feat(agent): add durable existing-agent credential transitions

backend/app/agent_enrollment/service.py

@@ -9,6 +9,8 @@ from app.agent_enrollment.exceptions import (
     AgentEnrollmentCredentialCollision,
 )
 from app.agent_enrollment.models import (
+    AgentCredentialTransitionCreateRequest,
+    AgentCredentialTransitionRedeemRequest,
     AgentEnrollmentCreateRequest,
     AgentEnrollRequest,
 )
@@ -73,6 +75,31 @@ class AgentEnrollmentService:
             limit=limit,
         )
 
+    def create_credential_transition(
+        self,
+        request: AgentCredentialTransitionCreateRequest,
+        *,
+        actor_user_id: UUID,
+    ) -> dict:
+        for _ in range(MAX_GENERATION_ATTEMPTS):
+            token = generate_enrollment_token()
+            try:
+                transition = self.repository.create_credential_transition(
+                    token_hash=hash_agent_secret(token),
+                    target_agent_id=request.agent_id,
+                    actor_user_id=actor_user_id,
+                )
+                return {
+                    **transition,
+                    "transition_token": token,
+                }
+            except AgentEnrollmentCredentialCollision:
+                continue
+
+        raise AgentEnrollmentConflict(
+            "Unable to generate a unique credential transition token"
+        )
+
     def redeem(self, request: AgentEnrollRequest) -> dict:
         token_hash = hash_agent_secret(request.token)
 
@@ -96,3 +123,12 @@ class AgentEnrollmentService:
         raise AgentEnrollmentConflict(
             "Unable to generate unique Agent credentials"
         )
+
+    def redeem_credential_transition(
+        self,
+        request: AgentCredentialTransitionRedeemRequest,
+    ) -> dict:
+        return self.repository.redeem_credential_transition(
+            token_hash=hash_agent_secret(request.token),
+            agent_secret_hash=request.agent_secret_hash,
+        )