chore: import upstream snapshot with attribution

src/lib/machineToken.ts

@@ -0,0 +1,53 @@
+import { createHash, createHmac } from "node:crypto";
+
+let machineIdSync: (original?: boolean) => string;
+try {
+  // Use require() to bypass webpack static analysis that breaks the default export
+  const mod = require("node-machine-id");
+  machineIdSync = mod.machineIdSync || mod.default?.machineIdSync;
+} catch {
+  machineIdSync = () => "";
+}
+
+const BUILTIN_DEFAULT_SALT = "omniroute-cli-auth-v1";
+
+function getActiveSalt(): string {
+  return process.env.OMNIROUTE_CLI_SALT || BUILTIN_DEFAULT_SALT;
+}
+
+function deriveToken(rawId: string, salt: string): string {
+  return createHmac("sha256", rawId).update(salt).digest("hex");
+}
+
+let cached: string | null = null;
+let cachedSalt: string | null = null;
+
+export function getMachineTokenSync(salt?: string): string {
+  const activeSalt = salt ?? getActiveSalt();
+  try {
+    // machineIdSync(true) returns the original unhashed hardware ID.
+    const rawId = machineIdSync(true);
+    if (activeSalt === cachedSalt && cached !== null) return cached;
+    const token = deriveToken(rawId, activeSalt);
+    if (!salt) {
+      cached = token;
+      cachedSalt = activeSalt;
+    }
+    return token;
+  } catch {
+    return "";
+  }
+}
+
+export function getLegacyCliTokenSync(salt?: string): string {
+  const activeSalt = salt ?? getActiveSalt();
+  try {
+    const machineId = machineIdSync();
+    return createHash("sha256")
+      .update(machineId + activeSalt)
+      .digest("hex")
+      .substring(0, 32);
+  } catch {
+    return "";
+  }
+}