@skrr-ai/auth-core 0.1.3 → 0.1.4

package/dist/cjs/configRoot.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The skrr root — the single definition of where this machine keeps its skrr
+ * state.
+ *
+ * It lives here because BOTH binaries need the same answer and neither owns it.
+ * `skrr` and `skrrd` keep separate credentials on purpose, but they share one
+ * root, and every place that re-derived it became a place they could disagree.
+ * They did, twice in one day:
+ *
+ *   - The CLI's engine path honoured `OVERSKY_CONFIG_DIR` while its config did
+ *     not, so a relocated root moved the engine and left the credentials in
+ *     `$HOME`. Fixed by teaching `config.ts` the variable — which promptly
+ *     re-created the split in the mirror image, because `sky-code.ts` still read
+ *     only the old name.
+ *   - The daemon then had the same shape, and fixing the CLI's half turned it
+ *     into a CLI/daemon divergence: with the variable set, the two halves of one
+ *     product disagreed about where the credentials live.
+ *
+ * Each of those was a correct local fix that created the next defect, because
+ * the root was being DERIVED rather than READ. Teaching every site the same list
+ * of variable names only defers the problem to whenever the list changes again —
+ * which is exactly what `SKRR_CONFIG_DIR` did.
+ *
+ * So: one function, and a boundary test that fails if anything re-derives it.
+ *
+ * `SKRR_CONFIG_DIR` is the spelling for anything new (root `CLAUDE.md`) and wins
+ * when both are set. `OVERSKY_CONFIG_DIR` keeps working because existing installs,
+ * the engine resolver and the daemon all read it, and breaking a documented
+ * override to tidy a name would be a worse trade than carrying two.
+ *
+ * Takes `env` rather than reading the global so a caller can resolve a root for a
+ * child process it is about to spawn, and so tests need no process-wide mutation.
+ */
+export declare function resolveConfigRoot(env?: NodeJS.ProcessEnv): string;
+/** A path under the skrr root, e.g. `configRootPath(env, 'sky-code', 'bin')`. */
+export declare function configRootPath(env: NodeJS.ProcessEnv, ...segments: string[]): string;
+/**
+ * Has the operator explicitly relocated the root?
+ *
+ * A distinct question from "what is the root", and it has a real caller: the
+ * legacy-location fallbacks exist to find state left by an older layout under
+ * `$HOME`, and once someone has POINTED the root somewhere, guessing at
+ * `$HOME` is no longer a helpful fallback — it is a different machine's data.
+ *
+ * Shared for the same reason as `resolveConfigRoot`: this check was copied to
+ * three call sites, each spelling the variable list itself, so adding
+ * `SKRR_CONFIG_DIR` to the resolver silently left the copies answering the old
+ * question.
+ */
+export declare function isConfigRootOverridden(env?: NodeJS.ProcessEnv): boolean;

package/dist/cjs/configRoot.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveConfigRoot = resolveConfigRoot;
+exports.configRootPath = configRootPath;
+exports.isConfigRootOverridden = isConfigRootOverridden;
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * The skrr root — the single definition of where this machine keeps its skrr
+ * state.
+ *
+ * It lives here because BOTH binaries need the same answer and neither owns it.
+ * `skrr` and `skrrd` keep separate credentials on purpose, but they share one
+ * root, and every place that re-derived it became a place they could disagree.
+ * They did, twice in one day:
+ *
+ *   - The CLI's engine path honoured `OVERSKY_CONFIG_DIR` while its config did
+ *     not, so a relocated root moved the engine and left the credentials in
+ *     `$HOME`. Fixed by teaching `config.ts` the variable — which promptly
+ *     re-created the split in the mirror image, because `sky-code.ts` still read
+ *     only the old name.
+ *   - The daemon then had the same shape, and fixing the CLI's half turned it
+ *     into a CLI/daemon divergence: with the variable set, the two halves of one
+ *     product disagreed about where the credentials live.
+ *
+ * Each of those was a correct local fix that created the next defect, because
+ * the root was being DERIVED rather than READ. Teaching every site the same list
+ * of variable names only defers the problem to whenever the list changes again —
+ * which is exactly what `SKRR_CONFIG_DIR` did.
+ *
+ * So: one function, and a boundary test that fails if anything re-derives it.
+ *
+ * `SKRR_CONFIG_DIR` is the spelling for anything new (root `CLAUDE.md`) and wins
+ * when both are set. `OVERSKY_CONFIG_DIR` keeps working because existing installs,
+ * the engine resolver and the daemon all read it, and breaking a documented
+ * override to tidy a name would be a worse trade than carrying two.
+ *
+ * Takes `env` rather than reading the global so a caller can resolve a root for a
+ * child process it is about to spawn, and so tests need no process-wide mutation.
+ */
+function resolveConfigRoot(env = process.env) {
+    const override = (env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim();
+    return override || node_path_1.default.join((0, node_os_1.homedir)(), '.skrr');
+}
+/** A path under the skrr root, e.g. `configRootPath(env, 'sky-code', 'bin')`. */
+function configRootPath(env, ...segments) {
+    return node_path_1.default.join(resolveConfigRoot(env), ...segments);
+}
+/**
+ * Has the operator explicitly relocated the root?
+ *
+ * A distinct question from "what is the root", and it has a real caller: the
+ * legacy-location fallbacks exist to find state left by an older layout under
+ * `$HOME`, and once someone has POINTED the root somewhere, guessing at
+ * `$HOME` is no longer a helpful fallback — it is a different machine's data.
+ *
+ * Shared for the same reason as `resolveConfigRoot`: this check was copied to
+ * three call sites, each spelling the variable list itself, so adding
+ * `SKRR_CONFIG_DIR` to the resolver silently left the copies answering the old
+ * question.
+ */
+function isConfigRootOverridden(env = process.env) {
+    return Boolean((env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim());
+}

package/dist/cjs/index.d.ts

@@ -36,3 +36,4 @@ export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';
+export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/cjs/index.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -315,3 +315,9 @@ Object.defineProperty(exports, "resolveSkyCodeChannel", { enumerable: true, get:
 Object.defineProperty(exports, "skyCodeChannelPrefix", { enumerable: true, get: function () { return skyCodeChannels_js_1.skyCodeChannelPrefix; } });
 Object.defineProperty(exports, "skyCodeFeedBase", { enumerable: true, get: function () { return skyCodeChannels_js_1.skyCodeFeedBase; } });
 Object.defineProperty(exports, "SKY_CODE_FEED_BASE_ENV", { enumerable: true, get: function () { return skyCodeChannels_js_1.SKY_CODE_FEED_BASE_ENV; } });
+// The one definition of the skrr root, shared by `skrr` and `skrrd`. See the
+// module for why re-deriving it kept producing divergences.
+var configRoot_js_1 = require("./configRoot.js");
+Object.defineProperty(exports, "resolveConfigRoot", { enumerable: true, get: function () { return configRoot_js_1.resolveConfigRoot; } });
+Object.defineProperty(exports, "configRootPath", { enumerable: true, get: function () { return configRoot_js_1.configRootPath; } });
+Object.defineProperty(exports, "isConfigRootOverridden", { enumerable: true, get: function () { return configRoot_js_1.isConfigRootOverridden; } });

package/dist/esm/configRoot.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The skrr root — the single definition of where this machine keeps its skrr
+ * state.
+ *
+ * It lives here because BOTH binaries need the same answer and neither owns it.
+ * `skrr` and `skrrd` keep separate credentials on purpose, but they share one
+ * root, and every place that re-derived it became a place they could disagree.
+ * They did, twice in one day:
+ *
+ *   - The CLI's engine path honoured `OVERSKY_CONFIG_DIR` while its config did
+ *     not, so a relocated root moved the engine and left the credentials in
+ *     `$HOME`. Fixed by teaching `config.ts` the variable — which promptly
+ *     re-created the split in the mirror image, because `sky-code.ts` still read
+ *     only the old name.
+ *   - The daemon then had the same shape, and fixing the CLI's half turned it
+ *     into a CLI/daemon divergence: with the variable set, the two halves of one
+ *     product disagreed about where the credentials live.
+ *
+ * Each of those was a correct local fix that created the next defect, because
+ * the root was being DERIVED rather than READ. Teaching every site the same list
+ * of variable names only defers the problem to whenever the list changes again —
+ * which is exactly what `SKRR_CONFIG_DIR` did.
+ *
+ * So: one function, and a boundary test that fails if anything re-derives it.
+ *
+ * `SKRR_CONFIG_DIR` is the spelling for anything new (root `CLAUDE.md`) and wins
+ * when both are set. `OVERSKY_CONFIG_DIR` keeps working because existing installs,
+ * the engine resolver and the daemon all read it, and breaking a documented
+ * override to tidy a name would be a worse trade than carrying two.
+ *
+ * Takes `env` rather than reading the global so a caller can resolve a root for a
+ * child process it is about to spawn, and so tests need no process-wide mutation.
+ */
+export declare function resolveConfigRoot(env?: NodeJS.ProcessEnv): string;
+/** A path under the skrr root, e.g. `configRootPath(env, 'sky-code', 'bin')`. */
+export declare function configRootPath(env: NodeJS.ProcessEnv, ...segments: string[]): string;
+/**
+ * Has the operator explicitly relocated the root?
+ *
+ * A distinct question from "what is the root", and it has a real caller: the
+ * legacy-location fallbacks exist to find state left by an older layout under
+ * `$HOME`, and once someone has POINTED the root somewhere, guessing at
+ * `$HOME` is no longer a helpful fallback — it is a different machine's data.
+ *
+ * Shared for the same reason as `resolveConfigRoot`: this check was copied to
+ * three call sites, each spelling the variable list itself, so adding
+ * `SKRR_CONFIG_DIR` to the resolver silently left the copies answering the old
+ * question.
+ */
+export declare function isConfigRootOverridden(env?: NodeJS.ProcessEnv): boolean;

package/dist/esm/configRoot.js

@@ -0,0 +1,59 @@
+import { homedir } from 'node:os';
+import path from 'node:path';
+/**
+ * The skrr root — the single definition of where this machine keeps its skrr
+ * state.
+ *
+ * It lives here because BOTH binaries need the same answer and neither owns it.
+ * `skrr` and `skrrd` keep separate credentials on purpose, but they share one
+ * root, and every place that re-derived it became a place they could disagree.
+ * They did, twice in one day:
+ *
+ *   - The CLI's engine path honoured `OVERSKY_CONFIG_DIR` while its config did
+ *     not, so a relocated root moved the engine and left the credentials in
+ *     `$HOME`. Fixed by teaching `config.ts` the variable — which promptly
+ *     re-created the split in the mirror image, because `sky-code.ts` still read
+ *     only the old name.
+ *   - The daemon then had the same shape, and fixing the CLI's half turned it
+ *     into a CLI/daemon divergence: with the variable set, the two halves of one
+ *     product disagreed about where the credentials live.
+ *
+ * Each of those was a correct local fix that created the next defect, because
+ * the root was being DERIVED rather than READ. Teaching every site the same list
+ * of variable names only defers the problem to whenever the list changes again —
+ * which is exactly what `SKRR_CONFIG_DIR` did.
+ *
+ * So: one function, and a boundary test that fails if anything re-derives it.
+ *
+ * `SKRR_CONFIG_DIR` is the spelling for anything new (root `CLAUDE.md`) and wins
+ * when both are set. `OVERSKY_CONFIG_DIR` keeps working because existing installs,
+ * the engine resolver and the daemon all read it, and breaking a documented
+ * override to tidy a name would be a worse trade than carrying two.
+ *
+ * Takes `env` rather than reading the global so a caller can resolve a root for a
+ * child process it is about to spawn, and so tests need no process-wide mutation.
+ */
+export function resolveConfigRoot(env = process.env) {
+    const override = (env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim();
+    return override || path.join(homedir(), '.skrr');
+}
+/** A path under the skrr root, e.g. `configRootPath(env, 'sky-code', 'bin')`. */
+export function configRootPath(env, ...segments) {
+    return path.join(resolveConfigRoot(env), ...segments);
+}
+/**
+ * Has the operator explicitly relocated the root?
+ *
+ * A distinct question from "what is the root", and it has a real caller: the
+ * legacy-location fallbacks exist to find state left by an older layout under
+ * `$HOME`, and once someone has POINTED the root somewhere, guessing at
+ * `$HOME` is no longer a helpful fallback — it is a different machine's data.
+ *
+ * Shared for the same reason as `resolveConfigRoot`: this check was copied to
+ * three call sites, each spelling the variable list itself, so adding
+ * `SKRR_CONFIG_DIR` to the resolver silently left the copies answering the old
+ * question.
+ */
+export function isConfigRootOverridden(env = process.env) {
+    return Boolean((env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim());
+}

package/dist/esm/index.d.ts

@@ -36,3 +36,4 @@ export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';
+export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/esm/index.js

@@ -143,3 +143,6 @@ export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATI
    reads, copies or removes what it finds (§7.2, §8.4). */
 export { findLegacyLocalState, describeLegacyState, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, } from './skyCodeChannels.js';
+// The one definition of the skrr root, shared by `skrr` and `skrrd`. See the
+// module for why re-deriving it kept producing divergences.
+export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Shared auth substrate (token store, refresh, scheduler, fd handoff) for the OverSky daemon and CLI.",
   "type": "module",
   "main": "dist/cjs/index.js",