@koed-labs/server 0.0.0-bootstrap.0 → 0.10.3

package/vendor/chunk-UI5RLBKQ.js

@@ -0,0 +1,30 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+
+// packages/koed-server/dist/runtime-artifact-source.js
+import { resolve } from "node:path";
+var runtimeProcess = process;
+var trimRuntimeValue = (value) => {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+};
+var isPackagedRuntimeMode = (environment = process.env) => environment.KOED_PACKAGED_DESKTOP === "1";
+var allowsPackagedSourceFallback = (environment = process.env) => environment.KOED_ALLOW_PACKAGED_SOURCE_FALLBACK === "1";
+var canUseSourceCheckoutFallback = (environment = process.env) => !isPackagedRuntimeMode(environment) || allowsPackagedSourceFallback(environment);
+var resolvePackagedResourcesPath = (environment = process.env) => {
+  const explicit = trimRuntimeValue(environment.KOED_PACKAGED_RESOURCES_PATH);
+  if (explicit) {
+    return resolve(explicit);
+  }
+  return runtimeProcess.resourcesPath ? resolve(runtimeProcess.resourcesPath) : void 0;
+};
+var resolvePackagedKoedRuntimeRoot = (environment = process.env) => {
+  const resourcesPath = resolvePackagedResourcesPath(environment);
+  return resourcesPath ? resolve(resourcesPath, "koed-runtime") : void 0;
+};
+
+export {
+  isPackagedRuntimeMode,
+  canUseSourceCheckoutFallback,
+  resolvePackagedResourcesPath,
+  resolvePackagedKoedRuntimeRoot
+};

package/vendor/chunk-VPC5NLZG.js

@@ -0,0 +1,259 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  PINNED_PRIVACY_MODEL_FILES,
+  PINNED_PRIVACY_MODEL_ID,
+  PINNED_PRIVACY_MODEL_REVISION
+} from "./chunk-473OA62O.js";
+
+// packages/koed-server/dist/privacy-model-runtime.js
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, createWriteStream, existsSync, linkSync, lstatSync, mkdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { setTimeout as delay } from "node:timers/promises";
+var PRIVACY_MODEL_ID = PINNED_PRIVACY_MODEL_ID;
+var PRIVACY_MODEL_REVISION = PINNED_PRIVACY_MODEL_REVISION;
+var PRIVACY_MODEL_FILES = PINNED_PRIVACY_MODEL_FILES;
+var resolvePrivacyModelPaths = (paths) => ({
+  blobsDir: resolve(paths.modelsDir, "privacy", "blobs", "sha256"),
+  cacheDir: resolve(paths.modelsDir, "privacy", "transformers-cache")
+});
+var cachePath = (paths, file) => resolve(paths.cacheDir, PRIVACY_MODEL_ID, PRIVACY_MODEL_REVISION, file.path);
+var blobPath = (paths, file) => resolve(paths.blobsDir, file.sha256);
+var isSameFile = (left, right) => {
+  try {
+    const leftStat = statSync(left);
+    const rightStat = lstatSync(right);
+    return rightStat.isFile() && leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+};
+var materializePrivacyModelCacheEntry = (blob, target) => {
+  if (isSameFile(blob, target))
+    return;
+  rmSync(target, { force: true });
+  try {
+    linkSync(blob, target);
+  } catch (error) {
+    if (error.code === "EEXIST" && isSameFile(blob, target)) {
+      return;
+    }
+    throw error;
+  }
+};
+var sha256File = async (path, signal) => {
+  const hash = createHash("sha256");
+  await pipeline(createReadStream(path), hash, signal ? { signal } : {});
+  return hash.digest("hex");
+};
+var materializeCacheEntry = (paths, file) => {
+  const target = cachePath(paths, file);
+  mkdirSync(dirname(target), { recursive: true, mode: 448 });
+  materializePrivacyModelCacheEntry(blobPath(paths, file), target);
+};
+var retryableTransferError = (error) => {
+  if (error instanceof TypeError)
+    return true;
+  const code = error?.code;
+  return [
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ETIMEDOUT",
+    "EAI_AGAIN",
+    "UND_ERR_SOCKET",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_BODY_TIMEOUT"
+  ].includes(code ?? "");
+};
+var downloadPrivacyAsset = async (file, temporary, fetcher, options) => {
+  const url = `https://huggingface.co/${PRIVACY_MODEL_ID}/resolve/${PRIVACY_MODEL_REVISION}/${file.path}`;
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    options.signal?.throwIfAborted();
+    rmSync(temporary, { force: true });
+    const idle = new AbortController();
+    let idleTimer;
+    const activity = () => {
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => idle.abort(new Error("Privacy model transfer stalled.")), 3e4);
+    };
+    activity();
+    const signal = options.signal ? AbortSignal.any([options.signal, idle.signal]) : idle.signal;
+    try {
+      const response = await fetcher(url, { signal });
+      if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        const retryAfter = response.headers.get("retry-after");
+        const seconds = retryAfter === null ? NaN : Number(retryAfter);
+        const requestedDelay = retryAfter === null ? NaN : Number.isFinite(seconds) ? seconds * 1e3 : Date.parse(retryAfter) - Date.now();
+        const retryDelay = Number.isFinite(requestedDelay) ? Math.max(0, requestedDelay) : 250 * attempt;
+        if (attempt < 3 && retryDelay <= 3e4 && (response.status === 408 || response.status === 429 || response.status >= 500)) {
+          clearTimeout(idleTimer);
+          await delay(retryDelay, void 0, options.signal ? { signal: options.signal } : {});
+          continue;
+        }
+        return response.status;
+      }
+      let transferredBytes = 0;
+      let lastProgressAt = 0;
+      const headerSize = Number(response.headers.get("content-length"));
+      const totalBytes = file.size ?? (Number.isSafeInteger(headerSize) && headerSize > 0 ? headerSize : void 0);
+      options.progress?.({
+        phase: "model-download",
+        transferredBytes,
+        ...totalBytes === void 0 ? {} : { totalBytes },
+        file: file.path
+      });
+      const monitor = new Transform({
+        transform(chunk, _encoding, callback) {
+          activity();
+          transferredBytes += chunk.length;
+          if (Date.now() - lastProgressAt >= 100) {
+            options.progress?.({
+              phase: "model-download",
+              transferredBytes,
+              ...totalBytes === void 0 ? {} : { totalBytes },
+              file: file.path
+            });
+            lastProgressAt = Date.now();
+          }
+          callback(null, chunk);
+        }
+      });
+      await pipeline(Readable.fromWeb(response.body), monitor, createWriteStream(temporary, { mode: 384 }), { signal });
+      options.progress?.({
+        phase: "model-download",
+        transferredBytes,
+        ...totalBytes === void 0 ? {} : { totalBytes },
+        file: file.path
+      });
+      return void 0;
+    } catch (error) {
+      rmSync(temporary, { force: true });
+      options.signal?.throwIfAborted();
+      if (!idle.signal.aborted && !retryableTransferError(error))
+        throw error;
+      if (attempt === 3) {
+        throw new Error(`Could not download pinned Privacy Filter model asset ${file.path}: transfer failed after ${attempt} attempts.`, { cause: error });
+      }
+      clearTimeout(idleTimer);
+      await delay(250 * attempt, void 0, options.signal ? { signal: options.signal } : {});
+    } finally {
+      clearTimeout(idleTimer);
+    }
+  }
+  throw new Error("Privacy Filter model transfer did not complete.");
+};
+var collectPrivacyModelStatus = async (serverPaths, signal) => {
+  const paths = resolvePrivacyModelPaths(serverPaths);
+  const files = [];
+  for (const file of PRIVACY_MODEL_FILES) {
+    signal?.throwIfAborted();
+    const blob = blobPath(paths, file);
+    if (!existsSync(blob)) {
+      return {
+        ok: false,
+        state: "missing",
+        message: `Pinned Privacy Filter model asset is missing: ${file.path}.`,
+        action: "Run koed models install --kind privacy.",
+        modelPath: paths.cacheDir,
+        files
+      };
+    }
+    const sizeBytes = statSync(blob).size;
+    const actual = await sha256File(blob, signal);
+    files.push({ path: file.path, sha256: actual, sizeBytes });
+    if (actual !== file.sha256 || file.size !== void 0 && sizeBytes !== file.size) {
+      return {
+        ok: false,
+        state: "checksum_mismatch",
+        message: `Pinned Privacy Filter model asset failed verification: ${file.path}.`,
+        action: "Run koed models install --kind privacy to replace the invalid content-addressed asset.",
+        modelPath: paths.cacheDir,
+        files
+      };
+    }
+    materializeCacheEntry(paths, file);
+  }
+  return {
+    ok: true,
+    state: "installed",
+    message: "Pinned Privacy Filter model assets are installed and verified.",
+    modelPath: paths.cacheDir,
+    files
+  };
+};
+var installPrivacyModel = async (serverPaths, environment = process.env, fetcher = globalThis.fetch.bind(globalThis), options = {}) => {
+  if (environment.KOED_DEPENDENCY_MODE?.trim() === "external") {
+    return {
+      ok: false,
+      state: "not_configured",
+      message: "Privacy Filter model downloads are disabled in external dependency mode.",
+      action: "Run the Operator-managed Privacy Filter Service with its pinned model assets.",
+      modelPath: resolvePrivacyModelPaths(serverPaths).cacheDir,
+      files: []
+    };
+  }
+  const paths = resolvePrivacyModelPaths(serverPaths);
+  mkdirSync(paths.blobsDir, { recursive: true, mode: 448 });
+  for (const file of PRIVACY_MODEL_FILES) {
+    options.signal?.throwIfAborted();
+    const blob = blobPath(paths, file);
+    if (existsSync(blob) && await sha256File(blob, options.signal) === file.sha256) {
+      materializeCacheEntry(paths, file);
+      continue;
+    }
+    const temporary = `${blob}.${process.pid}.${randomUUID()}.download`;
+    try {
+      const failedStatus = await downloadPrivacyAsset(file, temporary, fetcher, options);
+      if (failedStatus !== void 0) {
+        return {
+          ok: false,
+          state: "missing",
+          message: `Could not download pinned Privacy Filter model asset ${file.path} (HTTP ${failedStatus}).`,
+          action: "Check network access to huggingface.co and retry.",
+          modelPath: paths.cacheDir,
+          files: []
+        };
+      }
+      const sizeBytes = statSync(temporary).size;
+      options.progress?.({
+        phase: "model-verify",
+        transferredBytes: sizeBytes,
+        totalBytes: sizeBytes,
+        file: file.path
+      });
+      const actual = await sha256File(temporary, options.signal);
+      if (actual !== file.sha256 || file.size !== void 0 && sizeBytes !== file.size) {
+        return {
+          ok: false,
+          state: "checksum_mismatch",
+          message: `Downloaded Privacy Filter model asset failed verification: ${file.path}.`,
+          action: "Do not use the asset; verify the pinned upstream revision and retry.",
+          modelPath: paths.cacheDir,
+          files: [{ path: file.path, sha256: actual, sizeBytes }]
+        };
+      }
+      rmSync(blob, { force: true });
+      renameSync(temporary, blob);
+      materializeCacheEntry(paths, file);
+    } finally {
+      rmSync(temporary, { force: true });
+    }
+  }
+  return collectPrivacyModelStatus(serverPaths, options.signal);
+};
+
+export {
+  PRIVACY_MODEL_ID,
+  PRIVACY_MODEL_REVISION,
+  PRIVACY_MODEL_FILES,
+  resolvePrivacyModelPaths,
+  materializePrivacyModelCacheEntry,
+  collectPrivacyModelStatus,
+  installPrivacyModel
+};

package/vendor/chunk-W2HNI6AA.js

@@ -0,0 +1,75 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+
+// packages/koed-server/dist/env-file.js
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+var parseEnvFile = (content, options = {}) => {
+  const values = {};
+  const fail = (lineNumber, reason) => {
+    throw new Error(`${options.source ?? "Environment file"}:${lineNumber}: ${reason}`);
+  };
+  for (const [index, line] of content.split(/\r?\n/).entries()) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const equals = trimmed.indexOf("=");
+    if (equals <= 0) {
+      if (options.strict)
+        fail(index + 1, "expected KEY=VALUE");
+      continue;
+    }
+    const key = trimmed.slice(0, equals).trim();
+    let value = trimmed.slice(equals + 1).trim();
+    const quoted = value.startsWith('"') || value.startsWith("'");
+    if (quoted && options.strict) {
+      const quote = value[0];
+      let closingQuote = -1;
+      for (let position = 1; position < value.length; position += 1) {
+        if (quote === '"' && value[position] === "\\") {
+          position += 1;
+        } else if (value[position] === quote) {
+          closingQuote = position;
+          break;
+        }
+      }
+      if (closingQuote < 0) {
+        fail(index + 1, `unterminated quoted value for ${key}`);
+      }
+      const trailing = value.slice(closingQuote + 1).trim();
+      if (trailing && !trailing.startsWith("#")) {
+        fail(index + 1, `unexpected text after quoted value for ${key}`);
+      }
+      value = value.slice(1, closingQuote);
+    } else if (quoted) {
+      if (value.length < 2 || value.at(-1) !== value[0]) {
+      } else {
+        value = value.slice(1, -1);
+      }
+    }
+    if (options.strict && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      fail(index + 1, `invalid environment variable name ${key}`);
+    }
+    values[key] = value;
+  }
+  return values;
+};
+var loadRepoEnv = (repoRoot, environment = process.env) => {
+  const envPath = environment.KOED_ENV_PATH?.trim() ? resolve(environment.KOED_ENV_PATH) : resolve(repoRoot, ".env");
+  if (!existsSync(envPath)) {
+    return {};
+  }
+  return parseEnvFile(readFileSync(envPath, "utf8"));
+};
+var environmentWithRepoEnv = (repoRoot, environment = process.env) => ({
+  ...loadRepoEnv(repoRoot, environment),
+  ...environment
+});
+var resolveApiUrl = (environment, repoEnv) => ((environment.KOED_AUTO_PORTS === "1" && environment.API_HOST_PORT ? `http://localhost:${environment.API_HOST_PORT}` : null) ?? environment.MEMORY_API_URL ?? (environment.API_HOST_PORT ? `http://localhost:${environment.API_HOST_PORT}` : null) ?? repoEnv.MEMORY_API_URL ?? (repoEnv.API_HOST_PORT ? `http://localhost:${repoEnv.API_HOST_PORT}` : null) ?? environment.CODEX_MEMORY_BASE_URL ?? repoEnv.CODEX_MEMORY_BASE_URL ?? "http://localhost:3300").trim();
+
+export {
+  parseEnvFile,
+  loadRepoEnv,
+  environmentWithRepoEnv,
+  resolveApiUrl
+};

package/vendor/chunk-X6M525ZJ.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  isKoedServerCliEntrypoint,
+  runKoedServerCli,
+  shouldExitPackagedSupervisor
+} from "./chunk-GELDEJJ2.js";
+import {
+  startKoedServerDaemon
+} from "./chunk-JKOG52PE.js";
+import "./chunk-A4NKL2PK.js";
+import "./chunk-K2EIFEQF.js";
+import "./chunk-UI5RLBKQ.js";
+import "./chunk-BTS4ZTF3.js";
+export {
+  isKoedServerCliEntrypoint,
+  runKoedServerCli,
+  shouldExitPackagedSupervisor,
+  startKoedServerDaemon
+};

package/vendor/chunk-XIZVLPHZ.js

@@ -0,0 +1,18 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  getProjectTeamWorkspaceLink,
+  linkProjectTeamWorkspace,
+  listProjectTeamWorkspaceLinks,
+  removeProjectTeamWorkspaceLink,
+  removeProjectTeamWorkspaceLinksForBackend,
+  removeProjectTeamWorkspaceLinksForMismatchedBinding
+} from "./chunk-6JRWGOQG.js";
+import "./chunk-BTS4ZTF3.js";
+export {
+  getProjectTeamWorkspaceLink,
+  linkProjectTeamWorkspace,
+  listProjectTeamWorkspaceLinks,
+  removeProjectTeamWorkspaceLink,
+  removeProjectTeamWorkspaceLinksForBackend,
+  removeProjectTeamWorkspaceLinksForMismatchedBinding
+};

package/vendor/chunk-XNFVSVBS.js

@@ -0,0 +1,242 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  require_proper_lockfile
+} from "./chunk-7NXKPDF3.js";
+import {
+  createPlatformHostProofStore,
+  deviceIdentityStatePathFor,
+  deviceProofFingerprint,
+  hostProofReferenceFor,
+  inspectDeviceIdentity,
+  serializeHostProof
+} from "./chunk-473OA62O.js";
+import {
+  __toESM
+} from "./chunk-BTS4ZTF3.js";
+
+// packages/koed-server/dist/device-identity.js
+var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
+import { randomBytes, randomUUID } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+var lockStaleMs = 3e4;
+var defaultProof = () => randomBytes(32).toString("base64url");
+var testProofDirectory = (paths) => {
+  const proofRoot = resolve(`${paths.koedHome}-proof-root`);
+  mkdirSync(proofRoot, { recursive: true, mode: 448 });
+  return resolve(proofRoot, "proof");
+};
+var dependencies = (paths, deps) => {
+  const environment = deps.environment ?? process.env;
+  return {
+    environment,
+    proofStore: deps.proofStore ?? createPlatformHostProofStore({
+      koedHome: paths.koedHome,
+      environment: environment.NODE_ENV === "test" ? {
+        ...environment,
+        KOED_DEVICE_PROOF_DIR: testProofDirectory(paths)
+      } : environment
+    }),
+    now: deps.now ?? (() => /* @__PURE__ */ new Date()),
+    randomId: deps.randomId ?? randomUUID,
+    randomProof: deps.randomProof ?? defaultProof,
+    onPhase: deps.onPhase ?? (() => void 0)
+  };
+};
+var lockTarget = (paths) => resolve(paths.runDir, "device-identity");
+var bootstrapTombstonePath = (paths) => resolve(paths.configDir, "device-identity-bootstrap.json");
+var withDeviceIdentityLock = async (paths, mutation) => {
+  mkdirSync(paths.runDir, { recursive: true, mode: 448 });
+  const release = await import_proper_lockfile.default.lock(lockTarget(paths), {
+    realpath: false,
+    stale: lockStaleMs,
+    update: lockStaleMs / 3,
+    retries: {
+      retries: 100,
+      factor: 1,
+      minTimeout: 25,
+      maxTimeout: 100,
+      randomize: true
+    }
+  });
+  try {
+    return await mutation();
+  } finally {
+    await release();
+  }
+};
+var writeState = (statePath, state) => {
+  mkdirSync(resolve(statePath, ".."), { recursive: true, mode: 448 });
+  const temporary = `${statePath}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, `${JSON.stringify(state, null, 2)}
+`, {
+      mode: 384,
+      flag: "wx"
+    });
+    renameSync(temporary, statePath);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+};
+var prepareIdentityStorage = (paths) => {
+  mkdirSync(paths.koedHome, { recursive: true, mode: 448 });
+  if (lstatSync(paths.koedHome).isSymbolicLink()) {
+    throw new Error("KOED_HOME must not be a symbolic link.");
+  }
+  mkdirSync(paths.configDir, { recursive: true, mode: 448 });
+  if (lstatSync(paths.configDir).isSymbolicLink()) {
+    throw new Error("Device identity config directory must not be a symbolic link.");
+  }
+  return realpathSync(paths.koedHome);
+};
+var writeBootstrapTombstone = (paths, now) => {
+  const tombstonePath = bootstrapTombstonePath(paths);
+  if (existsSync(tombstonePath))
+    return;
+  const temporary = `${tombstonePath}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, `${JSON.stringify({ schemaVersion: 1, initializedAt: now.toISOString() })}
+`, { mode: 384, flag: "wx" });
+    renameSync(temporary, tombstonePath);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+};
+var newIdentityState = (now, randomId, randomProof, remoteOperations, deploymentId = randomId(), pendingRemoteRevocation = false) => {
+  const deviceInstanceId = randomId();
+  const proof = randomProof();
+  const timestamp = now.toISOString();
+  return {
+    state: {
+      schemaVersion: 1,
+      deploymentId,
+      deviceInstanceId,
+      proof: {
+        reference: hostProofReferenceFor(deviceInstanceId),
+        fingerprint: deviceProofFingerprint(proof)
+      },
+      remoteOperations,
+      deploymentIdentityAdoptionPending: true,
+      ...pendingRemoteRevocation ? { pendingRemoteRevocation: true } : {},
+      createdAt: timestamp,
+      updatedAt: timestamp
+    },
+    proof
+  };
+};
+var result = (identity, options = {}) => ({
+  ...identity,
+  initialized: options.initialized ?? false,
+  rotated: options.rotated ?? false,
+  ...options.referencesInvalidated === void 0 ? {} : { referencesInvalidated: options.referencesInvalidated }
+});
+var inspect = (paths, proofStore) => inspectDeviceIdentity({
+  statePath: deviceIdentityStatePathFor(paths.koedHome),
+  proofStore
+});
+var inspectDeviceIdentityStatus = (paths, deps = {}) => {
+  const resolved = dependencies(paths, deps);
+  return Promise.resolve(result(inspect(paths, resolved.proofStore)));
+};
+var ensureDeviceIdentity = async (paths, deps = {}) => {
+  const resolved = dependencies(paths, deps);
+  return withDeviceIdentityLock(paths, () => {
+    try {
+      const canonicalKoedHome = prepareIdentityStorage(paths);
+      const current = inspect(paths, resolved.proofStore);
+      if (current.health !== "missing_state")
+        return result(current);
+      if (existsSync(bootstrapTombstonePath(paths)))
+        return result(current);
+      writeBootstrapTombstone(paths, resolved.now());
+      resolved.onPhase("tombstone");
+      const next = newIdentityState(resolved.now(), resolved.randomId, resolved.randomProof, "repair_required");
+      resolved.proofStore.write(next.state.proof.reference, serializeHostProof({
+        deploymentId: next.state.deploymentId,
+        deviceInstanceId: next.state.deviceInstanceId,
+        proof: next.proof,
+        canonicalKoedHome
+      }));
+      resolved.onPhase("proof");
+      writeState(deviceIdentityStatePathFor(paths.koedHome), next.state);
+      resolved.onPhase("state");
+      writeState(deviceIdentityStatePathFor(paths.koedHome), {
+        ...next.state,
+        remoteOperations: "enabled",
+        updatedAt: resolved.now().toISOString()
+      });
+      return result(inspect(paths, resolved.proofStore), { initialized: true });
+    } catch {
+      return result(inspect(paths, resolved.proofStore));
+    }
+  });
+};
+var rotateDeviceIdentity = async (paths, options) => {
+  const resolved = dependencies(paths, options.dependencies ?? {});
+  return withDeviceIdentityLock(paths, async () => {
+    let canonicalKoedHome;
+    try {
+      canonicalKoedHome = prepareIdentityStorage(paths);
+    } catch {
+      return result(inspect(paths, resolved.proofStore), { rotated: false });
+    }
+    const previous = inspect(paths, resolved.proofStore);
+    const previousReference = previous.deviceInstanceId ? hostProofReferenceFor(previous.deviceInstanceId) : null;
+    const next = newIdentityState(resolved.now(), resolved.randomId, resolved.randomProof, "repair_required", previous.deploymentId ?? void 0, true);
+    delete next.state.deploymentIdentityAdoptionPending;
+    try {
+      writeBootstrapTombstone(paths, resolved.now());
+      resolved.proofStore.write(next.state.proof.reference, serializeHostProof({
+        deploymentId: next.state.deploymentId,
+        deviceInstanceId: next.state.deviceInstanceId,
+        proof: next.proof,
+        canonicalKoedHome
+      }));
+      writeState(deviceIdentityStatePathFor(paths.koedHome), next.state);
+    } catch {
+      return result(inspect(paths, resolved.proofStore), { rotated: false });
+    }
+    try {
+      const invalidation = await options.invalidateRemoteReferences();
+      if (invalidation?.pendingRemoteRevocation) {
+        return result(inspect(paths, resolved.proofStore), {
+          rotated: true,
+          referencesInvalidated: false
+        });
+      }
+    } catch {
+      return result(inspect(paths, resolved.proofStore), {
+        rotated: true,
+        referencesInvalidated: false
+      });
+    }
+    const completed = {
+      ...next.state,
+      remoteOperations: "enabled",
+      updatedAt: resolved.now().toISOString()
+    };
+    delete completed.pendingRemoteRevocation;
+    try {
+      writeState(deviceIdentityStatePathFor(paths.koedHome), completed);
+      if (previousReference && previousReference !== completed.proof.reference) {
+        resolved.proofStore.remove(previousReference);
+      }
+      return result(inspect(paths, resolved.proofStore), {
+        rotated: true,
+        referencesInvalidated: true
+      });
+    } catch {
+      return result(inspect(paths, resolved.proofStore), {
+        rotated: true,
+        referencesInvalidated: false
+      });
+    }
+  });
+};
+
+export {
+  inspectDeviceIdentityStatus,
+  ensureDeviceIdentity,
+  rotateDeviceIdentity
+};