@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -1,445 +1,570 @@
 "use strict";
-/**
- * @skrr-ai/auth-core — shared auth substrate.
- *
- * Public surface for the OverSky daemon, Sky CLI, and Electron main
- * process. Each consumer calls `configureAuthCore()` once at startup to
- * wire up its logger, config dir, kill switches, and binary name — then
- * uses the rest of the API uniformly.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
-exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
-exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.describeMachineIdentity = exports.getMachineUuidForProfile = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
-exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = exports.qualifyMachineUuid = exports.getMachineUuidProfile = void 0;
-exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = void 0;
-// Daemon scope vocabulary — single source of truth for non-Mongoose tiers
-// (daemon, desktop, cli). Schema-bound canonical lives in
-// `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
-// by the api-side parity test. See daemonScopes.ts header for details.
-var daemonScopes_js_1 = require("./daemonScopes.js");
-Object.defineProperty(exports, "SCOPES", { enumerable: true, get: function () { return daemonScopes_js_1.SCOPES; } });
-Object.defineProperty(exports, "ALL_DAEMON_SCOPES", { enumerable: true, get: function () { return daemonScopes_js_1.ALL_DAEMON_SCOPES; } });
-Object.defineProperty(exports, "VALID_DAEMON_SCOPE_SET", { enumerable: true, get: function () { return daemonScopes_js_1.VALID_DAEMON_SCOPE_SET; } });
-Object.defineProperty(exports, "isDaemonScope", { enumerable: true, get: function () { return daemonScopes_js_1.isDaemonScope; } });
-Object.defineProperty(exports, "OAUTH_CLI_SCOPE", { enumerable: true, get: function () { return daemonScopes_js_1.OAUTH_CLI_SCOPE; } });
-// Runtime / DI
-var runtime_js_1 = require("./runtime.js");
-Object.defineProperty(exports, "configureAuthCore", { enumerable: true, get: function () { return runtime_js_1.configureAuthCore; } });
-Object.defineProperty(exports, "getAuthLogger", { enumerable: true, get: function () { return runtime_js_1.getAuthLogger; } });
-Object.defineProperty(exports, "getAuthConfigDir", { enumerable: true, get: function () { return runtime_js_1.getAuthConfigDir; } });
-Object.defineProperty(exports, "getAuthKillSwitches", { enumerable: true, get: function () { return runtime_js_1.getAuthKillSwitches; } });
-Object.defineProperty(exports, "getAuthBinaryName", { enumerable: true, get: function () { return runtime_js_1.getAuthBinaryName; } });
-Object.defineProperty(exports, "emitAuthTelemetry", { enumerable: true, get: function () { return runtime_js_1.emitAuthTelemetry; } });
-// Types
-var types_js_1 = require("./types.js");
-Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get: function () { return types_js_1.PermanentAuthFailure; } });
-Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return types_js_1.TransientAuthFailure; } });
-// JWT helpers
-var jwtUtils_js_1 = require("./jwtUtils.js");
-Object.defineProperty(exports, "decodeJwtExpiry", { enumerable: true, get: function () { return jwtUtils_js_1.decodeJwtExpiry; } });
-Object.defineProperty(exports, "decodeJwtPayload", { enumerable: true, get: function () { return jwtUtils_js_1.decodeJwtPayload; } });
-// Mid-stream auth-expired SSE detector — recognises terminal "auth_expired"
-// events from long-lived SSE / Socket.IO streams and orchestrates a
-// refresher-driven recovery. Mobile RN keeps a byte-equal mirror; see file
-// header.
-var authExpiredDetector_js_1 = require("./authExpiredDetector.js");
-Object.defineProperty(exports, "isAuthExpiredSseEvent", { enumerable: true, get: function () { return authExpiredDetector_js_1.isAuthExpiredSseEvent; } });
-Object.defineProperty(exports, "handleMidStreamAuthExpiry", { enumerable: true, get: function () { return authExpiredDetector_js_1.handleMidStreamAuthExpiry; } });
-// Reauth messaging
-var messages_js_1 = require("./messages.js");
-Object.defineProperty(exports, "formatReauthMessage", { enumerable: true, get: function () { return messages_js_1.formatReauthMessage; } });
-Object.defineProperty(exports, "reauthCommand", { enumerable: true, get: function () { return messages_js_1.reauthCommand; } });
-Object.defineProperty(exports, "EXIT_NEEDS_REAUTH", { enumerable: true, get: function () { return messages_js_1.EXIT_NEEDS_REAUTH; } });
-// Pure HTTP→{Permanent, Transient, Success} response classification —
-// exposed so RN-side clients can apply the same mapping daemon uses.
-var refreshClassification_js_1 = require("./refreshClassification.js");
-Object.defineProperty(exports, "classifyRefreshResponse", { enumerable: true, get: function () { return refreshClassification_js_1.classifyRefreshResponse; } });
-// Refresh
-var refresh_js_1 = require("./refresh.js");
-Object.defineProperty(exports, "refreshDaemonToken", { enumerable: true, get: function () { return refresh_js_1.refreshDaemonToken; } });
-Object.defineProperty(exports, "revokeDaemonRefreshSession", { enumerable: true, get: function () { return refresh_js_1.revokeDaemonRefreshSession; } });
-Object.defineProperty(exports, "withAuthLock", { enumerable: true, get: function () { return refresh_js_1.withAuthLock; } });
-Object.defineProperty(exports, "persistReauthState", { enumerable: true, get: function () { return refresh_js_1.persistReauthState; } });
-Object.defineProperty(exports, "needsReauthState", { enumerable: true, get: function () { return refresh_js_1.needsReauthState; } });
-Object.defineProperty(exports, "clearReauthState", { enumerable: true, get: function () { return refresh_js_1.clearReauthState; } });
-Object.defineProperty(exports, "installLockExitHandlers", { enumerable: true, get: function () { return refresh_js_1.installLockExitHandlers; } });
-// H1 — Test-only diagnostic counters that prove every outgoing
-// refresh request mints a fresh proof. Production code never reads
-// this; tests use it to assert the per-attempt invariant.
-Object.defineProperty(exports, "__refreshDiagnostics", { enumerable: true, get: function () { return refresh_js_1.__refreshDiagnostics; } });
-// Finding 4 — Test-only reset for the per-daemonId unknown-shape-401
-// retry budget. Lets tests start each case with a clean streak.
-Object.defineProperty(exports, "__resetUnknown401StreaksForTest", { enumerable: true, get: function () { return refresh_js_1.__resetUnknown401StreaksForTest; } });
-// Finding 4 follow-up (BOOT-BUDGET COUPLING) — consumed by the daemon's
-// startup-recovery loop to statically assert
-// `STARTUP_RECOVERY_MAX_ATTEMPTS >= UNKNOWN_401_BUDGET` so the in-process
-// unknown-401 latch always fires before the boot loop yields to the
-// supervisor. See daemon/src/auth.ts.
-Object.defineProperty(exports, "UNKNOWN_401_BUDGET", { enumerable: true, get: function () { return refresh_js_1.UNKNOWN_401_BUDGET; } });
-// Refresh scheduler
-var refreshScheduler_js_1 = require("./refreshScheduler.js");
-Object.defineProperty(exports, "createRefreshScheduler", { enumerable: true, get: function () { return refreshScheduler_js_1.createRefreshScheduler; } });
-// Fd handoff
-var fdToken_js_1 = require("./fdToken.js");
-Object.defineProperty(exports, "readAuthFromFd", { enumerable: true, get: function () { return fdToken_js_1.readAuthFromFd; } });
-Object.defineProperty(exports, "__setFdReaderForTest", { enumerable: true, get: function () { return fdToken_js_1.__setFdReaderForTest; } });
-// Credential resolver — Phase H precedence chain + Phase I tokenKind
-var credentialResolver_js_1 = require("./credentialResolver.js");
-Object.defineProperty(exports, "CredentialResolver", { enumerable: true, get: function () { return credentialResolver_js_1.CredentialResolver; } });
-Object.defineProperty(exports, "CREDENTIAL_PRECEDENCE", { enumerable: true, get: function () { return credentialResolver_js_1.CREDENTIAL_PRECEDENCE; } });
-Object.defineProperty(exports, "__resetCredentialResolverForTest", { enumerable: true, get: function () { return credentialResolver_js_1.__resetCredentialResolverForTest; } });
-// H3-6 — public seam 401 handlers call to bust the helper cache so
-// the next resolve re-invokes OVERSKY_AUTH_HELPER immediately
-// instead of serving the stale cached token for up to its TTL.
-Object.defineProperty(exports, "invalidateAuthHelperCache", { enumerable: true, get: function () { return credentialResolver_js_1.invalidateAuthHelperCache; } });
-Object.defineProperty(exports, "classifyTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.classifyTokenKind; } });
-Object.defineProperty(exports, "CI_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.CI_TOKEN_PREFIX; } });
-Object.defineProperty(exports, "PERSONAL_ACCESS_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.PERSONAL_ACCESS_TOKEN_PREFIX; } });
-Object.defineProperty(exports, "isStaticTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.isStaticTokenKind; } });
-// L6.1 / L6.3 — fail-closed errors thrown by the auth-helper slot.
-Object.defineProperty(exports, "AuthHelperUntrustedError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUntrustedError; } });
-Object.defineProperty(exports, "AuthHelperUnavailableError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUnavailableError; } });
-// Auth helper — invocation contract for OVERSKY_AUTH_HELPER
-var authHelper_js_1 = require("./authHelper.js");
-Object.defineProperty(exports, "invokeAuthHelper", { enumerable: true, get: function () { return authHelper_js_1.invokeAuthHelper; } });
-Object.defineProperty(exports, "getDefaultHelperTtlMs", { enumerable: true, get: function () { return authHelper_js_1.getDefaultHelperTtlMs; } });
-Object.defineProperty(exports, "getLastAuthHelperFailureReason", { enumerable: true, get: function () { return authHelper_js_1.getLastAuthHelperFailureReason; } });
-Object.defineProperty(exports, "__resetAuthHelperFailureReasonForTest", { enumerable: true, get: function () { return authHelper_js_1.__resetAuthHelperFailureReasonForTest; } });
-Object.defineProperty(exports, "SENTINEL_TRIGGERING_FAILURES", { enumerable: true, get: function () { return authHelper_js_1.SENTINEL_TRIGGERING_FAILURES; } });
-// Headers helper — invocation contract for OVERSKY_HEADERS_HELPER
-// (authenticates OverSky to outbound MCP servers)
-var headers_helper_js_1 = require("./headers-helper.js");
-Object.defineProperty(exports, "runHeadersHelper", { enumerable: true, get: function () { return headers_helper_js_1.runHeadersHelper; } });
-Object.defineProperty(exports, "invalidateHeadersHelperCache", { enumerable: true, get: function () { return headers_helper_js_1.invalidateHeadersHelperCache; } });
-// PKCE — RFC 7636 primitives for the Phase H.0 localhost-callback login.
-// Keep `safeEqual` and `verifyChallenge` exported even though they are
-// server-side concerns: server code consumes auth-core via the same
-// public surface and the alternative (a separate server-only module)
-// fragments the spec implementation across two locations.
-var pkce_js_1 = require("./pkce.js");
-Object.defineProperty(exports, "generateVerifier", { enumerable: true, get: function () { return pkce_js_1.generateVerifier; } });
-Object.defineProperty(exports, "challenge", { enumerable: true, get: function () { return pkce_js_1.challenge; } });
-Object.defineProperty(exports, "generateState", { enumerable: true, get: function () { return pkce_js_1.generateState; } });
-Object.defineProperty(exports, "safeEqual", { enumerable: true, get: function () { return pkce_js_1.safeEqual; } });
-Object.defineProperty(exports, "verifyChallenge", { enumerable: true, get: function () { return pkce_js_1.verifyChallenge; } });
-// Local 127.0.0.1 callback server — Phase H.0.2.
-// Keep error classes exported; callers branch on them to decide
-// fallback behavior (BindError → retry on different port; TimeoutError
-// → fall back to device-code; StateMismatchError → fail loudly).
-var loginLocalhost_js_1 = require("./loginLocalhost.js");
-Object.defineProperty(exports, "startLocalCallback", { enumerable: true, get: function () { return loginLocalhost_js_1.startLocalCallback; } });
-Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return loginLocalhost_js_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
-Object.defineProperty(exports, "LocalCallbackError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackError; } });
-Object.defineProperty(exports, "LocalCallbackBindError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackBindError; } });
-Object.defineProperty(exports, "LocalCallbackTimeoutError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackTimeoutError; } });
-Object.defineProperty(exports, "LocalCallbackStateMismatchError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackStateMismatchError; } });
-Object.defineProperty(exports, "LocalCallbackDeniedError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackDeniedError; } });
-Object.defineProperty(exports, "LocalCallbackMalformedError", { enumerable: true, get: function () { return loginLocalhost_js_1.LocalCallbackMalformedError; } });
-// Phase H.0.2.b — single-call orchestrator that ties PKCE + local
-// callback + server endpoints into the daemon-style token bundle.
-// Daemon/CLI consume this; auth-core is platform-agnostic via the
-// caller-injected `openBrowser` and `fetchImpl`.
-var loginWithLocalhost_js_1 = require("./loginWithLocalhost.js");
-Object.defineProperty(exports, "loginWithLocalhost", { enumerable: true, get: function () { return loginWithLocalhost_js_1.loginWithLocalhost; } });
-Object.defineProperty(exports, "LoginInitError", { enumerable: true, get: function () { return loginWithLocalhost_js_1.LoginInitError; } });
-Object.defineProperty(exports, "LoginExchangeError", { enumerable: true, get: function () { return loginWithLocalhost_js_1.LoginExchangeError; } });
-// ADD-CLI1 — shared `--ttl` parser for `create-token`. Both the
-// daemon CLI (`oversky create-token`) and the oclif CLI (`sky
-// create-token`) import from here to prevent grammar drift.
-var ttlParser_js_1 = require("./ttlParser.js");
-Object.defineProperty(exports, "parseTtlDays", { enumerable: true, get: function () { return ttlParser_js_1.parseTtlDays; } });
-Object.defineProperty(exports, "MIN_TTL_DAYS", { enumerable: true, get: function () { return ttlParser_js_1.MIN_TTL_DAYS; } });
-Object.defineProperty(exports, "MAX_TTL_DAYS", { enumerable: true, get: function () { return ttlParser_js_1.MAX_TTL_DAYS; } });
-// Tier 1 #3 — printable account-recovery code format (1Password-style
-// 11-group base32). Server, CLI, and daemon-side helper all import from here.
-var recoveryCode_js_1 = require("./recoveryCode.js");
-Object.defineProperty(exports, "formatRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.formatRecoveryCode; } });
-Object.defineProperty(exports, "parseRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.parseRecoveryCode; } });
-Object.defineProperty(exports, "normalizeRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.normalizeRecoveryCode; } });
-Object.defineProperty(exports, "isValidRecoveryCode", { enumerable: true, get: function () { return recoveryCode_js_1.isValidRecoveryCode; } });
-// L12 Layer 0 — at-rest credential envelope encryption primitives.
-// Pure crypto, no platform code. Daemon and CLI both consume.
-var credentialEnvelope_js_1 = require("./credentialEnvelope.js");
-Object.defineProperty(exports, "buildCredentialAad", { enumerable: true, get: function () { return credentialEnvelope_js_1.buildCredentialAad; } });
-Object.defineProperty(exports, "credEnvelopeDecrypt", { enumerable: true, get: function () { return credentialEnvelope_js_1.decrypt; } });
-Object.defineProperty(exports, "credEnvelopeDeserialize", { enumerable: true, get: function () { return credentialEnvelope_js_1.deserialize; } });
-Object.defineProperty(exports, "credEnvelopeEncrypt", { enumerable: true, get: function () { return credentialEnvelope_js_1.encrypt; } });
-Object.defineProperty(exports, "CRED_ENVELOPE_MAGIC", { enumerable: true, get: function () { return credentialEnvelope_js_1.ENVELOPE_MAGIC; } });
-Object.defineProperty(exports, "generateDek", { enumerable: true, get: function () { return credentialEnvelope_js_1.generateDek; } });
-Object.defineProperty(exports, "isCredEnvelopeString", { enumerable: true, get: function () { return credentialEnvelope_js_1.isEnvelopeString; } });
-Object.defineProperty(exports, "CRED_KEY_LEN", { enumerable: true, get: function () { return credentialEnvelope_js_1.KEY_LEN; } });
-Object.defineProperty(exports, "credOpenBuffer", { enumerable: true, get: function () { return credentialEnvelope_js_1.openBuffer; } });
-Object.defineProperty(exports, "credSealBuffer", { enumerable: true, get: function () { return credentialEnvelope_js_1.sealBuffer; } });
-Object.defineProperty(exports, "credEnvelopeSerialize", { enumerable: true, get: function () { return credentialEnvelope_js_1.serialize; } });
-Object.defineProperty(exports, "credEnvelopeUnwrap", { enumerable: true, get: function () { return credentialEnvelope_js_1.unwrap; } });
-Object.defineProperty(exports, "credEnvelopeWrap", { enumerable: true, get: function () { return credentialEnvelope_js_1.wrap; } });
-// L12 Layer 1 — KEK platform-strategy interface and implementations.
-//
-// This block used to claim "today every strategy reports available=false so
-// the daemon falls through to legacy plaintext". That has not been true since
-// the macOS `security(1)` backend (C5) and the Linux tier-3 machine-id HKDF
-// fallback shipped: on Linux `available()` is now essentially always true, and
-// on macOS it is true whenever a login keychain resolves. The stale note is
-// worth calling out rather than deleting, because four daemon suites were
-// written against it and only failed once CI first ran them on Linux.
-//
-// Tests that need the unavailable branch must inject `UnavailableKek`;
-// `__setKekStrategyForTest(null)` restores the PLATFORM default, which is not
-// the same thing and differs per OS.
-var index_js_1 = require("./kek/index.js");
-Object.defineProperty(exports, "__setKekStrategyForTest", { enumerable: true, get: function () { return index_js_1.__setKekStrategyForTest; } });
-Object.defineProperty(exports, "getKekStrategy", { enumerable: true, get: function () { return index_js_1.getKekStrategy; } });
-Object.defineProperty(exports, "InMemoryKek", { enumerable: true, get: function () { return index_js_1.InMemoryKek; } });
-Object.defineProperty(exports, "UnavailableKek", { enumerable: true, get: function () { return index_js_1.UnavailableKek; } });
-Object.defineProperty(exports, "KekUnavailableError", { enumerable: true, get: function () { return index_js_1.KekUnavailableError; } });
-Object.defineProperty(exports, "LinuxKek", { enumerable: true, get: function () { return index_js_1.LinuxKek; } });
-Object.defineProperty(exports, "MacosKek", { enumerable: true, get: function () { return index_js_1.MacosKek; } });
-Object.defineProperty(exports, "registerZeroizeHook", { enumerable: true, get: function () { return index_js_1.registerZeroizeHook; } });
-Object.defineProperty(exports, "WindowsKek", { enumerable: true, get: function () { return index_js_1.WindowsKek; } });
-Object.defineProperty(exports, "zeroizeKekCaches", { enumerable: true, get: function () { return index_js_1.zeroizeKekCaches; } });
-// L11 Phase 1 — Device identity (Ed25519) + DPoP-shaped proof JWS.
-// The crypto half of the two-axis identity story; daemon-side
-// persistence + signing lives in `daemon/src/deviceIdentity.ts`.
-// Server-side verification middleware is a later PR.
-var deviceKey_js_1 = require("./deviceKey.js");
-Object.defineProperty(exports, "buildDeviceProof", { enumerable: true, get: function () { return deviceKey_js_1.buildProof; } });
-Object.defineProperty(exports, "generateDeviceKeyPair", { enumerable: true, get: function () { return deviceKey_js_1.generateDeviceKeyPair; } });
-Object.defineProperty(exports, "jwkThumbprint", { enumerable: true, get: function () { return deviceKey_js_1.jwkThumbprint; } });
-Object.defineProperty(exports, "normalizeHtu", { enumerable: true, get: function () { return deviceKey_js_1.normalizeHtu; } });
-Object.defineProperty(exports, "publicJwkFromX", { enumerable: true, get: function () { return deviceKey_js_1.publicJwkFromX; } });
-Object.defineProperty(exports, "tokenHash", { enumerable: true, get: function () { return deviceKey_js_1.tokenHash; } });
-Object.defineProperty(exports, "verifyDeviceProof", { enumerable: true, get: function () { return deviceKey_js_1.verifyProof; } });
-// OSK-12020 — RFC 9449 access-token binding (`cnf.jkt` + `DPoP` proof). A
-// different protocol from the device proof above (`typ: dpop+jwt`, header
-// `DPoP`), signed by a dedicated in-memory key the daemon holds.
-var dpop_js_1 = require("./dpop.js");
-Object.defineProperty(exports, "DPOP_HEADER", { enumerable: true, get: function () { return dpop_js_1.DPOP_HEADER; } });
-Object.defineProperty(exports, "DPOP_MAX_AGE_SECONDS", { enumerable: true, get: function () { return dpop_js_1.DPOP_MAX_AGE_SECONDS; } });
-Object.defineProperty(exports, "DPOP_PROOF_INVALID", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_INVALID; } });
-Object.defineProperty(exports, "DPOP_PROOF_REQUIRED", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_REQUIRED; } });
-Object.defineProperty(exports, "DPOP_PROOF_TYP", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_TYP; } });
-Object.defineProperty(exports, "DPOP_PROOF_VERIFY_UNAVAILABLE", { enumerable: true, get: function () { return dpop_js_1.DPOP_PROOF_VERIFY_UNAVAILABLE; } });
-Object.defineProperty(exports, "accessTokenHash", { enumerable: true, get: function () { return dpop_js_1.accessTokenHash; } });
-Object.defineProperty(exports, "createDpopKey", { enumerable: true, get: function () { return dpop_js_1.createDpopKey; } });
-Object.defineProperty(exports, "isAth", { enumerable: true, get: function () { return dpop_js_1.isAth; } });
-Object.defineProperty(exports, "isJwkThumbprint", { enumerable: true, get: function () { return dpop_js_1.isJwkThumbprint; } });
-Object.defineProperty(exports, "normalizeDpopHtu", { enumerable: true, get: function () { return dpop_js_1.normalizeDpopHtu; } });
-Object.defineProperty(exports, "verifyDpopProof", { enumerable: true, get: function () { return dpop_js_1.verifyDpopProof; } });
-// L11/L12 — composed runtime: init, transforms, sign, enroll, locks.
-// Daemon and CLI consume these; the underlying primitives live above.
-var credentialEnvelopeBridge_js_1 = require("./credentialEnvelopeBridge.js");
-// credEnvelope bridge
-Object.defineProperty(exports, "initCredEnvelope", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.initCredEnvelope; } });
-Object.defineProperty(exports, "resetCredEnvelope", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.resetCredEnvelope; } });
-Object.defineProperty(exports, "shutdownCredEnvelope", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.shutdownCredEnvelope; } });
-Object.defineProperty(exports, "isCredEnvelopeActive", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.isCredEnvelopeActive; } });
-Object.defineProperty(exports, "hasCredEnvelopePathConflict", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.hasCredEnvelopePathConflict; } });
-Object.defineProperty(exports, "describeCredEnvelopeState", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.describeCredEnvelopeState; } });
-Object.defineProperty(exports, "splitKeyConvergencePolicy", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.splitKeyConvergencePolicy; } });
-Object.defineProperty(exports, "maybeEncryptForWrite", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeEncryptForWrite; } });
-Object.defineProperty(exports, "maybeDecryptOnRead", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeDecryptOnRead; } });
-Object.defineProperty(exports, "DEFAULT_UNREADABLE_CREDENTIAL_HINT", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT; } });
-// Test seams — `__`-prefixed so consumers don't import them in
-// production code paths. Re-exported here so CLI/daemon spec files
-// can resolve the wrapped-DEK path against the same module instance.
-Object.defineProperty(exports, "__wrappedDekFilePathForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__wrappedDekFilePathForTest; } });
-Object.defineProperty(exports, "__setCredEnvelopeStateForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__setStateForTest; } });
-Object.defineProperty(exports, "__getCredEnvelopeStateForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__getStateForTest; } });
-Object.defineProperty(exports, "__resetShutdownGuardForTest", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.__resetShutdownGuardForTest; } });
-var deviceIdentityBridge_js_1 = require("./deviceIdentityBridge.js");
-// deviceIdentity bridge
-Object.defineProperty(exports, "initDeviceIdentity", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.initDeviceIdentity; } });
-Object.defineProperty(exports, "resetDeviceIdentity", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.resetDeviceIdentity; } });
-Object.defineProperty(exports, "signServerRequest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.signServerRequest; } });
-Object.defineProperty(exports, "enrollWithServer", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.enrollWithServer; } });
-Object.defineProperty(exports, "clearEnrollmentMarker", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.clearEnrollmentMarker; } });
-Object.defineProperty(exports, "isDeviceIdentityActive", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.isDeviceIdentityActive; } });
-Object.defineProperty(exports, "getDevicePublicKey", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.getDevicePublicKey; } });
-Object.defineProperty(exports, "describeDeviceIdentityState", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.describeDeviceIdentityState; } });
-Object.defineProperty(exports, "describeDeviceKeySplit", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.describeDeviceKeySplit; } });
-// Test seams — file path resolvers + state setters for spec files.
-Object.defineProperty(exports, "__publicKeyPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__publicKeyPathForTest; } });
-Object.defineProperty(exports, "__privateKeyPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__privateKeyPathForTest; } });
-Object.defineProperty(exports, "__enrollmentMarkerPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__enrollmentMarkerPathForTest; } });
-Object.defineProperty(exports, "__enrollmentBackoffPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__enrollmentBackoffPathForTest; } });
-Object.defineProperty(exports, "__setDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__setStateForTest; } });
-Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__getStateForTest; } });
-// Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
-// machine-id / MachineGuid). ONE implementation for daemon and CLI —
-// OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
-var machineUuid_js_1 = require("./machineUuid.js");
-Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
-Object.defineProperty(exports, "getMachineUuidForProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidForProfile; } });
-Object.defineProperty(exports, "describeMachineIdentity", { enumerable: true, get: function () { return machineUuid_js_1.describeMachineIdentity; } });
-Object.defineProperty(exports, "getHardwareMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getHardwareMachineUuid; } });
-Object.defineProperty(exports, "setMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.setMachineUuidProfile; } });
-Object.defineProperty(exports, "getMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidProfile; } });
-Object.defineProperty(exports, "qualifyMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.qualifyMachineUuid; } });
-Object.defineProperty(exports, "MACHINE_IDENTITY_FILENAME", { enumerable: true, get: function () { return machineUuid_js_1.MACHINE_IDENTITY_FILENAME; } });
-Object.defineProperty(exports, "hostedRuntimeIdOverride", { enumerable: true, get: function () { return machineUuid_js_1.hostedRuntimeIdOverride; } });
-Object.defineProperty(exports, "HOSTED_RUNTIME_MACHINE_SOURCES", { enumerable: true, get: function () { return machineUuid_js_1.HOSTED_RUNTIME_MACHINE_SOURCES; } });
-Object.defineProperty(exports, "__resetMachineUuidCacheForTest", { enumerable: true, get: function () { return machineUuid_js_1.__resetMachineUuidCacheForTest; } });
-// Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
-// NOT a `machineUuid` — see machineUuid.ts.
-var machineId_js_1 = require("./machineId.js");
-Object.defineProperty(exports, "ensureMachineDaemonId", { enumerable: true, get: function () { return machineId_js_1.ensureMachineDaemonId; } });
-Object.defineProperty(exports, "legacyDaemonUuids", { enumerable: true, get: function () { return machineId_js_1.legacyDaemonUuids; } });
-Object.defineProperty(exports, "__resetCachedDaemonIdForTest", { enumerable: true, get: function () { return machineId_js_1.__resetCachedDaemonIdForTest; } });
-// Tier 1 #2 — daemon QR pairing primitives. Pure crypto + AAD framing,
-// shared between the daemon CLI orchestrator (`daemon/src/pair.ts`) and
-// any future native-app callers. The mobile RN client mirrors the same
-// shapes locally because it can't pull a Node-shaped package.
-var daemonPair_js_1 = require("./daemonPair.js");
-Object.defineProperty(exports, "PAIR_AAD_PREFIX", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_AAD_PREFIX; } });
-Object.defineProperty(exports, "PAIR_AAD_MAX_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_AAD_MAX_LEN; } });
-Object.defineProperty(exports, "PAIR_BUNDLE_MAX_BASE64_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_BUNDLE_MAX_BASE64_LEN; } });
-Object.defineProperty(exports, "PAIR_NONCE_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_NONCE_LEN; } });
-Object.defineProperty(exports, "PAIR_PUBKEY_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_PUBKEY_LEN; } });
-Object.defineProperty(exports, "PAIR_SECRET_LEN", { enumerable: true, get: function () { return daemonPair_js_1.PAIR_SECRET_LEN; } });
-Object.defineProperty(exports, "PairBundleError", { enumerable: true, get: function () { return daemonPair_js_1.PairBundleError; } });
-Object.defineProperty(exports, "assemblePairBundleBase64", { enumerable: true, get: function () { return daemonPair_js_1.assemblePairBundleBase64; } });
-Object.defineProperty(exports, "pairBase64ToUint8Array", { enumerable: true, get: function () { return daemonPair_js_1.base64ToUint8Array; } });
-Object.defineProperty(exports, "pairBase64UrlToUint8Array", { enumerable: true, get: function () { return daemonPair_js_1.base64UrlToUint8Array; } });
-Object.defineProperty(exports, "buildPairAad", { enumerable: true, get: function () { return daemonPair_js_1.buildPairAad; } });
-Object.defineProperty(exports, "buildPairUrl", { enumerable: true, get: function () { return daemonPair_js_1.buildPairUrl; } });
-Object.defineProperty(exports, "generatePairKeyPair", { enumerable: true, get: function () { return daemonPair_js_1.generatePairKeyPair; } });
-Object.defineProperty(exports, "openPairBundleBase64", { enumerable: true, get: function () { return daemonPair_js_1.openPairBundleBase64; } });
-Object.defineProperty(exports, "parsePairBundle", { enumerable: true, get: function () { return daemonPair_js_1.parsePairBundle; } });
-Object.defineProperty(exports, "parsePairPlaintext", { enumerable: true, get: function () { return daemonPair_js_1.parsePairPlaintext; } });
-Object.defineProperty(exports, "parsePairUrl", { enumerable: true, get: function () { return daemonPair_js_1.parsePairUrl; } });
-Object.defineProperty(exports, "pairUint8ArrayToBase64", { enumerable: true, get: function () { return daemonPair_js_1.uint8ArrayToBase64; } });
-Object.defineProperty(exports, "pairUint8ArrayToBase64Url", { enumerable: true, get: function () { return daemonPair_js_1.uint8ArrayToBase64Url; } });
-// OSK-3897 — harness trust tiers, shared by the daemon (the authority) and the
-// CLI (which publishes the fact in `skrr code doctor`). The PROVENANCE half stays
-// in the daemon on purpose: a tier is a published fact, provenance is evidence
-// about bytes on disk that only the spawning process can gather.
-var harnessTrust_js_1 = require("./harnessTrust.js");
-Object.defineProperty(exports, "HARNESS_TIERS", { enumerable: true, get: function () { return harnessTrust_js_1.HARNESS_TIERS; } });
-Object.defineProperty(exports, "getHarnessTier", { enumerable: true, get: function () { return harnessTrust_js_1.getHarnessTier; } });
-Object.defineProperty(exports, "credentialPolicyForTier", { enumerable: true, get: function () { return harnessTrust_js_1.credentialPolicyForTier; } });
-Object.defineProperty(exports, "tierPermitsConfiguredAutoMode", { enumerable: true, get: function () { return harnessTrust_js_1.tierPermitsConfiguredAutoMode; } });
-// OSK-10409 — which harnesses resolve the `.claude/skills` layout the daemon
-// materializes. One declared table with per-harness evidence, read by the
-// server's two skill gates and by the daemon's shadowing protection. See
-// harnessSkillLayout.ts for why a second copy would be worse than none.
-var harnessSkillLayout_js_1 = require("./harnessSkillLayout.js");
-Object.defineProperty(exports, "HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT", { enumerable: true, get: function () { return harnessSkillLayout_js_1.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT; } });
-Object.defineProperty(exports, "claudeSkillsLayoutEvidence", { enumerable: true, get: function () { return harnessSkillLayout_js_1.claudeSkillsLayoutEvidence; } });
-Object.defineProperty(exports, "harnessLoadsClaudeSkillsLayout", { enumerable: true, get: function () { return harnessSkillLayout_js_1.harnessLoadsClaudeSkillsLayout; } });
-// OSK-3892 — spawn-env sanitization, shared by the daemon (which has stripped
-// its own credentials before every harness spawn all along) and the CLI (which
-// spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
-// these so its own importers are unchanged, and keeps `filterCustomEnv` — that
-// governs SERVER-PROVIDED env, which no other process is handed.
-var spawnEnv_js_1 = require("./spawnEnv.js");
-Object.defineProperty(exports, "sanitizeSpawnEnv", { enumerable: true, get: function () { return spawnEnv_js_1.sanitizeSpawnEnv; } });
-Object.defineProperty(exports, "SENSITIVE_ENV_VARS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_VARS; } });
-Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIXES; } });
-Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
-Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
-Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
-Object.defineProperty(exports, "DAEMON_CHILD_ENV", { enumerable: true, get: function () { return spawnEnv_js_1.DAEMON_CHILD_ENV; } });
-Object.defineProperty(exports, "isDaemonChildEnv", { enumerable: true, get: function () { return spawnEnv_js_1.isDaemonChildEnv; } });
-Object.defineProperty(exports, "LOOPBACK_NO_PROXY_HOSTS", { enumerable: true, get: function () { return spawnEnv_js_1.LOOPBACK_NO_PROXY_HOSTS; } });
-Object.defineProperty(exports, "envHasProxy", { enumerable: true, get: function () { return spawnEnv_js_1.envHasProxy; } });
-Object.defineProperty(exports, "withLoopbackNoProxy", { enumerable: true, get: function () { return spawnEnv_js_1.withLoopbackNoProxy; } });
-// OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
-// Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
-// credentials and all; every loopback caller goes through this instead.
-var loopbackHttp_js_1 = require("./loopbackHttp.js");
-Object.defineProperty(exports, "loopbackFetch", { enumerable: true, get: function () { return loopbackHttp_js_1.loopbackFetch; } });
-Object.defineProperty(exports, "assertLoopbackHttpUrl", { enumerable: true, get: function () { return loopbackHttp_js_1.assertLoopbackHttpUrl; } });
-Object.defineProperty(exports, "isLoopbackHostname", { enumerable: true, get: function () { return loopbackHttp_js_1.isLoopbackHostname; } });
-Object.defineProperty(exports, "isLoopbackAddress", { enumerable: true, get: function () { return loopbackHttp_js_1.isLoopbackAddress; } });
-Object.defineProperty(exports, "LoopbackTargetRefusedError", { enumerable: true, get: function () { return loopbackHttp_js_1.LoopbackTargetRefusedError; } });
-Object.defineProperty(exports, "LOOPBACK_DEFAULT_MAX_BODY_BYTES", { enumerable: true, get: function () { return loopbackHttp_js_1.LOOPBACK_DEFAULT_MAX_BODY_BYTES; } });
-/* Local-machine identity — the names this product leaves on a disk. Exported so
-   the CLI, daemon and Desktop share one definition instead of 47 literals. */
-var localIdentity_js_1 = require("./localIdentity.js");
-Object.defineProperty(exports, "CONFIG_DIR_NAME", { enumerable: true, get: function () { return localIdentity_js_1.CONFIG_DIR_NAME; } });
-Object.defineProperty(exports, "LEGACY_CONFIG_DIR_NAMES", { enumerable: true, get: function () { return localIdentity_js_1.LEGACY_CONFIG_DIR_NAMES; } });
-Object.defineProperty(exports, "NATIVE_ID_PREFIX", { enumerable: true, get: function () { return localIdentity_js_1.NATIVE_ID_PREFIX; } });
-Object.defineProperty(exports, "LEGACY_NATIVE_ID_PREFIXES", { enumerable: true, get: function () { return localIdentity_js_1.LEGACY_NATIVE_ID_PREFIXES; } });
-Object.defineProperty(exports, "DEFAULT_BINARY_NAME", { enumerable: true, get: function () { return localIdentity_js_1.DEFAULT_BINARY_NAME; } });
-/* Pre-rename state detection. Callers REFUSE on a positive result; nothing here
-   reads, copies or removes what it finds (§7.2, §8.4). */
-var legacyStatePreflight_js_1 = require("./legacyStatePreflight.js");
-Object.defineProperty(exports, "findLegacyLocalState", { enumerable: true, get: function () { return legacyStatePreflight_js_1.findLegacyLocalState; } });
-Object.defineProperty(exports, "describeLegacyState", { enumerable: true, get: function () { return legacyStatePreflight_js_1.describeLegacyState; } });
-// The first-party harness identity: the ONE place its product name is written.
-// Pure, and also published as the `./first-party-harness` subpath for browser and
-// React Native consumers. See firstPartyHarness.ts.
-__exportStar(require("./firstPartyHarness.js"), exports);
-// Where the first-party harness lives under the skrr root, and the one-time move
-// that keeps legacy installs working across a rename. Node-only.
-var firstPartyHarnessHome_js_1 = require("./firstPartyHarnessHome.js");
-Object.defineProperty(exports, "FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX; } });
-Object.defineProperty(exports, "FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX; } });
-Object.defineProperty(exports, "firstPartyHarnessBinDir", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.firstPartyHarnessBinDir; } });
-Object.defineProperty(exports, "firstPartyHarnessHomeDir", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.firstPartyHarnessHomeDir; } });
-Object.defineProperty(exports, "firstPartyHarnessInstalledBinaryPath", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.firstPartyHarnessInstalledBinaryPath; } });
-Object.defineProperty(exports, "linkFirstPartyHarnessAliases", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.linkFirstPartyHarnessAliases; } });
-Object.defineProperty(exports, "migrateFirstPartyHarnessHome", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.migrateFirstPartyHarnessHome; } });
-var firstPartyHarnessChannels_js_1 = require("./firstPartyHarnessChannels.js");
-Object.defineProperty(exports, "DEFAULT_FIRST_PARTY_HARNESS_CHANNEL", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL; } });
-Object.defineProperty(exports, "FIRST_PARTY_HARNESS_CHANNELS", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.FIRST_PARTY_HARNESS_CHANNELS; } });
-Object.defineProperty(exports, "firstPartyHarnessChannelPrefix", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.firstPartyHarnessChannelPrefix; } });
-Object.defineProperty(exports, "firstPartyHarnessFeedBase", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.firstPartyHarnessFeedBase; } });
-Object.defineProperty(exports, "firstPartyHarnessFeedCandidates", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.firstPartyHarnessFeedCandidates; } });
-Object.defineProperty(exports, "isFirstPartyHarnessChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.isFirstPartyHarnessChannel; } });
-Object.defineProperty(exports, "resolveChannelManifestUrl", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveChannelManifestUrl; } });
-Object.defineProperty(exports, "resolveFirstPartyHarnessChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveFirstPartyHarnessChannel; } });
-// Daemon release trust: the pinned ed25519 keys and the canonical signature
-// messages. Shared because BOTH the daemon (self-update) and the CLI
-// (`skrr daemon install`, which runs when there is no daemon to ask) verify the
-// same manifest against the same root. See releaseManifest.ts for why a mirror
-// would be the wrong shape here.
-var releaseKeys_js_1 = require("./releaseKeys.js");
-Object.defineProperty(exports, "OVERSKY_RELEASE_PUBLIC_KEYS", { enumerable: true, get: function () { return releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS; } });
-var releaseManifest_js_1 = require("./releaseManifest.js");
-Object.defineProperty(exports, "MAX_SIGS", { enumerable: true, get: function () { return releaseManifest_js_1.MAX_SIGS; } });
-Object.defineProperty(exports, "TRUSTED_FEED_ORIGINS", { enumerable: true, get: function () { return releaseManifest_js_1.TRUSTED_FEED_ORIGINS; } });
-Object.defineProperty(exports, "buildArtifactMessage", { enumerable: true, get: function () { return releaseManifest_js_1.buildArtifactMessage; } });
-Object.defineProperty(exports, "buildManifestMessage", { enumerable: true, get: function () { return releaseManifest_js_1.buildManifestMessage; } });
-Object.defineProperty(exports, "getDeltaFor", { enumerable: true, get: function () { return releaseManifest_js_1.getDeltaFor; } });
-Object.defineProperty(exports, "isTrustedArtifactOrigin", { enumerable: true, get: function () { return releaseManifest_js_1.isTrustedArtifactOrigin; } });
-Object.defineProperty(exports, "verifyArtifact", { enumerable: true, get: function () { return releaseManifest_js_1.verifyArtifact; } });
-Object.defineProperty(exports, "verifyManifest", { enumerable: true, get: function () { return releaseManifest_js_1.verifyManifest; } });
-// The one definition of the skrr root, shared by `skrr` and `skrrd`. See the
-// module for why re-deriving it kept producing divergences.
-var configRoot_js_1 = require("./configRoot.js");
-Object.defineProperty(exports, "resolveConfigRoot", { enumerable: true, get: function () { return configRoot_js_1.resolveConfigRoot; } });
-Object.defineProperty(exports, "configRootPath", { enumerable: true, get: function () { return configRoot_js_1.configRootPath; } });
-Object.defineProperty(exports, "isConfigRootOverridden", { enumerable: true, get: function () { return configRoot_js_1.isConfigRootOverridden; } });
-// The one definition of where a PROFILE's auth state lives under that root, and
-// the migration for a machine that ended up with two. Same lesson, one level
-// down: two modules spelled the rule themselves and the two consumers disagreed.
-var profileStateDir_js_1 = require("./profileStateDir.js");
-Object.defineProperty(exports, "PROFILES_SEGMENT", { enumerable: true, get: function () { return profileStateDir_js_1.PROFILES_SEGMENT; } });
-Object.defineProperty(exports, "SUPERSEDED_MARKER_SUFFIX", { enumerable: true, get: function () { return profileStateDir_js_1.SUPERSEDED_MARKER_SUFFIX; } });
-Object.defineProperty(exports, "SUPERSEDED_COPY_SUFFIX", { enumerable: true, get: function () { return profileStateDir_js_1.SUPERSEDED_COPY_SUFFIX; } });
-Object.defineProperty(exports, "profileStateDir", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateDir; } });
-Object.defineProperty(exports, "legacyProfileStateDir", { enumerable: true, get: function () { return profileStateDir_js_1.legacyProfileStateDir; } });
-Object.defineProperty(exports, "resolveProfileStateDir", { enumerable: true, get: function () { return profileStateDir_js_1.resolveProfileStateDir; } });
-Object.defineProperty(exports, "resolveProfileStateFile", { enumerable: true, get: function () { return profileStateDir_js_1.resolveProfileStateFile; } });
-Object.defineProperty(exports, "profileStateFileLocations", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateFileLocations; } });
-Object.defineProperty(exports, "profileStateFilePathsToClear", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateFilePathsToClear; } });
-Object.defineProperty(exports, "consolidateProfileState", { enumerable: true, get: function () { return profileStateDir_js_1.consolidateProfileState; } });
-__exportStar(require("./harnessPermissionControls.js"), exports);
-var releaseVersions_js_1 = require("./releaseVersions.js");
-Object.defineProperty(exports, "compareReleaseVersions", { enumerable: true, get: function () { return releaseVersions_js_1.compareReleaseVersions; } });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  ALL_DAEMON_SCOPES: () => import_daemonScopes.ALL_DAEMON_SCOPES,
+  AuthHelperUnavailableError: () => import_credentialResolver.AuthHelperUnavailableError,
+  AuthHelperUntrustedError: () => import_credentialResolver.AuthHelperUntrustedError,
+  CI_TOKEN_PREFIX: () => import_credentialResolver.CI_TOKEN_PREFIX,
+  CONFIG_DIR_NAME: () => import_localIdentity.CONFIG_DIR_NAME,
+  CREDENTIAL_PRECEDENCE: () => import_credentialResolver.CREDENTIAL_PRECEDENCE,
+  CRED_ENVELOPE_MAGIC: () => import_credentialEnvelope.ENVELOPE_MAGIC,
+  CRED_KEY_LEN: () => import_credentialEnvelope.KEY_LEN,
+  CredentialResolver: () => import_credentialResolver.CredentialResolver,
+  DAEMON_CHILD_ENV: () => import_spawnEnv.DAEMON_CHILD_ENV,
+  DEFAULT_BINARY_NAME: () => import_localIdentity.DEFAULT_BINARY_NAME,
+  DEFAULT_DAEMON_SCOPES: () => import_daemonScopes.DEFAULT_DAEMON_SCOPES,
+  DEFAULT_FIRST_PARTY_HARNESS_CHANNEL: () => import_firstPartyHarnessChannels.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL,
+  DEFAULT_LOGIN_TIMEOUT_MS: () => import_loginLocalhost.DEFAULT_LOGIN_TIMEOUT_MS,
+  DEFAULT_UNREADABLE_CREDENTIAL_HINT: () => import_credentialEnvelopeBridge.DEFAULT_UNREADABLE_CREDENTIAL_HINT,
+  DPOP_HEADER: () => import_dpop.DPOP_HEADER,
+  DPOP_MAX_AGE_SECONDS: () => import_dpop.DPOP_MAX_AGE_SECONDS,
+  DPOP_PROOF_INVALID: () => import_dpop.DPOP_PROOF_INVALID,
+  DPOP_PROOF_REQUIRED: () => import_dpop.DPOP_PROOF_REQUIRED,
+  DPOP_PROOF_TYP: () => import_dpop.DPOP_PROOF_TYP,
+  DPOP_PROOF_VERIFY_UNAVAILABLE: () => import_dpop.DPOP_PROOF_VERIFY_UNAVAILABLE,
+  EXIT_NEEDS_REAUTH: () => import_messages.EXIT_NEEDS_REAUTH,
+  FIRST_PARTY_HARNESS_CHANNELS: () => import_firstPartyHarnessChannels.FIRST_PARTY_HARNESS_CHANNELS,
+  FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX: () => import_firstPartyHarnessHome.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX,
+  FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX: () => import_firstPartyHarnessHome.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX,
+  HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT: () => import_harnessSkillLayout.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT,
+  HARNESS_TIERS: () => import_harnessTrust.HARNESS_TIERS,
+  HOSTED_RUNTIME_MACHINE_SOURCES: () => import_machineUuid.HOSTED_RUNTIME_MACHINE_SOURCES,
+  InMemoryKek: () => import_kek.InMemoryKek,
+  KekUnavailableError: () => import_kek.KekUnavailableError,
+  LEGACY_CONFIG_DIR_NAMES: () => import_localIdentity.LEGACY_CONFIG_DIR_NAMES,
+  LEGACY_NATIVE_ID_PREFIXES: () => import_localIdentity.LEGACY_NATIVE_ID_PREFIXES,
+  LOOPBACK_DEFAULT_MAX_BODY_BYTES: () => import_loopbackHttp.LOOPBACK_DEFAULT_MAX_BODY_BYTES,
+  LOOPBACK_NO_PROXY_HOSTS: () => import_spawnEnv.LOOPBACK_NO_PROXY_HOSTS,
+  LinuxKek: () => import_kek.LinuxKek,
+  LocalCallbackBindError: () => import_loginLocalhost.LocalCallbackBindError,
+  LocalCallbackDeniedError: () => import_loginLocalhost.LocalCallbackDeniedError,
+  LocalCallbackError: () => import_loginLocalhost.LocalCallbackError,
+  LocalCallbackMalformedError: () => import_loginLocalhost.LocalCallbackMalformedError,
+  LocalCallbackStateMismatchError: () => import_loginLocalhost.LocalCallbackStateMismatchError,
+  LocalCallbackTimeoutError: () => import_loginLocalhost.LocalCallbackTimeoutError,
+  LoginExchangeError: () => import_loginWithLocalhost.LoginExchangeError,
+  LoginInitError: () => import_loginWithLocalhost.LoginInitError,
+  LoopbackTargetRefusedError: () => import_loopbackHttp.LoopbackTargetRefusedError,
+  MACHINE_IDENTITY_FILENAME: () => import_machineUuid.MACHINE_IDENTITY_FILENAME,
+  MAX_SIGS: () => import_releaseManifest.MAX_SIGS,
+  MAX_TTL_DAYS: () => import_ttlParser.MAX_TTL_DAYS,
+  MIN_TTL_DAYS: () => import_ttlParser.MIN_TTL_DAYS,
+  MacosKek: () => import_kek.MacosKek,
+  NATIVE_ID_PREFIX: () => import_localIdentity.NATIVE_ID_PREFIX,
+  OAUTH_CLI_SCOPE: () => import_daemonScopes.OAUTH_CLI_SCOPE,
+  OVERSKY_RELEASE_PUBLIC_KEYS: () => import_releaseKeys.OVERSKY_RELEASE_PUBLIC_KEYS,
+  PAIR_AAD_MAX_LEN: () => import_daemonPair.PAIR_AAD_MAX_LEN,
+  PAIR_AAD_PREFIX: () => import_daemonPair.PAIR_AAD_PREFIX,
+  PAIR_BUNDLE_MAX_BASE64_LEN: () => import_daemonPair.PAIR_BUNDLE_MAX_BASE64_LEN,
+  PAIR_NONCE_LEN: () => import_daemonPair.PAIR_NONCE_LEN,
+  PAIR_PUBKEY_LEN: () => import_daemonPair.PAIR_PUBKEY_LEN,
+  PAIR_SECRET_LEN: () => import_daemonPair.PAIR_SECRET_LEN,
+  PERSONAL_ACCESS_TOKEN_PREFIX: () => import_credentialResolver.PERSONAL_ACCESS_TOKEN_PREFIX,
+  PROFILES_SEGMENT: () => import_profileStateDir.PROFILES_SEGMENT,
+  PairBundleError: () => import_daemonPair.PairBundleError,
+  PermanentAuthFailure: () => import_types.PermanentAuthFailure,
+  SCOPES: () => import_daemonScopes.SCOPES,
+  SENSITIVE_ENV_NAME_TOKENS: () => import_spawnEnv.SENSITIVE_ENV_NAME_TOKENS,
+  SENSITIVE_ENV_PREFIXES: () => import_spawnEnv.SENSITIVE_ENV_PREFIXES,
+  SENSITIVE_ENV_PREFIX_EXCEPTIONS: () => import_spawnEnv.SENSITIVE_ENV_PREFIX_EXCEPTIONS,
+  SENSITIVE_ENV_SUFFIXES: () => import_spawnEnv.SENSITIVE_ENV_SUFFIXES,
+  SENSITIVE_ENV_VARS: () => import_spawnEnv.SENSITIVE_ENV_VARS,
+  SENTINEL_TRIGGERING_FAILURES: () => import_authHelper.SENTINEL_TRIGGERING_FAILURES,
+  SUPERSEDED_COPY_SUFFIX: () => import_profileStateDir.SUPERSEDED_COPY_SUFFIX,
+  SUPERSEDED_MARKER_SUFFIX: () => import_profileStateDir.SUPERSEDED_MARKER_SUFFIX,
+  TRUSTED_FEED_ORIGINS: () => import_releaseManifest.TRUSTED_FEED_ORIGINS,
+  TransientAuthFailure: () => import_types.TransientAuthFailure,
+  UNKNOWN_401_BUDGET: () => import_refresh.UNKNOWN_401_BUDGET,
+  UnavailableKek: () => import_kek.UnavailableKek,
+  VALID_DAEMON_SCOPE_SET: () => import_daemonScopes.VALID_DAEMON_SCOPE_SET,
+  WindowsKek: () => import_kek.WindowsKek,
+  __enrollmentBackoffPathForTest: () => import_deviceIdentityBridge.__enrollmentBackoffPathForTest,
+  __enrollmentMarkerPathForTest: () => import_deviceIdentityBridge.__enrollmentMarkerPathForTest,
+  __getCredEnvelopeStateForTest: () => import_credentialEnvelopeBridge.__getStateForTest,
+  __getDeviceIdentityStateForTest: () => import_deviceIdentityBridge.__getStateForTest,
+  __privateKeyPathForTest: () => import_deviceIdentityBridge.__privateKeyPathForTest,
+  __publicKeyPathForTest: () => import_deviceIdentityBridge.__publicKeyPathForTest,
+  __refreshDiagnostics: () => import_refresh.__refreshDiagnostics,
+  __resetAuthHelperFailureReasonForTest: () => import_authHelper.__resetAuthHelperFailureReasonForTest,
+  __resetCachedDaemonIdForTest: () => import_machineId.__resetCachedDaemonIdForTest,
+  __resetCredentialResolverForTest: () => import_credentialResolver.__resetCredentialResolverForTest,
+  __resetMachineUuidCacheForTest: () => import_machineUuid.__resetMachineUuidCacheForTest,
+  __resetShutdownGuardForTest: () => import_credentialEnvelopeBridge.__resetShutdownGuardForTest,
+  __resetUnknown401StreaksForTest: () => import_refresh.__resetUnknown401StreaksForTest,
+  __setCredEnvelopeStateForTest: () => import_credentialEnvelopeBridge.__setStateForTest,
+  __setDeviceIdentityStateForTest: () => import_deviceIdentityBridge.__setStateForTest,
+  __setFdReaderForTest: () => import_fdToken.__setFdReaderForTest,
+  __setKekStrategyForTest: () => import_kek.__setKekStrategyForTest,
+  __wrappedDekFilePathForTest: () => import_credentialEnvelopeBridge.__wrappedDekFilePathForTest,
+  accessTokenHash: () => import_dpop.accessTokenHash,
+  assemblePairBundleBase64: () => import_daemonPair.assemblePairBundleBase64,
+  assertLoopbackHttpUrl: () => import_loopbackHttp.assertLoopbackHttpUrl,
+  buildArtifactMessage: () => import_releaseManifest.buildArtifactMessage,
+  buildCredentialAad: () => import_credentialEnvelope.buildCredentialAad,
+  buildDeviceProof: () => import_deviceKey.buildProof,
+  buildManifestMessage: () => import_releaseManifest.buildManifestMessage,
+  buildPairAad: () => import_daemonPair.buildPairAad,
+  buildPairUrl: () => import_daemonPair.buildPairUrl,
+  challenge: () => import_pkce.challenge,
+  classifyRefreshResponse: () => import_refreshClassification.classifyRefreshResponse,
+  classifyTokenKind: () => import_credentialResolver.classifyTokenKind,
+  claudeSkillsLayoutEvidence: () => import_harnessSkillLayout.claudeSkillsLayoutEvidence,
+  clearEnrollmentMarker: () => import_deviceIdentityBridge.clearEnrollmentMarker,
+  clearReauthState: () => import_refresh.clearReauthState,
+  compareReleaseVersions: () => import_releaseVersions.compareReleaseVersions,
+  configRootPath: () => import_configRoot.configRootPath,
+  configureAuthCore: () => import_runtime.configureAuthCore,
+  consolidateProfileState: () => import_profileStateDir.consolidateProfileState,
+  createDpopKey: () => import_dpop.createDpopKey,
+  createRefreshScheduler: () => import_refreshScheduler.createRefreshScheduler,
+  credEnvelopeDecrypt: () => import_credentialEnvelope.decrypt,
+  credEnvelopeDeserialize: () => import_credentialEnvelope.deserialize,
+  credEnvelopeEncrypt: () => import_credentialEnvelope.encrypt,
+  credEnvelopeSerialize: () => import_credentialEnvelope.serialize,
+  credEnvelopeUnwrap: () => import_credentialEnvelope.unwrap,
+  credEnvelopeWrap: () => import_credentialEnvelope.wrap,
+  credOpenBuffer: () => import_credentialEnvelope.openBuffer,
+  credSealBuffer: () => import_credentialEnvelope.sealBuffer,
+  credentialPolicyForTier: () => import_harnessTrust.credentialPolicyForTier,
+  decodeJwtExpiry: () => import_jwtUtils.decodeJwtExpiry,
+  decodeJwtPayload: () => import_jwtUtils.decodeJwtPayload,
+  describeCredEnvelopeState: () => import_credentialEnvelopeBridge.describeCredEnvelopeState,
+  describeDeviceIdentityState: () => import_deviceIdentityBridge.describeDeviceIdentityState,
+  describeDeviceKeySplit: () => import_deviceIdentityBridge.describeDeviceKeySplit,
+  describeLegacyState: () => import_legacyStatePreflight.describeLegacyState,
+  describeMachineIdentity: () => import_machineUuid.describeMachineIdentity,
+  emitAuthTelemetry: () => import_runtime.emitAuthTelemetry,
+  enrollWithServer: () => import_deviceIdentityBridge.enrollWithServer,
+  ensureMachineDaemonId: () => import_machineId.ensureMachineDaemonId,
+  envHasProxy: () => import_spawnEnv.envHasProxy,
+  findLegacyLocalState: () => import_legacyStatePreflight.findLegacyLocalState,
+  firstPartyHarnessBinDir: () => import_firstPartyHarnessHome.firstPartyHarnessBinDir,
+  firstPartyHarnessChannelPrefix: () => import_firstPartyHarnessChannels.firstPartyHarnessChannelPrefix,
+  firstPartyHarnessFeedBase: () => import_firstPartyHarnessChannels.firstPartyHarnessFeedBase,
+  firstPartyHarnessFeedCandidates: () => import_firstPartyHarnessChannels.firstPartyHarnessFeedCandidates,
+  firstPartyHarnessHomeDir: () => import_firstPartyHarnessHome.firstPartyHarnessHomeDir,
+  firstPartyHarnessInstalledBinaryPath: () => import_firstPartyHarnessHome.firstPartyHarnessInstalledBinaryPath,
+  formatReauthMessage: () => import_messages.formatReauthMessage,
+  formatRecoveryCode: () => import_recoveryCode.formatRecoveryCode,
+  generateDek: () => import_credentialEnvelope.generateDek,
+  generateDeviceKeyPair: () => import_deviceKey.generateDeviceKeyPair,
+  generatePairKeyPair: () => import_daemonPair.generatePairKeyPair,
+  generateState: () => import_pkce.generateState,
+  generateVerifier: () => import_pkce.generateVerifier,
+  getAuthBinaryName: () => import_runtime.getAuthBinaryName,
+  getAuthConfigDir: () => import_runtime.getAuthConfigDir,
+  getAuthKillSwitches: () => import_runtime.getAuthKillSwitches,
+  getAuthLogger: () => import_runtime.getAuthLogger,
+  getDefaultHelperTtlMs: () => import_authHelper.getDefaultHelperTtlMs,
+  getDeltaFor: () => import_releaseManifest.getDeltaFor,
+  getDevicePublicKey: () => import_deviceIdentityBridge.getDevicePublicKey,
+  getHardwareMachineUuid: () => import_machineUuid.getHardwareMachineUuid,
+  getHarnessTier: () => import_harnessTrust.getHarnessTier,
+  getKekStrategy: () => import_kek.getKekStrategy,
+  getLastAuthHelperFailureReason: () => import_authHelper.getLastAuthHelperFailureReason,
+  getMachineUuid: () => import_machineUuid.getMachineUuid,
+  getMachineUuidForProfile: () => import_machineUuid.getMachineUuidForProfile,
+  getMachineUuidProfile: () => import_machineUuid.getMachineUuidProfile,
+  handleMidStreamAuthExpiry: () => import_authExpiredDetector.handleMidStreamAuthExpiry,
+  harnessLoadsClaudeSkillsLayout: () => import_harnessSkillLayout.harnessLoadsClaudeSkillsLayout,
+  hasCredEnvelopePathConflict: () => import_credentialEnvelopeBridge.hasCredEnvelopePathConflict,
+  hostedRuntimeIdOverride: () => import_machineUuid.hostedRuntimeIdOverride,
+  initCredEnvelope: () => import_credentialEnvelopeBridge.initCredEnvelope,
+  initDeviceIdentity: () => import_deviceIdentityBridge.initDeviceIdentity,
+  installLockExitHandlers: () => import_refresh.installLockExitHandlers,
+  invalidateAuthHelperCache: () => import_credentialResolver.invalidateAuthHelperCache,
+  invalidateHeadersHelperCache: () => import_headers_helper.invalidateHeadersHelperCache,
+  invokeAuthHelper: () => import_authHelper.invokeAuthHelper,
+  isAth: () => import_dpop.isAth,
+  isAuthExpiredSseEvent: () => import_authExpiredDetector.isAuthExpiredSseEvent,
+  isConfigRootOverridden: () => import_configRoot.isConfigRootOverridden,
+  isCredEnvelopeActive: () => import_credentialEnvelopeBridge.isCredEnvelopeActive,
+  isCredEnvelopeString: () => import_credentialEnvelope.isEnvelopeString,
+  isDaemonChildEnv: () => import_spawnEnv.isDaemonChildEnv,
+  isDaemonScope: () => import_daemonScopes.isDaemonScope,
+  isDeviceIdentityActive: () => import_deviceIdentityBridge.isDeviceIdentityActive,
+  isFirstPartyHarnessChannel: () => import_firstPartyHarnessChannels.isFirstPartyHarnessChannel,
+  isJwkThumbprint: () => import_dpop.isJwkThumbprint,
+  isLoopbackAddress: () => import_loopbackHttp.isLoopbackAddress,
+  isLoopbackHostname: () => import_loopbackHttp.isLoopbackHostname,
+  isStaticTokenKind: () => import_credentialResolver.isStaticTokenKind,
+  isTrustedArtifactOrigin: () => import_releaseManifest.isTrustedArtifactOrigin,
+  isValidRecoveryCode: () => import_recoveryCode.isValidRecoveryCode,
+  jwkThumbprint: () => import_deviceKey.jwkThumbprint,
+  legacyDaemonUuids: () => import_machineId.legacyDaemonUuids,
+  legacyProfileStateDir: () => import_profileStateDir.legacyProfileStateDir,
+  linkFirstPartyHarnessAliases: () => import_firstPartyHarnessHome.linkFirstPartyHarnessAliases,
+  loginWithLocalhost: () => import_loginWithLocalhost.loginWithLocalhost,
+  loopbackFetch: () => import_loopbackHttp.loopbackFetch,
+  maybeDecryptOnRead: () => import_credentialEnvelopeBridge.maybeDecryptOnRead,
+  maybeEncryptForWrite: () => import_credentialEnvelopeBridge.maybeEncryptForWrite,
+  migrateFirstPartyHarnessHome: () => import_firstPartyHarnessHome.migrateFirstPartyHarnessHome,
+  needsReauthState: () => import_refresh.needsReauthState,
+  normalizeDpopHtu: () => import_dpop.normalizeDpopHtu,
+  normalizeHtu: () => import_deviceKey.normalizeHtu,
+  normalizeRecoveryCode: () => import_recoveryCode.normalizeRecoveryCode,
+  openPairBundleBase64: () => import_daemonPair.openPairBundleBase64,
+  pairBase64ToUint8Array: () => import_daemonPair.base64ToUint8Array,
+  pairBase64UrlToUint8Array: () => import_daemonPair.base64UrlToUint8Array,
+  pairUint8ArrayToBase64: () => import_daemonPair.uint8ArrayToBase64,
+  pairUint8ArrayToBase64Url: () => import_daemonPair.uint8ArrayToBase64Url,
+  parsePairBundle: () => import_daemonPair.parsePairBundle,
+  parsePairPlaintext: () => import_daemonPair.parsePairPlaintext,
+  parsePairUrl: () => import_daemonPair.parsePairUrl,
+  parseRecoveryCode: () => import_recoveryCode.parseRecoveryCode,
+  parseTtlDays: () => import_ttlParser.parseTtlDays,
+  persistReauthState: () => import_refresh.persistReauthState,
+  profileStateDir: () => import_profileStateDir.profileStateDir,
+  profileStateFileLocations: () => import_profileStateDir.profileStateFileLocations,
+  profileStateFilePathsToClear: () => import_profileStateDir.profileStateFilePathsToClear,
+  publicJwkFromX: () => import_deviceKey.publicJwkFromX,
+  qualifyMachineUuid: () => import_machineUuid.qualifyMachineUuid,
+  readAuthFromFd: () => import_fdToken.readAuthFromFd,
+  reauthCommand: () => import_messages.reauthCommand,
+  refreshDaemonToken: () => import_refresh.refreshDaemonToken,
+  registerZeroizeHook: () => import_kek.registerZeroizeHook,
+  resetCredEnvelope: () => import_credentialEnvelopeBridge.resetCredEnvelope,
+  resetDeviceIdentity: () => import_deviceIdentityBridge.resetDeviceIdentity,
+  resolveChannelManifestUrl: () => import_firstPartyHarnessChannels.resolveChannelManifestUrl,
+  resolveConfigRoot: () => import_configRoot.resolveConfigRoot,
+  resolveFirstPartyHarnessChannel: () => import_firstPartyHarnessChannels.resolveFirstPartyHarnessChannel,
+  resolveProfileStateDir: () => import_profileStateDir.resolveProfileStateDir,
+  resolveProfileStateFile: () => import_profileStateDir.resolveProfileStateFile,
+  revokeDaemonRefreshSession: () => import_refresh.revokeDaemonRefreshSession,
+  runHeadersHelper: () => import_headers_helper.runHeadersHelper,
+  safeEqual: () => import_pkce.safeEqual,
+  sanitizeSpawnEnv: () => import_spawnEnv.sanitizeSpawnEnv,
+  setMachineUuidProfile: () => import_machineUuid.setMachineUuidProfile,
+  shutdownCredEnvelope: () => import_credentialEnvelopeBridge.shutdownCredEnvelope,
+  signServerRequest: () => import_deviceIdentityBridge.signServerRequest,
+  splitKeyConvergencePolicy: () => import_credentialEnvelopeBridge.splitKeyConvergencePolicy,
+  startLocalCallback: () => import_loginLocalhost.startLocalCallback,
+  tierPermitsConfiguredAutoMode: () => import_harnessTrust.tierPermitsConfiguredAutoMode,
+  tokenHash: () => import_deviceKey.tokenHash,
+  verifyArtifact: () => import_releaseManifest.verifyArtifact,
+  verifyChallenge: () => import_pkce.verifyChallenge,
+  verifyDeviceProof: () => import_deviceKey.verifyProof,
+  verifyDpopProof: () => import_dpop.verifyDpopProof,
+  verifyManifest: () => import_releaseManifest.verifyManifest,
+  withAuthLock: () => import_refresh.withAuthLock,
+  withLoopbackNoProxy: () => import_spawnEnv.withLoopbackNoProxy,
+  zeroizeKekCaches: () => import_kek.zeroizeKekCaches
+});
+module.exports = __toCommonJS(index_exports);
+var import_daemonScopes = require("./daemonScopes.js");
+var import_runtime = require("./runtime.js");
+var import_types = require("./types.js");
+var import_jwtUtils = require("./jwtUtils.js");
+var import_authExpiredDetector = require("./authExpiredDetector.js");
+var import_messages = require("./messages.js");
+var import_refreshClassification = require("./refreshClassification.js");
+var import_refresh = require("./refresh.js");
+var import_refreshScheduler = require("./refreshScheduler.js");
+var import_fdToken = require("./fdToken.js");
+var import_credentialResolver = require("./credentialResolver.js");
+var import_authHelper = require("./authHelper.js");
+var import_headers_helper = require("./headers-helper.js");
+var import_pkce = require("./pkce.js");
+var import_loginLocalhost = require("./loginLocalhost.js");
+var import_loginWithLocalhost = require("./loginWithLocalhost.js");
+var import_ttlParser = require("./ttlParser.js");
+var import_recoveryCode = require("./recoveryCode.js");
+var import_credentialEnvelope = require("./credentialEnvelope.js");
+var import_kek = require("./kek/index.js");
+var import_deviceKey = require("./deviceKey.js");
+var import_dpop = require("./dpop.js");
+var import_credentialEnvelopeBridge = require("./credentialEnvelopeBridge.js");
+var import_deviceIdentityBridge = require("./deviceIdentityBridge.js");
+var import_machineUuid = require("./machineUuid.js");
+var import_machineId = require("./machineId.js");
+var import_daemonPair = require("./daemonPair.js");
+var import_harnessTrust = require("./harnessTrust.js");
+var import_harnessSkillLayout = require("./harnessSkillLayout.js");
+var import_spawnEnv = require("./spawnEnv.js");
+var import_loopbackHttp = require("./loopbackHttp.js");
+var import_localIdentity = require("./localIdentity.js");
+var import_legacyStatePreflight = require("./legacyStatePreflight.js");
+__reExport(index_exports, require("./firstPartyHarness.js"), module.exports);
+var import_firstPartyHarnessHome = require("./firstPartyHarnessHome.js");
+var import_firstPartyHarnessChannels = require("./firstPartyHarnessChannels.js");
+var import_releaseKeys = require("./releaseKeys.js");
+var import_releaseManifest = require("./releaseManifest.js");
+var import_configRoot = require("./configRoot.js");
+var import_profileStateDir = require("./profileStateDir.js");
+__reExport(index_exports, require("./harnessPermissionControls.js"), module.exports);
+var import_releaseVersions = require("./releaseVersions.js");
+__reExport(index_exports, require("./computerUse.js"), module.exports);
+__reExport(index_exports, require("./desktopWire.js"), module.exports);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALL_DAEMON_SCOPES,
+  AuthHelperUnavailableError,
+  AuthHelperUntrustedError,
+  CI_TOKEN_PREFIX,
+  CONFIG_DIR_NAME,
+  CREDENTIAL_PRECEDENCE,
+  CRED_ENVELOPE_MAGIC,
+  CRED_KEY_LEN,
+  CredentialResolver,
+  DAEMON_CHILD_ENV,
+  DEFAULT_BINARY_NAME,
+  DEFAULT_DAEMON_SCOPES,
+  DEFAULT_FIRST_PARTY_HARNESS_CHANNEL,
+  DEFAULT_LOGIN_TIMEOUT_MS,
+  DEFAULT_UNREADABLE_CREDENTIAL_HINT,
+  DPOP_HEADER,
+  DPOP_MAX_AGE_SECONDS,
+  DPOP_PROOF_INVALID,
+  DPOP_PROOF_REQUIRED,
+  DPOP_PROOF_TYP,
+  DPOP_PROOF_VERIFY_UNAVAILABLE,
+  EXIT_NEEDS_REAUTH,
+  FIRST_PARTY_HARNESS_CHANNELS,
+  FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX,
+  FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX,
+  HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT,
+  HARNESS_TIERS,
+  HOSTED_RUNTIME_MACHINE_SOURCES,
+  InMemoryKek,
+  KekUnavailableError,
+  LEGACY_CONFIG_DIR_NAMES,
+  LEGACY_NATIVE_ID_PREFIXES,
+  LOOPBACK_DEFAULT_MAX_BODY_BYTES,
+  LOOPBACK_NO_PROXY_HOSTS,
+  LinuxKek,
+  LocalCallbackBindError,
+  LocalCallbackDeniedError,
+  LocalCallbackError,
+  LocalCallbackMalformedError,
+  LocalCallbackStateMismatchError,
+  LocalCallbackTimeoutError,
+  LoginExchangeError,
+  LoginInitError,
+  LoopbackTargetRefusedError,
+  MACHINE_IDENTITY_FILENAME,
+  MAX_SIGS,
+  MAX_TTL_DAYS,
+  MIN_TTL_DAYS,
+  MacosKek,
+  NATIVE_ID_PREFIX,
+  OAUTH_CLI_SCOPE,
+  OVERSKY_RELEASE_PUBLIC_KEYS,
+  PAIR_AAD_MAX_LEN,
+  PAIR_AAD_PREFIX,
+  PAIR_BUNDLE_MAX_BASE64_LEN,
+  PAIR_NONCE_LEN,
+  PAIR_PUBKEY_LEN,
+  PAIR_SECRET_LEN,
+  PERSONAL_ACCESS_TOKEN_PREFIX,
+  PROFILES_SEGMENT,
+  PairBundleError,
+  PermanentAuthFailure,
+  SCOPES,
+  SENSITIVE_ENV_NAME_TOKENS,
+  SENSITIVE_ENV_PREFIXES,
+  SENSITIVE_ENV_PREFIX_EXCEPTIONS,
+  SENSITIVE_ENV_SUFFIXES,
+  SENSITIVE_ENV_VARS,
+  SENTINEL_TRIGGERING_FAILURES,
+  SUPERSEDED_COPY_SUFFIX,
+  SUPERSEDED_MARKER_SUFFIX,
+  TRUSTED_FEED_ORIGINS,
+  TransientAuthFailure,
+  UNKNOWN_401_BUDGET,
+  UnavailableKek,
+  VALID_DAEMON_SCOPE_SET,
+  WindowsKek,
+  __enrollmentBackoffPathForTest,
+  __enrollmentMarkerPathForTest,
+  __getCredEnvelopeStateForTest,
+  __getDeviceIdentityStateForTest,
+  __privateKeyPathForTest,
+  __publicKeyPathForTest,
+  __refreshDiagnostics,
+  __resetAuthHelperFailureReasonForTest,
+  __resetCachedDaemonIdForTest,
+  __resetCredentialResolverForTest,
+  __resetMachineUuidCacheForTest,
+  __resetShutdownGuardForTest,
+  __resetUnknown401StreaksForTest,
+  __setCredEnvelopeStateForTest,
+  __setDeviceIdentityStateForTest,
+  __setFdReaderForTest,
+  __setKekStrategyForTest,
+  __wrappedDekFilePathForTest,
+  accessTokenHash,
+  assemblePairBundleBase64,
+  assertLoopbackHttpUrl,
+  buildArtifactMessage,
+  buildCredentialAad,
+  buildDeviceProof,
+  buildManifestMessage,
+  buildPairAad,
+  buildPairUrl,
+  challenge,
+  classifyRefreshResponse,
+  classifyTokenKind,
+  claudeSkillsLayoutEvidence,
+  clearEnrollmentMarker,
+  clearReauthState,
+  compareReleaseVersions,
+  configRootPath,
+  configureAuthCore,
+  consolidateProfileState,
+  createDpopKey,
+  createRefreshScheduler,
+  credEnvelopeDecrypt,
+  credEnvelopeDeserialize,
+  credEnvelopeEncrypt,
+  credEnvelopeSerialize,
+  credEnvelopeUnwrap,
+  credEnvelopeWrap,
+  credOpenBuffer,
+  credSealBuffer,
+  credentialPolicyForTier,
+  decodeJwtExpiry,
+  decodeJwtPayload,
+  describeCredEnvelopeState,
+  describeDeviceIdentityState,
+  describeDeviceKeySplit,
+  describeLegacyState,
+  describeMachineIdentity,
+  emitAuthTelemetry,
+  enrollWithServer,
+  ensureMachineDaemonId,
+  envHasProxy,
+  findLegacyLocalState,
+  firstPartyHarnessBinDir,
+  firstPartyHarnessChannelPrefix,
+  firstPartyHarnessFeedBase,
+  firstPartyHarnessFeedCandidates,
+  firstPartyHarnessHomeDir,
+  firstPartyHarnessInstalledBinaryPath,
+  formatReauthMessage,
+  formatRecoveryCode,
+  generateDek,
+  generateDeviceKeyPair,
+  generatePairKeyPair,
+  generateState,
+  generateVerifier,
+  getAuthBinaryName,
+  getAuthConfigDir,
+  getAuthKillSwitches,
+  getAuthLogger,
+  getDefaultHelperTtlMs,
+  getDeltaFor,
+  getDevicePublicKey,
+  getHardwareMachineUuid,
+  getHarnessTier,
+  getKekStrategy,
+  getLastAuthHelperFailureReason,
+  getMachineUuid,
+  getMachineUuidForProfile,
+  getMachineUuidProfile,
+  handleMidStreamAuthExpiry,
+  harnessLoadsClaudeSkillsLayout,
+  hasCredEnvelopePathConflict,
+  hostedRuntimeIdOverride,
+  initCredEnvelope,
+  initDeviceIdentity,
+  installLockExitHandlers,
+  invalidateAuthHelperCache,
+  invalidateHeadersHelperCache,
+  invokeAuthHelper,
+  isAth,
+  isAuthExpiredSseEvent,
+  isConfigRootOverridden,
+  isCredEnvelopeActive,
+  isCredEnvelopeString,
+  isDaemonChildEnv,
+  isDaemonScope,
+  isDeviceIdentityActive,
+  isFirstPartyHarnessChannel,
+  isJwkThumbprint,
+  isLoopbackAddress,
+  isLoopbackHostname,
+  isStaticTokenKind,
+  isTrustedArtifactOrigin,
+  isValidRecoveryCode,
+  jwkThumbprint,
+  legacyDaemonUuids,
+  legacyProfileStateDir,
+  linkFirstPartyHarnessAliases,
+  loginWithLocalhost,
+  loopbackFetch,
+  maybeDecryptOnRead,
+  maybeEncryptForWrite,
+  migrateFirstPartyHarnessHome,
+  needsReauthState,
+  normalizeDpopHtu,
+  normalizeHtu,
+  normalizeRecoveryCode,
+  openPairBundleBase64,
+  pairBase64ToUint8Array,
+  pairBase64UrlToUint8Array,
+  pairUint8ArrayToBase64,
+  pairUint8ArrayToBase64Url,
+  parsePairBundle,
+  parsePairPlaintext,
+  parsePairUrl,
+  parseRecoveryCode,
+  parseTtlDays,
+  persistReauthState,
+  profileStateDir,
+  profileStateFileLocations,
+  profileStateFilePathsToClear,
+  publicJwkFromX,
+  qualifyMachineUuid,
+  readAuthFromFd,
+  reauthCommand,
+  refreshDaemonToken,
+  registerZeroizeHook,
+  resetCredEnvelope,
+  resetDeviceIdentity,
+  resolveChannelManifestUrl,
+  resolveConfigRoot,
+  resolveFirstPartyHarnessChannel,
+  resolveProfileStateDir,
+  resolveProfileStateFile,
+  revokeDaemonRefreshSession,
+  runHeadersHelper,
+  safeEqual,
+  sanitizeSpawnEnv,
+  setMachineUuidProfile,
+  shutdownCredEnvelope,
+  signServerRequest,
+  splitKeyConvergencePolicy,
+  startLocalCallback,
+  tierPermitsConfiguredAutoMode,
+  tokenHash,
+  verifyArtifact,
+  verifyChallenge,
+  verifyDeviceProof,
+  verifyDpopProof,
+  verifyManifest,
+  withAuthLock,
+  withLoopbackNoProxy,
+  zeroizeKekCaches,
+  ...require("./firstPartyHarness.js"),
+  ...require("./harnessPermissionControls.js"),
+  ...require("./computerUse.js"),
+  ...require("./desktopWire.js")
+});