@agentxm/client-core 0.1.6

package/dist/src/unstable/auth/index.js

@@ -0,0 +1,23 @@
+/**
+ * Auth feature module.
+ *
+ * Provides credential storage, environment detection, token resolution,
+ * auth middleware, and device login orchestration for authentication.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+export { CredentialEntrySchema, CredentialFileSchema, CredentialStoreTokenSource, EnvVarTokenSource, FlagTokenSource, RegistryAccountsSchema, } from "./schema.js";
+export { canUsePersistedCredentials, CredentialStore, CredentialStoreLive, CredentialStoreTest, detectEnvironment, makePersistedCredentialsUnsupportedError, selectTier, } from "./credential-store.js";
+// Token resolution
+export { resolveRequiredToken, resolveToken, resolveStoredToken, refreshStoredToken, resolveAmbientToken, resolveRequestToken, } from "./token-resolution.js";
+// Registry URL service
+export { RegistryUrl } from "./registry-url.js";
+// Auth middleware
+export { AuthMiddlewareLive, makeAuthMiddlewareLive } from "./auth-middleware.js";
+export { AuthClient, AuthClientLive, AuthClientTest, pollOnce } from "./auth-client.js";
+export { DeviceLoginInteraction, DeviceLoginInteractionTest, runDeviceLogin, } from "./device-login.js";
+export { AuthLoginInteraction, AuthLoginInteractionLive, AuthLoginInteractionTest, } from "./login-interaction.js";
+export { AuthGuardInteraction, AuthGuardInteractionLive, AuthGuardInteractionTest, } from "./guard-interaction.js";
+export { withAuthGuard } from "./guard.js";
+//# sourceMappingURL=index.js.map

package/dist/src/unstable/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/unstable/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,wCAAwC,EACxC,UAAU,GACX,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,uBAAuB;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,kBAAkB;AAClB,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AASlF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAUxF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/src/unstable/auth/login-interaction.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Auth login interaction service.
+ *
+ * Best-effort platform integration for browser launch and clipboard copy.
+ * Provides both the CLI-specific AuthLoginInteraction and the core
+ * DeviceLoginInteraction service (used by core's runDeviceLogin).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/ServiceMap";
+import { DeviceLoginInteraction } from "./device-login.js";
+export interface AuthLoginInteractionService {
+    readonly openBrowser: (url: string) => Effect.Effect<boolean>;
+    readonly copyToClipboard: (text: string) => Effect.Effect<boolean>;
+}
+declare const AuthLoginInteraction_base: ServiceMap.ServiceClass<AuthLoginInteraction, "axm.sh/AuthLoginInteraction", AuthLoginInteractionService>;
+export declare class AuthLoginInteraction extends AuthLoginInteraction_base {
+}
+export declare const AuthLoginInteractionLive: Layer.Layer<DeviceLoginInteraction | AuthLoginInteraction, never, never>;
+export interface AuthLoginInteractionTestState {
+    readonly openBrowserCalls: Array<string>;
+    readonly copyToClipboardCalls: Array<string>;
+}
+export declare const AuthLoginInteractionTest: (overrides?: {
+    readonly openBrowser?: (url: string) => Effect.Effect<boolean>;
+    readonly copyToClipboard?: (text: string) => Effect.Effect<boolean>;
+}) => {
+    layer: Layer.Layer<DeviceLoginInteraction | AuthLoginInteraction, never, never>;
+    state: AuthLoginInteractionTestState;
+};
+export {};
+//# sourceMappingURL=login-interaction.d.ts.map

package/dist/src/unstable/auth/login-interaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-interaction.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/login-interaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAsC,MAAM,mBAAmB,CAAC;AAQ/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CACpE;;AAED,qBAAa,oBAAqB,SAAQ,yBAGR;CAAG;AAsErC,eAAO,MAAM,wBAAwB,0EAGpC,CAAC;AAEF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,eAAO,MAAM,wBAAwB,GAAI,YAAY;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CACrE;;;CAyBA,CAAC"}

package/dist/src/unstable/auth/login-interaction.js

@@ -0,0 +1,93 @@
+/**
+ * Auth login interaction service.
+ *
+ * Best-effort platform integration for browser launch and clipboard copy.
+ * Provides both the CLI-specific AuthLoginInteraction and the core
+ * DeviceLoginInteraction service (used by core's runDeviceLogin).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/ServiceMap";
+import { DeviceLoginInteraction } from "./device-login.js";
+export class AuthLoginInteraction extends ServiceMap.Service()("axm.sh/AuthLoginInteraction") {
+}
+const runCommand = (invocation) => Effect.tryPromise({
+    try: async () => {
+        const { spawn } = await import("node:child_process");
+        return await new Promise((resolve, reject) => {
+            const child = spawn(invocation.command, [...invocation.args], {
+                stdio: ["pipe", "ignore", "ignore"],
+                windowsHide: true,
+            });
+            child.on("error", reject);
+            child.on("close", (code) => resolve(code === 0));
+            child.stdin.on("error", () => resolve(false));
+            if (invocation.stdinText !== undefined) {
+                child.stdin.end(invocation.stdinText);
+            }
+            else {
+                child.stdin.end();
+            }
+        });
+    },
+    catch: () => false,
+}).pipe(Effect.catch(() => Effect.succeed(false)));
+const tryCommands = (invocations) => Effect.gen(function* () {
+    for (const invocation of invocations) {
+        const succeeded = yield* runCommand(invocation);
+        if (succeeded) {
+            return true;
+        }
+    }
+    return false;
+});
+const browserCommands = (url) => {
+    switch (process.platform) {
+        case "darwin":
+            return [{ command: "open", args: [url] }];
+        case "win32":
+            return [{ command: "cmd", args: ["/c", "start", "", url] }];
+        default:
+            return [{ command: "xdg-open", args: [url] }];
+    }
+};
+const clipboardCommands = (text) => {
+    switch (process.platform) {
+        case "darwin":
+            return [{ command: "pbcopy", args: [], stdinText: text }];
+        case "win32":
+            return [{ command: "clip", args: [], stdinText: text }];
+        default:
+            return [
+                { command: "wl-copy", args: [], stdinText: text },
+                { command: "xclip", args: ["-selection", "clipboard"], stdinText: text },
+                { command: "xsel", args: ["--clipboard", "--input"], stdinText: text },
+            ];
+    }
+};
+const interactionImpl = {
+    openBrowser: (url) => tryCommands(browserCommands(url)),
+    copyToClipboard: (text) => tryCommands(clipboardCommands(text)),
+};
+export const AuthLoginInteractionLive = Layer.mergeAll(Layer.succeed(AuthLoginInteraction, interactionImpl), Layer.succeed(DeviceLoginInteraction, interactionImpl));
+export const AuthLoginInteractionTest = (overrides) => {
+    const state = {
+        openBrowserCalls: [],
+        copyToClipboardCalls: [],
+    };
+    const impl = {
+        openBrowser: (url) => Effect.gen(function* () {
+            state.openBrowserCalls.push(url);
+            return yield* overrides?.openBrowser?.(url) ?? Effect.succeed(false);
+        }),
+        copyToClipboard: (text) => Effect.gen(function* () {
+            state.copyToClipboardCalls.push(text);
+            return yield* overrides?.copyToClipboard?.(text) ?? Effect.succeed(false);
+        }),
+    };
+    const layer = Layer.mergeAll(Layer.succeed(AuthLoginInteraction, impl), Layer.succeed(DeviceLoginInteraction, impl));
+    return { layer, state };
+};
+//# sourceMappingURL=login-interaction.js.map

package/dist/src/unstable/auth/login-interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-interaction.js","sourceRoot":"","sources":["../../../../src/unstable/auth/login-interaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAsC,MAAM,mBAAmB,CAAC;AAa/F,MAAM,OAAO,oBAAqB,SAAQ,UAAU,CAAC,OAAO,EAGzD,CAAC,6BAA6B,CAAC;CAAG;AAErC,MAAM,UAAU,GAAG,CAAC,UAA6B,EAAE,EAAE,CACnD,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAErD,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE;gBAC5D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACjD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAE9C,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACvC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;CACnB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAErD,MAAM,WAAW,GAAG,CAAC,WAA6C,EAAE,EAAE,CACpE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CAAC,GAAW,EAAoC,EAAE;IACxE,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,KAAK,OAAO;YACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D;YACE,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAoC,EAAE;IAC3E,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D;YACE,OAAO;gBACL,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBACjD,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;gBACxE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;aACvE,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAkC;IACrD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvD,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,QAAQ,CACpD,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAqD,CAAC,EAC1F,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,eAAe,CAAC,CACvD,CAAC;AAOF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,SAGxC,EAAE,EAAE;IACH,MAAM,KAAK,GAAkC;QAC3C,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,EAAE;KACzB,CAAC;IAEF,MAAM,IAAI,GAAkC;QAC1C,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC;QACJ,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC;KACL,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAC1B,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,IAA0C,CAAC,EAC/E,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAC5C,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/src/unstable/auth/oauth-contract.d.ts

@@ -0,0 +1,6 @@
+export interface NormalizedTokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_at: string;
+}
+//# sourceMappingURL=oauth-contract.d.ts.map

package/dist/src/unstable/auth/oauth-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-contract.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/oauth-contract.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B"}

package/dist/src/unstable/auth/oauth-contract.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth-contract.js.map

package/dist/src/unstable/auth/oauth-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-contract.js","sourceRoot":"","sources":["../../../../src/unstable/auth/oauth-contract.ts"],"names":[],"mappings":""}

package/dist/src/unstable/auth/registry-url.d.ts

@@ -0,0 +1,14 @@
+/**
+ * RegistryUrl service tag — configures which URL is the default registry.
+ *
+ * Extracted to its own module to avoid circular dependencies between
+ * auth-client.ts and auth-middleware.ts.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as ServiceMap from "effect/ServiceMap";
+declare const RegistryUrl_base: ServiceMap.ServiceClass<RegistryUrl, "@agentxm/client-core/RegistryUrl", string>;
+export declare class RegistryUrl extends RegistryUrl_base {
+}
+export {};
+//# sourceMappingURL=registry-url.d.ts.map

package/dist/src/unstable/auth/registry-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-url.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/registry-url.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;;AAEhD,qBAAa,WAAY,SAAQ,gBAEhC;CAAG"}

package/dist/src/unstable/auth/registry-url.js

@@ -0,0 +1,12 @@
+/**
+ * RegistryUrl service tag — configures which URL is the default registry.
+ *
+ * Extracted to its own module to avoid circular dependencies between
+ * auth-client.ts and auth-middleware.ts.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as ServiceMap from "effect/ServiceMap";
+export class RegistryUrl extends ServiceMap.Service()("@agentxm/client-core/RegistryUrl") {
+}
+//# sourceMappingURL=registry-url.js.map

package/dist/src/unstable/auth/registry-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-url.js","sourceRoot":"","sources":["../../../../src/unstable/auth/registry-url.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAEhD,MAAM,OAAO,WAAY,SAAQ,UAAU,CAAC,OAAO,EAAuB,CACxE,kCAAkC,CACnC;CAAG"}

package/dist/src/unstable/auth/schema.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Schema definitions for credential storage and token sources.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Schema from "effect/Schema";
+import { IsoDateTimeStringSchema } from "../date-time.js";
+import { type Handle } from "../extensions/handle.js";
+export declare const CredentialEntrySchema: Schema.Struct<{
+    readonly access_token: Schema.String;
+    readonly refresh_token: Schema.String;
+    readonly expires_at: Schema.String;
+    readonly active: Schema.Boolean;
+}>;
+export type CredentialEntry = Schema.Schema.Type<typeof CredentialEntrySchema>;
+export declare const RegistryAccountsSchema: Schema.Struct<{
+    readonly accounts: Schema.$Record<Schema.brand<Schema.String, "Handle">, Schema.Struct<{
+        readonly access_token: Schema.String;
+        readonly refresh_token: Schema.String;
+        readonly expires_at: Schema.String;
+        readonly active: Schema.Boolean;
+    }>>;
+}>;
+export type RegistryAccounts = Schema.Schema.Type<typeof RegistryAccountsSchema>;
+export declare const CredentialFileSchema: Schema.Struct<{
+    readonly version: Schema.Literal<1>;
+    readonly registries: Schema.$Record<Schema.String, Schema.Struct<{
+        readonly accounts: Schema.$Record<Schema.brand<Schema.String, "Handle">, Schema.Struct<{
+            readonly access_token: Schema.String;
+            readonly refresh_token: Schema.String;
+            readonly expires_at: Schema.String;
+            readonly active: Schema.Boolean;
+        }>>;
+    }>>;
+}>;
+export type CredentialFile = Schema.Schema.Type<typeof CredentialFileSchema>;
+declare const EnvVarTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "EnvVar";
+} & import("effect/Pipeable").Pipeable;
+export declare class EnvVarTokenSource extends EnvVarTokenSource_base<{
+    readonly token: string;
+}> {
+}
+declare const FlagTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "Flag";
+} & import("effect/Pipeable").Pipeable;
+export declare class FlagTokenSource extends FlagTokenSource_base<{
+    readonly token: string;
+}> {
+}
+declare const CredentialStoreTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "CredentialStore";
+} & import("effect/Pipeable").Pipeable;
+export declare class CredentialStoreTokenSource extends CredentialStoreTokenSource_base<{
+    readonly token: string;
+    readonly refresh_token: string;
+    readonly expires_at: Schema.Schema.Type<typeof IsoDateTimeStringSchema>;
+    readonly registryUrl: string;
+}> {
+}
+export type TokenSource = EnvVarTokenSource | FlagTokenSource | CredentialStoreTokenSource;
+export interface StoredCredentials {
+    readonly handle: Handle;
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_at: Schema.Schema.Type<typeof IsoDateTimeStringSchema>;
+}
+export type StorageTier = "keychain" | "restricted-file" | "plaintext-file";
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/unstable/auth/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAMpE,eAAO,MAAM,qBAAqB;;;;;EAehC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAM/E,eAAO,MAAM,sBAAsB;;;;;;;EAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMjF,eAAO,MAAM,oBAAoB;;;;;;;;;;EAS/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,oBAAoB,CAAC,CAAC;;;;AAM7E,qBAAa,iBAAkB,SAAQ,uBAA2B;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;CAAG;;;;AAEL,qBAAa,eAAgB,SAAQ,qBAAyB;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;CAAG;;;;AAEL,qBAAa,0BAA2B,SAAQ,gCAAoC;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;CAAG;AAEL,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAM3F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACzE;AAMD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,iBAAiB,GAAG,gBAAgB,CAAC"}

package/dist/src/unstable/auth/schema.js

@@ -0,0 +1,53 @@
+/**
+ * Schema definitions for credential storage and token sources.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Data from "effect/Data";
+import * as Schema from "effect/Schema";
+import { IsoDateTimeStringSchema } from "../date-time.js";
+import { HandleSchema } from "../extensions/handle.js";
+// -----------------------------------------------------------------------------
+// Credential Entry
+// -----------------------------------------------------------------------------
+export const CredentialEntrySchema = Schema.Struct({
+    access_token: Schema.String.pipe(Schema.annotateKey({ messageMissingKey: "access_token is required" })),
+    refresh_token: Schema.String.pipe(Schema.annotateKey({ messageMissingKey: "refresh_token is required" })),
+    expires_at: IsoDateTimeStringSchema.pipe(Schema.annotateKey({ messageMissingKey: "expires_at is required" })),
+    active: Schema.Boolean.pipe(Schema.annotateKey({ messageMissingKey: "active is required" })),
+}).annotate({
+    identifier: "CredentialEntry",
+    title: "Credential Entry",
+    description: "A saved login credential with access token, refresh token, and expiration time.",
+});
+// -----------------------------------------------------------------------------
+// Registry Accounts
+// -----------------------------------------------------------------------------
+export const RegistryAccountsSchema = Schema.Struct({
+    accounts: Schema.Record(HandleSchema, CredentialEntrySchema).pipe(Schema.annotateKey({ messageMissingKey: "accounts is required" })),
+}).annotate({
+    identifier: "RegistryAccounts",
+    title: "Registry Accounts",
+    description: "Accounts you're logged into on a registry, keyed by handle.",
+});
+// -----------------------------------------------------------------------------
+// Credential File (versioned, keyed by registry URL)
+// -----------------------------------------------------------------------------
+export const CredentialFileSchema = Schema.Struct({
+    version: Schema.Literal(1).pipe(Schema.annotateKey({ messageMissingKey: "version is required" })),
+    registries: Schema.Record(Schema.String, RegistryAccountsSchema).pipe(Schema.annotateKey({ messageMissingKey: "registries is required" })),
+}).annotate({
+    identifier: "CredentialFile",
+    title: "Credential File",
+    description: "Your saved credentials, organized by registry URL.",
+});
+// -----------------------------------------------------------------------------
+// Token Source (tagged union)
+// -----------------------------------------------------------------------------
+export class EnvVarTokenSource extends Data.TaggedClass("EnvVar") {
+}
+export class FlagTokenSource extends Data.TaggedClass("Flag") {
+}
+export class CredentialStoreTokenSource extends Data.TaggedClass("CredentialStore") {
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/unstable/auth/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/unstable/auth/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAe,MAAM,yBAAyB,CAAC;AAEpE,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9B,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CACtE;IACD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAC/B,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,CAAC,CACvE;IACD,UAAU,EAAE,uBAAuB,CAAC,IAAI,CACtC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CACpE;IACD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC,CAAC;CAC7F,CAAC,CAAC,QAAQ,CAAC;IACV,UAAU,EAAE,iBAAiB;IAC7B,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,iFAAiF;CAC/F,CAAC,CAAC;AAIH,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC,CAClE;CACF,CAAC,CAAC,QAAQ,CAAC;IACV,UAAU,EAAE,kBAAkB;IAC9B,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,6DAA6D;CAC3E,CAAC,CAAC;AAIH,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACjG,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CACpE;CACF,CAAC,CAAC,QAAQ,CAAC;IACV,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,iBAAiB;IACxB,WAAW,EAAE,oDAAoD;CAClE,CAAC,CAAC;AAIH,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,OAAO,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAE9D;CAAG;AAEL,MAAM,OAAO,eAAgB,SAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAE1D;CAAG;AAEL,MAAM,OAAO,0BAA2B,SAAQ,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAKhF;CAAG"}

package/dist/src/unstable/auth/token-resolution.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Token resolution with precedence chain.
+ *
+ * Resolves authentication tokens from multiple sources in priority order:
+ * 1. AXM_TOKEN environment variable
+ * 2. --token flag (per-command, passed as parameter)
+ * 3. Credential store lookup by registry URL
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { type AppError } from "../app-error/index.js";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { CredentialStoreTokenSource, type TokenSource } from "./schema.js";
+/**
+ * Resolve a token from the credential store only.
+ *
+ * Looks up stored credentials by origin URL. Does not check env vars or flags.
+ */
+export declare const resolveStoredToken: (origin: string) => Effect.Effect<Option.Option<CredentialStoreTokenSource>, AppError, CredentialStore>;
+export declare const refreshStoredToken: (tokenSource: CredentialStoreTokenSource) => Effect.Effect<CredentialStoreTokenSource, AppError, AuthClient | CredentialStore>;
+/**
+ * Resolve a token from ambient sources only (env var and flag).
+ *
+ * Does not access the credential store.
+ *
+ * Precedence:
+ * 1. AXM_TOKEN env var
+ * 2. --token flag (passed as `flagToken` parameter)
+ */
+export declare const resolveAmbientToken: (flagToken?: string) => Effect.Effect<Option.Option<TokenSource>, never, never>;
+/**
+ * Resolve the token that should be attached to a specific request target.
+ *
+ * Ambient sources are only considered for the configured default registry.
+ * Stored credentials remain scoped by request origin.
+ */
+export declare const resolveRequestToken: (requestUrl: string, defaultRegistryUrl: string, flagToken?: string) => Effect.Effect<Option.Option<TokenSource>, AppError, CredentialStore>;
+/**
+ * Resolve a token from the precedence chain.
+ *
+ * Precedence:
+ * 1. AXM_TOKEN env var
+ * 2. --token flag (passed as `flagToken` parameter)
+ * 3. CredentialStore lookup by registry URL
+ *
+ * Returns the stored token as-is without proactive refresh. Callers should
+ * handle 401 responses from the server (e.g., prompt re-login). The auth
+ * middleware handles automatic refresh on 401 for requests going through
+ * HttpClient.
+ *
+ * Returns `Option.none()` when no token is available from any source.
+ */
+export declare const resolveToken: (registryUrl: string, flagToken?: string) => Effect.Effect<Option.Option<TokenSource>, AppError, CredentialStore>;
+/**
+ * Resolve a token and fail with the correct auth policy error when none is available.
+ *
+ * In CI/container environments, persisted credentials are disabled by policy, so
+ * callers should surface `AUTH_TOKEN_REQUIRED` instead of suggesting `axm login`.
+ */
+export declare const resolveRequiredToken: (registryUrl: string, options?: {
+    readonly flagToken?: string;
+    readonly missingTokenError?: AppError;
+}) => Effect.Effect<TokenSource, AppError, CredentialStore>;
+//# sourceMappingURL=token-resolution.d.ts.map

package/dist/src/unstable/auth/token-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-resolution.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/token-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAA4C,MAAM,uBAAuB,CAAC;AAElG,OAAO,EACL,0BAA0B,EAI1B,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAsDrB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,eAAe,CASjF,CAAC;AAEL,eAAO,MAAM,kBAAkB,GAAI,aAAa,0BAA0B,sFAMtE,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,4DAWlD,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,EAClB,oBAAoB,MAAM,EAC1B,YAAY,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,eAAe,CAalE,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GACvB,aAAa,MAAM,EACnB,YAAY,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,eAAe,CAKlE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC/B,aAAa,MAAM,EACnB,UAAU;IACR,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC;CACvC,KACA,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,eAAe,CAanD,CAAC"}

package/dist/src/unstable/auth/token-resolution.js

@@ -0,0 +1,149 @@
+/**
+ * Token resolution with precedence chain.
+ *
+ * Resolves authentication tokens from multiple sources in priority order:
+ * 1. AXM_TOKEN environment variable
+ * 2. --token flag (per-command, passed as parameter)
+ * 3. Credential store lookup by registry URL
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { envOption } from "../utils/index.js";
+import { makeAppError } from "../app-error/index.js";
+import { normalizeHandle } from "../extensions/handle.js";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore, makePersistedCredentialsUnsupportedError } from "./credential-store.js";
+import { CredentialStoreTokenSource, EnvVarTokenSource, FlagTokenSource, } from "./schema.js";
+// -----------------------------------------------------------------------------
+// Token resolution
+// -----------------------------------------------------------------------------
+const parseOrigin = (url) => Effect.try({
+    try: () => new URL(url).origin,
+    catch: (error) => makeAppError({
+        code: "AUTH_INVALID_URL",
+        what: `Invalid URL: ${url}`,
+        howToFix: "Check the registry URL in your settings.",
+        cause: error,
+    }),
+});
+const makeStoredTokenSource = (registryUrl, credentials) => new CredentialStoreTokenSource({
+    token: credentials.access_token,
+    refresh_token: credentials.refresh_token,
+    expires_at: credentials.expires_at,
+    registryUrl,
+});
+const persistRefreshedCredentials = (registryUrl, token) => Effect.gen(function* () {
+    const store = yield* CredentialStore;
+    const existing = yield* store.load(registryUrl);
+    const handle = Option.match(existing, {
+        onNone: () => normalizeHandle("@unknown"),
+        onSome: (credentials) => credentials.handle,
+    });
+    yield* store.save(registryUrl, handle, {
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        expires_at: token.expires_at,
+    });
+    return makeStoredTokenSource(registryUrl, token);
+});
+const makeLoginRequiredError = () => makeAppError({
+    code: "AUTH_LOGIN_REQUIRED",
+    what: "Authentication required",
+    howToFix: "Run `axm login` to sign in, or set the AXM_TOKEN environment variable.",
+});
+/**
+ * Resolve a token from the credential store only.
+ *
+ * Looks up stored credentials by origin URL. Does not check env vars or flags.
+ */
+export const resolveStoredToken = (origin) => Effect.gen(function* () {
+    const store = yield* CredentialStore;
+    if (!store.allowsPersistedCredentials) {
+        return Option.none();
+    }
+    const stored = yield* store.load(origin);
+    return Option.map(stored, (credentials) => makeStoredTokenSource(origin, credentials));
+});
+export const refreshStoredToken = (tokenSource) => Effect.gen(function* () {
+    const authClient = yield* AuthClient;
+    const token = yield* authClient.refreshToken(tokenSource.refresh_token);
+    return yield* persistRefreshedCredentials(tokenSource.registryUrl, token);
+});
+/**
+ * Resolve a token from ambient sources only (env var and flag).
+ *
+ * Does not access the credential store.
+ *
+ * Precedence:
+ * 1. AXM_TOKEN env var
+ * 2. --token flag (passed as `flagToken` parameter)
+ */
+export const resolveAmbientToken = (flagToken) => Effect.gen(function* () {
+    const envTokenOpt = yield* envOption("AXM_TOKEN");
+    const envToken = Option.getOrUndefined(envTokenOpt);
+    if (envToken !== undefined && envToken.length > 0) {
+        return Option.some(new EnvVarTokenSource({ token: envToken }));
+    }
+    if (flagToken !== undefined && flagToken.length > 0) {
+        return Option.some(new FlagTokenSource({ token: flagToken }));
+    }
+    return Option.none();
+});
+/**
+ * Resolve the token that should be attached to a specific request target.
+ *
+ * Ambient sources are only considered for the configured default registry.
+ * Stored credentials remain scoped by request origin.
+ */
+export const resolveRequestToken = (requestUrl, defaultRegistryUrl, flagToken) => Effect.gen(function* () {
+    const requestOrigin = yield* parseOrigin(requestUrl);
+    const defaultRegistryOrigin = yield* parseOrigin(defaultRegistryUrl);
+    if (requestOrigin === defaultRegistryOrigin) {
+        const ambient = yield* resolveAmbientToken(flagToken);
+        if (Option.isSome(ambient)) {
+            return ambient;
+        }
+    }
+    return yield* resolveStoredToken(requestOrigin);
+});
+/**
+ * Resolve a token from the precedence chain.
+ *
+ * Precedence:
+ * 1. AXM_TOKEN env var
+ * 2. --token flag (passed as `flagToken` parameter)
+ * 3. CredentialStore lookup by registry URL
+ *
+ * Returns the stored token as-is without proactive refresh. Callers should
+ * handle 401 responses from the server (e.g., prompt re-login). The auth
+ * middleware handles automatic refresh on 401 for requests going through
+ * HttpClient.
+ *
+ * Returns `Option.none()` when no token is available from any source.
+ */
+export const resolveToken = (registryUrl, flagToken) => Effect.gen(function* () {
+    const ambient = yield* resolveAmbientToken(flagToken);
+    if (Option.isSome(ambient))
+        return ambient;
+    return yield* resolveStoredToken(registryUrl);
+});
+/**
+ * Resolve a token and fail with the correct auth policy error when none is available.
+ *
+ * In CI/container environments, persisted credentials are disabled by policy, so
+ * callers should surface `AUTH_TOKEN_REQUIRED` instead of suggesting `axm login`.
+ */
+export const resolveRequiredToken = (registryUrl, options) => Effect.gen(function* () {
+    const token = yield* resolveToken(registryUrl, options?.flagToken);
+    if (Option.isSome(token)) {
+        return token.value;
+    }
+    const store = yield* CredentialStore;
+    if (!store.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    return yield* options?.missingTokenError ?? makeLoginRequiredError();
+});
+//# sourceMappingURL=token-resolution.js.map

package/dist/src/unstable/auth/token-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-resolution.js","sourceRoot":"","sources":["../../../../src/unstable/auth/token-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,GAGhB,MAAM,aAAa,CAAC;AAErB,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAClC,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;IAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,YAAY,CAAC;QACX,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,gBAAgB,GAAG,EAAE;QAC3B,QAAQ,EAAE,0CAA0C;QACpD,KAAK,EAAE,KAAK;KACb,CAAC;CACL,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAC5B,WAAmB,EACnB,WAAqF,EACrF,EAAE,CACF,IAAI,0BAA0B,CAAC;IAC7B,KAAK,EAAE,WAAW,CAAC,YAAY;IAC/B,aAAa,EAAE,WAAW,CAAC,aAAa;IACxC,UAAU,EAAE,WAAW,CAAC,UAAU;IAClC,WAAW;CACZ,CAAC,CAAC;AAEL,MAAM,2BAA2B,GAAG,CAAC,WAAmB,EAAE,KAA8B,EAAE,EAAE,CAC1F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC;QACzC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM;KAC5C,CAAC,CAAC;IAEH,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE;QACrC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,OAAO,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAClC,YAAY,CAAC;IACX,IAAI,EAAE,qBAAqB;IAC3B,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,wEAAwE;CACnF,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACuE,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,EAA8B,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAAuC,EAAE,EAAE,CAC5E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;IAErC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,CAAC,2BAA2B,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAkB,EAAE,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,IAAI,CAAc,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,IAAI,CAAc,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAe,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,UAAkB,EAClB,kBAA0B,EAC1B,SAAkB,EACoD,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,IAAI,aAAa,KAAK,qBAAqB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,WAAmB,EACnB,SAAkB,EACoD,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,WAAmB,EACnB,OAGC,EACsD,EAAE,CACzD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,wCAAwC,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,CAAC;AACvE,CAAC,CAAC,CAAC"}

package/dist/src/unstable/cli/prompt/autocomplete-multiselect.d.ts

@@ -0,0 +1,16 @@
+import * as Effect from "effect/Effect";
+import type * as PromptTypes from "effect/unstable/cli/Prompt";
+export type AutocompleteMultiselectChoice<A> = PromptTypes.SelectChoice<A>;
+export interface AutocompleteMultiselectOptions<A> {
+    readonly message: string;
+    readonly choices: ReadonlyArray<AutocompleteMultiselectChoice<A>>;
+    readonly maxPerPage?: number;
+    readonly min?: number;
+    readonly max?: number;
+    readonly filterLabel?: string;
+    readonly filterPlaceholder?: string;
+    readonly emptyMessage?: string;
+    readonly validate?: (value: ReadonlyArray<A>) => Effect.Effect<ReadonlyArray<A>, string>;
+}
+export declare const autocompleteMultiselect: <const A>(options: AutocompleteMultiselectOptions<A>) => PromptTypes.Prompt<ReadonlyArray<A>>;
+//# sourceMappingURL=autocomplete-multiselect.d.ts.map

package/dist/src/unstable/cli/prompt/autocomplete-multiselect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autocomplete-multiselect.d.ts","sourceRoot":"","sources":["../../../../../src/unstable/cli/prompt/autocomplete-multiselect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,KAAK,WAAW,MAAM,4BAA4B,CAAC;AAE/D,MAAM,MAAM,6BAA6B,CAAC,CAAC,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,8BAA8B,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC1F;AA4RD,eAAO,MAAM,uBAAuB,GAAI,KAAK,CAAC,CAAC,EAC7C,SAAS,8BAA8B,CAAC,CAAC,CAAC,KACzC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CA4DrC,CAAC"}