@skrr-ai/cli 0.1.79 → 0.1.81

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -16,7 +16,7 @@ export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefr
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';
 export { readAuthFromFd, __setFdReaderForTest, type FdAuthPayload } from './fdToken.js';
-export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
+export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, PERSONAL_ACCESS_TOKEN_PREFIX, isStaticTokenKind, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
 export { invokeAuthHelper, getDefaultHelperTtlMs, getLastAuthHelperFailureReason, __resetAuthHelperFailureReasonForTest, SENTINEL_TRIGGERING_FAILURES, type HelperResult, type InvokeAuthHelperOptions, type AuthHelperFailureReason, } from './authHelper.js';
 export { runHeadersHelper, invalidateHeadersHelperCache, type RunHeadersHelperOptions, } from './headers-helper.js';
 export { generateVerifier, challenge, generateState, safeEqual, verifyChallenge, type PkceChallengeMethod, } from './pkce.js';
@@ -27,6 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -22,11 +22,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
-exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = void 0;
+exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
+exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
+exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
+exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -109,6 +109,8 @@ Object.defineProperty(exports, "__resetCredentialResolverForTest", { enumerable:
 Object.defineProperty(exports, "invalidateAuthHelperCache", { enumerable: true, get: function () { return credentialResolver_js_1.invalidateAuthHelperCache; } });
 Object.defineProperty(exports, "classifyTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.classifyTokenKind; } });
 Object.defineProperty(exports, "CI_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.CI_TOKEN_PREFIX; } });
+Object.defineProperty(exports, "PERSONAL_ACCESS_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.PERSONAL_ACCESS_TOKEN_PREFIX; } });
+Object.defineProperty(exports, "isStaticTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.isStaticTokenKind; } });
 // L6.1 / L6.3 — fail-closed errors thrown by the auth-helper slot.
 Object.defineProperty(exports, "AuthHelperUntrustedError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUntrustedError; } });
 Object.defineProperty(exports, "AuthHelperUnavailableError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUnavailableError; } });
@@ -222,6 +224,22 @@ Object.defineProperty(exports, "normalizeHtu", { enumerable: true, get: function
 Object.defineProperty(exports, "publicJwkFromX", { enumerable: true, get: function () { return deviceKey_js_1.publicJwkFromX; } });
 Object.defineProperty(exports, "tokenHash", { enumerable: true, get: function () { return deviceKey_js_1.tokenHash; } });
 Object.defineProperty(exports, "verifyDeviceProof", { enumerable: true, get: function () { return deviceKey_js_1.verifyProof; } });
+// OSK-12020 — RFC 9449 access-token binding (`cnf.jkt` + `DPoP` proof). A
+// different protocol from the device proof above (`typ: dpop+jwt`, header
+// `DPoP`), signed by a dedicated in-memory key the daemon holds.
+var dpop_js_1 = require("./dpop.js");
+Object.defineProperty(exports, "DPOP_HEADER", { enumerable: true, get: function () { return dpop_js_1.DPOP_HEADER; } });
+Object.defineProperty(exports, "DPOP_MAX_AGE_SECONDS", { enumerable: true, get: function () { return dpop_js_1.DPOP_MAX_AGE_SECONDS; } });
+Object.defineProperty(exports, "DPOP_PROOF_INVALID", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_INVALID; } });
+Object.defineProperty(exports, "DPOP_PROOF_REQUIRED", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_REQUIRED; } });
+Object.defineProperty(exports, "DPOP_PROOF_TYP", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_TYP; } });
+Object.defineProperty(exports, "DPOP_PROOF_VERIFY_UNAVAILABLE", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_VERIFY_UNAVAILABLE; } });
+Object.defineProperty(exports, "accessTokenHash", { enumerable: true, get: function () { return dpop_js_1.accessTokenHash; } });
+Object.defineProperty(exports, "createDpopKey", { enumerable: true, get: function () { return dpop_js_1.createDpopKey; } });
+Object.defineProperty(exports, "isAth", { enumerable: true, get: function () { return dpop_js_1.isAth; } });
+Object.defineProperty(exports, "isJwkThumbprint", { enumerable: true, get: function () { return dpop_js_1.isJwkThumbprint; } });
+Object.defineProperty(exports, "normalizeDpopHtu", { enumerable: true, get: function () { return dpop_js_1.normalizeDpopHtu; } });
+Object.defineProperty(exports, "verifyDpopProof", { enumerable: true, get: function () { return dpop_js_1.verifyDpopProof; } });
 // L11/L12 — composed runtime: init, transforms, sign, enroll, locks.
 // Daemon and CLI consume these; the underlying primitives live above.
 var credentialEnvelopeBridge_js_1 = require("./credentialEnvelopeBridge.js");

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.d.ts

@@ -22,7 +22,7 @@
  *  - `access_token`:   broker mode — a short-lived access token from a
  *                      daemon-owned family; nothing durable leaves the daemon.
  */
-export declare const CLI_HANDOFF_MODES: readonly ["refresh_family", "access_token"];
+export declare const CLI_HANDOFF_MODES: readonly ["refresh_family", "access_token", "access_token_dpop"];
 export type CliHandoffMode = (typeof CLI_HANDOFF_MODES)[number];
 /** Broker-mode redeem route on the daemon's loopback server. */
 export declare const CLI_HANDOFF_TOKEN_PATH = "/v1/auth/cli-handoff-token";
@@ -74,10 +74,26 @@ export declare function normalizeHandoffModes(value: unknown): CliHandoffMode[];
  */
 export declare function advertisedHandoffModes(d: CliHandoffDescriptor): CliHandoffMode[];
 export declare function descriptorOffersAccessToken(d: CliHandoffDescriptor): boolean;
+/** True when the token route can serve DPoP-bound tokens (OSK-12020). */
+export declare function descriptorOffersDpop(d: CliHandoffDescriptor): boolean;
 export interface CliHandoffTokenRequest {
     /** Bypass the daemon broker's cached token (the 401-recovery path). */
     forceRefresh?: boolean;
+    /**
+     * The caller can fetch per-request proofs from `CLI_HANDOFF_DPOP_PROOF_PATH`
+     * and wants a DPoP-bound token. Sent only to a descriptor that advertises
+     * `access_token_dpop`; a daemon that does not know the field ignores it and
+     * answers an unbound token, which `tokenType` then says.
+     */
+    dpop?: boolean;
 }
+/**
+ * How the token must be presented. `DPoP` means the token carries `cnf.jkt`
+ * and every request needs a fresh proof; absent or `Bearer` means an ordinary
+ * bearer token. Read from the RESPONSE, never assumed from the request: an
+ * older server ignores the binding request and mints an unbound token.
+ */
+export type CliHandoffTokenType = 'Bearer' | 'DPoP';
 export interface CliHandoffTokenResponse {
     accessToken: string;
     /** Absolute expiry in ms since epoch, when the daemon knows it. */
@@ -85,6 +101,31 @@ export interface CliHandoffTokenResponse {
     /** Server the minted credential belongs to — lets the caller verify it is
      *  about to use a token for the API it thinks it is talking to. */
     serverUrl?: string;
+    tokenType?: CliHandoffTokenType;
 }
 /** Parse the redeem response; null when the token itself is absent. */
 export declare function parseCliHandoffTokenResponse(value: unknown): CliHandoffTokenResponse | null;
+/** The daemon refuses an UNBOUND token because its posture requires binding. */
+export declare const CLI_HANDOFF_ERROR_DPOP_REQUIRED = "HANDOFF_DPOP_REQUIRED";
+/**
+ * The daemon signs RFC 9449 proofs for a bound token with a key that never
+ * leaves it. Same descriptor secret as the token route: using a stolen bound
+ * token therefore needs live loopback access to THIS daemon, which is the
+ * boundary the capability already has.
+ */
+export declare const CLI_HANDOFF_DPOP_PROOF_PATH = "/v1/auth/cli-handoff-dpop-proof";
+/** The oracle refused to sign (bad htm/htu, or `ath` names no token it issued). */
+export declare const CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = "HANDOFF_DPOP_PROOF_REFUSED";
+/** The daemon holds no DPoP key (binding is off on this daemon). */
+export declare const CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = "HANDOFF_DPOP_UNAVAILABLE";
+export interface CliHandoffDpopProofRequest {
+    htm: string;
+    htu: string;
+    /** base64url SHA-256 of the bound access token. The token itself is never
+     *  sent: the oracle commits to a hash, and only to one it issued. */
+    ath: string;
+}
+export interface CliHandoffDpopProofResponse {
+    proof: string;
+}
+export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.js

@@ -22,7 +22,7 @@
  *  - `access_token`:   broker mode — a short-lived access token from a
  *                      daemon-owned family; nothing durable leaves the daemon.
  */
-export const CLI_HANDOFF_MODES = ['refresh_family', 'access_token'];
+export const CLI_HANDOFF_MODES = ['refresh_family', 'access_token', 'access_token_dpop'];
 /** Broker-mode redeem route on the daemon's loopback server. */
 export const CLI_HANDOFF_TOKEN_PATH = '/v1/auth/cli-handoff-token';
 /** Error codes this contract emits. String literals so both ends compare
@@ -88,7 +88,12 @@ export function advertisedHandoffModes(d) {
     return declared.length > 0 ? declared : ['refresh_family'];
 }
 export function descriptorOffersAccessToken(d) {
-    return advertisedHandoffModes(d).includes('access_token');
+    const modes = advertisedHandoffModes(d);
+    return modes.includes('access_token') || modes.includes('access_token_dpop');
+}
+/** True when the token route can serve DPoP-bound tokens (OSK-12020). */
+export function descriptorOffersDpop(d) {
+    return advertisedHandoffModes(d).includes('access_token_dpop');
 }
 /** Parse the redeem response; null when the token itself is absent. */
 export function parseCliHandoffTokenResponse(value) {
@@ -101,5 +106,30 @@ export function parseCliHandoffTokenResponse(value) {
         accessToken: v.accessToken,
         ...(typeof v.accessExpiresAt === 'number' ? { accessExpiresAt: v.accessExpiresAt } : {}),
         ...(typeof v.serverUrl === 'string' ? { serverUrl: v.serverUrl } : {}),
+        ...(v.tokenType === 'DPoP' || v.tokenType === 'Bearer' ? { tokenType: v.tokenType } : {}),
     };
 }
+/** The daemon refuses an UNBOUND token because its posture requires binding. */
+export const CLI_HANDOFF_ERROR_DPOP_REQUIRED = 'HANDOFF_DPOP_REQUIRED';
+// ---------------------------------------------------------------------
+// Proof oracle — POST CLI_HANDOFF_DPOP_PROOF_PATH (OSK-12020)
+// ---------------------------------------------------------------------
+/**
+ * The daemon signs RFC 9449 proofs for a bound token with a key that never
+ * leaves it. Same descriptor secret as the token route: using a stolen bound
+ * token therefore needs live loopback access to THIS daemon, which is the
+ * boundary the capability already has.
+ */
+export const CLI_HANDOFF_DPOP_PROOF_PATH = '/v1/auth/cli-handoff-dpop-proof';
+/** The oracle refused to sign (bad htm/htu, or `ath` names no token it issued). */
+export const CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = 'HANDOFF_DPOP_PROOF_REFUSED';
+/** The daemon holds no DPoP key (binding is off on this daemon). */
+export const CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = 'HANDOFF_DPOP_UNAVAILABLE';
+export function parseCliHandoffDpopProofResponse(value) {
+    if (value == null || typeof value !== 'object')
+        return null;
+    const v = value;
+    if (typeof v.proof !== 'string' || v.proof.split('.').length !== 3)
+        return null;
+    return { proof: v.proof };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialResolver.d.ts

@@ -13,8 +13,11 @@
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -64,6 +67,12 @@ export interface CredentialResolverOptions {
      * string to use that value directly.
      */
     envTokenOverride?: string | null;
+    /**
+     * Environment variables read by the env-token slot, in precedence order.
+     * Defaults to `['OVERSKY_TOKEN']`. The CLI passes
+     * `['OVERSKY_TOKEN', 'SKRR_TOKEN']` (OSK-13208).
+     */
+    envTokenNames?: readonly string[];
     /** Test/explicit override for `OVERSKY_AUTH_HELPER` env. Same semantics. */
     authHelperPathOverride?: string | null;
     /**
@@ -143,6 +152,8 @@ export interface AuthHelperSentinelInfo {
  *                  (POST /api/daemons/token), MUST NOT schedule refresh,
  *                  and on auth failure exits 75 with a CI-specific error
  *                  rather than writing needs-reauth.json.
+ *   - 'pat'      — personal access token (`osk_pat_*`, OSK-13208): a static
+ *                  bearer used AS the user by the CLI. Never refreshed.
  *   - 'install'  — short-lived web-minted JWT with `scope=daemon-install`.
  *                  The daemon exchanges it through the same /api/daemons/token
  *                  bootstrap path, persists only the returned daemon
@@ -157,9 +168,17 @@ export interface AuthHelperSentinelInfo {
  * The kill switch `OVERSKY_DISABLE_CI_TOKEN_RESOLVER=1` forces every token to
  * `'standard'` for triage purposes.
  */
-export type TokenKind = 'standard' | 'ci' | 'install';
+export type TokenKind = 'standard' | 'ci' | 'install' | 'pat';
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 export declare const CI_TOKEN_PREFIX = "osk_ci_";
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+export declare const PERSONAL_ACCESS_TOKEN_PREFIX = "osk_pat_";
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+export declare function isStaticTokenKind(kind: TokenKind): boolean;
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialResolver.js

@@ -13,8 +13,11 @@
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -62,6 +65,16 @@ export const CREDENTIAL_PRECEDENCE = [
 ];
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 export const CI_TOKEN_PREFIX = 'osk_ci_';
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+export const PERSONAL_ACCESS_TOKEN_PREFIX = 'osk_pat_';
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+export function isStaticTokenKind(kind) {
+    return kind === 'ci' || kind === 'pat';
+}
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input
@@ -97,6 +110,8 @@ export function classifyTokenKind(token) {
         return 'standard';
     if (token.startsWith(CI_TOKEN_PREFIX))
         return 'ci';
+    if (token.startsWith(PERSONAL_ACCESS_TOKEN_PREFIX))
+        return 'pat';
     const payload = decodeJwtPayload(token);
     if (payload &&
         typeof payload === 'object' &&
@@ -252,8 +267,16 @@ export class CredentialResolver {
         if (typeof this.opts.envTokenOverride === 'string') {
             return this.opts.envTokenOverride.length > 0 ? this.opts.envTokenOverride : null;
         }
-        const v = process.env.OVERSKY_TOKEN;
-        return typeof v === 'string' && v.length > 0 ? v : null;
+        // `OVERSKY_TOKEN` first (retained by decision, docs/product/skrr-env-inventory.md),
+        // then any renamed spelling the caller opted into (`SKRR_TOKEN` for the CLI,
+        // OSK-13208). The daemon does not opt in: a CI job that sets `SKRR_TOKEN`
+        // for `skrr` must not have a co-located `skrrd` silently adopt it.
+        for (const name of this.opts.envTokenNames ?? ['OVERSKY_TOKEN']) {
+            const v = process.env[name];
+            if (typeof v === 'string' && v.length > 0)
+                return v;
+        }
+        return null;
     }
     async tryResolveAuthHelper() {
         let helperPath;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialSession.d.ts

@@ -13,6 +13,20 @@
  * Deliberately thin: no persistence, no retry policy, no logging. Callers
  * own their store and their error surfaces; this owns the cache/single-
  * flight/invalidate invariants so they cannot drift between surfaces.
+ *
+ * Two policies are options because mechanisms genuinely need different ones,
+ * and both default to the original behaviour:
+ *
+ *   - `forcedAcquire: 'join'` — a forced acquire joins whatever is in flight,
+ *     for a mechanism where a second concurrent renewal is itself the hazard
+ *     (a refresh-family rotation or a family mint);
+ *   - `classifyAcquireError` — stale-on-degrade: a TRANSIENT failure serves the
+ *     still-unexpired cached credential instead of failing, a PERMANENT one
+ *     drops it.
+ *
+ * Mechanism-specific limits — how often a new family may be minted, which
+ * failures retire it — stay in the mechanism. The daemon's task token broker
+ * (`daemon/src/task/token-broker.ts`) is the consumer that uses both options.
  */
 /** What an acquire returns. `expiresAtMs` absent means "no known expiry" —
  *  the token is served until `invalidate()` or an acquire replaces it. */
@@ -26,13 +40,45 @@ export interface CredentialSessionOptions {
      * The mechanism. Called with `forceRefresh: true` when the caller asked to
      * bypass the cache (the 401-recovery path) — implementations should renew
      * rather than serve their own cache. A rejected promise propagates to every
-     * waiter and is never cached.
+     * waiter and is never cached (`classifyAcquireError` is the one way a waiter
+     * can be served the previous credential instead).
      */
     acquire: (forceRefresh: boolean) => Promise<AcquiredCredential>;
     /** Serve the cached token until this many ms before expiry. Default 30s. */
     skewMs?: number;
     /** Injectable clock for tests. */
     now?: () => number;
+    /**
+     * What a forced acquire does when an acquire is already in flight.
+     *
+     *   - `'supersede'` (default): a forced acquire never joins a NON-forced
+     *     in-flight one — that could serve the very credential a 401 just
+     *     invalidated — so it starts a second operation, and the superseded one
+     *     cannot write its result back. Right for a mechanism whose plain
+     *     acquire may serve its own cache.
+     *   - `'join'`: every acquire, forced or not, joins the one in flight. Right
+     *     — and required — for a mechanism whose acquire ALWAYS renews (it never
+     *     serves a cache of its own), and for which a second concurrent renewal
+     *     is itself the hazard: a rotation that burns a refresh family, a mint
+     *     that creates a new one. Whatever is in flight was started after the
+     *     credential being replaced was issued, so its result is not that
+     *     credential.
+     */
+    forcedAcquire?: 'supersede' | 'join';
+    /**
+     * Classify an acquire failure. Without it every failure propagates and the
+     * cache is left as it was (the default).
+     *
+     *   - `'transient'` — the renewal failed but the cached credential is still
+     *     good: a waiter is served the cached token while it is inside its HARD
+     *     expiry (the skew window only says when to start renewing), instead of
+     *     the error. Nothing stale is served after `invalidate()`, after a forced
+     *     acquire discarded it, or once it has actually expired.
+     *   - `'permanent'` — the credential is dead upstream: the cache is dropped
+     *     and the error propagates.
+     *   - `undefined` — not classified: the default behaviour.
+     */
+    classifyAcquireError?: (err: unknown) => 'transient' | 'permanent' | undefined;
 }
 export interface CredentialSession {
     /**
@@ -41,6 +87,8 @@ export interface CredentialSession {
      * discards the cache first (use after a resource 401).
      */
     getToken(forceRefresh?: boolean): Promise<string>;
+    /** Same as getToken, but resolves the whole credential (with its expiry). */
+    getCredential(forceRefresh?: boolean): Promise<AcquiredCredential>;
     /** Drop the cached token; the next getToken() acquires. */
     invalidate(): void;
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialSession.js

@@ -13,11 +13,27 @@
  * Deliberately thin: no persistence, no retry policy, no logging. Callers
  * own their store and their error surfaces; this owns the cache/single-
  * flight/invalidate invariants so they cannot drift between surfaces.
+ *
+ * Two policies are options because mechanisms genuinely need different ones,
+ * and both default to the original behaviour:
+ *
+ *   - `forcedAcquire: 'join'` — a forced acquire joins whatever is in flight,
+ *     for a mechanism where a second concurrent renewal is itself the hazard
+ *     (a refresh-family rotation or a family mint);
+ *   - `classifyAcquireError` — stale-on-degrade: a TRANSIENT failure serves the
+ *     still-unexpired cached credential instead of failing, a PERMANENT one
+ *     drops it.
+ *
+ * Mechanism-specific limits — how often a new family may be minted, which
+ * failures retire it — stay in the mechanism. The daemon's task token broker
+ * (`daemon/src/task/token-broker.ts`) is the consumer that uses both options.
  */
 const DEFAULT_SKEW_MS = 30_000;
 export function createCredentialSession(opts) {
     const skewMs = opts.skewMs ?? DEFAULT_SKEW_MS;
     const now = opts.now ?? Date.now;
+    const forcedJoins = opts.forcedAcquire === 'join';
+    const classify = opts.classifyAcquireError;
     let cached = null;
     let inFlight = null;
     let inFlightForced = false;
@@ -26,17 +42,26 @@ export function createCredentialSession(opts) {
     // result back over the newer one.
     let generation = 0;
     const fresh = (t) => t.expiresAtMs == null || now() < t.expiresAtMs - skewMs;
+    /** Not yet actually expired — the bar for serving a stale credential. */
+    const unexpired = (t) => t.expiresAtMs == null || now() < t.expiresAtMs;
     const acquireShared = (force) => {
-        // A forced acquire must not join a non-forced in-flight one — that would
-        // serve the very credential a 401 just invalidated. A forced in-flight
-        // DOES satisfy non-forced waiters: it is already renewing.
-        if (inFlight && (inFlightForced || !force))
+        // Under 'supersede', a forced acquire must not join a non-forced in-flight
+        // one — that would serve the very credential a 401 just invalidated. A
+        // forced in-flight DOES satisfy non-forced waiters: it is already renewing.
+        // Under 'join', everything joins (see `forcedAcquire`).
+        if (inFlight && (forcedJoins || inFlightForced || !force))
             return inFlight;
         const gen = ++generation;
         const p = opts.acquire(force).then((t) => {
             if (gen === generation)
                 cached = t;
             return t;
+        }, (err) => {
+            // Settled before any waiter resumes, so a waiter's stale check below
+            // already sees a permanent failure's dropped cache.
+            if (gen === generation && classify?.(err) === 'permanent')
+                cached = null;
+            throw err;
         });
         inFlight = p;
         inFlightForced = force;
@@ -51,13 +76,26 @@ export function createCredentialSession(opts) {
         p.then(cleanup, cleanup);
         return p;
     };
+    const getCredential = async (forceRefresh = false) => {
+        if (forceRefresh)
+            cached = null;
+        if (cached && fresh(cached))
+            return cached;
+        try {
+            return await acquireShared(forceRefresh);
+        }
+        catch (err) {
+            // Stale-on-degrade: read `cached` AFTER the failure, so an invalidate()
+            // or a forced discard that happened meanwhile is honoured.
+            if (classify?.(err) === 'transient' && cached && unexpired(cached))
+                return cached;
+            throw err;
+        }
+    };
     return {
+        getCredential,
         async getToken(forceRefresh = false) {
-            if (forceRefresh)
-                cached = null;
-            if (cached && fresh(cached))
-                return cached.accessToken;
-            return (await acquireShared(forceRefresh)).accessToken;
+            return (await getCredential(forceRefresh)).accessToken;
         },
         invalidate() {
             cached = null;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -38,7 +38,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  * Order:
  *   1. Try to load existing keypair from disk.
  *      - Success → state = active.
- *      - Missing files / corruption / decrypt failure → step 2.
+ *      - No key material at all (first install) → step 2.
+ *      - Key material present but unloadable (corruption, decrypt failure,
+ *        public/private mismatch) → disabled+unreadable_key and a
+ *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
+ *        an explicit interactive login sets it, because that login proves and
+ *        re-pins the new key; replacing it on ordinary boot would sign the
+ *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -335,7 +335,13 @@ async function consolidateDeviceIdentity(profile) {
  * Order:
  *   1. Try to load existing keypair from disk.
  *      - Success → state = active.
- *      - Missing files / corruption / decrypt failure → step 2.
+ *      - No key material at all (first install) → step 2.
+ *      - Key material present but unloadable (corruption, decrypt failure,
+ *        public/private mismatch) → disabled+unreadable_key and a
+ *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
+ *        an explicit interactive login sets it, because that login proves and
+ *        re-pins the new key; replacing it on ordinary boot would sign the
+ *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceKey.d.ts

@@ -1,3 +1,40 @@
+/**
+ * deviceKey.ts — L11 Phase 1: Ed25519 device identity + DPoP-style proofs.
+ *
+ * The load-bearing recommendation in `docs/daemon-auth-cc-deep-comparison-
+ * 2026-04-24.md` §L11. Two-axis identity:
+ *
+ *   user identity  = OAuth refresh token  (server-rotated, scope-pinned, reuse-detected)
+ *   device identity = Ed25519 keypair      (device-generated, server-revocable)
+ *
+ * Every daemon→server request carries a JWS signature over
+ * `{htm, htu, iat, jti, rth?, ath?}` using the device key. Server validates
+ * against the public key registered for this daemon.
+ *
+ * Stolen credentials require BOTH halves:
+ *   - refresh token alone is useless without the device key
+ *   - device key alone is useless without the refresh token
+ *
+ * Why DPoP-shaped (RFC 9449) rather than rolling our own JWS:
+ *   - The htm/htu/iat/jti/ath claim set is well-studied. Server-side
+ *     replay defenses, clock-skew handling, and audit-trail formats all
+ *     have a body of prior art to copy from.
+ *   - Future interop: if we ever expose OverSky as a third-party OAuth
+ *     resource server, DPoP-bearer is the way clients will already
+ *     understand.
+ *
+ * Why we extend with `rth` (refresh-token-hash):
+ *   - RFC 9449 only mints `ath` (access-token-hash). The whole point of
+ *     L11 is to bind the *refresh* token to the device, so the proof
+ *     accompanying a refresh request must commit to the refresh token.
+ *     `rth` is structurally identical to `ath`; the name disambiguates.
+ *
+ * What this module is NOT responsible for:
+ *   - Persistence (lives in `daemon/src/deviceIdentity.ts`).
+ *   - Server-side public-key registration (separate API in a later PR).
+ *   - Wire-up to the daemon's outgoing HTTP path (Phase 2 of L11).
+ */
+import crypto from 'node:crypto';
 /**
  * Ed25519 JSON Web Key — RFC 8037 §2 ("Key Type 'OKP'").
  *
@@ -123,6 +160,18 @@ export interface BuildProofOptions {
  * not a silent fallback.
  */
 export declare function buildProof(privateJwk: Ed25519PrivateJwk, publicJwk: Ed25519PublicJwk, opts: BuildProofOptions): string;
+/** The header `typ` of an OverSky device-identity proof. */
+export declare const DEVICE_PROOF_TYP = "oversky-dpop+jwt";
+/**
+ * Sign a DPoP-shaped proof with an Ed25519 key under the given header `typ`.
+ *
+ * @internal Shared by the device-identity proof (`oversky-dpop+jwt`, above)
+ * and the RFC 9449 access-token proof (`dpop+jwt`, `dpop.ts`). `typ` is the
+ * only thing on the wire that separates the two protocols, which is why it is
+ * a required argument rather than a default: a proof signed for one must
+ * never verify as the other.
+ */
+export declare function signEd25519Proof(privateKey: crypto.KeyObject, publicJwk: Ed25519PublicJwk, typ: string, opts: BuildProofOptions): string;
 export type VerifyFailureReason = 'malformed' | 'bad_alg' | 'bad_typ' | 'bad_jwk' | 'sig_invalid' | 'iat_old' | 'iat_future' | 'htm_mismatch' | 'htu_mismatch' | 'rth_mismatch' | 'ath_mismatch' | 'pin_mismatch';
 export interface VerifySuccess {
     valid: true;
@@ -165,3 +214,10 @@ export interface VerifyOptions {
  * `sig_invalid` to keep the failure surface narrow.
  */
 export declare function verifyProof(jws: string, opts?: VerifyOptions): VerifySuccess | VerifyFailure;
+/**
+ * Verify a DPoP-shaped Ed25519 proof whose header `typ` must equal `typ`.
+ *
+ * @internal See `signEd25519Proof`. `verifyProof` (device identity) and
+ * `verifyDpopProof` (`dpop.ts`, RFC 9449) are the two public doors.
+ */
+export declare function verifyEd25519Proof(jws: string, opts: VerifyOptions, typ: string): VerifySuccess | VerifyFailure;