@serviceme/devtools-core 2.0.2 → 2.0.4

package/dist/device-yWpY_Zds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-yWpY_Zds.js","names":["createHash","createHmac","randomUUID","os","createHash","randomUUID","randomBytes","fsp","path","delay","getDeviceJsonPath","os","getServicemeHome"],"sources":["../src/device/deviceAuth.ts","../src/device/InstallationId.ts","../src/device/Enroller.ts","../src/device/types.ts","../src/device/IdentityStore.ts","../src/device/DeviceCore.ts"],"sourcesContent":["/**\n * deviceAuth — Device request signing helpers for device auth headers.\n *\n * **Boundary exception copy.** The single source of truth for the\n * `x-ms-device-*` header names + the signature algorithms now lives in\n * `@serviceme/devtools-shared` (`device-auth.ts`), consumed by the\n * extension signer and the server verifier. ADL-003 forbids\n * core → shared (and shared → core), so this module keeps a\n * byte-for-byte copy as the documented exception. Keep it in lock-step\n * with `packages/serviceme-shared/src/device-auth.ts`.\n *\n * See `docs/architecture/phase-5-device-header-spec.md` §5 for the wire\n * format. Legacy (v1) basis is `METHOD\\nPATH\\nTIMESTAMP\\nBODY\\nSECRET`\n * hashed with a secret-suffix SHA-256; v2 basis is\n * `METHOD\\nPATH?QUERY\\nTIMESTAMP\\nNONCE\\nBODY\\nSECRET` MACed with real\n * HMAC-SHA-256 keyed by the device secret and signed over the full\n * path-with-query. Both output lowercase hex.\n */\n\nimport { createHash, createHmac, randomUUID } from \"node:crypto\";\n\n/** Canonical header names — MUST match `@serviceme/devtools-shared`'s `DeviceAuthHeaders`. */\nexport const DeviceAuthHeaders = {\n\tdeviceId: \"x-ms-device-id\",\n\tdeviceSecret: \"x-ms-device-secret\",\n\tsignature: \"x-ms-device-signature\",\n\ttimestamp: \"x-ms-device-timestamp\",\n\tsecretVersion: \"x-ms-device-secret-version\",\n\t/** v2 only — algorithm self-declaration so the server can verify\n\t * both schemes during the legacy-client rollout window. */\n\tsigAlg: \"x-ms-device-sig-alg\",\n\t/** v2 only — one-time value folded into the signature basis and\n\t * checked against a server-side replay cache. */\n\tnonce: \"x-ms-device-nonce\",\n} as const;\n\n/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */\nexport const DEVICE_SIG_ALG_V2 = \"hmac-sha256-v2\";\n\nexport interface DeviceRequestSignatureParams {\n\tmethod: string;\n\tpath: string;\n\ttimestamp: number;\n\tbody: string;\n\tsecret: string;\n}\n\n/**\n * Legacy (v1) secret-suffix SHA-256 over the canonical basis. Retained\n * for backward compatibility with fielded verifiers/clients that\n * predate v2; new code should use `createDeviceRequestSignatureV2`.\n */\nexport function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string {\n\tconst basis = [\n\t\tparams.method.toUpperCase(),\n\t\tparams.path,\n\t\tString(params.timestamp),\n\t\tparams.body,\n\t\tparams.secret,\n\t].join(\"\\n\");\n\treturn createHash(\"sha256\").update(basis).digest(\"hex\");\n}\n\nexport interface DeviceRequestSignatureV2Params {\n\tmethod: string;\n\t/** Full request path INCLUDING the query string. v2 signs the query\n\t * so GET parameters cannot be substituted or replayed independently\n\t * of the signed basis. */\n\tpath: string;\n\ttimestamp: number;\n\t/** One-time value; the server tracks seen nonces per device and\n\t * rejects replays within the timestamp window. */\n\tnonce: string;\n\tbody: string;\n\tsecret: string;\n}\n\n/**\n * Compute the v2 HMAC-SHA-256 hex digest over the canonical basis\n * (path-with-query + nonce).\n *\n * Server contract (`apps/server/src/lib/auth/device-signature-guard.ts`)\n * is line-for-line identical: same LF-joined basis, same lowercase hex\n * output. Any divergence breaks `device-signature-guard.test.ts`.\n */\nexport function createDeviceRequestSignatureV2(params: DeviceRequestSignatureV2Params): string {\n\tconst basis = [\n\t\tparams.method.toUpperCase(),\n\t\tparams.path,\n\t\tString(params.timestamp),\n\t\tparams.nonce,\n\t\tparams.body,\n\t\tparams.secret,\n\t].join(\"\\n\");\n\treturn createHmac(\"sha256\", params.secret).update(basis).digest(\"hex\");\n}\n\n/** Header map consumed by `fetch()` callers (CLI bridge, Extension). */\nexport interface DeviceSignedHeaders {\n\t[DeviceAuthHeaders.deviceId]: string;\n\t[DeviceAuthHeaders.deviceSecret]: string;\n\t[DeviceAuthHeaders.signature]: string;\n\t[DeviceAuthHeaders.timestamp]: string;\n\t[DeviceAuthHeaders.secretVersion]: string;\n\t[DeviceAuthHeaders.sigAlg]: string;\n\t[DeviceAuthHeaders.nonce]: string;\n}\n\nexport interface BuildSignedHeadersParams {\n\tmethod: string;\n\t/** Full request path INCLUDING the query string (v2 signs it). */\n\tpath: string;\n\tbody: string;\n\tpublicId: string;\n\tdeviceSecret: string;\n\tsecretVersion: number;\n\t/** Override for deterministic tests. */\n\ttimestamp?: number;\n\t/** Override for deterministic tests; defaults to a fresh random UUID. */\n\tnonce?: string;\n}\n\n/**\n * Build the v2 header map. The `path` parameter MUST include the exact\n * query string sent on the wire, and the `body` parameter MUST be the\n * exact byte sequence sent on the wire (no whitespace\n * re-canonicalization between client serialization and signature basis\n * construction).\n */\nexport function buildSignedHeaders(params: BuildSignedHeadersParams): DeviceSignedHeaders {\n\tconst timestamp = params.timestamp ?? Date.now();\n\tconst nonce = params.nonce ?? randomUUID();\n\tconst signature = createDeviceRequestSignatureV2({\n\t\tmethod: params.method,\n\t\tpath: params.path,\n\t\ttimestamp,\n\t\tnonce,\n\t\tbody: params.body,\n\t\tsecret: params.deviceSecret,\n\t});\n\treturn {\n\t\t[DeviceAuthHeaders.deviceId]: params.publicId,\n\t\t[DeviceAuthHeaders.deviceSecret]: params.deviceSecret,\n\t\t[DeviceAuthHeaders.signature]: signature,\n\t\t[DeviceAuthHeaders.timestamp]: String(timestamp),\n\t\t[DeviceAuthHeaders.secretVersion]: String(params.secretVersion),\n\t\t[DeviceAuthHeaders.sigAlg]: DEVICE_SIG_ALG_V2,\n\t\t[DeviceAuthHeaders.nonce]: nonce,\n\t};\n}\n","/**\n * InstallationId — Derive a stable per-machine identifier from\n * `os.hostname()` + `os.userInfo()`.\n *\n * Per `docs/architecture/phase-5-auth-device-toolbox.md § P5-2 (并入本文时对应 § P5-2 拆分)` B2,\n * `installationId` MUST survive Extension re-installs but vary across\n * machines. We compute a UUID v5-style hash over hostname + username +\n * platform so the result is:\n *   - deterministic (same machine → same id)\n *   - collision-resistant (SHA-256, 128-bit truncated)\n *   - browser-safe (no PII survives — username never enters output)\n *\n * Note: this intentionally differs from `vscode.env.machineId`, which\n * is per-Extension-install and uses a different algorithm. The two\n * coexist: `installationId` is what gets sent to the server, while\n * `machineId` (raw `os.hostname()`) is for diagnostics.\n *\n * Refs:\n * - 4.功能规划.md §2.2 — `InstallationId.ts os.hostname() + os.userInfo() 哈希生成`\n * - 3.功能拆分.md B2 — installationId semantics\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\nimport * as os from \"node:os\";\n\n/** Hex-encoded SHA-256 input. Format: `<hostname>|<username>|<platform>|<nodeVersion>`. */\nfunction fingerprintMaterial(): string {\n\t// `os.userInfo()` is undefined-ish on Windows in some sandboxes; fall\n\t// back to a process env user, then to a constant placeholder. We never\n\t// emit the raw username to the caller — it only enters the hash.\n\tlet username = \"unknown\";\n\ttry {\n\t\tusername = os.userInfo().username;\n\t} catch {\n\t\tusername = process.env.USER ?? process.env.USERNAME ?? \"unknown\";\n\t}\n\treturn [\n\t\tos.hostname(),\n\t\tusername,\n\t\tos.platform(),\n\t\tos.arch(),\n\t\tprocess.versions.node ?? \"unknown\",\n\t].join(\"|\");\n}\n\n/**\n * Returns a deterministic installation id for the current machine.\n * Use this when you need an id that survives Extension reinstalls\n * but stays stable across restarts on the same machine.\n */\nexport function deriveInstallationId(): string {\n\tconst material = fingerprintMaterial();\n\tconst digest = createHash(\"sha256\").update(material).digest(\"hex\");\n\t// Take the first 32 hex chars (128 bits) and reformat as UUID v4-shape\n\t// so the output looks like a UUID to downstream consumers while\n\t// remaining a pure SHA-256 truncation.\n\treturn formatAsV4(digest.slice(0, 32));\n}\n\n/**\n * Returns a random installation id (UUID v4). Use this for fresh\n * installs when no fingerprint input is available (e.g. containerized\n * CI runners where `os.hostname()` is meaningless).\n */\nexport function randomInstallationId(): string {\n\treturn randomUUID();\n}\n\n/** SHA-256 fingerprint material exposed for tests + diagnostics. */\nexport function fingerprintSource(): string {\n\treturn fingerprintMaterial();\n}\n\nfunction formatAsV4(hex32: string): string {\n\t// Stamp version 4 + variant bits per RFC 4122 §4.4. The bits are\n\t// cosmetic — the underlying entropy is still SHA-256.\n\tconst chars = hex32.split(\"\");\n\t// Version nibble (position 12 in canonical UUID, index 13 of the 32-char string).\n\tconst versionIdx = 12;\n\tconst variantIdx = 16;\n\tconst versionChar = (parseInt(chars[versionIdx] ?? \"8\", 16) & 0x0) | 0x4;\n\tchars[versionIdx] = versionChar.toString(16);\n\t// Variant nibble: 10xx → first hex char of the 17th position.\n\tconst variantChar = (parseInt(chars[variantIdx] ?? \"8\", 16) & 0x3) | 0x8;\n\tchars[variantIdx] = variantChar.toString(16);\n\tconst formatted = chars.join(\"\");\n\treturn `${formatted.slice(0, 8)}-${formatted.slice(8, 12)}-${formatted.slice(12, 16)}-${formatted.slice(16, 20)}-${formatted.slice(20, 32)}`;\n}\n","/**\n * Enroller — State machine for `device.enroll` and `device.rotate-secret`.\n *\n * States per `2.需求澄清.md` §1.2:\n *   anonymous → pending → claimed → expired\n *\n *   - `anonymous` (initial): no device has ever enrolled. Server returns\n *     a fresh `publicId` + secret.\n *   - `pending`: enrollment HTTP call has been issued but the server\n *     hasn't confirmed yet. In-flight state — never persisted.\n *   - `claimed`: user has linked this device to their account (via\n *     `/api/v1/devices/claim`). Sticky binding locks future re-enrolls\n *     to the same `userId` (server-side matrix).\n *   - `expired`: server returned a device-expiry error. Forces a fresh\n *     enroll on next call.\n *\n * `--force` semantics: any non-anonymous state can be force-reset to\n * `anonymous` by wiping the local identity file. The next enroll will\n * be treated as a brand-new install by the server (no sticky binding).\n *\n * The Enroller is the **state machine**; the actual HTTP I/O is the\n * caller's responsibility (the `DeviceSyncClient` in Phase 5.4 wires\n * the server). This split keeps the Enroller unit-testable without\n * a live server.\n *\n * Refs:\n * - 4.功能规划.md §2.2 — `Enroller.ts anonymous → pending → claimed → expired`\n * - `2.需求澄清.md` §1.2 — binding-state machine\n */\n\nimport { randomBytes } from \"node:crypto\";\n\nimport type { DeviceBindingState, DeviceEnrollResult } from \"@serviceme/devtools-protocol\";\nimport type { IdentityStore } from \"./IdentityStore\";\nimport { deriveInstallationId } from \"./InstallationId\";\nimport type { PersistedDeviceIdentity } from \"./types\";\n\n/** 32 bytes of HMAC secret material — matches the server's `device-registration.ts:73-80` generator. */\nconst SECRET_BYTES = 32;\n/** Server returns `publicId` as 32-char hex (16 bytes). Match the wire length. */\nconst PUBLIC_ID_BYTES = 16;\n\ntype RandomBytesFn = (size: number) => Buffer;\n\nconst defaultRandomBytes: RandomBytesFn = (size) => {\n\treturn randomBytes(size);\n};\n\nexport interface EnrollerOptions {\n\tidentityStore: IdentityStore;\n\t/** Injectable clock for deterministic tests. */\n\tnow?: () => Date;\n\t/** Override the random source (tests). */\n\trandomBytes?: (size: number) => Buffer;\n\t/** Caller-supplied enroll HTTP function. Phase 5.4 wires the real one. */\n\tenrollRequest?: EnrollRequestFn;\n}\n\nexport type EnrollRequestFn = (input: {\n\tinstallationId: string;\n\tmachineId: string;\n\tplatform: string;\n\texisting: PersistedDeviceIdentity | null;\n\tforce: boolean;\n\trequireAuth: boolean;\n}) => Promise<EnrollResponse>;\n\nexport interface EnrollResponse {\n\tpublicId: string;\n\tdeviceSecret: string;\n\tsecretVersion: number;\n\tbindingState: DeviceBindingState;\n\texpiresAt?: string;\n}\n\n/** Sentinel error — re-enroll on a claimed device without auth. */\nexport class DeviceReenrollRequiresAuthError extends Error {\n\tconstructor(\n\t\tmessage = \"Re-enroll on a claimed device requires current device credentials or the bound user\"\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"DeviceReenrollRequiresAuthError\";\n\t}\n}\n\n/** Sentinel error — server returned a 410 / version-mismatch after rotation. */\nexport class DeviceSecretVersionMismatchError extends Error {\n\tconstructor(message = \"Device secret version mismatch — server has rotated past the local copy\") {\n\t\tsuper(message);\n\t\tthis.name = \"DeviceSecretVersionMismatchError\";\n\t}\n}\n\nexport class Enroller {\n\tprivate readonly identity: IdentityStore;\n\tprivate readonly now: () => Date;\n\tprivate readonly random: (size: number) => Buffer;\n\tprivate readonly enrollRequest?: EnrollRequestFn;\n\tprivate inflight: Promise<DeviceEnrollResult> | null = null;\n\n\tconstructor(opts: EnrollerOptions) {\n\t\tthis.identity = opts.identityStore;\n\t\tthis.now = opts.now ?? (() => new Date());\n\t\tthis.random = opts.randomBytes ?? defaultRandomBytes;\n\t\tthis.enrollRequest = opts.enrollRequest;\n\t}\n\n\t/**\n\t * Read the current binding state without touching the disk.\n\t * Returns `anonymous` when no identity is stored.\n\t */\n\tasync currentState(): Promise<DeviceBindingState> {\n\t\tconst stored = await this.identity.read();\n\t\treturn stored?.bindingState ?? \"anonymous\";\n\t}\n\n\t/**\n\t * Drive the enrollment flow.\n\t *\n\t * @param force when true, drop the local identity and start fresh\n\t *              (server treats this as a brand-new install).\n\t * @param requireAuth when true, refuse to silently re-enroll an\n\t *              existing claimed device — throw\n\t *              `DeviceReenrollRequiresAuthError` instead.\n\t */\n\t/**\n\t * Resolve when any in-flight enrollment completes.  Returns immediately\n\t * when no enrollment is in progress.  Allows callers (e.g. the extension's\n\t * `buildDeviceAuthHeaders`) to wait for a concurrent `syncDeviceInfo()`\n\t * enrollment before attempting to read the identity from the store.\n\t */\n\tasync waitForEnrollment(): Promise<void> {\n\t\tif (this.inflight) {\n\t\t\tawait this.inflight;\n\t\t}\n\t}\n\n\tasync enroll(opts: { force?: boolean; requireAuth?: boolean } = {}): Promise<DeviceEnrollResult> {\n\t\t// Concurrency guard — multiple in-flight calls share the same promise.\n\t\tif (this.inflight) {\n\t\t\treturn this.inflight;\n\t\t}\n\t\tconst promise = this.runEnroll(opts);\n\t\tthis.inflight = promise;\n\t\ttry {\n\t\t\treturn await promise;\n\t\t} finally {\n\t\t\tif (this.inflight === promise) this.inflight = null;\n\t\t}\n\t}\n\n\t/** Test seam — surface the underlying identity store. */\n\tgetIdentityStore(): IdentityStore {\n\t\treturn this.identity;\n\t}\n\n\t/** True when an enrollment is currently in-flight. Used by callers (e.g. the extension's `buildDeviceAuthHeaders`) to skip triggering a competing enrollment. */\n\tisEnrolling(): boolean {\n\t\treturn this.inflight !== null;\n\t}\n\n\tprivate async runEnroll(opts: {\n\t\tforce?: boolean;\n\t\trequireAuth?: boolean;\n\t}): Promise<DeviceEnrollResult> {\n\t\tconst { written } = await this.identity.mutate(async (current) => {\n\t\t\tconst existing = opts.force ? null : current;\n\n\t\t\tif (!opts.force && current) {\n\t\t\t\tif (current.bindingState === \"expired\") {\n\t\t\t\t\t// Expired identities are forced to re-enroll as if they were new.\n\t\t\t\t} else if (\n\t\t\t\t\topts.requireAuth &&\n\t\t\t\t\t(current.bindingState === \"claimed\" || current.bindingState === \"pending\")\n\t\t\t\t) {\n\t\t\t\t\t// Caller asserted the device must be claimed, but local state\n\t\t\t\t\t// shows it's still in flight. This is a CLI-only guard — the\n\t\t\t\t\t// server is the final arbiter.\n\t\t\t\t\tthrow new DeviceReenrollRequiresAuthError();\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst installationId = current?.installationId ?? deriveInstallationId();\n\t\t\tconst machineId = current?.machineId ?? \"unknown\";\n\t\t\tconst platform = current?.platform ?? \"unknown\";\n\n\t\t\tlet response: EnrollResponse;\n\t\t\tif (this.enrollRequest) {\n\t\t\t\tresponse = await this.enrollRequest({\n\t\t\t\t\tinstallationId,\n\t\t\t\t\tmachineId,\n\t\t\t\t\tplatform,\n\t\t\t\t\texisting,\n\t\t\t\t\tforce: Boolean(opts.force),\n\t\t\t\t\trequireAuth: Boolean(opts.requireAuth),\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\t// Test path / no live HTTP — synthesize a fresh identity. This\n\t\t\t\t// branch is what unit tests exercise; production wires\n\t\t\t\t// `enrollRequest` in Phase 5.4.\n\t\t\t\tresponse = synthesizeEnrollResponse(this.random, existing);\n\t\t\t}\n\n\t\t\tconst next: PersistedDeviceIdentity = {\n\t\t\t\tversion: current?.version ?? 1,\n\t\t\t\tinstallationId,\n\t\t\t\tmachineId,\n\t\t\t\tplatform,\n\t\t\t\thostname: current?.hostname,\n\t\t\t\tpublicId: response.publicId,\n\t\t\t\tsecretVersion: response.secretVersion,\n\t\t\t\tbindingState: response.bindingState,\n\t\t\t\tdeviceSecret: response.deviceSecret,\n\t\t\t\tpreviousDeviceSecret: existing?.deviceSecret,\n\t\t\t\tpreviousSecretExpiresAt:\n\t\t\t\t\topts.force || response.secretVersion === (existing?.secretVersion ?? 0) + 1\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: existing?.previousSecretExpiresAt,\n\t\t\t\tlastEnrollAt: this.now().toISOString(),\n\t\t\t\tlastSyncAt: existing?.lastSyncAt,\n\t\t\t\tlastSyncError: undefined,\n\t\t\t};\n\t\t\treturn { next };\n\t\t});\n\n\t\treturn {\n\t\t\tpublicId: written.publicId,\n\t\t\tbindingState: written.bindingState,\n\t\t\texpiresAt: deriveExpiresAt(written, this.now),\n\t\t};\n\t}\n\n\t/**\n\t * Rotate the HMAC secret. Keeps the previous secret for the grace\n\t * window (default 7 days per `2.需求澄清.md` §1.2) — the\n\t * `previousSecretExpiresAt` is stamped on the persisted identity.\n\t */\n\tasync rotateSecret(\n\t\topts: { gracePeriodDays?: number } = {}\n\t): Promise<{ publicId: string; secretVersion: number; gracePeriodDays: number }> {\n\t\tconst gracePeriodDays = opts.gracePeriodDays ?? 7;\n\t\tconst now = this.now();\n\t\tconst newSecret = this.random(SECRET_BYTES).toString(\"hex\");\n\n\t\tconst { written } = await this.identity.mutate(async (current) => {\n\t\t\tif (!current) {\n\t\t\t\tthrow new Error(\"Cannot rotate-secret without a prior enrollment\");\n\t\t\t}\n\t\t\tconst graceExpiresAt = new Date(now.getTime() + gracePeriodDays * 24 * 60 * 60 * 1000);\n\t\t\tconst next: PersistedDeviceIdentity = {\n\t\t\t\t...current,\n\t\t\t\tdeviceSecret: newSecret,\n\t\t\t\tpreviousDeviceSecret: current.deviceSecret,\n\t\t\t\tpreviousSecretExpiresAt: graceExpiresAt.toISOString(),\n\t\t\t\tsecretVersion: current.secretVersion + 1,\n\t\t\t\tlastEnrollAt: now.toISOString(),\n\t\t\t};\n\t\t\treturn { next };\n\t\t});\n\n\t\treturn {\n\t\t\tpublicId: written.publicId,\n\t\t\tsecretVersion: written.secretVersion,\n\t\t\tgracePeriodDays,\n\t\t};\n\t}\n\n\t/**\n\t * Mark the device as `expired`. Used when the server returns a\n\t * device-expiry response; the next `enroll()` call forces a fresh\n\t * round-trip.\n\t */\n\tasync markExpired(): Promise<void> {\n\t\tawait this.identity.mutate(async (current) => {\n\t\t\tif (!current) {\n\t\t\t\t// Nothing to expire.\n\t\t\t\treturn { next: current ?? (await emptyIdentity(this.random)), result: undefined };\n\t\t\t}\n\t\t\tconst next: PersistedDeviceIdentity = { ...current, bindingState: \"expired\" };\n\t\t\treturn { next };\n\t\t});\n\t}\n\n\t/**\n\t * Mark the device as `claimed`. Called by the bridge after a\n\t * successful `device.claim` server response.\n\t */\n\tasync markClaimed(): Promise<void> {\n\t\tawait this.identity.mutate(async (current) => {\n\t\t\tif (!current) {\n\t\t\t\tthrow new Error(\"Cannot mark-claimed without a prior enrollment\");\n\t\t\t}\n\t\t\tconst next: PersistedDeviceIdentity = {\n\t\t\t\t...current,\n\t\t\t\tbindingState: \"claimed\",\n\t\t\t\tlastSyncAt: this.now().toISOString(),\n\t\t\t\tlastSyncError: undefined,\n\t\t\t};\n\t\t\treturn { next };\n\t\t});\n\t}\n}\n\nfunction deriveExpiresAt(_identity: PersistedDeviceIdentity, _now: () => Date): string | undefined {\n\t// No explicit expiry on the server today (per phase-5-device-header-spec.md\n\t// §9 #1: 7-day grace is rotation-only). The shape is here for forward\n\t// compatibility — when the server adds a per-device expiry, this\n\t// pulls the value from the response without changing the call site.\n\treturn undefined;\n}\n\nfunction synthesizeEnrollResponse(\n\trandom: RandomBytesFn,\n\texisting: PersistedDeviceIdentity | null\n): EnrollResponse {\n\tconst publicId = existing?.publicId ?? random(PUBLIC_ID_BYTES).toString(\"hex\");\n\tconst secretVersion = (existing?.secretVersion ?? 0) + 1;\n\treturn {\n\t\tpublicId,\n\t\tdeviceSecret: random(SECRET_BYTES).toString(\"hex\"),\n\t\tsecretVersion,\n\t\tbindingState: existing?.bindingState === \"claimed\" ? \"claimed\" : \"anonymous\",\n\t};\n}\n\nasync function emptyIdentity(random: RandomBytesFn): Promise<PersistedDeviceIdentity> {\n\treturn {\n\t\tversion: 1,\n\t\tinstallationId: deriveInstallationId(),\n\t\tmachineId: \"unknown\",\n\t\tplatform: \"unknown\",\n\t\tpublicId: random(PUBLIC_ID_BYTES).toString(\"hex\"),\n\t\tsecretVersion: 1,\n\t\tbindingState: \"anonymous\",\n\t\tdeviceSecret: random(SECRET_BYTES).toString(\"hex\"),\n\t\tlastEnrollAt: new Date().toISOString(),\n\t};\n}\n","/**\n * Internal types for the device domain.\n *\n * These types are NOT re-exported from the protocol package — they are\n * implementation details of the IdentityStore + Enroller. Public data\n * models (the bridge wire shape) live in `@serviceme/devtools-protocol`'s\n * `device.ts`.\n *\n * Refs:\n * - 4.功能规划.md §2.2 — `device/types.ts`\n */\n\nimport type { DeviceBindingState } from \"@serviceme/devtools-protocol\";\n\n/**\n * Schema version of the on-disk `device.json` file. Bumped when the\n * shape changes incompatibly. IdentityStore checks this on read and\n * either migrates (versions ≤ 1) or refuses (versions > supported).\n */\nexport const DEVICE_JSON_SCHEMA_VERSION = 1;\n\n/** Internal representation of the persisted identity file. */\nexport interface PersistedDeviceIdentity {\n\tversion: number;\n\t/** Stable per-machine id (UUID v4 shape) — survives secret rotates. */\n\tinstallationId: string;\n\t/** Raw `os.hostname()` for diagnostics. */\n\tmachineId: string;\n\t/** Platform string (e.g. \"darwin\"). */\n\tplatform: string;\n\t/** Optional hostname override for environments where `os.hostname()` is unstable. */\n\thostname?: string;\n\t/** Public, non-secret id returned by the server. 32-char hex. */\n\tpublicId: string;\n\t/** Monotonic secret version counter, starts at 1 after first enroll. */\n\tsecretVersion: number;\n\t/** Current binding state — drives the re-enroll matrix. */\n\tbindingState: DeviceBindingState;\n\t/** HMAC secret (32 bytes hex-encoded = 64 chars). Persisted per `device-header-spec.md` §3.1. */\n\tdeviceSecret: string;\n\t/** Optional: previous secret retained during the grace window (rotation). */\n\tpreviousDeviceSecret?: string;\n\t/** Optional: ISO timestamp at which the previous secret stops being accepted. */\n\tpreviousSecretExpiresAt?: string;\n\t/** ISO timestamp of the most recent successful enroll / rotate. */\n\tlastEnrollAt: string;\n\t/** Optional ISO timestamp of the most recent server sync. */\n\tlastSyncAt?: string;\n\t/** Optional human-readable message for the last sync error. */\n\tlastSyncError?: string;\n}\n\n/** Result of a single atomic write. */\nexport interface AtomicWriteResult {\n\tbytesWritten: number;\n\t/** Path to the temp file (post-rename it no longer exists; useful for diagnostics). */\n\ttmpPath: string;\n}\n\n/** Hook called before/after every identity write — used by tests to assert concurrency safety. */\nexport interface IdentityStoreHooks {\n\tbeforeWrite?: (next: PersistedDeviceIdentity) => void | Promise<void>;\n\tafterWrite?: (next: PersistedDeviceIdentity) => void | Promise<void>;\n}\n","/**\n * IdentityStore — Atomic JSON persistence for the device identity file.\n *\n * Stores the `PersistedDeviceIdentity` (incl. the HMAC secret cleartext)\n * at `~/.serviceme/device.json` (per `phase-5-device-header-spec.md`\n * §3.1). Writes are atomic via `write-tmp + fsync + rename`, matching\n * the `SkillStore` / `ToolboxStore` precedent. Concurrent writes are\n * serialized with a mkdir-based file lock (POSIX-atomic) — proper\n * cross-process locking is deferred to Phase 6+ per the open spec.\n *\n * The file mode is `0600` (owner read/write only) so the cleartext\n * secret stays safe at rest. On Windows the mode hint is a no-op\n * (Windows uses ACLs) but `writeFile` still succeeds.\n *\n * Migration — IdentityStore auto-detects a v0-shape (pre-Phase-5.2)\n * file written by the Extension's old `globalState` blob:\n *   { version: 1, claimed: false, publicKeyFingerprint: null }\n * In that case the file is migrated forward to the v1 schema on the\n * next write (the data fields are empty and a fresh enroll is required).\n * The full Extension `globalState` → JSON migration happens in the\n * Phase 5.5 adapter (`apps/extension/.../DeviceService.ts`) since the\n * adapter holds the live `globalState` access.\n *\n * Refs:\n * - 4.功能规划.md §2.2 — `IdentityStore.ts 持久化到 ~/.config/serviceme/device.json, 原子写`\n * - `docs/architecture/phase-5-device-header-spec.md` §3.1, §2.5\n */\n\nimport * as fsp from \"node:fs/promises\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\n\nimport { getDeviceJsonPath, getServicemeHome } from \"../paths/userHome\";\n\nimport {\n\ttype AtomicWriteResult,\n\tDEVICE_JSON_SCHEMA_VERSION,\n\ttype IdentityStoreHooks,\n\ttype PersistedDeviceIdentity,\n} from \"./types\";\n\nconst FILE_MODE = 0o600;\nconst LOCK_DIR_MODE = 0o700;\nconst DEFAULT_LOCK_TIMEOUT_MS = 5000;\nconst DEFAULT_LOCK_RETRY_MS = 25;\n// `mkdir` (lock acquisition) and writing the pid file are two separate\n// syscalls, so there's a brief window where the lock dir exists but the\n// pid file doesn't yet. A grace period keeps a concurrent acquirer from\n// mistaking that window for an abandoned lock (see `isStaleLock`).\nconst LOCK_STALE_GRACE_MS = 200;\nconst TMP_SUFFIX = \".tmp\";\n\n/**\n * Minimal interface for reading + writing the persisted identity file.\n * Default impl uses `getDeviceJsonPath()` (which honors `SERVICEME_HOME`),\n * but tests can substitute a custom path for isolation.\n */\nexport interface IdentityFileBackend {\n\tread(filePath: string): Promise<PersistedDeviceIdentity | null>;\n\twrite(filePath: string, payload: PersistedDeviceIdentity): Promise<AtomicWriteResult>;\n\texists(filePath: string): Promise<boolean>;\n\tdelete(filePath: string): Promise<void>;\n\tlistDir?(dir: string): Promise<string[]>;\n}\n\nexport interface IdentityStoreOptions {\n\tfilePath?: string;\n\thooks?: IdentityStoreHooks;\n\tlockTimeoutMs?: number;\n\tlockRetryMs?: number;\n\t/** Injectable clock for deterministic tests. */\n\tnow?: () => Date;\n\tbackend?: IdentityFileBackend;\n}\n\n/**\n * Default file backend — uses `node:fs/promises` with the canonical\n * tmp-then-rename atomic-write pattern.\n */\nexport class FsIdentityFileBackend implements IdentityFileBackend {\n\tasync exists(filePath: string): Promise<boolean> {\n\t\ttry {\n\t\t\tawait fsp.access(filePath);\n\t\t\treturn true;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tasync read(filePath: string): Promise<PersistedDeviceIdentity | null> {\n\t\ttry {\n\t\t\tconst buf = await fsp.readFile(filePath, \"utf8\");\n\t\t\tconst parsed = JSON.parse(buf) as unknown;\n\t\t\treturn migratePersistedIdentity(parsed);\n\t\t} catch (err) {\n\t\t\tif (isNodeError(err) && err.code === \"ENOENT\") return null;\n\t\t\tthrow err;\n\t\t}\n\t}\n\n\tasync write(filePath: string, payload: PersistedDeviceIdentity): Promise<AtomicWriteResult> {\n\t\tawait fsp.mkdir(path.dirname(filePath), { recursive: true });\n\t\tconst tmpPath = `${filePath}${TMP_SUFFIX}`;\n\t\tconst bytes = Buffer.from(JSON.stringify(payload, null, \"\\t\"), \"utf8\");\n\t\t// Ensure tmp is fresh (in case a previous run died mid-write).\n\t\tawait fsp.rm(tmpPath, { force: true });\n\t\tconst handle = await fsp.open(tmpPath, \"w\", FILE_MODE);\n\t\ttry {\n\t\t\tawait handle.writeFile(bytes);\n\t\t\tawait handle.sync();\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t\tawait fsp.rename(tmpPath, filePath);\n\t\t// Best-effort chmod for filesystems that ignore mode on create (Windows).\n\t\tawait fsp.chmod(filePath, FILE_MODE).catch(() => undefined);\n\t\treturn { bytesWritten: bytes.byteLength, tmpPath };\n\t}\n\n\tasync delete(filePath: string): Promise<void> {\n\t\tawait fsp.rm(filePath, { force: true });\n\t}\n}\n\n/**\n * Reconcile an unknown on-disk shape into the current `PersistedDeviceIdentity`.\n *\n * - v1 IdentityStore files (current shape) pass through unchanged.\n * - v0 bootstrap files (`{ version: 1, claimed: false, publicKeyFingerprint: null }`)\n *   are recognized by their placeholder keys and discarded; the next\n *   enroll writes a fresh identity.\n * - Anything else throws — refuse to silently drop user data.\n */\nfunction migratePersistedIdentity(parsed: unknown): PersistedDeviceIdentity | null {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"device.json: top-level must be an object\");\n\t}\n\tconst version = parsed.version;\n\tif (version === DEVICE_JSON_SCHEMA_VERSION) {\n\t\t// Pre-Phase-5.2 placeholder shape carries `claimed` /\n\t\t// `publicKeyFingerprint` but no real device fields. Recognize\n\t\t// the marker and return null so the next enroll writes fresh data.\n\t\tif (\n\t\t\tparsed.publicId === undefined &&\n\t\t\tparsed.deviceSecret === undefined &&\n\t\t\t(\"claimed\" in parsed || \"publicKeyFingerprint\" in parsed)\n\t\t) {\n\t\t\treturn null;\n\t\t}\n\t\t// Trust the schema — the writer is also us.\n\t\treturn parsed as unknown as PersistedDeviceIdentity;\n\t}\n\tif (typeof version === \"number\" && version < DEVICE_JSON_SCHEMA_VERSION) {\n\t\t// Pre-Phase-5.2 bootstrap shape — the file is empty placeholder\n\t\t// data; nothing to migrate. Return null to signal \"no identity\".\n\t\treturn null;\n\t}\n\tthrow new Error(`device.json: unsupported schema version ${String(version)}`);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction isNodeError(value: unknown): value is NodeJS.ErrnoException {\n\treturn value instanceof Error && typeof (value as { code?: unknown }).code === \"string\";\n}\n\nconst LOCK_PID_FILE = \"pid\";\n\n/**\n * Check whether a process is still alive (best-effort, cross-platform).\n * Returns `false` for any PID we cannot verify as alive.\n */\nfunction isProcessAlive(pid: number): boolean {\n\ttry {\n\t\t// signal 0 — permission check only, never actually sent\n\t\tprocess.kill(pid, 0);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * mkdir-based advisory file lock with stale-lock recovery.\n *\n * POSIX mkdir is atomic; on Windows modern filesystems (NTFS) it's also\n * atomic at the API level. Sufficient for single-host, single-user\n * scenarios (which is the SERVICEME threat model).\n *\n * Stale lock recovery: a `pid` file inside the lock directory records the\n * owner's PID. On `EEXIST`, if the recorded PID is no longer alive, the\n * lock directory is forcibly removed and acquisition retried immediately.\n * This prevents permanent lockout when a process crashes without calling\n * `release()`.\n */\nclass FileLock {\n\tprivate readonly dirPath: string;\n\tprivate readonly pidFilePath: string;\n\tprivate readonly timeoutMs: number;\n\tprivate readonly retryMs: number;\n\tprivate acquired = false;\n\n\tconstructor(filePath: string, timeoutMs: number, retryMs: number) {\n\t\tthis.dirPath = `${filePath}.lock`;\n\t\tthis.pidFilePath = path.join(this.dirPath, LOCK_PID_FILE);\n\t\tthis.timeoutMs = timeoutMs;\n\t\tthis.retryMs = retryMs;\n\t}\n\n\tasync acquire(): Promise<void> {\n\t\tconst start = Date.now();\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\tawait fsp.mkdir(this.dirPath, { mode: LOCK_DIR_MODE });\n\t\t\t\t// Write PID so a future acquirer can detect if we crash.\n\t\t\t\tawait fsp.writeFile(this.pidFilePath, String(process.pid), \"utf8\").catch(() => undefined);\n\t\t\t\tthis.acquired = true;\n\t\t\t\treturn;\n\t\t\t} catch (err) {\n\t\t\t\tif (!isNodeError(err) || err.code !== \"EEXIST\") {\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\t\t\t\t// Lock directory exists — check for stale owner.\n\t\t\t\tconst stale = await this.isStaleLock();\n\t\t\t\tif (stale) {\n\t\t\t\t\tawait fsp.rm(this.dirPath, { recursive: true, force: true });\n\t\t\t\t\t// Retry immediately without counting this iteration against timeout.\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (Date.now() - start >= this.timeoutMs) {\n\t\t\t\t\tthrow new Error(`IdentityStore lock acquisition timed out for ${this.dirPath}`);\n\t\t\t\t}\n\t\t\t\tawait delay(this.retryMs);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async isStaleLock(): Promise<boolean> {\n\t\tlet pidStr: string;\n\t\ttry {\n\t\t\tpidStr = await fsp.readFile(this.pidFilePath, \"utf8\");\n\t\t} catch {\n\t\t\t// The pid file may not exist yet because another acquirer just\n\t\t\t// created the lock dir and hasn't finished writing its pid file\n\t\t\t// (mkdir + writeFile is not atomic). Give it a short grace window\n\t\t\t// before concluding the owner crashed between mkdir and writeFile.\n\t\t\ttry {\n\t\t\t\tconst stat = await fsp.stat(this.dirPath);\n\t\t\t\treturn Date.now() - stat.mtimeMs > LOCK_STALE_GRACE_MS;\n\t\t\t} catch {\n\t\t\t\t// Lock dir disappeared concurrently (e.g. released mid-check) —\n\t\t\t\t// not stale, just gone; the caller's next mkdir will succeed.\n\t\t\t\treturn false;\n\t\t\t}\n\t\t}\n\t\tconst pid = Number.parseInt(pidStr.trim(), 10);\n\t\tif (!Number.isFinite(pid) || pid <= 0) return true; // malformed pid file → treat as stale\n\t\treturn !isProcessAlive(pid);\n\t}\n\n\tasync release(): Promise<void> {\n\t\tif (!this.acquired) return;\n\t\tthis.acquired = false;\n\t\tawait fsp.rm(this.dirPath, { recursive: true, force: true });\n\t}\n}\n\nexport class IdentityStore {\n\tprivate readonly filePath: string;\n\tprivate readonly backend: IdentityFileBackend;\n\tprivate readonly hooks: IdentityStoreHooks;\n\tprivate readonly lockTimeoutMs: number;\n\tprivate readonly lockRetryMs: number;\n\n\tconstructor(opts: IdentityStoreOptions = {}) {\n\t\tthis.filePath = opts.filePath ?? getDeviceJsonPath();\n\t\tthis.backend = opts.backend ?? new FsIdentityFileBackend();\n\t\tthis.hooks = opts.hooks ?? {};\n\t\tthis.lockTimeoutMs = opts.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;\n\t\tthis.lockRetryMs = opts.lockRetryMs ?? DEFAULT_LOCK_RETRY_MS;\n\t}\n\n\t/** Absolute path to the underlying JSON file (test seam). */\n\tgetFilePath(): string {\n\t\treturn this.filePath;\n\t}\n\n\t/** True when the JSON file already exists on disk. */\n\tasync exists(): Promise<boolean> {\n\t\treturn this.backend.exists(this.filePath);\n\t}\n\n\t/** Read the persisted identity; returns `null` when no identity is stored. */\n\tasync read(): Promise<PersistedDeviceIdentity | null> {\n\t\treturn this.backend.read(this.filePath);\n\t}\n\n\t/**\n\t * Atomically write the given identity. Concurrent writers are\n\t * serialized via the file lock; the read-modify-write happens\n\t * inside the lock so callers can't see a partial state.\n\t */\n\tasync write(next: PersistedDeviceIdentity): Promise<AtomicWriteResult> {\n\t\tawait this.hooks.beforeWrite?.(next);\n\t\tconst lock = new FileLock(this.filePath, this.lockTimeoutMs, this.lockRetryMs);\n\t\tawait lock.acquire();\n\t\ttry {\n\t\t\tconst stamped: PersistedDeviceIdentity = {\n\t\t\t\t...next,\n\t\t\t\tversion: DEVICE_JSON_SCHEMA_VERSION,\n\t\t\t};\n\t\t\tconst result = await this.backend.write(this.filePath, stamped);\n\t\t\tawait this.hooks.afterWrite?.(stamped);\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t}\n\n\t/**\n\t * Read-modify-write under the same lock. The mutator receives the\n\t * current identity (or `null` on first call) and returns the\n\t * replacement. Throwing inside the mutator aborts the write.\n\t */\n\tasync mutate<T>(\n\t\tmutator: (\n\t\t\tcurrent: PersistedDeviceIdentity | null\n\t\t) => Promise<{ next: PersistedDeviceIdentity; result?: T }>\n\t): Promise<{ result: T | undefined; written: PersistedDeviceIdentity }> {\n\t\tconst lock = new FileLock(this.filePath, this.lockTimeoutMs, this.lockRetryMs);\n\t\tawait lock.acquire();\n\t\ttry {\n\t\t\tconst current = await this.backend.read(this.filePath);\n\t\t\tconst { next, result } = await mutator(current);\n\t\t\tconst stamped: PersistedDeviceIdentity = {\n\t\t\t\t...next,\n\t\t\t\tversion: DEVICE_JSON_SCHEMA_VERSION,\n\t\t\t};\n\t\t\tawait this.hooks.beforeWrite?.(stamped);\n\t\t\tawait this.backend.write(this.filePath, stamped);\n\t\t\tawait this.hooks.afterWrite?.(stamped);\n\t\t\treturn { result, written: stamped };\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t}\n\n\t/** Wipe the persisted identity (used by `device.enroll --force`). */\n\tasync clear(): Promise<void> {\n\t\tawait this.backend.delete(this.filePath);\n\t}\n\n\t/**\n\t * Resolve the installation metadata for the current machine.\n\t * Pure helper — no I/O, just `os.*` calls.\n\t */\n\tresolveInstallationMetadata(): Pick<\n\t\tPersistedDeviceIdentity,\n\t\t\"installationId\" | \"machineId\" | \"platform\"\n\t> {\n\t\tconst machineId = os.hostname();\n\t\tconst platform = os.platform();\n\t\t// installationId is derived by `InstallationId.ts` — pass the\n\t\t// caller's already-computed value via `material` so we don't\n\t\t// recompute the SHA twice in a row.\n\t\treturn {\n\t\t\tinstallationId: \"\", // intentionally empty; caller fills via deriveInstallationId()\n\t\t\tmachineId,\n\t\t\tplatform,\n\t\t};\n\t}\n\n\t/**\n\t * Ensure the parent directory exists (`~/.serviceme/`). Idempotent.\n\t * Useful when the bootstrap phase5 placeholder wasn't run yet.\n\t */\n\tasync ensureHome(): Promise<void> {\n\t\tawait fsp.mkdir(getServicemeHome(), { recursive: true });\n\t\tawait fsp.mkdir(path.dirname(this.filePath), { recursive: true });\n\t}\n}\n","/**\n * DeviceCore — Main entry for the device domain.\n *\n * Aggregates `IdentityStore` + `Enroller` + signer helpers into a single\n * surface that the CLI / Extension / Bridge can call. Pure orchestration\n * — no HTTP of its own (the actual `POST /api/v1/devices/enroll` lives\n * behind `EnrollerOptions.enrollRequest`, wired in Phase 5.4).\n *\n * Refs:\n * - 4.功能规划.md §2.2 — `DeviceCore.ts 主入口`\n * - ADL-003 — data model in `@serviceme/devtools-protocol`\n * - `docs/architecture/phase-5-device-header-spec.md` §3.1\n */\n\nimport type {\n\tDeviceEnrollResult,\n\tDeviceIdentityState,\n\tDeviceMetadata,\n\tDeviceRotateSecretResult,\n\tDeviceStatus,\n} from \"@serviceme/devtools-protocol\";\nimport { buildSignedHeaders, DeviceAuthHeaders, type DeviceSignedHeaders } from \"./deviceAuth\";\nimport { Enroller, type EnrollRequestFn } from \"./Enroller\";\nimport { IdentityStore } from \"./IdentityStore\";\nimport { deriveInstallationId } from \"./InstallationId\";\nimport type { PersistedDeviceIdentity } from \"./types\";\n\nexport interface DeviceCoreOptions {\n\tidentityStore?: IdentityStore;\n\tenrollRequest?: EnrollRequestFn;\n\tnow?: () => Date;\n\t/** Optional override for `deriveInstallationId` (used by tests for determinism). */\n\tresolveInstallationId?: () => string;\n}\n\nexport class DeviceCore {\n\tprivate readonly identity: IdentityStore;\n\tprivate readonly enroller: Enroller;\n\tprivate readonly resolveInstallationId: () => string;\n\n\tconstructor(opts: DeviceCoreOptions = {}) {\n\t\tthis.identity = opts.identityStore ?? new IdentityStore();\n\t\tthis.enroller = new Enroller({\n\t\t\tidentityStore: this.identity,\n\t\t\tenrollRequest: opts.enrollRequest,\n\t\t\tnow: opts.now,\n\t\t});\n\t\tthis.resolveInstallationId = opts.resolveInstallationId ?? deriveInstallationId;\n\t}\n\n\t/** Read-only snapshot of the device status (matches `device.status` wire shape). */\n\tasync status(): Promise<DeviceStatus> {\n\t\tconst stored = await this.identity.read();\n\t\treturn stored\n\t\t\t? {\n\t\t\t\t\tbindingState: stored.bindingState,\n\t\t\t\t\tidentity: projectIdentity(stored),\n\t\t\t\t\tmetadata: projectMetadata(stored),\n\t\t\t\t\tlastSyncAt: stored.lastSyncAt,\n\t\t\t\t\tlastSyncError: stored.lastSyncError,\n\t\t\t\t}\n\t\t\t: { bindingState: \"anonymous\" };\n\t}\n\n\t/** Enroll (or re-enroll) the device. */\n\tasync enroll(opts: { force?: boolean; requireAuth?: boolean } = {}): Promise<DeviceEnrollResult> {\n\t\treturn this.enroller.enroll(opts);\n\t}\n\n\t/** Wait for any in-flight enrollment to finish.  Use before `buildSignedHeaders` so that a concurrent `syncDeviceInfo` enrollment has time to write the identity to the store. */\n\tasync waitForEnrollment(): Promise<void> {\n\t\tawait this.enroller.waitForEnrollment();\n\t}\n\n\t/** True when an enrollment is currently in-flight. Used by callers to skip triggering a competing enrollment. */\n\tisEnrolling(): boolean {\n\t\treturn this.enroller.isEnrolling();\n\t}\n\n\t/** Rotate the HMAC secret while keeping the previous one for the grace window. */\n\tasync rotateSecret(opts: { gracePeriodDays?: number } = {}): Promise<DeviceRotateSecretResult> {\n\t\tconst result = await this.enroller.rotateSecret(opts);\n\t\tconst stored = await this.identity.read();\n\t\treturn {\n\t\t\t...result,\n\t\t\tgracePeriodEndsAt: stored?.previousSecretExpiresAt,\n\t\t};\n\t}\n\n\t/** Build the v2 signed header map for an outbound request. The path\n\t * MUST include the query string (v2 signs it). */\n\tasync buildSignedHeaders(input: {\n\t\tmethod: string;\n\t\tpath: string;\n\t\tbody: string;\n\t}): Promise<DeviceSignedHeaders | null> {\n\t\tconst stored = await this.identity.read();\n\t\tif (!stored) return null;\n\t\treturn buildSignedHeaders({\n\t\t\tmethod: input.method,\n\t\t\tpath: input.path,\n\t\t\tbody: input.body,\n\t\t\tpublicId: stored.publicId,\n\t\t\tdeviceSecret: stored.deviceSecret,\n\t\t\tsecretVersion: stored.secretVersion,\n\t\t});\n\t}\n\n\t/** Raw stored identity (CLI/extension internal use). Test seam too. */\n\tasync readIdentity(): Promise<PersistedDeviceIdentity | null> {\n\t\treturn this.identity.read();\n\t}\n\n\t/** Wipe the local identity (the `--force` path before re-enroll). */\n\tasync clear(): Promise<void> {\n\t\tawait this.identity.clear();\n\t}\n\n\t/** Mark the device as claimed (called by the bridge after a successful claim). */\n\tasync markClaimed(): Promise<void> {\n\t\tawait this.enroller.markClaimed();\n\t}\n\n\t/** Mark the device as expired (server returned an expiry response). */\n\tasync markExpired(): Promise<void> {\n\t\tawait this.enroller.markExpired();\n\t}\n\n\t/** Expose the identity store (CLI uses it for direct file access in tests). */\n\tgetIdentityStore(): IdentityStore {\n\t\treturn this.identity;\n\t}\n\n\t/** Expose the enroller (CLI uses it for state inspection). */\n\tgetEnroller(): Enroller {\n\t\treturn this.enroller;\n\t}\n\n\t/** Header name constants — re-exported from `deviceAuth.ts`. */\n\tgetHeaderNames(): typeof DeviceAuthHeaders {\n\t\treturn DeviceAuthHeaders;\n\t}\n\n\t/** Compute the installation id for the current machine. */\n\tgetInstallationId(): string {\n\t\treturn this.resolveInstallationId();\n\t}\n}\n\nfunction projectIdentity(stored: PersistedDeviceIdentity): DeviceIdentityState {\n\treturn {\n\t\tpublicId: stored.publicId,\n\t\tsecretVersion: stored.secretVersion,\n\t\tbindingState: stored.bindingState,\n\t};\n}\n\nfunction projectMetadata(stored: PersistedDeviceIdentity): DeviceMetadata {\n\treturn {\n\t\tinstallationId: stored.installationId,\n\t\tmachineId: stored.machineId,\n\t\tplatform: stored.platform,\n\t\thostname: stored.hostname,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,oBAAoB;CAChC,UAAU;CACV,cAAc;CACd,WAAW;CACX,WAAW;CACX,eAAe;;;CAGf,QAAQ;;;CAGR,OAAO;AACR;;AAGA,MAAa,oBAAoB;;;;;;AAejC,SAAgB,6BAA6B,QAA8C;CAC1F,MAAM,QAAQ;EACb,OAAO,OAAO,YAAY;EAC1B,OAAO;EACP,OAAO,OAAO,SAAS;EACvB,OAAO;EACP,OAAO;CACR,CAAC,CAAC,KAAK,IAAI;CACX,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACvD;;;;;;;;;AAwBA,SAAgB,+BAA+B,QAAgD;CAC9F,MAAM,QAAQ;EACb,OAAO,OAAO,YAAY;EAC1B,OAAO;EACP,OAAO,OAAO,SAAS;EACvB,OAAO;EACP,OAAO;EACP,OAAO;CACR,CAAC,CAAC,KAAK,IAAI;CACX,QAAA,GAAOC,YAAAA,WAAAA,CAAW,UAAU,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACtE;;;;;;;;AAkCA,SAAgB,mBAAmB,QAAuD;CACzF,MAAM,YAAY,OAAO,aAAa,KAAK,IAAI;CAC/C,MAAM,QAAQ,OAAO,UAAA,GAASC,YAAAA,WAAAA,CAAW;CACzC,MAAM,YAAY,+BAA+B;EAChD,QAAQ,OAAO;EACf,MAAM,OAAO;EACb;EACA;EACA,MAAM,OAAO;EACb,QAAQ,OAAO;CAChB,CAAC;CACD,OAAO;GACL,kBAAkB,WAAW,OAAO;GACpC,kBAAkB,eAAe,OAAO;GACxC,kBAAkB,YAAY;GAC9B,kBAAkB,YAAY,OAAO,SAAS;GAC9C,kBAAkB,gBAAgB,OAAO,OAAO,aAAa;GAC7D,kBAAkB,SAAS;GAC3B,kBAAkB,QAAQ;CAC5B;AACD;;;;;;;;;;;;;;;;;;;;;;;;;AC3HA,SAAS,sBAA8B;CAItC,IAAI,WAAW;CACf,IAAI;EACH,WAAWC,QAAG,SAAS,CAAC,CAAC;CAC1B,QAAQ;EACP,WAAW,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;CACxD;CACA,OAAO;EACNA,QAAG,SAAS;EACZ;EACAA,QAAG,SAAS;EACZA,QAAG,KAAK;EACR,QAAQ,SAAS,QAAQ;CAC1B,CAAC,CAAC,KAAK,GAAG;AACX;;;;;;AAOA,SAAgB,uBAA+B;CAC9C,MAAM,WAAW,oBAAoB;CAKrC,OAAO,YAAA,GAJQC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAIrC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;AACtC;;;;;;AAOA,SAAgB,uBAA+B;CAC9C,QAAA,GAAOC,YAAAA,WAAAA,CAAW;AACnB;;AAGA,SAAgB,oBAA4B;CAC3C,OAAO,oBAAoB;AAC5B;AAEA,SAAS,WAAW,OAAuB;CAG1C,MAAM,QAAQ,MAAM,MAAM,EAAE;CAE5B,MAAM,aAAa;CACnB,MAAM,aAAa;CAEnB,MAAM,eADe,SAAS,MAAM,eAAe,KAAK,EAAE,IAAI,IAAO,EAAA,CACrC,SAAS,EAAE;CAG3C,MAAM,eADe,SAAS,MAAM,eAAe,KAAK,EAAE,IAAI,IAAO,EAAA,CACrC,SAAS,EAAE;CAC3C,MAAM,YAAY,MAAM,KAAK,EAAE;CAC/B,OAAO,GAAG,UAAU,MAAM,GAAG,CAAC,EAAE,GAAG,UAAU,MAAM,GAAG,EAAE,EAAE,GAAG,UAAU,MAAM,IAAI,EAAE,EAAE,GAAG,UAAU,MAAM,IAAI,EAAE,EAAE,GAAG,UAAU,MAAM,IAAI,EAAE;AAC1I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjDA,MAAM,eAAe;;AAErB,MAAM,kBAAkB;AAIxB,MAAM,sBAAqC,SAAS;CACnD,QAAA,GAAOC,YAAAA,YAAAA,CAAY,IAAI;AACxB;;AA8BA,IAAa,kCAAb,cAAqD,MAAM;CAC1D,YACC,UAAU,uFACT;EACD,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,mCAAb,cAAsD,MAAM;CAC3D,YAAY,UAAU,2EAA2E;EAChG,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;AAEA,IAAa,WAAb,MAAsB;CAOrB,YAAY,MAAuB;EAFoB,KAAA,WAAA;EAGtD,KAAK,WAAW,KAAK;EACrB,KAAK,MAAM,KAAK,8BAAc,IAAI,KAAK;EACvC,KAAK,SAAS,KAAK,eAAe;EAClC,KAAK,gBAAgB,KAAK;CAC3B;;;;;CAMA,MAAM,eAA4C;EAEjD,QAAO,MADc,KAAK,SAAS,KAAK,EAAA,EACzB,gBAAgB;CAChC;;;;;;;;;;;;;;;;CAiBA,MAAM,oBAAmC;EACxC,IAAI,KAAK,UACR,MAAM,KAAK;CAEb;CAEA,MAAM,OAAO,OAAmD,CAAC,GAAgC;EAEhG,IAAI,KAAK,UACR,OAAO,KAAK;EAEb,MAAM,UAAU,KAAK,UAAU,IAAI;EACnC,KAAK,WAAW;EAChB,IAAI;GACH,OAAO,MAAM;EACd,UAAU;GACT,IAAI,KAAK,aAAa,SAAS,KAAK,WAAW;EAChD;CACD;;CAGA,mBAAkC;EACjC,OAAO,KAAK;CACb;;CAGA,cAAuB;EACtB,OAAO,KAAK,aAAa;CAC1B;CAEA,MAAc,UAAU,MAGQ;EAC/B,MAAM,EAAE,YAAY,MAAM,KAAK,SAAS,OAAO,OAAO,YAAY;GACjE,MAAM,WAAW,KAAK,QAAQ,OAAO;GAErC,IAAI,CAAC,KAAK,SAAS,SAAS;IAC3B,IAAI,QAAQ,iBAAiB,WAAW,CAExC,OAAO,IACN,KAAK,gBACJ,QAAQ,iBAAiB,aAAa,QAAQ,iBAAiB,YAKhE,MAAM,IAAI,gCAAgC;GAE5C;GAEA,MAAM,iBAAiB,SAAS,kBAAkB,qBAAqB;GACvE,MAAM,YAAY,SAAS,aAAa;GACxC,MAAM,WAAW,SAAS,YAAY;GAEtC,IAAI;GACJ,IAAI,KAAK,eACR,WAAW,MAAM,KAAK,cAAc;IACnC;IACA;IACA;IACA;IACA,OAAO,QAAQ,KAAK,KAAK;IACzB,aAAa,QAAQ,KAAK,WAAW;GACtC,CAAC;QAKD,WAAW,yBAAyB,KAAK,QAAQ,QAAQ;GAsB1D,OAAO,EAAE,MAAA;IAlBR,SAAS,SAAS,WAAW;IAC7B;IACA;IACA;IACA,UAAU,SAAS;IACnB,UAAU,SAAS;IACnB,eAAe,SAAS;IACxB,cAAc,SAAS;IACvB,cAAc,SAAS;IACvB,sBAAsB,UAAU;IAChC,yBACC,KAAK,SAAS,SAAS,mBAAmB,UAAU,iBAAiB,KAAK,IACvE,KAAA,IACA,UAAU;IACd,cAAc,KAAK,IAAI,CAAC,CAAC,YAAY;IACrC,YAAY,UAAU;IACtB,eAAe,KAAA;GAEJ,EAAE;EACf,CAAC;EAED,OAAO;GACN,UAAU,QAAQ;GAClB,cAAc,QAAQ;GACtB,WAAW,gBAAgB,SAAS,KAAK,GAAG;EAC7C;CACD;;;;;;CAOA,MAAM,aACL,OAAqC,CAAC,GAC0C;EAChF,MAAM,kBAAkB,KAAK,mBAAmB;EAChD,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,YAAY,KAAK,OAAO,YAAY,CAAC,CAAC,SAAS,KAAK;EAE1D,MAAM,EAAE,YAAY,MAAM,KAAK,SAAS,OAAO,OAAO,YAAY;GACjE,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,iDAAiD;GAElE,MAAM,iBAAiB,IAAI,KAAK,IAAI,QAAQ,IAAI,kBAAkB,KAAK,KAAK,KAAK,GAAI;GASrF,OAAO,EAAE,MAAA;IAPR,GAAG;IACH,cAAc;IACd,sBAAsB,QAAQ;IAC9B,yBAAyB,eAAe,YAAY;IACpD,eAAe,QAAQ,gBAAgB;IACvC,cAAc,IAAI,YAAY;GAEnB,EAAE;EACf,CAAC;EAED,OAAO;GACN,UAAU,QAAQ;GAClB,eAAe,QAAQ;GACvB;EACD;CACD;;;;;;CAOA,MAAM,cAA6B;EAClC,MAAM,KAAK,SAAS,OAAO,OAAO,YAAY;GAC7C,IAAI,CAAC,SAEJ,OAAO;IAAE,MAAM,WAAY,MAAM,cAAc,KAAK,MAAM;IAAI,QAAQ,KAAA;GAAU;GAGjF,OAAO,EAAE,MAAA;IAD+B,GAAG;IAAS,cAAc;GACtD,EAAE;EACf,CAAC;CACF;;;;;CAMA,MAAM,cAA6B;EAClC,MAAM,KAAK,SAAS,OAAO,OAAO,YAAY;GAC7C,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,gDAAgD;GAQjE,OAAO,EAAE,MAAA;IALR,GAAG;IACH,cAAc;IACd,YAAY,KAAK,IAAI,CAAC,CAAC,YAAY;IACnC,eAAe,KAAA;GAEJ,EAAE;EACf,CAAC;CACF;AACD;AAEA,SAAS,gBAAgB,WAAoC,MAAsC,CAMnG;AAEA,SAAS,yBACR,QACA,UACiB;CACjB,MAAM,WAAW,UAAU,YAAY,OAAO,eAAe,CAAC,CAAC,SAAS,KAAK;CAC7E,MAAM,iBAAiB,UAAU,iBAAiB,KAAK;CACvD,OAAO;EACN;EACA,cAAc,OAAO,YAAY,CAAC,CAAC,SAAS,KAAK;EACjD;EACA,cAAc,UAAU,iBAAiB,YAAY,YAAY;CAClE;AACD;AAEA,eAAe,cAAc,QAAyD;CACrF,OAAO;EACN,SAAS;EACT,gBAAgB,qBAAqB;EACrC,WAAW;EACX,UAAU;EACV,UAAU,OAAO,eAAe,CAAC,CAAC,SAAS,KAAK;EAChD,eAAe;EACf,cAAc;EACd,cAAc,OAAO,YAAY,CAAC,CAAC,SAAS,KAAK;EACjD,+BAAc,IAAI,KAAK,EAAA,CAAE,YAAY;CACtC;AACD;;;;;;;;AC9TA,MAAa,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACuB1C,MAAM,YAAY;AAClB,MAAM,gBAAgB;AACtB,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAK9B,MAAM,sBAAsB;AAC5B,MAAM,aAAa;;;;;AA6BnB,IAAa,wBAAb,MAAkE;CACjE,MAAM,OAAO,UAAoC;EAChD,IAAI;GACH,MAAMC,iBAAI,OAAO,QAAQ;GACzB,OAAO;EACR,QAAQ;GACP,OAAO;EACR;CACD;CAEA,MAAM,KAAK,UAA2D;EACrE,IAAI;GACH,MAAM,MAAM,MAAMA,iBAAI,SAAS,UAAU,MAAM;GAE/C,OAAO,yBADQ,KAAK,MAAM,GACW,CAAC;EACvC,SAAS,KAAK;GACb,IAAI,YAAY,GAAG,KAAK,IAAI,SAAS,UAAU,OAAO;GACtD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,UAAkB,SAA8D;EAC3F,MAAMA,iBAAI,MAAMC,UAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EAC3D,MAAM,UAAU,GAAG,WAAW;EAC9B,MAAM,QAAQ,OAAO,KAAK,KAAK,UAAU,SAAS,MAAM,GAAI,GAAG,MAAM;EAErE,MAAMD,iBAAI,GAAG,SAAS,EAAE,OAAO,KAAK,CAAC;EACrC,MAAM,SAAS,MAAMA,iBAAI,KAAK,SAAS,KAAK,SAAS;EACrD,IAAI;GACH,MAAM,OAAO,UAAU,KAAK;GAC5B,MAAM,OAAO,KAAK;EACnB,UAAU;GACT,MAAM,OAAO,MAAM;EACpB;EACA,MAAMA,iBAAI,OAAO,SAAS,QAAQ;EAElC,MAAMA,iBAAI,MAAM,UAAU,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1D,OAAO;GAAE,cAAc,MAAM;GAAY;EAAQ;CAClD;CAEA,MAAM,OAAO,UAAiC;EAC7C,MAAMA,iBAAI,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC;CACvC;AACD;;;;;;;;;;AAWA,SAAS,yBAAyB,QAAiD;CAClF,IAAI,CAAC,SAAS,MAAM,GACnB,MAAM,IAAI,MAAM,0CAA0C;CAE3D,MAAM,UAAU,OAAO;CACvB,IAAI,YAAA,GAAwC;EAI3C,IACC,OAAO,aAAa,KAAA,KACpB,OAAO,iBAAiB,KAAA,MACvB,aAAa,UAAU,0BAA0B,SAElD,OAAO;EAGR,OAAO;CACR;CACA,IAAI,OAAO,YAAY,YAAY,UAAA,GAGlC,OAAO;CAER,MAAM,IAAI,MAAM,2CAA2C,OAAO,OAAO,GAAG;AAC7E;AAEA,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU;AAC/C;AAEA,SAAS,YAAY,OAAgD;CACpE,OAAO,iBAAiB,SAAS,OAAQ,MAA6B,SAAS;AAChF;AAEA,MAAM,gBAAgB;;;;;AAMtB,SAAS,eAAe,KAAsB;CAC7C,IAAI;EAEH,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACR,QAAQ;EACP,OAAO;CACR;AACD;;;;;;;;;;;;;;AAeA,IAAM,WAAN,MAAe;CAOd,YAAY,UAAkB,WAAmB,SAAiB;EAF/C,KAAA,WAAA;EAGlB,KAAK,UAAU,GAAG,SAAS;EAC3B,KAAK,cAAcC,UAAK,KAAK,KAAK,SAAS,aAAa;EACxD,KAAK,YAAY;EACjB,KAAK,UAAU;CAChB;CAEA,MAAM,UAAyB;EAC9B,MAAM,QAAQ,KAAK,IAAI;EACvB,OAAO,MACN,IAAI;GACH,MAAMD,iBAAI,MAAM,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;GAErD,MAAMA,iBAAI,UAAU,KAAK,aAAa,OAAO,QAAQ,GAAG,GAAG,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;GACxF,KAAK,WAAW;GAChB;EACD,SAAS,KAAK;GACb,IAAI,CAAC,YAAY,GAAG,KAAK,IAAI,SAAS,UACrC,MAAM;GAIP,IAAI,MADgB,KAAK,YAAY,GAC1B;IACV,MAAMA,iBAAI,GAAG,KAAK,SAAS;KAAE,WAAW;KAAM,OAAO;IAAK,CAAC;IAE3D;GACD;GACA,IAAI,KAAK,IAAI,IAAI,SAAS,KAAK,WAC9B,MAAM,IAAI,MAAM,gDAAgD,KAAK,SAAS;GAE/E,OAAA,GAAME,qBAAAA,WAAAA,CAAM,KAAK,OAAO;EACzB;CAEF;CAEA,MAAc,cAAgC;EAC7C,IAAI;EACJ,IAAI;GACH,SAAS,MAAMF,iBAAI,SAAS,KAAK,aAAa,MAAM;EACrD,QAAQ;GAKP,IAAI;IACH,MAAM,OAAO,MAAMA,iBAAI,KAAK,KAAK,OAAO;IACxC,OAAO,KAAK,IAAI,IAAI,KAAK,UAAU;GACpC,QAAQ;IAGP,OAAO;GACR;EACD;EACA,MAAM,MAAM,OAAO,SAAS,OAAO,KAAK,GAAG,EAAE;EAC7C,IAAI,CAAC,OAAO,SAAS,GAAG,KAAK,OAAO,GAAG,OAAO;EAC9C,OAAO,CAAC,eAAe,GAAG;CAC3B;CAEA,MAAM,UAAyB;EAC9B,IAAI,CAAC,KAAK,UAAU;EACpB,KAAK,WAAW;EAChB,MAAMA,iBAAI,GAAG,KAAK,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAC5D;AACD;AAEA,IAAa,gBAAb,MAA2B;CAO1B,YAAY,OAA6B,CAAC,GAAG;EAC5C,KAAK,WAAW,KAAK,YAAYG,iBAAAA,kBAAkB;EACnD,KAAK,UAAU,KAAK,WAAW,IAAI,sBAAsB;EACzD,KAAK,QAAQ,KAAK,SAAS,CAAC;EAC5B,KAAK,gBAAgB,KAAK,iBAAiB;EAC3C,KAAK,cAAc,KAAK,eAAe;CACxC;;CAGA,cAAsB;EACrB,OAAO,KAAK;CACb;;CAGA,MAAM,SAA2B;EAChC,OAAO,KAAK,QAAQ,OAAO,KAAK,QAAQ;CACzC;;CAGA,MAAM,OAAgD;EACrD,OAAO,KAAK,QAAQ,KAAK,KAAK,QAAQ;CACvC;;;;;;CAOA,MAAM,MAAM,MAA2D;EACtE,MAAM,KAAK,MAAM,cAAc,IAAI;EACnC,MAAM,OAAO,IAAI,SAAS,KAAK,UAAU,KAAK,eAAe,KAAK,WAAW;EAC7E,MAAM,KAAK,QAAQ;EACnB,IAAI;GACH,MAAM,UAAmC;IACxC,GAAG;IACH,SAAA;GACD;GACA,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,KAAK,UAAU,OAAO;GAC9D,MAAM,KAAK,MAAM,aAAa,OAAO;GACrC,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD;;;;;;CAOA,MAAM,OACL,SAGuE;EACvE,MAAM,OAAO,IAAI,SAAS,KAAK,UAAU,KAAK,eAAe,KAAK,WAAW;EAC7E,MAAM,KAAK,QAAQ;EACnB,IAAI;GAEH,MAAM,EAAE,MAAM,WAAW,MAAM,QAAQ,MADjB,KAAK,QAAQ,KAAK,KAAK,QAAQ,CACP;GAC9C,MAAM,UAAmC;IACxC,GAAG;IACH,SAAA;GACD;GACA,MAAM,KAAK,MAAM,cAAc,OAAO;GACtC,MAAM,KAAK,QAAQ,MAAM,KAAK,UAAU,OAAO;GAC/C,MAAM,KAAK,MAAM,aAAa,OAAO;GACrC,OAAO;IAAE;IAAQ,SAAS;GAAQ;EACnC,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD;;CAGA,MAAM,QAAuB;EAC5B,MAAM,KAAK,QAAQ,OAAO,KAAK,QAAQ;CACxC;;;;;CAMA,8BAGE;EAMD,OAAO;GACN,gBAAgB;GAChB,WAPiBC,QAAG,SAOZ;GACR,UAPgBA,QAAG,SAOZ;EACR;CACD;;;;;CAMA,MAAM,aAA4B;EACjC,MAAMJ,iBAAI,MAAMK,iBAAAA,iBAAiB,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAML,iBAAI,MAAMC,UAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;CACjE;AACD;;;AC5VA,IAAa,aAAb,MAAwB;CAKvB,YAAY,OAA0B,CAAC,GAAG;EACzC,KAAK,WAAW,KAAK,iBAAiB,IAAI,cAAc;EACxD,KAAK,WAAW,IAAI,SAAS;GAC5B,eAAe,KAAK;GACpB,eAAe,KAAK;GACpB,KAAK,KAAK;EACX,CAAC;EACD,KAAK,wBAAwB,KAAK,yBAAyB;CAC5D;;CAGA,MAAM,SAAgC;EACrC,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK;EACxC,OAAO,SACJ;GACA,cAAc,OAAO;GACrB,UAAU,gBAAgB,MAAM;GAChC,UAAU,gBAAgB,MAAM;GAChC,YAAY,OAAO;GACnB,eAAe,OAAO;EACvB,IACC,EAAE,cAAc,YAAY;CAChC;;CAGA,MAAM,OAAO,OAAmD,CAAC,GAAgC;EAChG,OAAO,KAAK,SAAS,OAAO,IAAI;CACjC;;CAGA,MAAM,oBAAmC;EACxC,MAAM,KAAK,SAAS,kBAAkB;CACvC;;CAGA,cAAuB;EACtB,OAAO,KAAK,SAAS,YAAY;CAClC;;CAGA,MAAM,aAAa,OAAqC,CAAC,GAAsC;EAC9F,MAAM,SAAS,MAAM,KAAK,SAAS,aAAa,IAAI;EACpD,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK;EACxC,OAAO;GACN,GAAG;GACH,mBAAmB,QAAQ;EAC5B;CACD;;;CAIA,MAAM,mBAAmB,OAIe;EACvC,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK;EACxC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,mBAAmB;GACzB,QAAQ,MAAM;GACd,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,UAAU,OAAO;GACjB,cAAc,OAAO;GACrB,eAAe,OAAO;EACvB,CAAC;CACF;;CAGA,MAAM,eAAwD;EAC7D,OAAO,KAAK,SAAS,KAAK;CAC3B;;CAGA,MAAM,QAAuB;EAC5B,MAAM,KAAK,SAAS,MAAM;CAC3B;;CAGA,MAAM,cAA6B;EAClC,MAAM,KAAK,SAAS,YAAY;CACjC;;CAGA,MAAM,cAA6B;EAClC,MAAM,KAAK,SAAS,YAAY;CACjC;;CAGA,mBAAkC;EACjC,OAAO,KAAK;CACb;;CAGA,cAAwB;EACvB,OAAO,KAAK;CACb;;CAGA,iBAA2C;EAC1C,OAAO;CACR;;CAGA,oBAA4B;EAC3B,OAAO,KAAK,sBAAsB;CACnC;AACD;AAEA,SAAS,gBAAgB,QAAsD;CAC9E,OAAO;EACN,UAAU,OAAO;EACjB,eAAe,OAAO;EACtB,cAAc,OAAO;CACtB;AACD;AAEA,SAAS,gBAAgB,QAAiD;CACzE,OAAO;EACN,gBAAgB,OAAO;EACvB,WAAW,OAAO;EAClB,UAAU,OAAO;EACjB,UAAU,OAAO;CAClB;AACD"}

package/dist/device.d.mts

@@ -1,2 +1,2 @@
-import { C as DeviceSignedHeaders, S as DeviceRequestSignatureParams, T as createDeviceRequestSignature, _ as DEVICE_JSON_SCHEMA_VERSION, a as DeviceCoreOptions, b as BuildSignedHeadersParams, c as EnrollRequestFn, d as EnrollerOptions, f as FsIdentityFileBackend, g as AtomicWriteResult, h as IdentityStoreOptions, i as DeviceCore, l as EnrollResponse, m as IdentityStore, n as fingerprintSource, o as DeviceReenrollRequiresAuthError, p as IdentityFileBackend, r as randomInstallationId, s as DeviceSecretVersionMismatchError, t as deriveInstallationId, u as Enroller, v as IdentityStoreHooks, w as buildSignedHeaders, x as DeviceAuthHeaders, y as PersistedDeviceIdentity } from "./index-BI11AfMH.mjs";
+import { C as DeviceSignedHeaders, S as DeviceRequestSignatureParams, T as createDeviceRequestSignature, _ as DEVICE_JSON_SCHEMA_VERSION, a as DeviceCoreOptions, b as BuildSignedHeadersParams, c as EnrollRequestFn, d as EnrollerOptions, f as FsIdentityFileBackend, g as AtomicWriteResult, h as IdentityStoreOptions, i as DeviceCore, l as EnrollResponse, m as IdentityStore, n as fingerprintSource, o as DeviceReenrollRequiresAuthError, p as IdentityFileBackend, r as randomInstallationId, s as DeviceSecretVersionMismatchError, t as deriveInstallationId, u as Enroller, v as IdentityStoreHooks, w as buildSignedHeaders, x as DeviceAuthHeaders, y as PersistedDeviceIdentity } from "./index-DGXYp8J5.mjs";
 export { type AtomicWriteResult, type BuildSignedHeadersParams, DEVICE_JSON_SCHEMA_VERSION, DeviceAuthHeaders, DeviceCore, type DeviceCoreOptions, DeviceReenrollRequiresAuthError, type DeviceRequestSignatureParams, DeviceSecretVersionMismatchError, type DeviceSignedHeaders, type EnrollRequestFn, type EnrollResponse, Enroller, type EnrollerOptions, FsIdentityFileBackend, type IdentityFileBackend, IdentityStore, type IdentityStoreHooks, type IdentityStoreOptions, type PersistedDeviceIdentity, buildSignedHeaders, createDeviceRequestSignature, deriveInstallationId, fingerprintSource, randomInstallationId };

package/dist/device.d.ts

@@ -1,2 +1,2 @@
-import { C as DeviceSignedHeaders, S as DeviceRequestSignatureParams, T as createDeviceRequestSignature, _ as DEVICE_JSON_SCHEMA_VERSION, a as DeviceCoreOptions, b as BuildSignedHeadersParams, c as EnrollRequestFn, d as EnrollerOptions, f as FsIdentityFileBackend, g as AtomicWriteResult, h as IdentityStoreOptions, i as DeviceCore, l as EnrollResponse, m as IdentityStore, n as fingerprintSource, o as DeviceReenrollRequiresAuthError, p as IdentityFileBackend, r as randomInstallationId, s as DeviceSecretVersionMismatchError, t as deriveInstallationId, u as Enroller, v as IdentityStoreHooks, w as buildSignedHeaders, x as DeviceAuthHeaders, y as PersistedDeviceIdentity } from "./index-BI11AfMH.js";
+import { C as DeviceSignedHeaders, S as DeviceRequestSignatureParams, T as createDeviceRequestSignature, _ as DEVICE_JSON_SCHEMA_VERSION, a as DeviceCoreOptions, b as BuildSignedHeadersParams, c as EnrollRequestFn, d as EnrollerOptions, f as FsIdentityFileBackend, g as AtomicWriteResult, h as IdentityStoreOptions, i as DeviceCore, l as EnrollResponse, m as IdentityStore, n as fingerprintSource, o as DeviceReenrollRequiresAuthError, p as IdentityFileBackend, r as randomInstallationId, s as DeviceSecretVersionMismatchError, t as deriveInstallationId, u as Enroller, v as IdentityStoreHooks, w as buildSignedHeaders, x as DeviceAuthHeaders, y as PersistedDeviceIdentity } from "./index-DGXYp8J5.js";
 export { type AtomicWriteResult, type BuildSignedHeadersParams, DEVICE_JSON_SCHEMA_VERSION, DeviceAuthHeaders, DeviceCore, type DeviceCoreOptions, DeviceReenrollRequiresAuthError, type DeviceRequestSignatureParams, DeviceSecretVersionMismatchError, type DeviceSignedHeaders, type EnrollRequestFn, type EnrollResponse, Enroller, type EnrollerOptions, FsIdentityFileBackend, type IdentityFileBackend, IdentityStore, type IdentityStoreHooks, type IdentityStoreOptions, type PersistedDeviceIdentity, buildSignedHeaders, createDeviceRequestSignature, deriveInstallationId, fingerprintSource, randomInstallationId };

package/dist/device.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_device = require("./device-DuAYH8bk.js");
+const require_device = require("./device-yWpY_Zds.js");
 exports.DEVICE_JSON_SCHEMA_VERSION = require_device.DEVICE_JSON_SCHEMA_VERSION;
 exports.DeviceAuthHeaders = require_device.DeviceAuthHeaders;
 exports.DeviceCore = require_device.DeviceCore;

package/dist/device.mjs

@@ -1,2 +1,2 @@
-import { a as DeviceReenrollRequiresAuthError, c as deriveInstallationId, d as DeviceAuthHeaders, f as buildSignedHeaders, i as DEVICE_JSON_SCHEMA_VERSION, l as fingerprintSource, n as FsIdentityFileBackend, o as DeviceSecretVersionMismatchError, p as createDeviceRequestSignature, r as IdentityStore, s as Enroller, t as DeviceCore, u as randomInstallationId } from "./device-CDDcwDY6.mjs";
+import { a as DeviceReenrollRequiresAuthError, c as deriveInstallationId, d as DeviceAuthHeaders, f as buildSignedHeaders, i as DEVICE_JSON_SCHEMA_VERSION, l as fingerprintSource, n as FsIdentityFileBackend, o as DeviceSecretVersionMismatchError, p as createDeviceRequestSignature, r as IdentityStore, s as Enroller, t as DeviceCore, u as randomInstallationId } from "./device-DCo0rgUt.mjs";
 export { DEVICE_JSON_SCHEMA_VERSION, DeviceAuthHeaders, DeviceCore, DeviceReenrollRequiresAuthError, DeviceSecretVersionMismatchError, Enroller, FsIdentityFileBackend, IdentityStore, buildSignedHeaders, createDeviceRequestSignature, deriveInstallationId, fingerprintSource, randomInstallationId };

package/dist/{index-BI11AfMH.d.ts → index-DGXYp8J5.d.mts}

@@ -1,10 +1,10 @@
 import { DeviceBindingState, DeviceEnrollResult, DeviceRotateSecretResult, DeviceStatus } from "@serviceme/devtools-protocol";
 //#region src/device/deviceAuth.d.ts
 /**
- * deviceAuth — Pure HMAC-SHA-256 signing helpers for device auth headers.
+ * deviceAuth — Device request signing helpers for device auth headers.
  *
  * **Boundary exception copy.** The single source of truth for the
- * `x-ms-device-*` header names + the signature algorithm now lives in
+ * `x-ms-device-*` header names + the signature algorithms now lives in
  * `@serviceme/devtools-shared` (`device-auth.ts`), consumed by the
  * extension signer and the server verifier. ADL-003 forbids
  * core → shared (and shared → core), so this module keeps a
@@ -12,8 +12,11 @@ import { DeviceBindingState, DeviceEnrollResult, DeviceRotateSecretResult, Devic
  * with `packages/serviceme-shared/src/device-auth.ts`.
  *
  * See `docs/architecture/phase-5-device-header-spec.md` §5 for the wire
- * format. The basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
- * (LF-joined, NOT JSON). Output is lowercase hex SHA-256.
+ * format. Legacy (v1) basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+ * hashed with a secret-suffix SHA-256; v2 basis is
+ * `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET` MACed with real
+ * HMAC-SHA-256 keyed by the device secret and signed over the full
+ * path-with-query. Both output lowercase hex.
  */
 /** Canonical header names — MUST match `@serviceme/devtools-shared`'s `DeviceAuthHeaders`. */
 declare const DeviceAuthHeaders: {
@@ -22,6 +25,12 @@ declare const DeviceAuthHeaders: {
   readonly signature: "x-ms-device-signature";
   readonly timestamp: "x-ms-device-timestamp";
   readonly secretVersion: "x-ms-device-secret-version";
+  /** v2 only — algorithm self-declaration so the server can verify
+   * both schemes during the legacy-client rollout window. */
+  readonly sigAlg: "x-ms-device-sig-alg";
+  /** v2 only — one-time value folded into the signature basis and
+   * checked against a server-side replay cache. */
+  readonly nonce: "x-ms-device-nonce";
 };
 interface DeviceRequestSignatureParams {
   method: string;
@@ -31,23 +40,24 @@ interface DeviceRequestSignatureParams {
   secret: string;
 }
 /**
- * Compute the HMAC-SHA-256 hex digest of the canonical basis.
- *
- * Server contract (`apps/server/src/lib/auth/device-signature-guard.ts:46-62`)
- * is line-for-line identical: same LF-joined basis, same lowercase
- * hex output. Any divergence breaks `device-signature-guard.test.ts`.
+ * Legacy (v1) secret-suffix SHA-256 over the canonical basis. Retained
+ * for backward compatibility with fielded verifiers/clients that
+ * predate v2; new code should use `createDeviceRequestSignatureV2`.
  */
 declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
-/** 5-header map consumed by `fetch()` callers (CLI bridge, Extension). */
+/** Header map consumed by `fetch()` callers (CLI bridge, Extension). */
 interface DeviceSignedHeaders {
   [DeviceAuthHeaders.deviceId]: string;
   [DeviceAuthHeaders.deviceSecret]: string;
   [DeviceAuthHeaders.signature]: string;
   [DeviceAuthHeaders.timestamp]: string;
   [DeviceAuthHeaders.secretVersion]: string;
+  [DeviceAuthHeaders.sigAlg]: string;
+  [DeviceAuthHeaders.nonce]: string;
 }
 interface BuildSignedHeadersParams {
   method: string;
+  /** Full request path INCLUDING the query string (v2 signs it). */
   path: string;
   body: string;
   publicId: string;
@@ -55,11 +65,15 @@ interface BuildSignedHeadersParams {
   secretVersion: number;
   /** Override for deterministic tests. */
   timestamp?: number;
+  /** Override for deterministic tests; defaults to a fresh random UUID. */
+  nonce?: string;
 }
 /**
- * Build the canonical 5-header map. The `body` parameter MUST be the
- * exact byte sequence sent on the wire (no whitespace re-canonicalization
- * between client serialization and signature basis construction).
+ * Build the v2 header map. The `path` parameter MUST include the exact
+ * query string sent on the wire, and the `body` parameter MUST be the
+ * exact byte sequence sent on the wire (no whitespace
+ * re-canonicalization between client serialization and signature basis
+ * construction).
  */
 declare function buildSignedHeaders(params: BuildSignedHeadersParams): DeviceSignedHeaders;
 //#endregion
@@ -312,7 +326,8 @@ declare class DeviceCore {
   rotateSecret(opts?: {
     gracePeriodDays?: number;
   }): Promise<DeviceRotateSecretResult>;
-  /** Build the canonical 5-header map for an outbound signed request. */
+  /** Build the v2 signed header map for an outbound request. The path
+   * MUST include the query string (v2 signs it). */
   buildSignedHeaders(input: {
     method: string;
     path: string;
@@ -374,4 +389,4 @@ declare function randomInstallationId(): string;
 declare function fingerprintSource(): string;
 //#endregion
 export { DeviceSignedHeaders as C, DeviceRequestSignatureParams as S, createDeviceRequestSignature as T, DEVICE_JSON_SCHEMA_VERSION as _, DeviceCoreOptions as a, BuildSignedHeadersParams as b, EnrollRequestFn as c, EnrollerOptions as d, FsIdentityFileBackend as f, AtomicWriteResult as g, IdentityStoreOptions as h, DeviceCore as i, EnrollResponse as l, IdentityStore as m, fingerprintSource as n, DeviceReenrollRequiresAuthError as o, IdentityFileBackend as p, randomInstallationId as r, DeviceSecretVersionMismatchError as s, deriveInstallationId as t, Enroller as u, IdentityStoreHooks as v, buildSignedHeaders as w, DeviceAuthHeaders as x, PersistedDeviceIdentity as y };
-//# sourceMappingURL=index-BI11AfMH.d.ts.map
+//# sourceMappingURL=index-DGXYp8J5.d.mts.map

package/dist/{index-BI11AfMH.d.mts → index-DGXYp8J5.d.ts}

@@ -1,10 +1,10 @@
 import { DeviceBindingState, DeviceEnrollResult, DeviceRotateSecretResult, DeviceStatus } from "@serviceme/devtools-protocol";
 //#region src/device/deviceAuth.d.ts
 /**
- * deviceAuth — Pure HMAC-SHA-256 signing helpers for device auth headers.
+ * deviceAuth — Device request signing helpers for device auth headers.
  *
  * **Boundary exception copy.** The single source of truth for the
- * `x-ms-device-*` header names + the signature algorithm now lives in
+ * `x-ms-device-*` header names + the signature algorithms now lives in
  * `@serviceme/devtools-shared` (`device-auth.ts`), consumed by the
  * extension signer and the server verifier. ADL-003 forbids
  * core → shared (and shared → core), so this module keeps a
@@ -12,8 +12,11 @@ import { DeviceBindingState, DeviceEnrollResult, DeviceRotateSecretResult, Devic
  * with `packages/serviceme-shared/src/device-auth.ts`.
  *
  * See `docs/architecture/phase-5-device-header-spec.md` §5 for the wire
- * format. The basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
- * (LF-joined, NOT JSON). Output is lowercase hex SHA-256.
+ * format. Legacy (v1) basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+ * hashed with a secret-suffix SHA-256; v2 basis is
+ * `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET` MACed with real
+ * HMAC-SHA-256 keyed by the device secret and signed over the full
+ * path-with-query. Both output lowercase hex.
  */
 /** Canonical header names — MUST match `@serviceme/devtools-shared`'s `DeviceAuthHeaders`. */
 declare const DeviceAuthHeaders: {
@@ -22,6 +25,12 @@ declare const DeviceAuthHeaders: {
   readonly signature: "x-ms-device-signature";
   readonly timestamp: "x-ms-device-timestamp";
   readonly secretVersion: "x-ms-device-secret-version";
+  /** v2 only — algorithm self-declaration so the server can verify
+   * both schemes during the legacy-client rollout window. */
+  readonly sigAlg: "x-ms-device-sig-alg";
+  /** v2 only — one-time value folded into the signature basis and
+   * checked against a server-side replay cache. */
+  readonly nonce: "x-ms-device-nonce";
 };
 interface DeviceRequestSignatureParams {
   method: string;
@@ -31,23 +40,24 @@ interface DeviceRequestSignatureParams {
   secret: string;
 }
 /**
- * Compute the HMAC-SHA-256 hex digest of the canonical basis.
- *
- * Server contract (`apps/server/src/lib/auth/device-signature-guard.ts:46-62`)
- * is line-for-line identical: same LF-joined basis, same lowercase
- * hex output. Any divergence breaks `device-signature-guard.test.ts`.
+ * Legacy (v1) secret-suffix SHA-256 over the canonical basis. Retained
+ * for backward compatibility with fielded verifiers/clients that
+ * predate v2; new code should use `createDeviceRequestSignatureV2`.
  */
 declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
-/** 5-header map consumed by `fetch()` callers (CLI bridge, Extension). */
+/** Header map consumed by `fetch()` callers (CLI bridge, Extension). */
 interface DeviceSignedHeaders {
   [DeviceAuthHeaders.deviceId]: string;
   [DeviceAuthHeaders.deviceSecret]: string;
   [DeviceAuthHeaders.signature]: string;
   [DeviceAuthHeaders.timestamp]: string;
   [DeviceAuthHeaders.secretVersion]: string;
+  [DeviceAuthHeaders.sigAlg]: string;
+  [DeviceAuthHeaders.nonce]: string;
 }
 interface BuildSignedHeadersParams {
   method: string;
+  /** Full request path INCLUDING the query string (v2 signs it). */
   path: string;
   body: string;
   publicId: string;
@@ -55,11 +65,15 @@ interface BuildSignedHeadersParams {
   secretVersion: number;
   /** Override for deterministic tests. */
   timestamp?: number;
+  /** Override for deterministic tests; defaults to a fresh random UUID. */
+  nonce?: string;
 }
 /**
- * Build the canonical 5-header map. The `body` parameter MUST be the
- * exact byte sequence sent on the wire (no whitespace re-canonicalization
- * between client serialization and signature basis construction).
+ * Build the v2 header map. The `path` parameter MUST include the exact
+ * query string sent on the wire, and the `body` parameter MUST be the
+ * exact byte sequence sent on the wire (no whitespace
+ * re-canonicalization between client serialization and signature basis
+ * construction).
  */
 declare function buildSignedHeaders(params: BuildSignedHeadersParams): DeviceSignedHeaders;
 //#endregion
@@ -312,7 +326,8 @@ declare class DeviceCore {
   rotateSecret(opts?: {
     gracePeriodDays?: number;
   }): Promise<DeviceRotateSecretResult>;
-  /** Build the canonical 5-header map for an outbound signed request. */
+  /** Build the v2 signed header map for an outbound request. The path
+   * MUST include the query string (v2 signs it). */
   buildSignedHeaders(input: {
     method: string;
     path: string;
@@ -374,4 +389,4 @@ declare function randomInstallationId(): string;
 declare function fingerprintSource(): string;
 //#endregion
 export { DeviceSignedHeaders as C, DeviceRequestSignatureParams as S, createDeviceRequestSignature as T, DEVICE_JSON_SCHEMA_VERSION as _, DeviceCoreOptions as a, BuildSignedHeadersParams as b, EnrollRequestFn as c, EnrollerOptions as d, FsIdentityFileBackend as f, AtomicWriteResult as g, IdentityStoreOptions as h, DeviceCore as i, EnrollResponse as l, IdentityStore as m, fingerprintSource as n, DeviceReenrollRequiresAuthError as o, IdentityFileBackend as p, randomInstallationId as r, DeviceSecretVersionMismatchError as s, deriveInstallationId as t, Enroller as u, IdentityStoreHooks as v, buildSignedHeaders as w, DeviceAuthHeaders as x, PersistedDeviceIdentity as y };
-//# sourceMappingURL=index-BI11AfMH.d.mts.map
+//# sourceMappingURL=index-DGXYp8J5.d.ts.map

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { A as KeyValueStore, C as AuthStateManagerOptions, D as AccessCheckResult, E as noopLogger, O as AccessControl, S as AuthStateManager, T as createConsoleLogger, _ as KeychainAccountKey, a as MicrosoftProviderNotHostedError, b as KeychainTokenMetadata, c as AuthCore, d as DeviceFlowUiCallback, f as ProviderRegistry, g as InMemoryKeychainAuthTokenStore, h as IAuthProviderUserInfo, i as MicrosoftAuthProvider, j as OrgMembershipFetcher, k as AccessControlOptions, l as AuthCoreOptions, m as IAuthProviderSession, n as isGitHubLocalEmail, o as GitHubAuthProvider, p as IAuthProvider, r as resolvePrimaryEmail, s as GitHubAuthProviderConfig, t as buildGitHubLocalEmail, u as CancellationCheck, v as KeychainAuthTokenStore, w as ServiceMeLogger, x as KeychainUnavailableError, y as KeychainTokenEnvelope } from "./index-CoA6y0MP.mjs";
-import { C as DeviceSignedHeaders, S as DeviceRequestSignatureParams, T as createDeviceRequestSignature, _ as DEVICE_JSON_SCHEMA_VERSION, a as DeviceCoreOptions, b as BuildSignedHeadersParams, c as EnrollRequestFn, d as EnrollerOptions, f as FsIdentityFileBackend, g as AtomicWriteResult, h as IdentityStoreOptions, i as DeviceCore, l as EnrollResponse, m as IdentityStore, n as fingerprintSource, o as DeviceReenrollRequiresAuthError, p as IdentityFileBackend, r as randomInstallationId, s as DeviceSecretVersionMismatchError, t as deriveInstallationId, u as Enroller, v as IdentityStoreHooks, w as buildSignedHeaders, x as DeviceAuthHeaders, y as PersistedDeviceIdentity } from "./index-BI11AfMH.mjs";
+import { C as DeviceSignedHeaders, S as DeviceRequestSignatureParams, T as createDeviceRequestSignature, _ as DEVICE_JSON_SCHEMA_VERSION, a as DeviceCoreOptions, b as BuildSignedHeadersParams, c as EnrollRequestFn, d as EnrollerOptions, f as FsIdentityFileBackend, g as AtomicWriteResult, h as IdentityStoreOptions, i as DeviceCore, l as EnrollResponse, m as IdentityStore, n as fingerprintSource, o as DeviceReenrollRequiresAuthError, p as IdentityFileBackend, r as randomInstallationId, s as DeviceSecretVersionMismatchError, t as deriveInstallationId, u as Enroller, v as IdentityStoreHooks, w as buildSignedHeaders, x as DeviceAuthHeaders, y as PersistedDeviceIdentity } from "./index-DGXYp8J5.mjs";
 import { i as SkillKind, r as SkillFile } from "./types-BCV3IedE.mjs";
 import { a as SubmitError, c as NodeGitSpawner, d as toFileUrl, f as GitError, i as SubmitResult, l as StubGitSpawner, n as SubmitClientOptions, o as GIT_PROXY_PATH_SUFFIX, p as PullResult, r as SubmitOptions, s as GitClient, t as SubmitClient, u as buildGitProxyBase } from "./index-2rX86yMq.mjs";
 import { _ as reindexOrder, a as ToolboxFileBackend, b as touchLastUsedAt, c as ToolboxStoreOptions, d as DefaultToolSeed, f as PersistedToolbox, g as mergeWithDefaults, h as ToolboxPatch, i as FsToolboxFileBackend, l as WORKSPACE_TOOLBOX_RELATIVE_PATH, m as TOOLBOX_JSON_SCHEMA_VERSION, n as ToolboxCore, o as ToolboxStore, p as ResolvedToolbox, r as ToolboxCoreOptions, s as ToolboxStoreHooks, t as DefaultToolImmutableError, u as BUILTIN_DEFAULT_TOOLS, v as sortByRecentFirst, y as sortByUserOrder } from "./index-DaW7IYA-.mjs";
@@ -1682,8 +1682,6 @@ export declare const AGENT_DRAFTS_SUBDIR = "agents";
 export declare const REPOS_CONFIG_FILENAME = "repos.json";
 export declare const WORKSPACES_SUBDIR = "workspaces";
 export declare const WORKSPACE_CONTENT_STATE_FILENAME = "copilot-content-state.json";
-/** rev.20 — r7 BYOM Server Proxy toggle self-state (read by ext + CLI + server). */
-export declare const SERVER_PROXY_GLOBAL_FILENAME = "server-proxy.json";
 /**
  * Repo id regex — used to validate any `repoId` argument before it is joined
  * into a filesystem path. Keeps path traversal attempts out and gives us a
@@ -1770,18 +1768,6 @@ export declare function getSchedulerLogPath(): string;
 export declare function getMigrationFailuresPath(): string;
 /** `~/.serviceme/known-workspaces.json` — workspace list the extension has seen. */
 export declare function getKnownWorkspacesPath(): string;
-/**
- * `~/.serviceme/server-proxy.json` — r7 BYOM Server Proxy toggle
- * self-state. Written by the extension's `ProxyConfigService`, readable
- * by the CLI / Server so they can decide whether to route traffic
- * through the corporate proxy without booting VS Code.
- *
- * Lives under user-level `~/.serviceme/` (not under a workspace) because
- * the toggle is a *user preference* — the same human enabling it on
- * machine A should be able to rely on it on machine B after sync, not
- * have it disappear when they switch repos.
- */
-export declare function getServerProxyGlobalPath(): string;
 /** Layout constants for the Phase 5 client-side state files. The server
  * already has the corresponding routes (`/api/v1/auth/...`,
  * `/api/v1/device/...`, etc.) — the client just needs the on-disk
@@ -1803,72 +1789,6 @@ export declare function getMachineIdPath(): string;
 /** `~/.serviceme/profiles.json` — cached projection of server-side profile rows; refresh on demand. */
 export declare function getProfilesJsonPath(): string;
 //#endregion
-//#region src/paths/serverProxyGlobal.d.ts
-/** On-disk shape for `~/.serviceme/server-proxy.json`. */
-export interface ServerProxyGlobalState {
-  /** Whether the user has previously enabled Server Proxy. */
-  enabled: boolean;
-  /** Last server URL we toggled ON with. Used for re-toggling and UI hint. */
-  lastServerUrl: string | undefined;
-  /**
-   * rev.21 — explicit opt-in to enable Server Proxy even when
-   * `http.proxySupport === "override"`. `override` mode forces ALL
-   * extensions to route through `http.proxy`; defaulting to `false`
-   * keeps the legacy defensive guard against accidental global
-   * hijack. Power users (e.g. corp environments that WANT all
-   * extensions including GitHub Copilot Chat to route through the
-   * corp tunnel) can flip this on via the Webview's "Allow under
-   * proxySupport=override" affordance.
-   *
-   * Note: stored in the global file alongside `enabled` because
-   * this is *our* self-flag — it has nothing to do with VS Code's
-   * `http.*` schema.
-   */
-  allowOverride: boolean;
-  /** ISO 8601 timestamp of the most recent write. Diagnostic only. */
-  updatedAt: string;
-}
-/**
- * Patch semantics (mirrors `vscode.workspace.getConfiguration().update(...)`):
- *   - Field omitted / `undefined` → leave the existing value alone.
- *   - Field set to `null`           → explicitly clear the field.
- *
- * Only `lastServerUrl` distinguishes "leave alone" from "clear"; `enabled`
- * and `allowOverride` are plain `boolean | undefined` because boolean is
- * the natural unit (false = "the user disabled it").
- */
-export interface ServerProxyGlobalPatch {
-  enabled?: boolean;
-  allowOverride?: boolean;
-  lastServerUrl?: string | null;
-}
-/**
- * Reads the global config file. Returns `null` if the file does not
- * exist (first-run case) — does NOT throw. Throws on parse errors or
- * permission issues, so callers can surface those to the user.
- */
-export declare function readServerProxyGlobal(): Promise<ServerProxyGlobalState | null>;
-/**
- * Merges a partial patch into the existing state and writes back
- * atomically. Creates `~/.serviceme/` if missing.
- *
- * Returns the post-write state. Throws on IO/JSON errors.
- */
-export declare function writeServerProxyGlobal(patch: ServerProxyGlobalPatch): Promise<ServerProxyGlobalState>;
-/**
- * Best-effort migration of a legacy `enabled` flag (typically read from
- * VS Code's `settings.json` at `serverProxy.enabled`) into the global
- * config file.
- *
- * Reads via the provided accessor (so tests can stub it), writes the
- * global flag if present, then **clears** the legacy flag via the
- * provided writer — never silently leaves the migration half-done.
- *
- * Returns the migrated state, or `null` if no migration was needed
- * (legacy flag absent OR global config already up to date).
- */
-export declare function migrateLegacyServerProxyEnabled(readLegacy: () => boolean | undefined, clearLegacy: () => Promise<void>): Promise<ServerProxyGlobalState | null>;
-//#endregion
 //#region src/permissions/agent-permissions.d.ts
 export declare const TOOL_RISK_MAP: Record<string, AgentToolRiskLevel>;
 export declare function parseAgentToolPermissions(content: string): AgentToolPermission[];
@@ -1915,12 +1835,23 @@ interface BootstrapPhase5Result {
 export declare function bootstrapPhase5Placeholders(): Promise<BootstrapPhase5Result>;
 //#endregion
 //#region src/project/projectTools.d.ts
+export interface ScaffoldPruneOptions {
+  /** Optional capability module ids to turn off (--no-module, repeatable). */
+  disabledModules?: string[];
+}
 export declare class ProjectTools {
   extractTemplate(zipPath: string, workspacePath: string, tempExtractDir: string, input: ServiceMeProjectExtractTemplateInput): Promise<ServiceMeProjectExtractTemplateResult>;
   installDependencies(workspacePath: string, command?: string): Promise<ServiceMeProjectInstallDepsResult>;
   makeScriptsExecutable(workspacePath: string): Promise<ServiceMeProjectMakeScriptsExecutableResult>;
   initializeGit(workspacePath: string): Promise<ServiceMeProjectGitInitResult>;
-  runScaffoldPrune(workspacePath: string, preset?: string): Promise<ServiceMeProjectScaffoldPruneResult>;
+  runScaffoldPrune(workspacePath: string, preset?: string, options?: ScaffoldPruneOptions): Promise<ServiceMeProjectScaffoldPruneResult>;
+  /**
+   * `prune.mjs --format json` prints its result object (pretty-printed) as
+   * the only stdout payload, but stay tolerant: if log noise precedes it,
+   * fall back to the last line-initial `{` and try from there. Any parse
+   * failure degrades to an empty list — follow-ups are advisory.
+   */
+  private parseRecommendedNextSteps;
   private ensurePresetManifest;
   private findScripts;
   private pathExists;