@skrr-ai/cli 0.1.109 → 0.1.110

package/dist/lib/triggers.js

@@ -27,6 +27,7 @@ exports.assertKindFlagsApply = assertKindFlagsApply;
 exports.assertModeRequiredFlags = assertModeRequiredFlags;
 exports.describeScheduledFire = describeScheduledFire;
 exports.fireWasAccepted = fireWasAccepted;
+exports.describeStrictFireRefusal = describeStrictFireRefusal;
 exports.describeFireDetail = describeFireDetail;
 exports.formatFireInZone = formatFireInZone;
 exports.nextFireLines = nextFireLines;
@@ -50,6 +51,7 @@ exports.renderTriggerSummary = renderTriggerSummary;
 exports.renderLegacyRuns = renderLegacyRuns;
 exports.renderFireAudit = renderFireAudit;
 const data_provider_1 = require("@skrr-ai/data-provider");
+const node_fs_1 = require("node:fs");
 const format_1 = require("./format");
 exports.TRIGGER_KINDS = [
     'schedule',
@@ -390,12 +392,28 @@ function parseJsonObject(raw, flagName) {
     }
     return parsed;
 }
+/**
+ * A JSON-array flag value: inline JSON, `@path` (a file), or a bare path to an existing file. A
+ * path used to reach `JSON.parse` and fail with "Unexpected token '/'" (OSK-15402).
+ */
 function parseJsonArray(raw, flagName) {
     if (raw === undefined)
         return undefined;
+    let text = raw;
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('@') || (!/^[[{]/.test(trimmed) && (0, node_fs_1.existsSync)(trimmed))) {
+        const path = trimmed.startsWith('@') ? trimmed.slice(1) : trimmed;
+        try {
+            text = (0, node_fs_1.readFileSync)(path, 'utf8');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new Error(`Cannot read ${flagName} file ${path}: ${msg}`);
+        }
+    }
     let parsed;
     try {
-        parsed = JSON.parse(raw);
+        parsed = JSON.parse(text);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -443,6 +461,13 @@ function buildScheduleConfigFromFlags(flags) {
         endAt: flags['end-at'],
         staleCatchupMs: flags['stale-catchup-ms'],
     });
+    // The range is the server's (`TRIGGER_STALE_CATCHUP_MS_RANGE`), checked here too so the refusal
+    // names the flag the person typed and happens before anything is sent (OSK-16474).
+    if (flags['stale-catchup-ms'] !== undefined) {
+        const refusal = (0, data_provider_1.describeStaleCatchupMsRefusal)(flags['stale-catchup-ms'], '--stale-catchup-ms');
+        if (refusal)
+            throw new Error(refusal);
+    }
     return schedule;
 }
 function assertScheduleTimingShape(schedule, options = {}) {
@@ -840,6 +865,23 @@ function fireWasAccepted(result) {
         typeof result.originalOutcome === 'string' &&
         accepted.includes(result.originalOutcome));
 }
+/**
+ * Why `triggers fire --strict` failed. A strict failure used to print exactly what the exit-0 run
+ * printed and then exit 1, so nothing said what the flag had judged (OSK-16474). It names the
+ * outcome it refused, the reason, the server's sentence when there is one, and what --strict
+ * accepts.
+ */
+function describeStrictFireRefusal(result) {
+    const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : '');
+    const outcome = text(result.outcome) || 'unknown';
+    const original = outcome === 'duplicate' ? text(result.originalOutcome) : '';
+    const reason = text(result.reason);
+    const sentence = text(result.detail) || text(result.errorMessage);
+    return (`--strict: the fire was not accepted (outcome ${outcome}` +
+        `${original ? `, a repeat of ${original}` : ''}${reason ? `, reason ${reason}` : ''})` +
+        `${sentence ? `: ${sentence}` : '.'} ` +
+        `--strict accepts only ${data_provider_1.ACCEPTED_AGENT_TRIGGER_FIRE_OUTCOMES.join(', ')}, or a repeat of one.`);
+}
 /**
  * The lines a fire or replay owes beyond `outcome=… reason=…` (OSK-15494): the sentence the
  * server wrote ("Replayed fire … resolved a step that was not waiting when that fire ran:

package/dist/lib/workflow-run-view.d.ts

@@ -21,6 +21,10 @@ export interface RunViewNode {
     waitKind?: unknown;
     signalable?: unknown;
     waitingFor?: unknown;
+    stoppedBecause?: {
+        code?: unknown;
+        message?: unknown;
+    } | null;
     loopSummary?: {
         total?: unknown;
         completed?: unknown;

package/dist/lib/workflow-run-view.js

@@ -53,6 +53,11 @@ function describeNodeDetail(node, attention = '') {
         parts.push(attention);
     if (wait)
         parts.push(wait.text);
+    // A cancelled node says why it stopped (the run's deadline, a person's stop), not the
+    // problem it had been parked on before (OSK-16473).
+    const stopped = node.status === 'cancelled' ? node.stoppedBecause?.message : undefined;
+    if (typeof stopped === 'string' && stopped)
+        parts.push(`stopped: ${stopped}`);
     const loop = describeLoopProgress(node);
     if (loop)
         parts.push(loop);

package/dist/lib/workspaces.d.ts

@@ -35,6 +35,8 @@ export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
     membership: {
         status: 'active' | 'absent' | 'unavailable';
         role?: string;
+        /** `false` on `absent`: a removed member and an id that never existed read alike. */
+        canDistinguishRemoved?: boolean;
     };
     commitments: StewardshipCommitmentMetadata[] | null;
     approverSeats: StewardshipCommitmentMetadata[] | null;
@@ -45,17 +47,31 @@ export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
 }
 export declare function getWorkspaceStewardship(workspaceId: string, memberUserId: string): Promise<WorkspaceStewardshipReport>;
 /** One current member of a workspace, as `GET /api/workspaces/:id/members` returns it. */
+/**
+ * One current member as `skrr workspaces members` shows it, in its table and in
+ * `--json` alike (OSK-16472). Only these fields: the endpoint's raw row also carries
+ * the membership `_id`, monthly usage counters the web billing tab reads, and the
+ * user's avatar, none of which a members listing promises.
+ */
 export interface WorkspaceMemberRow {
     userId: string;
-    role: string;
-    joinedAt?: string;
+    name: string | null;
+    email: string | null;
+    role: string | null;
+    joinedAt: string | null;
+}
+interface RawWorkspaceMember {
+    userId?: unknown;
+    role?: unknown;
+    joinedAt?: unknown;
     user?: {
-        _id?: string;
-        name?: string;
-        username?: string;
-        email?: string;
-    };
+        name?: unknown;
+        username?: unknown;
+        email?: unknown;
+    } | null;
 }
+/** The ONE projection of a raw members row; nothing else of it reaches output. */
+export declare function toWorkspaceMemberRow(raw: RawWorkspaceMember): WorkspaceMemberRow;
 export declare function listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMemberRow[]>;
 /** A user id as the stewardship route takes it: a 24-hex ObjectId. */
 export declare const USER_ID_PATTERN: RegExp;
@@ -226,3 +242,4 @@ export declare function getWorkspace(workspaceId: string): Promise<WorkspaceRow>
  * session history to the wrong team.
  */
 export declare function matchWorkspace(rows: WorkspaceRow[], ref: string): WorkspaceRow[];
+export {};

package/dist/lib/workspaces.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MemberReferenceError = exports.USER_ID_PATTERN = void 0;
 exports.getWorkspaceStewardship = getWorkspaceStewardship;
+exports.toWorkspaceMemberRow = toWorkspaceMemberRow;
 exports.listWorkspaceMembers = listWorkspaceMembers;
 exports.resolveMemberUserId = resolveMemberUserId;
 exports.listWorkspaceGrants = listWorkspaceGrants;
@@ -18,9 +19,20 @@ const triggers_1 = require("./triggers");
 async function getWorkspaceStewardship(workspaceId, memberUserId) {
     return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/members/${encodeURIComponent(memberUserId)}`);
 }
+const text = (value) => (typeof value === 'string' && value ? value : null);
+/** The ONE projection of a raw members row; nothing else of it reaches output. */
+function toWorkspaceMemberRow(raw) {
+    return {
+        userId: String(raw.userId ?? ''),
+        name: text(raw.user?.name) ?? text(raw.user?.username),
+        email: text(raw.user?.email),
+        role: text(raw.role),
+        joinedAt: text(raw.joinedAt),
+    };
+}
 async function listWorkspaceMembers(workspaceId) {
     const response = await (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/members`);
-    return Array.isArray(response?.data) ? response.data : [];
+    return Array.isArray(response?.data) ? response.data.map(toWorkspaceMemberRow) : [];
 }
 /** A user id as the stewardship route takes it: a 24-hex ObjectId. */
 exports.USER_ID_PATTERN = /^[a-f0-9]{24}$/i;
@@ -51,7 +63,7 @@ async function resolveMemberUserId(workspaceId, reference, list = listWorkspaceM
         throw new MemberReferenceError(`"${reference}" is not a user id or an email. A user id is 24 hexadecimal characters. ${listHint}`);
     }
     const email = value.toLowerCase();
-    const matches = (await list(workspaceId)).filter((member) => member.user?.email?.toLowerCase() === email);
+    const matches = (await list(workspaceId)).filter((member) => member.email?.toLowerCase() === email);
     if (matches.length === 1)
         return String(matches[0].userId);
     throw new MemberReferenceError(matches.length === 0

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -30,7 +30,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
-export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
-exports.qualifyMachineUuid = exports.getMachineUuidProfile = exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
-exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = void 0;
-exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
+exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.describeMachineIdentity = exports.getMachineUuidForProfile = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
+exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = exports.qualifyMachineUuid = exports.getMachineUuidProfile = void 0;
+exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -284,6 +284,8 @@ Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable:
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
 var machineUuid_js_1 = require("./machineUuid.js");
 Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
+Object.defineProperty(exports, "getMachineUuidForProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidForProfile; } });
+Object.defineProperty(exports, "describeMachineIdentity", { enumerable: true, get: function () { return machineUuid_js_1.describeMachineIdentity; } });
 Object.defineProperty(exports, "getHardwareMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getHardwareMachineUuid; } });
 Object.defineProperty(exports, "setMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.setMachineUuidProfile; } });
 Object.defineProperty(exports, "getMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidProfile; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.d.ts

@@ -56,5 +56,65 @@ export declare function getMachineUuidProfile(): string | null;
  * profile that already held credentials; see the block above.
  */
 export declare function getMachineUuid(): string;
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+export declare function getMachineUuidForProfile(profile: string | null | undefined): string;
+export type MachineIdentityReason = 
+/** The default profile, which always uses this computer's own identity. */
+'default_profile'
+/** A hosted runtime, whose identity the control plane issued. */
+ | 'hosted_runtime'
+/** A profile that held no credentials when its identity was first decided. */
+ | 'new_profile'
+/** A profile that already held credentials, so it keeps the shared identity. */
+ | 'pre_existing_profile'
+/** Recovered from the copy kept outside the profile after product state was removed. */
+ | 'restored_profile'
+/** The profile's record could not be read (the identity is still the one in use). */
+ | 'unrecorded';
+export interface MachineIdentityDescription {
+    /** The profile this process runs as; null for the default profile. */
+    profile: string | null;
+    /** The value sent to the server as `machineUuid`. */
+    machineUuid: string;
+    /** This computer's own identity. */
+    hardware: string;
+    /**
+     * A non-default profile that registers on the SAME machine row as the default
+     * profile: they share one Daemon row, one device-key pin and one machine page.
+     */
+    sharesDefaultMachine: boolean;
+    reason: MachineIdentityReason;
+    /** The files that made a profile "already hold credentials", when recorded. */
+    evidence: string[];
+    decidedAt: string | null;
+    /** One sentence for a person. Written once, here, so no surface words it differently. */
+    sentence: string;
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+export declare function describeMachineIdentity(): MachineIdentityDescription;
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export declare function __resetMachineUuidCacheForTest(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -10,6 +10,8 @@ exports.qualifyMachineUuid = qualifyMachineUuid;
 exports.setMachineUuidProfile = setMachineUuidProfile;
 exports.getMachineUuidProfile = getMachineUuidProfile;
 exports.getMachineUuid = getMachineUuid;
+exports.getMachineUuidForProfile = getMachineUuidForProfile;
+exports.describeMachineIdentity = describeMachineIdentity;
 exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
 /**
  * machineUuid.ts — the ONE hardware machine identity sent to the server as
@@ -231,7 +233,7 @@ function readPersistedChoice(file, hardware, profile, requireProfile = false) {
         return null;
     }
 }
-function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
+function persistChoice(dir, file, hardware, machineUuid, reason, profile, evidence) {
     try {
         node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
         const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
@@ -241,6 +243,12 @@ function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
             machineUuid,
             profile,
             reason,
+            // WHICH file made a profile "already hold credentials". The reason alone
+            // says a profile shares the default's machine row; this says what put it
+            // there, which is the difference between "an older Skrr set it up" and
+            // "its first credential was written before anything chose its identity".
+            // Additive: a reader that predates it ignores the field.
+            ...(evidence && evidence.length > 0 ? { evidence: [...evidence] } : {}),
             decidedAt: new Date().toISOString(),
         };
         node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
@@ -280,7 +288,7 @@ function resolveProfileMachineUuid(profile, hardware) {
             persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
     }
     if (!chosen) {
-        const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
+        const evidence = PRE_EXISTING_PROFILE_EVIDENCE.filter((name) => {
             try {
                 return node_fs_1.default.existsSync(node_path_1.default.join(dir, name));
             }
@@ -288,8 +296,9 @@ function resolveProfileMachineUuid(profile, hardware) {
                 return false;
             }
         });
+        const preExisting = evidence.length > 0;
         chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile);
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile, evidence);
     }
     preserveRecoveryChoice(profile, hardware, chosen);
     profileChoiceCache.set(cacheKey, chosen);
@@ -309,14 +318,129 @@ function resolveProfileMachineUuid(profile, hardware) {
  * profile that already held credentials; see the block above.
  */
 function getMachineUuid() {
+    return getMachineUuidForProfile(activeMachineProfile);
+}
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+function getMachineUuidForProfile(profile) {
     const hardware = getHardwareMachineUuid();
     // A hosted runtime's identity is ISSUED and fenced by the control plane.
     if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID'))
         return hardware;
-    const profile = activeMachineProfile;
-    if (!profile || profile === DEFAULT_PROFILE_NAME)
+    const name = typeof profile === 'string' ? profile.trim() : '';
+    if (!name || name === DEFAULT_PROFILE_NAME)
         return hardware;
-    return resolveProfileMachineUuid(profile, hardware);
+    return resolveProfileMachineUuid(name, hardware);
+}
+function readRecordedChoice(profile) {
+    try {
+        const file = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile, exports.MACHINE_IDENTITY_FILENAME);
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
+        const reason = parsed.reason === 'new_profile' ||
+            parsed.reason === 'pre_existing_profile' ||
+            parsed.reason === 'restored_profile'
+            ? parsed.reason
+            : null;
+        return {
+            reason,
+            evidence: Array.isArray(parsed.evidence)
+                ? parsed.evidence.filter((e) => typeof e === 'string')
+                : [],
+            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : null,
+        };
+    }
+    catch {
+        return { reason: null, evidence: [], decidedAt: null };
+    }
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+function describeMachineIdentity() {
+    const hardware = getHardwareMachineUuid();
+    const machineUuid = getMachineUuid();
+    const active = activeMachineProfile;
+    const profile = active && active !== DEFAULT_PROFILE_NAME ? active : null;
+    const base = { profile, machineUuid, hardware };
+    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID')) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'hosted_runtime',
+            evidence: [],
+            decidedAt: null,
+            sentence: 'This runtime is hosted; its machine identity was issued by the control plane.',
+        };
+    }
+    if (!profile) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'default_profile',
+            evidence: [],
+            decidedAt: null,
+            sentence: "The default profile uses this computer's own machine identity.",
+        };
+    }
+    const recorded = readRecordedChoice(profile);
+    const sharesDefaultMachine = machineUuid === hardware;
+    const reason = recorded.reason ?? 'unrecorded';
+    const decided = recorded.decidedAt ? ` (decided ${recorded.decidedAt})` : '';
+    const held = recorded.evidence.length > 0 ? ` (${recorded.evidence.join(', ')})` : '';
+    let sentence;
+    if (reason === 'new_profile') {
+        sentence =
+            `Profile '${profile}' has its own machine identity: it held no credentials when that ` +
+                `identity was first chosen${decided}.`;
+    }
+    else if (reason === 'pre_existing_profile') {
+        sentence =
+            `Profile '${profile}' shares this computer's default machine identity: it already held ` +
+                `credentials${held} when its identity was first chosen${decided}, and the server ties ` +
+                'those credentials to that identity, so changing it would sign the profile out.';
+    }
+    else if (reason === 'restored_profile') {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' shares this computer's default machine identity, restored from the ` +
+                `copy kept outside the profile after its state was removed${decided}.`
+            : `Profile '${profile}' has its own machine identity, restored from the copy kept outside ` +
+                `the profile after its state was removed${decided}.`;
+    }
+    else {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' uses this computer's default machine identity; the record of why ` +
+                'could not be read.'
+            : `Profile '${profile}' has its own machine identity; the record of why could not be read.`;
+    }
+    return {
+        ...base,
+        sharesDefaultMachine,
+        reason,
+        evidence: recorded.evidence,
+        decidedAt: recorded.decidedAt,
+        sentence,
+    };
 }
 /** @internal test seam — forget the cached value so the next call re-probes. */
 function __resetMachineUuidCacheForTest() {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -30,7 +30,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
-export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -125,7 +125,7 @@ __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest,
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
 // machine-id / MachineGuid). ONE implementation for daemon and CLI —
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
-export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
 // NOT a `machineUuid` — see machineUuid.ts.
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineUuid.d.ts

@@ -56,5 +56,65 @@ export declare function getMachineUuidProfile(): string | null;
  * profile that already held credentials; see the block above.
  */
 export declare function getMachineUuid(): string;
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+export declare function getMachineUuidForProfile(profile: string | null | undefined): string;
+export type MachineIdentityReason = 
+/** The default profile, which always uses this computer's own identity. */
+'default_profile'
+/** A hosted runtime, whose identity the control plane issued. */
+ | 'hosted_runtime'
+/** A profile that held no credentials when its identity was first decided. */
+ | 'new_profile'
+/** A profile that already held credentials, so it keeps the shared identity. */
+ | 'pre_existing_profile'
+/** Recovered from the copy kept outside the profile after product state was removed. */
+ | 'restored_profile'
+/** The profile's record could not be read (the identity is still the one in use). */
+ | 'unrecorded';
+export interface MachineIdentityDescription {
+    /** The profile this process runs as; null for the default profile. */
+    profile: string | null;
+    /** The value sent to the server as `machineUuid`. */
+    machineUuid: string;
+    /** This computer's own identity. */
+    hardware: string;
+    /**
+     * A non-default profile that registers on the SAME machine row as the default
+     * profile: they share one Daemon row, one device-key pin and one machine page.
+     */
+    sharesDefaultMachine: boolean;
+    reason: MachineIdentityReason;
+    /** The files that made a profile "already hold credentials", when recorded. */
+    evidence: string[];
+    decidedAt: string | null;
+    /** One sentence for a person. Written once, here, so no surface words it differently. */
+    sentence: string;
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+export declare function describeMachineIdentity(): MachineIdentityDescription;
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export declare function __resetMachineUuidCacheForTest(): void;