@skrr-ai/cli 0.1.123 → 0.1.124

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -28,6 +28,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var deviceIdentityBridge_exports = {};
 __export(deviceIdentityBridge_exports, {
+  DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT: () => DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT,
+  PENDING_HARDWARE_KEY_MAX_AGE_MS: () => PENDING_HARDWARE_KEY_MAX_AGE_MS,
   __enrollmentBackoffPathForTest: () => __enrollmentBackoffPathForTest,
   __enrollmentMarkerPathForTest: () => __enrollmentMarkerPathForTest,
   __getStateForTest: () => __getStateForTest,
@@ -36,23 +38,35 @@ __export(deviceIdentityBridge_exports, {
   __setStateForTest: () => __setStateForTest,
   __setUnreadableReloadIntervalForTest: () => __setUnreadableReloadIntervalForTest,
   clearEnrollmentMarker: () => clearEnrollmentMarker,
+  commitDeviceKeyCandidate: () => commitDeviceKeyCandidate,
+  commitPendingHardwareKey: () => commitPendingHardwareKey,
   describeDeviceIdentityState: () => describeDeviceIdentityState,
   describeDeviceKeySplit: () => describeDeviceKeySplit,
+  describeStoredDeviceKey: () => describeStoredDeviceKey,
+  discardPendingHardwareKey: () => discardPendingHardwareKey,
   enrollWithServer: () => enrollWithServer,
   getDevicePublicKey: () => getDevicePublicKey,
   initDeviceIdentity: () => initDeviceIdentity,
   isDeviceIdentityActive: () => isDeviceIdentityActive,
+  persistPendingHardwareKey: () => persistPendingHardwareKey,
+  prepareHardwareKeyCandidate: () => prepareHardwareKeyCandidate,
   resetDeviceIdentity: () => resetDeviceIdentity,
-  signServerRequest: () => signServerRequest
+  signServerRequest: () => signServerRequest,
+  signWithCandidate: () => signWithCandidate
 });
 module.exports = __toCommonJS(deviceIdentityBridge_exports);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_deviceKey = require("./deviceKey.js");
+var import_deviceKeyHandle = require("./deviceKeyHandle.js");
+var import_deviceKeyHardware = require("./deviceKeyHardware.js");
 var import_credentialEnvelopeBridge = require("./credentialEnvelopeBridge.js");
 var import_profileStateDir = require("./profileStateDir.js");
+var import_liveState = require("./liveState.js");
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
+const DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT = "stored device key is unreadable on this machine \u2014 only an interactive daemon sign-in replaces it";
 const PUBLIC_KEY_FILENAME = "device-public-key.jwk";
 const PRIVATE_KEY_FILENAME = "device-private-key";
 const ENROLLMENT_MARKER_FILENAME = "device-enrollment.json";
@@ -82,7 +96,16 @@ function keyFilesStamp(profile) {
   };
   return `${part(publicKeyPath(profile))}|${part(privateKeyPath(profile))}`;
 }
+let _activeSeen = null;
+function trackActiveKeyFiles(profile) {
+  try {
+    _activeSeen = { profile, stamp: keyFilesStamp(profile), checkedAt: Date.now() };
+  } catch {
+    _activeSeen = null;
+  }
+}
 function reloadIfRecovered() {
+  reloadIfActiveKeyChanged();
   if (_state.kind !== "disabled" || _state.reason !== "unreadable_key")
     return;
   const seen = _unreadableSeen;
@@ -101,26 +124,70 @@ function reloadIfRecovered() {
   if (stamp === seen.stamp)
     return;
   seen.stamp = stamp;
-  let keypair = null;
+  let key = null;
   try {
-    keypair = loadKeypair(seen.profile);
+    key = loadStoredKey(seen.profile);
   } catch {
-    keypair = null;
+    key = null;
   }
-  if (!keypair)
+  if (!key)
     return;
   _state = {
     kind: "active",
-    keypair,
+    key,
     profile: seen.profile,
-    envelopeProtected: (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)()
+    envelopeProtected: key.custody === "software" && (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)()
   };
   _unreadableSeen = null;
-  emit("reloaded_after_recovery", true, { profile: seen.profile, thumbprint: keypair.thumbprint });
+  trackActiveKeyFiles(seen.profile);
+  emit("reloaded_after_recovery", true, {
+    profile: seen.profile,
+    thumbprint: key.thumbprint,
+    custody: key.custody
+  });
+}
+function reloadIfActiveKeyChanged() {
+  const state = _state;
+  const seen = _activeSeen;
+  if (state.kind !== "active" || !seen || seen.profile !== state.profile || _initializing)
+    return;
+  const now = Date.now();
+  if (now - seen.checkedAt < _unreadableReloadIntervalMs)
+    return;
+  seen.checkedAt = now;
+  let stamp;
+  try {
+    stamp = keyFilesStamp(seen.profile);
+  } catch {
+    return;
+  }
+  if (stamp === seen.stamp)
+    return;
+  seen.stamp = stamp;
+  let key = null;
+  try {
+    key = loadStoredKey(seen.profile);
+  } catch {
+    key = null;
+  }
+  if (!key || key.thumbprint === state.key.thumbprint)
+    return;
+  _state = {
+    kind: "active",
+    key,
+    profile: seen.profile,
+    envelopeProtected: key.custody === "software" && (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)()
+  };
+  emit("reloaded_after_key_change", true, {
+    profile: seen.profile,
+    from: state.key.thumbprint,
+    thumbprint: key.thumbprint,
+    custody: key.custody
+  });
 }
 async function withDeviceIdentityLock(profile, body) {
   const dir = (0, import_profileStateDir.profileStateDir)(profile);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  (0, import_stateFiles.ensureStateDir)(dir, `take the device identity lock for profile ${profile}`);
   const release = await import_proper_lockfile.default.lock(dir, {
     realpath: false,
     lockfilePath: import_node_path.default.join(dir, ".device-identity.lock"),
@@ -176,29 +243,6 @@ function enrollmentMarkerPath(profile) {
 function enrollmentBackoffPath(profile) {
   return import_node_path.default.join(profileConfigDir(profile), ENROLLMENT_BACKOFF_FILENAME);
 }
-function atomicWrite0600(target, value) {
-  const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  const buf = typeof value === "string" ? Buffer.from(value, "utf-8") : value;
-  const fd = import_node_fs.default.openSync(tmp, "w", 384);
-  try {
-    import_node_fs.default.writeSync(fd, buf);
-    import_node_fs.default.fsyncSync(fd);
-  } finally {
-    import_node_fs.default.closeSync(fd);
-  }
-  import_node_fs.default.renameSync(tmp, target);
-  try {
-    const dirFd = import_node_fs.default.openSync(dir, "r");
-    try {
-      import_node_fs.default.fsyncSync(dirFd);
-    } finally {
-      import_node_fs.default.closeSync(dirFd);
-    }
-  } catch {
-  }
-}
 function emit(eventName, success, metadata, opts = {}) {
   (0, import_runtime.emitAuthTelemetry)({
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -216,17 +260,31 @@ function emit(eventName, success, metadata, opts = {}) {
     }
   }
 }
-function persistKeypair(profile, kp) {
-  const publicPayload = JSON.stringify({
-    publicJwk: kp.publicJwk,
-    thumbprint: kp.thumbprint,
+function writePublicKeyRecord(profile, publicJwk) {
+  (0, import_stateFiles.atomicWrite0600)(publicKeyPath(profile), JSON.stringify({
+    publicJwk,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(publicJwk),
+    alg: publicJwk.kty === "EC" ? "ES256" : "EdDSA",
+    custody: publicJwk.kty === "EC" ? "hardware" : "software",
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  }), `write the device public key for profile ${profile}`);
+}
+function persistHardwareKey(profile, record) {
+  (0, import_stateFiles.atomicWrite0600)(privateKeyPath(profile), (0, import_deviceKeyHardware.serializeHardwareKeyRecord)(record), `write the hardware device key record for profile ${profile}`);
+  writePublicKeyRecord(profile, record.publicJwk);
+  emit("keypair_persisted", true, {
+    profile,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(record.publicJwk),
+    custody: "hardware",
+    envelopeProtected: false
   });
-  atomicWrite0600(publicKeyPath(profile), publicPayload);
+}
+function persistKeypair(profile, kp) {
+  writePublicKeyRecord(profile, kp.publicJwk);
   const privatePlaintext = JSON.stringify(kp.privateJwk);
   const wireForm = (0, import_credentialEnvelopeBridge.wrapIfActiveOrPassthrough)(privatePlaintext);
   const envelopeProtected = wireForm !== privatePlaintext;
-  atomicWrite0600(privateKeyPath(profile), wireForm);
+  (0, import_stateFiles.atomicWrite0600)(privateKeyPath(profile), wireForm, `write the device private key for profile ${profile}`);
   emit("keypair_persisted", true, {
     profile,
     thumbprint: kp.thumbprint,
@@ -267,7 +325,7 @@ function readIndependentIdentityFile(file, sealed) {
     import_node_fs.default.closeSync(fd);
   }
 }
-function loadKeypair(profile) {
+function loadStoredKey(profile) {
   const pubPath = publicKeyPath(profile);
   const privPath = privateKeyPath(profile);
   const independent = /^desktop-bg-[a-f0-9]{32}$/i.test(profile);
@@ -281,6 +339,8 @@ function loadKeypair(profile) {
   let storedThumbprint;
   try {
     const parsed = JSON.parse(pubRaw);
+    if (!(0, import_deviceKey.isDevicePublicJwk)(parsed.publicJwk))
+      throw new Error("public key is not a device key");
     publicJwk = parsed.publicJwk;
     storedThumbprint = parsed.thumbprint;
   } catch (err) {
@@ -290,7 +350,22 @@ function loadKeypair(profile) {
     });
     return null;
   }
-  const decryptResult = (0, import_credentialEnvelopeBridge.maybeDecryptOnRead)(privRaw);
+  const hardware = independent ? null : (0, import_deviceKeyHardware.parseHardwareKeyRecord)(privRaw);
+  if (hardware) {
+    if ((0, import_deviceKey.jwkThumbprint)(hardware.publicJwk) !== (0, import_deviceKey.jwkThumbprint)(publicJwk)) {
+      try {
+        writePublicKeyRecord(profile, hardware.publicJwk);
+        emit("public_key_repaired_from_hardware_record", true, { profile }, { logLevel: "info" });
+      } catch (err) {
+        emit("public_key_unreadable", false, { profile, message: err?.message ?? "unknown" });
+        return null;
+      }
+    }
+    return (0, import_deviceKeyHardware.hardwareDeviceKeyHandle)(hardware);
+  }
+  const decryptResult = (0, import_credentialEnvelopeBridge.maybeDecryptOnRead)(privRaw, {
+    unreadableHint: DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT
+  });
   if (decryptResult.plaintext === null) {
     emit("private_key_decrypt_failed", false, { profile });
     return null;
@@ -306,7 +381,7 @@ function loadKeypair(profile) {
     });
     return null;
   }
-  if (publicJwk.x !== privateJwk.x) {
+  if (publicJwk.kty !== "OKP" || publicJwk.x !== privateJwk.x) {
     emit("keypair_inconsistent", false, { profile });
     return null;
   }
@@ -318,16 +393,20 @@ function loadKeypair(profile) {
       recomputed
     });
   }
-  return {
-    publicJwk,
-    privateJwk,
-    thumbprint: recomputed
-  };
+  try {
+    return (0, import_deviceKeyHandle.softwareEd25519Handle)({ publicJwk, privateJwk, thumbprint: recomputed });
+  } catch (err) {
+    emit("private_key_malformed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
 }
 function deviceIdentityOf(dir) {
   try {
     const parsed = JSON.parse(import_node_fs.default.readFileSync(import_node_path.default.join(dir, PUBLIC_KEY_FILENAME), "utf-8"));
-    if (!parsed.publicJwk || typeof parsed.publicJwk.x !== "string")
+    if (!(0, import_deviceKey.isDevicePublicJwk)(parsed.publicJwk))
       return null;
     return (0, import_deviceKey.jwkThumbprint)(parsed.publicJwk);
   } catch {
@@ -370,6 +449,7 @@ async function consolidateDeviceIdentity(profile) {
       onEvent: (name, success, meta) => emit(name, success, meta)
     });
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("path_consolidation.failed", false, {
       profile,
       message: err?.message ?? "unknown"
@@ -390,6 +470,7 @@ async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind === "uninit")
       await initDeviceIdentityLocked(profile, options);
   }).catch((err) => {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     _state = { kind: "disabled", reason: "init_failed" };
     emit("init_failed", false, {
       profile,
@@ -409,22 +490,24 @@ async function initDeviceIdentityLocked(profile, options = {}) {
   const independent = /^desktop-bg-[a-f0-9]{32}$/i.test(profile);
   if (!independent)
     await consolidateDeviceIdentity(profile);
-  let keypair = null;
+  let stored = null;
   try {
-    keypair = loadKeypair(profile);
+    stored = loadStoredKey(profile);
   } catch (err) {
     emit("load_failed", false, {
       profile,
       message: err?.message ?? "unknown"
     });
-    keypair = null;
+    stored = null;
   }
-  if (keypair) {
-    const envelopeProtected = (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)();
-    _state = { kind: "active", keypair, profile, envelopeProtected };
+  if (stored) {
+    const envelopeProtected = stored.custody === "software" && (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)();
+    _state = { kind: "active", key: stored, profile, envelopeProtected };
+    trackActiveKeyFiles(profile);
     emit("active", true, {
       profile,
-      thumbprint: keypair.thumbprint,
+      thumbprint: stored.thumbprint,
+      custody: stored.custody,
       envelopeProtected,
       regenerated: false
     });
@@ -458,6 +541,7 @@ async function initDeviceIdentityLocked(profile, options = {}) {
   try {
     persistResult = persistKeypair(profile, fresh);
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     _state = { kind: "disabled", reason: "persist_failed" };
     emit("persist_failed", false, {
       profile,
@@ -465,15 +549,29 @@ async function initDeviceIdentityLocked(profile, options = {}) {
     });
     return;
   }
+  let freshKey;
+  try {
+    freshKey = (0, import_deviceKeyHandle.softwareEd25519Handle)(fresh);
+  } catch (err) {
+    _state = { kind: "disabled", reason: "init_failed" };
+    emit("init_failed", false, {
+      profile,
+      reason: "keygen_threw",
+      message: err?.message ?? "unknown"
+    });
+    return;
+  }
   _state = {
     kind: "active",
-    keypair: fresh,
+    key: freshKey,
     profile,
     envelopeProtected: persistResult.envelopeProtected
   };
+  trackActiveKeyFiles(profile);
   emit("active", true, {
     profile,
     thumbprint: fresh.thumbprint,
+    custody: "software",
     envelopeProtected: persistResult.envelopeProtected,
     regenerated: true
   });
@@ -482,12 +580,18 @@ async function resetDeviceIdentity(opts) {
   if (_initializing)
     await _initializing;
   if (opts?.clearOnDisk && opts.profile) {
-    const targets = [PUBLIC_KEY_FILENAME, PRIVATE_KEY_FILENAME].flatMap((name) => (0, import_profileStateDir.profileStateFilePathsToClear)(opts.profile, name));
+    const targets = [
+      ...[PUBLIC_KEY_FILENAME, PRIVATE_KEY_FILENAME].flatMap((name) => (0, import_profileStateDir.profileStateFilePathsToClear)(opts.profile, name)),
+      ...retiredKeyCopies(opts.profile, PUBLIC_KEY_FILENAME),
+      ...retiredKeyCopies(opts.profile, PRIVATE_KEY_FILENAME),
+      pendingHardwareKeyPath(opts.profile)
+    ];
     await withDeviceIdentityLock(opts.profile, async () => {
       for (const p of targets) {
         try {
-          import_node_fs.default.unlinkSync(p);
+          (0, import_stateFiles.removeStateFile)(p, `delete the device key file ${import_node_path.default.basename(p)}`);
         } catch (err) {
+          (0, import_liveState.rethrowIfLiveStateRefusal)(err);
           if (err.code !== "ENOENT") {
             emit("clear_failed", false, {
               profile: opts.profile,
@@ -501,6 +605,150 @@ async function resetDeviceIdentity(opts) {
   }
   _state = { kind: "uninit" };
   _unreadableSeen = null;
+  _activeSeen = null;
+}
+async function prepareHardwareKeyCandidate(profile) {
+  if (/^desktop-bg-[a-f0-9]{32}$/i.test(profile))
+    return { ok: false, reason: "independent_profile" };
+  if (_state.kind === "active" && _state.key.custody === "hardware") {
+    return { ok: false, reason: "already_hardware" };
+  }
+  const capability = await (0, import_deviceKeyHardware.probeHardwareDeviceKey)();
+  if (!capability.available)
+    return { ok: false, reason: "unavailable", capability };
+  try {
+    const { record, handle } = await (0, import_deviceKeyHardware.createHardwareDeviceKey)();
+    return { ok: true, candidate: { key: handle, record } };
+  } catch (err) {
+    emit("hardware_key_create_failed", false, {
+      profile,
+      ...err instanceof import_deviceKeyHardware.HardwareDeviceKeyError ? { hardwareFailure: err.code } : {},
+      message: err?.message ?? "unknown"
+    });
+    return { ok: false, reason: "create_failed", message: err?.message ?? "unknown" };
+  }
+}
+async function signWithCandidate(candidate, opts) {
+  try {
+    return await (0, import_deviceKey.signProofWith)(candidate.key, opts);
+  } catch (err) {
+    emit("sign_failed", false, {
+      thumbprint: candidate.key.thumbprint,
+      custody: "hardware",
+      candidate: true,
+      method: opts.method,
+      ...err instanceof import_deviceKeyHardware.HardwareDeviceKeyError ? { hardwareFailure: err.code } : {},
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+}
+function retiredKeyCopies(profile, filename) {
+  const dir = import_node_path.default.dirname(filename === PUBLIC_KEY_FILENAME ? publicKeyPath(profile) : privateKeyPath(profile));
+  const prefix = `${filename}${import_profileStateDir.RETIRED_COPY_SUFFIX}.`;
+  try {
+    return import_node_fs.default.readdirSync(dir).filter((name) => name.startsWith(prefix)).sort().map((name) => import_node_path.default.join(dir, name));
+  } catch {
+    return [];
+  }
+}
+function retireSoftwareKey(profile) {
+  try {
+    const priv = privateKeyPath(profile);
+    const raw = import_node_fs.default.readFileSync(priv, "utf-8");
+    if ((0, import_deviceKeyHardware.parseHardwareKeyRecord)(raw))
+      return;
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    (0, import_stateFiles.atomicWrite0600)(`${priv}${import_profileStateDir.RETIRED_COPY_SUFFIX}.${stamp}`, raw, `keep the replaced software device key for profile ${profile}`);
+    try {
+      (0, import_stateFiles.atomicWrite0600)(`${publicKeyPath(profile)}${import_profileStateDir.RETIRED_COPY_SUFFIX}.${stamp}`, import_node_fs.default.readFileSync(publicKeyPath(profile), "utf-8"), `keep the replaced software device public key for profile ${profile}`);
+    } catch (err) {
+      (0, import_liveState.rethrowIfLiveStateRefusal)(err);
+    }
+    for (const filename of [PRIVATE_KEY_FILENAME, PUBLIC_KEY_FILENAME]) {
+      for (const stale of retiredKeyCopies(profile, filename).slice(0, -1)) {
+        try {
+          (0, import_stateFiles.removeStateFile)(stale, `prune a retired device key copy for profile ${profile}`);
+        } catch (err) {
+          (0, import_liveState.rethrowIfLiveStateRefusal)(err);
+        }
+      }
+    }
+  } catch (err) {
+    emit("retire_software_key_failed", false, { profile, message: err?.message ?? "unknown" });
+  }
+}
+async function commitDeviceKeyCandidate(profile, candidate) {
+  if (_initializing)
+    await _initializing;
+  await withDeviceIdentityLock(profile, async () => {
+    commitRecordLocked(profile, candidate.record, candidate.key);
+  });
+}
+function commitRecordLocked(profile, record, key) {
+  retireSoftwareKey(profile);
+  persistHardwareKey(profile, record);
+  clearEnrollmentMarker(profile);
+  removePendingHardwareKey(profile);
+  _state = { kind: "active", key, profile, envelopeProtected: false };
+  _unreadableSeen = null;
+  trackActiveKeyFiles(profile);
+  emit("upgraded_to_hardware", true, {
+    profile,
+    thumbprint: key.thumbprint,
+    custody: "hardware"
+  });
+}
+const PENDING_HARDWARE_FILENAME = "device-key.pending";
+const PENDING_HARDWARE_KEY_MAX_AGE_MS = 10 * 60 * 1e3;
+function pendingHardwareKeyPath(profile) {
+  return import_node_path.default.join(profileConfigDir(profile), PENDING_HARDWARE_FILENAME);
+}
+function removePendingHardwareKey(profile) {
+  try {
+    (0, import_stateFiles.removeStateFile)(pendingHardwareKeyPath(profile), `remove the pending hardware key for profile ${profile}`);
+  } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
+    if (err.code !== "ENOENT") {
+      emit("pending_hardware_key_clear_failed", false, { profile, message: err?.message ?? "unknown" });
+    }
+  }
+}
+async function persistPendingHardwareKey(profile, candidate) {
+  await withDeviceIdentityLock(profile, async () => {
+    (0, import_stateFiles.atomicWrite0600)(pendingHardwareKeyPath(profile), (0, import_deviceKeyHardware.serializeHardwareKeyRecord)(candidate.record), `park a pending hardware key for profile ${profile}`);
+  });
+}
+async function commitPendingHardwareKey(profile, thumbprint) {
+  if (_initializing)
+    await _initializing;
+  return withDeviceIdentityLock(profile, async () => {
+    const file = pendingHardwareKeyPath(profile);
+    let raw;
+    let modifiedAt;
+    try {
+      raw = import_node_fs.default.readFileSync(file, "utf-8");
+      modifiedAt = import_node_fs.default.statSync(file).mtimeMs;
+    } catch {
+      return "no_pending";
+    }
+    const record = (0, import_deviceKeyHardware.parseHardwareKeyRecord)(raw);
+    if (!record)
+      return "unreadable";
+    if (Date.now() - modifiedAt > PENDING_HARDWARE_KEY_MAX_AGE_MS) {
+      removePendingHardwareKey(profile);
+      return "expired";
+    }
+    if ((0, import_deviceKey.jwkThumbprint)(record.publicJwk) !== thumbprint)
+      return "mismatch";
+    commitRecordLocked(profile, record, (0, import_deviceKeyHardware.hardwareDeviceKeyHandle)(record));
+    return "committed";
+  });
+}
+async function discardPendingHardwareKey(profile) {
+  await withDeviceIdentityLock(profile, async () => {
+    removePendingHardwareKey(profile);
+  });
 }
 function isDeviceIdentityActive() {
   reloadIfRecovered();
@@ -510,7 +758,12 @@ function getDevicePublicKey() {
   reloadIfRecovered();
   if (_state.kind !== "active")
     return null;
-  return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
+  return {
+    jwk: _state.key.publicJwk,
+    thumbprint: _state.key.thumbprint,
+    alg: _state.key.alg,
+    custody: _state.key.custody
+  };
 }
 function describeDeviceIdentityState() {
   reloadIfRecovered();
@@ -520,19 +773,41 @@ function describeDeviceIdentityState() {
   if (_state.kind === "active") {
     return {
       kind: "active",
-      thumbprint: _state.keypair.thumbprint,
+      thumbprint: _state.key.thumbprint,
       profile: _state.profile,
-      envelopeProtected: _state.envelopeProtected
+      envelopeProtected: _state.envelopeProtected,
+      alg: _state.key.alg,
+      custody: _state.key.custody,
+      canSign: _state.key.custody === "software" ? true : (0, import_deviceKeyHardware.resolveHardwareDeviceKeyHelper)() !== null
     };
   }
   return { kind: "uninit" };
 }
-function signServerRequest(opts) {
+function describeStoredDeviceKey(profile) {
+  try {
+    const parsed = JSON.parse(import_node_fs.default.readFileSync(publicKeyPath(profile), "utf-8"));
+    if (!(0, import_deviceKey.isDevicePublicJwk)(parsed.publicJwk))
+      return { stored: false };
+    const alg = parsed.publicJwk.kty === "EC" ? "ES256" : "EdDSA";
+    const custody = alg === "ES256" ? "hardware" : "software";
+    return {
+      stored: true,
+      alg,
+      custody,
+      thumbprint: (0, import_deviceKey.jwkThumbprint)(parsed.publicJwk),
+      canSign: custody === "software" ? true : (0, import_deviceKeyHardware.resolveHardwareDeviceKeyHelper)() !== null
+    };
+  } catch {
+    return { stored: false };
+  }
+}
+async function signServerRequest(opts) {
   reloadIfRecovered();
-  if (_state.kind !== "active")
+  const state = _state;
+  if (state.kind !== "active")
     return null;
   try {
-    return (0, import_deviceKey.buildProof)(_state.keypair.privateJwk, _state.keypair.publicJwk, {
+    return await (0, import_deviceKey.signProofWith)(state.key, {
       method: opts.method,
       url: opts.url,
       refreshToken: opts.refreshToken,
@@ -540,9 +815,13 @@ function signServerRequest(opts) {
     });
   } catch (err) {
     emit("sign_failed", false, {
-      profile: _state.profile,
-      thumbprint: _state.keypair.thumbprint,
+      profile: state.profile,
+      thumbprint: state.key.thumbprint,
+      custody: state.key.custody,
       method: opts.method,
+      // A hardware failure names its cause (helper missing, timed out, key
+      // mismatch) so a status line can say what to do about it.
+      ...err instanceof import_deviceKeyHardware.HardwareDeviceKeyError ? { hardwareFailure: err.code } : {},
       message: err?.message ?? "unknown"
     });
     return null;
@@ -563,8 +842,9 @@ function __enrollmentBackoffPathForTest(profile) {
 function clearEnrollmentMarker(profile) {
   for (const markerPath of [enrollmentMarkerPath(profile), enrollmentBackoffPath(profile)]) {
     try {
-      import_node_fs.default.unlinkSync(markerPath);
+      (0, import_stateFiles.removeStateFile)(markerPath, `delete the enrollment file ${import_node_path.default.basename(markerPath)}`);
     } catch (err) {
+      (0, import_liveState.rethrowIfLiveStateRefusal)(err);
       if (err.code !== "ENOENT") {
         emit("enrollment_marker_clear_failed", false, {
           profile,
@@ -581,7 +861,7 @@ async function enrollWithServer(opts) {
     return { enrolled: false, reason: "not_active" };
   }
   const profile = _state.profile;
-  const keypair = _state.keypair;
+  const key = _state.key;
   const markerPath = enrollmentMarkerPath(profile);
   const backoffPath = enrollmentBackoffPath(profile);
   try {
@@ -593,27 +873,33 @@ async function enrollWithServer(opts) {
   try {
     const raw = JSON.parse(import_node_fs.default.readFileSync(backoffPath, "utf-8"));
     const retryAfter = Date.parse(raw.retryAfter || "");
-    if (raw.serverUrl === serverUrl && raw.machineUuid === machineUuid && raw.thumbprint === keypair.thumbprint && Number.isFinite(retryAfter) && retryAfter > Date.now()) {
+    if (raw.serverUrl === serverUrl && raw.machineUuid === machineUuid && raw.thumbprint === key.thumbprint && Number.isFinite(retryAfter) && retryAfter > Date.now()) {
       return { enrolled: false, reason: "backoff_active" };
     }
-    import_node_fs.default.unlinkSync(backoffPath);
+    (0, import_stateFiles.removeStateFile)(backoffPath, "delete the stale enrollment backoff");
   } catch (err) {
     if (err.code !== "ENOENT") {
       try {
-        import_node_fs.default.unlinkSync(backoffPath);
-      } catch {
+        (0, import_stateFiles.removeStateFile)(backoffPath, "delete the corrupt enrollment backoff");
+      } catch (clearErr) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(clearErr);
       }
     }
   }
   const base = serverUrl.replace(/\/+$/, "");
   const htu = `${base}/api/daemon-resources/enroll-device-key`;
-  const proofJws = (0, import_deviceKey.buildProof)(keypair.privateJwk, keypair.publicJwk, {
-    method: "POST",
-    url: htu
-  });
+  let proofJws;
+  try {
+    proofJws = await (0, import_deviceKey.signProofWith)(key, { method: "POST", url: htu });
+  } catch (err) {
+    const message = err?.message ?? "unknown";
+    emit("enrollment_sign_failed", false, { profile, thumbprint: key.thumbprint, custody: key.custody, message });
+    return { enrolled: false, reason: "not_active", message };
+  }
   const body = JSON.stringify({
     machineUuid,
-    publicJwkX: keypair.publicJwk.x,
+    ...key.publicJwk.kty === "OKP" ? { publicJwkX: key.publicJwk.x } : {},
+    publicJwk: key.publicJwk,
     proofJws
   });
   const ownAbort = new AbortController();
@@ -634,7 +920,7 @@ async function enrollWithServer(opts) {
     const message = err?.message ?? "unknown";
     emit("enrollment_network_error", false, {
       profile,
-      thumbprint: keypair.thumbprint,
+      thumbprint: key.thumbprint,
       serverUrl,
       message
     });
@@ -654,13 +940,13 @@ async function enrollWithServer(opts) {
       } catch {
       }
     }
-    const pinnedToOtherKey = response.status === 409 && enrolledThumbprint !== null && enrolledThumbprint !== keypair.thumbprint;
+    const pinnedToOtherKey = response.status === 409 && enrolledThumbprint !== null && enrolledThumbprint !== key.thumbprint;
     const keyPinnedElsewhere = response.status === 409 && conflictCode === "ENROLLMENT_DUPLICATE_KEY";
     const isBenignRejection = response.status === 404 && responseText.includes("DAEMON_NOT_FOUND") || response.status === 403 && responseText.includes("OPAQUE_AUTH_REFUSED") || response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere;
     if (pinnedToOtherKey) {
       emit("enrollment_key_mismatch", false, {
         profile,
-        thumbprint: keypair.thumbprint,
+        thumbprint: key.thumbprint,
         enrolledThumbprint,
         serverUrl,
         message: "this machine is registered with a different device key than this profile signs with; its refreshes will be refused. An interactive daemon login (skrrd login) re-registers this key."
@@ -668,13 +954,14 @@ async function enrollWithServer(opts) {
     }
     if (response.status === 404 && responseText.includes("DAEMON_NOT_FOUND")) {
       try {
-        atomicWrite0600(backoffPath, JSON.stringify({
+        (0, import_stateFiles.atomicWrite0600)(backoffPath, JSON.stringify({
           serverUrl,
           machineUuid,
-          thumbprint: keypair.thumbprint,
+          thumbprint: key.thumbprint,
           retryAfter: new Date(Date.now() + DAEMON_NOT_FOUND_BACKOFF_MS).toISOString()
-        }));
+        }), "write the enrollment backoff");
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         emit("enrollment_backoff_write_failed", false, {
           profile,
           message: err?.message ?? "unknown"
@@ -683,7 +970,7 @@ async function enrollWithServer(opts) {
     }
     emit("enrollment_rejected", false, {
       profile,
-      thumbprint: keypair.thumbprint,
+      thumbprint: key.thumbprint,
       serverUrl,
       status: response.status,
       body: responseText
@@ -698,20 +985,21 @@ async function enrollWithServer(opts) {
   const marker = JSON.stringify({
     enrolledAt: (/* @__PURE__ */ new Date()).toISOString(),
     serverUrl,
-    thumbprint: keypair.thumbprint,
+    thumbprint: key.thumbprint,
     machineUuid
   });
   try {
-    atomicWrite0600(markerPath, marker);
+    (0, import_stateFiles.atomicWrite0600)(markerPath, marker, "write the enrollment marker");
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("enrollment_marker_write_failed", false, {
       profile,
-      thumbprint: keypair.thumbprint,
+      thumbprint: key.thumbprint,
       message: err?.message ?? "unknown"
     });
   }
   try {
-    import_node_fs.default.unlinkSync(backoffPath);
+    (0, import_stateFiles.removeStateFile)(backoffPath, "delete the enrollment backoff");
   } catch (err) {
     if (err.code !== "ENOENT") {
       emit("enrollment_backoff_clear_failed", false, {
@@ -722,13 +1010,15 @@ async function enrollWithServer(opts) {
   }
   emit("enrolled_with_server", true, {
     profile,
-    thumbprint: keypair.thumbprint,
+    thumbprint: key.thumbprint,
     serverUrl
   });
-  return { enrolled: true, thumbprint: keypair.thumbprint };
+  return { enrolled: true, thumbprint: key.thumbprint };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT,
+  PENDING_HARDWARE_KEY_MAX_AGE_MS,
   __enrollmentBackoffPathForTest,
   __enrollmentMarkerPathForTest,
   __getStateForTest,
@@ -737,12 +1027,19 @@ async function enrollWithServer(opts) {
   __setStateForTest,
   __setUnreadableReloadIntervalForTest,
   clearEnrollmentMarker,
+  commitDeviceKeyCandidate,
+  commitPendingHardwareKey,
   describeDeviceIdentityState,
   describeDeviceKeySplit,
+  describeStoredDeviceKey,
+  discardPendingHardwareKey,
   enrollWithServer,
   getDevicePublicKey,
   initDeviceIdentity,
   isDeviceIdentityActive,
+  persistPendingHardwareKey,
+  prepareHardwareKeyCandidate,
   resetDeviceIdentity,
-  signServerRequest
+  signServerRequest,
+  signWithCandidate
 });