@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -1,803 +1,606 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.__setStateForTest = __setStateForTest;
-exports.__getStateForTest = __getStateForTest;
-exports.describeDeviceKeySplit = describeDeviceKeySplit;
-exports.initDeviceIdentity = initDeviceIdentity;
-exports.resetDeviceIdentity = resetDeviceIdentity;
-exports.isDeviceIdentityActive = isDeviceIdentityActive;
-exports.getDevicePublicKey = getDevicePublicKey;
-exports.describeDeviceIdentityState = describeDeviceIdentityState;
-exports.signServerRequest = signServerRequest;
-exports.__publicKeyPathForTest = __publicKeyPathForTest;
-exports.__privateKeyPathForTest = __privateKeyPathForTest;
-exports.__enrollmentMarkerPathForTest = __enrollmentMarkerPathForTest;
-exports.__enrollmentBackoffPathForTest = __enrollmentBackoffPathForTest;
-exports.clearEnrollmentMarker = clearEnrollmentMarker;
-exports.enrollWithServer = enrollWithServer;
-/**
- * deviceIdentityBridge.ts — composed L11 runtime (init, sign, enroll).
- *
- * Lifts the previously-duplicated `daemon/src/deviceIdentity.ts` and
- * `cli/src/lib/device-identity.ts` modules into a single shared
- * implementation. Daemon and CLI both consume this module so they land
- * on the SAME on-disk artifacts:
- *
- *   <machine root>/profiles/<p>/device-public-key.jwk    — plaintext JWK
- *   <machine root>/profiles/<p>/device-private-key       — L12-wrapped JSON
- *   <machine root>/profiles/<p>/device-enrollment.json   — server-ack marker
- *
- * Architectural decision (locked): CLI shares the daemon's keypair on
- * the same machine. Same machine = same device identity. The scope
- * discriminator is the JWT claim (`scope: 'cli'` vs `scope: 'daemon'`),
- * not the key.
- *
- * That decision was locked and then quietly broken. This file spelled the
- * directory `path.join(getAuthConfigDir(), 'profiles', profile)` — the same
- * expression `credentialEnvelopeBridge` spelled independently — and the daemon's
- * `configDir` is already profile-scoped, so the two consumers minted two
- * keypairs per profile and neither noticed (OSK-10314). The directory now comes
- * from `profileStateDir.ts`, and the four files below resolve as a GROUP: a
- * public JWK from one copy beside a private key from the other is a keypair
- * mismatch, which `loadKeypair` correctly rejects and would then paper over by
- * regenerating.
- *
- * NAMING NOTE — the suffix `Bridge` distinguishes this composed runtime
- * (init + sign + enroll + telemetry) from the pure-crypto primitive
- * file `deviceKey.ts` it composes.
- */
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const deviceKey_js_1 = require("./deviceKey.js");
-const credentialEnvelopeBridge_js_1 = require("./credentialEnvelopeBridge.js");
-const profileStateDir_js_1 = require("./profileStateDir.js");
-const runtime_js_1 = require("./runtime.js");
-const PUBLIC_KEY_FILENAME = 'device-public-key.jwk';
-const PRIVATE_KEY_FILENAME = 'device-private-key';
-const ENROLLMENT_MARKER_FILENAME = 'device-enrollment.json';
-const ENROLLMENT_BACKOFF_FILENAME = 'device-enrollment-backoff.json';
-/**
- * The device identity's files, in the order they are copied by a migration.
- * The public JWK goes first so a reader that catches the directory mid-copy sees
- * a public key without a private one — which `loadKeypair` treats as "no
- * keypair" — rather than a private key it will pair with a stale public one.
- */
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var deviceIdentityBridge_exports = {};
+__export(deviceIdentityBridge_exports, {
+  __enrollmentBackoffPathForTest: () => __enrollmentBackoffPathForTest,
+  __enrollmentMarkerPathForTest: () => __enrollmentMarkerPathForTest,
+  __getStateForTest: () => __getStateForTest,
+  __privateKeyPathForTest: () => __privateKeyPathForTest,
+  __publicKeyPathForTest: () => __publicKeyPathForTest,
+  __setStateForTest: () => __setStateForTest,
+  clearEnrollmentMarker: () => clearEnrollmentMarker,
+  describeDeviceIdentityState: () => describeDeviceIdentityState,
+  describeDeviceKeySplit: () => describeDeviceKeySplit,
+  enrollWithServer: () => enrollWithServer,
+  getDevicePublicKey: () => getDevicePublicKey,
+  initDeviceIdentity: () => initDeviceIdentity,
+  isDeviceIdentityActive: () => isDeviceIdentityActive,
+  resetDeviceIdentity: () => resetDeviceIdentity,
+  signServerRequest: () => signServerRequest
+});
+module.exports = __toCommonJS(deviceIdentityBridge_exports);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_deviceKey = require("./deviceKey.js");
+var import_credentialEnvelopeBridge = require("./credentialEnvelopeBridge.js");
+var import_profileStateDir = require("./profileStateDir.js");
+var import_runtime = require("./runtime.js");
+const PUBLIC_KEY_FILENAME = "device-public-key.jwk";
+const PRIVATE_KEY_FILENAME = "device-private-key";
+const ENROLLMENT_MARKER_FILENAME = "device-enrollment.json";
+const ENROLLMENT_BACKOFF_FILENAME = "device-enrollment-backoff.json";
 const DEVICE_IDENTITY_FILES = [
-    PUBLIC_KEY_FILENAME,
-    PRIVATE_KEY_FILENAME,
-    ENROLLMENT_MARKER_FILENAME,
-    ENROLLMENT_BACKOFF_FILENAME,
+  PUBLIC_KEY_FILENAME,
+  PRIVATE_KEY_FILENAME,
+  ENROLLMENT_MARKER_FILENAME,
+  ENROLLMENT_BACKOFF_FILENAME
 ];
-// A missing Daemon row cannot become enrollable until registration changes
-// server state. Persist the negative result across short-lived `sky` processes
-// so every CLI command does not repeat the same guaranteed 404.
-const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1000;
-let _state = { kind: 'uninit' };
-/** @internal Test seam — force-set state. */
+const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1e3;
+let _state = { kind: "uninit" };
 function __setStateForTest(next) {
-    const prev = _state;
-    _state = next;
-    return prev;
+  const prev = _state;
+  _state = next;
+  return prev;
 }
-/** @internal Test seam — read state. */
 function __getStateForTest() {
-    return _state;
+  return _state;
 }
-/**
- * The directory holding this profile's device identity, anchored on the PRIVATE
- * key: that is the file `loadKeypair` cannot proceed without, so it is the one
- * that decides which copy the group is read from.
- */
 function profileConfigDir(profile) {
-    return (0, profileStateDir_js_1.resolveProfileStateDir)(profile, PRIVATE_KEY_FILENAME).dir;
+  return (0, import_profileStateDir.resolveProfileStateDir)(profile, PRIVATE_KEY_FILENAME).dir;
 }
 function publicKeyPath(profile) {
-    return node_path_1.default.join(profileConfigDir(profile), PUBLIC_KEY_FILENAME);
+  return import_node_path.default.join(profileConfigDir(profile), PUBLIC_KEY_FILENAME);
 }
 function privateKeyPath(profile) {
-    return node_path_1.default.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
+  return import_node_path.default.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
 }
 function storedKeyMaterialExists(profile) {
-    let files;
+  let files;
+  try {
+    files = [publicKeyPath(profile), privateKeyPath(profile), enrollmentMarkerPath(profile)];
+  } catch {
+    return true;
+  }
+  for (const file of files) {
     try {
-        files = [publicKeyPath(profile), privateKeyPath(profile), enrollmentMarkerPath(profile)];
-    }
-    catch {
+      import_node_fs.default.lstatSync(file);
+      return true;
+    } catch (err) {
+      if (err.code !== "ENOENT")
         return true;
     }
-    for (const file of files) {
-        try {
-            node_fs_1.default.lstatSync(file);
-            return true;
-        }
-        catch (err) {
-            if (err.code !== 'ENOENT')
-                return true;
-        }
-    }
-    return false;
+  }
+  return false;
 }
 function enrollmentMarkerPath(profile) {
-    return node_path_1.default.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
+  return import_node_path.default.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
 }
 function enrollmentBackoffPath(profile) {
-    return node_path_1.default.join(profileConfigDir(profile), ENROLLMENT_BACKOFF_FILENAME);
+  return import_node_path.default.join(profileConfigDir(profile), ENROLLMENT_BACKOFF_FILENAME);
 }
 function atomicWrite0600(target, value) {
-    const dir = node_path_1.default.dirname(target);
-    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-    const buf = typeof value === 'string' ? Buffer.from(value, 'utf-8') : value;
-    const fd = node_fs_1.default.openSync(tmp, 'w', 0o600);
-    try {
-        node_fs_1.default.writeSync(fd, buf);
-        node_fs_1.default.fsyncSync(fd);
-    }
-    finally {
-        node_fs_1.default.closeSync(fd);
-    }
-    node_fs_1.default.renameSync(tmp, target);
+  const dir = import_node_path.default.dirname(target);
+  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+  const buf = typeof value === "string" ? Buffer.from(value, "utf-8") : value;
+  const fd = import_node_fs.default.openSync(tmp, "w", 384);
+  try {
+    import_node_fs.default.writeSync(fd, buf);
+    import_node_fs.default.fsyncSync(fd);
+  } finally {
+    import_node_fs.default.closeSync(fd);
+  }
+  import_node_fs.default.renameSync(tmp, target);
+  try {
+    const dirFd = import_node_fs.default.openSync(dir, "r");
     try {
-        const dirFd = node_fs_1.default.openSync(dir, 'r');
-        try {
-            node_fs_1.default.fsyncSync(dirFd);
-        }
-        finally {
-            node_fs_1.default.closeSync(dirFd);
-        }
-    }
-    catch {
-        /* best-effort; some platforms reject dir fsync */
+      import_node_fs.default.fsyncSync(dirFd);
+    } finally {
+      import_node_fs.default.closeSync(dirFd);
     }
+  } catch {
+  }
 }
 function emit(eventName, success, metadata, opts = {}) {
-    (0, runtime_js_1.emitAuthTelemetry)({
-        timestamp: new Date().toISOString(),
-        eventType: 'auth',
-        success,
-        metadata: { source: 'deviceIdentity', event: eventName, ...metadata },
-    });
-    if (!success) {
-        const level = opts.logLevel ?? 'warn';
-        const log = (0, runtime_js_1.getAuthLogger)();
-        if (level === 'info') {
-            log.info(`[deviceIdentity] ${eventName}`, metadata);
-        }
-        else {
-            log.warn(`[deviceIdentity] ${eventName}`, metadata);
-        }
-    }
+  (0, import_runtime.emitAuthTelemetry)({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    eventType: "auth",
+    success,
+    metadata: { source: "deviceIdentity", event: eventName, ...metadata }
+  });
+  if (!success) {
+    const level = opts.logLevel ?? "warn";
+    const log = (0, import_runtime.getAuthLogger)();
+    if (level === "info") {
+      log.info(`[deviceIdentity] ${eventName}`, metadata);
+    } else {
+      log.warn(`[deviceIdentity] ${eventName}`, metadata);
+    }
+  }
 }
-/**
- * Persist a freshly-generated keypair. Public goes plaintext; private
- * goes through `maybeEncryptForWrite` so L12 wraps it when active.
- */
 function persistKeypair(profile, kp) {
-    const publicPayload = JSON.stringify({
-        publicJwk: kp.publicJwk,
-        thumbprint: kp.thumbprint,
-        createdAt: new Date().toISOString(),
-    });
-    atomicWrite0600(publicKeyPath(profile), publicPayload);
-    // Use the always-fail-open variant — device-identity wants the private
-    // key persisted even when the L12 envelope path is inactive (today's
-    // default on every platform). The daemon's `credEnvelopeFailClosed`
-    // policy applies only to the keychain.ts write path.
-    const privatePlaintext = JSON.stringify(kp.privateJwk);
-    const wireForm = (0, credentialEnvelopeBridge_js_1.wrapIfActiveOrPassthrough)(privatePlaintext);
-    const envelopeProtected = wireForm !== privatePlaintext;
-    atomicWrite0600(privateKeyPath(profile), wireForm);
-    emit('keypair_persisted', true, {
-        profile,
-        thumbprint: kp.thumbprint,
-        envelopeProtected,
-    });
-    return { envelopeProtected };
+  const publicPayload = JSON.stringify({
+    publicJwk: kp.publicJwk,
+    thumbprint: kp.thumbprint,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  atomicWrite0600(publicKeyPath(profile), publicPayload);
+  const privatePlaintext = JSON.stringify(kp.privateJwk);
+  const wireForm = (0, import_credentialEnvelopeBridge.wrapIfActiveOrPassthrough)(privatePlaintext);
+  const envelopeProtected = wireForm !== privatePlaintext;
+  atomicWrite0600(privateKeyPath(profile), wireForm);
+  emit("keypair_persisted", true, {
+    profile,
+    thumbprint: kp.thumbprint,
+    envelopeProtected
+  });
+  return { envelopeProtected };
 }
-/**
- * Load a previously-persisted keypair. Returns null on missing files,
- * decrypt failure, public/private mismatch (file-swap defense), or
- * malformed JSON. Throws only on unexpected fs errors; init catches.
- */
 function loadKeypair(profile) {
-    const pubPath = publicKeyPath(profile);
-    const privPath = privateKeyPath(profile);
-    if (!node_fs_1.default.existsSync(pubPath) || !node_fs_1.default.existsSync(privPath)) {
-        return null;
-    }
-    const pubRaw = node_fs_1.default.readFileSync(pubPath, 'utf-8');
-    const privRaw = node_fs_1.default.readFileSync(privPath, 'utf-8');
-    let publicJwk;
-    let storedThumbprint;
-    try {
-        const parsed = JSON.parse(pubRaw);
-        publicJwk = parsed.publicJwk;
-        storedThumbprint = parsed.thumbprint;
-    }
-    catch (err) {
-        emit('public_key_unreadable', false, {
-            profile,
-            message: err?.message ?? 'unknown',
-        });
-        return null;
-    }
-    const decryptResult = (0, credentialEnvelopeBridge_js_1.maybeDecryptOnRead)(privRaw);
-    if (decryptResult.plaintext === null) {
-        emit('private_key_decrypt_failed', false, { profile });
-        return null;
-    }
-    const privatePlaintext = decryptResult.plaintext;
-    let privateJwk;
-    try {
-        privateJwk = JSON.parse(privatePlaintext);
-    }
-    catch (err) {
-        emit('private_key_malformed', false, {
-            profile,
-            message: err?.message ?? 'unknown',
-        });
-        return null;
-    }
-    // public.x must match private.x — any mismatch indicates a partial
-    // write race, manual edit, or attacker swapping one of the files.
-    if (publicJwk.x !== privateJwk.x) {
-        emit('keypair_inconsistent', false, { profile });
-        return null;
-    }
-    // Recompute the thumbprint; mismatch with stored is informational
-    // (we trust the recomputed value), not a failure.
-    const recomputed = (0, deviceKey_js_1.jwkThumbprint)(publicJwk);
-    if (recomputed !== storedThumbprint) {
-        emit('thumbprint_drift', false, {
-            profile,
-            stored: storedThumbprint,
-            recomputed,
-        });
-    }
-    return {
-        publicJwk,
-        privateJwk,
-        thumbprint: recomputed,
-    };
+  const pubPath = publicKeyPath(profile);
+  const privPath = privateKeyPath(profile);
+  if (!import_node_fs.default.existsSync(pubPath) || !import_node_fs.default.existsSync(privPath)) {
+    return null;
+  }
+  const pubRaw = import_node_fs.default.readFileSync(pubPath, "utf-8");
+  const privRaw = import_node_fs.default.readFileSync(privPath, "utf-8");
+  let publicJwk;
+  let storedThumbprint;
+  try {
+    const parsed = JSON.parse(pubRaw);
+    publicJwk = parsed.publicJwk;
+    storedThumbprint = parsed.thumbprint;
+  } catch (err) {
+    emit("public_key_unreadable", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+  const decryptResult = (0, import_credentialEnvelopeBridge.maybeDecryptOnRead)(privRaw);
+  if (decryptResult.plaintext === null) {
+    emit("private_key_decrypt_failed", false, { profile });
+    return null;
+  }
+  const privatePlaintext = decryptResult.plaintext;
+  let privateJwk;
+  try {
+    privateJwk = JSON.parse(privatePlaintext);
+  } catch (err) {
+    emit("private_key_malformed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+  if (publicJwk.x !== privateJwk.x) {
+    emit("keypair_inconsistent", false, { profile });
+    return null;
+  }
+  const recomputed = (0, import_deviceKey.jwkThumbprint)(publicJwk);
+  if (recomputed !== storedThumbprint) {
+    emit("thumbprint_drift", false, {
+      profile,
+      stored: storedThumbprint,
+      recomputed
+    });
+  }
+  return {
+    publicJwk,
+    privateJwk,
+    thumbprint: recomputed
+  };
 }
-/**
- * Identity of a device-identity directory: the thumbprint of the PLAINTEXT
- * public JWK.
- *
- * The private key is envelope-wrapped with a random nonce, so its bytes say
- * nothing about whether two copies are the same key. The public JWK is written
- * in the clear and is derived from the private one, so it answers the question
- * exactly and without needing the DEK.
- */
 function deviceIdentityOf(dir) {
-    try {
-        const parsed = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, PUBLIC_KEY_FILENAME), 'utf-8'));
-        if (!parsed.publicJwk || typeof parsed.publicJwk.x !== 'string')
-            return null;
-        return (0, deviceKey_js_1.jwkThumbprint)(parsed.publicJwk);
-    }
-    catch {
-        return null;
-    }
+  try {
+    const parsed = JSON.parse(import_node_fs.default.readFileSync(import_node_path.default.join(dir, PUBLIC_KEY_FILENAME), "utf-8"));
+    if (!parsed.publicJwk || typeof parsed.publicJwk.x !== "string")
+      return null;
+    return (0, import_deviceKey.jwkThumbprint)(parsed.publicJwk);
+  } catch {
+    return null;
+  }
 }
-/**
- * The device-key split, read from disk: the daemon (legacy directory, not yet
- * consolidated) and the CLI (canonical directory) holding DIFFERENT keypairs
- * for one profile. `null` when this process has no legacy location, when the
- * legacy copy is consolidated, or when either side has no readable public key.
- *
- * This is the fact the server acts on (OSK-12462): a CLI credential brokered by
- * the daemon is checked against the key pinned on the daemon's machine row, so
- * while the thumbprints differ the CLI's refresh is refused. Reading it from
- * the public JWKs, which are plaintext, needs no DEK and changes nothing.
- */
 function describeDeviceKeySplit(profile) {
-    try {
-        const resolved = (0, profileStateDir_js_1.resolveProfileStateDir)(profile, PRIVATE_KEY_FILENAME);
-        if (!resolved.usingLegacy || resolved.legacyDir === null)
-            return null;
-        const daemonThumbprint = deviceIdentityOf(resolved.legacyDir);
-        const cliThumbprint = deviceIdentityOf(resolved.canonicalDir);
-        if (!daemonThumbprint || !cliThumbprint || daemonThumbprint === cliThumbprint)
-            return null;
-        return {
-            daemonThumbprint,
-            cliThumbprint,
-            daemonDir: resolved.legacyDir,
-            cliDir: resolved.canonicalDir,
-        };
-    }
-    catch {
-        return null;
-    }
+  try {
+    const resolved = (0, import_profileStateDir.resolveProfileStateDir)(profile, PRIVATE_KEY_FILENAME);
+    if (!resolved.usingLegacy || resolved.legacyDir === null)
+      return null;
+    const daemonThumbprint = deviceIdentityOf(resolved.legacyDir);
+    const cliThumbprint = deviceIdentityOf(resolved.canonicalDir);
+    if (!daemonThumbprint || !cliThumbprint || daemonThumbprint === cliThumbprint)
+      return null;
+    return {
+      daemonThumbprint,
+      cliThumbprint,
+      daemonDir: resolved.legacyDir,
+      cliDir: resolved.canonicalDir
+    };
+  } catch {
+    return null;
+  }
 }
-/**
- * Run the OSK-10314 consolidation for this profile's device identity.
- *
- * Refuses outright while the credential envelope is holding two different DEKs:
- * see `hasCredEnvelopePathConflict`. Never fatal — a failed migration leaves the
- * process reading exactly what it read before.
- */
 async function consolidateDeviceIdentity(profile) {
-    if (!(0, profileStateDir_js_1.resolveProfileStateDir)(profile, PRIVATE_KEY_FILENAME).usingLegacy)
-        return;
-    if ((0, credentialEnvelopeBridge_js_1.hasCredEnvelopePathConflict)()) {
-        emit('path_consolidation.deferred', true, { profile, reason: 'cred_envelope_path_conflict' }, { logLevel: 'info' });
-        return;
-    }
-    // Two different keypairs under one DEK are converged the way two DEKs are:
-    // onto the daemon's, unless the daemon itself was refused over it. The CLI's
-    // keypair is set aside as `.retired`, not deleted (OSK-12462). Leaving them
-    // split is what had the CLI refresh refused as a device-key mismatch.
-    const policy = (0, credentialEnvelopeBridge_js_1.splitKeyConvergencePolicy)();
-    try {
-        await (0, profileStateDir_js_1.consolidateProfileState)(profile, {
-            files: DEVICE_IDENTITY_FILES,
-            primary: PRIVATE_KEY_FILENAME,
-            identify: deviceIdentityOf,
-            onConflict: policy.converge ? 'adopt_legacy' : 'refuse',
-            onEvent: (name, success, meta) => emit(name, success, meta),
-        });
-    }
-    catch (err) {
-        emit('path_consolidation.failed', false, {
-            profile,
-            message: err?.message ?? 'unknown',
-        });
-    }
+  if (!(0, import_profileStateDir.resolveProfileStateDir)(profile, PRIVATE_KEY_FILENAME).usingLegacy)
+    return;
+  if ((0, import_credentialEnvelopeBridge.hasCredEnvelopePathConflict)()) {
+    emit("path_consolidation.deferred", true, { profile, reason: "cred_envelope_path_conflict" }, { logLevel: "info" });
+    return;
+  }
+  const policy = (0, import_credentialEnvelopeBridge.splitKeyConvergencePolicy)();
+  try {
+    await (0, import_profileStateDir.consolidateProfileState)(profile, {
+      files: DEVICE_IDENTITY_FILES,
+      primary: PRIVATE_KEY_FILENAME,
+      identify: deviceIdentityOf,
+      onConflict: policy.converge ? "adopt_legacy" : "refuse",
+      onEvent: (name, success, meta) => emit(name, success, meta)
+    });
+  } catch (err) {
+    emit("path_consolidation.failed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+  }
 }
-/**
- * Initialize device identity. Idempotent.
- *
- * Order:
- *   1. Try to load existing keypair from disk.
- *      - Success → state = active.
- *      - No key material at all (first install) → step 2.
- *      - Key material present but unloadable (corruption, decrypt failure,
- *        public/private mismatch) → disabled+unreadable_key and a
- *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
- *        an explicit interactive login sets it, because that login proves and
- *        re-pins the new key; replacing it on ordinary boot would sign the
- *        next refresh with a key the server never pinned.
- *   2. Generate fresh keypair and persist. Failure to persist is a hard
- *      error landing in disabled+persist_failed.
- *
- * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
- * never replaces anything: for a short-lived process that must only READ the
- * daemon's key while the daemon itself may be creating it (OSK-15990's
- * `skrrd device-proof`). The persist below is not an exclusive create, so a
- * second creator racing the daemon could leave the daemon holding one key in
- * memory and the disk another.
- */
 async function initDeviceIdentity(profile, options = {}) {
-    if (_state.kind !== 'uninit')
-        return;
-    if (typeof profile !== 'string' || profile.length === 0) {
-        _state = { kind: 'disabled', reason: 'init_failed' };
-        emit('init_failed', false, { reason: 'empty_profile' });
-        return;
-    }
-    // OSK-10314 — converge the two directories this profile may have before
-    // resolving any of the four files. Must run after `initCredEnvelope`, which
-    // both consumers already guarantee, because the private key's readability
-    // depends on which DEK ended up active.
-    await consolidateDeviceIdentity(profile);
-    let keypair = null;
-    try {
-        keypair = loadKeypair(profile);
-    }
-    catch (err) {
-        emit('load_failed', false, {
-            profile,
-            message: err?.message ?? 'unknown',
-        });
-        keypair = null;
-    }
-    if (keypair) {
-        const envelopeProtected = (0, credentialEnvelopeBridge_js_1.isCredEnvelopeActive)();
-        _state = { kind: 'active', keypair, profile, envelopeProtected };
-        emit('active', true, {
-            profile,
-            thumbprint: keypair.thumbprint,
-            envelopeProtected,
-            regenerated: false,
-        });
-        return;
-    }
-    // A first install has neither file. If either file already exists, a null
-    // load is a lost, corrupt or temporarily unreadable identity. Replacing it
-    // during ordinary boot would make the next refresh sign with a key the
-    // server has never pinned, turning a local read failure into an unexpected
-    // DEVICE_KEY_MISMATCH. Only an explicit interactive login may replace it;
-    // that login proves the new key and re-pins it before issuing credentials.
-    const hasStoredKey = storedKeyMaterialExists(profile);
-    if (hasStoredKey && !options.recoverUnreadable) {
-        _state = { kind: 'disabled', reason: 'unreadable_key' };
-        emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
-        return;
-    }
-    if (options.createIfMissing === false) {
-        _state = { kind: 'disabled', reason: 'no_stored_key' };
-        emit('no_stored_key', false, { profile });
-        return;
-    }
-    let fresh;
-    try {
-        fresh = (0, deviceKey_js_1.generateDeviceKeyPair)();
-    }
-    catch (err) {
-        _state = { kind: 'disabled', reason: 'init_failed' };
-        emit('init_failed', false, {
-            profile,
-            reason: 'keygen_threw',
-            message: err?.message ?? 'unknown',
-        });
-        return;
-    }
-    let persistResult;
-    try {
-        persistResult = persistKeypair(profile, fresh);
-    }
-    catch (err) {
-        _state = { kind: 'disabled', reason: 'persist_failed' };
-        emit('persist_failed', false, {
-            profile,
-            message: err?.message ?? 'unknown',
-        });
-        return;
-    }
-    _state = {
-        kind: 'active',
-        keypair: fresh,
-        profile,
-        envelopeProtected: persistResult.envelopeProtected,
-    };
-    emit('active', true, {
-        profile,
-        thumbprint: fresh.thumbprint,
-        envelopeProtected: persistResult.envelopeProtected,
-        regenerated: true,
+  if (_state.kind !== "uninit")
+    return;
+  if (typeof profile !== "string" || profile.length === 0) {
+    _state = { kind: "disabled", reason: "init_failed" };
+    emit("init_failed", false, { reason: "empty_profile" });
+    return;
+  }
+  await consolidateDeviceIdentity(profile);
+  let keypair = null;
+  try {
+    keypair = loadKeypair(profile);
+  } catch (err) {
+    emit("load_failed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    keypair = null;
+  }
+  if (keypair) {
+    const envelopeProtected = (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)();
+    _state = { kind: "active", keypair, profile, envelopeProtected };
+    emit("active", true, {
+      profile,
+      thumbprint: keypair.thumbprint,
+      envelopeProtected,
+      regenerated: false
+    });
+    return;
+  }
+  const hasStoredKey = storedKeyMaterialExists(profile);
+  if (hasStoredKey && !options.recoverUnreadable) {
+    _state = { kind: "disabled", reason: "unreadable_key" };
+    emit("recovery_required", false, { profile, reason: "stored_key_unreadable" });
+    return;
+  }
+  if (options.createIfMissing === false) {
+    _state = { kind: "disabled", reason: "no_stored_key" };
+    emit("no_stored_key", false, { profile });
+    return;
+  }
+  let fresh;
+  try {
+    fresh = (0, import_deviceKey.generateDeviceKeyPair)();
+  } catch (err) {
+    _state = { kind: "disabled", reason: "init_failed" };
+    emit("init_failed", false, {
+      profile,
+      reason: "keygen_threw",
+      message: err?.message ?? "unknown"
+    });
+    return;
+  }
+  let persistResult;
+  try {
+    persistResult = persistKeypair(profile, fresh);
+  } catch (err) {
+    _state = { kind: "disabled", reason: "persist_failed" };
+    emit("persist_failed", false, {
+      profile,
+      message: err?.message ?? "unknown"
     });
+    return;
+  }
+  _state = {
+    kind: "active",
+    keypair: fresh,
+    profile,
+    envelopeProtected: persistResult.envelopeProtected
+  };
+  emit("active", true, {
+    profile,
+    thumbprint: fresh.thumbprint,
+    envelopeProtected: persistResult.envelopeProtected,
+    regenerated: true
+  });
 }
-/**
- * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
- * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
- * the daemon's pinned identity.
- */
 async function resetDeviceIdentity(opts) {
-    if (opts?.clearOnDisk && opts.profile) {
-        // Every location, not just the resolved one. A reset that cleared only the
-        // canonical copy would leave the pre-consolidation copy for the next init to
-        // adopt — a deleted device key that reappears.
-        const targets = [PUBLIC_KEY_FILENAME, PRIVATE_KEY_FILENAME].flatMap((name) => (0, profileStateDir_js_1.profileStateFilePathsToClear)(opts.profile, name));
-        for (const p of targets) {
-            try {
-                node_fs_1.default.unlinkSync(p);
-            }
-            catch (err) {
-                if (err.code !== 'ENOENT') {
-                    emit('clear_failed', false, {
-                        profile: opts.profile,
-                        file: node_path_1.default.basename(p),
-                        message: err?.message ?? 'unknown',
-                    });
-                }
-            }
+  if (opts?.clearOnDisk && opts.profile) {
+    const targets = [PUBLIC_KEY_FILENAME, PRIVATE_KEY_FILENAME].flatMap((name) => (0, import_profileStateDir.profileStateFilePathsToClear)(opts.profile, name));
+    for (const p of targets) {
+      try {
+        import_node_fs.default.unlinkSync(p);
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          emit("clear_failed", false, {
+            profile: opts.profile,
+            file: import_node_path.default.basename(p),
+            message: err?.message ?? "unknown"
+          });
         }
+      }
     }
-    _state = { kind: 'uninit' };
+  }
+  _state = { kind: "uninit" };
 }
-/** True iff init has completed and a keypair is in memory. */
 function isDeviceIdentityActive() {
-    return _state.kind === 'active';
+  return _state.kind === "active";
 }
-/**
- * Export the public key for server enrollment / dashboard display.
- * Returns null when not active so callers know to skip the JWS header
- * on the in-flight request.
- */
 function getDevicePublicKey() {
-    if (_state.kind !== 'active')
-        return null;
-    return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
+  if (_state.kind !== "active")
+    return null;
+  return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
 }
-/**
- * Operator-readable summary of device-identity state. Used by
- * `oversky status` and CLI debug commands. Never includes the private key.
- */
 function describeDeviceIdentityState() {
-    if (_state.kind === 'disabled') {
-        return { kind: 'disabled', reason: _state.reason };
-    }
-    if (_state.kind === 'active') {
-        return {
-            kind: 'active',
-            thumbprint: _state.keypair.thumbprint,
-            profile: _state.profile,
-            envelopeProtected: _state.envelopeProtected,
-        };
-    }
-    return { kind: 'uninit' };
+  if (_state.kind === "disabled") {
+    return { kind: "disabled", reason: _state.reason };
+  }
+  if (_state.kind === "active") {
+    return {
+      kind: "active",
+      thumbprint: _state.keypair.thumbprint,
+      profile: _state.profile,
+      envelopeProtected: _state.envelopeProtected
+    };
+  }
+  return { kind: "uninit" };
 }
-/**
- * Sign an outgoing request with the device key. Returns the JWS Compact
- * Serialization, or null when device identity is not active. NEVER
- * throws — a failed sign returns null and emits a telemetry event so
- * the caller can fall back to bearer-only auth without an outage.
- *
- * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
- * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
- */
 function signServerRequest(opts) {
-    if (_state.kind !== 'active')
-        return null;
-    try {
-        return (0, deviceKey_js_1.buildProof)(_state.keypair.privateJwk, _state.keypair.publicJwk, {
-            method: opts.method,
-            url: opts.url,
-            refreshToken: opts.refreshToken,
-            accessToken: opts.accessToken,
-        });
-    }
-    catch (err) {
-        emit('sign_failed', false, {
-            profile: _state.profile,
-            thumbprint: _state.keypair.thumbprint,
-            method: opts.method,
-            message: err?.message ?? 'unknown',
-        });
-        return null;
-    }
+  if (_state.kind !== "active")
+    return null;
+  try {
+    return (0, import_deviceKey.buildProof)(_state.keypair.privateJwk, _state.keypair.publicJwk, {
+      method: opts.method,
+      url: opts.url,
+      refreshToken: opts.refreshToken,
+      accessToken: opts.accessToken
+    });
+  } catch (err) {
+    emit("sign_failed", false, {
+      profile: _state.profile,
+      thumbprint: _state.keypair.thumbprint,
+      method: opts.method,
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
 }
-/** @internal Test seams — file path resolvers. */
 function __publicKeyPathForTest(profile) {
-    return publicKeyPath(profile);
+  return publicKeyPath(profile);
 }
 function __privateKeyPathForTest(profile) {
-    return privateKeyPath(profile);
+  return privateKeyPath(profile);
 }
 function __enrollmentMarkerPathForTest(profile) {
-    return enrollmentMarkerPath(profile);
+  return enrollmentMarkerPath(profile);
 }
 function __enrollmentBackoffPathForTest(profile) {
-    return enrollmentBackoffPath(profile);
+  return enrollmentBackoffPath(profile);
 }
-/** Remove the enrollment marker so re-login gets a fresh enrollment. */
 function clearEnrollmentMarker(profile) {
-    for (const markerPath of [enrollmentMarkerPath(profile), enrollmentBackoffPath(profile)]) {
-        try {
-            node_fs_1.default.unlinkSync(markerPath);
-        }
-        catch (err) {
-            if (err.code !== 'ENOENT') {
-                emit('enrollment_marker_clear_failed', false, {
-                    profile,
-                    file: node_path_1.default.basename(markerPath),
-                    message: err?.message ?? 'unknown',
-                });
-            }
-        }
+  for (const markerPath of [enrollmentMarkerPath(profile), enrollmentBackoffPath(profile)]) {
+    try {
+      import_node_fs.default.unlinkSync(markerPath);
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        emit("enrollment_marker_clear_failed", false, {
+          profile,
+          file: import_node_path.default.basename(markerPath),
+          message: err?.message ?? "unknown"
+        });
+      }
     }
+  }
 }
-/**
- * POST the device public key to the server for enrollment.
- *
- * Idempotent across boots — the marker file short-circuits subsequent
- * calls. The marker stores serverUrl + thumbprint so a URL change
- * (staging → prod swap) forces fresh enrollment.
- *
- * Fire-and-forget contract — callers should `.catch()` so a network
- * partition at startup cannot stall the consumer's command path.
- *
- * NOTE: Both `sky` and `oversky` may race to enroll the same shared
- * keypair. The server's `enroll-device-key` route is idempotent on
- * `(machineUuid, publicJwkX)` so a duplicate POST is safe; whichever
- * binary writes its marker file first short-circuits the other.
- */
 async function enrollWithServer(opts) {
-    const { serverUrl, accessToken, machineUuid } = opts;
-    if (_state.kind !== 'active') {
-        return { enrolled: false, reason: 'not_active' };
-    }
-    const profile = _state.profile;
-    const keypair = _state.keypair;
-    const markerPath = enrollmentMarkerPath(profile);
-    const backoffPath = enrollmentBackoffPath(profile);
-    try {
-        if (node_fs_1.default.existsSync(markerPath)) {
-            return { enrolled: false, reason: 'already_persisted' };
-        }
-    }
-    catch {
-        /* best-effort */
-    }
-    try {
-        const raw = JSON.parse(node_fs_1.default.readFileSync(backoffPath, 'utf-8'));
-        const retryAfter = Date.parse(raw.retryAfter || '');
-        if (raw.serverUrl === serverUrl &&
-            raw.machineUuid === machineUuid &&
-            raw.thumbprint === keypair.thumbprint &&
-            Number.isFinite(retryAfter) &&
-            retryAfter > Date.now()) {
-            return { enrolled: false, reason: 'backoff_active' };
-        }
-        node_fs_1.default.unlinkSync(backoffPath);
-    }
-    catch (err) {
-        if (err.code !== 'ENOENT') {
-            // A corrupt/stale marker must never suppress enrollment indefinitely.
-            try {
-                node_fs_1.default.unlinkSync(backoffPath);
-            }
-            catch {
-                /* best-effort */
-            }
-        }
-    }
-    const base = serverUrl.replace(/\/+$/, '');
-    const htu = `${base}/api/daemon-resources/enroll-device-key`;
-    const proofJws = (0, deviceKey_js_1.buildProof)(keypair.privateJwk, keypair.publicJwk, {
-        method: 'POST',
-        url: htu,
+  const { serverUrl, accessToken, machineUuid } = opts;
+  if (_state.kind !== "active") {
+    return { enrolled: false, reason: "not_active" };
+  }
+  const profile = _state.profile;
+  const keypair = _state.keypair;
+  const markerPath = enrollmentMarkerPath(profile);
+  const backoffPath = enrollmentBackoffPath(profile);
+  try {
+    if (import_node_fs.default.existsSync(markerPath)) {
+      return { enrolled: false, reason: "already_persisted" };
+    }
+  } catch {
+  }
+  try {
+    const raw = JSON.parse(import_node_fs.default.readFileSync(backoffPath, "utf-8"));
+    const retryAfter = Date.parse(raw.retryAfter || "");
+    if (raw.serverUrl === serverUrl && raw.machineUuid === machineUuid && raw.thumbprint === keypair.thumbprint && Number.isFinite(retryAfter) && retryAfter > Date.now()) {
+      return { enrolled: false, reason: "backoff_active" };
+    }
+    import_node_fs.default.unlinkSync(backoffPath);
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      try {
+        import_node_fs.default.unlinkSync(backoffPath);
+      } catch {
+      }
+    }
+  }
+  const base = serverUrl.replace(/\/+$/, "");
+  const htu = `${base}/api/daemon-resources/enroll-device-key`;
+  const proofJws = (0, import_deviceKey.buildProof)(keypair.privateJwk, keypair.publicJwk, {
+    method: "POST",
+    url: htu
+  });
+  const body = JSON.stringify({
+    machineUuid,
+    publicJwkX: keypair.publicJwk.x,
+    proofJws
+  });
+  const ownAbort = new AbortController();
+  const timer = setTimeout(() => ownAbort.abort(), 1e4);
+  let response;
+  try {
+    response = await fetch(htu, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${accessToken}`
+      },
+      body,
+      signal: opts.signal ?? ownAbort.signal
     });
-    const body = JSON.stringify({
-        machineUuid,
-        publicJwkX: keypair.publicJwk.x,
-        proofJws,
+  } catch (err) {
+    clearTimeout(timer);
+    const message = err?.message ?? "unknown";
+    emit("enrollment_network_error", false, {
+      profile,
+      thumbprint: keypair.thumbprint,
+      serverUrl,
+      message
     });
-    // 10-second bound — enrollment is best-effort at startup.
-    const ownAbort = new AbortController();
-    const timer = setTimeout(() => ownAbort.abort(), 10_000);
-    let response;
-    try {
-        response = await fetch(htu, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${accessToken}`,
-            },
-            body,
-            signal: opts.signal ?? ownAbort.signal,
-        });
-    }
-    catch (err) {
-        clearTimeout(timer);
-        const message = err?.message ?? 'unknown';
-        emit('enrollment_network_error', false, {
-            profile,
-            thumbprint: keypair.thumbprint,
-            serverUrl,
-            message,
-        });
-        return { enrolled: false, reason: 'network_error', message };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    const responseText = await response.text().catch(() => '');
-    if (!response.ok) {
-        // Some rejection statuses are expected, non-actionable states rather
-        // than failures — log them at info so they don't read as auth errors or
-        // spam stderr on every invocation. Other statuses (proof failures, 5xx,
-        // etc.) keep the louder warn level for ops visibility.
-        //   • 404 DAEMON_NOT_FOUND — pre-enrollment window: the daemon row for
-        //     this (user, machineUuid) pair does not exist yet (fresh install,
-        //     server swap, or daemon hasn't started). Fires every CLI command
-        //     in that window.
-        //   • 403 OPAQUE_AUTH_REFUSED — the enroll route is JWT-only (M11); an
-        //     opaque `osk_dmn_*` daemon token is refused by design (OSK-1660 #5).
-        //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
-        //     token should not enroll. Guarded at the daemon call site, this is
-        //     defense-in-depth for any other opaque caller.
-        //   • 409 ALREADY_ENROLLED with OUR thumbprint — a concurrent binary won
-        //     the enrollment race for this keypair; idempotent, nothing to do.
-        //
-        // A 409 is NOT benign when the row is pinned to a DIFFERENT key
-        // (OSK-12063). The server keeps one pin per (user, machine) row while
-        // every local profile has its own key, so a 409 can mean "every refresh
-        // this key signs will be refused with DEVICE_PROOF_THUMBPRINT_MISMATCH".
-        // The server names the pinned thumbprint (`enrolledThumbprint`) so the
-        // two cases can be told apart. An older server that omits it keeps the
-        // old reading, because there is nothing to compare. A 409
-        // ENROLLMENT_DUPLICATE_KEY — this key is pinned on another active row —
-        // is never benign either.
-        let conflictCode = null;
-        let enrolledThumbprint = null;
-        if (response.status === 409) {
-            try {
-                const parsed = JSON.parse(responseText);
-                conflictCode = typeof parsed.code === 'string' ? parsed.code : null;
-                enrolledThumbprint =
-                    typeof parsed.enrolledThumbprint === 'string' ? parsed.enrolledThumbprint : null;
-            }
-            catch {
-                /* non-JSON 409 — treat as the legacy benign race */
-            }
-        }
-        const pinnedToOtherKey = response.status === 409 &&
-            enrolledThumbprint !== null &&
-            enrolledThumbprint !== keypair.thumbprint;
-        const keyPinnedElsewhere = response.status === 409 && conflictCode === 'ENROLLMENT_DUPLICATE_KEY';
-        const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
-            (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
-            (response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere);
-        if (pinnedToOtherKey) {
-            emit('enrollment_key_mismatch', false, {
-                profile,
-                thumbprint: keypair.thumbprint,
-                enrolledThumbprint,
-                serverUrl,
-                message: 'this machine is registered with a different device key than this profile signs ' +
-                    'with; its refreshes will be refused. An interactive daemon login (skrrd login) ' +
-                    're-registers this key.',
-            }, { logLevel: 'warn' });
-        }
-        if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
-            try {
-                atomicWrite0600(backoffPath, JSON.stringify({
-                    serverUrl,
-                    machineUuid,
-                    thumbprint: keypair.thumbprint,
-                    retryAfter: new Date(Date.now() + DAEMON_NOT_FOUND_BACKOFF_MS).toISOString(),
-                }));
-            }
-            catch (err) {
-                emit('enrollment_backoff_write_failed', false, {
-                    profile,
-                    message: err?.message ?? 'unknown',
-                });
-            }
-        }
-        emit('enrollment_rejected', false, {
-            profile,
-            thumbprint: keypair.thumbprint,
-            serverUrl,
-            status: response.status,
-            body: responseText,
-        }, { logLevel: isBenignRejection ? 'info' : 'warn' });
-        return {
-            enrolled: false,
-            reason: 'http_error',
-            status: response.status,
-            body: responseText,
-        };
-    }
-    const marker = JSON.stringify({
-        enrolledAt: new Date().toISOString(),
-        serverUrl,
-        thumbprint: keypair.thumbprint,
-        machineUuid,
-    });
-    try {
-        atomicWrite0600(markerPath, marker);
-    }
-    catch (err) {
-        // Non-fatal — server enrolled us; we may re-POST next run, which
-        // the server handles idempotently.
-        emit('enrollment_marker_write_failed', false, {
-            profile,
-            thumbprint: keypair.thumbprint,
-            message: err?.message ?? 'unknown',
-        });
-    }
-    try {
-        node_fs_1.default.unlinkSync(backoffPath);
-    }
-    catch (err) {
-        if (err.code !== 'ENOENT') {
-            emit('enrollment_backoff_clear_failed', false, {
-                profile,
-                message: err?.message ?? 'unknown',
-            });
-        }
-    }
-    emit('enrolled_with_server', true, {
+    return { enrolled: false, reason: "network_error", message };
+  } finally {
+    clearTimeout(timer);
+  }
+  const responseText = await response.text().catch(() => "");
+  if (!response.ok) {
+    let conflictCode = null;
+    let enrolledThumbprint = null;
+    if (response.status === 409) {
+      try {
+        const parsed = JSON.parse(responseText);
+        conflictCode = typeof parsed.code === "string" ? parsed.code : null;
+        enrolledThumbprint = typeof parsed.enrolledThumbprint === "string" ? parsed.enrolledThumbprint : null;
+      } catch {
+      }
+    }
+    const pinnedToOtherKey = response.status === 409 && enrolledThumbprint !== null && enrolledThumbprint !== keypair.thumbprint;
+    const keyPinnedElsewhere = response.status === 409 && conflictCode === "ENROLLMENT_DUPLICATE_KEY";
+    const isBenignRejection = response.status === 404 && responseText.includes("DAEMON_NOT_FOUND") || response.status === 403 && responseText.includes("OPAQUE_AUTH_REFUSED") || response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere;
+    if (pinnedToOtherKey) {
+      emit("enrollment_key_mismatch", false, {
         profile,
         thumbprint: keypair.thumbprint,
+        enrolledThumbprint,
         serverUrl,
+        message: "this machine is registered with a different device key than this profile signs with; its refreshes will be refused. An interactive daemon login (skrrd login) re-registers this key."
+      }, { logLevel: "warn" });
+    }
+    if (response.status === 404 && responseText.includes("DAEMON_NOT_FOUND")) {
+      try {
+        atomicWrite0600(backoffPath, JSON.stringify({
+          serverUrl,
+          machineUuid,
+          thumbprint: keypair.thumbprint,
+          retryAfter: new Date(Date.now() + DAEMON_NOT_FOUND_BACKOFF_MS).toISOString()
+        }));
+      } catch (err) {
+        emit("enrollment_backoff_write_failed", false, {
+          profile,
+          message: err?.message ?? "unknown"
+        });
+      }
+    }
+    emit("enrollment_rejected", false, {
+      profile,
+      thumbprint: keypair.thumbprint,
+      serverUrl,
+      status: response.status,
+      body: responseText
+    }, { logLevel: isBenignRejection ? "info" : "warn" });
+    return {
+      enrolled: false,
+      reason: "http_error",
+      status: response.status,
+      body: responseText
+    };
+  }
+  const marker = JSON.stringify({
+    enrolledAt: (/* @__PURE__ */ new Date()).toISOString(),
+    serverUrl,
+    thumbprint: keypair.thumbprint,
+    machineUuid
+  });
+  try {
+    atomicWrite0600(markerPath, marker);
+  } catch (err) {
+    emit("enrollment_marker_write_failed", false, {
+      profile,
+      thumbprint: keypair.thumbprint,
+      message: err?.message ?? "unknown"
     });
-    return { enrolled: true, thumbprint: keypair.thumbprint };
+  }
+  try {
+    import_node_fs.default.unlinkSync(backoffPath);
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      emit("enrollment_backoff_clear_failed", false, {
+        profile,
+        message: err?.message ?? "unknown"
+      });
+    }
+  }
+  emit("enrolled_with_server", true, {
+    profile,
+    thumbprint: keypair.thumbprint,
+    serverUrl
+  });
+  return { enrolled: true, thumbprint: keypair.thumbprint };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  __enrollmentBackoffPathForTest,
+  __enrollmentMarkerPathForTest,
+  __getStateForTest,
+  __privateKeyPathForTest,
+  __publicKeyPathForTest,
+  __setStateForTest,
+  clearEnrollmentMarker,
+  describeDeviceIdentityState,
+  describeDeviceKeySplit,
+  enrollWithServer,
+  getDevicePublicKey,
+  initDeviceIdentity,
+  isDeviceIdentityActive,
+  resetDeviceIdentity,
+  signServerRequest
+});