@skrr-ai/cli 0.1.89 → 0.1.91

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeBusyWire.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The Dedicated Runtime busy-report wire contract (power-control task K2,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §7.3 / §13.5).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so
+ * the capability name, the payload shape and its bounds live in this package,
+ * which every end can import (`@skrr-ai/auth-core/dedicated-runtime-busy-wire`).
+ * `dedicatedRuntimeBusyWire.test.ts` fails on a second spelling of the
+ * capability anywhere else in the repo.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "Does anything run in the tenant workload slice?" — read by the guest daemon
+ * from cgroup v2 `skrr-workload.slice`, recursively (the slice root is empty by
+ * contract; processes live in leaves), with the root-owned sshd listener left
+ * out. It is a LOCAL read summarised into counts; no per-process list ever
+ * crosses the wire.
+ *
+ * FAIL CLOSED. `busy` is `true | false | 'unknown'`. Any failure to read — a
+ * missing slice, an unreadable file, a tree too large to walk, a quiesce in
+ * progress, an sshd that is not where the image promises — is `'unknown'`, and
+ * a reader MUST treat `'unknown'` as busy. `false` is only ever the daemon
+ * having positively read an empty slice.
+ *
+ * THE POLICY KNOB (OPEN PRODUCT QUESTION — not decided here)
+ * ---------------------------------------------------------------------------
+ * An idle tmux server or a shell prompt keeps a leaf populated forever. The
+ * owner decision is that tmux/SSH shells ARE protected, but whether an IDLE
+ * shell should pin the machine is undecided. So the report carries both
+ * readings and the server chooses:
+ *
+ *   - `busy`                    the STRICT reading (`policy: 'strict'`): every
+ *                                process in the slice counts. This is the
+ *                                default and the only one a server should act
+ *                                on until the product question is answered.
+ *   - `busyIgnoringIdleShells`  the same read with the `idleShell` bucket
+ *                                removed. Classification is by process name
+ *                                (a shell or tmux with nothing else running),
+ *                                a HEURISTIC: it cannot see a shell loop, so
+ *                                it must never be the default.
+ *
+ * The `breakdown` says which bucket made it busy, for the "why" text.
+ */
+export declare const DEDICATED_RUNTIME_BUSY_REPORT_CAPABILITY = "dedicated_runtime_busy_report_v1";
+/** The heartbeat key the report rides under. Sent only by a daemon that announced the capability. */
+export declare const DEDICATED_RUNTIME_BUSY_HEARTBEAT_KEY = "dedicatedRuntimeBusy";
+export declare const DEDICATED_RUNTIME_BUSY_REPORT_VERSION = 1;
+/**
+ * `strict`: every process in the slice (less the root sshd listener) counts.
+ * The only value v1 sends; the field exists so a later relaxation is a new
+ * value rather than a silent change of meaning.
+ */
+export declare const DEDICATED_RUNTIME_BUSY_POLICIES: readonly ["strict"];
+export type DedicatedRuntimeBusyPolicy = (typeof DEDICATED_RUNTIME_BUSY_POLICIES)[number];
+/**
+ * Why the daemon could not give a definite answer, or `ok`. Anything but `ok`
+ * pairs with `busy: 'unknown'`.
+ */
+export declare const DEDICATED_RUNTIME_BUSY_SLICE_HEALTH: readonly ["ok", "not_a_guest", "slice_missing", "slice_unreadable", "ssh_not_in_slice", "tree_too_large", "quiesced", "read_error"];
+export type DedicatedRuntimeBusySliceHealth = (typeof DEDICATED_RUNTIME_BUSY_SLICE_HEALTH)[number];
+export declare const DEDICATED_RUNTIME_BUSY_LIMITS: {
+    /** Service leaf names carried for the "busy because of service X" text. */
+    readonly maxServiceNames: 8;
+    readonly maxServiceNameLength: 48;
+    /** Cgroup leaves the daemon will visit; more is `tree_too_large` -> unknown. */
+    readonly maxLeaves: 64;
+    readonly maxDepth: 4;
+    /** Processes the daemon classifies per read; the rest count as workload. */
+    readonly maxClassifiedPids: 256;
+    /** Hard ceiling on the serialized report. */
+    readonly maxSerializedBytes: 1024;
+};
+export interface DedicatedRuntimeBusyBreakdown {
+    /** Processes in non-service, non-ssh leaves (the `default` leaf, the slice root) that are not idle-shell class. */
+    workload: number;
+    /** Processes in `skrr-svc-*.scope` leaves: a declared service running, always-on by design. */
+    service: number;
+    /** SSH connection plumbing in `ssh.service` that is not the root listener (non-root sshd, the session helper) and other non-shell processes there. */
+    ssh: number;
+    /** Shell or tmux processes in `default` / `ssh.service` (heuristic by name; see header). */
+    idleShell: number;
+    /** Root-owned sshd processes left out of every count above. */
+    excludedSshd: number;
+    /** True when more processes existed than were classified; the rest are in `workload`. */
+    truncated: boolean;
+    /** Up to `maxServiceNames` service leaf names that have processes. */
+    services: string[];
+}
+export interface DedicatedRuntimeBusyReport {
+    version: typeof DEDICATED_RUNTIME_BUSY_REPORT_VERSION;
+    policy: DedicatedRuntimeBusyPolicy;
+    /** Strict reading. `'unknown'` MUST be treated as busy. */
+    busy: boolean | 'unknown';
+    /** Same read with the `idleShell` bucket removed; a heuristic, not the default. */
+    busyIgnoringIdleShells: boolean | 'unknown';
+    breakdown: DedicatedRuntimeBusyBreakdown;
+    /** ISO time the daemon read the slice. */
+    readAt: string;
+    sliceHealth: DedicatedRuntimeBusySliceHealth;
+}
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from
+ * a daemon that did not announce the capability, or oversized is `null`, and
+ * the caller must then treat the machine as busy. Never trusts a field it did
+ * not validate; a value is clamped, not coerced to "idle".
+ */
+export declare function parseDedicatedRuntimeBusyReport(raw: unknown): DedicatedRuntimeBusyReport | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeBusyWire.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * The Dedicated Runtime busy-report wire contract (power-control task K2,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §7.3 / §13.5).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so
+ * the capability name, the payload shape and its bounds live in this package,
+ * which every end can import (`@skrr-ai/auth-core/dedicated-runtime-busy-wire`).
+ * `dedicatedRuntimeBusyWire.test.ts` fails on a second spelling of the
+ * capability anywhere else in the repo.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "Does anything run in the tenant workload slice?" — read by the guest daemon
+ * from cgroup v2 `skrr-workload.slice`, recursively (the slice root is empty by
+ * contract; processes live in leaves), with the root-owned sshd listener left
+ * out. It is a LOCAL read summarised into counts; no per-process list ever
+ * crosses the wire.
+ *
+ * FAIL CLOSED. `busy` is `true | false | 'unknown'`. Any failure to read — a
+ * missing slice, an unreadable file, a tree too large to walk, a quiesce in
+ * progress, an sshd that is not where the image promises — is `'unknown'`, and
+ * a reader MUST treat `'unknown'` as busy. `false` is only ever the daemon
+ * having positively read an empty slice.
+ *
+ * THE POLICY KNOB (OPEN PRODUCT QUESTION — not decided here)
+ * ---------------------------------------------------------------------------
+ * An idle tmux server or a shell prompt keeps a leaf populated forever. The
+ * owner decision is that tmux/SSH shells ARE protected, but whether an IDLE
+ * shell should pin the machine is undecided. So the report carries both
+ * readings and the server chooses:
+ *
+ *   - `busy`                    the STRICT reading (`policy: 'strict'`): every
+ *                                process in the slice counts. This is the
+ *                                default and the only one a server should act
+ *                                on until the product question is answered.
+ *   - `busyIgnoringIdleShells`  the same read with the `idleShell` bucket
+ *                                removed. Classification is by process name
+ *                                (a shell or tmux with nothing else running),
+ *                                a HEURISTIC: it cannot see a shell loop, so
+ *                                it must never be the default.
+ *
+ * The `breakdown` says which bucket made it busy, for the "why" text.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_RUNTIME_BUSY_LIMITS = exports.DEDICATED_RUNTIME_BUSY_SLICE_HEALTH = exports.DEDICATED_RUNTIME_BUSY_POLICIES = exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION = exports.DEDICATED_RUNTIME_BUSY_HEARTBEAT_KEY = exports.DEDICATED_RUNTIME_BUSY_REPORT_CAPABILITY = void 0;
+exports.parseDedicatedRuntimeBusyReport = parseDedicatedRuntimeBusyReport;
+exports.DEDICATED_RUNTIME_BUSY_REPORT_CAPABILITY = 'dedicated_runtime_busy_report_v1';
+/** The heartbeat key the report rides under. Sent only by a daemon that announced the capability. */
+exports.DEDICATED_RUNTIME_BUSY_HEARTBEAT_KEY = 'dedicatedRuntimeBusy';
+exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION = 1;
+/**
+ * `strict`: every process in the slice (less the root sshd listener) counts.
+ * The only value v1 sends; the field exists so a later relaxation is a new
+ * value rather than a silent change of meaning.
+ */
+exports.DEDICATED_RUNTIME_BUSY_POLICIES = ['strict'];
+/**
+ * Why the daemon could not give a definite answer, or `ok`. Anything but `ok`
+ * pairs with `busy: 'unknown'`.
+ */
+exports.DEDICATED_RUNTIME_BUSY_SLICE_HEALTH = [
+    'ok',
+    'not_a_guest',
+    'slice_missing',
+    'slice_unreadable',
+    'ssh_not_in_slice',
+    'tree_too_large',
+    'quiesced',
+    'read_error',
+];
+exports.DEDICATED_RUNTIME_BUSY_LIMITS = {
+    /** Service leaf names carried for the "busy because of service X" text. */
+    maxServiceNames: 8,
+    maxServiceNameLength: 48,
+    /** Cgroup leaves the daemon will visit; more is `tree_too_large` -> unknown. */
+    maxLeaves: 64,
+    maxDepth: 4,
+    /** Processes the daemon classifies per read; the rest count as workload. */
+    maxClassifiedPids: 256,
+    /** Hard ceiling on the serialized report. */
+    maxSerializedBytes: 1024,
+};
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from
+ * a daemon that did not announce the capability, or oversized is `null`, and
+ * the caller must then treat the machine as busy. Never trusts a field it did
+ * not validate; a value is clamped, not coerced to "idle".
+ */
+function parseDedicatedRuntimeBusyReport(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    if (r.version !== exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION)
+        return null;
+    if (!exports.DEDICATED_RUNTIME_BUSY_POLICIES.includes(r.policy))
+        return null;
+    const tri = (v) => v === true || v === false || v === 'unknown' ? v : undefined;
+    const busy = tri(r.busy);
+    const ignoring = tri(r.busyIgnoringIdleShells);
+    if (busy === undefined || ignoring === undefined)
+        return null;
+    if (!exports.DEDICATED_RUNTIME_BUSY_SLICE_HEALTH.includes(r.sliceHealth)) {
+        return null;
+    }
+    const readAtMs = typeof r.readAt === 'string' ? Date.parse(r.readAt) : NaN;
+    if (!Number.isFinite(readAtMs))
+        return null;
+    const b = r.breakdown;
+    if (!b || typeof b !== 'object')
+        return null;
+    const count = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0 ? v : null;
+    const workload = count(b.workload);
+    const service = count(b.service);
+    const ssh = count(b.ssh);
+    const idleShell = count(b.idleShell);
+    const excludedSshd = count(b.excludedSshd);
+    if (workload === null ||
+        service === null ||
+        ssh === null ||
+        idleShell === null ||
+        excludedSshd === null ||
+        typeof b.truncated !== 'boolean' ||
+        !Array.isArray(b.services)) {
+        return null;
+    }
+    const services = b.services
+        .filter((s) => typeof s === 'string')
+        .slice(0, exports.DEDICATED_RUNTIME_BUSY_LIMITS.maxServiceNames)
+        .map((s) => s.slice(0, exports.DEDICATED_RUNTIME_BUSY_LIMITS.maxServiceNameLength));
+    const report = {
+        version: exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION,
+        policy: r.policy,
+        busy,
+        busyIgnoringIdleShells: ignoring,
+        breakdown: {
+            workload,
+            service,
+            ssh,
+            idleShell,
+            excludedSshd,
+            truncated: b.truncated,
+            services,
+        },
+        readAt: new Date(readAtMs).toISOString(),
+        sliceHealth: r.sliceHealth,
+    };
+    if (JSON.stringify(report).length > exports.DEDICATED_RUNTIME_BUSY_LIMITS.maxSerializedBytes)
+        return null;
+    return report;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeWakeWire.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The Dedicated Runtime wake-progress wire contract (power-control task W5,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §5.3, §7.2, §9).
+ *
+ * Declared ONCE, here, for the same reason `computerWire.ts` is: the browser,
+ * the React Native app and the CLI import it, and none of them may spell the
+ * event, the capability or a code a second time. `dedicatedRuntimeWakeWire.test.ts`
+ * fails on a second spelling in the API.
+ *
+ * WHAT IT IS
+ * ---------------------------------------------------------------------------
+ * A person opens a terminal, an SSH channel, a service call or the Computer on a
+ * STOPPED Dedicated Runtime. That is wake progress, not an error: the relay asks
+ * `requestWake` (source `person`) to start the machine, then tells THAT request,
+ * in stages, how far the start has got, until the machine is assignable and the
+ * original request is served, or a bound runs out and it says why and what to do.
+ *
+ * THE CLIENT ANNOUNCES IT
+ * ---------------------------------------------------------------------------
+ * A client that has not announced `dedicated_wake_progress_v1` in the open
+ * request's `capabilities` array is NEVER sent `dedicated:wake:progress` and is
+ * never made to wait: it gets an immediate typed refusal instead. (A client
+ * socket has no registration step to announce on, so the announcement rides each
+ * request — stateless, nothing held in the relay.)
+ *
+ * THE VOCABULARY
+ * ---------------------------------------------------------------------------
+ * `phase` uses the cold-start measurement's phase names
+ * (`scripts/dedicated-runtime/measure-cold-start.js` `COLD_START_PHASES`), so
+ * what the person sees and what F4 measures are the same words. A spec holds the
+ * two lists equal.
+ *
+ * NOT A SPINNER WITHOUT A BOUND
+ * ---------------------------------------------------------------------------
+ * `boundMs` is carried on every event so a surface can show elapsed-of-bound.
+ * The bound sits ABOVE a slow-but-working start (design §9): running out says
+ * "this is taking longer than expected" and the machine is left starting; it is
+ * never an accusation that the machine is dead.
+ */
+/** API -> client, on the same socket as the request it belongs to. */
+export declare const DEDICATED_WAKE_EVENTS: {
+    readonly progress: "dedicated:wake:progress";
+};
+/** Announced in the open request's `capabilities` array. */
+export declare const DEDICATED_WAKE_CAPABILITIES: {
+    readonly progress: "dedicated_wake_progress_v1";
+};
+export type DedicatedWakeCapability = (typeof DEDICATED_WAKE_CAPABILITIES)[keyof typeof DEDICATED_WAKE_CAPABILITIES];
+/** Same names, same order as `WAKE_PHASES` in api/server/services/DedicatedRuntime/wakePhases.js (pinned by a test). */
+export declare const DEDICATED_WAKE_PHASES: readonly ["start_requested", "provider_start_accepted", "instance_running", "daemon_connected", "first_heartbeat", "assignable"];
+export type DedicatedWakePhase = (typeof DEDICATED_WAKE_PHASES)[number];
+/**
+ * - `waking`    a start is in flight; `phase` says how far.
+ * - `ready`     assignable; the original request is about to be served.
+ * - `deferred`  the machine is stopping; nothing was started. Retry after `retryAfterSeconds`.
+ * - `refused`   the start was refused, with `code`, `reason`, `detail`, `fix`.
+ * - `timed_out` the bound ran out while it was still starting. Not a failure of the machine.
+ */
+export declare const DEDICATED_WAKE_STATES: readonly ["waking", "ready", "deferred", "refused", "timed_out"];
+export type DedicatedWakeState = (typeof DEDICATED_WAKE_STATES)[number];
+/** The surfaces a wake can be asked from. */
+export declare const DEDICATED_WAKE_SURFACES: readonly ["terminal", "ssh", "services", "templates", "computer", "http"];
+export type DedicatedWakeSurface = (typeof DEDICATED_WAKE_SURFACES)[number];
+/**
+ * Typed refusals. Each is a different fact with a different next step; none of
+ * them is the generic "Dedicated Runtime dispatch was refused".
+ */
+export declare const DEDICATED_WAKE_CODES: {
+    /** Stopped, and this request did not (or could not) wake it. */
+    readonly stopped: "DEDICATED_RUNTIME_STOPPED";
+    /** A stop is finishing; retry when it has. */
+    readonly stopping: "DEDICATED_RUNTIME_STOPPING";
+    /** A start is in flight (ours or someone's). */
+    readonly starting: "DEDICATED_RUNTIME_STARTING";
+    /** The bound ran out while it was still starting. */
+    readonly timeout: "DEDICATED_RUNTIME_WAKE_TIMEOUT";
+    /** The start was refused: the plan no longer includes the machine. */
+    readonly entitlement: "DEDICATED_RUNTIME_WAKE_REFUSED_ENTITLEMENT";
+    /** The start was refused: the spend cap was reached. */
+    readonly spendCap: "DEDICATED_RUNTIME_WAKE_REFUSED_SPEND_CAP";
+    /** Any other refusal; `reason` names it. */
+    readonly refused: "DEDICATED_RUNTIME_WAKE_REFUSED";
+    /** The start was requested and the machine fell back to stopped or failed. */
+    readonly failed: "DEDICATED_RUNTIME_WAKE_FAILED";
+};
+export type DedicatedWakeCode = (typeof DEDICATED_WAKE_CODES)[keyof typeof DEDICATED_WAKE_CODES];
+/**
+ * How long a surface waits for a start before saying it is taking longer than
+ * expected. Above the slow-but-working case: a cold start on a fresh guest
+ * takes 25-30 s for the browser alone, and the AMI boot is longer. It is a
+ * bound on what we show, never a verdict on the machine.
+ */
+export declare const DEDICATED_WAKE_BOUND_MS = 180000;
+/** How often the relay re-reads the lease while waiting. */
+export declare const DEDICATED_WAKE_POLL_MS = 2000;
+export interface DedicatedWakeProgress {
+    leaseId: string;
+    surface: DedicatedWakeSurface;
+    /** The id of the request this belongs to (`requestId`, `channelId`, ...). */
+    ref?: string;
+    state: DedicatedWakeState;
+    /** Present while `waking`, and on `timed_out` (where the machine had got to). */
+    phase?: DedicatedWakePhase;
+    elapsedMs: number;
+    boundMs: number;
+    /** Power reason (e.g. `wake_refused_spend_cap`) or a lifecycle reason. */
+    reason?: string;
+    /** One of `DEDICATED_WAKE_CODES` on `refused`, `deferred` and `timed_out`. */
+    code?: DedicatedWakeCode;
+    detail?: string;
+    /** What the person can do next. */
+    fix?: string | null;
+    retryAfterSeconds?: number;
+}
+export declare function clientAnnouncesWakeProgress(capabilities: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeWakeWire.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * The Dedicated Runtime wake-progress wire contract (power-control task W5,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §5.3, §7.2, §9).
+ *
+ * Declared ONCE, here, for the same reason `computerWire.ts` is: the browser,
+ * the React Native app and the CLI import it, and none of them may spell the
+ * event, the capability or a code a second time. `dedicatedRuntimeWakeWire.test.ts`
+ * fails on a second spelling in the API.
+ *
+ * WHAT IT IS
+ * ---------------------------------------------------------------------------
+ * A person opens a terminal, an SSH channel, a service call or the Computer on a
+ * STOPPED Dedicated Runtime. That is wake progress, not an error: the relay asks
+ * `requestWake` (source `person`) to start the machine, then tells THAT request,
+ * in stages, how far the start has got, until the machine is assignable and the
+ * original request is served, or a bound runs out and it says why and what to do.
+ *
+ * THE CLIENT ANNOUNCES IT
+ * ---------------------------------------------------------------------------
+ * A client that has not announced `dedicated_wake_progress_v1` in the open
+ * request's `capabilities` array is NEVER sent `dedicated:wake:progress` and is
+ * never made to wait: it gets an immediate typed refusal instead. (A client
+ * socket has no registration step to announce on, so the announcement rides each
+ * request — stateless, nothing held in the relay.)
+ *
+ * THE VOCABULARY
+ * ---------------------------------------------------------------------------
+ * `phase` uses the cold-start measurement's phase names
+ * (`scripts/dedicated-runtime/measure-cold-start.js` `COLD_START_PHASES`), so
+ * what the person sees and what F4 measures are the same words. A spec holds the
+ * two lists equal.
+ *
+ * NOT A SPINNER WITHOUT A BOUND
+ * ---------------------------------------------------------------------------
+ * `boundMs` is carried on every event so a surface can show elapsed-of-bound.
+ * The bound sits ABOVE a slow-but-working start (design §9): running out says
+ * "this is taking longer than expected" and the machine is left starting; it is
+ * never an accusation that the machine is dead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_WAKE_POLL_MS = exports.DEDICATED_WAKE_BOUND_MS = exports.DEDICATED_WAKE_CODES = exports.DEDICATED_WAKE_SURFACES = exports.DEDICATED_WAKE_STATES = exports.DEDICATED_WAKE_PHASES = exports.DEDICATED_WAKE_CAPABILITIES = exports.DEDICATED_WAKE_EVENTS = void 0;
+exports.clientAnnouncesWakeProgress = clientAnnouncesWakeProgress;
+/** API -> client, on the same socket as the request it belongs to. */
+exports.DEDICATED_WAKE_EVENTS = {
+    progress: 'dedicated:wake:progress',
+};
+/** Announced in the open request's `capabilities` array. */
+exports.DEDICATED_WAKE_CAPABILITIES = {
+    progress: 'dedicated_wake_progress_v1',
+};
+/** Same names, same order as `WAKE_PHASES` in api/server/services/DedicatedRuntime/wakePhases.js (pinned by a test). */
+exports.DEDICATED_WAKE_PHASES = [
+    'start_requested',
+    'provider_start_accepted',
+    'instance_running',
+    'daemon_connected',
+    'first_heartbeat',
+    'assignable',
+];
+/**
+ * - `waking`    a start is in flight; `phase` says how far.
+ * - `ready`     assignable; the original request is about to be served.
+ * - `deferred`  the machine is stopping; nothing was started. Retry after `retryAfterSeconds`.
+ * - `refused`   the start was refused, with `code`, `reason`, `detail`, `fix`.
+ * - `timed_out` the bound ran out while it was still starting. Not a failure of the machine.
+ */
+exports.DEDICATED_WAKE_STATES = [
+    'waking',
+    'ready',
+    'deferred',
+    'refused',
+    'timed_out',
+];
+/** The surfaces a wake can be asked from. */
+exports.DEDICATED_WAKE_SURFACES = [
+    'terminal',
+    'ssh',
+    'services',
+    'templates',
+    'computer',
+    'http',
+];
+/**
+ * Typed refusals. Each is a different fact with a different next step; none of
+ * them is the generic "Dedicated Runtime dispatch was refused".
+ */
+exports.DEDICATED_WAKE_CODES = {
+    /** Stopped, and this request did not (or could not) wake it. */
+    stopped: 'DEDICATED_RUNTIME_STOPPED',
+    /** A stop is finishing; retry when it has. */
+    stopping: 'DEDICATED_RUNTIME_STOPPING',
+    /** A start is in flight (ours or someone's). */
+    starting: 'DEDICATED_RUNTIME_STARTING',
+    /** The bound ran out while it was still starting. */
+    timeout: 'DEDICATED_RUNTIME_WAKE_TIMEOUT',
+    /** The start was refused: the plan no longer includes the machine. */
+    entitlement: 'DEDICATED_RUNTIME_WAKE_REFUSED_ENTITLEMENT',
+    /** The start was refused: the spend cap was reached. */
+    spendCap: 'DEDICATED_RUNTIME_WAKE_REFUSED_SPEND_CAP',
+    /** Any other refusal; `reason` names it. */
+    refused: 'DEDICATED_RUNTIME_WAKE_REFUSED',
+    /** The start was requested and the machine fell back to stopped or failed. */
+    failed: 'DEDICATED_RUNTIME_WAKE_FAILED',
+};
+/**
+ * How long a surface waits for a start before saying it is taking longer than
+ * expected. Above the slow-but-working case: a cold start on a fresh guest
+ * takes 25-30 s for the browser alone, and the AMI boot is longer. It is a
+ * bound on what we show, never a verdict on the machine.
+ */
+exports.DEDICATED_WAKE_BOUND_MS = 180_000;
+/** How often the relay re-reads the lease while waiting. */
+exports.DEDICATED_WAKE_POLL_MS = 2_000;
+function clientAnnouncesWakeProgress(capabilities) {
+    return Array.isArray(capabilities) && capabilities.includes(exports.DEDICATED_WAKE_CAPABILITIES.progress);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -30,7 +30,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
-export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
-exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
-exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = void 0;
+exports.qualifyMachineUuid = exports.getMachineUuidProfile = exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
+exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -284,6 +284,11 @@ Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable:
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
 var machineUuid_js_1 = require("./machineUuid.js");
 Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
+Object.defineProperty(exports, "getHardwareMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getHardwareMachineUuid; } });
+Object.defineProperty(exports, "setMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.setMachineUuidProfile; } });
+Object.defineProperty(exports, "getMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidProfile; } });
+Object.defineProperty(exports, "qualifyMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.qualifyMachineUuid; } });
+Object.defineProperty(exports, "MACHINE_IDENTITY_FILENAME", { enumerable: true, get: function () { return machineUuid_js_1.MACHINE_IDENTITY_FILENAME; } });
 Object.defineProperty(exports, "hostedRuntimeIdOverride", { enumerable: true, get: function () { return machineUuid_js_1.hostedRuntimeIdOverride; } });
 Object.defineProperty(exports, "HOSTED_RUNTIME_MACHINE_SOURCES", { enumerable: true, get: function () { return machineUuid_js_1.HOSTED_RUNTIME_MACHINE_SOURCES; } });
 Object.defineProperty(exports, "__resetMachineUuidCacheForTest", { enumerable: true, get: function () { return machineUuid_js_1.__resetMachineUuidCacheForTest; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.d.ts

@@ -18,19 +18,43 @@ export declare const HOSTED_RUNTIME_MACHINE_SOURCES: ReadonlySet<string>;
  */
 export declare function hostedRuntimeIdOverride(name: string, env?: NodeJS.ProcessEnv): string | null;
 /**
- * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ * The HARDWARE identity of this machine (IOPlatformUUID / machine-id /
+ * MachineGuid, or a control-plane-issued value on a hosted runtime). Cached for
+ * the process lifetime. Same machine -> same value across reboots.
  *
- * Callers should treat this as opaque: the format differs per platform
- * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
- * The guarantee is only: same machine -> same value across reboots, and the
- * same value from every binary that calls this function.
- *
- * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ * Almost nothing should call this: `getMachineUuid()` is what goes on the wire,
+ * and it equals this for the default profile.
  *
  * Falls back to a deterministic hostname+username hash if the platform
  * probe fails. This preserves server-side record continuity even on
  * locked-down machines that refuse ioreg / registry access.
  */
+export declare function getHardwareMachineUuid(): string;
+/** The profile's persisted machine-identity choice, beside its other state. */
+export declare const MACHINE_IDENTITY_FILENAME = "machine-identity.json";
+/** The server caps `machineUuid` at 64 characters; 36 + 15 fits, and so does a 41-character fallback. */
+export declare function qualifyMachineUuid(hardware: string, profile: string): string;
+/**
+ * Tell this module which profile the process runs as. Called wherever a binary
+ * resolves its profile (`setActiveProfile` in the daemon and in the CLI), so the
+ * identity cannot depend on call order. `null`, '' and the default profile all
+ * mean "the hardware identity".
+ */
+export declare function setMachineUuidProfile(profile: string | null | undefined): void;
+export declare function getMachineUuidProfile(): string | null;
+/**
+ * Return the `machineUuid` this process sends to the server.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid), and a
+ * non-default profile that started new carries a `:p-<hash>` suffix. The
+ * guarantee is only: same machine + same profile -> same value across reboots,
+ * and the same value from every binary of that profile that calls this function.
+ *
+ * Equals the hardware identity for the default profile, for a hosted runtime
+ * (the control-plane-issued `OVERSKY_MACHINE_UUID` wins) and for a non-default
+ * profile that already held credentials; see the block above.
+ */
 export declare function getMachineUuid(): string;
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export declare function __resetMachineUuidCacheForTest(): void;