.js

@@ -0,0 +1,138 @@
+/**
+ * dpop.ts — RFC 9449 proof-of-possession for ACCESS tokens.
+ *
+ * Sibling of `deviceKey.ts`, and deliberately a different protocol on the
+ * wire. A device-identity proof (`typ: oversky-dpop+jwt`, header
+ * `OverSky-DPoP`) proves a daemon holds its ENROLLED key and authorizes
+ * minting/rotating that daemon's families. An access-token proof
+ * (`typ: dpop+jwt`, header `DPoP`) proves the presenter of an access token
+ * holds the key the token is bound to (`cnf.jkt`). The `typ` keeps either
+ * proof from ever verifying as the other.
+ *
+ * Why a SEPARATE key, never the device key (OSK-12020): the access-token key
+ * signs whatever `{htm, htu, ath}` a local caller asks of the daemon's proof
+ * oracle (`/v1/auth/cli-handoff-dpop-proof`). Handing that oracle the device
+ * key would turn it into a signer for the credential that mints families —
+ * one confused-deputy step from the workload asking for a device proof over
+ * `POST /api/daemons/cli-handoff`. A dedicated key carries no authority but
+ * the tokens bound to it, lives only in daemon memory (`createDpopKey` never
+ * exposes the private half), and dies with the family it binds.
+ *
+ * Algorithm: EdDSA / Ed25519, the same primitive as the device key. RFC 9449
+ * lets the server advertise `dpop_signing_alg_values_supported`; ours is
+ * exactly `["EdDSA"]`, and the verifier refuses anything else.
+ */
+import * as crypto from 'node:crypto';
+import { jwkThumbprint, normalizeHtu, tokenHash, verifyEd25519Proof, } from './deviceKey.js';
+/** RFC 9449 §4.2 — the proof's JOSE header `typ`. */
+export const DPOP_PROOF_TYP = 'dpop+jwt';
+/** RFC 9449 §4.1 — the request header carrying the proof. */
+export const DPOP_HEADER = 'DPoP';
+/** Default freshness window, matching the device-proof verifier. */
+export const DPOP_MAX_AGE_SECONDS = 60;
+/** Server error codes for a bound token presented without a usable proof. */
+export const DPOP_PROOF_REQUIRED = 'DPOP_PROOF_REQUIRED';
+export const DPOP_PROOF_INVALID = 'DPOP_PROOF_INVALID';
+export const DPOP_PROOF_VERIFY_UNAVAILABLE = 'DPOP_PROOF_VERIFY_UNAVAILABLE';
+export function createDpopKey() {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');
+    const exported = publicKey.export({ format: 'jwk' });
+    if (exported.kty !== 'OKP' || exported.crv !== 'Ed25519' || typeof exported.x !== 'string') {
+        throw new Error('createDpopKey: unexpected public JWK shape');
+    }
+    const publicJwk = Object.freeze({ kty: 'OKP', crv: 'Ed25519', x: exported.x });
+    const thumbprint = jwkThumbprint(publicJwk);
+    return Object.freeze({
+        publicJwk,
+        thumbprint,
+        sign(req) {
+            return buildDpopProofWithKey(privateKey, publicJwk, req);
+        },
+    });
+}
+function b64u(buf) {
+    return buf.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+/**
+ * Sign one proof. `ath` comes from the token when the signer holds it, or is
+ * taken as given — the daemon's proof oracle is handed the hash and never the
+ * token, which is the point of the oracle.
+ */
+function buildDpopProofWithKey(privateKey, publicJwk, req) {
+    if (typeof req.htm !== 'string' || !/^[A-Za-z]{3,10}$/.test(req.htm)) {
+        throw new Error('dpop: htm must be an HTTP method');
+    }
+    if (typeof req.htu !== 'string' || req.htu.length === 0) {
+        throw new Error('dpop: htu must be a URL');
+    }
+    const ath = req.accessToken !== undefined ? tokenHash(req.accessToken) : req.ath;
+    if (ath !== undefined && !isAth(ath)) {
+        throw new Error('dpop: ath must be a base64url SHA-256 digest');
+    }
+    const header = { alg: 'EdDSA', typ: DPOP_PROOF_TYP, jwk: publicJwk };
+    const claims = {
+        htm: req.htm.toUpperCase(),
+        htu: normalizeDpopHtu(req.htu),
+        iat: req.iat ?? Math.floor(Date.now() / 1000),
+        jti: req.jti ?? b64u(crypto.randomBytes(16)),
+        ...(ath !== undefined ? { ath } : {}),
+    };
+    const signingInput = `${b64u(Buffer.from(JSON.stringify(header), 'utf-8'))}.${b64u(Buffer.from(JSON.stringify(claims), 'utf-8'))}`;
+    const signature = crypto.sign(null, Buffer.from(signingInput, 'utf-8'), privateKey);
+    return `${signingInput}.${b64u(signature)}`;
+}
+/** RFC 9449 §4.2 htu normalization — identical to the device proof's. */
+export function normalizeDpopHtu(url) {
+    return normalizeHtu(url);
+}
+/** `ath` for an access token: base64url(SHA-256(ascii(token))), RFC 9449 §4.2. */
+export function accessTokenHash(accessToken) {
+    return tokenHash(accessToken);
+}
+/** True for a value shaped like an `ath` / `jkt` (43-char base64url SHA-256). */
+export function isAth(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+/** Same shape test, named for the `cnf.jkt` call sites. */
+export const isJwkThumbprint = isAth;
+/**
+ * Verify an RFC 9449 proof: `typ` dpop+jwt, `alg` EdDSA, a well-formed inline
+ * JWK, the signature, iat window, htm, htu, `ath` (when expected) and the
+ * key's thumbprint against `expectedJkt` (when given).
+ *
+ * Replay (`jti`) is NOT checked here — it needs shared state, and the caller
+ * owns that (the API's Redis jti cache). A verifier that claimed to do it in
+ * process memory would be wrong on every multi-replica deployment.
+ */
+export function verifyDpopProof(jws, opts) {
+    const result = verifyEd25519Proof(jws, {
+        expectedHtm: opts.expectedHtm,
+        expectedHtu: opts.expectedHtu,
+        ...(opts.maxAgeSeconds !== undefined ? { maxAgeSeconds: opts.maxAgeSeconds } : {}),
+        ...(opts.clockSkewSeconds !== undefined ? { clockSkewSeconds: opts.clockSkewSeconds } : {}),
+        ...(opts.now !== undefined ? { now: opts.now } : {}),
+    }, DPOP_PROOF_TYP);
+    if (!result.valid) {
+        // rth/pin are device-proof-only checks the options above never request.
+        return { valid: false, reason: result.reason };
+    }
+    // An empty jti cannot be claimed in a replay cache, so it is not a nonce.
+    if (result.claims.jti.length === 0)
+        return { valid: false, reason: 'malformed' };
+    if (opts.expectedAth !== undefined) {
+        if (typeof result.claims.ath !== 'string')
+            return { valid: false, reason: 'ath_missing' };
+        if (result.claims.ath !== opts.expectedAth)
+            return { valid: false, reason: 'ath_mismatch' };
+    }
+    if (opts.expectedJkt !== undefined && result.thumbprint !== opts.expectedJkt) {
+        return { valid: false, reason: 'jkt_mismatch' };
+    }
+    const { htm, htu, iat, jti, ath } = result.claims;
+    return {
+        valid: true,
+        claims: { htm, htu, iat, jti, ...(typeof ath === 'string' ? { ath } : {}) },
+        thumbprint: result.thumbprint,
+        publicJwk: result.publicJwk,
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -16,7 +16,7 @@ export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefr
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';
 export { readAuthFromFd, __setFdReaderForTest, type FdAuthPayload } from './fdToken.js';
-export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
+export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, PERSONAL_ACCESS_TOKEN_PREFIX, isStaticTokenKind, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
 export { invokeAuthHelper, getDefaultHelperTtlMs, getLastAuthHelperFailureReason, __resetAuthHelperFailureReasonForTest, SENTINEL_TRIGGERING_FAILURES, type HelperResult, type InvokeAuthHelperOptions, type AuthHelperFailureReason, } from './authHelper.js';
 export { runHeadersHelper, invalidateHeadersHelperCache, type RunHeadersHelperOptions, } from './headers-helper.js';
 export { generateVerifier, challenge, generateState, safeEqual, verifyChallenge, type PkceChallengeMethod, } from './pkce.js';
@@ -27,6 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -51,7 +51,7 @@ export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverFor
 // H3-6 — public seam 401 handlers call to bust the helper cache so
 // the next resolve re-invokes OVERSKY_AUTH_HELPER immediately
 // instead of serving the stale cached token for up to its TTL.
-invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, 
+invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, PERSONAL_ACCESS_TOKEN_PREFIX, isStaticTokenKind, 
 // L6.1 / L6.3 — fail-closed errors thrown by the auth-helper slot.
 AuthHelperUntrustedError, AuthHelperUnavailableError, } from './credentialResolver.js';
 // Auth helper — invocation contract for OVERSKY_AUTH_HELPER
@@ -104,6 +104,10 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 // persistence + signing lives in `daemon/src/deviceIdentity.ts`.
 // Server-side verification middleware is a later PR.
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, } from './deviceKey.js';
+// OSK-12020 — RFC 9449 access-token binding (`cnf.jkt` + `DPoP` proof). A
+// different protocol from the device proof above (`typ: dpop+jwt`, header
+// `DPoP`), signed by a dedicated in-memory key the daemon holds.
+export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, } from './dpop.js';
 // L11/L12 — composed runtime: init, transforms, sign, enroll, locks.
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {