@skrr-ai/cli 0.1.79 → 0.1.81

package/dist/lib/dpop-auth.d.ts

@@ -0,0 +1,35 @@
+/**
+ * dpop-auth.ts — attach RFC 9449 proofs for a DPoP-bound hand-off token
+ * (OSK-12020).
+ *
+ * The ONE place a request path asks for a proof, so every transport the CLI
+ * has — `apiFetch`, the data-service node adapter, SSE, and Socket.IO — binds
+ * the same way. For any other credential both helpers are no-ops and the wire
+ * is byte-identical to before.
+ *
+ * The CLI never holds the key. Each proof comes from the local daemon
+ * (`brokeredDpopProof`), which keeps the private half in its own memory; that
+ * is what makes a copied token useless anywhere but on this machine.
+ */
+/** RFC 9449 §4.1. */
+export declare const DPOP_HEADER = "DPoP";
+/** Headers to add to one HTTP request made with `token`; `{}` when unbound. */
+export declare function dpopHeadersFor(token: string | null | undefined, method: string, url: string): Promise<Record<string, string>>;
+/**
+ * The URI a Socket.IO handshake proof commits to: the realtime origin's
+ * http(s) form plus the engine path, no trailing slash — what the server
+ * rebuilds from the handshake request (`reconstructHandshakeHtu`).
+ */
+export declare function socketHandshakeHtu(wsOrigin: string, ioPath?: string): string;
+type SocketAuth = Record<string, unknown>;
+type SocketAuthFn = (cb: (data: SocketAuth) => void) => void;
+/**
+ * Socket.IO `auth` for a handshake made with `auth.token`. Unbound: the object
+ * itself, unchanged. Bound: a FUNCTION, which socket.io-client calls on every
+ * (re)connect — so each handshake presents a fresh, single-use proof instead
+ * of replaying the first one into the server's jti cache.
+ */
+export declare function socketAuthWithDpop(auth: SocketAuth & {
+    token?: string | null;
+}, wsOrigin: string, ioPath?: string): SocketAuth | SocketAuthFn;
+export {};

package/dist/lib/dpop-auth.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * dpop-auth.ts — attach RFC 9449 proofs for a DPoP-bound hand-off token
+ * (OSK-12020).
+ *
+ * The ONE place a request path asks for a proof, so every transport the CLI
+ * has — `apiFetch`, the data-service node adapter, SSE, and Socket.IO — binds
+ * the same way. For any other credential both helpers are no-ops and the wire
+ * is byte-identical to before.
+ *
+ * The CLI never holds the key. Each proof comes from the local daemon
+ * (`brokeredDpopProof`), which keeps the private half in its own memory; that
+ * is what makes a copied token useless anywhere but on this machine.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DPOP_HEADER = void 0;
+exports.dpopHeadersFor = dpopHeadersFor;
+exports.socketHandshakeHtu = socketHandshakeHtu;
+exports.socketAuthWithDpop = socketAuthWithDpop;
+const brokered_dpop_1 = require("./brokered-dpop");
+/** RFC 9449 §4.1. */
+exports.DPOP_HEADER = 'DPoP';
+/** Headers to add to one HTTP request made with `token`; `{}` when unbound. */
+async function dpopHeadersFor(token, method, url) {
+    if (!(0, brokered_dpop_1.isDpopBoundHandoffToken)(token))
+        return {};
+    const proof = await (0, brokered_dpop_1.brokeredDpopProof)(token, method, url);
+    return proof ? { [exports.DPOP_HEADER]: proof } : {};
+}
+/**
+ * The URI a Socket.IO handshake proof commits to: the realtime origin's
+ * http(s) form plus the engine path, no trailing slash — what the server
+ * rebuilds from the handshake request (`reconstructHandshakeHtu`).
+ */
+function socketHandshakeHtu(wsOrigin, ioPath = '/ws/agentic') {
+    const u = new URL(wsOrigin);
+    u.protocol = u.protocol === 'wss:' ? 'https:' : u.protocol === 'ws:' ? 'http:' : u.protocol;
+    u.pathname = ioPath.replace(/\/+$/, '');
+    u.search = '';
+    u.hash = '';
+    return u.toString();
+}
+/**
+ * Socket.IO `auth` for a handshake made with `auth.token`. Unbound: the object
+ * itself, unchanged. Bound: a FUNCTION, which socket.io-client calls on every
+ * (re)connect — so each handshake presents a fresh, single-use proof instead
+ * of replaying the first one into the server's jti cache.
+ */
+function socketAuthWithDpop(auth, wsOrigin, ioPath = '/ws/agentic') {
+    const token = typeof auth.token === 'string' ? auth.token : null;
+    if (!(0, brokered_dpop_1.isDpopBoundHandoffToken)(token))
+        return auth;
+    const htu = socketHandshakeHtu(wsOrigin, ioPath);
+    return (cb) => {
+        void (0, brokered_dpop_1.brokeredDpopProof)(token, 'GET', htu).then((proof) => cb(proof ? { ...auth, dpop: proof } : auth), () => cb(auth));
+    };
+}

package/dist/lib/login.d.ts

@@ -42,6 +42,12 @@ export interface CliLoginWithRefreshTokenOptions {
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
  * name only CI tokens, which is not a sign-in: an agent session asking for one
  * could only hand the job to a person typing `! skrr login`.
+ *
+ * It also used to send CI to `skrr create-token` + `OVERSKY_TOKEN=osk_ci_...`.
+ * That token only bootstraps a daemon; every `skrr` command rejects it with 401
+ * (create-token.ts, base-command.ts), so the advice was a dead end (OSK-13209).
+ * The route that works today is a minted machine session — see
+ * docs/cli/SKRR_AUTH.md "CI today" for its caveats.
  */
 export declare const HEADLESS_LOGIN_HINT: string;
 /**

package/dist/lib/login.js

@@ -43,10 +43,18 @@ const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
  * name only CI tokens, which is not a sign-in: an agent session asking for one
  * could only hand the job to a person typing `! skrr login`.
+ *
+ * It also used to send CI to `skrr create-token` + `OVERSKY_TOKEN=osk_ci_...`.
+ * That token only bootstraps a daemon; every `skrr` command rejects it with 401
+ * (create-token.ts, base-command.ts), so the advice was a dead end (OSK-13209).
+ * The route that works today is a minted machine session — see
+ * docs/cli/SKRR_AUTH.md "CI today" for its caveats.
  */
 exports.HEADLESS_LOGIN_HINT = '`skrr login --device-code` works without a terminal: it prints a URL and a code for a ' +
-    'person to approve in any browser, and finishes when they do. For CI, use ' +
-    '`skrr create-token` and set OVERSKY_TOKEN=osk_ci_...';
+    'person to approve in any browser, and finishes when they do. With no person to approve ' +
+    '(CI, a script), mint a session for this machine elsewhere with `skrr token mint --for <id>` ' +
+    'and run `skrr login` here with OVERSKY_REFRESH_TOKEN and OVERSKY_CLI_ID set. ' +
+    '`skrr create-token` tokens are not accepted by skrr commands.';
 /**
  * The line printed when the daemon descriptor this CLI found is for another
  * server (OSK-12117).
@@ -164,8 +172,9 @@ async function cliLogin(opts = {}) {
         // silently fall through to PKCE / device-code below.
         if (brokerResult.reason === 'ci_token_refused') {
             throw new Error('The skrr background service on this computer is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
-                'Use `skrr create-token --name <name>` to mint a long-lived CI credential directly, ' +
-                'or run `skrr login` on a machine where the daemon was authenticated interactively.');
+                'Sign this CLI in on its own with `skrr login --device-code`, or with a session minted elsewhere by ' +
+                '`skrr token mint --for <id>` (OVERSKY_REFRESH_TOKEN + OVERSKY_CLI_ID). ' +
+                'A `skrr create-token` token is not accepted by skrr commands.');
         }
         // `base_url_mismatch` is a configuration drift the user can resolve
         // explicitly; print a one-line hint so they're not surprised when

package/dist/lib/node-adapter.js

@@ -12,6 +12,7 @@ const config_1 = require("./config");
 const auth_storage_1 = require("./auth-storage");
 const credential_resolver_1 = require("./credential-resolver");
 const daemonBroker_1 = require("./daemonBroker");
+const dpop_auth_1 = require("./dpop-auth");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
 const workspace_header_1 = require("./workspace-header");
@@ -159,6 +160,9 @@ function createNodeAdapter(opts = {}) {
             }
         }
         const finalUrl = appendQuery(resolveUrl(url), options?.params);
+        // OSK-12020 — a DPoP-bound hand-off token needs a fresh proof per request
+        // (and per retry: proofs are single-use). No-op for every other token.
+        Object.assign(headers, await (0, dpop_auth_1.dpopHeadersFor)(currentCredential().token, method, finalUrl));
         return fetch(finalUrl, { method, headers, body: finalBody });
     }
     /**
@@ -198,7 +202,7 @@ function createNodeAdapter(opts = {}) {
             return false;
         // Never refresh a CI token — they're static by construction.
         const { token, kind } = currentCredential();
-        if (!token || kind === 'ci')
+        if (!token || (0, auth_core_1.isStaticTokenKind)(kind))
             return false;
         if (refreshInFlight)
             return refreshInFlight;
@@ -237,7 +241,7 @@ function createNodeAdapter(opts = {}) {
         if (process.env.OVERSKY_SKIP_DAEMON_BROKER === '1')
             return false;
         const cred = currentCredential();
-        if (cred.kind === 'ci')
+        if ((0, auth_core_1.isStaticTokenKind)(cred.kind))
             return false;
         // An operator-supplied `--token` is that operator's explicit
         // authority: when the server refuses it, the honest answer is the

package/dist/lib/publisher-profile-flags.d.ts

@@ -0,0 +1,19 @@
+import type { PublisherProfileDraft } from '@skrr-ai/data-provider';
+/**
+ * Shared flags for `skrr store publishers profile *`.
+ *
+ * `--publish-as` names a workspace you publish for; omitted, the console is
+ * your personal publisher profile. The server derives the actual principal —
+ * this only selects which of your profiles to address.
+ */
+export declare const publishAsFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+export declare const jsonFlag: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+/** A profile draft is a document; read it from a JSON file, never from argv. */
+export declare function readDraftFile(file: string): PublisherProfileDraft;
+/**
+ * The CAS revision a state change applies to. Publish, hide and restore act
+ * on whatever the draft is NOW, so reading it immediately before the write is
+ * the intent; a caller holding a specific revision passes it and the server
+ * refuses a stale one.
+ */
+export declare function currentRevision(publishAs?: string, explicit?: number): Promise<number>;

package/dist/lib/publisher-profile-flags.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsonFlag = exports.publishAsFlag = void 0;
+exports.readDraftFile = readDraftFile;
+exports.currentRevision = currentRevision;
+const node_fs_1 = require("node:fs");
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Shared flags for `skrr store publishers profile *`.
+ *
+ * `--publish-as` names a workspace you publish for; omitted, the console is
+ * your personal publisher profile. The server derives the actual principal —
+ * this only selects which of your profiles to address.
+ */
+exports.publishAsFlag = core_1.Flags.string({
+    description: 'Workspace id to act for (omit for your personal publisher profile)',
+});
+exports.jsonFlag = core_1.Flags.boolean({ description: 'Output as JSON' });
+/** A profile draft is a document; read it from a JSON file, never from argv. */
+function readDraftFile(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Could not read a JSON draft from ${file}: ${err.message}`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`${file} must contain a JSON object (the profile draft)`);
+    }
+    const doc = parsed;
+    // Accept either the bare draft or the `profile show --json` envelope's draft.
+    const nested = doc.profile?.draft ?? doc.draft;
+    return (nested && typeof nested === 'object' ? nested : doc);
+}
+/**
+ * The CAS revision a state change applies to. Publish, hide and restore act
+ * on whatever the draft is NOW, so reading it immediately before the write is
+ * the intent; a caller holding a specific revision passes it and the server
+ * refuses a stale one.
+ */
+async function currentRevision(publishAs, explicit) {
+    if (explicit !== undefined)
+        return explicit;
+    const { profile } = await data_provider_1.dataService.getStorePublisherProfileEditor(publishAs);
+    return profile.revision;
+}

package/dist/lib/refresh.d.ts

@@ -47,7 +47,7 @@ export interface EnsureFreshCliCredentialResult {
     pair?: TokenPair;
     /** Stable diagnostic code; never contains token or server response text. */
     refreshFailureCode?: string;
-    skippedReason?: 'no_token' | 'ci_token' | 'external_source' | 'env_override' | 'bare_mode' | 'fresh' | 'no_refresh_token' | 'refresh_failed';
+    skippedReason?: 'no_token' | 'ci_token' | 'personal_access_token' | 'external_source' | 'env_override' | 'bare_mode' | 'fresh' | 'no_refresh_token' | 'refresh_failed';
 }
 /**
  * Ensure the active CLI credential has enough remaining lifetime for a

package/dist/lib/refresh.js

@@ -94,7 +94,7 @@ function canMutatePersistedCredential(credential, bareMode) {
         return false;
     if (bareMode)
         return false;
-    if (credential.kind === 'ci')
+    if ((0, auth_core_1.isStaticTokenKind)(credential.kind))
         return false;
     // These sources are operator-owned or generated on demand. Never rotate
     // them into the local keychain/file store behind the operator's back.
@@ -120,6 +120,11 @@ async function ensureFreshCliCredential(opts = {}) {
     if (credential.kind === 'ci') {
         return { credential, refreshed: false, skippedReason: 'ci_token' };
     }
+    // A personal access token is static by construction (OSK-13208): there is
+    // no refresh family behind it, so there is nothing to rotate.
+    if (credential.kind === 'pat') {
+        return { credential, refreshed: false, skippedReason: 'personal_access_token' };
+    }
     if (!canMutatePersistedCredential(credential, Boolean(opts.bareMode))) {
         return { credential, refreshed: false, skippedReason: 'external_source' };
     }

package/dist/lib/ssh-ordered-bytes.d.ts

@@ -0,0 +1,8 @@
+/** A bounded receiver for a retryable SSH byte stream. One frame may be
+ * outstanding. A lost acknowledgment may repeat that exact frame, never its
+ * bytes; an overlapping, changed, or skipped frame is a stream error. */
+export declare class SshOrderedBytes {
+    nextOffset: number;
+    private last?;
+    receive(offset: number, bytes: Buffer, write: (bytes: Buffer) => Promise<void>): Promise<number>;
+}

package/dist/lib/ssh-ordered-bytes.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SshOrderedBytes = void 0;
+/** A bounded receiver for a retryable SSH byte stream. One frame may be
+ * outstanding. A lost acknowledgment may repeat that exact frame, never its
+ * bytes; an overlapping, changed, or skipped frame is a stream error. */
+class SshOrderedBytes {
+    nextOffset = 0;
+    last;
+    receive(offset, bytes, write) {
+        if (!Number.isSafeInteger(offset) || offset < 0 || bytes.length < 1 || bytes.length > 16 * 1024 ||
+            !Number.isSafeInteger(offset + bytes.length)) {
+            return Promise.reject(new Error('invalid SSH stream frame'));
+        }
+        if (this.last?.offset === offset) {
+            return this.last.bytes.equals(bytes)
+                ? this.last.written
+                : Promise.reject(new Error('changed SSH stream replay'));
+        }
+        if (offset !== this.nextOffset)
+            return Promise.reject(new Error('SSH stream offset mismatch'));
+        const retained = Buffer.from(bytes);
+        const written = Promise.resolve().then(() => write(retained)).then(() => {
+            this.nextOffset = offset + retained.length;
+            return this.nextOffset;
+        });
+        this.last = { offset, bytes: retained, written };
+        return written;
+    }
+}
+exports.SshOrderedBytes = SshOrderedBytes;

package/dist/lib/usd-micros.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Parse a user-typed USD amount ("5", "2.50") into integer micros.
+ *
+ * Integer arithmetic on the decimal STRING, never `Number(x) * 1e6`: binary
+ * floating point turns 0.29 into 289999.99… and a money path that truncates
+ * that charges a micro less — or, rounded the other way, a micro more.
+ * Returns null for anything that is not a positive amount with ≤ 2 decimals.
+ */
+export declare function usdToMicros(amount: string): number | null;

package/dist/lib/usd-micros.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.usdToMicros = usdToMicros;
+/**
+ * Parse a user-typed USD amount ("5", "2.50") into integer micros.
+ *
+ * Integer arithmetic on the decimal STRING, never `Number(x) * 1e6`: binary
+ * floating point turns 0.29 into 289999.99… and a money path that truncates
+ * that charges a micro less — or, rounded the other way, a micro more.
+ * Returns null for anything that is not a positive amount with ≤ 2 decimals.
+ */
+function usdToMicros(amount) {
+    const trimmed = amount.trim();
+    if (!/^\d+(\.\d{1,2})?$/.test(trimmed))
+        return null;
+    const [whole, frac = ''] = trimmed.split('.');
+    const cents = Number(whole) * 100 + Number(frac.padEnd(2, '0'));
+    if (!Number.isSafeInteger(cents) || cents <= 0)
+        return null;
+    return cents * 10_000;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -22,7 +22,7 @@
  *  - `access_token`:   broker mode — a short-lived access token from a
  *                      daemon-owned family; nothing durable leaves the daemon.
  */
-export declare const CLI_HANDOFF_MODES: readonly ["refresh_family", "access_token"];
+export declare const CLI_HANDOFF_MODES: readonly ["refresh_family", "access_token", "access_token_dpop"];
 export type CliHandoffMode = (typeof CLI_HANDOFF_MODES)[number];
 /** Broker-mode redeem route on the daemon's loopback server. */
 export declare const CLI_HANDOFF_TOKEN_PATH = "/v1/auth/cli-handoff-token";
@@ -74,10 +74,26 @@ export declare function normalizeHandoffModes(value: unknown): CliHandoffMode[];
  */
 export declare function advertisedHandoffModes(d: CliHandoffDescriptor): CliHandoffMode[];
 export declare function descriptorOffersAccessToken(d: CliHandoffDescriptor): boolean;
+/** True when the token route can serve DPoP-bound tokens (OSK-12020). */
+export declare function descriptorOffersDpop(d: CliHandoffDescriptor): boolean;
 export interface CliHandoffTokenRequest {
     /** Bypass the daemon broker's cached token (the 401-recovery path). */
     forceRefresh?: boolean;
+    /**
+     * The caller can fetch per-request proofs from `CLI_HANDOFF_DPOP_PROOF_PATH`
+     * and wants a DPoP-bound token. Sent only to a descriptor that advertises
+     * `access_token_dpop`; a daemon that does not know the field ignores it and
+     * answers an unbound token, which `tokenType` then says.
+     */
+    dpop?: boolean;
 }
+/**
+ * How the token must be presented. `DPoP` means the token carries `cnf.jkt`
+ * and every request needs a fresh proof; absent or `Bearer` means an ordinary
+ * bearer token. Read from the RESPONSE, never assumed from the request: an
+ * older server ignores the binding request and mints an unbound token.
+ */
+export type CliHandoffTokenType = 'Bearer' | 'DPoP';
 export interface CliHandoffTokenResponse {
     accessToken: string;
     /** Absolute expiry in ms since epoch, when the daemon knows it. */
@@ -85,6 +101,31 @@ export interface CliHandoffTokenResponse {
     /** Server the minted credential belongs to — lets the caller verify it is
      *  about to use a token for the API it thinks it is talking to. */
     serverUrl?: string;
+    tokenType?: CliHandoffTokenType;
 }
 /** Parse the redeem response; null when the token itself is absent. */
 export declare function parseCliHandoffTokenResponse(value: unknown): CliHandoffTokenResponse | null;
+/** The daemon refuses an UNBOUND token because its posture requires binding. */
+export declare const CLI_HANDOFF_ERROR_DPOP_REQUIRED = "HANDOFF_DPOP_REQUIRED";
+/**
+ * The daemon signs RFC 9449 proofs for a bound token with a key that never
+ * leaves it. Same descriptor secret as the token route: using a stolen bound
+ * token therefore needs live loopback access to THIS daemon, which is the
+ * boundary the capability already has.
+ */
+export declare const CLI_HANDOFF_DPOP_PROOF_PATH = "/v1/auth/cli-handoff-dpop-proof";
+/** The oracle refused to sign (bad htm/htu, or `ath` names no token it issued). */
+export declare const CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = "HANDOFF_DPOP_PROOF_REFUSED";
+/** The daemon holds no DPoP key (binding is off on this daemon). */
+export declare const CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = "HANDOFF_DPOP_UNAVAILABLE";
+export interface CliHandoffDpopProofRequest {
+    htm: string;
+    htu: string;
+    /** base64url SHA-256 of the bound access token. The token itself is never
+     *  sent: the oracle commits to a hash, and only to one it issued. */
+    ath: string;
+}
+export interface CliHandoffDpopProofResponse {
+    proof: string;
+}
+export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -18,19 +18,21 @@
  * must produce the full shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
+exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
 exports.parseCliHandoffDescriptor = parseCliHandoffDescriptor;
 exports.normalizeHandoffModes = normalizeHandoffModes;
 exports.advertisedHandoffModes = advertisedHandoffModes;
 exports.descriptorOffersAccessToken = descriptorOffersAccessToken;
+exports.descriptorOffersDpop = descriptorOffersDpop;
 exports.parseCliHandoffTokenResponse = parseCliHandoffTokenResponse;
+exports.parseCliHandoffDpopProofResponse = parseCliHandoffDpopProofResponse;
 /**
  * What a caller may redeem the descriptor secret for.
  *  - `refresh_family`: the legacy durable mint (90-day cli-scope family).
  *  - `access_token`:   broker mode — a short-lived access token from a
  *                      daemon-owned family; nothing durable leaves the daemon.
  */
-exports.CLI_HANDOFF_MODES = ['refresh_family', 'access_token'];
+exports.CLI_HANDOFF_MODES = ['refresh_family', 'access_token', 'access_token_dpop'];
 /** Broker-mode redeem route on the daemon's loopback server. */
 exports.CLI_HANDOFF_TOKEN_PATH = '/v1/auth/cli-handoff-token';
 /** Error codes this contract emits. String literals so both ends compare
@@ -96,7 +98,12 @@ function advertisedHandoffModes(d) {
     return declared.length > 0 ? declared : ['refresh_family'];
 }
 function descriptorOffersAccessToken(d) {
-    return advertisedHandoffModes(d).includes('access_token');
+    const modes = advertisedHandoffModes(d);
+    return modes.includes('access_token') || modes.includes('access_token_dpop');
+}
+/** True when the token route can serve DPoP-bound tokens (OSK-12020). */
+function descriptorOffersDpop(d) {
+    return advertisedHandoffModes(d).includes('access_token_dpop');
 }
 /** Parse the redeem response; null when the token itself is absent. */
 function parseCliHandoffTokenResponse(value) {
@@ -109,5 +116,30 @@ function parseCliHandoffTokenResponse(value) {
         accessToken: v.accessToken,
         ...(typeof v.accessExpiresAt === 'number' ? { accessExpiresAt: v.accessExpiresAt } : {}),
         ...(typeof v.serverUrl === 'string' ? { serverUrl: v.serverUrl } : {}),
+        ...(v.tokenType === 'DPoP' || v.tokenType === 'Bearer' ? { tokenType: v.tokenType } : {}),
     };
 }
+/** The daemon refuses an UNBOUND token because its posture requires binding. */
+exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = 'HANDOFF_DPOP_REQUIRED';
+// ---------------------------------------------------------------------
+// Proof oracle — POST CLI_HANDOFF_DPOP_PROOF_PATH (OSK-12020)
+// ---------------------------------------------------------------------
+/**
+ * The daemon signs RFC 9449 proofs for a bound token with a key that never
+ * leaves it. Same descriptor secret as the token route: using a stolen bound
+ * token therefore needs live loopback access to THIS daemon, which is the
+ * boundary the capability already has.
+ */
+exports.CLI_HANDOFF_DPOP_PROOF_PATH = '/v1/auth/cli-handoff-dpop-proof';
+/** The oracle refused to sign (bad htm/htu, or `ath` names no token it issued). */
+exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = 'HANDOFF_DPOP_PROOF_REFUSED';
+/** The daemon holds no DPoP key (binding is off on this daemon). */
+exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = 'HANDOFF_DPOP_UNAVAILABLE';
+function parseCliHandoffDpopProofResponse(value) {
+    if (value == null || typeof value !== 'object')
+        return null;
+    const v = value;
+    if (typeof v.proof !== 'string' || v.proof.split('.').length !== 3)
+        return null;
+    return { proof: v.proof };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialResolver.d.ts

@@ -13,8 +13,11 @@
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -64,6 +67,12 @@ export interface CredentialResolverOptions {
      * string to use that value directly.
      */
     envTokenOverride?: string | null;
+    /**
+     * Environment variables read by the env-token slot, in precedence order.
+     * Defaults to `['OVERSKY_TOKEN']`. The CLI passes
+     * `['OVERSKY_TOKEN', 'SKRR_TOKEN']` (OSK-13208).
+     */
+    envTokenNames?: readonly string[];
     /** Test/explicit override for `OVERSKY_AUTH_HELPER` env. Same semantics. */
     authHelperPathOverride?: string | null;
     /**
@@ -143,6 +152,8 @@ export interface AuthHelperSentinelInfo {
  *                  (POST /api/daemons/token), MUST NOT schedule refresh,
  *                  and on auth failure exits 75 with a CI-specific error
  *                  rather than writing needs-reauth.json.
+ *   - 'pat'      — personal access token (`osk_pat_*`, OSK-13208): a static
+ *                  bearer used AS the user by the CLI. Never refreshed.
  *   - 'install'  — short-lived web-minted JWT with `scope=daemon-install`.
  *                  The daemon exchanges it through the same /api/daemons/token
  *                  bootstrap path, persists only the returned daemon
@@ -157,9 +168,17 @@ export interface AuthHelperSentinelInfo {
  * The kill switch `OVERSKY_DISABLE_CI_TOKEN_RESOLVER=1` forces every token to
  * `'standard'` for triage purposes.
  */
-export type TokenKind = 'standard' | 'ci' | 'install';
+export type TokenKind = 'standard' | 'ci' | 'install' | 'pat';
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 export declare const CI_TOKEN_PREFIX = "osk_ci_";
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+export declare const PERSONAL_ACCESS_TOKEN_PREFIX = "osk_pat_";
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+export declare function isStaticTokenKind(kind: TokenKind): boolean;
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialResolver.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialResolver = exports.AuthHelperUntrustedError = exports.AuthHelperUnavailableError = exports.CI_TOKEN_PREFIX = exports.CREDENTIAL_PRECEDENCE = void 0;
+exports.CredentialResolver = exports.AuthHelperUntrustedError = exports.AuthHelperUnavailableError = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.CREDENTIAL_PRECEDENCE = void 0;
+exports.isStaticTokenKind = isStaticTokenKind;
 exports.classifyTokenKind = classifyTokenKind;
 exports.__resetCredentialResolverForTest = __resetCredentialResolverForTest;
 exports.invalidateAuthHelperCache = invalidateAuthHelperCache;
@@ -19,8 +20,11 @@ exports.invalidateAuthHelperCache = invalidateAuthHelperCache;
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -68,6 +72,16 @@ exports.CREDENTIAL_PRECEDENCE = [
 ];
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 exports.CI_TOKEN_PREFIX = 'osk_ci_';
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+exports.PERSONAL_ACCESS_TOKEN_PREFIX = 'osk_pat_';
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+function isStaticTokenKind(kind) {
+    return kind === 'ci' || kind === 'pat';
+}
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input
@@ -103,6 +117,8 @@ function classifyTokenKind(token) {
         return 'standard';
     if (token.startsWith(exports.CI_TOKEN_PREFIX))
         return 'ci';
+    if (token.startsWith(exports.PERSONAL_ACCESS_TOKEN_PREFIX))
+        return 'pat';
     const payload = (0, jwtUtils_js_1.decodeJwtPayload)(token);
     if (payload &&
         typeof payload === 'object' &&
@@ -260,8 +276,16 @@ class CredentialResolver {
         if (typeof this.opts.envTokenOverride === 'string') {
             return this.opts.envTokenOverride.length > 0 ? this.opts.envTokenOverride : null;
         }
-        const v = process.env.OVERSKY_TOKEN;
-        return typeof v === 'string' && v.length > 0 ? v : null;
+        // `OVERSKY_TOKEN` first (retained by decision, docs/product/skrr-env-inventory.md),
+        // then any renamed spelling the caller opted into (`SKRR_TOKEN` for the CLI,
+        // OSK-13208). The daemon does not opt in: a CI job that sets `SKRR_TOKEN`
+        // for `skrr` must not have a co-located `skrrd` silently adopt it.
+        for (const name of this.opts.envTokenNames ?? ['OVERSKY_TOKEN']) {
+            const v = process.env[name];
+            if (typeof v === 'string' && v.length > 0)
+                return v;
+        }
+        return null;
     }
     async tryResolveAuthHelper() {
         let helperPath;