@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -1,450 +1,310 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MACHINE_IDENTITY_FILENAME = exports.HOSTED_RUNTIME_MACHINE_SOURCES = void 0;
-exports.hostedRuntimeIdOverride = hostedRuntimeIdOverride;
-exports.getHardwareMachineUuid = getHardwareMachineUuid;
-exports.qualifyMachineUuid = qualifyMachineUuid;
-exports.setMachineUuidProfile = setMachineUuidProfile;
-exports.getMachineUuidProfile = getMachineUuidProfile;
-exports.getMachineUuid = getMachineUuid;
-exports.getMachineUuidForProfile = getMachineUuidForProfile;
-exports.describeMachineIdentity = describeMachineIdentity;
-exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
-/**
- * machineUuid.ts — the ONE hardware machine identity sent to the server as
- * `machineUuid`, shared by the daemon and the CLI.
- *
- * Server Daemon rows are keyed on this value (daemon register, device-key
- * enrollment, token mint, pairing), so every binary on one machine must
- * compute it identically. Until OSK-12063 the CLI sent its own UUIDv7 from
- * `~/.skrr/daemon.id` (`ensureMachineDaemonId()`, a DIFFERENT identity) as
- * `machineUuid` on device-key enrollment while the daemon sent the hardware
- * UUID computed here, so every CLI enrollment matched no Daemon row, got
- * 404 DAEMON_NOT_FOUND and backed off forever. Two implementations of one
- * identity can only agree by being edited together; this file is the one
- * implementation, and `daemon/src/registry-lite.ts` re-exports it.
- *
- * Deliberately dependency-free (node builtins only) and exposed as the
- * `@skrr-ai/auth-core/machine-uuid` subpath: the packaged desktop imports the
- * daemon's `registry-lite.js` directly, and loading the full auth-core index
- * there would drag in the credential stack for a one-function need.
- *
- * Not to be confused with `ensureMachineDaemonId()` (`machineId.ts`), the
- * minted per-home-dir UUIDv7 that anchors the daemon's `stableDaemonId`. That
- * one survives an OS reinstall; this one survives a home-dir wipe. They are
- * different facts and neither may stand in for the other on the wire.
- */
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
-const node_child_process_1 = require("node:child_process");
-const configRoot_js_1 = require("./configRoot.js");
-/**
- * Daemon sources whose identity is ISSUED by the control plane rather than
- * derived from the host: the provisioner mints the daemon id and machine uuid
- * before the daemon exists, and every binary on the runtime must use exactly
- * those values.
- *
- * `dedicated-runtime` is here because the server's generation fence parses the
- * lease generation out of the machine uuid (`dedicated-runtime:<lease>:<gen>`).
- * A guest that fell back to `/etc/machine-id` would register under a uuid the
- * fence cannot read, and every dispatch to it would be refused.
- */
-exports.HOSTED_RUNTIME_MACHINE_SOURCES = new Set([
-    'hosted-machine',
-    'cloud-coding',
-    'dedicated-runtime',
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var machineUuid_exports = {};
+__export(machineUuid_exports, {
+  HOSTED_RUNTIME_MACHINE_SOURCES: () => HOSTED_RUNTIME_MACHINE_SOURCES,
+  MACHINE_IDENTITY_FILENAME: () => MACHINE_IDENTITY_FILENAME,
+  __resetMachineUuidCacheForTest: () => __resetMachineUuidCacheForTest,
+  describeMachineIdentity: () => describeMachineIdentity,
+  getHardwareMachineUuid: () => getHardwareMachineUuid,
+  getMachineUuid: () => getMachineUuid,
+  getMachineUuidForProfile: () => getMachineUuidForProfile,
+  getMachineUuidProfile: () => getMachineUuidProfile,
+  hostedRuntimeIdOverride: () => hostedRuntimeIdOverride,
+  qualifyMachineUuid: () => qualifyMachineUuid,
+  setMachineUuidProfile: () => setMachineUuidProfile
+});
+module.exports = __toCommonJS(machineUuid_exports);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_os = __toESM(require("node:os"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+var import_configRoot = require("./configRoot.js");
+const HOSTED_RUNTIME_MACHINE_SOURCES = /* @__PURE__ */ new Set([
+  "hosted-machine",
+  "cloud-coding",
+  "dedicated-runtime"
 ]);
 const HOSTED_RUNTIME_ID_RE = /^[A-Za-z0-9_.:-]{1,160}$/;
-/**
- * The control-plane-issued value of `name` (e.g. `OVERSKY_MACHINE_UUID`), or
- * null when this process is not on a hosted runtime or the value is absent /
- * malformed. Only honoured under a hosted `OVERSKY_DAEMON_SOURCE`, so a stray
- * variable on a laptop cannot rename the machine.
- */
 function hostedRuntimeIdOverride(name, env = process.env) {
-    if (!exports.HOSTED_RUNTIME_MACHINE_SOURCES.has(env.OVERSKY_DAEMON_SOURCE ?? '')) {
-        return null;
-    }
-    const value = env[name]?.trim();
-    if (!value || !HOSTED_RUNTIME_ID_RE.test(value))
-        return null;
-    return value;
+  if (!HOSTED_RUNTIME_MACHINE_SOURCES.has(env.OVERSKY_DAEMON_SOURCE ?? "")) {
+    return null;
+  }
+  const value = env[name]?.trim();
+  if (!value || !HOSTED_RUNTIME_ID_RE.test(value))
+    return null;
+  return value;
 }
 let cachedMachineUuid = null;
 function readMachineUuidDarwin() {
-    try {
-        const out = (0, node_child_process_1.execFileSync)('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], {
-            encoding: 'utf-8',
-            timeout: 2_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        const match = out.match(/IOPlatformUUID"?\s*=\s*"?([0-9A-F-]{36})/i);
-        return match ? match[1].toLowerCase() : null;
-    }
-    catch {
-        return null;
-    }
+  try {
+    const out = (0, import_node_child_process.execFileSync)("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      encoding: "utf-8",
+      timeout: 2e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const match = out.match(/IOPlatformUUID"?\s*=\s*"?([0-9A-F-]{36})/i);
+    return match ? match[1].toLowerCase() : null;
+  } catch {
+    return null;
+  }
 }
 function readMachineUuidLinux() {
-    for (const p of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
-        try {
-            const raw = node_fs_1.default.readFileSync(p, 'utf-8').trim();
-            if (raw)
-                return raw.toLowerCase();
-        }
-        catch {
-            // Try the next candidate.
-        }
+  for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    try {
+      const raw = import_node_fs.default.readFileSync(p, "utf-8").trim();
+      if (raw)
+        return raw.toLowerCase();
+    } catch {
     }
-    return null;
+  }
+  return null;
 }
 function readMachineUuidWindows() {
-    try {
-        const out = (0, node_child_process_1.execFileSync)('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf-8', timeout: 2_000, stdio: ['ignore', 'pipe', 'ignore'] });
-        const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9A-Fa-f-]{36})/);
-        return match ? match[1].toLowerCase() : null;
-    }
-    catch {
-        return null;
-    }
+  try {
+    const out = (0, import_node_child_process.execFileSync)("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"], { encoding: "utf-8", timeout: 2e3, stdio: ["ignore", "pipe", "ignore"] });
+    const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9A-Fa-f-]{36})/);
+    return match ? match[1].toLowerCase() : null;
+  } catch {
+    return null;
+  }
 }
-/**
- * The HARDWARE identity of this machine (IOPlatformUUID / machine-id /
- * MachineGuid, or a control-plane-issued value on a hosted runtime). Cached for
- * the process lifetime. Same machine -> same value across reboots.
- *
- * Almost nothing should call this: `getMachineUuid()` is what goes on the wire,
- * and it equals this for the default profile.
- *
- * Falls back to a deterministic hostname+username hash if the platform
- * probe fails. This preserves server-side record continuity even on
- * locked-down machines that refuse ioreg / registry access.
- */
 function getHardwareMachineUuid() {
-    const hostedMachineUuid = hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID');
-    if (hostedMachineUuid)
-        return hostedMachineUuid;
-    if (cachedMachineUuid !== null)
-        return cachedMachineUuid;
-    let detected = null;
-    switch (process.platform) {
-        case 'darwin':
-            detected = readMachineUuidDarwin();
-            break;
-        case 'linux':
-            detected = readMachineUuidLinux();
-            break;
-        case 'win32':
-            detected = readMachineUuidWindows();
-            break;
-    }
-    if (detected) {
-        cachedMachineUuid = detected;
-        return detected;
-    }
-    const fallback = 'fallback-' +
-        node_crypto_1.default
-            .createHash('sha256')
-            .update(`${node_os_1.default.hostname()}:${node_os_1.default.userInfo().username}`)
-            .digest('hex')
-            .slice(0, 32);
-    cachedMachineUuid = fallback;
-    return fallback;
+  const hostedMachineUuid = hostedRuntimeIdOverride("OVERSKY_MACHINE_UUID");
+  if (hostedMachineUuid)
+    return hostedMachineUuid;
+  if (cachedMachineUuid !== null)
+    return cachedMachineUuid;
+  let detected = null;
+  switch (process.platform) {
+    case "darwin":
+      detected = readMachineUuidDarwin();
+      break;
+    case "linux":
+      detected = readMachineUuidLinux();
+      break;
+    case "win32":
+      detected = readMachineUuidWindows();
+      break;
+  }
+  if (detected) {
+    cachedMachineUuid = detected;
+    return detected;
+  }
+  const fallback = "fallback-" + import_node_crypto.default.createHash("sha256").update(`${import_node_os.default.hostname()}:${import_node_os.default.userInfo().username}`).digest("hex").slice(0, 32);
+  cachedMachineUuid = fallback;
+  return fallback;
 }
-// ---------------------------------------------------------------------------
-// Profile-qualified machine identity (OSK-13845)
-//
-// The server keys a Daemon row on (user, machineUuid), pins ONE device key to
-// that row, and groups Harness rows into one "machine" by it. A profile is the
-// documented way to run a second, isolated daemon on the same computer, and
-// while the machineUuid was hardware only a second profile landed on the FIRST
-// profile's row: it replaced the machine page's Daemon and working directory,
-// re-registered every harness under itself, and its interactive login re-pinned
-// the row's device key (OSK-12063), so the default profile's next refresh was
-// refused DEVICE_KEY_MISMATCH and every `skrr` call failed until a re-login.
-//
-// So a profile that STARTS NEW on a machine is qualified:
-// `<hardware>:p-<12 hex of sha256(profile)>`. Two rules keep everything that
-// exists where it is:
-//
-//   - the default profile is NEVER qualified: its identity is the hardware value
-//     it has always had, so no existing machine row changes;
-//   - a non-default profile that already holds credentials (an
-//     `auth-binding.json` or a persisted daemon identity) keeps the hardware
-//     value. Its refresh tokens are bound to that row and the server refuses a
-//     refresh whose machineUuid differs from the stored one (H7), so qualifying
-//     it would sign it out. It stays a second daemon on the shared row.
-//
-// The choice is made ONCE, from that evidence, and written to the profile's
-// `machine-identity.json`; afterwards it is read, never re-derived. Deriving it
-// every time would flip a profile from qualified to shared the moment its own
-// first login wrote `auth-binding.json`.
-// ---------------------------------------------------------------------------
-/** The profile's persisted machine-identity choice, beside its other state. */
-exports.MACHINE_IDENTITY_FILENAME = 'machine-identity.json';
-/** Files that prove a profile already holds credentials bound to the shared row. */
-const PRE_EXISTING_PROFILE_EVIDENCE = ['auth-binding.json', 'daemon-identity.json'];
-const DEFAULT_PROFILE_NAME = 'default';
-/** The server caps `machineUuid` at 64 characters; 36 + 15 fits, and so does a 41-character fallback. */
+const MACHINE_IDENTITY_FILENAME = "machine-identity.json";
+const PRE_EXISTING_PROFILE_EVIDENCE = ["auth-binding.json", "daemon-identity.json"];
+const DEFAULT_PROFILE_NAME = "default";
 function qualifyMachineUuid(hardware, profile) {
-    const digest = node_crypto_1.default
-        .createHash('sha256')
-        .update(`profile:${profile}`)
-        .digest('hex')
-        .slice(0, 12);
-    return `${hardware}:p-${digest}`;
+  const digest = import_node_crypto.default.createHash("sha256").update(`profile:${profile}`).digest("hex").slice(0, 12);
+  return `${hardware}:p-${digest}`;
 }
 let activeMachineProfile = null;
-const profileChoiceCache = new Map();
-/**
- * Tell this module which profile the process runs as. Called wherever a binary
- * resolves its profile (`setActiveProfile` in the daemon and in the CLI), so the
- * identity cannot depend on call order. `null`, '' and the default profile all
- * mean "the hardware identity".
- */
+const profileChoiceCache = /* @__PURE__ */ new Map();
 function setMachineUuidProfile(profile) {
-    activeMachineProfile = typeof profile === 'string' && profile.trim() ? profile.trim() : null;
+  activeMachineProfile = typeof profile === "string" && profile.trim() ? profile.trim() : null;
 }
 function getMachineUuidProfile() {
-    return activeMachineProfile;
+  return activeMachineProfile;
 }
 function readPersistedChoice(file, hardware, profile, requireProfile = false) {
-    try {
-        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
-        // A file from another machine (a restored backup, a synced home) is absent.
-        if (parsed?.version !== 1 ||
-            parsed.hardware !== hardware ||
-            (parsed.profile !== undefined && parsed.profile !== profile) ||
-            (requireProfile && parsed.profile !== profile))
-            return null;
-        // Only the two values this module can produce are accepted: a hand-edited or
-        // foreign string must never become an identity.
-        if (parsed.machineUuid === hardware)
-            return hardware;
-        const qualified = qualifyMachineUuid(hardware, profile);
-        return parsed.machineUuid === qualified ? qualified : null;
-    }
-    catch {
-        return null;
-    }
+  try {
+    const parsed = JSON.parse(import_node_fs.default.readFileSync(file, "utf-8"));
+    if (parsed?.version !== 1 || parsed.hardware !== hardware || parsed.profile !== void 0 && parsed.profile !== profile || requireProfile && parsed.profile !== profile)
+      return null;
+    if (parsed.machineUuid === hardware)
+      return hardware;
+    const qualified = qualifyMachineUuid(hardware, profile);
+    return parsed.machineUuid === qualified ? qualified : null;
+  } catch {
+    return null;
+  }
 }
 function persistChoice(dir, file, hardware, machineUuid, reason, profile, evidence) {
-    try {
-        node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
-        const body = {
-            version: 1,
-            hardware,
-            machineUuid,
-            profile,
-            reason,
-            // WHICH file made a profile "already hold credentials". The reason alone
-            // says a profile shares the default's machine row; this says what put it
-            // there, which is the difference between "an older Skrr set it up" and
-            // "its first credential was written before anything chose its identity".
-            // Additive: a reader that predates it ignores the field.
-            ...(evidence && evidence.length > 0 ? { evidence: [...evidence] } : {}),
-            decidedAt: new Date().toISOString(),
-        };
-        node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
-        node_fs_1.default.renameSync(tmp, file);
-    }
-    catch {
-        // Not persisted: the in-process cache keeps this process consistent, and the
-        // next process decides again from the same evidence.
-    }
+  try {
+    import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    const body = {
+      version: 1,
+      hardware,
+      machineUuid,
+      profile,
+      reason,
+      // WHICH file made a profile "already hold credentials". The reason alone
+      // says a profile shares the default's machine row; this says what put it
+      // there, which is the difference between "an older Skrr set it up" and
+      // "its first credential was written before anything chose its identity".
+      // Additive: a reader that predates it ignores the field.
+      ...evidence && evidence.length > 0 ? { evidence: [...evidence] } : {},
+      decidedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    import_node_fs.default.writeFileSync(tmp, `${JSON.stringify(body)}
+`, { mode: 384 });
+    import_node_fs.default.renameSync(tmp, file);
+  } catch {
+  }
 }
-/** A nonsecret recovery copy survives product uninstall. Each profile has its
- * own file, so concurrent profiles never overwrite a shared identity map. A
- * copied home cannot adopt another machine's value: the hardware is verified
- * and only this module's hardware/qualified values are admitted. */
 function recoveryChoicePath(profile) {
-    const name = node_crypto_1.default.createHash('sha256').update(profile).digest('hex');
-    return node_path_1.default.join(node_os_1.default.homedir(), '.local', 'state', 'skrr', 'machine-identities', `${name}.json`);
+  const name = import_node_crypto.default.createHash("sha256").update(profile).digest("hex");
+  return import_node_path.default.join(import_node_os.default.homedir(), ".local", "state", "skrr", "machine-identities", `${name}.json`);
 }
 function preserveRecoveryChoice(profile, hardware, machineUuid) {
-    const file = recoveryChoicePath(profile);
-    if (readPersistedChoice(file, hardware, profile, true) === machineUuid)
-        return;
-    persistChoice(node_path_1.default.dirname(file), file, hardware, machineUuid, 'restored_profile', profile);
+  const file = recoveryChoicePath(profile);
+  if (readPersistedChoice(file, hardware, profile, true) === machineUuid)
+    return;
+  persistChoice(import_node_path.default.dirname(file), file, hardware, machineUuid, "restored_profile", profile);
 }
-/** The identity a NON-default profile registers under. Never throws. */
 function resolveProfileMachineUuid(profile, hardware) {
-    const cacheKey = `${hardware}\u0000${profile}`;
-    const cached = profileChoiceCache.get(cacheKey);
-    if (cached)
-        return cached;
-    const dir = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile);
-    const file = node_path_1.default.join(dir, exports.MACHINE_IDENTITY_FILENAME);
-    let chosen = readPersistedChoice(file, hardware, profile);
-    if (!chosen) {
-        chosen = readPersistedChoice(recoveryChoicePath(profile), hardware, profile, true);
-        if (chosen)
-            persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
-    }
-    if (!chosen) {
-        const evidence = PRE_EXISTING_PROFILE_EVIDENCE.filter((name) => {
-            try {
-                return node_fs_1.default.existsSync(node_path_1.default.join(dir, name));
-            }
-            catch {
-                return false;
-            }
-        });
-        const preExisting = evidence.length > 0;
-        chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile, evidence);
-    }
-    preserveRecoveryChoice(profile, hardware, chosen);
-    profileChoiceCache.set(cacheKey, chosen);
-    return chosen;
+  const cacheKey = `${hardware}\0${profile}`;
+  const cached = profileChoiceCache.get(cacheKey);
+  if (cached)
+    return cached;
+  const dir = import_node_path.default.join((0, import_configRoot.resolveConfigRoot)(), "profiles", profile);
+  const file = import_node_path.default.join(dir, MACHINE_IDENTITY_FILENAME);
+  let chosen = readPersistedChoice(file, hardware, profile);
+  if (!chosen) {
+    chosen = readPersistedChoice(recoveryChoicePath(profile), hardware, profile, true);
+    if (chosen)
+      persistChoice(dir, file, hardware, chosen, "restored_profile", profile);
+  }
+  if (!chosen) {
+    const evidence = PRE_EXISTING_PROFILE_EVIDENCE.filter((name) => {
+      try {
+        return import_node_fs.default.existsSync(import_node_path.default.join(dir, name));
+      } catch {
+        return false;
+      }
+    });
+    const preExisting = evidence.length > 0;
+    chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
+    persistChoice(dir, file, hardware, chosen, preExisting ? "pre_existing_profile" : "new_profile", profile, evidence);
+  }
+  preserveRecoveryChoice(profile, hardware, chosen);
+  profileChoiceCache.set(cacheKey, chosen);
+  return chosen;
 }
-/**
- * Return the `machineUuid` this process sends to the server.
- *
- * Callers should treat this as opaque: the format differs per platform
- * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid), and a
- * non-default profile that started new carries a `:p-<hash>` suffix. The
- * guarantee is only: same machine + same profile -> same value across reboots,
- * and the same value from every binary of that profile that calls this function.
- *
- * Equals the hardware identity for the default profile, for a hosted runtime
- * (the control-plane-issued `OVERSKY_MACHINE_UUID` wins) and for a non-default
- * profile that already held credentials; see the block above.
- */
 function getMachineUuid() {
-    return getMachineUuidForProfile(activeMachineProfile);
+  return getMachineUuidForProfile(activeMachineProfile);
 }
-/**
- * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
- * profile this process runs as.
- *
- * The CLI needs the answer for the profile it is about to hand a credential to,
- * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
- * Two programs that compute one identity can only be known to agree by
- * comparing them, and a daemon that predates per-profile identities does not
- * agree: it sends the hardware value whatever the profile's
- * `machine-identity.json` says, so a credential minted for what it reports
- * registers the profile on the default machine's row (the OSK-13845 failure, now
- * reached through version skew rather than through the rule). The comparison
- * needs this: the expected value for the TARGET profile, which is not
- * necessarily the one this process is running as.
- *
- * Decides and persists the profile's identity if nothing has yet — the same
- * side effect `getMachineUuid()` has, for the same reason.
- */
 function getMachineUuidForProfile(profile) {
-    const hardware = getHardwareMachineUuid();
-    // A hosted runtime's identity is ISSUED and fenced by the control plane.
-    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID'))
-        return hardware;
-    const name = typeof profile === 'string' ? profile.trim() : '';
-    if (!name || name === DEFAULT_PROFILE_NAME)
-        return hardware;
-    return resolveProfileMachineUuid(name, hardware);
+  const hardware = getHardwareMachineUuid();
+  if (hostedRuntimeIdOverride("OVERSKY_MACHINE_UUID"))
+    return hardware;
+  const name = typeof profile === "string" ? profile.trim() : "";
+  if (!name || name === DEFAULT_PROFILE_NAME)
+    return hardware;
+  return resolveProfileMachineUuid(name, hardware);
 }
 function readRecordedChoice(profile) {
-    try {
-        const file = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile, exports.MACHINE_IDENTITY_FILENAME);
-        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
-        const reason = parsed.reason === 'new_profile' ||
-            parsed.reason === 'pre_existing_profile' ||
-            parsed.reason === 'restored_profile'
-            ? parsed.reason
-            : null;
-        return {
-            reason,
-            evidence: Array.isArray(parsed.evidence)
-                ? parsed.evidence.filter((e) => typeof e === 'string')
-                : [],
-            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : null,
-        };
-    }
-    catch {
-        return { reason: null, evidence: [], decidedAt: null };
-    }
+  try {
+    const file = import_node_path.default.join((0, import_configRoot.resolveConfigRoot)(), "profiles", profile, MACHINE_IDENTITY_FILENAME);
+    const parsed = JSON.parse(import_node_fs.default.readFileSync(file, "utf-8"));
+    const reason = parsed.reason === "new_profile" || parsed.reason === "pre_existing_profile" || parsed.reason === "restored_profile" ? parsed.reason : null;
+    return {
+      reason,
+      evidence: Array.isArray(parsed.evidence) ? parsed.evidence.filter((e) => typeof e === "string") : [],
+      decidedAt: typeof parsed.decidedAt === "string" ? parsed.decidedAt : null
+    };
+  } catch {
+    return { reason: null, evidence: [], decidedAt: null };
+  }
 }
-/**
- * Which machine this process registers as, and WHY — the question a person has
- * when two profiles turn up on one machine page and the logs say nothing.
- *
- * A read, not a decision: it reports the identity `getMachineUuid()` settled on
- * (settling it if nothing has, exactly as any caller would) and the record that
- * explains it. It never changes what a profile registers as.
- */
 function describeMachineIdentity() {
-    const hardware = getHardwareMachineUuid();
-    const machineUuid = getMachineUuid();
-    const active = activeMachineProfile;
-    const profile = active && active !== DEFAULT_PROFILE_NAME ? active : null;
-    const base = { profile, machineUuid, hardware };
-    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID')) {
-        return {
-            ...base,
-            sharesDefaultMachine: false,
-            reason: 'hosted_runtime',
-            evidence: [],
-            decidedAt: null,
-            sentence: 'This runtime is hosted; its machine identity was issued by the control plane.',
-        };
-    }
-    if (!profile) {
-        return {
-            ...base,
-            sharesDefaultMachine: false,
-            reason: 'default_profile',
-            evidence: [],
-            decidedAt: null,
-            sentence: "The default profile uses this computer's own machine identity.",
-        };
-    }
-    const recorded = readRecordedChoice(profile);
-    const sharesDefaultMachine = machineUuid === hardware;
-    const reason = recorded.reason ?? 'unrecorded';
-    const decided = recorded.decidedAt ? ` (decided ${recorded.decidedAt})` : '';
-    const held = recorded.evidence.length > 0 ? ` (${recorded.evidence.join(', ')})` : '';
-    let sentence;
-    if (reason === 'new_profile') {
-        sentence =
-            `Profile '${profile}' has its own machine identity: it held no credentials when that ` +
-                `identity was first chosen${decided}.`;
-    }
-    else if (reason === 'pre_existing_profile') {
-        sentence =
-            `Profile '${profile}' shares this computer's default machine identity: it already held ` +
-                `credentials${held} when its identity was first chosen${decided}, and the server ties ` +
-                'those credentials to that identity, so changing it would sign the profile out.';
-    }
-    else if (reason === 'restored_profile') {
-        sentence = sharesDefaultMachine
-            ? `Profile '${profile}' shares this computer's default machine identity, restored from the ` +
-                `copy kept outside the profile after its state was removed${decided}.`
-            : `Profile '${profile}' has its own machine identity, restored from the copy kept outside ` +
-                `the profile after its state was removed${decided}.`;
-    }
-    else {
-        sentence = sharesDefaultMachine
-            ? `Profile '${profile}' uses this computer's default machine identity; the record of why ` +
-                'could not be read.'
-            : `Profile '${profile}' has its own machine identity; the record of why could not be read.`;
-    }
+  const hardware = getHardwareMachineUuid();
+  const machineUuid = getMachineUuid();
+  const active = activeMachineProfile;
+  const profile = active && active !== DEFAULT_PROFILE_NAME ? active : null;
+  const base = { profile, machineUuid, hardware };
+  if (hostedRuntimeIdOverride("OVERSKY_MACHINE_UUID")) {
+    return {
+      ...base,
+      sharesDefaultMachine: false,
+      reason: "hosted_runtime",
+      evidence: [],
+      decidedAt: null,
+      sentence: "This runtime is hosted; its machine identity was issued by the control plane."
+    };
+  }
+  if (!profile) {
     return {
-        ...base,
-        sharesDefaultMachine,
-        reason,
-        evidence: recorded.evidence,
-        decidedAt: recorded.decidedAt,
-        sentence,
+      ...base,
+      sharesDefaultMachine: false,
+      reason: "default_profile",
+      evidence: [],
+      decidedAt: null,
+      sentence: "The default profile uses this computer's own machine identity."
     };
+  }
+  const recorded = readRecordedChoice(profile);
+  const sharesDefaultMachine = machineUuid === hardware;
+  const reason = recorded.reason ?? "unrecorded";
+  const decided = recorded.decidedAt ? ` (decided ${recorded.decidedAt})` : "";
+  const held = recorded.evidence.length > 0 ? ` (${recorded.evidence.join(", ")})` : "";
+  let sentence;
+  if (reason === "new_profile") {
+    sentence = `Profile '${profile}' has its own machine identity: it held no credentials when that identity was first chosen${decided}.`;
+  } else if (reason === "pre_existing_profile") {
+    sentence = `Profile '${profile}' shares this computer's default machine identity: it already held credentials${held} when its identity was first chosen${decided}, and the server ties those credentials to that identity, so changing it would sign the profile out.`;
+  } else if (reason === "restored_profile") {
+    sentence = sharesDefaultMachine ? `Profile '${profile}' shares this computer's default machine identity, restored from the copy kept outside the profile after its state was removed${decided}.` : `Profile '${profile}' has its own machine identity, restored from the copy kept outside the profile after its state was removed${decided}.`;
+  } else {
+    sentence = sharesDefaultMachine ? `Profile '${profile}' uses this computer's default machine identity; the record of why could not be read.` : `Profile '${profile}' has its own machine identity; the record of why could not be read.`;
+  }
+  return {
+    ...base,
+    sharesDefaultMachine,
+    reason,
+    evidence: recorded.evidence,
+    decidedAt: recorded.decidedAt,
+    sentence
+  };
 }
-/** @internal test seam — forget the cached value so the next call re-probes. */
 function __resetMachineUuidCacheForTest() {
-    cachedMachineUuid = null;
-    activeMachineProfile = null;
-    profileChoiceCache.clear();
+  cachedMachineUuid = null;
+  activeMachineProfile = null;
+  profileChoiceCache.clear();
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HOSTED_RUNTIME_MACHINE_SOURCES,
+  MACHINE_IDENTITY_FILENAME,
+  __resetMachineUuidCacheForTest,
+  describeMachineIdentity,
+  getHardwareMachineUuid,
+  getMachineUuid,
+  getMachineUuidForProfile,
+  getMachineUuidProfile,
+  hostedRuntimeIdOverride,
+  qualifyMachineUuid,
+  setMachineUuidProfile
+});