@skrr-ai/cli 0.1.115 → 0.1.117

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/profileStateDir.js

@@ -1,379 +1,274 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RETIRED_COPY_SUFFIX = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = void 0;
-exports.profileStateDir = profileStateDir;
-exports.legacyProfileStateDir = legacyProfileStateDir;
-exports.resolveProfileStateDir = resolveProfileStateDir;
-exports.resolveProfileStateFile = resolveProfileStateFile;
-exports.profileStateFileLocations = profileStateFileLocations;
-exports.consolidateProfileState = consolidateProfileState;
-exports.profileStateFilePathsToClear = profileStateFilePathsToClear;
-/**
- * profileStateDir.ts — the ONE definition of where a profile's auth state lives
- * on disk, and the migration for a machine that ended up with two.
- *
- * A profile is this product's unit of credential isolation, and its state has
- * exactly one home:
- *
- *   <machine root>/profiles/<profile>/cred-dek-wrapped
- *   <machine root>/profiles/<profile>/cred-envelope.lock
- *   <machine root>/profiles/<profile>/device-private-key
- *   …
- *
- * It lives here, next to `configRoot.ts`, for the same reason that file exists:
- * both binaries need the same answer and neither owns it. `configRoot.ts` made
- * "where is the skrr root" one function; this makes "where is a profile's auth
- * state" one function, because the layer above it had the identical defect one
- * level down.
- *
- * WHAT WENT WRONG (OSK-10314). `credentialEnvelopeBridge` and
- * `deviceIdentityBridge` each wrote `path.join(getAuthConfigDir(), 'profiles',
- * profile)` — two independent spellings of one rule — and `configDir` means
- * different things to the two consumers:
- *
- *   - the CLI passes the MACHINE ROOT, so it landed on the layout above;
- *   - the daemon passes `getConfigDir()`, which is ALREADY `<root>/profiles/<p>`,
- *     so it landed on `<root>/profiles/<p>/profiles/<p>/…`.
- *
- * One profile therefore had two wrapped DEKs, two device keypairs and two
- * lockfiles, and the lockfile the shared module exists to share served neither
- * of the two processes it was meant to serialize. Nothing cross-read, so
- * nothing broke — it was a split-brain waiting for the first cross-read.
- *
- * The fix is to derive the directory from `getAuthMachineConfigDir()`, which
- * BOTH consumers already wire explicitly (daemon: `getMachineConfigDir()`; CLI:
- * the skrr root). Note what is deliberately NOT done: the daemon is not asked to
- * pass a different `configDir`. It has one knob and auth-core needs two answers
- * from it — `refresh.ts` reads `getAuthConfigDir()` raw for `auth.lock` and
- * `needs-reauth.json`, so repointing the daemon's `configDir` at the machine
- * root would quietly move its reauth latch from per-profile to machine-wide and
- * let one profile latch every profile. Profile-scoped and root-scoped artifacts
- * are only distinguishable INSIDE auth-core, so that is where the line is drawn.
- *
- * WHY A BARE PATH SWAP IS NOT THE FIX. A daemon with a nested wrapped DEK has
- * sealed real credentials under it. Pointing it at the canonical path hands it a
- * DIFFERENT DEK and every one of those credentials stops decrypting — a silent,
- * fleet-wide forced re-login, to repair a bug that had so far harmed nobody. So
- * the resolver PREFERS THE FILE A PROCESS IS ALREADY USING until a migration has
- * proved the canonical one is equivalent, and the migration COPIES.
- *
- * Resolution order for `<filename>` under `<profile>` (stateless — no ordering
- * requirement between this and any init):
- *
- *   1. legacy dir IS the canonical dir (the CLI)      → canonical
- *   2. no legacy copy of the file                      → canonical
- *   3. a `<filename>.superseded.json` marker beside it → canonical (consolidated)
- *   4. no canonical copy of the file                   → legacy (not yet consolidated)
- *   5. both copies, no marker                          → legacy (unresolved: stay put)
- *
- * The migration writes the marker and never deletes. Case 5 with a usable and
- * DIFFERENT key on each side is refused by default. A caller that knows which
- * key must win can pass `onConflict: 'adopt_legacy'`, which moves the canonical
- * copy aside as `<file>.retired.<stamp>` (kept, never deleted) and adopts the
- * legacy one. The credential envelope does that for the daemon's key, and keeps
- * the retired DEK readable so nothing sealed under it is lost (OSK-12462): the
- * refusal alone left the CLI signing with a key the server does not pin, which
- * gets its refresh refused as a device-key mismatch.
- *
- * ROLLBACK. The legacy file is left exactly where it was, under its own name.
- * Older code looks there, finds it, and works — no operator step. The marker is
- * a sidecar older code never reads.
- */
-const node_crypto_1 = require("node:crypto");
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const runtime_js_1 = require("./runtime.js");
-/** Directory segment that separates per-profile state from machine-scoped state. */
-exports.PROFILES_SEGMENT = 'profiles';
-/**
- * Sidecar written beside a legacy file once it has been consolidated. Its
- * PRESENCE is what flips resolution to the canonical copy; its contents are for
- * a human reading the directory afterwards.
- */
-exports.SUPERSEDED_MARKER_SUFFIX = '.superseded.json';
-/**
- * Suffix for a canonical file moved aside to make room. Only used when the
- * canonical copy existed and was NOT usable — a usable one is never replaced.
- */
-exports.SUPERSEDED_COPY_SUFFIX = '.superseded';
-/**
- * Suffix for a USABLE canonical file set aside by a converging consolidation
- * (`onConflict: 'adopt_legacy'`). Distinct from `SUPERSEDED_COPY_SUFFIX`, which
- * names an unusable copy: a retired key still opens what was sealed under it,
- * and the credential envelope reads these as its keyring (OSK-12462).
- */
-exports.RETIRED_COPY_SUFFIX = '.retired';
-/** The canonical directory for a profile's auth state. */
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var profileStateDir_exports = {};
+__export(profileStateDir_exports, {
+  PROFILES_SEGMENT: () => PROFILES_SEGMENT,
+  RETIRED_COPY_SUFFIX: () => RETIRED_COPY_SUFFIX,
+  SUPERSEDED_COPY_SUFFIX: () => SUPERSEDED_COPY_SUFFIX,
+  SUPERSEDED_MARKER_SUFFIX: () => SUPERSEDED_MARKER_SUFFIX,
+  consolidateProfileState: () => consolidateProfileState,
+  legacyProfileStateDir: () => legacyProfileStateDir,
+  profileStateDir: () => profileStateDir,
+  profileStateFileLocations: () => profileStateFileLocations,
+  profileStateFilePathsToClear: () => profileStateFilePathsToClear,
+  resolveProfileStateDir: () => resolveProfileStateDir,
+  resolveProfileStateFile: () => resolveProfileStateFile
+});
+module.exports = __toCommonJS(profileStateDir_exports);
+var import_node_crypto = require("node:crypto");
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_runtime = require("./runtime.js");
+const PROFILES_SEGMENT = "profiles";
+const SUPERSEDED_MARKER_SUFFIX = ".superseded.json";
+const SUPERSEDED_COPY_SUFFIX = ".superseded";
+const RETIRED_COPY_SUFFIX = ".retired";
 function profileStateDir(profile) {
-    assertProfile(profile);
-    return node_path_1.default.join((0, runtime_js_1.getAuthMachineConfigDir)(), exports.PROFILES_SEGMENT, profile);
+  assertProfile(profile);
+  return import_node_path.default.join((0, import_runtime.getAuthMachineConfigDir)(), PROFILES_SEGMENT, profile);
 }
-/**
- * Where a consumer whose `configDir` is already profile-scoped used to write.
- *
- * `null` when it resolves to the canonical directory — i.e. the consumer passes
- * the machine root and never had a second location. Callers branch on `null`
- * rather than comparing strings so the "one root" case costs one check.
- */
 function legacyProfileStateDir(profile) {
-    assertProfile(profile);
-    const legacy = node_path_1.default.join((0, runtime_js_1.getAuthConfigDir)(), exports.PROFILES_SEGMENT, profile);
-    const canonical = profileStateDir(profile);
-    return node_path_1.default.resolve(legacy) === node_path_1.default.resolve(canonical) ? null : legacy;
+  assertProfile(profile);
+  const legacy = import_node_path.default.join((0, import_runtime.getAuthConfigDir)(), PROFILES_SEGMENT, profile);
+  const canonical = profileStateDir(profile);
+  return import_node_path.default.resolve(legacy) === import_node_path.default.resolve(canonical) ? null : legacy;
 }
-/**
- * Resolve the directory holding `primaryFilename` for `profile`.
- *
- * `primaryFilename` is the file whose presence decides where a group of related
- * files lives. Device identity has four files that must be read from ONE
- * directory — a public JWK from one copy and a private key from the other is a
- * keypair mismatch — so the group anchors on the private key rather than each
- * file answering for itself.
- */
 function resolveProfileStateDir(profile, primaryFilename) {
-    const canonicalDir = profileStateDir(profile);
-    const legacyDir = legacyProfileStateDir(profile);
-    if (legacyDir === null) {
-        return { dir: canonicalDir, canonicalDir, legacyDir: null, usingLegacy: false };
-    }
-    const legacyFile = node_path_1.default.join(legacyDir, primaryFilename);
-    const stayOnLegacy = existsFile(legacyFile) && !existsFile(`${legacyFile}${exports.SUPERSEDED_MARKER_SUFFIX}`);
-    return {
-        dir: stayOnLegacy ? legacyDir : canonicalDir,
-        canonicalDir,
-        legacyDir,
-        usingLegacy: stayOnLegacy,
-    };
+  const canonicalDir = profileStateDir(profile);
+  const legacyDir = legacyProfileStateDir(profile);
+  if (legacyDir === null) {
+    return { dir: canonicalDir, canonicalDir, legacyDir: null, usingLegacy: false };
+  }
+  const legacyFile = import_node_path.default.join(legacyDir, primaryFilename);
+  const stayOnLegacy = existsFile(legacyFile) && !existsFile(`${legacyFile}${SUPERSEDED_MARKER_SUFFIX}`);
+  return {
+    dir: stayOnLegacy ? legacyDir : canonicalDir,
+    canonicalDir,
+    legacyDir,
+    usingLegacy: stayOnLegacy
+  };
 }
-/** `resolveProfileStateDir` for a single self-anchoring file. */
 function resolveProfileStateFile(profile, filename) {
-    const resolved = resolveProfileStateDir(profile, filename);
-    return {
-        ...resolved,
-        path: node_path_1.default.join(resolved.dir, filename),
-        canonicalPath: node_path_1.default.join(resolved.canonicalDir, filename),
-        legacyPath: resolved.legacyDir === null ? null : node_path_1.default.join(resolved.legacyDir, filename),
-    };
+  const resolved = resolveProfileStateDir(profile, filename);
+  return {
+    ...resolved,
+    path: import_node_path.default.join(resolved.dir, filename),
+    canonicalPath: import_node_path.default.join(resolved.canonicalDir, filename),
+    legacyPath: resolved.legacyDir === null ? null : import_node_path.default.join(resolved.legacyDir, filename)
+  };
 }
-/** Every location `filename` may occupy for `profile`, canonical first. */
 function profileStateFileLocations(profile, filename) {
-    const canonicalDir = profileStateDir(profile);
-    const legacyDir = legacyProfileStateDir(profile);
-    const out = [node_path_1.default.join(canonicalDir, filename)];
-    if (legacyDir !== null)
-        out.push(node_path_1.default.join(legacyDir, filename));
-    return out;
+  const canonicalDir = profileStateDir(profile);
+  const legacyDir = legacyProfileStateDir(profile);
+  const out = [import_node_path.default.join(canonicalDir, filename)];
+  if (legacyDir !== null)
+    out.push(import_node_path.default.join(legacyDir, filename));
+  return out;
 }
-/**
- * Consolidate a profile's state onto the canonical path. Idempotent, additive,
- * and refuses rather than guesses.
- *
- * The one case it will not decide is two usable, different keys for one profile:
- * each side has sealed content under its own, that content lives in the OS
- * keychain, and nothing here can re-seal it. Picking a winner there would
- * destroy the loser's credentials silently, which is the exact failure this
- * whole module exists to avoid.
- */
 async function consolidateProfileState(profile, spec) {
-    assertProfile(profile);
-    const dryRun = spec.dryRun === true;
-    const canonicalDir = profileStateDir(profile);
-    const legacyDir = legacyProfileStateDir(profile);
-    const base = { profile, canonicalDir, legacyDir, written: [], supersededAside: [], dryRun };
-    if (legacyDir === null)
-        return { ...base, status: 'not_applicable' };
-    const legacyPrimary = node_path_1.default.join(legacyDir, spec.primary);
-    if (!existsFile(legacyPrimary))
-        return { ...base, status: 'nothing_to_migrate' };
-    const markerPath = `${legacyPrimary}${exports.SUPERSEDED_MARKER_SUFFIX}`;
-    if (existsFile(markerPath))
-        return { ...base, status: 'already_consolidated' };
-    const canonicalPrimary = node_path_1.default.join(canonicalDir, spec.primary);
-    if (!existsFile(canonicalPrimary)) {
-        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
-        if (!dryRun)
-            writeMarker(markerPath, canonicalPrimary, 'adopted');
-        emitOutcome(spec, 'adopted', { profile, from: legacyDir, to: canonicalDir });
-        return { ...base, status: 'adopted', ...moved };
-    }
-    const identify = spec.identify ?? ((dir) => sha256OfFile(node_path_1.default.join(dir, spec.primary)));
-    const legacyIdentity = await identify(legacyDir);
-    const canonicalIdentity = await identify(canonicalDir);
-    const identities = { canonical: canonicalIdentity, legacy: legacyIdentity };
-    // Same state in both places, or the legacy copy is unreadable while the
-    // canonical one is fine. Either way the canonical copy is authoritative and
-    // the legacy one has nothing to contribute — record that and move on.
-    const sameState = legacyIdentity !== null && canonicalIdentity !== null && legacyIdentity === canonicalIdentity;
-    const legacyHasNothingToOffer = legacyIdentity === null && canonicalIdentity !== null;
-    const bothUnreadableButIdentical = legacyIdentity === null &&
-        canonicalIdentity === null &&
-        sha256OfFile(legacyPrimary) !== null &&
-        sha256OfFile(legacyPrimary) === sha256OfFile(canonicalPrimary);
-    if (sameState || legacyHasNothingToOffer || bothUnreadableButIdentical) {
-        if (!dryRun)
-            writeMarker(markerPath, canonicalPrimary, 'already_consolidated');
-        emitOutcome(spec, 'already_consolidated', { profile, identities });
-        return { ...base, status: 'already_consolidated', identities };
-    }
-    // The legacy copy is usable and the canonical one is not. Nothing is sealed
-    // under an unreadable key that was not already lost, so replacing it costs
-    // nothing — but keep it, because "unreadable here, today" is not "worthless".
-    if (legacyIdentity !== null && canonicalIdentity === null) {
-        const aside = dryRun
-            ? plannedAside(canonicalDir, spec.files)
-            : moveAside(canonicalDir, spec.files);
-        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
-        if (!dryRun)
-            writeMarker(markerPath, canonicalPrimary, 'superseded');
-        emitOutcome(spec, 'superseded', { profile, identities, supersededAside: aside });
-        return {
-            ...base,
-            status: 'superseded',
-            written: moved.written,
-            supersededAside: aside,
-            identities,
-        };
-    }
-    if (spec.onConflict === 'adopt_legacy') {
-        const aside = dryRun
-            ? plannedAside(canonicalDir, spec.files)
-            : moveAside(canonicalDir, spec.files, exports.RETIRED_COPY_SUFFIX);
-        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
-        if (!dryRun)
-            writeMarker(markerPath, canonicalPrimary, 'converged');
-        emitOutcome(spec, 'converged', {
-            profile,
-            identities,
-            from: legacyDir,
-            to: canonicalDir,
-            retired: aside,
-        });
-        return {
-            ...base,
-            status: 'converged',
-            written: moved.written,
-            supersededAside: aside,
-            identities,
-        };
-    }
-    emitOutcome(spec, 'conflict', { profile, identities, canonicalDir, legacyDir });
-    return { ...base, status: 'conflict', identities };
+  assertProfile(profile);
+  const dryRun = spec.dryRun === true;
+  const canonicalDir = profileStateDir(profile);
+  const legacyDir = legacyProfileStateDir(profile);
+  const base = { profile, canonicalDir, legacyDir, written: [], supersededAside: [], dryRun };
+  if (legacyDir === null)
+    return { ...base, status: "not_applicable" };
+  const legacyPrimary = import_node_path.default.join(legacyDir, spec.primary);
+  if (!existsFile(legacyPrimary))
+    return { ...base, status: "nothing_to_migrate" };
+  const markerPath = `${legacyPrimary}${SUPERSEDED_MARKER_SUFFIX}`;
+  if (existsFile(markerPath))
+    return { ...base, status: "already_consolidated" };
+  const canonicalPrimary = import_node_path.default.join(canonicalDir, spec.primary);
+  if (!existsFile(canonicalPrimary)) {
+    const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+    if (!dryRun)
+      writeMarker(markerPath, canonicalPrimary, "adopted");
+    emitOutcome(spec, "adopted", { profile, from: legacyDir, to: canonicalDir });
+    return { ...base, status: "adopted", ...moved };
+  }
+  const identify = spec.identify ?? ((dir) => sha256OfFile(import_node_path.default.join(dir, spec.primary)));
+  const legacyIdentity = await identify(legacyDir);
+  const canonicalIdentity = await identify(canonicalDir);
+  const identities = { canonical: canonicalIdentity, legacy: legacyIdentity };
+  const sameState = legacyIdentity !== null && canonicalIdentity !== null && legacyIdentity === canonicalIdentity;
+  const legacyHasNothingToOffer = legacyIdentity === null && canonicalIdentity !== null;
+  const bothUnreadableButIdentical = legacyIdentity === null && canonicalIdentity === null && sha256OfFile(legacyPrimary) !== null && sha256OfFile(legacyPrimary) === sha256OfFile(canonicalPrimary);
+  if (sameState || legacyHasNothingToOffer || bothUnreadableButIdentical) {
+    if (!dryRun)
+      writeMarker(markerPath, canonicalPrimary, "already_consolidated");
+    emitOutcome(spec, "already_consolidated", { profile, identities });
+    return { ...base, status: "already_consolidated", identities };
+  }
+  if (legacyIdentity !== null && canonicalIdentity === null) {
+    const aside = dryRun ? plannedAside(canonicalDir, spec.files) : moveAside(canonicalDir, spec.files);
+    const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+    if (!dryRun)
+      writeMarker(markerPath, canonicalPrimary, "superseded");
+    emitOutcome(spec, "superseded", { profile, identities, supersededAside: aside });
+    return {
+      ...base,
+      status: "superseded",
+      written: moved.written,
+      supersededAside: aside,
+      identities
+    };
+  }
+  if (spec.onConflict === "adopt_legacy") {
+    const aside = dryRun ? plannedAside(canonicalDir, spec.files) : moveAside(canonicalDir, spec.files, RETIRED_COPY_SUFFIX);
+    const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+    if (!dryRun)
+      writeMarker(markerPath, canonicalPrimary, "converged");
+    emitOutcome(spec, "converged", {
+      profile,
+      identities,
+      from: legacyDir,
+      to: canonicalDir,
+      retired: aside
+    });
+    return {
+      ...base,
+      status: "converged",
+      written: moved.written,
+      supersededAside: aside,
+      identities
+    };
+  }
+  emitOutcome(spec, "conflict", { profile, identities, canonicalDir, legacyDir });
+  return { ...base, status: "conflict", identities };
 }
-/**
- * Every path a profile's copy of `filename` can occupy, plus its marker —
- * what a genuine logout must remove. Deliberately separate from the migration:
- * this module never deletes, and logout is the one caller that must.
- */
 function profileStateFilePathsToClear(profile, filename) {
-    const out = [];
-    for (const location of profileStateFileLocations(profile, filename)) {
-        out.push(location);
-        out.push(`${location}${exports.SUPERSEDED_MARKER_SUFFIX}`);
-    }
-    return out;
+  const out = [];
+  for (const location of profileStateFileLocations(profile, filename)) {
+    out.push(location);
+    out.push(`${location}${SUPERSEDED_MARKER_SUFFIX}`);
+  }
+  return out;
 }
-// ---------------------------------------------------------------------------
-// internals
-// ---------------------------------------------------------------------------
 function assertProfile(profile) {
-    if (typeof profile !== 'string' || profile.length === 0) {
-        throw new Error('profileStateDir: profile must be a non-empty string');
-    }
+  if (typeof profile !== "string" || profile.length === 0) {
+    throw new Error("profileStateDir: profile must be a non-empty string");
+  }
 }
 function existsFile(target) {
-    try {
-        return node_fs_1.default.statSync(target).isFile();
-    }
-    catch {
-        return false;
-    }
+  try {
+    return import_node_fs.default.statSync(target).isFile();
+  } catch {
+    return false;
+  }
 }
 function sha256OfFile(target) {
-    try {
-        return (0, node_crypto_1.createHash)('sha256').update(node_fs_1.default.readFileSync(target)).digest('hex');
-    }
-    catch {
-        return null;
-    }
+  try {
+    return (0, import_node_crypto.createHash)("sha256").update(import_node_fs.default.readFileSync(target)).digest("hex");
+  } catch {
+    return null;
+  }
 }
-/**
- * tmp + fsync + rename + dir-fsync, 0600. The same shape the two bridges
- * already use, so a crash mid-migration leaves either the old file or the new
- * one and never a half-written key.
- */
 function atomicWrite0600(target, value) {
-    const dir = node_path_1.default.dirname(target);
-    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-    const fd = node_fs_1.default.openSync(tmp, 'w', 0o600);
+  const dir = import_node_path.default.dirname(target);
+  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+  const fd = import_node_fs.default.openSync(tmp, "w", 384);
+  try {
+    import_node_fs.default.writeSync(fd, value);
+    import_node_fs.default.fsyncSync(fd);
+  } finally {
+    import_node_fs.default.closeSync(fd);
+  }
+  import_node_fs.default.renameSync(tmp, target);
+  try {
+    const dirFd = import_node_fs.default.openSync(dir, "r");
     try {
-        node_fs_1.default.writeSync(fd, value);
-        node_fs_1.default.fsyncSync(fd);
-    }
-    finally {
-        node_fs_1.default.closeSync(fd);
-    }
-    node_fs_1.default.renameSync(tmp, target);
-    try {
-        const dirFd = node_fs_1.default.openSync(dir, 'r');
-        try {
-            node_fs_1.default.fsyncSync(dirFd);
-        }
-        finally {
-            node_fs_1.default.closeSync(dirFd);
-        }
-    }
-    catch {
-        /* best-effort — Windows / some BSDs reject dir fsync */
+      import_node_fs.default.fsyncSync(dirFd);
+    } finally {
+      import_node_fs.default.closeSync(dirFd);
     }
+  } catch {
+  }
 }
 function adopt(fromDir, toDir, files, dryRun) {
-    const written = [];
-    for (const name of files) {
-        const source = node_path_1.default.join(fromDir, name);
-        if (!existsFile(source))
-            continue;
-        const target = node_path_1.default.join(toDir, name);
-        if (!dryRun)
-            atomicWrite0600(target, node_fs_1.default.readFileSync(source));
-        written.push(target);
-    }
-    return { written, supersededAside: [] };
+  const written = [];
+  for (const name of files) {
+    const source = import_node_path.default.join(fromDir, name);
+    if (!existsFile(source))
+      continue;
+    const target = import_node_path.default.join(toDir, name);
+    if (!dryRun)
+      atomicWrite0600(target, import_node_fs.default.readFileSync(source));
+    written.push(target);
+  }
+  return { written, supersededAside: [] };
 }
-function moveAside(dir, files, suffix = exports.SUPERSEDED_COPY_SUFFIX) {
-    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-    const aside = [];
-    for (const name of files) {
-        const target = node_path_1.default.join(dir, name);
-        if (!existsFile(target))
-            continue;
-        node_fs_1.default.renameSync(target, `${target}${suffix}.${stamp}`);
-        aside.push(target);
-    }
-    return aside;
+function moveAside(dir, files, suffix = SUPERSEDED_COPY_SUFFIX) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const aside = [];
+  for (const name of files) {
+    const target = import_node_path.default.join(dir, name);
+    if (!existsFile(target))
+      continue;
+    import_node_fs.default.renameSync(target, `${target}${suffix}.${stamp}`);
+    aside.push(target);
+  }
+  return aside;
 }
 function plannedAside(dir, files) {
-    return files.map((name) => node_path_1.default.join(dir, name)).filter((target) => existsFile(target));
+  return files.map((name) => import_node_path.default.join(dir, name)).filter((target) => existsFile(target));
 }
 function writeMarker(markerPath, supersededBy, reason) {
-    const payload = {
-        supersededBy,
-        reason,
-        sha256: sha256OfFile(supersededBy),
-        at: new Date().toISOString(),
-        note: 'Kept deliberately. This file is the pre-consolidation copy (OSK-10314); ' +
-            'older binaries read it and it is the only rollback that needs no operator step. ' +
-            'Remove it only through logout.',
-    };
-    atomicWrite0600(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}\n`, 'utf-8'));
+  const payload = {
+    supersededBy,
+    reason,
+    sha256: sha256OfFile(supersededBy),
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    note: "Kept deliberately. This file is the pre-consolidation copy (OSK-10314); older binaries read it and it is the only rollback that needs no operator step. Remove it only through logout."
+  };
+  atomicWrite0600(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}
+`, "utf-8"));
 }
 function emitOutcome(spec, status, meta) {
-    spec.onEvent?.(`path_consolidation.${status}`, status !== 'conflict', {
-        ...meta,
-        primary: spec.primary,
-        ...(spec.dryRun === true ? { dryRun: true } : {}),
-    });
+  spec.onEvent?.(`path_consolidation.${status}`, status !== "conflict", {
+    ...meta,
+    primary: spec.primary,
+    ...spec.dryRun === true ? { dryRun: true } : {}
+  });
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PROFILES_SEGMENT,
+  RETIRED_COPY_SUFFIX,
+  SUPERSEDED_COPY_SUFFIX,
+  SUPERSEDED_MARKER_SUFFIX,
+  consolidateProfileState,
+  legacyProfileStateDir,
+  profileStateDir,
+  profileStateFileLocations,
+  profileStateFilePathsToClear,
+  resolveProfileStateDir,
+  resolveProfileStateFile
+});