@agentxm/client-core 0.6.0 → 0.7.1

package/dist/src/unstable/auth/auth-client.d.ts

@@ -17,7 +17,6 @@ import { type AppError } from "../app-error/index.js";
 import { type Handle } from "../extensions/handle.js";
 import { type NormalizedTokenResponse } from "./oauth-contract.js";
 import { RegistryUrl } from "./registry-url.js";
-import * as GeneratedRegistryClient from "../registry/__generated__/registry-client.js";
 export interface DeviceFlowResponse {
     readonly device_code: string;
     readonly user_code: string;
@@ -37,6 +36,18 @@ export interface MeResponse {
         readonly handle: Handle;
     }>;
 }
+export interface BuildAuthorizeUrlParams {
+    readonly challenge: string;
+    readonly expiresAt?: Date;
+    readonly state: string;
+    readonly redirectUri: string;
+    readonly scopes?: ReadonlyArray<string>;
+}
+export interface ExchangePkceCodeParams {
+    readonly code: string;
+    readonly verifier: string;
+    readonly redirectUri: string;
+}
 /** Result of a single poll iteration. */
 export type PollResult = {
     readonly _tag: "Pending";
@@ -51,10 +62,13 @@ export type PollResult = {
     readonly _tag: "ExpiredToken";
 };
 export interface AuthClientService {
+    readonly buildAuthorizeUrl: (params: BuildAuthorizeUrlParams) => string;
+    readonly getAuthorizationIssuer: () => string;
+    readonly exchangePkceCode: (params: ExchangePkceCodeParams) => Effect.Effect<NormalizedTokenResponse, AppError>;
     readonly initiateDeviceFlow: () => Effect.Effect<DeviceFlowResponse, AppError>;
     readonly pollDeviceToken: (deviceCode: string, interval: number) => Effect.Effect<NormalizedTokenResponse, AppError>;
     readonly refreshToken: (refreshTokenValue: string) => Effect.Effect<NormalizedTokenResponse, AppError>;
-    readonly revokeToken: (accessToken: string) => Effect.Effect<void, AppError>;
+    readonly revokeToken: (token: string) => Effect.Effect<void, AppError>;
     readonly getMe: (accessToken: string) => Effect.Effect<MeResponse, AppError>;
 }
 declare const AuthClient_base: ServiceMap.ServiceClass<AuthClient, "@agentxm/client-core/unstable/auth/auth-client/AuthClient", AuthClientService>;
@@ -66,7 +80,7 @@ export declare class AuthClient extends AuthClient_base {
  * Transient HTTP failures are collapsed into AUTH_LOGIN_FAILED; this seam does
  * not retry on its own. For the retrying variant, use `pollDeviceToken`.
  */
-export declare const pollOnce: (client: GeneratedRegistryClient.RegistryClient, deviceCode: string) => Effect.Effect<PollResult, AppError>;
+export declare const pollOnce: (httpClient: HttpClient.HttpClient, registryUrl: string, deviceCode: string) => Effect.Effect<PollResult, AppError>;
 export declare const AuthClientLive: Layer.Layer<AuthClient, never, RegistryUrl | HttpClient.HttpClient>;
 export declare const AuthClientTest: (overrides?: Partial<AuthClientService>) => Layer.Layer<AuthClient, never, never>;
 export {};

package/dist/src/unstable/auth/auth-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-client.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,uBAAuB,MAAM,8CAA8C,CAAC;AAyBxF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChF;AAMD,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAMtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC/E,QAAQ,CAAC,eAAe,EAAE,CACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,CACrB,iBAAiB,EAAE,MAAM,KACtB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;CAC9E;;AAED,qBAAa,UAAW,SAAQ,eAE/B;CAAG;AA6IJ;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GACnB,QAAQ,uBAAuB,CAAC,cAAc,EAC9C,YAAY,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAKlC,CAAC;AAMJ,eAAO,MAAM,cAAc,qEAsM1B,CAAC;AAMF,eAAO,MAAM,cAAc,GAAI,YAAY,OAAO,CAAC,iBAAiB,CAAC,0CAgCrC,CAAC"}
+{"version":3,"file":"auth-client.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAK9D,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4BhD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAMtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,MAAM,CAAC;IACxE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,MAAM,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,CACzB,MAAM,EAAE,sBAAsB,KAC3B,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC/E,QAAQ,CAAC,eAAe,EAAE,CACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,CACrB,iBAAiB,EAAE,MAAM,KACtB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;CAC9E;;AAED,qBAAa,UAAW,SAAQ,eAE/B;CAAG;AAuMJ;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GACnB,YAAY,UAAU,CAAC,UAAU,EACjC,aAAa,MAAM,EACnB,YAAY,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAKlC,CAAC;AAMJ,eAAO,MAAM,cAAc,qEAsP1B,CAAC;AAMF,eAAO,MAAM,cAAc,GAAI,YAAY,OAAO,CAAC,iBAAiB,CAAC,0CA0CrC,CAAC"}

package/dist/src/unstable/auth/auth-client.js

@@ -10,12 +10,15 @@
  * @experimental This API is unstable and may change without notice.
  */
 import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 import * as Data from "effect/Data";
 import * as ServiceMap from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schedule from "effect/Schedule";
+import * as Schema from "effect/Schema";
 import { makeAppError } from "../app-error/index.js";
 import { normalizeHandle } from "../extensions/handle.js";
 import {} from "./oauth-contract.js";
@@ -27,7 +30,9 @@ import { isRegistryClientError, isAnyRegistryClientError, hasTagSuffix, getStrin
 // -----------------------------------------------------------------------------
 const CLIENT_ID = "axm-cli";
 const DEVICE_CODE_SCOPES = "extensions:read extensions:publish:new extensions:publish:version extensions:yank extensions:admin account:read account:write";
+const PKCE_SCOPES = "openid profile email offline_access";
 const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const AUTHORIZATION_CODE_GRANT_TYPE = "authorization_code";
 const SLOW_DOWN_INCREMENT_MS = 5000;
 const TRANSIENT_DEVICE_POLL_RETRY_COUNT = 2;
 const TRANSIENT_DEVICE_POLL_RETRY_BASE_DELAY = "250 millis";
@@ -44,13 +49,48 @@ const normalizeTokenResponse = (token) => ({
     refresh_token: token.refresh_token,
     expires_at: token.expires_at,
 });
-/**
- * Extract the semantic OAuth error from an AuthExchangeDeviceCode400 RegistryClientError.
- *
- * The generated 400 union can carry either a problem-style `{ code }` payload or
- * the RFC 8628 device-flow payload `{ error, error_description }`.
- */
-const getOAuthErrorCode = (error) => getString(error.cause, "error") ?? getString(error.cause, "code");
+const SessionTokenResponseSchema = Schema.Struct({
+    access_token: Schema.String,
+    refresh_token: Schema.String,
+    expires_at: Schema.String,
+});
+const OAuthTokenErrorResponseSchema = Schema.Struct({
+    error: Schema.String,
+    error_description: Schema.optional(Schema.String),
+});
+const unexpectedTokenStatus = (response) => Effect.flatMap(Effect.orElseSucceed(response.text, () => "Unexpected status code"), (description) => Effect.fail(new HttpClientError.HttpClientError({
+    reason: new HttpClientError.StatusCodeError({
+        request: response.request,
+        response,
+        description,
+    }),
+})));
+const deriveAuthorizationOrigin = (registryUrl) => {
+    const url = new URL(registryUrl);
+    if (url.origin === "https://registry.agentxm.ai") {
+        return "https://agentxm.ai";
+    }
+    if (url.origin === "https://registry-dev.agentxm-ai.workers.dev") {
+        return "https://web-dev.agentxm-ai.workers.dev";
+    }
+    if (url.host === "localhost:4300") {
+        return "http://localhost:4200";
+    }
+    if (url.host === "127.0.0.1:4300") {
+        return "http://127.0.0.1:4200";
+    }
+    if (url.hostname === "127.0.0.1") {
+        return `${url.protocol}//${url.hostname}:4200`;
+    }
+    return url.origin;
+};
+const mapAuthCodeExchangeError = (error) => makeAppError({
+    code: "auth",
+    message: "Authorization code exchange failed",
+    breadcrumbs: [{ description: "Run `axm login` to try again.", cmd: "axm login" }],
+    cause: error,
+});
+const getOAuthErrorCode = (error) => getString(error, "error") ?? getString(error, "code");
 const isRetryableDevicePollError = (error) => error._tag === "RetryableDevicePollError";
 const makeTransientDevicePollAppError = (cause) => makeAppError({
     code: "auth",
@@ -77,48 +117,43 @@ const retryTransientDevicePollFailure = (effect) => effect.pipe(Effect.retry({
 // -----------------------------------------------------------------------------
 // Single poll step
 // -----------------------------------------------------------------------------
+const postTokenForm = (httpClient, registryUrl, body) => HttpClientRequest.post("/v1/auth/token").pipe(HttpClientRequest.bodyUrlParams(body), (request) => httpClient
+    .pipe(HttpClient.mapRequest(HttpClientRequest.prependUrl(registryUrl)))
+    .execute(request), Effect.flatMap(HttpClientResponse.matchStatus({
+    "2xx": HttpClientResponse.schemaBodyJson(SessionTokenResponseSchema),
+    "400": (response) => HttpClientResponse.schemaBodyJson(OAuthTokenErrorResponseSchema)(response).pipe(Effect.flatMap((error) => Effect.fail(error))),
+    orElse: unexpectedTokenStatus,
+})), Effect.map(normalizeTokenResponse));
 /**
- * Internal: execute a single device token poll against the generated client.
+ * Internal: execute a single device token poll against the OAuth token endpoint.
  *
  * Surfaces transient HTTP failures as RetryableDevicePollError so callers can
  * decide whether to retry; other failures are mapped to AppError directly.
  *
- * @param client - Generated registry client instance
+ * @param httpClient - Effect HTTP client
+ * @param registryUrl - Registry API origin
  * @param deviceCode - Device verification code from the initial authorization
  */
-const pollOnceInternal = (client, deviceCode) => client
-    .AuthExchangeDeviceCode({
-    payload: {
-        client_id: CLIENT_ID,
-        device_code: deviceCode,
-        grant_type: DEVICE_CODE_GRANT_TYPE,
-    },
-})
-    .pipe(Effect.map((token) => ({
+const pollOnceInternal = (httpClient, registryUrl, deviceCode) => postTokenForm(httpClient, registryUrl, {
+    client_id: CLIENT_ID,
+    device_code: deviceCode,
+    grant_type: DEVICE_CODE_GRANT_TYPE,
+}).pipe(Effect.map((token) => ({
     _tag: "Success",
-    token: normalizeTokenResponse(token),
+    token,
 })), Effect.catch((error) => {
-    if (isRegistryClientError("AuthExchangeDeviceCode400")(error)) {
-        const code = getOAuthErrorCode(error);
-        switch (code) {
-            case "authorization_pending":
-                return Effect.succeed({ _tag: "Pending" });
-            case "slow_down":
-                return Effect.succeed({ _tag: "SlowDown" });
-            case "access_denied":
-                return Effect.succeed({ _tag: "AccessDenied" });
-            case "expired_token":
-                return Effect.succeed({ _tag: "ExpiredToken" });
-            default:
-                return Effect.fail(makeAppError({
-                    code: "auth",
-                    message: "Device token exchange failed with an unexpected error",
-                    breadcrumbs: [
-                        { description: "Try running `axm login` again.", cmd: "axm login" },
-                    ],
-                    cause: error,
-                }));
-        }
+    const code = getOAuthErrorCode(error);
+    switch (code) {
+        case "authorization_pending":
+            return Effect.succeed({ _tag: "Pending" });
+        case "slow_down":
+            return Effect.succeed({ _tag: "SlowDown" });
+        case "access_denied":
+            return Effect.succeed({ _tag: "AccessDenied" });
+        case "expired_token":
+            return Effect.succeed({ _tag: "ExpiredToken" });
+        default:
+            break;
     }
     if (isTransientHttpClientError(error)) {
         return Effect.fail(new RetryableDevicePollError({ cause: error }));
@@ -136,14 +171,40 @@ const pollOnceInternal = (client, deviceCode) => client
  * Transient HTTP failures are collapsed into AUTH_LOGIN_FAILED; this seam does
  * not retry on its own. For the retrying variant, use `pollDeviceToken`.
  */
-export const pollOnce = (client, deviceCode) => pollOnceInternal(client, deviceCode).pipe(Effect.catchTag("RetryableDevicePollError", (e) => Effect.fail(makeTransientDevicePollAppError(e.cause))));
+export const pollOnce = (httpClient, registryUrl, deviceCode) => pollOnceInternal(httpClient, registryUrl, deviceCode).pipe(Effect.catchTag("RetryableDevicePollError", (e) => Effect.fail(makeTransientDevicePollAppError(e.cause))));
 // -----------------------------------------------------------------------------
 // Live layer
 // -----------------------------------------------------------------------------
 export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
     const httpClient = yield* HttpClient.HttpClient;
     const registryUrl = yield* RegistryUrl;
+    const authorizationOrigin = deriveAuthorizationOrigin(registryUrl);
     const client = GeneratedRegistryClient.make(httpClient.pipe(HttpClient.mapRequest(HttpClientRequest.prependUrl(registryUrl))));
+    const buildAuthorizeUrl = ({ challenge, expiresAt, state, redirectUri, scopes, }) => {
+        const url = new URL("/oauth/authorize", authorizationOrigin);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", CLIENT_ID);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("state", state);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("scope", (scopes ?? PKCE_SCOPES.split(" ")).join(" "));
+        if (expiresAt !== undefined) {
+            url.searchParams.set("request_expires_at", expiresAt.toISOString());
+        }
+        return url.href;
+    };
+    const getAuthorizationIssuer = () => authorizationOrigin;
+    const exchangePkceCode = Effect.fn("AuthClient.exchangePkceCode")(function* ({ code, verifier, redirectUri }) {
+        const response = yield* postTokenForm(httpClient, registryUrl, {
+            grant_type: AUTHORIZATION_CODE_GRANT_TYPE,
+            code,
+            code_verifier: verifier,
+            client_id: CLIENT_ID,
+            redirect_uri: redirectUri,
+        }).pipe(Effect.mapError(mapAuthCodeExchangeError));
+        return response;
+    });
     const initiateDeviceFlow = Effect.fn("AuthClient.initiateDeviceFlow")(function* () {
         const response = yield* client
             .AuthIssueDeviceCode({
@@ -172,7 +233,7 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
         let currentInterval = interval * 1000;
         while (true) {
             yield* Effect.sleep(currentInterval);
-            const result = yield* retryTransientDevicePollFailure(pollOnceInternal(client, deviceCode));
+            const result = yield* retryTransientDevicePollFailure(pollOnceInternal(httpClient, registryUrl, deviceCode));
             switch (result._tag) {
                 case "Success":
                     return result.token;
@@ -197,15 +258,11 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
         }
     });
     const refreshToken = Effect.fn("AuthClient.refreshToken")(function* (refreshTokenValue) {
-        const token = yield* client
-            .AuthRefreshToken({
-            payload: {
-                grant_type: "refresh_token",
-                refresh_token: refreshTokenValue,
-                client_id: CLIENT_ID,
-            },
-        })
-            .pipe(Effect.mapError((error) => makeAppError({
+        return yield* postTokenForm(httpClient, registryUrl, {
+            grant_type: "refresh_token",
+            refresh_token: refreshTokenValue,
+            client_id: CLIENT_ID,
+        }).pipe(Effect.mapError((error) => makeAppError({
             code: "auth",
             message: "Token refresh request failed",
             breadcrumbs: [
@@ -213,14 +270,17 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
             ],
             cause: error,
         })));
-        return normalizeTokenResponse(token);
     });
-    const revokeToken = Effect.fn("AuthClient.revokeToken")(function* (accessToken) {
-        yield* client
-            .AuthRevokeToken({
-            payload: { token: accessToken },
-        })
-            .pipe(Effect.catch((error) => Effect.logWarning(`Token revocation failed: ${String(error)}. Local credentials will still be cleared.`)));
+    const revokeToken = Effect.fn("AuthClient.revokeToken")(function* (token) {
+        yield* HttpClientRequest.post("/v1/auth/revoke").pipe(HttpClientRequest.bodyUrlParams({
+            token,
+            token_type_hint: "refresh_token",
+        }), (request) => httpClient
+            .pipe(HttpClient.mapRequest(HttpClientRequest.prependUrl(registryUrl)))
+            .execute(request), Effect.flatMap(HttpClientResponse.matchStatus({
+            "200": () => Effect.void,
+            orElse: (response) => response.text.pipe(Effect.flatMap(Effect.fail)),
+        })), Effect.catch((error) => Effect.logWarning(`Token revocation failed: ${String(error)}. Local credentials will still be cleared.`)));
     });
     const getMe = Effect.fn("AuthClient.getMe")(function* (accessToken) {
         // Inject bearer token via a per-request HttpClient wrapper for getMe.
@@ -284,6 +344,9 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
         };
     });
     return {
+        buildAuthorizeUrl,
+        getAuthorizationIssuer,
+        exchangePkceCode,
         initiateDeviceFlow,
         pollDeviceToken,
         refreshToken,
@@ -295,6 +358,12 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
 // Test layer factory
 // -----------------------------------------------------------------------------
 export const AuthClientTest = (overrides) => Layer.succeed(AuthClient, {
+    buildAuthorizeUrl: ({ redirectUri }) => `https://agentxm.ai/oauth/authorize?redirect_uri=${redirectUri}`,
+    getAuthorizationIssuer: () => "https://agentxm.ai",
+    exchangePkceCode: () => Effect.fail(makeAppError({
+        code: "auth",
+        message: "Not implemented in test",
+    })),
     initiateDeviceFlow: () => Effect.fail(makeAppError({
         code: "auth",
         message: "Not implemented in test",

package/dist/src/unstable/auth/auth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAe,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAgC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,uBAAuB,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,SAAS,EACT,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAEtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,kBAAkB,GACtB,+HAA+H,CAAC;AAClI,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAC5C,MAAM,sCAAsC,GAAG,YAAY,CAAC;AAqD5D,MAAM,OAAO,UAAW,SAAQ,UAAU,CAAC,OAAO,EAAiC,CACjF,2DAA2D,CAC5D;CAAG;AAEJ,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAEhF;CAAG;AAEL,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,CAAC,KAI/B,EAA2B,EAAE,CAAC,CAAC;IAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;IAChC,aAAa,EAAE,KAAK,CAAC,aAAa;IAClC,UAAU,EAAE,KAAK,CAAC,UAAU;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CACxB,KAAwF,EACpE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAE3F,MAAM,0BAA0B,GAAG,CACjC,KAA0C,EACP,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC;AAElF,MAAM,+BAA+B,GAAG,CAAC,KAAc,EAAE,EAAE,CACzD,YAAY,CAAC;IACX,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,8CAA8C;IACvD,WAAW,EAAE;QACX;YACE,WAAW,EAAE,2EAA2E;YACxF,GAAG,EAAE,WAAW;SACjB;KACF;IACD,KAAK;CACN,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG,CACtC,MAA6D,EACjC,EAAE,CAC9B,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,iCAAiC;IACxC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,sCAAsC,CAAC;IACtE,KAAK,EAAE,0BAA0B;CAClC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CACvB,MAA8C,EAC9C,UAAkB,EAC8C,EAAE,CAClE,MAAM;KACH,sBAAsB,CAAC;IACtB,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,sBAAsB;KACnC;CACF,CAAC;KACD,IAAI,CACH,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,EAAc,EAAE,CAAC,CAAC;IACtB,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC;CACrC,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAkE,EAAE;IACrF,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,uBAAuB;gBAC1B,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACzD,KAAK,WAAW;gBACd,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1D,KAAK,eAAe;gBAClB,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9D,KAAK,eAAe;gBAClB,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9D;gBACE,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;oBACX,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,uDAAuD;oBAChE,WAAW,EAAE;wBACX,EAAE,WAAW,EAAE,gCAAgC,EAAE,GAAG,EAAE,WAAW,EAAE;qBACpE;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;QACN,CAAC;IACH,CAAC;IAED,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAClF,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEN;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,MAA8C,EAC9C,UAAkB,EACmB,EAAE,CACvC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACxC,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CACzC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAClF,CAAC;IAEF,MAAM,kBAAkB,GAA4C,MAAM,CAAC,EAAE,CAC3E,+BAA+B,CAChC,CAAC,QAAQ,CAAC;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM;aAC3B,mBAAmB,CAAC;YACnB,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE;SAC7D,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,mCAAmC;YAC5C,WAAW,EAAE;gBACX;oBACE,WAAW,EAAE,+DAA+D;iBAC7E;aACF;YACD,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;QAEJ,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;YAC7D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;SACH,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAyC,MAAM,CAAC,EAAE,CACrE,4BAA4B,CAC7B,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ;QAC/B,IAAI,eAAe,GAAG,QAAQ,GAAG,IAAI,CAAC;QAEtC,OAAO,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;YAE5F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,SAAS;oBACZ,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,KAAK,SAAS;oBACZ,SAAS;gBACX,KAAK,UAAU;oBACb,eAAe,IAAI,sBAAsB,CAAC;oBAC1C,SAAS;gBACX,KAAK,cAAc;oBACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;wBACzB,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,+BAA+B;wBACxC,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;qBAClF,CAAC,CAAC;gBACL,KAAK,cAAc;oBACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;wBACzB,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,oBAAoB;wBAC7B,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;qBAClF,CAAC,CAAC;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAsC,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAC1F,QAAQ,CAAC,EAAE,iBAAiB;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM;aACxB,gBAAgB,CAAC;YAChB,OAAO,EAAE;gBACP,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,iBAAiB;gBAChC,SAAS,EAAE,SAAS;aACrB;SACF,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,8BAA8B;YACvC,WAAW,EAAE;gBACX,EAAE,WAAW,EAAE,qCAAqC,EAAE,GAAG,EAAE,WAAW,EAAE;aACzE;YACD,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;QAEJ,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,WAAW,GAAqC,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CACvF,QAAQ,CAAC,EAAE,WAAW;QACpB,KAAK,CAAC,CAAC,MAAM;aACV,eAAe,CAAC;YACf,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;SAChC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,UAAU,CACf,4BAA4B,MAAM,CAAC,KAAK,CAAC,4CAA4C,CACtF,CACF,CACF,CAAC;IACN,CAAC,CACF,CAAC;IAEF,MAAM,KAAK,GAA+B,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CACrE,QAAQ,CAAC,EAAE,WAAW;QACpB,sEAAsE;QACtE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAC/C,UAAU,CAAC,IAAI,CACb,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAChE,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAClE,CACF,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAY,EAAE;YAClC,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,uCAAuC;oBAChD,WAAW,EAAE;wBACX,EAAE,WAAW,EAAE,qCAAqC,EAAE,GAAG,EAAE,WAAW,EAAE;qBACzE;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,uCAAuC;oBAChD,WAAW,EAAE;wBACX,EAAE,WAAW,EAAE,qCAAqC,EAAE,GAAG,EAAE,WAAW,EAAE;qBACzE;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,4EAA4E;YAC5E,+EAA+E;YAC/E,+EAA+E;YAC/E,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,gCAAgC;oBACzC,WAAW,EAAE;wBACX;4BACE,WAAW,EAAE,+DAA+D;yBAC7E;qBACF;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,mCAAmC;gBAC5C,WAAW,EAAE;oBACX;wBACE,WAAW,EAAE,+DAA+D;qBAC7E;iBACF;gBACD,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC/B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,IAAI,EAAE,EAAE;SACY,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,OAAO;QACL,kBAAkB;QAClB,eAAe;QACf,YAAY;QACZ,WAAW;QACX,KAAK;KACsB,CAAC;AAChC,CAAC,CAAC,CACH,CAAC;AAEF,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAsC,EAAE,EAAE,CACvE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;IACxB,kBAAkB,EAAE,GAAG,EAAE,CACvB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,YAAY,EAAE,GAAG,EAAE,CACjB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IAC9B,KAAK,EAAE,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,GAAG,SAAS;CACe,CAAC,CAAC"}
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AACxE,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,kBAAkB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAe,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAgC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,uBAAuB,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,SAAS,EACT,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAEtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,kBAAkB,GACtB,+HAA+H,CAAC;AAClI,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAC3D,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAC5C,MAAM,sCAAsC,GAAG,YAAY,CAAC;AAwE5D,MAAM,OAAO,UAAW,SAAQ,UAAU,CAAC,OAAO,EAAiC,CACjF,2DAA2D,CAC5D;CAAG;AAEJ,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAEhF;CAAG;AAEL,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,CAAC,KAI/B,EAA2B,EAAE,CAAC,CAAC;IAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;IAChC,aAAa,EAAE,KAAK,CAAC,aAAa;IAClC,UAAU,EAAE,KAAK,CAAC,UAAU;CAC7B,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC,MAAM;IAC3B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,UAAU,EAAE,MAAM,CAAC,MAAM;CAC1B,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,QAA+C,EAAE,EAAE,CAChF,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,EACnE,CAAC,WAAW,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,CACT,IAAI,eAAe,CAAC,eAAe,CAAC;IAClC,MAAM,EAAE,IAAI,eAAe,CAAC,eAAe,CAAC;QAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,WAAW;KACZ,CAAC;CACH,CAAC,CACH,CACJ,CAAC;AAEJ,MAAM,yBAAyB,GAAG,CAAC,WAAmB,EAAU,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,MAAM,KAAK,6BAA6B,EAAE,CAAC;QACjD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,6CAA6C,EAAE,CAAC;QACjE,OAAO,wCAAwC,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,OAAO,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,KAAc,EAAE,EAAE,CAClD,YAAY,CAAC;IACX,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,oCAAoC;IAC7C,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACjF,KAAK,EAAE,KAAK;CACb,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAsB,EAAE,CAC/D,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAExD,MAAM,0BAA0B,GAAG,CACjC,KAA0C,EACP,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC;AAElF,MAAM,+BAA+B,GAAG,CAAC,KAAc,EAAE,EAAE,CACzD,YAAY,CAAC;IACX,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,8CAA8C;IACvD,WAAW,EAAE;QACX;YACE,WAAW,EAAE,2EAA2E;YACxF,GAAG,EAAE,WAAW;SACjB;KACF;IACD,KAAK;CACN,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG,CACtC,MAA6D,EACjC,EAAE,CAC9B,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,iCAAiC;IACxC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,sCAAsC,CAAC;IACtE,KAAK,EAAE,0BAA0B;CAClC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,aAAa,GAAG,CACpB,UAAiC,EACjC,WAAmB,EACnB,IAAsC,EACW,EAAE,CACnD,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAC3C,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,EACrC,CAAC,OAAO,EAAE,EAAE,CACV,UAAU;KACP,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;KACtE,OAAO,CAAC,OAAO,CAAC,EACrB,MAAM,CAAC,OAAO,CACZ,kBAAkB,CAAC,WAAW,CAAC;IAC7B,KAAK,EAAE,kBAAkB,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACpE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClB,kBAAkB,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC7E,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC9C;IACH,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CACH,EACD,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CACnC,CAAC;AAEJ;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CACvB,UAAiC,EACjC,WAAmB,EACnB,UAAkB,EAC8C,EAAE,CAClE,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE;IACrC,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,UAAU;IACvB,UAAU,EAAE,sBAAsB;CACnC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,EAAc,EAAE,CAAC,CAAC;IACtB,IAAI,EAAE,SAAS;IACf,KAAK;CACN,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAkE,EAAE;IACrF,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB;YAC1B,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9D,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9D;YACE,MAAM;IACV,CAAC;IAED,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAClF,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,UAAiC,EACjC,WAAmB,EACnB,UAAkB,EACmB,EAAE,CACvC,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACxC,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CACzC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAClF,CAAC;IAEF,MAAM,iBAAiB,GAA2C,CAAC,EACjE,SAAS,EACT,SAAS,EACT,KAAK,EACL,WAAW,EACX,MAAM,GACP,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAgD,GAAG,EAAE,CAC/E,mBAAmB,CAAC;IAEtB,MAAM,gBAAgB,GAA0C,MAAM,CAAC,EAAE,CACvE,6BAA6B,CAC9B,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE;YAC7D,UAAU,EAAE,6BAA6B;YACzC,IAAI;YACJ,aAAa,EAAE,QAAQ;YACvB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAA4C,MAAM,CAAC,EAAE,CAC3E,+BAA+B,CAChC,CAAC,QAAQ,CAAC;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM;aAC3B,mBAAmB,CAAC;YACnB,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE;SAC7D,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,mCAAmC;YAC5C,WAAW,EAAE;gBACX;oBACE,WAAW,EAAE,+DAA+D;iBAC7E;aACF;YACD,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;QAEJ,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;YAC7D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;SACH,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAyC,MAAM,CAAC,EAAE,CACrE,4BAA4B,CAC7B,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ;QAC/B,IAAI,eAAe,GAAG,QAAQ,GAAG,IAAI,CAAC;QAEtC,OAAO,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,+BAA+B,CACnD,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CACtD,CAAC;YAEF,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,SAAS;oBACZ,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,KAAK,SAAS;oBACZ,SAAS;gBACX,KAAK,UAAU;oBACb,eAAe,IAAI,sBAAsB,CAAC;oBAC1C,SAAS;gBACX,KAAK,cAAc;oBACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;wBACzB,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,+BAA+B;wBACxC,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;qBAClF,CAAC,CAAC;gBACL,KAAK,cAAc;oBACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;wBACzB,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,oBAAoB;wBAC7B,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;qBAClF,CAAC,CAAC;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAsC,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAC1F,QAAQ,CAAC,EAAE,iBAAiB;QAC1B,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE;YACnD,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,iBAAiB;YAChC,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,8BAA8B;YACvC,WAAW,EAAE;gBACX,EAAE,WAAW,EAAE,qCAAqC,EAAE,GAAG,EAAE,WAAW,EAAE;aACzE;YACD,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,WAAW,GAAqC,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CACvF,QAAQ,CAAC,EAAE,KAAK;QACd,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACnD,iBAAiB,CAAC,aAAa,CAAC;YAC9B,KAAK;YACL,eAAe,EAAE,eAAe;SACjC,CAAC,EACF,CAAC,OAAO,EAAE,EAAE,CACV,UAAU;aACP,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;aACtE,OAAO,CAAC,OAAO,CAAC,EACrB,MAAM,CAAC,OAAO,CACZ,kBAAkB,CAAC,WAAW,CAAC;YAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACtE,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,UAAU,CACf,4BAA4B,MAAM,CAAC,KAAK,CAAC,4CAA4C,CACtF,CACF,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,KAAK,GAA+B,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CACrE,QAAQ,CAAC,EAAE,WAAW;QACpB,sEAAsE;QACtE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAC/C,UAAU,CAAC,IAAI,CACb,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAChE,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAClE,CACF,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAY,EAAE;YAClC,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,uCAAuC;oBAChD,WAAW,EAAE;wBACX,EAAE,WAAW,EAAE,qCAAqC,EAAE,GAAG,EAAE,WAAW,EAAE;qBACzE;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,uCAAuC;oBAChD,WAAW,EAAE;wBACX,EAAE,WAAW,EAAE,qCAAqC,EAAE,GAAG,EAAE,WAAW,EAAE;qBACzE;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,4EAA4E;YAC5E,+EAA+E;YAC/E,+EAA+E;YAC/E,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,gCAAgC;oBACzC,WAAW,EAAE;wBACX;4BACE,WAAW,EAAE,+DAA+D;yBAC7E;qBACF;oBACD,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,mCAAmC;gBAC5C,WAAW,EAAE;oBACX;wBACE,WAAW,EAAE,+DAA+D;qBAC7E;iBACF;gBACD,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC/B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,IAAI,EAAE,EAAE;SACY,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,sBAAsB;QACtB,gBAAgB;QAChB,kBAAkB;QAClB,eAAe;QACf,YAAY;QACZ,WAAW;QACX,KAAK;KACsB,CAAC;AAChC,CAAC,CAAC,CACH,CAAC;AAEF,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAsC,EAAE,EAAE,CACvE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;IACxB,iBAAiB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CACrC,mDAAmD,WAAW,EAAE;IAClE,sBAAsB,EAAE,GAAG,EAAE,CAAC,oBAAoB;IAClD,gBAAgB,EAAE,GAAG,EAAE,CACrB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,kBAAkB,EAAE,GAAG,EAAE,CACvB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,YAAY,EAAE,GAAG,EAAE,CACjB,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IAC9B,KAAK,EAAE,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,CACT,YAAY,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,yBAAyB;KACnC,CAAC,CACH;IACH,GAAG,SAAS;CACe,CAAC,CAAC"}

package/dist/src/unstable/auth/credential-store.d.ts

@@ -1,7 +1,7 @@
 /**
  * CredentialStore Effect service — credential storage and auth policy.
  *
- * Tier 1: OS keychain (TODO: @napi-rs/keyring not yet added)
+ * Tier 1: OS keychain (@napi-rs/keyring)
  * Tier 2: Restricted-permission file (~/.config/axm/credentials.json)
  *
  * CI and container environments are token-only by policy. They do not persist
@@ -49,10 +49,11 @@ export declare const detectEnvironment: Effect.Effect<{
 /**
  * Select storage tier based on detected environment.
  *
- * Until keychain support lands, all persisted credentials use the restricted
- * file backend. Whether persistence is allowed is a separate policy decision.
+ * Use OS keychain by default, falling back to the restricted file backend when
+ * keychain access is unavailable. Whether persistence is allowed is a separate
+ * policy decision.
  */
-export declare const selectTier: (_env: EnvironmentInfo) => StorageTier;
+export declare const selectTier: (env: EnvironmentInfo) => StorageTier;
 export declare const canUsePersistedCredentials: (env: EnvironmentInfo) => boolean;
 export declare const makePersistedCredentialsUnsupportedError: () => AppError;
 export declare const CredentialStoreLive: Layer.Layer<CredentialStore, never, FileSystem.FileSystem | Path.Path>;

package/dist/src/unstable/auth/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAwB,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAAoB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAWlF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,CACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE;QACX,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,KACE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClG,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;;AAED,qBAAa,eAAgB,SAAQ,oBAEpC;CAAG;AAuJJ,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,iBAAiB;;;;;;gCAQ5B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,eAAe,KAAG,WAAgC,CAAC;AAEpF,eAAO,MAAM,0BAA0B,GAAI,KAAK,eAAe,KAAG,OACnC,CAAC;AAEhC,eAAO,MAAM,wCAAwC,gBAA+B,CAAC;AAMrF,eAAO,MAAM,mBAAmB,wEAkG/B,CAAC;AAMF,eAAO,MAAM,mBAAmB,GAC9B,OAAM,WAA+B,EACrC,cAAc,cAAc,EAC5B,6BAA6B,OAAO,+CA6DrC,CAAC"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAwB,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAAoB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAWlF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,CACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE;QACX,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,KACE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClG,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;;AAED,qBAAa,eAAgB,SAAQ,oBAEpC;CAAG;AAyQJ,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,iBAAiB;;;;;;gCAQ5B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,eAAe,KAAG,WACyB,CAAC;AAE5E,eAAO,MAAM,0BAA0B,GAAI,KAAK,eAAe,KAAG,OACnC,CAAC;AAEhC,eAAO,MAAM,wCAAwC,gBAA+B,CAAC;AAMrF,eAAO,MAAM,mBAAmB,wEAmJ/B,CAAC;AAMF,eAAO,MAAM,mBAAmB,GAC9B,OAAM,WAA+B,EACrC,cAAc,cAAc,EAC5B,6BAA6B,OAAO,+CA6DrC,CAAC"}

package/dist/src/unstable/auth/credential-store.js

@@ -1,7 +1,7 @@
 /**
  * CredentialStore Effect service — credential storage and auth policy.
  *
- * Tier 1: OS keychain (TODO: @napi-rs/keyring not yet added)
+ * Tier 1: OS keychain (@napi-rs/keyring)
  * Tier 2: Restricted-permission file (~/.config/axm/credentials.json)
  *
  * CI and container environments are token-only by policy. They do not persist
@@ -16,6 +16,8 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
+import { Entry } from "@napi-rs/keyring";
+import * as lockfile from "proper-lockfile";
 import { errAuthTokenRequired, makeAppError } from "../app-error/index.js";
 import { isCI } from "../cli-flags/index.js";
 import { decodeHandleSync } from "../extensions/handle.js";
@@ -31,6 +33,7 @@ const CREDENTIALS_FILENAME = "credentials.json";
 const CONFIG_DIR_NAME = "axm";
 const DIR_PERMISSIONS = 0o700;
 const FILE_PERMISSIONS = 0o600;
+const KEYCHAIN_SERVICE = "axm";
 // -----------------------------------------------------------------------------
 // Internal helpers (take fs/path as args to avoid context leakage)
 // -----------------------------------------------------------------------------
@@ -54,6 +57,22 @@ const ensureCredentialsDir = (fs, path, homeDir) => Effect.gen(function* () {
 });
 const checkFilePermissions = (fs, filePath) => fs.stat(filePath).pipe(Effect.map((stat) => (stat.mode & 0o777) > FILE_PERMISSIONS), Effect.catch(() => Effect.succeed(false)));
 const setFilePermissions = (fs, filePath) => fs.chmod(filePath, FILE_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+const withCredentialFileLock = (fs, path, homeDir, effect) => Effect.gen(function* () {
+    yield* ensureCredentialsDir(fs, path, homeDir);
+    const dir = getCredentialsDir(path, homeDir);
+    const release = yield* Effect.tryPromise({
+        try: () => lockfile.lock(dir, { retries: { retries: 5, minTimeout: 25, maxTimeout: 100 } }),
+        catch: (error) => makeAppError({
+            code: "auth",
+            message: "Could not lock credential storage",
+            cause: error,
+        }),
+    });
+    return yield* effect.pipe(Effect.ensuring(Effect.tryPromise({
+        try: () => release(),
+        catch: () => undefined,
+    }).pipe(Effect.catch(() => Effect.void))));
+});
 const readCredentialFile = (fs, path, homeDir) => Effect.gen(function* () {
     const filePath = getCredentialsPath(path, homeDir);
     const exists = yield* fs.exists(filePath).pipe(Effect.catch(() => Effect.succeed(false)));
@@ -79,6 +98,13 @@ const readCredentialFile = (fs, path, homeDir) => Effect.gen(function* () {
         cause: error,
     })), Effect.catch(() => Effect.logWarning("Credential file failed schema validation, treating as empty.").pipe(Effect.map(() => Option.none()))));
 });
+const deleteCredentialFile = (fs, path, homeDir) => Effect.gen(function* () {
+    const filePath = getCredentialsPath(path, homeDir);
+    const exists = yield* fs.exists(filePath).pipe(Effect.catch(() => Effect.succeed(false)));
+    if (exists) {
+        yield* fs.remove(filePath).pipe(Effect.catch(() => Effect.void));
+    }
+});
 const writeCredentialFile = (fs, path, homeDir, data) => Effect.gen(function* () {
     yield* ensureCredentialsDir(fs, path, homeDir);
     const filePath = getCredentialsPath(path, homeDir);
@@ -99,6 +125,56 @@ const emptyCredentialFile = {
     version: 1,
     registries: {},
 };
+const keychainAccount = (registryUrl) => `registry:${registryUrl}`;
+const readKeychainCredentialFile = (registryUrl) => Effect.try({
+    try: () => {
+        const entry = new Entry(KEYCHAIN_SERVICE, keychainAccount(registryUrl));
+        return entry.getPassword();
+    },
+    catch: (error) => makeAppError({
+        code: "auth",
+        message: "OS keychain could not be read",
+        cause: error,
+    }),
+}).pipe(Effect.flatMap((content) => {
+    if (content === null)
+        return Effect.succeed(Option.none());
+    return decodeCredentialFileFromJsonString(content).pipe(Effect.map((file) => Option.some(file)), Effect.mapError((error) => makeAppError({
+        code: "auth",
+        message: "Failed to parse OS keychain credentials",
+        cause: error,
+    })));
+}));
+const writeKeychainCredentialFile = (registryUrl, data) => Effect.gen(function* () {
+    const encoded = yield* Schema.encodeEffect(CredentialFileSchema)(data).pipe(Effect.mapError((error) => makeAppError({
+        code: "auth",
+        message: "Failed to encode credential file",
+        cause: error,
+    })));
+    const content = JSON.stringify(encoded);
+    yield* Effect.try({
+        try: () => {
+            const entry = new Entry(KEYCHAIN_SERVICE, keychainAccount(registryUrl));
+            entry.setPassword(content);
+        },
+        catch: (error) => makeAppError({
+            code: "auth",
+            message: "OS keychain could not be written",
+            cause: error,
+        }),
+    });
+});
+const deleteKeychainCredentialFile = (registryUrl) => Effect.try({
+    try: () => {
+        const entry = new Entry(KEYCHAIN_SERVICE, keychainAccount(registryUrl));
+        entry.deletePassword();
+    },
+    catch: (error) => makeAppError({
+        code: "auth",
+        message: "OS keychain credential could not be deleted",
+        cause: error,
+    }),
+}).pipe(Effect.catch(() => Effect.void));
 export const detectEnvironment = Effect.gen(function* () {
     return {
         isSSH: yield* isSSH,
@@ -111,10 +187,11 @@ export const detectEnvironment = Effect.gen(function* () {
 /**
  * Select storage tier based on detected environment.
  *
- * Until keychain support lands, all persisted credentials use the restricted
- * file backend. Whether persistence is allowed is a separate policy decision.
+ * Use OS keychain by default, falling back to the restricted file backend when
+ * keychain access is unavailable. Whether persistence is allowed is a separate
+ * policy decision.
  */
-export const selectTier = (_env) => "restricted-file";
+export const selectTier = (env) => env.isContainer || env.isCI || env.isSSH ? "restricted-file" : "keychain";
 export const canUsePersistedCredentials = (env) => !env.isContainer && !env.isCI;
 export const makePersistedCredentialsUnsupportedError = () => errAuthTokenRequired();
 // -----------------------------------------------------------------------------
@@ -130,6 +207,14 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
     const env = yield* detectEnvironment;
     const storageTier = selectTier(env);
     const persistedCredentialsAllowed = canUsePersistedCredentials(env);
+    const readStoredFile = () => withCredentialFileLock(fs, path, homeDir, readCredentialFile(fs, path, homeDir));
+    const writeStoredFile = (data) => withCredentialFileLock(fs, path, homeDir, writeCredentialFile(fs, path, homeDir, data));
+    const loadCredentialFile = (registryUrl) => storageTier === "keychain"
+        ? readKeychainCredentialFile(registryUrl).pipe(Effect.catch(() => Effect.logWarning("OS keychain unavailable; using restricted credential file.").pipe(Effect.flatMap(() => readStoredFile()))))
+        : readStoredFile();
+    const saveCredentialFile = (registryUrl, data) => storageTier === "keychain"
+        ? writeKeychainCredentialFile(registryUrl, data).pipe(Effect.catch(() => Effect.logWarning("OS keychain unavailable; using restricted credential file.").pipe(Effect.flatMap(() => writeStoredFile(data)))))
+        : writeStoredFile(data);
     const save = Effect.fn("CredentialStore.save")(function* (registryUrl, handle, credentials) {
         if (!persistedCredentialsAllowed) {
             return yield* makePersistedCredentialsUnsupportedError();
@@ -137,7 +222,7 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
         if (env.isRoot) {
             yield* Effect.logWarning("Running as root. Credentials will be owned by root.");
         }
-        const existing = yield* readCredentialFile(fs, path, homeDir);
+        const existing = yield* loadCredentialFile(registryUrl);
         const file = Option.getOrElse(existing, () => emptyCredentialFile);
         const registryEntry = file.registries[registryUrl] ?? { accounts: {} };
         const updatedAccounts = {};
@@ -159,10 +244,28 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
                 [registryUrl]: { accounts: updatedAccounts },
             },
         };
-        yield* writeCredentialFile(fs, path, homeDir, updated);
+        yield* saveCredentialFile(registryUrl, updated);
+        if (storageTier === "keychain") {
+            yield* deleteCredentialFile(fs, path, homeDir);
+        }
     });
     const load = Effect.fn("CredentialStore.load")(function* (registryUrl) {
-        const existing = yield* readCredentialFile(fs, path, homeDir);
+        const existing = yield* loadCredentialFile(registryUrl);
+        if (storageTier === "keychain") {
+            const legacy = yield* readStoredFile();
+            const legacyRegistry = Option.isSome(legacy)
+                ? legacy.value.registries[registryUrl]
+                : undefined;
+            if (Option.isNone(existing) && legacyRegistry !== undefined) {
+                const migrated = {
+                    version: 1,
+                    registries: { [registryUrl]: legacyRegistry },
+                };
+                yield* writeKeychainCredentialFile(registryUrl, migrated).pipe(Effect.catch(() => Effect.void));
+                yield* deleteCredentialFile(fs, path, homeDir);
+                return yield* load(registryUrl);
+            }
+        }
         if (Option.isNone(existing))
             return Option.none();
         const registry = existing.value.registries[registryUrl];
@@ -181,7 +284,10 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
         return Option.none();
     });
     const clear = Effect.fn("CredentialStore.clear")(function* (registryUrl) {
-        const existing = yield* readCredentialFile(fs, path, homeDir);
+        if (storageTier === "keychain") {
+            yield* deleteKeychainCredentialFile(registryUrl);
+        }
+        const existing = yield* readStoredFile();
         if (Option.isNone(existing))
             return;
         const { [registryUrl]: _, ...remainingRegistries } = existing.value.registries;
@@ -189,7 +295,7 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
             ...existing.value,
             registries: remainingRegistries,
         };
-        yield* writeCredentialFile(fs, path, homeDir, updated);
+        yield* writeStoredFile(updated);
     });
     return {
         tier: storageTier,