@skrr-ai/cli 0.1.8

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -0,0 +1,113 @@
+import { type DeviceKeyPair, type Ed25519PublicJwk } from './deviceKey.js';
+type DeviceIdentityState = {
+    kind: 'uninit';
+} | {
+    kind: 'disabled';
+    reason: DisabledReason;
+} | {
+    kind: 'active';
+    keypair: DeviceKeyPair;
+    profile: string;
+    envelopeProtected: boolean;
+};
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
+/** @internal Test seam — force-set state. */
+export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
+/** @internal Test seam — read state. */
+export declare function __getStateForTest(): DeviceIdentityState;
+/**
+ * Initialize device identity. Idempotent.
+ *
+ * Order:
+ *   1. Try to load existing keypair from disk.
+ *      - Success → state = active.
+ *      - Missing files / corruption / decrypt failure → step 2.
+ *   2. Generate fresh keypair and persist. Failure to persist is a hard
+ *      error landing in disabled+persist_failed.
+ */
+export declare function initDeviceIdentity(profile: string): Promise<void>;
+/**
+ * Reset state. With `clearOnDisk=true` deletes both keypair files —
+ * used by `oversky logout` / `sky logout` so a freshly-logged-in user
+ * gets a fresh device identity that the daemon will see on its next start.
+ */
+export declare function resetDeviceIdentity(opts?: {
+    profile?: string;
+    clearOnDisk?: boolean;
+}): Promise<void>;
+/** True iff init has completed and a keypair is in memory. */
+export declare function isDeviceIdentityActive(): boolean;
+/**
+ * Export the public key for server enrollment / dashboard display.
+ * Returns null when not active so callers know to skip the JWS header
+ * on the in-flight request.
+ */
+export declare function getDevicePublicKey(): {
+    jwk: Ed25519PublicJwk;
+    thumbprint: string;
+} | null;
+/**
+ * Operator-readable summary of device-identity state. Used by
+ * `oversky status` and CLI debug commands. Never includes the private key.
+ */
+export declare function describeDeviceIdentityState(): {
+    kind: DeviceIdentityState['kind'];
+    reason?: DisabledReason;
+    thumbprint?: string;
+    profile?: string;
+    envelopeProtected?: boolean;
+};
+/**
+ * Sign an outgoing request with the device key. Returns the JWS Compact
+ * Serialization, or null when device identity is not active. NEVER
+ * throws — a failed sign returns null and emits a telemetry event so
+ * the caller can fall back to bearer-only auth without an outage.
+ *
+ * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
+ * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
+ */
+export declare function signServerRequest(opts: {
+    method: string;
+    url: string;
+    refreshToken?: string;
+    accessToken?: string;
+}): string | null;
+/** @internal Test seams — file path resolvers. */
+export declare function __publicKeyPathForTest(profile: string): string;
+export declare function __privateKeyPathForTest(profile: string): string;
+export declare function __enrollmentMarkerPathForTest(profile: string): string;
+export declare function __enrollmentBackoffPathForTest(profile: string): string;
+/** Remove the enrollment marker so re-login gets a fresh enrollment. */
+export declare function clearEnrollmentMarker(profile: string): void;
+export type EnrollmentResult = {
+    enrolled: true;
+    thumbprint: string;
+} | {
+    enrolled: false;
+    reason: 'not_active' | 'already_persisted' | 'backoff_active' | 'http_error' | 'network_error';
+    status?: number;
+    body?: string;
+    message?: string;
+};
+/**
+ * POST the device public key to the server for enrollment.
+ *
+ * Idempotent across boots — the marker file short-circuits subsequent
+ * calls. The marker stores serverUrl + thumbprint so a URL change
+ * (staging → prod swap) forces fresh enrollment.
+ *
+ * Fire-and-forget contract — callers should `.catch()` so a network
+ * partition at startup cannot stall the consumer's command path.
+ *
+ * NOTE: Both `sky` and `oversky` may race to enroll the same shared
+ * keypair. The server's `enroll-device-key` route is idempotent on
+ * `(machineUuid, publicJwkX)` so a duplicate POST is safe; whichever
+ * binary writes its marker file first short-circuits the other.
+ */
+export declare function enrollWithServer(opts: {
+    serverUrl: string;
+    accessToken: string;
+    machineUuid: string;
+    signal?: AbortSignal;
+}): Promise<EnrollmentResult>;
+export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -0,0 +1,591 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__setStateForTest = __setStateForTest;
+exports.__getStateForTest = __getStateForTest;
+exports.initDeviceIdentity = initDeviceIdentity;
+exports.resetDeviceIdentity = resetDeviceIdentity;
+exports.isDeviceIdentityActive = isDeviceIdentityActive;
+exports.getDevicePublicKey = getDevicePublicKey;
+exports.describeDeviceIdentityState = describeDeviceIdentityState;
+exports.signServerRequest = signServerRequest;
+exports.__publicKeyPathForTest = __publicKeyPathForTest;
+exports.__privateKeyPathForTest = __privateKeyPathForTest;
+exports.__enrollmentMarkerPathForTest = __enrollmentMarkerPathForTest;
+exports.__enrollmentBackoffPathForTest = __enrollmentBackoffPathForTest;
+exports.clearEnrollmentMarker = clearEnrollmentMarker;
+exports.enrollWithServer = enrollWithServer;
+/**
+ * deviceIdentityBridge.ts — composed L11 runtime (init, sign, enroll).
+ *
+ * Lifts the previously-duplicated `daemon/src/deviceIdentity.ts` and
+ * `cli/src/lib/device-identity.ts` modules into a single shared
+ * implementation. Daemon and CLI both consume this module so they land
+ * on the SAME on-disk artifacts:
+ *
+ *   <configDir>/profiles/<p>/device-public-key.jwk    — plaintext JWK
+ *   <configDir>/profiles/<p>/device-private-key       — L12-wrapped JSON
+ *   <configDir>/profiles/<p>/device-enrollment.json   — server-ack marker
+ *
+ * Architectural decision (locked): CLI shares the daemon's keypair on
+ * the same machine. Same machine = same device identity. The scope
+ * discriminator is the JWT claim (`scope: 'cli'` vs `scope: 'daemon'`),
+ * not the key.
+ *
+ * NAMING NOTE — the suffix `Bridge` distinguishes this composed runtime
+ * (init + sign + enroll + telemetry) from the pure-crypto primitive
+ * file `deviceKey.ts` it composes.
+ */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const deviceKey_js_1 = require("./deviceKey.js");
+const credentialEnvelopeBridge_js_1 = require("./credentialEnvelopeBridge.js");
+const runtime_js_1 = require("./runtime.js");
+const PUBLIC_KEY_FILENAME = 'device-public-key.jwk';
+const PRIVATE_KEY_FILENAME = 'device-private-key';
+const ENROLLMENT_MARKER_FILENAME = 'device-enrollment.json';
+const ENROLLMENT_BACKOFF_FILENAME = 'device-enrollment-backoff.json';
+// A missing Daemon row cannot become enrollable until registration changes
+// server state. Persist the negative result across short-lived `sky` processes
+// so every CLI command does not repeat the same guaranteed 404.
+const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1000;
+let _state = { kind: 'uninit' };
+/** @internal Test seam — force-set state. */
+function __setStateForTest(next) {
+    const prev = _state;
+    _state = next;
+    return prev;
+}
+/** @internal Test seam — read state. */
+function __getStateForTest() {
+    return _state;
+}
+function profileConfigDir(profile) {
+    return node_path_1.default.join((0, runtime_js_1.getAuthConfigDir)(), 'profiles', profile);
+}
+function publicKeyPath(profile) {
+    return node_path_1.default.join(profileConfigDir(profile), PUBLIC_KEY_FILENAME);
+}
+function privateKeyPath(profile) {
+    return node_path_1.default.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
+}
+function enrollmentMarkerPath(profile) {
+    return node_path_1.default.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
+}
+function enrollmentBackoffPath(profile) {
+    return node_path_1.default.join(profileConfigDir(profile), ENROLLMENT_BACKOFF_FILENAME);
+}
+function atomicWrite0600(target, value) {
+    const dir = node_path_1.default.dirname(target);
+    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    const buf = typeof value === 'string' ? Buffer.from(value, 'utf-8') : value;
+    const fd = node_fs_1.default.openSync(tmp, 'w', 0o600);
+    try {
+        node_fs_1.default.writeSync(fd, buf);
+        node_fs_1.default.fsyncSync(fd);
+    }
+    finally {
+        node_fs_1.default.closeSync(fd);
+    }
+    node_fs_1.default.renameSync(tmp, target);
+    try {
+        const dirFd = node_fs_1.default.openSync(dir, 'r');
+        try {
+            node_fs_1.default.fsyncSync(dirFd);
+        }
+        finally {
+            node_fs_1.default.closeSync(dirFd);
+        }
+    }
+    catch {
+        /* best-effort; some platforms reject dir fsync */
+    }
+}
+function emit(eventName, success, metadata, opts = {}) {
+    (0, runtime_js_1.emitAuthTelemetry)({
+        timestamp: new Date().toISOString(),
+        eventType: 'auth',
+        success,
+        metadata: { source: 'deviceIdentity', event: eventName, ...metadata },
+    });
+    if (!success) {
+        const level = opts.logLevel ?? 'warn';
+        const log = (0, runtime_js_1.getAuthLogger)();
+        if (level === 'info') {
+            log.info(`[deviceIdentity] ${eventName}`, metadata);
+        }
+        else {
+            log.warn(`[deviceIdentity] ${eventName}`, metadata);
+        }
+    }
+}
+/**
+ * Persist a freshly-generated keypair. Public goes plaintext; private
+ * goes through `maybeEncryptForWrite` so L12 wraps it when active.
+ */
+function persistKeypair(profile, kp) {
+    const publicPayload = JSON.stringify({
+        publicJwk: kp.publicJwk,
+        thumbprint: kp.thumbprint,
+        createdAt: new Date().toISOString(),
+    });
+    atomicWrite0600(publicKeyPath(profile), publicPayload);
+    // Use the always-fail-open variant — device-identity wants the private
+    // key persisted even when the L12 envelope path is inactive (today's
+    // default on every platform). The daemon's `credEnvelopeFailClosed`
+    // policy applies only to the keychain.ts write path.
+    const privatePlaintext = JSON.stringify(kp.privateJwk);
+    const wireForm = (0, credentialEnvelopeBridge_js_1.wrapIfActiveOrPassthrough)(privatePlaintext);
+    const envelopeProtected = wireForm !== privatePlaintext;
+    atomicWrite0600(privateKeyPath(profile), wireForm);
+    emit('keypair_persisted', true, {
+        profile,
+        thumbprint: kp.thumbprint,
+        envelopeProtected,
+    });
+    return { envelopeProtected };
+}
+/**
+ * Load a previously-persisted keypair. Returns null on missing files,
+ * decrypt failure, public/private mismatch (file-swap defense), or
+ * malformed JSON. Throws only on unexpected fs errors; init catches.
+ */
+function loadKeypair(profile) {
+    const pubPath = publicKeyPath(profile);
+    const privPath = privateKeyPath(profile);
+    if (!node_fs_1.default.existsSync(pubPath) || !node_fs_1.default.existsSync(privPath)) {
+        return null;
+    }
+    const pubRaw = node_fs_1.default.readFileSync(pubPath, 'utf-8');
+    const privRaw = node_fs_1.default.readFileSync(privPath, 'utf-8');
+    let publicJwk;
+    let storedThumbprint;
+    try {
+        const parsed = JSON.parse(pubRaw);
+        publicJwk = parsed.publicJwk;
+        storedThumbprint = parsed.thumbprint;
+    }
+    catch (err) {
+        emit('public_key_unreadable', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+    const decryptResult = (0, credentialEnvelopeBridge_js_1.maybeDecryptOnRead)(privRaw);
+    if (decryptResult.plaintext === null) {
+        emit('private_key_decrypt_failed', false, { profile });
+        return null;
+    }
+    const privatePlaintext = decryptResult.plaintext;
+    let privateJwk;
+    try {
+        privateJwk = JSON.parse(privatePlaintext);
+    }
+    catch (err) {
+        emit('private_key_malformed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+    // public.x must match private.x — any mismatch indicates a partial
+    // write race, manual edit, or attacker swapping one of the files.
+    if (publicJwk.x !== privateJwk.x) {
+        emit('keypair_inconsistent', false, { profile });
+        return null;
+    }
+    // Recompute the thumbprint; mismatch with stored is informational
+    // (we trust the recomputed value), not a failure.
+    const recomputed = (0, deviceKey_js_1.jwkThumbprint)(publicJwk);
+    if (recomputed !== storedThumbprint) {
+        emit('thumbprint_drift', false, {
+            profile,
+            stored: storedThumbprint,
+            recomputed,
+        });
+    }
+    return {
+        publicJwk,
+        privateJwk,
+        thumbprint: recomputed,
+    };
+}
+/**
+ * Initialize device identity. Idempotent.
+ *
+ * Order:
+ *   1. Try to load existing keypair from disk.
+ *      - Success → state = active.
+ *      - Missing files / corruption / decrypt failure → step 2.
+ *   2. Generate fresh keypair and persist. Failure to persist is a hard
+ *      error landing in disabled+persist_failed.
+ */
+async function initDeviceIdentity(profile) {
+    if (_state.kind !== 'uninit')
+        return;
+    if (typeof profile !== 'string' || profile.length === 0) {
+        _state = { kind: 'disabled', reason: 'init_failed' };
+        emit('init_failed', false, { reason: 'empty_profile' });
+        return;
+    }
+    let keypair = null;
+    try {
+        keypair = loadKeypair(profile);
+    }
+    catch (err) {
+        emit('load_failed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        keypair = null;
+    }
+    if (keypair) {
+        const envelopeProtected = (0, credentialEnvelopeBridge_js_1.isCredEnvelopeActive)();
+        _state = { kind: 'active', keypair, profile, envelopeProtected };
+        emit('active', true, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            envelopeProtected,
+            regenerated: false,
+        });
+        return;
+    }
+    let fresh;
+    try {
+        fresh = (0, deviceKey_js_1.generateDeviceKeyPair)();
+    }
+    catch (err) {
+        _state = { kind: 'disabled', reason: 'init_failed' };
+        emit('init_failed', false, {
+            profile,
+            reason: 'keygen_threw',
+            message: err?.message ?? 'unknown',
+        });
+        return;
+    }
+    let persistResult;
+    try {
+        persistResult = persistKeypair(profile, fresh);
+    }
+    catch (err) {
+        _state = { kind: 'disabled', reason: 'persist_failed' };
+        emit('persist_failed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return;
+    }
+    _state = {
+        kind: 'active',
+        keypair: fresh,
+        profile,
+        envelopeProtected: persistResult.envelopeProtected,
+    };
+    emit('active', true, {
+        profile,
+        thumbprint: fresh.thumbprint,
+        envelopeProtected: persistResult.envelopeProtected,
+        regenerated: true,
+    });
+}
+/**
+ * Reset state. With `clearOnDisk=true` deletes both keypair files —
+ * used by `oversky logout` / `sky logout` so a freshly-logged-in user
+ * gets a fresh device identity that the daemon will see on its next start.
+ */
+async function resetDeviceIdentity(opts) {
+    if (opts?.clearOnDisk && opts.profile) {
+        for (const p of [publicKeyPath(opts.profile), privateKeyPath(opts.profile)]) {
+            try {
+                node_fs_1.default.unlinkSync(p);
+            }
+            catch (err) {
+                if (err.code !== 'ENOENT') {
+                    emit('clear_failed', false, {
+                        profile: opts.profile,
+                        file: node_path_1.default.basename(p),
+                        message: err?.message ?? 'unknown',
+                    });
+                }
+            }
+        }
+    }
+    _state = { kind: 'uninit' };
+}
+/** True iff init has completed and a keypair is in memory. */
+function isDeviceIdentityActive() {
+    return _state.kind === 'active';
+}
+/**
+ * Export the public key for server enrollment / dashboard display.
+ * Returns null when not active so callers know to skip the JWS header
+ * on the in-flight request.
+ */
+function getDevicePublicKey() {
+    if (_state.kind !== 'active')
+        return null;
+    return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
+}
+/**
+ * Operator-readable summary of device-identity state. Used by
+ * `oversky status` and CLI debug commands. Never includes the private key.
+ */
+function describeDeviceIdentityState() {
+    if (_state.kind === 'disabled') {
+        return { kind: 'disabled', reason: _state.reason };
+    }
+    if (_state.kind === 'active') {
+        return {
+            kind: 'active',
+            thumbprint: _state.keypair.thumbprint,
+            profile: _state.profile,
+            envelopeProtected: _state.envelopeProtected,
+        };
+    }
+    return { kind: 'uninit' };
+}
+/**
+ * Sign an outgoing request with the device key. Returns the JWS Compact
+ * Serialization, or null when device identity is not active. NEVER
+ * throws — a failed sign returns null and emits a telemetry event so
+ * the caller can fall back to bearer-only auth without an outage.
+ *
+ * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
+ * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
+ */
+function signServerRequest(opts) {
+    if (_state.kind !== 'active')
+        return null;
+    try {
+        return (0, deviceKey_js_1.buildProof)(_state.keypair.privateJwk, _state.keypair.publicJwk, {
+            method: opts.method,
+            url: opts.url,
+            refreshToken: opts.refreshToken,
+            accessToken: opts.accessToken,
+        });
+    }
+    catch (err) {
+        emit('sign_failed', false, {
+            profile: _state.profile,
+            thumbprint: _state.keypair.thumbprint,
+            method: opts.method,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+}
+/** @internal Test seams — file path resolvers. */
+function __publicKeyPathForTest(profile) {
+    return publicKeyPath(profile);
+}
+function __privateKeyPathForTest(profile) {
+    return privateKeyPath(profile);
+}
+function __enrollmentMarkerPathForTest(profile) {
+    return enrollmentMarkerPath(profile);
+}
+function __enrollmentBackoffPathForTest(profile) {
+    return enrollmentBackoffPath(profile);
+}
+/** Remove the enrollment marker so re-login gets a fresh enrollment. */
+function clearEnrollmentMarker(profile) {
+    for (const markerPath of [enrollmentMarkerPath(profile), enrollmentBackoffPath(profile)]) {
+        try {
+            node_fs_1.default.unlinkSync(markerPath);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                emit('enrollment_marker_clear_failed', false, {
+                    profile,
+                    file: node_path_1.default.basename(markerPath),
+                    message: err?.message ?? 'unknown',
+                });
+            }
+        }
+    }
+}
+/**
+ * POST the device public key to the server for enrollment.
+ *
+ * Idempotent across boots — the marker file short-circuits subsequent
+ * calls. The marker stores serverUrl + thumbprint so a URL change
+ * (staging → prod swap) forces fresh enrollment.
+ *
+ * Fire-and-forget contract — callers should `.catch()` so a network
+ * partition at startup cannot stall the consumer's command path.
+ *
+ * NOTE: Both `sky` and `oversky` may race to enroll the same shared
+ * keypair. The server's `enroll-device-key` route is idempotent on
+ * `(machineUuid, publicJwkX)` so a duplicate POST is safe; whichever
+ * binary writes its marker file first short-circuits the other.
+ */
+async function enrollWithServer(opts) {
+    const { serverUrl, accessToken, machineUuid } = opts;
+    if (_state.kind !== 'active') {
+        return { enrolled: false, reason: 'not_active' };
+    }
+    const profile = _state.profile;
+    const keypair = _state.keypair;
+    const markerPath = enrollmentMarkerPath(profile);
+    const backoffPath = enrollmentBackoffPath(profile);
+    try {
+        if (node_fs_1.default.existsSync(markerPath)) {
+            return { enrolled: false, reason: 'already_persisted' };
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    try {
+        const raw = JSON.parse(node_fs_1.default.readFileSync(backoffPath, 'utf-8'));
+        const retryAfter = Date.parse(raw.retryAfter || '');
+        if (raw.serverUrl === serverUrl &&
+            raw.machineUuid === machineUuid &&
+            raw.thumbprint === keypair.thumbprint &&
+            Number.isFinite(retryAfter) &&
+            retryAfter > Date.now()) {
+            return { enrolled: false, reason: 'backoff_active' };
+        }
+        node_fs_1.default.unlinkSync(backoffPath);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            // A corrupt/stale marker must never suppress enrollment indefinitely.
+            try {
+                node_fs_1.default.unlinkSync(backoffPath);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    const base = serverUrl.replace(/\/+$/, '');
+    const htu = `${base}/api/daemon-resources/enroll-device-key`;
+    const proofJws = (0, deviceKey_js_1.buildProof)(keypair.privateJwk, keypair.publicJwk, {
+        method: 'POST',
+        url: htu,
+    });
+    const body = JSON.stringify({
+        machineUuid,
+        publicJwkX: keypair.publicJwk.x,
+        proofJws,
+    });
+    // 10-second bound — enrollment is best-effort at startup.
+    const ownAbort = new AbortController();
+    const timer = setTimeout(() => ownAbort.abort(), 10_000);
+    let response;
+    try {
+        response = await fetch(htu, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body,
+            signal: opts.signal ?? ownAbort.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const message = err?.message ?? 'unknown';
+        emit('enrollment_network_error', false, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            serverUrl,
+            message,
+        });
+        return { enrolled: false, reason: 'network_error', message };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const responseText = await response.text().catch(() => '');
+    if (!response.ok) {
+        // Some rejection statuses are expected, non-actionable states rather
+        // than failures — log them at info so they don't read as auth errors or
+        // spam stderr on every invocation. Other statuses (proof failures, 5xx,
+        // etc.) keep the louder warn level for ops visibility.
+        //   • 404 DAEMON_NOT_FOUND — pre-enrollment window: the daemon row for
+        //     this (user, machineUuid) pair does not exist yet (fresh install,
+        //     server swap, or daemon hasn't started). Fires every CLI command
+        //     in that window.
+        //   • 403 OPAQUE_AUTH_REFUSED — the enroll route is JWT-only (M11); an
+        //     opaque `osk_dmn_*` daemon token is refused by design (OSK-1660 #5).
+        //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
+        //     token should not enroll. Guarded at the daemon call site, this is
+        //     defense-in-depth for any other opaque caller.
+        //   • 409 already-enrolled — a concurrent binary won the enrollment race
+        //     for the shared keypair; idempotent, nothing to do.
+        const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
+            (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
+            response.status === 409;
+        if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
+            try {
+                atomicWrite0600(backoffPath, JSON.stringify({
+                    serverUrl,
+                    machineUuid,
+                    thumbprint: keypair.thumbprint,
+                    retryAfter: new Date(Date.now() + DAEMON_NOT_FOUND_BACKOFF_MS).toISOString(),
+                }));
+            }
+            catch (err) {
+                emit('enrollment_backoff_write_failed', false, {
+                    profile,
+                    message: err?.message ?? 'unknown',
+                });
+            }
+        }
+        emit('enrollment_rejected', false, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            serverUrl,
+            status: response.status,
+            body: responseText,
+        }, { logLevel: isBenignRejection ? 'info' : 'warn' });
+        return {
+            enrolled: false,
+            reason: 'http_error',
+            status: response.status,
+            body: responseText,
+        };
+    }
+    const marker = JSON.stringify({
+        enrolledAt: new Date().toISOString(),
+        serverUrl,
+        thumbprint: keypair.thumbprint,
+        machineUuid,
+    });
+    try {
+        atomicWrite0600(markerPath, marker);
+    }
+    catch (err) {
+        // Non-fatal — server enrolled us; we may re-POST next run, which
+        // the server handles idempotently.
+        emit('enrollment_marker_write_failed', false, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            message: err?.message ?? 'unknown',
+        });
+    }
+    try {
+        node_fs_1.default.unlinkSync(backoffPath);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            emit('enrollment_backoff_clear_failed', false, {
+                profile,
+                message: err?.message ?? 'unknown',
+            });
+        }
+    }
+    emit('enrolled_with_server', true, {
+        profile,
+        thumbprint: keypair.thumbprint,
+        serverUrl,
+    });
+    return { enrolled: true, thumbprint: keypair.thumbprint };
+}