@aiwg/cli 2026.7.25 → 2026.8.1

package/dist/src/auth/client.js

@@ -0,0 +1,209 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+const random = (bytes = 32) => randomBytes(bytes).toString("base64url");
+export const createPkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+async function responseJson(response) {
+    const value = await response.json().catch(() => ({}));
+    return value && typeof value === "object" ? value : {};
+}
+function oauthError(value, fallback) {
+    return new Error(typeof value.error === "string" ? value.error : fallback);
+}
+function toCredentials(value, now = new Date()) {
+    if (typeof value.access_token !== "string" || typeof value.refresh_token !== "string"
+        || value.token_type !== "Bearer" || !Number.isSafeInteger(value.expires_in))
+        throw new Error("authorization server returned an invalid token response");
+    return {
+        accessToken: value.access_token,
+        refreshToken: value.refresh_token,
+        tokenType: "Bearer",
+        scope: String(value.scope || "").split(/\s+/).filter(Boolean),
+        expiresAt: new Date(now.getTime() + Number(value.expires_in) * 1000).toISOString(),
+    };
+}
+export const defaultBrowserOpener = async (url) => {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd.exe" : "xdg-open";
+    const args = process.platform === "win32" ? ["/d", "/s", "/c", "start", "", url] : [url];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+        child.once("error", reject);
+        child.once("spawn", () => { child.unref(); resolve(); });
+    });
+};
+function wait(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(new Error("authentication canceled"));
+        const timer = setTimeout(resolve, ms);
+        const abort = () => { clearTimeout(timer); reject(new Error("authentication canceled")); };
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+export class AuthClient {
+    config;
+    store;
+    fetcher;
+    openBrowser;
+    now;
+    sleep;
+    constructor(config, store, fetcher = globalThis.fetch, openBrowser = defaultBrowserOpener, now = () => new Date(), sleep = wait) {
+        this.config = config;
+        this.store = store;
+        this.fetcher = fetcher;
+        this.openBrowser = openBrowser;
+        this.now = now;
+        this.sleep = sleep;
+    }
+    async request(pathname, init) {
+        const signal = init.signal || AbortSignal.timeout(this.config.requestTimeoutMs);
+        return this.fetcher(`${this.config.baseUrl}${pathname}`, { ...init, signal, redirect: "error" });
+    }
+    async loginBrowser(options = {}) {
+        const verifier = random(48);
+        const state = random();
+        let server;
+        const callback = new Promise((resolve, reject) => {
+            server = createServer((request, response) => {
+                try {
+                    const url = new URL(request.url || "/", "http://127.0.0.1");
+                    if (url.pathname !== "/callback" || !url.searchParams.get("code") || !url.searchParams.get("state")) {
+                        response.writeHead(400, { "content-type": "text/plain", "cache-control": "no-store" });
+                        response.end("Invalid authorization callback");
+                        return;
+                    }
+                    response.writeHead(200, { "content-type": "text/plain", "cache-control": "no-store" });
+                    response.end("AIWG authorization complete. You may close this window.");
+                    resolve({ code: url.searchParams.get("code"), state: url.searchParams.get("state") });
+                }
+                catch (error) {
+                    reject(error);
+                }
+            });
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1");
+        });
+        try {
+            const callbackServer = server;
+            if (!callbackServer)
+                throw new Error("loopback callback server was not created");
+            await new Promise((resolve, reject) => { callbackServer.once("listening", resolve); callbackServer.once("error", reject); });
+            const address = callbackServer.address();
+            if (!address || typeof address === "string")
+                throw new Error("loopback callback did not bind a random port");
+            const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+            const authorize = new URL(`${this.config.baseUrl}/oauth/authorize`);
+            authorize.search = new URLSearchParams({
+                client_id: this.config.clientId,
+                redirect_uri: redirectUri,
+                response_type: "code",
+                code_challenge: createPkceChallenge(verifier),
+                code_challenge_method: "S256",
+                state,
+                scope: this.config.scopes.join(" "),
+                ...(options.deviceLabel ? { device_label: options.deviceLabel } : {}),
+            }).toString();
+            await this.openBrowser(authorize.toString());
+            const result = await Promise.race([
+                callback,
+                new Promise((_, reject) => options.signal?.addEventListener("abort", () => reject(new Error("authentication canceled")), { once: true })),
+            ]);
+            if (result.state !== state)
+                throw new Error("OAuth state mismatch");
+            const response = await this.request("/oauth/token", {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({ grant_type: "authorization_code", code: result.code, code_verifier: verifier, client_id: this.config.clientId, redirect_uri: redirectUri }),
+                signal: options.signal,
+            });
+            const value = await responseJson(response);
+            if (!response.ok)
+                throw oauthError(value, "authorization code exchange failed");
+            const credentials = toCredentials(value, this.now());
+            await this.store.save(credentials);
+            return credentials;
+        }
+        finally {
+            server?.closeAllConnections();
+            server?.close();
+        }
+    }
+    async loginDevice(options = {}) {
+        const start = await this.request("/v1/auth/device/authorization", {
+            method: "POST", headers: { "content-type": "application/json" }, signal: options.signal,
+            body: JSON.stringify({ client_id: this.config.clientId, scope: this.config.scopes.join(" "), device_label: options.deviceLabel }),
+        });
+        const value = await responseJson(start);
+        if (!start.ok || typeof value.device_code !== "string" || typeof value.expires_in !== "number" || typeof value.interval !== "number") {
+            throw oauthError(value, "device authorization failed");
+        }
+        options.onCode?.(value);
+        const deadline = this.now().getTime() + value.expires_in * 1000;
+        let interval = value.interval;
+        while (this.now().getTime() < deadline) {
+            await this.sleep(interval * 1000, options.signal);
+            if (this.now().getTime() >= deadline)
+                break;
+            const response = await this.request("/oauth/token", {
+                method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, signal: options.signal,
+                body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: value.device_code, client_id: this.config.clientId }),
+            });
+            const token = await responseJson(response);
+            if (response.ok) {
+                const credentials = toCredentials(token, this.now());
+                await this.store.save(credentials);
+                return credentials;
+            }
+            if (token.error === "authorization_pending")
+                continue;
+            if (token.error === "slow_down") {
+                interval += 5;
+                continue;
+            }
+            throw oauthError(token, "device authorization failed");
+        }
+        throw new Error("expired_token");
+    }
+    async refresh(credentials, signal) {
+        const response = await this.request("/oauth/token", {
+            method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, signal,
+            body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: credentials.refreshToken, client_id: this.config.clientId }),
+        });
+        const value = await responseJson(response);
+        if (!response.ok)
+            throw oauthError(value, "refresh failed");
+        const updated = toCredentials(value, this.now());
+        await this.store.save(updated);
+        return updated;
+    }
+    async status(signal) {
+        let credentials = await this.store.load();
+        if (!credentials)
+            throw new Error("not_authenticated");
+        if (Date.parse(credentials.expiresAt) <= this.now().getTime() + 30_000)
+            credentials = await this.refresh(credentials, signal);
+        let response = await this.request("/v1/me", { headers: { authorization: `Bearer ${credentials.accessToken}` }, signal });
+        if (response.status === 401) {
+            credentials = await this.refresh(credentials, signal);
+            response = await this.request("/v1/me", { headers: { authorization: `Bearer ${credentials.accessToken}` }, signal });
+        }
+        const value = await responseJson(response);
+        if (!response.ok || typeof value.sub !== "string")
+            throw oauthError(value, "status request failed");
+        return { profile: value, credentials };
+    }
+    async logout(signal) {
+        const credentials = await this.store.load();
+        try {
+            if (credentials)
+                await this.request("/oauth/revoke", {
+                    method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, signal,
+                    body: new URLSearchParams({ token: credentials.refreshToken, token_type_hint: "refresh_token" }),
+                });
+        }
+        finally {
+            await this.store.delete();
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/src/auth/config.js

@@ -0,0 +1,38 @@
+import fs from "node:fs";
+import path from "node:path";
+export const DEFAULT_AUTH_BASE_URL = "https://releases.aiwg.io";
+export const DEFAULT_AUTH_CLIENT_ID = "aiwg-cli";
+export const DEFAULT_AUTH_SCOPES = ["releases:read", "profile:read"];
+function cleanOrigin(value, allowLoopbackHttp = false) {
+    const url = new URL(value);
+    const loopback = ["127.0.0.1", "[::1]", "::1", "localhost"].includes(url.hostname);
+    if (url.protocol !== "https:" && !(allowLoopbackHttp && loopback && url.protocol === "http:")) {
+        throw new Error("AIWG authentication requires HTTPS; HTTP is allowed only for explicitly enabled loopback tests");
+    }
+    if (url.username || url.password || url.search || url.hash)
+        throw new Error("AIWG authentication URL must be a clean origin");
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    return url.toString().replace(/\/$/, "");
+}
+export function authConfigFromEnvironment(env = process.env) {
+    const baseUrl = cleanOrigin(env.AIWG_AUTH_BASE_URL || DEFAULT_AUTH_BASE_URL, env.AIWG_AUTH_ALLOW_INSECURE_LOOPBACK_HTTP === "1");
+    const clientId = env.AIWG_AUTH_CLIENT_ID || DEFAULT_AUTH_CLIENT_ID;
+    if (!/^[a-z0-9][a-z0-9._-]{1,63}$/.test(clientId))
+        throw new Error("AIWG auth client ID is invalid");
+    const scopes = (env.AIWG_AUTH_SCOPES || DEFAULT_AUTH_SCOPES.join(" ")).split(/\s+/).filter(Boolean);
+    if (!scopes.length || scopes.some((scope) => !/^[a-z][a-z0-9._:-]{1,63}$/.test(scope)))
+        throw new Error("AIWG auth scopes are invalid");
+    return { baseUrl, clientId, scopes, requestTimeoutMs: 30_000 };
+}
+export function explicitResourceToken(env = process.env) {
+    if (env.AIWG_RESOURCE_TOKEN_FILE) {
+        const pathname = path.resolve(env.AIWG_RESOURCE_TOKEN_FILE);
+        const stat = fs.lstatSync(pathname);
+        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) {
+            throw new Error("AIWG_RESOURCE_TOKEN_FILE must be a non-symlink regular file with mode 0600");
+        }
+        return fs.readFileSync(pathname, "utf8").trim() || null;
+    }
+    return env.AIWG_RESOURCE_TOKEN?.trim() || null;
+}
+//# sourceMappingURL=config.js.map

package/dist/src/auth/credential-store.js

@@ -0,0 +1,141 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export const defaultCommandRunner = (command, args, stdin = "") => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    const stdout = [];
+    const stderr = [];
+    let outputBytes = 0;
+    const collect = (target, chunk) => {
+        outputBytes += chunk.length;
+        if (outputBytes > 1024 * 1024)
+            child.kill();
+        else
+            target.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(stdout, chunk));
+    child.stderr.on("data", (chunk) => collect(stderr, chunk));
+    child.once("error", reject);
+    child.once("close", (code) => resolve({
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        exitCode: code ?? 1,
+    }));
+    child.stdin.end(stdin);
+});
+function parseCredentials(raw) {
+    const value = JSON.parse(raw);
+    if (!value.accessToken?.startsWith("aiwg_at_") || !value.refreshToken?.startsWith("aiwg_rt_")
+        || value.tokenType !== "Bearer" || !Array.isArray(value.scope) || !value.expiresAt) {
+        throw new Error("stored AIWG credentials are invalid");
+    }
+    return value;
+}
+const SERVICE = "releases.aiwg.io";
+const ACCOUNT = "aiwg-cli";
+class NativeCredentialStore {
+    run;
+    constructor(run = defaultCommandRunner) {
+        this.run = run;
+    }
+    parse(raw) { return parseCredentials(raw.trim()); }
+}
+export class MacOsKeychainStore extends NativeCredentialStore {
+    metadata = { provider: "macos-keychain", location: `Keychain:${SERVICE}/${ACCOUNT}` };
+    async load() {
+        const result = await this.run("security", ["find-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-w"]);
+        return result.exitCode === 44 ? null : result.exitCode === 0 ? this.parse(result.stdout) : Promise.reject(new Error("macOS Keychain read failed"));
+    }
+    async save(credentials) {
+        const result = await this.run("security", ["add-generic-password", "-U", "-a", ACCOUNT, "-s", SERVICE, "-w"], JSON.stringify(credentials));
+        if (result.exitCode !== 0)
+            throw new Error("macOS Keychain write failed");
+    }
+    async delete() { await this.run("security", ["delete-generic-password", "-a", ACCOUNT, "-s", SERVICE]); }
+}
+export class LinuxSecretServiceStore extends NativeCredentialStore {
+    metadata = { provider: "linux-secret-service", location: `SecretService:${SERVICE}/${ACCOUNT}` };
+    async load() {
+        const result = await this.run("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT]);
+        return result.exitCode === 1 ? null : result.exitCode === 0 ? this.parse(result.stdout) : Promise.reject(new Error("Linux Secret Service read failed"));
+    }
+    async save(credentials) {
+        const result = await this.run("secret-tool", ["store", `--label=AIWG ${SERVICE}`, "service", SERVICE, "account", ACCOUNT], JSON.stringify(credentials));
+        if (result.exitCode !== 0)
+            throw new Error("Linux Secret Service write failed");
+    }
+    async delete() { await this.run("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT]); }
+}
+const WINDOWS_READ = "$v=New-Object Windows.Security.Credentials.PasswordVault;try{$c=$v.Retrieve('releases.aiwg.io','aiwg-cli');$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{exit 1}";
+const WINDOWS_WRITE = "$s=[Console]::In.ReadToEnd();$v=New-Object Windows.Security.Credentials.PasswordVault;$v.Add((New-Object Windows.Security.Credentials.PasswordCredential('releases.aiwg.io','aiwg-cli',$s)))";
+const WINDOWS_DELETE = "$v=New-Object Windows.Security.Credentials.PasswordVault;try{$c=$v.Retrieve('releases.aiwg.io','aiwg-cli');$v.Remove($c)}catch{}";
+export class WindowsCredentialManagerStore extends NativeCredentialStore {
+    metadata = { provider: "windows-credential-manager", location: `CredentialManager:${SERVICE}/${ACCOUNT}` };
+    execute(script, stdin = "") { return this.run("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], stdin); }
+    async load() { const result = await this.execute(WINDOWS_READ); return result.exitCode === 1 ? null : result.exitCode === 0 ? this.parse(result.stdout) : Promise.reject(new Error("Windows Credential Manager read failed")); }
+    async save(credentials) { if ((await this.execute(WINDOWS_WRITE, JSON.stringify(credentials))).exitCode !== 0)
+        throw new Error("Windows Credential Manager write failed"); }
+    async delete() { await this.execute(WINDOWS_DELETE); }
+}
+export class FileCredentialStore {
+    pathname;
+    explicitlyAllowed;
+    metadata;
+    constructor(pathname, explicitlyAllowed) {
+        this.pathname = pathname;
+        this.explicitlyAllowed = explicitlyAllowed;
+        this.pathname = path.resolve(pathname);
+        this.metadata = { provider: "file", location: this.pathname };
+    }
+    assertAllowed() { if (!this.explicitlyAllowed)
+        throw new Error("credential file fallback requires --allow-file-store or AIWG_AUTH_ALLOW_FILE_STORE=1"); }
+    async load() {
+        this.assertAllowed();
+        try {
+            const stat = await fs.lstat(this.pathname);
+            if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0)
+                throw new Error("credential file must be a non-symlink mode-0600 regular file");
+            return parseCredentials(await fs.readFile(this.pathname, "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async save(credentials) {
+        this.assertAllowed();
+        await fs.mkdir(path.dirname(this.pathname), { recursive: true, mode: 0o700 });
+        const temporary = `${this.pathname}.${process.pid}.tmp`;
+        await fs.writeFile(temporary, `${JSON.stringify(credentials)}\n`, { mode: 0o600, flag: "wx" });
+        await fs.rename(temporary, this.pathname);
+        await fs.chmod(this.pathname, 0o600);
+    }
+    async delete() { this.assertAllowed(); await fs.unlink(this.pathname).catch((error) => { if (error.code !== "ENOENT")
+        throw error; }); }
+}
+export class MemoryCredentialStore {
+    metadata = { provider: "memory", location: "injected-memory-store" };
+    value = null;
+    async load() { return this.value ? structuredClone(this.value) : null; }
+    async save(value) { this.value = structuredClone(value); }
+    async delete() { this.value = null; }
+}
+export function defaultCredentialFile() {
+    const root = process.env.XDG_CONFIG_HOME || (process.platform === "win32" ? process.env.APPDATA : undefined) || path.join(os.homedir(), ".config");
+    return path.join(root, "aiwg", "credentials", "resource-auth.json");
+}
+export function createCredentialStore(options = {}) {
+    if (options.useFile)
+        return new FileCredentialStore(options.pathname || defaultCredentialFile(), options.allowFile === true);
+    const platform = options.platform || process.platform;
+    if (platform === "darwin")
+        return new MacOsKeychainStore(options.runner);
+    if (platform === "win32")
+        return new WindowsCredentialManagerStore(options.runner);
+    if (platform === "linux")
+        return new LinuxSecretServiceStore(options.runner);
+    throw new Error("no native credential store is available; explicitly opt in to the mode-0600 file fallback");
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/src/auth/resource-credentials.js

@@ -0,0 +1,25 @@
+import { explicitResourceToken } from "./config.js";
+import { createCredentialStore } from "./credential-store.js";
+/**
+ * Resolve credentials for protected release downloads. Explicit compatibility
+ * inputs take precedence over interactive-login credentials.
+ */
+export function createResourceCredentialProvider(env = process.env, store) {
+    return async () => {
+        const explicit = explicitResourceToken(env);
+        if (explicit)
+            return explicit;
+        const selected = store ?? createCredentialStore();
+        try {
+            return (await selected.load())?.accessToken ?? null;
+        }
+        catch (error) {
+            // A workstation without the platform keychain helper must retain access
+            // to public releases. Invalid/corrupt stored credentials still fail loud.
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    };
+}
+//# sourceMappingURL=resource-credentials.js.map

package/dist/src/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/channel/manager.mjs

@@ -99,10 +99,10 @@ const DEFAULT_CONFIG = {
  * Get the package root directory.
  *
  * Walks up from this file's directory looking for the nearest package.json
- * that names "aiwg". This works whether this module runs from its source
- * location (`src/channel/manager.mjs`) or from its compiled-build copy
- * (`dist/src/channel/manager.mjs`), both of which have package.json at
- * the repo root.
+ * that names either the full `aiwg` distribution or the lightweight
+ * `@aiwg/cli` distribution. This works whether this module runs from its
+ * source location (`src/channel/manager.mjs`) or from its compiled-build copy
+ * (`dist/src/channel/manager.mjs`).
  *
  * The walk is bounded to 10 levels as a safety cap.
  *
@@ -115,7 +115,7 @@ export function getPackageRoot() {
     if (existsSync(pkg)) {
       try {
         const content = JSON.parse(readFileSync(pkg, 'utf8'));
-        if (content.name === 'aiwg') return dir;
+        if (content.name === 'aiwg' || content.name === '@aiwg/cli') return dir;
       } catch {
         // keep walking
       }

package/dist/src/cli/handlers/auth.js

@@ -0,0 +1,125 @@
+import { AuthClient, defaultBrowserOpener } from "../../auth/client.js";
+import { authConfigFromEnvironment } from "../../auth/config.js";
+import { createCredentialStore } from "../../auth/credential-store.js";
+function usage() {
+    return [
+        "Usage:",
+        "  aiwg auth login [--device] [--device-label <label>] [--store native|file] [--allow-file-store]",
+        "  aiwg auth status [--json] [--store native|file] [--allow-file-store]",
+        "  aiwg auth logout [--all] [--store native|file] [--allow-file-store]",
+        "",
+        "Exit codes: 0 success; 2 invalid usage; 3 not authenticated; 4 authorization denied/expired; 5 credential store unavailable; 6 network/protocol failure.",
+    ].join("\n");
+}
+function value(args, flag) {
+    const index = args.indexOf(flag);
+    if (index < 0)
+        return undefined;
+    const result = args[index + 1];
+    if (!result || result.startsWith("--"))
+        throw new Error(`${flag} requires a value`);
+    return result;
+}
+function classify(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message === "not_authenticated")
+        return 3;
+    if (/access_denied|expired_token|authorization canceled/.test(message))
+        return 4;
+    if (/credential|Keychain|Secret Service|Credential Manager/.test(message))
+        return 5;
+    return 6;
+}
+export function createAuthHandler(dependencies = {}) {
+    return {
+        id: "auth",
+        name: "Authentication",
+        description: "Log in, inspect access, and log out of paid AIWG web resources",
+        category: "maintenance",
+        aliases: [],
+        async execute(ctx) {
+            if (!ctx.args.length || ["help", "--help", "-h"].includes(ctx.args[0])) {
+                console.log(usage());
+                return { exitCode: 0 };
+            }
+            const [subcommand, ...args] = ctx.args;
+            if (!["login", "status", "logout"].includes(subcommand))
+                return { exitCode: 2, message: usage() };
+            try {
+                const storeMode = value(args, "--store") || "native";
+                if (!["native", "file"].includes(storeMode))
+                    return { exitCode: 2, message: "--store must be native or file" };
+                const allowFile = args.includes("--allow-file-store") || dependencies.env?.AIWG_AUTH_ALLOW_FILE_STORE === "1" || process.env.AIWG_AUTH_ALLOW_FILE_STORE === "1";
+                const store = dependencies.store || createCredentialStore({
+                    platform: dependencies.platform,
+                    useFile: storeMode === "file",
+                    allowFile,
+                    runner: dependencies.runner,
+                });
+                if (store.metadata.provider === "file")
+                    console.error("Warning: using explicitly opted-in mode-0600 credential file fallback.");
+                const config = dependencies.config || authConfigFromEnvironment(dependencies.env);
+                const client = new AuthClient(config, store, dependencies.fetcher, dependencies.openBrowser, dependencies.now);
+                if (subcommand === "login") {
+                    const deviceLabel = value(args, "--device-label");
+                    if (args.includes("--device")) {
+                        await client.loginDevice({
+                            signal: ctx.signal,
+                            deviceLabel,
+                            onCode(info) {
+                                console.log(`Open: ${String(info.verification_uri)}`);
+                                console.log(`Code: ${String(info.user_code)}`);
+                            },
+                        });
+                    }
+                    else {
+                        await client.loginBrowser({ signal: ctx.signal, deviceLabel });
+                    }
+                    console.log(`Authenticated. Credentials stored in ${store.metadata.location}.`);
+                    return { exitCode: 0 };
+                }
+                if (subcommand === "status") {
+                    const { profile, credentials } = await client.status(ctx.signal);
+                    const output = {
+                        authenticated: true,
+                        subject: profile.sub,
+                        account: profile.email || null,
+                        organization: profile.organization_id || null,
+                        scopes: profile.scope?.split(/\s+/).filter(Boolean) || credentials.scope,
+                        plan: profile.plan || null,
+                        accessReason: profile.access_reason || null,
+                        accessValidUntil: profile.access_valid_until || credentials.expiresAt,
+                        credentialStore: store.metadata,
+                    };
+                    if (args.includes("--json"))
+                        console.log(JSON.stringify(output));
+                    else {
+                        console.log(`subject: ${output.subject}`);
+                        console.log(`account: ${output.account || "(not supplied)"}`);
+                        console.log(`organization: ${output.organization || "(none)"}`);
+                        console.log(`scopes: ${output.scopes.join(" ")}`);
+                        console.log(`plan: ${output.plan || "(none)"}`);
+                        console.log(`access_reason: ${output.accessReason || "(unknown)"}`);
+                        console.log(`access_valid_until: ${output.accessValidUntil}`);
+                        console.log(`credential_location: ${store.metadata.location}`);
+                    }
+                    return { exitCode: 0 };
+                }
+                if (args.includes("--all")) {
+                    const opener = dependencies.openBrowser || defaultBrowserOpener;
+                    await opener(`${config.baseUrl}/account/security?revoke=all`);
+                }
+                await client.logout(ctx.signal);
+                console.log(args.includes("--all")
+                    ? "Local credentials removed. Complete revoke-all in the opened account security page."
+                    : "Logged out and removed local credentials.");
+                return { exitCode: 0 };
+            }
+            catch (error) {
+                return { exitCode: classify(error), message: error instanceof Error ? error.message : String(error) };
+            }
+        },
+    };
+}
+export const authHandler = createAuthHandler();
+//# sourceMappingURL=auth.js.map

package/dist/src/cli/handlers/help.js

@@ -81,6 +81,7 @@ function displayHelp() {
         ['discover "<phrase>"', 'Find skills/agents/commands/rules by capability'],
         ['show <type> <name>', 'Stream the body of an indexed artifact'],
         ['versions <list|resolve|show>', 'Browse and resolve signed AIWG web resource releases'],
+        ['auth <login|status|logout>', 'Authenticate for paid AIWG web resources'],
         ['index <subcommand>', 'Manage the artifact index (build/query/discover/deps/stats)'],
         ['artifacts move --to <path>', 'Move/rename the project AIWG artifact root and reindex'],
     ]);

package/dist/src/cli/handlers/index.js

@@ -13,6 +13,7 @@ export { createScriptRunner, DefaultScriptRunner } from './script-runner.js';
 // Import all handlers
 import { helpHandler } from './help.js';
 import { versionHandler } from './version.js';
+import { authHandler } from './auth.js';
 import { useHandler } from './use.js';
 import { statusHandler, wizardHandler, migrateWorkspaceHandler, rollbackWorkspaceHandler, workspaceHandlers, } from './workspace.js';
 import { prefillCardsHandler, contributeStartHandler, validateMetadataHandler, doctorHandler, updateHandler, utilityHandlers, } from './utilities.js';
@@ -57,12 +58,13 @@ import { commandLogHandler } from './command-log.js';
 import { skillUsageHandler } from './skill-usage.js';
 import { modelsHandler } from './models.js';
 import { versionsHandler } from './resource-versions.js';
+import { jobHandler } from './job.js';
 // Re-export individual handlers
 export { 
 // Maintenance
-helpHandler, versionHandler, doctorHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
+helpHandler, versionHandler, authHandler, doctorHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -114,6 +116,7 @@ export const allHandlers = [
     // Maintenance (shown first in help)
     helpHandler,
     versionHandler,
+    authHandler,
     doctorHandler,
     updateHandler,
     refreshHandler,
@@ -139,6 +142,7 @@ export const allHandlers = [
     issueHandler,
     issueAuditHandler,
     runHandler,
+    jobHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)