@skrr-ai/cli 0.1.115 → 0.1.117

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialResolver.js

@@ -1,447 +1,307 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialResolver = exports.AuthHelperUntrustedError = exports.AuthHelperUnavailableError = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.CREDENTIAL_PRECEDENCE = void 0;
-exports.isStaticTokenKind = isStaticTokenKind;
-exports.classifyTokenKind = classifyTokenKind;
-exports.__resetCredentialResolverForTest = __resetCredentialResolverForTest;
-exports.invalidateAuthHelperCache = invalidateAuthHelperCache;
-/**
- * credentialResolver.ts — documented credential precedence for the
- * OverSky daemon and CLI.
- *
- * Roadmap: docs/daemon-auth-roadmap.md, Phase H.
- *
- * The resolver walks a fixed, ordered list of credential sources and
- * returns the first non-null token along with its source name. Source
- * names are part of the public surface — they show up in
- * `oversky doctor`, `oversky status`, and `sky whoami`, and operators
- * use them to triage "where did this token come from?" tickets.
- *
- * Precedence (high → low):
- *
- *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
- *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
- *                     when both are set, matching the CLI config overlay. A
- *                     personal access token (`osk_pat_*`) is the credential
- *                     CI should put here.
- *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
- *                     creds — Vault, AWS SM, internal SSO proxy)
- *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
- *                     supervisor → daemon child). Internal; never
- *                     user-configured.
- *   5. keychain     — macOS Keychain (`ai.skrr.daemon`)
- *   6. file         — `~/.skrr/auth.json` (0600)
- *   7. interactive  — Browser/device-code login (TTY only, blocked
- *                     under launchd via `isHeadless()`)
- *
- * Skip rules (Phase H.2 + H.4):
- *   - `bareMode: true` skips slots 4–7 (no platform storage, no IPC,
- *     no interactive). Bare mode demands an explicit token from env or
- *     flag — designed for reproducible CI runs and "is the daemon
- *     broken or is my config corrupted?" triage.
- *   - `storeMode: 'env-only'` skips slots 5 + 6 (and the daemon
- *     wrapper additionally disables the auth-generation.json sidecar).
- *   - `storeMode: 'keychain'` skips slot 6 (file backend).
- *   - `storeMode: 'file'` skips slot 5 (keychain backend).
- *
- * Backend access uses dependency-injected callbacks
- * (`readKeychainToken`, `readFileToken`, `runInteractiveLogin`) so this
- * module stays free of OS-specific imports and the Sky CLI can wire its
- * own backends without dragging the daemon's `keychain.ts` into
- * non-daemon binaries.
- */
-const authHelper_js_1 = require("./authHelper.js");
-const fdToken_js_1 = require("./fdToken.js");
-const jwtUtils_js_1 = require("./jwtUtils.js");
-const runtime_js_1 = require("./runtime.js");
-/**
- * Ordered slots tried by `CredentialResolver.resolve()`. Excludes
- * `'none'` (only emitted when no slot produced a token). Treat this as
- * the canonical published precedence — flipping the order is a public
- * API change and breaks operator runbooks.
- */
-exports.CREDENTIAL_PRECEDENCE = [
-    'flag',
-    'env-token',
-    'auth-helper',
-    'fd-handoff',
-    'keychain',
-    'file',
-    'interactive',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var credentialResolver_exports = {};
+__export(credentialResolver_exports, {
+  AuthHelperUnavailableError: () => AuthHelperUnavailableError,
+  AuthHelperUntrustedError: () => AuthHelperUntrustedError,
+  CI_TOKEN_PREFIX: () => CI_TOKEN_PREFIX,
+  CREDENTIAL_PRECEDENCE: () => CREDENTIAL_PRECEDENCE,
+  CredentialResolver: () => CredentialResolver,
+  PERSONAL_ACCESS_TOKEN_PREFIX: () => PERSONAL_ACCESS_TOKEN_PREFIX,
+  __resetCredentialResolverForTest: () => __resetCredentialResolverForTest,
+  classifyTokenKind: () => classifyTokenKind,
+  invalidateAuthHelperCache: () => invalidateAuthHelperCache,
+  isStaticTokenKind: () => isStaticTokenKind
+});
+module.exports = __toCommonJS(credentialResolver_exports);
+var import_authHelper = require("./authHelper.js");
+var import_fdToken = require("./fdToken.js");
+var import_jwtUtils = require("./jwtUtils.js");
+var import_runtime = require("./runtime.js");
+const CREDENTIAL_PRECEDENCE = [
+  "flag",
+  "env-token",
+  "auth-helper",
+  "fd-handoff",
+  "keychain",
+  "file",
+  "interactive"
 ];
-/** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
-exports.CI_TOKEN_PREFIX = 'osk_ci_';
-/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
-exports.PERSONAL_ACCESS_TOKEN_PREFIX = 'osk_pat_';
-/**
- * True for a kind whose token is static by construction: never refreshed,
- * never rotated into a store. Like `TokenKind` itself this selects a local
- * code path and grants nothing.
- */
+const CI_TOKEN_PREFIX = "osk_ci_";
+const PERSONAL_ACCESS_TOKEN_PREFIX = "osk_pat_";
 function isStaticTokenKind(kind) {
-    return kind === 'ci' || kind === 'pat';
+  return kind === "ci" || kind === "pat";
 }
-/**
- * Classify a token by local shape. Pure function; safe to call on any string
- * (including `null`-coerced empty). Returns `'standard'` for empty input
- * so callers don't need to null-check before classification.
- *
- * Honors `OVERSKY_DISABLE_CI_TOKEN_RESOLVER=1` kill switch — when set,
- * everything classifies as `'standard'` so the resolver can be used as
- * a triage tool ("is the CI-token path the problem?").
- */
-/**
- * SECURITY NOTE — this reads `scope` out of an UNVERIFIED JWT payload.
- *
- * That is safe here, and stays safe only under one condition: the return value
- * selects a local code path and nothing else. `'install'` means "refresh this
- * the install-token way"; it grants no capability, skips no check, and asserts
- * no identity. The server still validates the token on every request, so a
- * forged `scope: daemon-install` buys an attacker a different local branch and
- * the same 401.
- *
- * The forgery is trivial — no signature is checked, so anyone who can write the
- * credential file or set the env var can put any claim in it. That is fine
- * while the only consequence is routing. It stops being fine the moment a
- * caller treats `TokenKind` as a permission. Do not let this value gate a
- * capability, and do not add a branch here that returns a kind meaning "more
- * privileged".
- *
- * See `jwtUtils.ts` for the general rule.
- */
 function classifyTokenKind(token) {
-    if (process.env.OVERSKY_DISABLE_CI_TOKEN_RESOLVER === '1')
-        return 'standard';
-    if (typeof token !== 'string' || token.length === 0)
-        return 'standard';
-    if (token.startsWith(exports.CI_TOKEN_PREFIX))
-        return 'ci';
-    if (token.startsWith(exports.PERSONAL_ACCESS_TOKEN_PREFIX))
-        return 'pat';
-    const payload = (0, jwtUtils_js_1.decodeJwtPayload)(token);
-    if (payload &&
-        typeof payload === 'object' &&
-        !Array.isArray(payload) &&
-        payload.scope === 'daemon-install') {
-        return 'install';
-    }
-    return 'standard';
+  if (process.env.OVERSKY_DISABLE_CI_TOKEN_RESOLVER === "1")
+    return "standard";
+  if (typeof token !== "string" || token.length === 0)
+    return "standard";
+  if (token.startsWith(CI_TOKEN_PREFIX))
+    return "ci";
+  if (token.startsWith(PERSONAL_ACCESS_TOKEN_PREFIX))
+    return "pat";
+  const payload = (0, import_jwtUtils.decodeJwtPayload)(token);
+  if (payload && typeof payload === "object" && !Array.isArray(payload) && payload.scope === "daemon-install") {
+    return "install";
+  }
+  return "standard";
 }
 let _helperCache = null;
-/** @internal test-only — drop the helper cache between tests. */
 function __resetCredentialResolverForTest() {
-    _helperCache = null;
+  _helperCache = null;
 }
-/**
- * L6.3 — typed error thrown when the cold-cache failure sentinel is in
- * effect. Callers (daemon refresh path, CLI) can catch this specifically
- * to render "auth helper unavailable: <reason>" without falling through
- * to OAuth or device-code retry.
- */
 class AuthHelperUnavailableError extends Error {
-    reason;
-    cachedAt;
-    constructor(reason, cachedAt) {
-        super(`auth helper unavailable: ${reason}`);
-        this.name = 'AuthHelperUnavailableError';
-        this.reason = reason;
-        this.cachedAt = cachedAt;
-    }
+  reason;
+  cachedAt;
+  constructor(reason, cachedAt) {
+    super(`auth helper unavailable: ${reason}`);
+    this.name = "AuthHelperUnavailableError";
+    this.reason = reason;
+    this.cachedAt = cachedAt;
+  }
 }
-exports.AuthHelperUnavailableError = AuthHelperUnavailableError;
-/**
- * L6.1 — typed error thrown when the workspace-trust gate blocks a
- * project- or local-scope helper. Surfaces the actionable next step
- * (`skrrd trust accept`) to the user; the daemon catches and presents
- * this without falling through to OAuth.
- */
 class AuthHelperUntrustedError extends Error {
-    origin;
-    reason;
-    helperPath;
-    constructor(helperPath, origin, reason) {
-        super(`OVERSKY_AUTH_HELPER (${origin}-scope) is not trusted for this workspace ` +
-            `(reason: ${reason}). Run \`skrrd trust accept\` to allow it.`);
-        this.name = 'AuthHelperUntrustedError';
-        this.origin = origin;
-        this.reason = reason;
-        this.helperPath = helperPath;
-    }
+  origin;
+  reason;
+  helperPath;
+  constructor(helperPath, origin, reason) {
+    super(`OVERSKY_AUTH_HELPER (${origin}-scope) is not trusted for this workspace (reason: ${reason}). Run \`skrrd trust accept\` to allow it.`);
+    this.name = "AuthHelperUntrustedError";
+    this.origin = origin;
+    this.reason = reason;
+    this.helperPath = helperPath;
+  }
 }
-exports.AuthHelperUntrustedError = AuthHelperUntrustedError;
-/**
- * H3-6 — public invalidation seam for the `OVERSKY_AUTH_HELPER` result
- * cache. 401 handlers call this right after receiving a 401 from the
- * server so the NEXT credential resolve re-invokes the helper to mint
- * a fresh token instead of serving the stale (cached) one for up to
- * `OVERSKY_AUTH_HELPER_TTL_MS`.
- *
- * Without this seam, a rotated secret at the helper's source (Vault,
- * AWS Secrets Manager, etc.) could take up to 5 minutes to propagate
- * to OverSky even when the server is actively rejecting the old
- * value. The helper is the only slot in the precedence chain that
- * naturally caches; keychain/file reads are already one-shot per
- * resolve.
- *
- * L6.3 — also clears the cold-cache failure sentinel. A 401 means the
- * server is rejecting whatever we sent, which usually means the helper
- * needs to retry from scratch — even when the LAST helper attempt
- * failed and seeded the sentinel. Without this, a transient helper
- * failure during the same TTL window as a server-issued 401 would lock
- * the daemon out for the full TTL.
- *
- * Idempotent: calling this on an already-empty cache is a no-op.
- */
 function invalidateAuthHelperCache() {
-    _helperCache = null;
+  _helperCache = null;
 }
 class CredentialResolver {
-    opts;
-    constructor(opts = {}) {
-        this.opts = opts;
+  opts;
+  constructor(opts = {}) {
+    this.opts = opts;
+  }
+  /**
+   * Walk the precedence chain and return the first non-null token.
+   * Returns `{ token: null, source: 'none' }` when nothing matches.
+   *
+   * Fail-closed exceptions from the auth-helper slot
+   * (`AuthHelperUntrustedError`, `AuthHelperUnavailableError`) propagate
+   * out — they intentionally PREVENT fall-through to OAuth. Callers
+   * that want soft-fall-through behavior must catch explicitly. See
+   * L6.1 spec point 4 and L6.3.
+   */
+  async resolve() {
+    for (const source of CREDENTIAL_PRECEDENCE) {
+      if (this.shouldSkip(source))
+        continue;
+      const token = await this.tryResolveSlot(source);
+      if (token) {
+        return { token, source, kind: classifyTokenKind(token) };
+      }
     }
-    /**
-     * Walk the precedence chain and return the first non-null token.
-     * Returns `{ token: null, source: 'none' }` when nothing matches.
-     *
-     * Fail-closed exceptions from the auth-helper slot
-     * (`AuthHelperUntrustedError`, `AuthHelperUnavailableError`) propagate
-     * out — they intentionally PREVENT fall-through to OAuth. Callers
-     * that want soft-fall-through behavior must catch explicitly. See
-     * L6.1 spec point 4 and L6.3.
-     */
-    async resolve() {
-        for (const source of exports.CREDENTIAL_PRECEDENCE) {
-            if (this.shouldSkip(source))
-                continue;
-            const token = await this.tryResolveSlot(source);
-            if (token) {
-                return { token, source, kind: classifyTokenKind(token) };
-            }
-        }
-        return { token: null, source: 'none', kind: 'standard' };
+    return { token: null, source: "none", kind: "standard" };
+  }
+  /**
+   * Test seam: invoke a single slot in isolation. Production code should
+   * always go through `resolve()` so the chain ordering is enforced.
+   */
+  async tryResolveSlot(source) {
+    switch (source) {
+      case "flag":
+        return this.tryResolveFlag();
+      case "env-token":
+        return this.tryResolveEnvToken();
+      case "auth-helper":
+        return this.tryResolveAuthHelper();
+      case "fd-handoff":
+        return this.tryResolveFdHandoff();
+      case "keychain":
+        return this.tryResolveKeychain();
+      case "file":
+        return this.tryResolveFile();
+      case "interactive":
+        return this.tryResolveInteractive();
     }
-    /**
-     * Test seam: invoke a single slot in isolation. Production code should
-     * always go through `resolve()` so the chain ordering is enforced.
-     */
-    async tryResolveSlot(source) {
-        switch (source) {
-            case 'flag':
-                return this.tryResolveFlag();
-            case 'env-token':
-                return this.tryResolveEnvToken();
-            case 'auth-helper':
-                return this.tryResolveAuthHelper();
-            case 'fd-handoff':
-                return this.tryResolveFdHandoff();
-            case 'keychain':
-                return this.tryResolveKeychain();
-            case 'file':
-                return this.tryResolveFile();
-            case 'interactive':
-                return this.tryResolveInteractive();
-        }
+  }
+  shouldSkip(source) {
+    const { bareMode } = this.opts;
+    const storeMode = this.opts.storeMode ?? "auto";
+    if (bareMode && (source === "fd-handoff" || source === "keychain" || source === "file" || source === "interactive")) {
+      return true;
     }
-    shouldSkip(source) {
-        const { bareMode } = this.opts;
-        const storeMode = this.opts.storeMode ?? 'auto';
-        if (bareMode &&
-            (source === 'fd-handoff' ||
-                source === 'keychain' ||
-                source === 'file' ||
-                source === 'interactive')) {
-            return true;
-        }
-        if (storeMode === 'env-only' && (source === 'keychain' || source === 'file')) {
-            return true;
-        }
-        if (storeMode === 'keychain' && source === 'file')
-            return true;
-        if (storeMode === 'file' && source === 'keychain')
-            return true;
-        return false;
+    if (storeMode === "env-only" && (source === "keychain" || source === "file")) {
+      return true;
     }
-    // ------------------------------------------------------------------
-    // Slot implementations
-    // ------------------------------------------------------------------
-    tryResolveFlag() {
-        const v = this.opts.flagToken;
-        return typeof v === 'string' && v.length > 0 ? v : null;
+    if (storeMode === "keychain" && source === "file")
+      return true;
+    if (storeMode === "file" && source === "keychain")
+      return true;
+    return false;
+  }
+  // ------------------------------------------------------------------
+  // Slot implementations
+  // ------------------------------------------------------------------
+  tryResolveFlag() {
+    const v = this.opts.flagToken;
+    return typeof v === "string" && v.length > 0 ? v : null;
+  }
+  tryResolveEnvToken() {
+    if (this.opts.envTokenOverride === null)
+      return null;
+    if (typeof this.opts.envTokenOverride === "string") {
+      return this.opts.envTokenOverride.length > 0 ? this.opts.envTokenOverride : null;
     }
-    tryResolveEnvToken() {
-        if (this.opts.envTokenOverride === null)
-            return null; // explicit force-skip
-        if (typeof this.opts.envTokenOverride === 'string') {
-            return this.opts.envTokenOverride.length > 0 ? this.opts.envTokenOverride : null;
-        }
-        // `OVERSKY_TOKEN` first (retained by decision, docs/product/skrr-env-inventory.md),
-        // then any renamed spelling the caller opted into (`SKRR_TOKEN` for the CLI,
-        // OSK-13208). The daemon does not opt in: a CI job that sets `SKRR_TOKEN`
-        // for `skrr` must not have a co-located `skrrd` silently adopt it.
-        for (const name of this.opts.envTokenNames ?? ['OVERSKY_TOKEN']) {
-            const v = process.env[name];
-            if (typeof v === 'string' && v.length > 0)
-                return v;
-        }
-        return null;
+    for (const name of this.opts.envTokenNames ?? ["OVERSKY_TOKEN"]) {
+      const v = process.env[name];
+      if (typeof v === "string" && v.length > 0)
+        return v;
     }
-    async tryResolveAuthHelper() {
-        let helperPath;
-        let fromEnvVar = false;
-        if (this.opts.authHelperPathOverride === null)
-            return null;
-        if (typeof this.opts.authHelperPathOverride === 'string') {
-            helperPath =
-                this.opts.authHelperPathOverride.length > 0 ? this.opts.authHelperPathOverride : null;
-        }
-        else {
-            helperPath = process.env.OVERSKY_AUTH_HELPER ?? null;
-            fromEnvVar = helperPath !== null;
-        }
-        if (!helperPath)
-            return null;
-        // ---------------------------------------------------------------
-        // L6.3 — sentinel served BEFORE re-spawning. Failure cache prevents
-        // silent fall-through to OAuth within the TTL window.
-        // ---------------------------------------------------------------
-        if (_helperCache && Date.now() < _helperCache.expiresAt) {
-            if (_helperCache.kind === 'success') {
-                return _helperCache.token;
-            }
-            // Failed sentinel still warm — fail closed. The slot returns
-            // a fail-closed signal via thrown error so the chain doesn't
-            // continue to keychain/file/OAuth.
-            this.opts.onAuthHelperSentinelHit?.({
-                helperPath,
-                reason: _helperCache.reason,
-                cachedAt: _helperCache.cachedAt,
-                ttlMs: _helperCache.expiresAt - _helperCache.cachedAt,
-            });
-            throw new AuthHelperUnavailableError(_helperCache.reason, _helperCache.cachedAt);
-        }
-        // ---------------------------------------------------------------
-        // L6.1 — workspace-trust gate. Project- and local-scope helpers
-        // must have an accepted trust record for the cwd. User-scope
-        // helpers (env var, ~/.skrr/) bypass the check.
-        //
-        // Trust check runs BEFORE invocation so we never even spawn an
-        // untrusted script. Failed trust = fail-closed throw, never
-        // falls through to OAuth.
-        // ---------------------------------------------------------------
-        if (this.opts.helperTrustGate) {
-            const decision = this.opts.helperTrustGate(helperPath, fromEnvVar);
-            if (!decision.trusted) {
-                const reason = decision.reason ?? 'no-record';
-                this.opts.onAuthHelperBlocked?.({
-                    helperPath,
-                    origin: decision.origin,
-                    reason,
-                    cwd: process.cwd(),
-                });
-                throw new AuthHelperUntrustedError(helperPath, decision.origin, reason);
-            }
-        }
-        const result = await (0, authHelper_js_1.invokeAuthHelper)(helperPath);
-        if (result) {
-            const ttlMs = (0, authHelper_js_1.getDefaultHelperTtlMs)();
-            const expiresAt = result.expiresAt ?? Date.now() + ttlMs;
-            _helperCache = { kind: 'success', token: result.token, expiresAt };
-            return result.token;
-        }
-        // ---------------------------------------------------------------
-        // L6.3 — invocation failed. Distinguish two failure classes:
-        //
-        //   - Validation failures ('disabled', 'invalid-path',
-        //     'not-executable', null) — helper isn't really wired up.
-        //     Fall through to next slot. NO sentinel.
-        //
-        //   - Execution failures ('timeout', 'non-zero-exit', 'oversized',
-        //     'empty-output', 'parse-error', 'spawn-error') — the helper
-        //     was wired up but couldn't deliver a token. Cache the
-        //     sentinel and fail closed for the TTL window. This matches
-        //     CC's `' '` literal sentinel at CC-A-34.
-        // ---------------------------------------------------------------
-        const reason = (0, authHelper_js_1.getLastAuthHelperFailureReason)();
-        if (reason && authHelper_js_1.SENTINEL_TRIGGERING_FAILURES.has(reason)) {
-            const ttlMs = (0, authHelper_js_1.getDefaultHelperTtlMs)();
-            const cachedAt = Date.now();
-            _helperCache = {
-                kind: 'failed',
-                reason,
-                cachedAt,
-                expiresAt: cachedAt + ttlMs,
-            };
-            this.opts.onAuthHelperSentinelHit?.({
-                helperPath,
-                reason,
-                cachedAt,
-                ttlMs,
-            });
-            throw new AuthHelperUnavailableError(reason, cachedAt);
-        }
-        // Validation failure — no sentinel; fall through.
-        return null;
+    return null;
+  }
+  async tryResolveAuthHelper() {
+    let helperPath;
+    let fromEnvVar = false;
+    if (this.opts.authHelperPathOverride === null)
+      return null;
+    if (typeof this.opts.authHelperPathOverride === "string") {
+      helperPath = this.opts.authHelperPathOverride.length > 0 ? this.opts.authHelperPathOverride : null;
+    } else {
+      helperPath = process.env.OVERSKY_AUTH_HELPER ?? null;
+      fromEnvVar = helperPath !== null;
+    }
+    if (!helperPath)
+      return null;
+    if (_helperCache && Date.now() < _helperCache.expiresAt) {
+      if (_helperCache.kind === "success") {
+        return _helperCache.token;
+      }
+      this.opts.onAuthHelperSentinelHit?.({
+        helperPath,
+        reason: _helperCache.reason,
+        cachedAt: _helperCache.cachedAt,
+        ttlMs: _helperCache.expiresAt - _helperCache.cachedAt
+      });
+      throw new AuthHelperUnavailableError(_helperCache.reason, _helperCache.cachedAt);
     }
-    async tryResolveFdHandoff() {
-        // FD handoff is daemon-only; CLI never has OVERSKY_AUTH_FD set, so
-        // the env check below makes this a near-zero-cost slot for CLI
-        // processes. The fdToken module does its own kill-switch check
-        // (`fdTokenHandoff` killSwitch) and bounded read.
-        if (!process.env.OVERSKY_AUTH_FD)
-            return null;
-        try {
-            const payload = await (0, fdToken_js_1.readAuthFromFd)();
-            if (!payload)
-                return null;
-            if (payload.accessExpiresAt && Date.now() > payload.accessExpiresAt) {
-                return null;
-            }
-            return payload.accessToken || null;
-        }
-        catch (err) {
-            (0, runtime_js_1.getAuthLogger)().warn(`[credentialResolver] FD handoff read failed: ${formatErr(err)}`);
-            return null;
-        }
+    if (this.opts.helperTrustGate) {
+      const decision = this.opts.helperTrustGate(helperPath, fromEnvVar);
+      if (!decision.trusted) {
+        const reason2 = decision.reason ?? "no-record";
+        this.opts.onAuthHelperBlocked?.({
+          helperPath,
+          origin: decision.origin,
+          reason: reason2,
+          cwd: process.cwd()
+        });
+        throw new AuthHelperUntrustedError(helperPath, decision.origin, reason2);
+      }
+    }
+    const result = await (0, import_authHelper.invokeAuthHelper)(helperPath);
+    if (result) {
+      const ttlMs = (0, import_authHelper.getDefaultHelperTtlMs)();
+      const expiresAt = result.expiresAt ?? Date.now() + ttlMs;
+      _helperCache = { kind: "success", token: result.token, expiresAt };
+      return result.token;
+    }
+    const reason = (0, import_authHelper.getLastAuthHelperFailureReason)();
+    if (reason && import_authHelper.SENTINEL_TRIGGERING_FAILURES.has(reason)) {
+      const ttlMs = (0, import_authHelper.getDefaultHelperTtlMs)();
+      const cachedAt = Date.now();
+      _helperCache = {
+        kind: "failed",
+        reason,
+        cachedAt,
+        expiresAt: cachedAt + ttlMs
+      };
+      this.opts.onAuthHelperSentinelHit?.({
+        helperPath,
+        reason,
+        cachedAt,
+        ttlMs
+      });
+      throw new AuthHelperUnavailableError(reason, cachedAt);
+    }
+    return null;
+  }
+  async tryResolveFdHandoff() {
+    if (!process.env.OVERSKY_AUTH_FD)
+      return null;
+    try {
+      const payload = await (0, import_fdToken.readAuthFromFd)();
+      if (!payload)
+        return null;
+      if (payload.accessExpiresAt && Date.now() > payload.accessExpiresAt) {
+        return null;
+      }
+      return payload.accessToken || null;
+    } catch (err) {
+      (0, import_runtime.getAuthLogger)().warn(`[credentialResolver] FD handoff read failed: ${formatErr(err)}`);
+      return null;
     }
-    tryResolveKeychain() {
-        if (!this.opts.readKeychainToken)
-            return null;
-        try {
-            return this.opts.readKeychainToken();
-        }
-        catch (err) {
-            (0, runtime_js_1.getAuthLogger)().warn(`[credentialResolver] keychain read failed: ${formatErr(err)}`);
-            return null;
-        }
+  }
+  tryResolveKeychain() {
+    if (!this.opts.readKeychainToken)
+      return null;
+    try {
+      return this.opts.readKeychainToken();
+    } catch (err) {
+      (0, import_runtime.getAuthLogger)().warn(`[credentialResolver] keychain read failed: ${formatErr(err)}`);
+      return null;
     }
-    tryResolveFile() {
-        if (!this.opts.readFileToken)
-            return null;
-        try {
-            return this.opts.readFileToken();
-        }
-        catch (err) {
-            (0, runtime_js_1.getAuthLogger)().warn(`[credentialResolver] file read failed: ${formatErr(err)}`);
-            return null;
-        }
+  }
+  tryResolveFile() {
+    if (!this.opts.readFileToken)
+      return null;
+    try {
+      return this.opts.readFileToken();
+    } catch (err) {
+      (0, import_runtime.getAuthLogger)().warn(`[credentialResolver] file read failed: ${formatErr(err)}`);
+      return null;
     }
-    async tryResolveInteractive() {
-        if (!this.opts.runInteractiveLogin)
-            return null;
-        if (this.opts.isHeadless?.())
-            return null;
-        try {
-            return await this.opts.runInteractiveLogin();
-        }
-        catch (err) {
-            (0, runtime_js_1.getAuthLogger)().warn(`[credentialResolver] interactive login failed: ${formatErr(err)}`);
-            return null;
-        }
+  }
+  async tryResolveInteractive() {
+    if (!this.opts.runInteractiveLogin)
+      return null;
+    if (this.opts.isHeadless?.())
+      return null;
+    try {
+      return await this.opts.runInteractiveLogin();
+    } catch (err) {
+      (0, import_runtime.getAuthLogger)().warn(`[credentialResolver] interactive login failed: ${formatErr(err)}`);
+      return null;
     }
+  }
 }
-exports.CredentialResolver = CredentialResolver;
 function formatErr(err) {
-    return err instanceof Error ? err.message : String(err);
+  return err instanceof Error ? err.message : String(err);
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthHelperUnavailableError,
+  AuthHelperUntrustedError,
+  CI_TOKEN_PREFIX,
+  CREDENTIAL_PRECEDENCE,
+  CredentialResolver,
+  PERSONAL_ACCESS_TOKEN_PREFIX,
+  __resetCredentialResolverForTest,
+  classifyTokenKind,
+  invalidateAuthHelperCache,
+  isStaticTokenKind
+});