@skrr-ai/cli 0.1.115 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -1,962 +1,639 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = void 0;
-exports.__setStateForTest = __setStateForTest;
-exports.__getStateForTest = __getStateForTest;
-exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
-exports.splitKeyConvergencePolicy = splitKeyConvergencePolicy;
-exports.initCredEnvelope = initCredEnvelope;
-exports.resetCredEnvelope = resetCredEnvelope;
-exports.shutdownCredEnvelope = shutdownCredEnvelope;
-exports.__resetShutdownGuardForTest = __resetShutdownGuardForTest;
-exports.isCredEnvelopeActive = isCredEnvelopeActive;
-exports.hasCredEnvelopePathConflict = hasCredEnvelopePathConflict;
-exports.describeCredEnvelopeState = describeCredEnvelopeState;
-exports.maybeEncryptForWrite = maybeEncryptForWrite;
-exports.wrapIfActiveOrPassthrough = wrapIfActiveOrPassthrough;
-exports.maybeDecryptOnRead = maybeDecryptOnRead;
-exports.__wrappedDekFilePathForTest = __wrappedDekFilePathForTest;
-/**
- * credentialEnvelopeBridge.ts — composed L12 runtime (init, transforms, lock).
- *
- * Lifts the previously-duplicated `daemon/src/credEnvelope.ts` and
- * `cli/src/lib/cred-envelope.ts` modules into a single shared
- * implementation. The daemon and CLI both consume this module so they
- * land on the SAME on-disk artifacts:
- *
- *   <machine root>/profiles/<p>/cred-dek-wrapped     — KEK-wrapped DEK
- *   <machine root>/profiles/<p>/cred-envelope.lock   — proper-lockfile sentinel
- *
- * `<machine root>` comes from `profileStateDir.ts`, which derives it from
- * `getAuthMachineConfigDir()`. That indirection is not decoration. This header
- * used to say the paths were built from `configDir` and that "both binaries
- * today resolve to `~/.skrr` so first-enrollment races between `sky` and
- * `oversky` serialize against the same lockfile" — and it had been false for as
- * long as the daemon has been profile-aware. The daemon passes a configDir that
- * is ALREADY `~/.skrr/profiles/<p>`, so it wrote to
- * `~/.skrr/profiles/<p>/profiles/<p>/…` while the CLI wrote to
- * `~/.skrr/profiles/<p>/…`. One profile, two wrapped DEKs, two lockfiles, and
- * the mutex this module exists to share serialized neither process against the
- * other (OSK-10314). Reading the machine root is what makes the sentence above
- * true rather than aspirational.
- *
- * On a machine that already has both, `profileStateDir.ts` keeps each process
- * reading the copy it has been using until the migration has proved the two are
- * equivalent, and refuses to pick a winner when they are not — see that file.
- * The LOCK is always taken at the canonical path regardless, because a mutex
- * that is per-consumer is not a mutex.
- *
- * NAMING NOTE — the suffix `Bridge` distinguishes this composed runtime
- * (init + sign + persist + telemetry) from the pure-crypto primitive
- * file `credentialEnvelope.ts` it composes.
- *
- * Failure mode contract:
- *   - KEK unavailable on this platform: transforms are passthrough; one
- *     `cred_envelope.kek_unavailable` telemetry event fires at init.
- *   - Init failure: transforms passthrough; never crashes the consumer.
- *   - Daemon configures `credEnvelopeFailClosed=true` so writes throw
- *     when not active. CLI leaves it unset; legacy `OVERSKY_KEK_REQUIRED=1`
- *     env var is still honored as a back-compat trigger.
- */
-const node_crypto_1 = require("node:crypto");
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
-const credentialEnvelope_js_1 = require("./credentialEnvelope.js");
-const index_js_1 = require("./kek/index.js");
-const profileStateDir_js_1 = require("./profileStateDir.js");
-const refresh_js_1 = require("./refresh.js");
-const runtime_js_1 = require("./runtime.js");
-/**
- * Account name the wrapped DEK lives under (file fallback). Keeping the
- * literal here so a future rename surfaces as a single grep target.
- */
-const ACCOUNT_CRED_DEK_WRAPPED = 'cred-dek-wrapped';
-let _state = { kind: 'uninit' };
-/**
- * Sticky flag set by `initCredEnvelope` when the on-disk wrapped DEK
- * exists but unwrap fails under a currently-available KEK — strong
- * evidence the KEK was rotated underneath us. Persists across the init
- * pass so `describeCredEnvelopeState()` and the `oversky status` surface
- * can explain why local credentials were just re-enrolled.
- */
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var credentialEnvelopeBridge_exports = {};
+__export(credentialEnvelopeBridge_exports, {
+  DEFAULT_UNREADABLE_CREDENTIAL_HINT: () => DEFAULT_UNREADABLE_CREDENTIAL_HINT,
+  __clearWarnDedupeForTest: () => __clearWarnDedupeForTest,
+  __getStateForTest: () => __getStateForTest,
+  __resetShutdownGuardForTest: () => __resetShutdownGuardForTest,
+  __setStateForTest: () => __setStateForTest,
+  __wrappedDekFilePathForTest: () => __wrappedDekFilePathForTest,
+  describeCredEnvelopeState: () => describeCredEnvelopeState,
+  hasCredEnvelopePathConflict: () => hasCredEnvelopePathConflict,
+  initCredEnvelope: () => initCredEnvelope,
+  isCredEnvelopeActive: () => isCredEnvelopeActive,
+  maybeDecryptOnRead: () => maybeDecryptOnRead,
+  maybeEncryptForWrite: () => maybeEncryptForWrite,
+  resetCredEnvelope: () => resetCredEnvelope,
+  shutdownCredEnvelope: () => shutdownCredEnvelope,
+  splitKeyConvergencePolicy: () => splitKeyConvergencePolicy,
+  wrapIfActiveOrPassthrough: () => wrapIfActiveOrPassthrough
+});
+module.exports = __toCommonJS(credentialEnvelopeBridge_exports);
+var import_node_crypto = require("node:crypto");
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
+var import_credentialEnvelope = require("./credentialEnvelope.js");
+var import_kek = require("./kek/index.js");
+var import_profileStateDir = require("./profileStateDir.js");
+var import_refresh = require("./refresh.js");
+var import_runtime = require("./runtime.js");
+const ACCOUNT_CRED_DEK_WRAPPED = "cred-dek-wrapped";
+let _state = { kind: "uninit" };
 let _kekRotationDetected = false;
-/** @internal Test seam — force-set state, returns previous. */
 function __setStateForTest(next) {
-    const prev = _state;
-    _state = next;
-    return prev;
+  const prev = _state;
+  _state = next;
+  return prev;
 }
-/** @internal Test seam — read state for assertions. */
 function __getStateForTest() {
-    return _state;
+  return _state;
 }
-/**
- * The wrapped DEK this process must read and write for `profile`.
- *
- * Canonical on any machine that has only ever had one location, and on one that
- * has been consolidated. On a machine that still has two, this returns the copy
- * this process has been using — see `profileStateDir.ts` for why swapping it out
- * from under a daemon that has sealed credentials with it is not an option.
- */
 function wrappedDekFilePath(profile) {
-    return (0, profileStateDir_js_1.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED).path;
+  return (0, import_profileStateDir.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED).path;
 }
-/**
- * Atomic 0600 write — tmp+fsync+rename+dir-fsync. Same shape as the
- * original daemon/CLI implementations so partial-write races between
- * `sky` and `oversky` produce the same on-disk transitions.
- */
 function atomicWrite0600(target, value) {
-    const dir = node_path_1.default.dirname(target);
-    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-    const fd = node_fs_1.default.openSync(tmp, 'w', 0o600);
-    try {
-        node_fs_1.default.writeSync(fd, value);
-        node_fs_1.default.fsyncSync(fd);
-    }
-    finally {
-        node_fs_1.default.closeSync(fd);
-    }
-    node_fs_1.default.renameSync(tmp, target);
+  const dir = import_node_path.default.dirname(target);
+  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+  const fd = import_node_fs.default.openSync(tmp, "w", 384);
+  try {
+    import_node_fs.default.writeSync(fd, value);
+    import_node_fs.default.fsyncSync(fd);
+  } finally {
+    import_node_fs.default.closeSync(fd);
+  }
+  import_node_fs.default.renameSync(tmp, target);
+  try {
+    const dirFd = import_node_fs.default.openSync(dir, "r");
     try {
-        const dirFd = node_fs_1.default.openSync(dir, 'r');
-        try {
-            node_fs_1.default.fsyncSync(dirFd);
-        }
-        finally {
-            node_fs_1.default.closeSync(dirFd);
-        }
-    }
-    catch {
-        /* best-effort — Windows / some BSDs reject dir fsync */
+      import_node_fs.default.fsyncSync(dirFd);
+    } finally {
+      import_node_fs.default.closeSync(dirFd);
     }
+  } catch {
+  }
 }
-/**
- * Telemetry shim. Routes through the consumer-supplied logEvent sink
- * (daemon: structured event log; CLI: typically no-op or stderr at DEBUG).
- * Also writes to `getAuthLogger().warn` on failure so an operator running
- * with verbose logs sees the signal even without a configured event sink.
- *
- * The event name passed in is the FULLY-QUALIFIED `cred_envelope.*` form
- * because daemon-side telemetry consumers (`event-log.ts`, dashboards,
- * spec assertions) key off the prefixed name. Do not strip the prefix.
- *
- * Identical failure warnings hit the logger only once per process.
- * Telemetry still records every occurrence — the dedupe exists because a
- * single unreadable envelope produced the same warning once per stored
- * field (token, refresh token, expiry…), which read to users as three
- * crashes rather than one stale credential (OSK-12074). The signature is
- * event + kek identity + message, so a genuinely different failure mode
- * still gets its own line.
- */
-const warnedSignatures = new Set();
+const warnedSignatures = /* @__PURE__ */ new Set();
 const MAX_WARNED_SIGNATURES = 64;
-/** @internal Test seam — each spec owns its warn-dedupe horizon. */
 function __clearWarnDedupeForTest() {
-    warnedSignatures.clear();
+  warnedSignatures.clear();
 }
 function emit(eventName, success, metadata) {
-    (0, runtime_js_1.emitAuthTelemetry)({
-        timestamp: new Date().toISOString(),
-        eventType: 'auth',
-        success,
-        metadata: { event: eventName, ...metadata },
-    });
-    if (!success) {
-        // The hint is part of the signature: the same crypto failure on this
-        // config's own credential and on another config's is two different facts,
-        // and the second must not swallow the first (OSK-12135).
-        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}:${metadata.hint ?? ''}`;
-        if (!warnedSignatures.has(signature)) {
-            if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
-                warnedSignatures.clear();
-            warnedSignatures.add(signature);
-            (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
-        }
-    }
+  (0, import_runtime.emitAuthTelemetry)({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    eventType: "auth",
+    success,
+    metadata: { event: eventName, ...metadata }
+  });
+  if (!success) {
+    const signature = `${eventName}:${metadata.kekId ?? ""}:${metadata.kekKind ?? ""}:${metadata.message ?? ""}:${metadata.hint ?? ""}`;
+    if (!warnedSignatures.has(signature)) {
+      if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
+        warnedSignatures.clear();
+      warnedSignatures.add(signature);
+      (0, import_runtime.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+    }
+  }
 }
-// ---------------------------------------------------------------------------
-// First-enrollment lockfile (gap G5).
-//
-// Two daemon processes that race to enroll a fresh DEK under the same
-// profile would each generate a different DEK, wrap each, and the second
-// rename-write would silently win — making any envelopes wrapped under
-// the loser's DEK permanently unrecoverable. The lock serializes this
-// window. Mirrors `withAuthLock` in `packages/auth-core/src/refresh.ts`.
-// ---------------------------------------------------------------------------
-const CRED_LOCK_STALE_MS = 30_000;
+const CRED_LOCK_STALE_MS = 3e4;
 const CRED_LOCK_RETRY_MS = 100;
-// Exponential retry capped at 400 ms: 50 retries are ~20 s total, not 5 s.
 const CRED_LOCK_MAX_RETRIES = 50;
-/**
- * ALWAYS the canonical directory, even when this process is reading a legacy
- * wrapped DEK. The lock's job is to serialize first enrollment for one profile
- * on one machine across both binaries; resolving it the way the DEK resolves
- * would give each consumer its own sentinel, which is how the mutex documented
- * in this file's header came to protect nobody.
- */
 function credEnvelopeLockPath(profile) {
-    return node_path_1.default.join((0, profileStateDir_js_1.profileStateDir)(profile), 'cred-envelope.lock');
+  return import_node_path.default.join((0, import_profileStateDir.profileStateDir)(profile), "cred-envelope.lock");
 }
-/**
- * Acquire the cross-process credential-envelope lock for a profile, run
- * the body, release in `finally`. Emits `cred_envelope.lock_acquired`
- * and `cred_envelope.lock_released` so contention shows up in telemetry.
- *
- * The lock file is a sentinel (mode 0600) — `proper-lockfile` locks the
- * sentinel rather than the real wrapped-DEK file because the latter is
- * subject to atomic tmp+rename writes that would race with the lock
- * adapter on some filesystems.
- */
 async function withCredEnvelopeLock(profile, body) {
-    const lockPath = credEnvelopeLockPath(profile);
-    const dir = node_path_1.default.dirname(lockPath);
-    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    if (!node_fs_1.default.existsSync(lockPath)) {
-        node_fs_1.default.writeFileSync(lockPath, '', { mode: 0o600 });
-    }
-    const acquireStart = Date.now();
-    const release = await proper_lockfile_1.default.lock(lockPath, {
-        stale: CRED_LOCK_STALE_MS,
-        retries: {
-            retries: CRED_LOCK_MAX_RETRIES,
-            minTimeout: CRED_LOCK_RETRY_MS,
-            maxTimeout: CRED_LOCK_RETRY_MS * 4,
-            factor: 1.5,
-        },
-    });
-    const acquiredAt = Date.now();
-    emit('cred_envelope.lock_acquired', true, {
-        profile,
-        waitedMs: acquiredAt - acquireStart,
+  const lockPath = credEnvelopeLockPath(profile);
+  const dir = import_node_path.default.dirname(lockPath);
+  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (!import_node_fs.default.existsSync(lockPath)) {
+    import_node_fs.default.writeFileSync(lockPath, "", { mode: 384 });
+  }
+  const acquireStart = Date.now();
+  const release = await import_proper_lockfile.default.lock(lockPath, {
+    stale: CRED_LOCK_STALE_MS,
+    retries: {
+      retries: CRED_LOCK_MAX_RETRIES,
+      minTimeout: CRED_LOCK_RETRY_MS,
+      maxTimeout: CRED_LOCK_RETRY_MS * 4,
+      factor: 1.5
+    }
+  });
+  const acquiredAt = Date.now();
+  emit("cred_envelope.lock_acquired", true, {
+    profile,
+    waitedMs: acquiredAt - acquireStart
+  });
+  try {
+    return await body();
+  } finally {
+    const heldForMs = Date.now() - acquiredAt;
+    emit("cred_envelope.lock_released", true, {
+      profile,
+      waitedMs: heldForMs
     });
     try {
-        return await body();
-    }
-    finally {
-        const heldForMs = Date.now() - acquiredAt;
-        emit('cred_envelope.lock_released', true, {
-            profile,
-            waitedMs: heldForMs,
-        });
-        try {
-            await release();
-        }
-        catch {
-            /* best-effort — stale-lock fallback handles next-acquire */
-        }
+      await release();
+    } catch {
     }
+  }
 }
-/**
- * Sticky record of the last consolidation refusal for this process — two usable
- * and DIFFERENT wrapped DEKs for one profile. Surfaced through
- * `describeCredEnvelopeState()` so `skrr status` / `oversky status` can say so:
- * the split cannot be repaired here (each side's secrets live in its own
- * keychain namespace, sealed under its own DEK, and re-sealing them is not
- * auth-core's to do), so being loud about it IS the remedy.
- */
 let _pathConflict = null;
-/**
- * DEKs this profile used before a converging consolidation retired them
- * (OSK-12462). Read-only: nothing is ever sealed under one again. A value that
- * only a retired DEK opens is returned with `needsMigration: true`, the same
- * signal a legacy plaintext value carries, so every consumer that already
- * upgrades plaintext in place re-seals it under the active DEK on its own
- * schedule. auth-core does not need to know where the consumer keeps it.
- */
 let _retiredDeks = [];
-/**
- * Set when THIS process converged a split profile onto the legacy key. For the
- * status surface and tests; the on-disk marker is the durable record.
- */
 let _convergedFrom = null;
-/**
- * Identity of a wrapped DEK: the SHA-256 of the key it unwraps to.
- *
- * Not of the file. `kek.wrap` draws a fresh nonce, so wrapping ONE key twice
- * gives two different files — comparing bytes would call two copies of the same
- * key a conflict and refuse a migration that was safe. `unwrapExisting` is the
- * read-only probe: it must never mint a KEK as a side effect of asking whether
- * an old file is still readable.
- */
 async function wrappedDekIdentity(target, kek, aad) {
-    let dek = null;
-    try {
-        if (!kek.unwrapExisting)
-            return null;
-        dek = await kek.unwrapExisting(node_fs_1.default.readFileSync(target), aad);
-        if (dek.length !== 32)
-            return null;
-        return (0, node_crypto_1.createHash)('sha256').update(dek).digest('hex');
-    }
-    catch {
-        return null;
-    }
-    finally {
-        dek?.fill(0);
-    }
+  let dek = null;
+  try {
+    if (!kek.unwrapExisting)
+      return null;
+    dek = await kek.unwrapExisting(import_node_fs.default.readFileSync(target), aad);
+    if (dek.length !== 32)
+      return null;
+    return (0, import_node_crypto.createHash)("sha256").update(dek).digest("hex");
+  } catch {
+    return null;
+  } finally {
+    dek?.fill(0);
+  }
 }
-/**
- * Run the OSK-10314 consolidation for this profile's wrapped DEK.
- *
- * Under the canonical lock, because the window it closes is real: a daemon
- * copying its legacy DEK into an empty canonical slot must not race a CLI
- * enrolling a fresh one there — the loser's key would be overwritten and
- * anything already sealed under it lost. That is the same race the lock was
- * introduced for, one layer up.
- *
- * Never fatal. A migration that cannot run leaves the process exactly where it
- * was, which is the state it has been operating in all along.
- */
-/**
- * Whether a split profile may be converged onto the legacy (daemon) key.
- *
- * Only the daemon ever has a legacy location, so only the daemon runs this, and
- * the legacy key is the one it signs with. Since OSK-12063 the CLI enrolls no
- * device key and only an interactive daemon login re-pins, so the key the server
- * pins for this machine is the daemon's, UNLESS the daemon has itself been
- * refused over its device key. That is the one fact that proves otherwise, and
- * then nothing here knows which key the server holds, so it refuses as before.
- *
- * Why converging matters (OSK-12462): a CLI credential brokered by the daemon
- * is tied to the daemon's machine row, and the server checks its refresh proof
- * against the key pinned there. A CLI signing with a different key has that
- * refresh refused as DEVICE_PROOF_THUMBPRINT_MISMATCH at its first renewal.
- */
 function splitKeyConvergencePolicy() {
-    let reauthReason;
-    try {
-        const state = (0, refresh_js_1.needsReauthState)();
-        reauthReason = state.needed ? state.reason : undefined;
-    }
-    catch {
-        reauthReason = undefined;
-    }
-    return reauthReason === 'DEVICE_KEY_MISMATCH'
-        ? { converge: false, reason: 'daemon_key_refused' }
-        : { converge: true, reason: 'daemon_key_pinned' };
+  let reauthReason;
+  try {
+    const state = (0, import_refresh.needsReauthState)();
+    reauthReason = state.needed ? state.reason : void 0;
+  } catch {
+    reauthReason = void 0;
+  }
+  return reauthReason === "DEVICE_KEY_MISMATCH" ? { converge: false, reason: "daemon_key_refused" } : { converge: true, reason: "daemon_key_pinned" };
 }
 async function consolidateWrappedDek(profile, kek, aad) {
-    const resolved = (0, profileStateDir_js_1.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED);
-    if (!resolved.usingLegacy) {
-        _pathConflict = null;
-        return;
-    }
-    const policy = splitKeyConvergencePolicy();
-    let outcome;
-    try {
-        outcome = await withCredEnvelopeLock(profile, () => (0, profileStateDir_js_1.consolidateProfileState)(profile, {
-            files: [ACCOUNT_CRED_DEK_WRAPPED],
-            primary: ACCOUNT_CRED_DEK_WRAPPED,
-            identify: (dir) => wrappedDekIdentity(node_path_1.default.join(dir, ACCOUNT_CRED_DEK_WRAPPED), kek, aad),
-            onConflict: policy.converge ? 'adopt_legacy' : 'refuse',
-            onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta),
-        }));
-    }
-    catch (err) {
-        emit('cred_envelope.path_consolidation.failed', false, {
-            profile,
-            message: err?.message ?? 'unknown',
-        });
-        return;
-    }
-    if (outcome.status === 'converged') {
-        _pathConflict = null;
-        _convergedFrom = {
-            canonicalPath: node_path_1.default.join(outcome.canonicalDir, ACCOUNT_CRED_DEK_WRAPPED),
-            legacyPath: node_path_1.default.join(outcome.legacyDir ?? '', ACCOUNT_CRED_DEK_WRAPPED),
-        };
-        (0, runtime_js_1.getAuthLogger)().info(`[credEnvelope] profile "${profile}" had two different usable wrapped DEKs; ` +
-            `converged on the daemon's (${_convergedFrom.legacyPath}), which is the key the ` +
-            "server pins for this machine. The CLI's former key is kept beside it as " +
-            `${ACCOUNT_CRED_DEK_WRAPPED}${profileStateDir_js_1.RETIRED_COPY_SUFFIX}.* and still opens what was ` +
-            'sealed under it; each value is re-sealed under the shared key on its next write.');
-        return;
-    }
-    if (outcome.status !== 'conflict') {
-        _pathConflict = null;
-        return;
-    }
-    _pathConflict = {
-        canonicalPath: node_path_1.default.join(outcome.canonicalDir, ACCOUNT_CRED_DEK_WRAPPED),
-        legacyPath: node_path_1.default.join(outcome.legacyDir ?? '', ACCOUNT_CRED_DEK_WRAPPED),
+  const resolved = (0, import_profileStateDir.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED);
+  if (!resolved.usingLegacy) {
+    _pathConflict = null;
+    return;
+  }
+  const policy = splitKeyConvergencePolicy();
+  let outcome;
+  try {
+    outcome = await withCredEnvelopeLock(profile, () => (0, import_profileStateDir.consolidateProfileState)(profile, {
+      files: [ACCOUNT_CRED_DEK_WRAPPED],
+      primary: ACCOUNT_CRED_DEK_WRAPPED,
+      identify: (dir) => wrappedDekIdentity(import_node_path.default.join(dir, ACCOUNT_CRED_DEK_WRAPPED), kek, aad),
+      onConflict: policy.converge ? "adopt_legacy" : "refuse",
+      onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta)
+    }));
+  } catch (err) {
+    emit("cred_envelope.path_consolidation.failed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    return;
+  }
+  if (outcome.status === "converged") {
+    _pathConflict = null;
+    _convergedFrom = {
+      canonicalPath: import_node_path.default.join(outcome.canonicalDir, ACCOUNT_CRED_DEK_WRAPPED),
+      legacyPath: import_node_path.default.join(outcome.legacyDir ?? "", ACCOUNT_CRED_DEK_WRAPPED)
     };
-    // The paths go in the MESSAGE, not only the metadata: a log pipeline that
-    // drops structured fields would otherwise render this as an unactionable
-    // noun. Naming the remedy matters too, and it has to be one that converges
-    // (OSK-12172). Only the CLI's logout deletes a key, and only the canonical
-    // one; a daemon logout deletes neither. So the CLI logs out, the daemon
-    // BINARY restarts and adopts its legacy key into the empty canonical slot,
-    // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
-    // command mints a fresh key into an empty slot before doing anything else.
-    //
-    // Reached only when the daemon itself was refused over its device key
-    // (`splitKeyConvergencePolicy`); an ordinary split converges above.
-    (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs, and ` +
-        "the server refused the daemon's key, so neither is known to be the pinned one; " +
-        `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
-        `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
-        "credentials, and neither can read the other's. Do not delete " +
-        `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
-        'run `skrr logout && skrrd restart && skrr login`.');
+    (0, import_runtime.getAuthLogger)().info(`[credEnvelope] profile "${profile}" had two different usable wrapped DEKs; converged on the daemon's (${_convergedFrom.legacyPath}), which is the key the server pins for this machine. The CLI's former key is kept beside it as ${ACCOUNT_CRED_DEK_WRAPPED}${import_profileStateDir.RETIRED_COPY_SUFFIX}.* and still opens what was sealed under it; each value is re-sealed under the shared key on its next write.`);
+    return;
+  }
+  if (outcome.status !== "conflict") {
+    _pathConflict = null;
+    return;
+  }
+  _pathConflict = {
+    canonicalPath: import_node_path.default.join(outcome.canonicalDir, ACCOUNT_CRED_DEK_WRAPPED),
+    legacyPath: import_node_path.default.join(outcome.legacyDir ?? "", ACCOUNT_CRED_DEK_WRAPPED)
+  };
+  (0, import_runtime.getAuthLogger)().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs, and the server refused the daemon's key, so neither is known to be the pinned one; refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ${_pathConflict.canonicalPath} untouched. Each side can still read its own credentials, and neither can read the other's. Do not delete ${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, run \`skrr logout && skrrd restart && skrr login\`.`);
 }
-/**
- * Load every retired DEK beside the canonical one (OSK-12462). Only files a
- * converging consolidation set aside are read; the `.superseded.*` copy an
- * UNUSABLE key leaves is not a key anything can open. Read-only unwrap, never
- * fatal: a retired key that no longer opens is simply not in the ring.
- */
 async function loadRetiredDeks(profile, kek, aad, active) {
-    for (const old of _retiredDeks)
-        old.fill(0);
-    _retiredDeks = [];
-    for (const target of retiredDekFiles(profile)) {
-        try {
-            if (!kek.unwrapExisting)
-                return;
-            const dek = await kek.unwrapExisting(node_fs_1.default.readFileSync(target), aad);
-            if (dek.length === 32 && !dek.equals(active)) {
-                _retiredDeks.push(dek);
-            }
-            else {
-                dek.fill(0);
-            }
-        }
-        catch {
-            emit('cred_envelope.retired_dek.unreadable', false, {
-                profile,
-                file: node_path_1.default.basename(target),
-            });
-        }
+  for (const old of _retiredDeks)
+    old.fill(0);
+  _retiredDeks = [];
+  for (const target of retiredDekFiles(profile)) {
+    try {
+      if (!kek.unwrapExisting)
+        return;
+      const dek = await kek.unwrapExisting(import_node_fs.default.readFileSync(target), aad);
+      if (dek.length === 32 && !dek.equals(active)) {
+        _retiredDeks.push(dek);
+      } else {
+        dek.fill(0);
+      }
+    } catch {
+      emit("cred_envelope.retired_dek.unreadable", false, {
+        profile,
+        file: import_node_path.default.basename(target)
+      });
     }
+  }
 }
-/** Retired wrapped DEKs for `profile`, oldest first. */
 function retiredDekFiles(profile) {
-    const dir = (0, profileStateDir_js_1.profileStateDir)(profile);
-    const prefix = `${ACCOUNT_CRED_DEK_WRAPPED}${profileStateDir_js_1.RETIRED_COPY_SUFFIX}.`;
-    try {
-        return node_fs_1.default
-            .readdirSync(dir)
-            .filter((name) => name.startsWith(prefix))
-            .sort()
-            .map((name) => node_path_1.default.join(dir, name));
-    }
-    catch {
-        return [];
-    }
+  const dir = (0, import_profileStateDir.profileStateDir)(profile);
+  const prefix = `${ACCOUNT_CRED_DEK_WRAPPED}${import_profileStateDir.RETIRED_COPY_SUFFIX}.`;
+  try {
+    return import_node_fs.default.readdirSync(dir).filter((name) => name.startsWith(prefix)).sort().map((name) => import_node_path.default.join(dir, name));
+  } catch {
+    return [];
+  }
 }
-/**
- * Initialize the envelope path. Idempotent — second call when state is
- * non-uninit returns immediately.
- *
- * Order:
- *   1. Probe KEK; unavailable → disabled+kek_unavailable.
- *   2. Try to read+unwrap an existing DEK; success → active.
- *   3. Generate fresh DEK, wrap, persist atomically; → active.
- *   4. Any throw → disabled+init_failed; transforms stay passthrough.
- */
 async function initCredEnvelope(profile) {
-    if (_state.kind !== 'uninit')
-        return;
-    if (typeof profile !== 'string' || profile.length === 0) {
-        _state = { kind: 'disabled', reason: 'init_failed' };
-        emit('cred_envelope.init_failed', false, { reason: 'empty_profile' });
-        return;
-    }
-    let kek;
+  if (_state.kind !== "uninit")
+    return;
+  if (typeof profile !== "string" || profile.length === 0) {
+    _state = { kind: "disabled", reason: "init_failed" };
+    emit("cred_envelope.init_failed", false, { reason: "empty_profile" });
+    return;
+  }
+  let kek;
+  try {
+    kek = (0, import_kek.getKekStrategy)();
+  } catch (err) {
+    _state = { kind: "disabled", reason: "platform_unsupported" };
+    emit("cred_envelope.init_failed", false, {
+      reason: "kek_resolve_threw",
+      message: err?.message ?? "unknown"
+    });
+    return;
+  }
+  let kekAvailable = false;
+  try {
+    kekAvailable = await kek.available();
+  } catch {
+    kekAvailable = false;
+  }
+  if (!kekAvailable) {
+    _state = { kind: "disabled", reason: "kek_unavailable" };
+    emit("cred_envelope.kek_unavailable", false, {
+      kekId: kek.id,
+      profile,
+      describe: kek.describe()
+    });
+    return;
+  }
+  const aad = (0, import_credentialEnvelope.buildCredentialAad)(profile);
+  await consolidateWrappedDek(profile, kek, aad);
+  const targetPath = wrappedDekFilePath(profile);
+  const captureKind = () => typeof kek.kind === "string" || kek.kind === null ? kek.kind ?? null : null;
+  try {
+    if (!kek.unwrapExisting)
+      throw new Error("KEK has no read-only unwrap path");
+    const wrappedBytes = import_node_fs.default.readFileSync(targetPath);
+    const candidate = await kek.unwrapExisting(wrappedBytes, aad);
+    if (candidate.length === 32) {
+      await loadRetiredDeks(profile, kek, aad, candidate);
+      _state = {
+        kind: "active",
+        dek: candidate,
+        kekId: kek.id,
+        kekKind: captureKind(),
+        profile
+      };
+      emit("cred_envelope.active", true, {
+        kekId: kek.id,
+        kekKind: captureKind(),
+        profile,
+        existingDekFastPath: true
+      });
+      return;
+    }
+    candidate.fill(0);
+  } catch {
+  }
+  let dek = null;
+  let unwrapAttemptedAndFailed = false;
+  await withCredEnvelopeLock(profile, async () => {
+    let wrappedBytes = null;
     try {
-        kek = (0, index_js_1.getKekStrategy)();
-    }
-    catch (err) {
-        _state = { kind: 'disabled', reason: 'platform_unsupported' };
-        emit('cred_envelope.init_failed', false, {
-            reason: 'kek_resolve_threw',
-            message: err?.message ?? 'unknown',
+      if (import_node_fs.default.existsSync(targetPath)) {
+        wrappedBytes = import_node_fs.default.readFileSync(targetPath);
+      }
+    } catch (err) {
+      emit("cred_envelope.init_failed", false, {
+        reason: "wrapped_dek_read_threw",
+        message: err?.message ?? "unknown"
+      });
+      wrappedBytes = null;
+    }
+    if (wrappedBytes !== null) {
+      try {
+        const candidate = await kek.unwrap(wrappedBytes, aad);
+        if (candidate.length !== 32) {
+          emit("cred_envelope.init_failed", false, {
+            reason: "unwrapped_dek_wrong_length",
+            length: candidate.length,
+            kekKind: captureKind()
+          });
+          unwrapAttemptedAndFailed = true;
+        } else {
+          dek = candidate;
+        }
+      } catch (err) {
+        emit("cred_envelope.unwrap.failed", false, {
+          reason: "wrapped_dek_unwrap_threw",
+          kekId: kek.id,
+          kekKind: captureKind(),
+          message: err?.message ?? "unknown"
         });
-        return;
-    }
-    let kekAvailable = false;
-    try {
-        kekAvailable = await kek.available();
-    }
-    catch {
-        kekAvailable = false;
-    }
-    if (!kekAvailable) {
-        _state = { kind: 'disabled', reason: 'kek_unavailable' };
-        emit('cred_envelope.kek_unavailable', false, {
-            kekId: kek.id,
-            profile,
-            describe: kek.describe(),
+        unwrapAttemptedAndFailed = true;
+      }
+    }
+    if (unwrapAttemptedAndFailed && dek === null) {
+      _kekRotationDetected = true;
+      emit("cred_envelope.kek_rotated", false, {
+        kekId: kek.id,
+        kekKind: captureKind(),
+        profile,
+        message: "wrapped DEK present but unwrap failed under available KEK; treating as rotation and re-enrolling"
+      });
+    }
+    if (dek === null) {
+      try {
+        dek = (0, import_credentialEnvelope.generateDek)();
+        const wrapped = await kek.wrap(dek, aad);
+        atomicWrite0600(targetPath, wrapped);
+        emit("cred_envelope.dek_enrolled", true, {
+          kekId: kek.id,
+          kekKind: captureKind(),
+          profile,
+          ...unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}
         });
-        return;
-    }
-    const aad = (0, credentialEnvelope_js_1.buildCredentialAad)(profile);
-    // OSK-10314 — converge this profile's two possible locations BEFORE any path
-    // is resolved, so the rest of init sees one answer. A no-op costing one string
-    // comparison on a machine that only ever had one location (every CLI process,
-    // and every daemon installed after this change).
-    await consolidateWrappedDek(profile, kek, aad);
-    const targetPath = wrappedDekFilePath(profile);
-    // Capture the kek's tier-aware kind once at init so transform-side events
-    // can include it without holding a live `kek` reference. macOS sets `kind`
-    // only after the first wrap/unwrap; null here is honest.
-    const captureKind = () => typeof kek.kind === 'string' || kek.kind === null ? (kek.kind ?? null) : null;
-    // Existing wrapped DEKs are immutable between enrollments and are published
-    // with atomic rename. Reading and unwrapping one therefore does not need the
-    // first-enrollment mutex. Keeping this hot path outside the lock matters for
-    // short-lived CLI processes: a burst of read-only `sky` commands used to
-    // serialize here, and contenders could outlive the CLI's bounded auth
-    // prefetch even though there was no write for them to coordinate.
-    //
-    // Any miss or unwrap failure falls through to the locked path below. That
-    // path re-reads the file after acquiring the mutex before it decides whether
-    // to enroll or rotate, so a concurrent writer can never make this optimistic
-    // read create a second DEK or produce a false rotation signal.
-    try {
-        if (!kek.unwrapExisting)
-            throw new Error('KEK has no read-only unwrap path');
-        const wrappedBytes = node_fs_1.default.readFileSync(targetPath);
-        const candidate = await kek.unwrapExisting(wrappedBytes, aad);
-        if (candidate.length === 32) {
-            await loadRetiredDeks(profile, kek, aad, candidate);
-            _state = {
-                kind: 'active',
-                dek: candidate,
-                kekId: kek.id,
-                kekKind: captureKind(),
-                profile,
-            };
-            emit('cred_envelope.active', true, {
-                kekId: kek.id,
-                kekKind: captureKind(),
-                profile,
-                existingDekFastPath: true,
-            });
-            return;
-        }
-        candidate.fill(0);
-    }
-    catch {
-        // The locked path owns diagnostics and recovery. In particular, it
-        // distinguishes a stable unwrap failure (probable KEK rotation) from a
-        // file that another process replaced between this read and lock acquire.
-    }
-    let dek = null;
-    let unwrapAttemptedAndFailed = false;
-    await withCredEnvelopeLock(profile, async () => {
-        // Re-stat after acquiring the lock — a sibling sky/oversky may have
-        // enrolled while we were waiting. Without this, both processes would
-        // proceed to "first-run enrollment" and the second writer's DEK
-        // would silently win, orphaning the first writer's DEK and every
-        // credential it has already wrapped.
-        let wrappedBytes = null;
-        try {
-            if (node_fs_1.default.existsSync(targetPath)) {
-                wrappedBytes = node_fs_1.default.readFileSync(targetPath);
-            }
-        }
-        catch (err) {
-            emit('cred_envelope.init_failed', false, {
-                reason: 'wrapped_dek_read_threw',
-                message: err?.message ?? 'unknown',
-            });
-            wrappedBytes = null;
-        }
-        if (wrappedBytes !== null) {
-            try {
-                const candidate = await kek.unwrap(wrappedBytes, aad);
-                if (candidate.length !== 32) {
-                    emit('cred_envelope.init_failed', false, {
-                        reason: 'unwrapped_dek_wrong_length',
-                        length: candidate.length,
-                        kekKind: captureKind(),
-                    });
-                    unwrapAttemptedAndFailed = true;
-                }
-                else {
-                    dek = candidate;
-                }
-            }
-            catch (err) {
-                emit('cred_envelope.unwrap.failed', false, {
-                    reason: 'wrapped_dek_unwrap_threw',
-                    kekId: kek.id,
-                    kekKind: captureKind(),
-                    message: err?.message ?? 'unknown',
-                });
-                unwrapAttemptedAndFailed = true;
-            }
-        }
-        // KEK rotation detection (gap G4). If the wrapped file was present,
-        // KEK reported `available=true`, but unwrap threw — the most likely
-        // explanation is the KEK was rotated underneath us. Surface this as
-        // a distinct event so dashboards can count rotations separately
-        // from genuinely-corrupt blobs, while still falling through to a
-        // fresh enrollment so the daemon stays operational.
-        if (unwrapAttemptedAndFailed && dek === null) {
-            _kekRotationDetected = true;
-            emit('cred_envelope.kek_rotated', false, {
-                kekId: kek.id,
-                kekKind: captureKind(),
-                profile,
-                message: 'wrapped DEK present but unwrap failed under available KEK; treating as rotation and re-enrolling',
-            });
-        }
-        // First-run enrollment if no DEK yet.
-        if (dek === null) {
-            try {
-                dek = (0, credentialEnvelope_js_1.generateDek)();
-                const wrapped = await kek.wrap(dek, aad);
-                atomicWrite0600(targetPath, wrapped);
-                emit('cred_envelope.dek_enrolled', true, {
-                    kekId: kek.id,
-                    kekKind: captureKind(),
-                    profile,
-                    ...(unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}),
-                });
-            }
-            catch (err) {
-                _state = { kind: 'disabled', reason: 'init_failed' };
-                emit('cred_envelope.init_failed', false, {
-                    reason: 'enrollment_failed',
-                    kekId: kek.id,
-                    kekKind: captureKind(),
-                    message: err?.message ?? 'unknown',
-                });
-                return;
-            }
-        }
-        await loadRetiredDeks(profile, kek, aad, dek);
-        _state = {
-            kind: 'active',
-            dek: dek,
-            kekId: kek.id,
-            kekKind: captureKind(),
-            profile,
-        };
-        emit('cred_envelope.active', true, {
-            kekId: kek.id,
-            kekKind: captureKind(),
-            profile,
-            ...(unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}),
+      } catch (err) {
+        _state = { kind: "disabled", reason: "init_failed" };
+        emit("cred_envelope.init_failed", false, {
+          reason: "enrollment_failed",
+          kekId: kek.id,
+          kekKind: captureKind(),
+          message: err?.message ?? "unknown"
         });
+        return;
+      }
+    }
+    await loadRetiredDeks(profile, kek, aad, dek);
+    _state = {
+      kind: "active",
+      dek,
+      kekId: kek.id,
+      kekKind: captureKind(),
+      profile
+    };
+    emit("cred_envelope.active", true, {
+      kekId: kek.id,
+      kekKind: captureKind(),
+      profile,
+      ...unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}
     });
+  });
 }
-/**
- * Reset state. With `clearOnDisk` deletes the wrapped DEK file too —
- * used by `oversky logout` / `sky logout`. Zeroes the in-memory DEK
- * before dropping state for forward secrecy on the active credential.
- *
- * It deletes EVERY location this profile's key can occupy, plus the
- * consolidation marker. `profileStateDir.ts` never deletes anything and says so;
- * this is the one caller that must, and the reason is not symmetry — a logout
- * that removed only the canonical copy would leave the pre-consolidation copy
- * behind, and the next init would adopt it straight back. That is a deleted
- * credential key resurrecting itself, which is a worse bug than the one this
- * whole change is fixing.
- */
 async function resetCredEnvelope(opts) {
-    if (opts?.clearOnDisk && opts.profile) {
-        // A logout ends every key this profile held, the retired ones included: a
-        // retired DEK exists only to open values the logout is deleting anyway.
-        for (const target of [
-            ...(0, profileStateDir_js_1.profileStateFilePathsToClear)(opts.profile, ACCOUNT_CRED_DEK_WRAPPED),
-            ...retiredDekFiles(opts.profile),
-        ]) {
-            try {
-                node_fs_1.default.unlinkSync(target);
-            }
-            catch (err) {
-                if (err.code !== 'ENOENT') {
-                    emit('cred_envelope.clear_failed', false, {
-                        profile: opts.profile,
-                        path: target,
-                        message: err?.message ?? 'unknown',
-                    });
-                }
-            }
+  if (opts?.clearOnDisk && opts.profile) {
+    for (const target of [
+      ...(0, import_profileStateDir.profileStateFilePathsToClear)(opts.profile, ACCOUNT_CRED_DEK_WRAPPED),
+      ...retiredDekFiles(opts.profile)
+    ]) {
+      try {
+        import_node_fs.default.unlinkSync(target);
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          emit("cred_envelope.clear_failed", false, {
+            profile: opts.profile,
+            path: target,
+            message: err?.message ?? "unknown"
+          });
         }
-    }
-    if (_state.kind === 'active') {
-        _state.dek.fill(0);
-    }
-    _state = { kind: 'uninit' };
-    _kekRotationDetected = false;
-    _pathConflict = null;
-    _convergedFrom = null;
-    for (const old of _retiredDeks)
-        old.fill(0);
-    _retiredDeks = [];
+      }
+    }
+  }
+  if (_state.kind === "active") {
+    _state.dek.fill(0);
+  }
+  _state = { kind: "uninit" };
+  _kekRotationDetected = false;
+  _pathConflict = null;
+  _convergedFrom = null;
+  for (const old of _retiredDeks)
+    old.fill(0);
+  _retiredDeks = [];
 }
-/**
- * Idempotent shutdown — must be called from the daemon's graceful-exit
- * handler (SIGTERM / SIGINT). Zeroes the in-memory DEK and drops the
- * platform KEK caches so neither lingers in process memory after the
- * exit path begins. The KEK-cache zeroize hooks come from the platform
- * registry exposed by `@skrr-ai/auth-core` (`zeroizeKekCaches()`); each
- * platform module registers its hook at module-load time.
- *
- * Synchronous so the caller's exit path can run it without managing a
- * promise chain. Distinct from `resetCredEnvelope` because:
- *   - shutdown does NOT delete on-disk state (the next process restart
- *     should still find the wrapped DEK).
- *   - shutdown ALSO zeroes platform KEK caches (resetCredEnvelope leaves
- *     them resident so the next reactivation can reuse them).
- */
 let _shutdownDone = false;
 function shutdownCredEnvelope() {
-    if (_shutdownDone)
-        return;
-    _shutdownDone = true;
-    try {
-        if (_state.kind === 'active') {
-            _state.dek.fill(0);
-        }
-    }
-    catch {
-        /* swallow — shutdown is best-effort */
-    }
-    try {
-        (0, index_js_1.zeroizeKekCaches)();
-    }
-    catch {
-        /* swallow — shutdown is best-effort */
-    }
-    _state = { kind: 'uninit' };
-    _kekRotationDetected = false;
-    _pathConflict = null;
-    _convergedFrom = null;
-    for (const old of _retiredDeks)
-        old.fill(0);
-    _retiredDeks = [];
+  if (_shutdownDone)
+    return;
+  _shutdownDone = true;
+  try {
+    if (_state.kind === "active") {
+      _state.dek.fill(0);
+    }
+  } catch {
+  }
+  try {
+    (0, import_kek.zeroizeKekCaches)();
+  } catch {
+  }
+  _state = { kind: "uninit" };
+  _kekRotationDetected = false;
+  _pathConflict = null;
+  _convergedFrom = null;
+  for (const old of _retiredDeks)
+    old.fill(0);
+  _retiredDeks = [];
 }
-/** @internal Test seam — re-arm `shutdownCredEnvelope` so it can run again. */
 function __resetShutdownGuardForTest() {
-    _shutdownDone = false;
+  _shutdownDone = false;
 }
-/**
- * True iff the envelope path is initialized AND active. Hot-path
- * predicate used by sync transforms; never throws.
- */
 function isCredEnvelopeActive() {
-    return _state.kind === 'active';
+  return _state.kind === "active";
 }
-/**
- * True while this profile holds two usable and different wrapped DEKs.
- *
- * Read by `deviceIdentityBridge` before it migrates anything of its own. The
- * device private key is sealed with whichever DEK is active, so moving it to the
- * canonical directory while the two binaries are still on DIFFERENT DEKs hands
- * the other one a key it cannot open — it regenerates, overwrites, and the two
- * processes then destroy each other's device identity on every start. Unresolved
- * conflicts freeze the whole profile's layout, not just the DEK's.
- */
 function hasCredEnvelopePathConflict() {
-    return _pathConflict !== null;
+  return _pathConflict !== null;
 }
-/**
- * Operator-readable summary of envelope state. Used by `oversky status`
- * and CLI debug commands. Never includes the DEK or any key material.
- *
- * `kekRotated` is true when the most recent init pass detected a wrapped
- * DEK that could not be unwrapped under the currently-available KEK and
- * had to fall back to a fresh enrollment. Operators see this in
- * `oversky status`; clears on the next clean `resetCredEnvelope`.
- */
 function describeCredEnvelopeState() {
-    const extras = {
-        ...(_convergedFrom ? { convergedFrom: _convergedFrom } : {}),
-        ...(_retiredDeks.length > 0 ? { retiredKeys: _retiredDeks.length } : {}),
+  const extras = {
+    ..._convergedFrom ? { convergedFrom: _convergedFrom } : {},
+    ..._retiredDeks.length > 0 ? { retiredKeys: _retiredDeks.length } : {}
+  };
+  if (_state.kind === "disabled") {
+    return {
+      kind: "disabled",
+      reason: _state.reason,
+      ..._kekRotationDetected ? { kekRotated: true } : {},
+      ..._pathConflict ? { pathConflict: _pathConflict } : {}
     };
-    if (_state.kind === 'disabled') {
-        return {
-            kind: 'disabled',
-            reason: _state.reason,
-            ...(_kekRotationDetected ? { kekRotated: true } : {}),
-            ...(_pathConflict ? { pathConflict: _pathConflict } : {}),
-        };
-    }
-    if (_state.kind === 'active') {
-        return {
-            kind: 'active',
-            kekId: _state.kekId,
-            kekKind: _state.kekKind,
-            profile: _state.profile,
-            ...(_kekRotationDetected ? { kekRotated: true } : {}),
-            ...(_pathConflict ? { pathConflict: _pathConflict } : {}),
-            ...extras,
-        };
-    }
-    return { kind: 'uninit', ...(_pathConflict ? { pathConflict: _pathConflict } : {}) };
+  }
+  if (_state.kind === "active") {
+    return {
+      kind: "active",
+      kekId: _state.kekId,
+      kekKind: _state.kekKind,
+      profile: _state.profile,
+      ..._kekRotationDetected ? { kekRotated: true } : {},
+      ..._pathConflict ? { pathConflict: _pathConflict } : {},
+      ...extras
+    };
+  }
+  return { kind: "uninit", ..._pathConflict ? { pathConflict: _pathConflict } : {} };
 }
-/**
- * Sync write transform. Returns the wrapped serialized form when active.
- *
- * Behavior when not active:
- *   - If `credEnvelopeFailClosed` was set via `configureAuthCore()` (or
- *     `OVERSKY_KEK_REQUIRED=1` is set as a back-compat trigger), emits
- *     `cred_envelope.wrap.refused` and throws — the caller must not
- *     write plaintext.
- *   - Otherwise, returns the plaintext (legacy fail-open behavior used
- *     by CLI today during dark-ship rollout).
- *
- * Empty-string input is universally passthrough — there is no secret
- * to protect.
- */
 function maybeEncryptForWrite(plaintext) {
-    if (typeof plaintext !== 'string' || plaintext.length === 0)
-        return plaintext;
-    if (_state.kind !== 'active') {
-        const stateKind = _state.kind;
-        const reason = _state.kind === 'disabled' ? _state.reason : undefined;
-        if ((0, runtime_js_1.getCredEnvelopeFailClosed)()) {
-            emit('cred_envelope.wrap.refused', false, {
-                stateKind,
-                ...(reason !== undefined ? { reason } : {}),
-            });
-            throw new Error(`cred_envelope: envelope path is ${stateKind}` +
-                (reason ? ` (${reason})` : '') +
-                '; refusing to write credential as plaintext');
-        }
-        return plaintext;
-    }
-    try {
-        const aad = (0, credentialEnvelope_js_1.buildCredentialAad)(_state.profile);
-        const sealed = (0, credentialEnvelope_js_1.encrypt)(plaintext, _state.dek, aad);
-        const out = (0, credentialEnvelope_js_1.serialize)(sealed);
-        emit('cred_envelope.wrap.success', true, {
-            kekId: _state.kekId,
-            kekKind: _state.kekKind,
-        });
-        return out;
-    }
-    catch (err) {
-        const message = err?.message ?? 'unknown';
-        emit('cred_envelope.wrap.failure', false, {
-            kekId: _state.kekId,
-            kekKind: _state.kekKind,
-            message,
-        });
-        if ((0, runtime_js_1.getCredEnvelopeFailClosed)()) {
-            emit('cred_envelope.wrap.refused', false, {
-                stateKind: 'active',
-                kekId: _state.kekId,
-                kekKind: _state.kekKind,
-                message,
-            });
-            throw err;
-        }
-        return plaintext;
-    }
+  if (typeof plaintext !== "string" || plaintext.length === 0)
+    return plaintext;
+  if (_state.kind !== "active") {
+    const stateKind = _state.kind;
+    const reason = _state.kind === "disabled" ? _state.reason : void 0;
+    if ((0, import_runtime.getCredEnvelopeFailClosed)()) {
+      emit("cred_envelope.wrap.refused", false, {
+        stateKind,
+        ...reason !== void 0 ? { reason } : {}
+      });
+      throw new Error(`cred_envelope: envelope path is ${stateKind}` + (reason ? ` (${reason})` : "") + "; refusing to write credential as plaintext");
+    }
+    return plaintext;
+  }
+  try {
+    const aad = (0, import_credentialEnvelope.buildCredentialAad)(_state.profile);
+    const sealed = (0, import_credentialEnvelope.encrypt)(plaintext, _state.dek, aad);
+    const out = (0, import_credentialEnvelope.serialize)(sealed);
+    emit("cred_envelope.wrap.success", true, {
+      kekId: _state.kekId,
+      kekKind: _state.kekKind
+    });
+    return out;
+  } catch (err) {
+    const message = err?.message ?? "unknown";
+    emit("cred_envelope.wrap.failure", false, {
+      kekId: _state.kekId,
+      kekKind: _state.kekKind,
+      message
+    });
+    if ((0, import_runtime.getCredEnvelopeFailClosed)()) {
+      emit("cred_envelope.wrap.refused", false, {
+        stateKind: "active",
+        kekId: _state.kekId,
+        kekKind: _state.kekKind,
+        message
+      });
+      throw err;
+    }
+    return plaintext;
+  }
 }
-/**
- * Always-fail-open variant of `maybeEncryptForWrite` for callers that
- * cannot afford to abort their write when the envelope path is inactive
- * (today: device-identity persistence, which writes the private key as
- * plaintext JSON before the L12 KEK ships per-platform). The wire form
- * is identical to `maybeEncryptForWrite` when active (envelope-prefixed)
- * and identical to the input when not.
- *
- * Distinct from `maybeEncryptForWrite` because that helper honors the
- * daemon's `credEnvelopeFailClosed: true` policy — designed for callers
- * that MUST refuse a plaintext write rather than silently degrade.
- */
 function wrapIfActiveOrPassthrough(plaintext) {
-    if (typeof plaintext !== 'string' || plaintext.length === 0)
-        return plaintext;
-    if (_state.kind !== 'active')
-        return plaintext;
-    try {
-        const aad = (0, credentialEnvelope_js_1.buildCredentialAad)(_state.profile);
-        const sealed = (0, credentialEnvelope_js_1.encrypt)(plaintext, _state.dek, aad);
-        const out = (0, credentialEnvelope_js_1.serialize)(sealed);
-        emit('cred_envelope.wrap.success', true, {
-            kekId: _state.kekId,
-            kekKind: _state.kekKind,
-        });
-        return out;
-    }
-    catch (err) {
-        emit('cred_envelope.wrap.failure', false, {
-            kekId: _state.kekId,
-            kekKind: _state.kekKind,
-            message: err?.message ?? 'unknown',
-        });
-        return plaintext;
-    }
+  if (typeof plaintext !== "string" || plaintext.length === 0)
+    return plaintext;
+  if (_state.kind !== "active")
+    return plaintext;
+  try {
+    const aad = (0, import_credentialEnvelope.buildCredentialAad)(_state.profile);
+    const sealed = (0, import_credentialEnvelope.encrypt)(plaintext, _state.dek, aad);
+    const out = (0, import_credentialEnvelope.serialize)(sealed);
+    emit("cred_envelope.wrap.success", true, {
+      kekId: _state.kekId,
+      kekKind: _state.kekKind
+    });
+    return out;
+  } catch (err) {
+    emit("cred_envelope.wrap.failure", false, {
+      kekId: _state.kekId,
+      kekKind: _state.kekKind,
+      message: err?.message ?? "unknown"
+    });
+    return plaintext;
+  }
 }
-/** The `decrypt_failed` hint when the caller has no better explanation. */
-exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = 'stored credential is unreadable on this machine — signing in again rebuilds it';
+const DEFAULT_UNREADABLE_CREDENTIAL_HINT = "stored credential is unreadable on this machine \u2014 signing in again rebuilds it";
 function maybeDecryptOnRead(stored, options = {}) {
-    if (typeof stored !== 'string' || stored.length === 0) {
-        return { plaintext: stored, needsMigration: false };
-    }
-    if ((0, credentialEnvelope_js_1.isEnvelopeString)(stored)) {
-        if (_state.kind !== 'active') {
-            emit('cred_envelope.read.envelope_but_inactive', false, {
-                stateKind: _state.kind,
-            });
-            return { plaintext: null, needsMigration: false };
-        }
-        const sealed = (0, credentialEnvelope_js_1.deserialize)(stored);
-        if (!sealed) {
-            emit('cred_envelope.read.malformed', false, {
-                kekId: _state.kekId,
-                kekKind: _state.kekKind,
-            });
-            return { plaintext: null, needsMigration: false };
-        }
-        const aad = (0, credentialEnvelope_js_1.buildCredentialAad)(_state.profile);
+  if (typeof stored !== "string" || stored.length === 0) {
+    return { plaintext: stored, needsMigration: false };
+  }
+  if ((0, import_credentialEnvelope.isEnvelopeString)(stored)) {
+    if (_state.kind !== "active") {
+      emit("cred_envelope.read.envelope_but_inactive", false, {
+        stateKind: _state.kind
+      });
+      return { plaintext: null, needsMigration: false };
+    }
+    const sealed = (0, import_credentialEnvelope.deserialize)(stored);
+    if (!sealed) {
+      emit("cred_envelope.read.malformed", false, {
+        kekId: _state.kekId,
+        kekKind: _state.kekKind
+      });
+      return { plaintext: null, needsMigration: false };
+    }
+    const aad = (0, import_credentialEnvelope.buildCredentialAad)(_state.profile);
+    try {
+      const pt = (0, import_credentialEnvelope.decrypt)(sealed, _state.dek, aad).toString("utf-8");
+      return { plaintext: pt, needsMigration: false };
+    } catch (err) {
+      for (const retired of _retiredDeks) {
         try {
-            const pt = (0, credentialEnvelope_js_1.decrypt)(sealed, _state.dek, aad).toString('utf-8');
-            return { plaintext: pt, needsMigration: false };
-        }
-        catch (err) {
-            // Sealed before a converging consolidation retired its key (OSK-12462).
-            // Readable, and flagged for the in-place upgrade every consumer already
-            // performs for legacy plaintext, which re-seals it under the active DEK.
-            for (const retired of _retiredDeks) {
-                try {
-                    const pt = (0, credentialEnvelope_js_1.decrypt)(sealed, retired, aad).toString('utf-8');
-                    emit('cred_envelope.read.retired_key', true, {
-                        kekId: _state.kekId,
-                        kekKind: _state.kekKind,
-                    });
-                    return { plaintext: pt, needsMigration: true };
-                }
-                catch {
-                    /* not this one */
-                }
-            }
-            emit('cred_envelope.read.decrypt_failed', false, {
-                kekId: _state.kekId,
-                kekKind: _state.kekKind,
-                message: err?.message ?? 'unknown',
-                // The crypto error alone reads as a crash; the actionable truth is
-                // that this stored credential is unreadable by THIS binary (usually
-                // a signing-identity or profile drift) and re-login rebuilds it.
-                hint: options.unreadableHint ?? exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT,
-            });
-            return { plaintext: null, needsMigration: false };
-        }
-    }
-    // Legacy plaintext path.
-    if (_state.kind === 'active') {
-        emit('cred_envelope.unwrap.fallback_to_legacy', true, {
+          const pt = (0, import_credentialEnvelope.decrypt)(sealed, retired, aad).toString("utf-8");
+          emit("cred_envelope.read.retired_key", true, {
             kekId: _state.kekId,
-            kekKind: _state.kekKind,
-        });
-        return { plaintext: stored, needsMigration: true };
-    }
-    return { plaintext: stored, needsMigration: false };
+            kekKind: _state.kekKind
+          });
+          return { plaintext: pt, needsMigration: true };
+        } catch {
+        }
+      }
+      emit("cred_envelope.read.decrypt_failed", false, {
+        kekId: _state.kekId,
+        kekKind: _state.kekKind,
+        message: err?.message ?? "unknown",
+        // The crypto error alone reads as a crash; the actionable truth is
+        // that this stored credential is unreadable by THIS binary (usually
+        // a signing-identity or profile drift) and re-login rebuilds it.
+        hint: options.unreadableHint ?? DEFAULT_UNREADABLE_CREDENTIAL_HINT
+      });
+      return { plaintext: null, needsMigration: false };
+    }
+  }
+  if (_state.kind === "active") {
+    emit("cred_envelope.unwrap.fallback_to_legacy", true, {
+      kekId: _state.kekId,
+      kekKind: _state.kekKind
+    });
+    return { plaintext: stored, needsMigration: true };
+  }
+  return { plaintext: stored, needsMigration: false };
 }
-/** @internal Test seam — wrapped-DEK path resolver. */
 function __wrappedDekFilePathForTest(profile) {
-    return wrappedDekFilePath(profile);
+  return wrappedDekFilePath(profile);
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_UNREADABLE_CREDENTIAL_HINT,
+  __clearWarnDedupeForTest,
+  __getStateForTest,
+  __resetShutdownGuardForTest,
+  __setStateForTest,
+  __wrappedDekFilePathForTest,
+  describeCredEnvelopeState,
+  hasCredEnvelopePathConflict,
+  initCredEnvelope,
+  isCredEnvelopeActive,
+  maybeDecryptOnRead,
+  maybeEncryptForWrite,
+  resetCredEnvelope,
+  shutdownCredEnvelope,
+  splitKeyConvergencePolicy,
+  wrapIfActiveOrPassthrough
+});