@agentxm/client-core 0.1.6

package/dist/src/unstable/auth/credential-store.js

@@ -0,0 +1,262 @@
+/**
+ * CredentialStore Effect service — credential storage and auth policy.
+ *
+ * Tier 1: OS keychain (TODO: @napi-rs/keyring not yet added)
+ * Tier 2: Restricted-permission file (~/.config/axm/credentials.json)
+ *
+ * CI and container environments are token-only by policy. They do not persist
+ * credentials and should use AXM_TOKEN instead.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { makeAppError } from "../app-error/index.js";
+import { isCI } from "../cli-flags/index.js";
+import { decodeHandleSync } from "../extensions/handle.js";
+import { envOption, isContainer, isRoot, isSSH, isWSL } from "../utils/index.js";
+import { CredentialFileSchema } from "./schema.js";
+const decodeCredentialFileFromJsonString = Schema.decodeUnknownEffect(Schema.fromJsonString(CredentialFileSchema));
+export class CredentialStore extends ServiceMap.Service()("@agentxm/client-core/CredentialStore") {
+}
+// -----------------------------------------------------------------------------
+// Constants
+// -----------------------------------------------------------------------------
+const CREDENTIALS_FILENAME = "credentials.json";
+const CONFIG_DIR_NAME = "axm";
+const DIR_PERMISSIONS = 0o700;
+const FILE_PERMISSIONS = 0o600;
+// -----------------------------------------------------------------------------
+// Internal helpers (take fs/path as args to avoid context leakage)
+// -----------------------------------------------------------------------------
+const resolveHomeDir = (config) => Option.getOrElse(Option.orElse(Option.orElse(config.home, () => config.userProfile), () => config.homePath), () => "/tmp");
+const getCredentialsDir = (path, homeDir) => {
+    return path.join(homeDir, ".config", CONFIG_DIR_NAME);
+};
+const getCredentialsPath = (path, homeDir) => path.join(getCredentialsDir(path, homeDir), CREDENTIALS_FILENAME);
+const ensureCredentialsDir = (fs, path, homeDir) => Effect.gen(function* () {
+    const dir = getCredentialsDir(path, homeDir);
+    const exists = yield* fs.exists(dir).pipe(Effect.catch(() => Effect.succeed(false)));
+    if (!exists) {
+        yield* fs.makeDirectory(dir, { recursive: true }).pipe(Effect.mapError((error) => makeAppError({
+            code: "AUTH_CREDENTIAL_STORE_FAILED",
+            what: `Failed to create credentials directory: ${dir}`,
+            details: [String(error)],
+            howToFix: `Ensure you have write access to ~/.config/`,
+            cause: error,
+        })));
+        yield* fs.chmod(dir, DIR_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+    }
+});
+const checkFilePermissions = (fs, filePath) => fs.stat(filePath).pipe(Effect.map((stat) => (stat.mode & 0o777) > FILE_PERMISSIONS), Effect.catch(() => Effect.succeed(false)));
+const setFilePermissions = (fs, filePath) => fs.chmod(filePath, FILE_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+const readCredentialFile = (fs, path, homeDir) => Effect.gen(function* () {
+    const filePath = getCredentialsPath(path, homeDir);
+    const exists = yield* fs.exists(filePath).pipe(Effect.catch(() => Effect.succeed(false)));
+    if (!exists)
+        return Option.none();
+    const overly = yield* checkFilePermissions(fs, filePath);
+    if (overly) {
+        yield* Effect.logWarning("Credential file has overly permissive permissions.");
+    }
+    const content = yield* fs.readFileString(filePath).pipe(Effect.mapError((error) => makeAppError({
+        code: "AUTH_CREDENTIAL_STORE_FAILED",
+        what: "Failed to read credential file",
+        details: [String(error)],
+        cause: error,
+    })));
+    return yield* decodeCredentialFileFromJsonString(content).pipe(Effect.map((file) => Option.some(file)), Effect.mapError((error) => makeAppError({
+        code: "AUTH_CREDENTIAL_STORE_FAILED",
+        what: "Failed to parse credential file",
+        details: [String(error)],
+        howToFix: "The credential file may be corrupt. Delete it and re-authenticate with `axm login`.",
+        cause: error,
+    })), Effect.catch(() => Effect.logWarning("Credential file failed schema validation, treating as empty.").pipe(Effect.map(() => Option.none()))));
+});
+const writeCredentialFile = (fs, path, homeDir, data) => Effect.gen(function* () {
+    yield* ensureCredentialsDir(fs, path, homeDir);
+    const filePath = getCredentialsPath(path, homeDir);
+    const encoded = yield* Schema.encodeEffect(CredentialFileSchema)(data).pipe(Effect.mapError((error) => makeAppError({
+        code: "AUTH_CREDENTIAL_STORE_FAILED",
+        what: "Failed to encode credential file",
+        details: [String(error)],
+        cause: error,
+    })));
+    const content = JSON.stringify(encoded, null, 2);
+    yield* fs.writeFileString(filePath, content).pipe(Effect.mapError((error) => makeAppError({
+        code: "AUTH_CREDENTIAL_STORE_FAILED",
+        what: "Failed to write credential file",
+        details: [String(error)],
+        cause: error,
+    })));
+    yield* setFilePermissions(fs, filePath);
+});
+const emptyCredentialFile = {
+    version: 1,
+    registries: {},
+};
+export const detectEnvironment = Effect.gen(function* () {
+    return {
+        isSSH: yield* isSSH,
+        isContainer: yield* isContainer,
+        isWSL: yield* isWSL,
+        isCI: yield* isCI,
+        isRoot: isRoot(),
+    };
+});
+/**
+ * Select storage tier based on detected environment.
+ *
+ * Until keychain support lands, all persisted credentials use the restricted
+ * file backend. Whether persistence is allowed is a separate policy decision.
+ */
+export const selectTier = (_env) => "restricted-file";
+export const canUsePersistedCredentials = (env) => !env.isContainer && !env.isCI;
+export const makePersistedCredentialsUnsupportedError = () => makeAppError({
+    code: "AUTH_TOKEN_REQUIRED",
+    what: "Persisted credentials are disabled in CI and container environments.",
+    howToFix: "Set the AXM_TOKEN environment variable instead of running `axm login`.",
+});
+// -----------------------------------------------------------------------------
+// Live layer
+// -----------------------------------------------------------------------------
+export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const home = yield* envOption("HOME");
+    const userProfile = yield* envOption("USERPROFILE");
+    const homePath = yield* envOption("HOMEPATH");
+    const homeDir = resolveHomeDir({ home, userProfile, homePath });
+    const env = yield* detectEnvironment;
+    const storageTier = selectTier(env);
+    const persistedCredentialsAllowed = canUsePersistedCredentials(env);
+    const save = Effect.fn("CredentialStore.save")(function* (registryUrl, handle, credentials) {
+        if (!persistedCredentialsAllowed) {
+            return yield* makePersistedCredentialsUnsupportedError();
+        }
+        if (env.isRoot) {
+            yield* Effect.logWarning("Running as root. Credentials will be owned by root.");
+        }
+        const existing = yield* readCredentialFile(fs, path, homeDir);
+        const file = Option.getOrElse(existing, () => emptyCredentialFile);
+        const registryEntry = file.registries[registryUrl] ?? { accounts: {} };
+        const updatedAccounts = {};
+        for (const [h, entry] of Object.entries(registryEntry.accounts)) {
+            if (entry !== undefined) {
+                updatedAccounts[h] = { ...entry, active: false };
+            }
+        }
+        updatedAccounts[handle] = {
+            access_token: credentials.access_token,
+            refresh_token: credentials.refresh_token,
+            expires_at: credentials.expires_at,
+            active: true,
+        };
+        const updated = {
+            ...file,
+            registries: {
+                ...file.registries,
+                [registryUrl]: { accounts: updatedAccounts },
+            },
+        };
+        yield* writeCredentialFile(fs, path, homeDir, updated);
+    });
+    const load = Effect.fn("CredentialStore.load")(function* (registryUrl) {
+        const existing = yield* readCredentialFile(fs, path, homeDir);
+        if (Option.isNone(existing))
+            return Option.none();
+        const registry = existing.value.registries[registryUrl];
+        if (!registry)
+            return Option.none();
+        for (const [handle, entry] of Object.entries(registry.accounts)) {
+            if (entry?.active) {
+                return Option.some({
+                    handle: decodeHandleSync(handle),
+                    access_token: entry.access_token,
+                    refresh_token: entry.refresh_token,
+                    expires_at: entry.expires_at,
+                });
+            }
+        }
+        return Option.none();
+    });
+    const clear = Effect.fn("CredentialStore.clear")(function* (registryUrl) {
+        const existing = yield* readCredentialFile(fs, path, homeDir);
+        if (Option.isNone(existing))
+            return;
+        const { [registryUrl]: _, ...remainingRegistries } = existing.value.registries;
+        const updated = {
+            ...existing.value,
+            registries: remainingRegistries,
+        };
+        yield* writeCredentialFile(fs, path, homeDir, updated);
+    });
+    return {
+        tier: storageTier,
+        allowsPersistedCredentials: persistedCredentialsAllowed,
+        save,
+        load,
+        clear,
+    };
+}));
+// -----------------------------------------------------------------------------
+// Test layer factory
+// -----------------------------------------------------------------------------
+export const CredentialStoreTest = (tier = "restricted-file", initialData, allowsPersistedCredentials) => {
+    let data = initialData ?? emptyCredentialFile;
+    const persistedCredentialsAllowed = allowsPersistedCredentials ?? true;
+    return Layer.succeed(CredentialStore, {
+        tier,
+        allowsPersistedCredentials: persistedCredentialsAllowed,
+        save: (registryUrl, handle, credentials) => persistedCredentialsAllowed
+            ? Effect.sync(() => {
+                const registryEntry = data.registries[registryUrl] ?? { accounts: {} };
+                const updatedAccounts = {};
+                for (const [h, entry] of Object.entries(registryEntry.accounts)) {
+                    if (entry !== undefined) {
+                        updatedAccounts[h] = { ...entry, active: false };
+                    }
+                }
+                updatedAccounts[handle] = {
+                    access_token: credentials.access_token,
+                    refresh_token: credentials.refresh_token,
+                    expires_at: credentials.expires_at,
+                    active: true,
+                };
+                data = {
+                    ...data,
+                    registries: {
+                        ...data.registries,
+                        [registryUrl]: { accounts: updatedAccounts },
+                    },
+                };
+            })
+            : Effect.fail(makePersistedCredentialsUnsupportedError()),
+        load: (registryUrl) => Effect.sync(() => {
+            const registry = data.registries[registryUrl];
+            if (!registry)
+                return Option.none();
+            for (const [handle, entry] of Object.entries(registry.accounts)) {
+                if (entry?.active) {
+                    return Option.some({
+                        handle: decodeHandleSync(handle),
+                        access_token: entry.access_token,
+                        refresh_token: entry.refresh_token,
+                        expires_at: entry.expires_at,
+                    });
+                }
+            }
+            return Option.none();
+        }),
+        clear: (registryUrl) => Effect.sync(() => {
+            const { [registryUrl]: _, ...rest } = data.registries;
+            data = { ...data, registries: rest };
+        }),
+    });
+};
+//# sourceMappingURL=credential-store.js.map

package/dist/src/unstable/auth/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../../src/unstable/auth/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAe,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,kCAAkC,GAAG,MAAM,CAAC,mBAAmB,CACnE,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAC5C,CAAC;AAsBF,MAAM,OAAO,eAAgB,SAAQ,UAAU,CAAC,OAAO,EAA2C,CAChG,sCAAsC,CACvC;CAAG;AAEJ,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAEhF,MAAM,cAAc,GAAG,CAAC,MAIvB,EAAU,EAAE,CACX,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACpD,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CACtB,EACD,GAAG,EAAE,CAAC,MAAM,CACb,CAAC;AAEJ,MAAM,iBAAiB,GAAG,CAAC,IAAe,EAAE,OAAe,EAAE,EAAE;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,IAAe,EAAE,OAAe,EAAE,EAAE,CAC9D,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAEpE,MAAM,oBAAoB,GAAG,CAAC,EAAyB,EAAE,IAAe,EAAE,OAAe,EAAE,EAAE,CAC3F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,2CAA2C,GAAG,EAAE;YACtD,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,QAAQ,EAAE,4CAA4C;YACtD,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;QACF,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,CAAC,EAAyB,EAAE,QAAgB,EAAE,EAAE,CAC3E,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAC,EAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC1C,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CAAC,EAAyB,EAAE,QAAgB,EAAE,EAAE,CACzE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7E,MAAM,kBAAkB,GAAG,CACzB,EAAyB,EACzB,IAAe,EACf,OAAe,EACyC,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAkB,CAAC;IAElD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oDAAoD,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;QACX,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CACF,CAAC;IAEF,OAAO,KAAK,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;QACX,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,QAAQ,EACN,qFAAqF;QACvF,KAAK,EAAE,KAAK;KACb,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CAAC,UAAU,CAAC,8DAA8D,CAAC,CAAC,IAAI,CACpF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAkB,CAAC,CAChD,CACF,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,mBAAmB,GAAG,CAC1B,EAAyB,EACzB,IAAe,EACf,OAAe,EACf,IAAoB,EACW,EAAE,CACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CACzE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;QACX,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;QACX,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CACF,CAAC;IACF,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEL,MAAM,mBAAmB,GAAmB;IAC1C,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,EAAE;CACf,CAAC;AAcF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK;QACnB,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK;QACnB,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,EAAE;KACS,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAqB,EAAe,EAAE,CAAC,iBAAiB,CAAC;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAoB,EAAW,EAAE,CAC1E,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AAEhC,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,EAAE,CAC3D,YAAY,CAAC;IACX,IAAI,EAAE,qBAAqB;IAC3B,IAAI,EAAE,sEAAsE;IAC5E,QAAQ,EAAE,wEAAwE;CACnF,CAAC,CAAC;AAEL,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAC7C,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,IAAI,GAAmC,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAC5E,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW;QACzC,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,wCAAwC,EAAE,CAAC;QAC3D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,qDAAqD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEnE,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvE,MAAM,eAAe,GAGjB,EAAE,CAAC;QACP,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,GAAG;YACxB,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,MAAM,OAAO,GAAmB;YAC9B,GAAG,IAAI;YACP,UAAU,EAAE;gBACV,GAAG,IAAI,CAAC,UAAU;gBAClB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;aAC7C;SACF,CAAC;QAEF,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAmC,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAC5E,QAAQ,CAAC,EAAE,WAAW;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,EAAqB,CAAC;QAErE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,EAAqB,CAAC;QAEvD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,OAAO,MAAM,CAAC,IAAI,CAAoB;oBACpC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC;oBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,EAAqB,CAAC;IAC1C,CAAC,CACF,CAAC;IACF,MAAM,KAAK,GAAoC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAC/E,QAAQ,CAAC,EAAE,WAAW;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO;QAEpC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/E,MAAM,OAAO,GAAmB;YAC9B,GAAG,QAAQ,CAAC,KAAK;YACjB,UAAU,EAAE,mBAAmB;SAChC,CAAC;QAEF,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CACF,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,0BAA0B,EAAE,2BAA2B;QACvD,IAAI;QACJ,IAAI;QACJ,KAAK;KAC2B,CAAC;AACrC,CAAC,CAAC,CACH,CAAC;AAEF,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAoB,iBAAiB,EACrC,WAA4B,EAC5B,0BAAoC,EACpC,EAAE;IACF,IAAI,IAAI,GAAmB,WAAW,IAAI,mBAAmB,CAAC;IAC9D,MAAM,2BAA2B,GAAG,0BAA0B,IAAI,IAAI,CAAC;IAEvE,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE;QACpC,IAAI;QACJ,0BAA0B,EAAE,2BAA2B;QAEvD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CACzC,2BAA2B;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACvE,MAAM,eAAe,GAGjB,EAAE,CAAC;gBACP,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;oBACnD,CAAC;gBACH,CAAC;gBACD,eAAe,CAAC,MAAM,CAAC,GAAG;oBACxB,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,aAAa,EAAE,WAAW,CAAC,aAAa;oBACxC,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,MAAM,EAAE,IAAI;iBACb,CAAC;gBACF,IAAI,GAAG;oBACL,GAAG,IAAI;oBACP,UAAU,EAAE;wBACV,GAAG,IAAI,CAAC,UAAU;wBAClB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;qBAC7C;iBACF,CAAC;YACJ,CAAC,CAAC;YACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC;QAE7D,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAqB,CAAC;YACvD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,IAAI,CAAoB;wBACpC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC;wBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;wBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;wBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,EAAqB,CAAC;QAC1C,CAAC,CAAC;QAEJ,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;YACtD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC;KAC4B,CAAC,CAAC;AACtC,CAAC,CAAC"}

package/dist/src/unstable/auth/device-login.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Shared device-code login flow for auth commands and guards.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Layer from "effect/Layer";
+import { CliRenderer } from "../cli-renderer/index.js";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+export interface DeviceLoginInteractionService {
+    readonly openBrowser: (url: string) => Effect.Effect<boolean>;
+    readonly copyToClipboard: (text: string) => Effect.Effect<boolean>;
+}
+declare const DeviceLoginInteraction_base: ServiceMap.ServiceClass<DeviceLoginInteraction, "@agentxm/client-core/DeviceLoginInteraction", DeviceLoginInteractionService>;
+export declare class DeviceLoginInteraction extends DeviceLoginInteraction_base {
+}
+export interface DeviceLoginInteractionTestState {
+    readonly openBrowserCalls: Array<string>;
+    readonly copyToClipboardCalls: Array<string>;
+}
+export declare const DeviceLoginInteractionTest: (overrides?: {
+    readonly openBrowser?: (url: string) => Effect.Effect<boolean>;
+    readonly copyToClipboard?: (text: string) => Effect.Effect<boolean>;
+}) => {
+    layer: Layer.Layer<DeviceLoginInteraction, never, never>;
+    state: DeviceLoginInteractionTestState;
+};
+export declare const runDeviceLogin: (registryUrl: string) => Effect.Effect<undefined, import("../app-error/app-error.ts").AppError, AuthClient | CredentialStore | CliRenderer | DeviceLoginInteraction>;
+export {};
+//# sourceMappingURL=device-login.d.ts.map

package/dist/src/unstable/auth/device-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/device-login.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAA4C,MAAM,uBAAuB,CAAC;AAOlG,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CACpE;;AAED,qBAAa,sBAAuB,SAAQ,2BAGM;CAAG;AAMrD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,eAAO,MAAM,0BAA0B,GAAI,YAAY;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CACrE;;;CAoBA,CAAC;AAkDF,eAAO,MAAM,cAAc,GAAI,aAAa,MAAM,gJA0B9C,CAAC"}

package/dist/src/unstable/auth/device-login.js

@@ -0,0 +1,88 @@
+/**
+ * Shared device-code login flow for auth commands and guards.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Layer from "effect/Layer";
+import { CliRenderer } from "../cli-renderer/index.js";
+import { normalizeHandle } from "../extensions/handle.js";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore, makePersistedCredentialsUnsupportedError } from "./credential-store.js";
+export class DeviceLoginInteraction extends ServiceMap.Service()("@agentxm/client-core/DeviceLoginInteraction") {
+}
+export const DeviceLoginInteractionTest = (overrides) => {
+    const state = {
+        openBrowserCalls: [],
+        copyToClipboardCalls: [],
+    };
+    const layer = Layer.succeed(DeviceLoginInteraction, {
+        openBrowser: (url) => Effect.gen(function* () {
+            state.openBrowserCalls.push(url);
+            return yield* overrides?.openBrowser?.(url) ?? Effect.succeed(false);
+        }),
+        copyToClipboard: (text) => Effect.gen(function* () {
+            state.copyToClipboardCalls.push(text);
+            return yield* overrides?.copyToClipboard?.(text) ?? Effect.succeed(false);
+        }),
+    });
+    return { layer, state };
+};
+// -----------------------------------------------------------------------------
+// Device login orchestration
+// -----------------------------------------------------------------------------
+const UNKNOWN_HANDLE = normalizeHandle("@unknown");
+const persistLoginCredentials = (registryUrl, token) => Effect.gen(function* () {
+    const authClient = yield* AuthClient;
+    const credStore = yield* CredentialStore;
+    const meResult = yield* authClient
+        .getMe(token.access_token)
+        .pipe(Effect.retry({ times: 1 }), Effect.option);
+    const handle = Option.match(meResult, {
+        onNone: () => UNKNOWN_HANDLE,
+        onSome: (me) => me.userHandle,
+    });
+    yield* credStore.save(registryUrl, handle, {
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        expires_at: token.expires_at,
+    });
+    return Option.map(meResult, (me) => me.userHandle);
+});
+const presentDeviceFlow = (verificationUrl, userCode) => Effect.gen(function* () {
+    const renderer = yield* CliRenderer;
+    const interaction = yield* DeviceLoginInteraction;
+    // Copy to clipboard first so code is ready before browser loads
+    const copiedToClipboard = yield* interaction.copyToClipboard(userCode);
+    const openedBrowser = yield* interaction.openBrowser(verificationUrl);
+    if (openedBrowser) {
+        yield* renderer.step("Opening browser to sign in...");
+        yield* renderer.message(verificationUrl);
+    }
+    else {
+        yield* renderer.step(`Open this URL in your browser: ${verificationUrl}`);
+    }
+    const clipboardHint = copiedToClipboard ? " (copied to clipboard)" : "";
+    yield* renderer.step(`Your verification code: ${userCode}${clipboardHint}`);
+});
+export const runDeviceLogin = (registryUrl) => Effect.gen(function* () {
+    const authClient = yield* AuthClient;
+    const credStore = yield* CredentialStore;
+    const renderer = yield* CliRenderer;
+    if (!credStore.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    const deviceFlow = yield* authClient.initiateDeviceFlow();
+    const verificationUrl = deviceFlow.verification_uri_complete ?? deviceFlow.verification_uri;
+    yield* presentDeviceFlow(verificationUrl, deviceFlow.user_code);
+    const token = yield* renderer.withSpinner("Waiting for approval in browser...", () => authClient.pollDeviceToken(deviceFlow.device_code, deviceFlow.interval));
+    const handle = yield* persistLoginCredentials(registryUrl, token);
+    const registryHost = new URL(registryUrl).host;
+    yield* Option.match(handle, {
+        onNone: () => renderer.success(`Logged in to ${registryHost}.`),
+        onSome: (userHandle) => renderer.success(`Logged in to ${registryHost} as ${userHandle}.`),
+    });
+});
+//# sourceMappingURL=device-login.js.map

package/dist/src/unstable/auth/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../../../../src/unstable/auth/device-login.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AAYlG,MAAM,OAAO,sBAAuB,SAAQ,UAAU,CAAC,OAAO,EAG3D,CAAC,6CAA6C,CAAC;CAAG;AAWrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,SAG1C,EAAE,EAAE;IACH,MAAM,KAAK,GAAoC;QAC7C,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,EAAE;KACzB,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE;QAClD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC;QACJ,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC;KACmC,CAAC,CAAC;IAE3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,MAAM,cAAc,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;AAEnD,MAAM,uBAAuB,GAAG,CAAC,WAAmB,EAAE,KAA8B,EAAE,EAAE,CACtF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAEzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU;SAC/B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;SACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc;QAC5B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU;KAC9B,CAAC,CAAC;IAEH,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE;QACzC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,eAAuB,EAAE,QAAgB,EAAE,EAAE,CACtE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;IAElD,gEAAgE;IAChE,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IAEtE,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACtD,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,kCAAkC,eAAe,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,QAAQ,GAAG,aAAa,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAmB,EAAE,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IAEpC,IAAI,CAAC,SAAS,CAAC,0BAA0B,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,wCAAwC,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAC1D,MAAM,eAAe,GAAG,UAAU,CAAC,yBAAyB,IAAI,UAAU,CAAC,gBAAgB,CAAC;IAE5F,KAAK,CAAC,CAAC,iBAAiB,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,oCAAoC,EAAE,GAAG,EAAE,CACnF,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CACxE,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IAC/C,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;QAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,YAAY,GAAG,CAAC;QAC/D,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,YAAY,OAAO,UAAU,GAAG,CAAC;KAC3F,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/unstable/auth/guard-interaction.d.ts

@@ -0,0 +1,26 @@
+import * as FileSystem from "effect/FileSystem";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Terminal from "effect/Terminal";
+import type { AppError } from "../app-error/index.js";
+import type { PromptCancelled } from "../cli-prompt/prompt-cancelled.js";
+export interface AuthGuardInteractionService {
+    readonly confirmLogin: () => Effect.Effect<boolean, PromptCancelled | AppError>;
+}
+declare const AuthGuardInteraction_base: ServiceMap.ServiceClass<AuthGuardInteraction, "axm.sh/AuthGuardInteraction", AuthGuardInteractionService>;
+export declare class AuthGuardInteraction extends AuthGuardInteraction_base {
+}
+export declare const AuthGuardInteractionLive: Layer.Layer<AuthGuardInteraction, never, FileSystem.FileSystem | Path.Path | Terminal.Terminal>;
+export interface AuthGuardInteractionTestState {
+    readonly confirmLoginCalls: Array<null>;
+}
+export declare const AuthGuardInteractionTest: (overrides?: {
+    readonly confirmLogin?: () => Effect.Effect<boolean, PromptCancelled | AppError>;
+}) => {
+    layer: Layer.Layer<AuthGuardInteraction, never, never>;
+    state: AuthGuardInteractionTestState;
+};
+export {};
+//# sourceMappingURL=guard-interaction.d.ts.map

package/dist/src/unstable/auth/guard-interaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-interaction.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/guard-interaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAIzE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,CAAC;CACjF;;AAED,qBAAa,oBAAqB,SAAQ,yBAGR;CAAG;AAErC,eAAO,MAAM,wBAAwB,iGAmBpC,CAAC;AAEF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,eAAO,MAAM,wBAAwB,GAAI,YAAY;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,CAAC;CAClF;;;CAcA,CAAC"}

package/dist/src/unstable/auth/guard-interaction.js

@@ -0,0 +1,35 @@
+import * as FileSystem from "effect/FileSystem";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Terminal from "effect/Terminal";
+import { Prompt } from "effect/unstable/cli";
+import { requireInteractive } from "../cli/prompt/index.js";
+const confirmLoginMessage = "You need to sign in to publish. Sign in now?";
+export class AuthGuardInteraction extends ServiceMap.Service()("axm.sh/AuthGuardInteraction") {
+}
+export const AuthGuardInteractionLive = Layer.effect(AuthGuardInteraction, Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const terminal = yield* Terminal.Terminal;
+    const promptEnvironment = Layer.mergeAll(Layer.succeed(FileSystem.FileSystem, fileSystem), Layer.succeed(Path.Path, path), Layer.succeed(Terminal.Terminal, terminal));
+    return {
+        confirmLogin: () => requireInteractive(Prompt.confirm({ message: confirmLoginMessage }), {
+            message: confirmLoginMessage,
+        }).pipe(Effect.provide(promptEnvironment)),
+    };
+}));
+export const AuthGuardInteractionTest = (overrides) => {
+    const state = {
+        confirmLoginCalls: [],
+    };
+    const layer = Layer.succeed(AuthGuardInteraction, {
+        confirmLogin: () => Effect.gen(function* () {
+            state.confirmLoginCalls.push(null);
+            return yield* overrides?.confirmLogin?.() ?? Effect.succeed(true);
+        }),
+    });
+    return { layer, state };
+};
+//# sourceMappingURL=guard-interaction.js.map

package/dist/src/unstable/auth/guard-interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-interaction.js","sourceRoot":"","sources":["../../../../src/unstable/auth/guard-interaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAG5D,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAM3E,MAAM,OAAO,oBAAqB,SAAQ,UAAU,CAAC,OAAO,EAGzD,CAAC,6BAA6B,CAAC;CAAG;AAErC,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,MAAM,CAClD,oBAAoB,EACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CACtC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EAChD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAC9B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC3C,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,GAAG,EAAE,CACjB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE;YACnE,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;KACP,CAAC;AAC1C,CAAC,CAAC,CACH,CAAC;AAMF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,SAExC,EAAE,EAAE;IACH,MAAM,KAAK,GAAkC;QAC3C,iBAAiB,EAAE,EAAE;KACtB,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE;QAChD,YAAY,EAAE,GAAG,EAAE,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC,CAAC;KACiC,CAAC,CAAC;IAEzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/src/unstable/auth/guard.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Auth guard combinator for commands that require authentication.
+ *
+ * Wraps an Effect with a pre-check for authentication. If no token is
+ * resolvable, fails immediately with an actionable error message directing
+ * the user to `axm auth login`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { type AppError } from "../app-error/index.js";
+import { CredentialStore, RegistryUrl } from "./index.js";
+/**
+ * Wraps an Effect with an auth guard.
+ *
+ * - If the target registry is local, runs the inner effect directly.
+ * - If a token is already resolvable, runs the inner effect directly.
+ * - If no token: fails with `AUTH_LOGIN_REQUIRED`.
+ */
+export declare const withAuthGuard: <A, E, R>(effect: Effect.Effect<A, E | AppError, R>, options?: {
+    registryUrl?: string;
+}) => Effect.Effect<A, AppError | E, RegistryUrl | CredentialStore | R>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/src/unstable/auth/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,eAAe,EACf,WAAW,EAGZ,MAAM,YAAY,CAAC;AA+BpB;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACnC,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,EACzC,UAAU;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,sEA0BhC,CAAC"}

package/dist/src/unstable/auth/guard.js

@@ -0,0 +1,64 @@
+/**
+ * Auth guard combinator for commands that require authentication.
+ *
+ * Wraps an Effect with a pre-check for authentication. If no token is
+ * resolvable, fails immediately with an actionable error message directing
+ * the user to `axm auth login`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { makeAppError } from "../app-error/index.js";
+import { CredentialStore, RegistryUrl, makePersistedCredentialsUnsupportedError, resolveRequestToken, } from "./index.js";
+// -----------------------------------------------------------------------------
+// Constants
+// -----------------------------------------------------------------------------
+const AUTH_LOGIN_REQUIRED = makeAppError({
+    code: "AUTH_LOGIN_REQUIRED",
+    what: "Authentication required",
+    howToFix: 'Run "axm auth login" to sign in, then retry.',
+});
+// -----------------------------------------------------------------------------
+// Auth guard combinator
+// -----------------------------------------------------------------------------
+const isRemoteRegistryUrl = (registryUrl) => Effect.try({
+    try: () => {
+        const protocol = new URL(registryUrl).protocol;
+        return protocol === "http:" || protocol === "https:";
+    },
+    catch: (error) => makeAppError({
+        code: "AUTH_INVALID_REGISTRY_URL",
+        what: `Invalid registry URL: ${registryUrl}`,
+        howToFix: "Check the registry URL in your settings.",
+        cause: error,
+    }),
+});
+/**
+ * Wraps an Effect with an auth guard.
+ *
+ * - If the target registry is local, runs the inner effect directly.
+ * - If a token is already resolvable, runs the inner effect directly.
+ * - If no token: fails with `AUTH_LOGIN_REQUIRED`.
+ */
+export const withAuthGuard = (effect, options) => Effect.gen(function* () {
+    const defaultRegistryUrl = yield* RegistryUrl;
+    const targetRegistryUrl = options?.registryUrl ?? defaultRegistryUrl;
+    // Local registries do not require HTTP auth.
+    const isRemote = yield* isRemoteRegistryUrl(targetRegistryUrl);
+    if (!isRemote) {
+        return yield* effect;
+    }
+    const token = yield* resolveRequestToken(targetRegistryUrl, defaultRegistryUrl);
+    // Token available — proceed directly
+    if (Option.isSome(token)) {
+        return yield* effect;
+    }
+    const credStore = yield* CredentialStore;
+    if (!credStore.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    // No token — fail fast
+    return yield* AUTH_LOGIN_REQUIRED;
+});
+//# sourceMappingURL=guard.js.map

package/dist/src/unstable/auth/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../../src/unstable/auth/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,eAAe,EACf,WAAW,EACX,wCAAwC,EACxC,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,YAAY,CAAC;IACvC,IAAI,EAAE,qBAAqB;IAC3B,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,8CAA8C;CACzD,CAAC,CAAC;AAEH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAE,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QAC/C,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IACvD,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,YAAY,CAAC;QACX,IAAI,EAAE,2BAA2B;QACjC,IAAI,EAAE,yBAAyB,WAAW,EAAE;QAC5C,QAAQ,EAAE,0CAA0C;QACpD,KAAK,EAAE,KAAK;KACb,CAAC;CACL,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAyC,EACzC,OAAkC,EAClC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IAC9C,MAAM,iBAAiB,GAAG,OAAO,EAAE,WAAW,IAAI,kBAAkB,CAAC;IAErE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IAEhF,qCAAqC;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,0BAA0B,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,wCAAwC,EAAE,CAAC;IAC3D,CAAC;IAED,uBAAuB;IACvB,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC;AACpC,CAAC,CAAC,CAAC"}

package/dist/src/unstable/auth/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Auth feature module.
+ *
+ * Provides credential storage, environment detection, token resolution,
+ * auth middleware, and device login orchestration for authentication.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+export type { CredentialEntry, CredentialFile, StorageTier, StoredCredentials, TokenSource, } from "./schema.js";
+export { CredentialEntrySchema, CredentialFileSchema, CredentialStoreTokenSource, EnvVarTokenSource, FlagTokenSource, RegistryAccountsSchema, } from "./schema.js";
+export type { CredentialStoreService, EnvironmentInfo } from "./credential-store.js";
+export { canUsePersistedCredentials, CredentialStore, CredentialStoreLive, CredentialStoreTest, detectEnvironment, makePersistedCredentialsUnsupportedError, selectTier, } from "./credential-store.js";
+export { resolveRequiredToken, resolveToken, resolveStoredToken, refreshStoredToken, resolveAmbientToken, resolveRequestToken, } from "./token-resolution.js";
+export { RegistryUrl } from "./registry-url.js";
+export { AuthMiddlewareLive, makeAuthMiddlewareLive } from "./auth-middleware.js";
+export type { AuthClientService, DeviceFlowResponse, MeResponse, PollResult, } from "./auth-client.js";
+export { AuthClient, AuthClientLive, AuthClientTest, pollOnce } from "./auth-client.js";
+export type { NormalizedTokenResponse } from "./oauth-contract.js";
+export type { DeviceLoginInteractionService, DeviceLoginInteractionTestState, } from "./device-login.js";
+export { DeviceLoginInteraction, DeviceLoginInteractionTest, runDeviceLogin, } from "./device-login.js";
+export type { AuthLoginInteractionService, AuthLoginInteractionTestState, } from "./login-interaction.js";
+export { AuthLoginInteraction, AuthLoginInteractionLive, AuthLoginInteractionTest, } from "./login-interaction.js";
+export type { AuthGuardInteractionService, AuthGuardInteractionTestState, } from "./guard-interaction.js";
+export { AuthGuardInteraction, AuthGuardInteractionLive, AuthGuardInteractionTest, } from "./guard-interaction.js";
+export { withAuthGuard } from "./guard.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/unstable/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EACV,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,YAAY,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,wCAAwC,EACxC,UAAU,GACX,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGlF,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGxF,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAGnE,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACV,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}