@jarel/myskills 0.1.0-alpha.0 → 0.1.0-alpha.1

package/README.md

@@ -37,7 +37,8 @@ myskills validate --path <file-directory-or-zip>
 myskills scan --path <file-directory-or-zip>
 myskills search [query] [--api-url <url>]
 myskills info <skill-slug> [--api-url <url>]
-myskills login [--api-url <url>] [--email <email>]
+myskills login [--api-url <url>] [--method <password|api-key>] [--email <email>]
+myskills login --api-key [--api-url <url>]
 myskills logout [--api-url <url>] [--token <token>]
 myskills whoami [--api-url <url>] [--token <token>]
 myskills submit --path <file-directory-or-zip> [--api-url <url>] [--token <token>]
@@ -60,6 +61,7 @@ The first public alpha package is distributed through npm under the `alpha` tag:
 ```bash
 npm install -g @jarel/myskills@alpha
 myskills --version
+myskills login
 ```
 
 Update the CLI with:
@@ -68,9 +70,11 @@ Update the CLI with:
 npm install -g @jarel/myskills@alpha
 ```
 
-`validate`, `scan`, and `submit` accept a manifest file, package directory, or local `.zip` package. `login` prompts for the password, handles MFA challenges with a TOTP or recovery code prompt, and stores the returned session token by normalized API URL. Token resolution is `--token`, then `MYSKILLS_TOKEN`, then the stored login token. The default token store writes `tokens.json` under `MYSKILLS_CONFIG_DIR`, `MYSKILLS_TOKEN_FILE`, or the user config directory with user-only file permissions. `logout` revokes stored session tokens and clears the local entry; stored API tokens are removed locally and must be revoked with `token revoke`.
+`validate`, `scan`, and `submit` accept a manifest file, package directory, or local `.zip` package. `login` prompts for the API URL when one is not supplied; the default is the local API at `http://localhost:3001`, and custom hosted URLs can be entered manually. Successful login stores the selected API URL in local CLI config so later commands can omit `--api-url`. API URL resolution is `--api-url`, then `MYSKILLS_API_URL`, then saved config, then `http://localhost:3001`.
 
-`submit` validates and scans locally before sending package directories as normalized text entries or `.zip` packages as base64 archive uploads for server-side extraction. `export` downloads server-authorized bundle content, verifies byte size and SHA-256 against release metadata, and writes normalized package paths under the requested output directory. `install` uses the same verified bundle path, writes into `--dir`, `MYSKILLS_INSTALL_DIR`, or the user data directory, and records local state in `.myskills-app/installed.json`; `update` preserves a rollback snapshot before replacing files, and `rollback` restores the most recent snapshot. `token create` prints the plaintext API token only once and does not overwrite the stored login session. Platform keychain storage, browser login, platform-specific install adapters, and archive creation are still planned.
+`login` supports an email/password session flow and an API-key flow. The email/password flow handles MFA challenges with a TOTP or recovery code prompt and stores only the verified session token. The API-key flow validates the key with `/v1/me` before storing it. Token resolution is `--token`, then `MYSKILLS_TOKEN`, then the stored login token. The default token store uses the platform credential store through `@napi-rs/keyring` and falls back to `tokens.json` with user-only file permissions when keyring storage is unavailable or `MYSKILLS_TOKEN_STORE=file`/`MYSKILLS_TOKEN_FILE` is set. `logout` revokes stored session tokens and clears the local entry; stored API tokens are removed locally and must be revoked with `token revoke`.
+
+`submit` validates and scans locally before sending package directories as normalized text entries or `.zip` packages as base64 archive uploads for server-side extraction. `export` downloads server-authorized bundle content, verifies byte size and SHA-256 against release metadata, and writes normalized package paths under the requested output directory. `install` uses the same verified bundle path, writes into `--dir`, `MYSKILLS_INSTALL_DIR`, or the user data directory, and records local state in `.myskills-app/installed.json`; `update` preserves a rollback snapshot before replacing files, and `rollback` restores the most recent snapshot. `token create` prints the plaintext API token only once and does not overwrite the stored login session. Browser/device login, platform-specific install adapters, and archive creation are still planned.
 
 Common scopes:
 

package/dist/index.js

@@ -548,7 +548,7 @@ var require_yauzl = __commonJS({
     exports.Entry = Entry;
     exports.LocalFileHeader = LocalFileHeader;
     exports.RandomAccessReader = RandomAccessReader;
-    function open(path4, options2, callback) {
+    function open(path5, options2, callback) {
       if (typeof options2 === "function") {
         callback = options2;
         options2 = null;
@@ -560,7 +560,7 @@ var require_yauzl = __commonJS({
       if (options2.validateEntrySizes == null) options2.validateEntrySizes = true;
       if (options2.strictFileNames == null) options2.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs.open(path4, "r", function(err, fd) {
+      fs.open(path5, "r", function(err, fd) {
         if (err) return callback(err);
         fromFd(fd, options2, function(err2, zipfile) {
           if (err2) fs.close(fd, defaultCallback);
@@ -2039,10 +2039,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path4) {
-  if (!path4)
+function getElementAtPath(obj, path5) {
+  if (!path5)
     return obj;
-  return path4.reduce((acc, key) => acc?.[key], obj);
+  return path5.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -2451,11 +2451,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path4, issues) {
+function prefixIssues(path5, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path4);
+    iss.path.unshift(path5);
     return iss;
   });
 }
@@ -2602,16 +2602,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path5 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path5, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -2638,17 +2638,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path5 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path5, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -2680,8 +2680,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path4) {
+  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path5) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -15373,13 +15373,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path4 = ref.slice(1).split("/").filter(Boolean);
-  if (path4.length === 0) {
+  const path5 = ref.slice(1).split("/").filter(Boolean);
+  if (path5.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path4[0] === defsKey) {
-    const key = path4[1];
+  if (path5[0] === defsKey) {
+    const key = path5[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -16321,8 +16321,9 @@ function decodePackageText(buffer, relativePath) {
 
 // src/cli.ts
 var DEFAULT_API_URL = "http://localhost:3001";
-var CLI_VERSION = "0.1.0-alpha.0";
+var CLI_VERSION = "0.1.0-alpha.1";
 var CLI_VISIBILITY_SCOPES = ["public", "authenticated", "organization", "team", "private", "explicit-users"];
+var LOGIN_AUTH_METHODS = ["password", "api-key"];
 async function runCli(argv, runtime) {
   const parsed = parseArgs(argv);
   try {
@@ -16450,23 +16451,46 @@ async function infoCommand(parsed, runtime) {
   return 0;
 }
 async function loginCommand(parsed, runtime) {
-  if (!runtime.tokenStore) {
+  const tokenStore = runtime.tokenStore;
+  if (!tokenStore) {
     throw new CliError("No token store is configured. Set MYSKILLS_TOKEN for one-off commands.", 1);
   }
+  const apiUrl = await loginApiUrl(parsed, runtime);
+  parsed.options["api-url"] = apiUrl;
+  const method = await loginAuthMethod(parsed, runtime);
+  if (method === "api-key") {
+    return await loginWithApiKey(parsed, runtime, apiUrl, tokenStore);
+  }
+  return await loginWithPassword(parsed, runtime, apiUrl, tokenStore);
+}
+async function loginWithPassword(parsed, runtime, apiUrl, tokenStore) {
   const email3 = optionalStringOption(parsed, "email") ?? await promptText(runtime, "Email: ");
   const password = await promptSecret(runtime, "Password: ");
   const loginResponse = await apiPost("/v1/auth/login", { email: email3.trim(), password }, parsed, runtime);
   const session = loginResponse.mfaRequired === true ? await completeMfaLogin(loginResponse, parsed, runtime) : authSessionFromResponse(loginResponse);
-  const apiUrl = apiBaseUrl(parsed, runtime);
-  await runtime.tokenStore.set(apiUrl, {
+  await tokenStore.set(apiUrl, {
     kind: "session",
     token: session.token,
     email: session.email,
     expiresAt: session.expiresAt
   });
+  await runtime.configStore?.setApiUrl(apiUrl);
   runtime.io.stdout(`${session.email ?? email3.trim()}	logged-in	expires=${session.expiresAt}`);
   return 0;
 }
+async function loginWithApiKey(parsed, runtime, apiUrl, tokenStore) {
+  const apiKey = await promptSecret(runtime, "API key: ");
+  const response = await apiGet("/v1/me", parsed, runtime, apiKey);
+  const user = response.user;
+  await tokenStore.set(apiUrl, {
+    kind: "api",
+    token: apiKey,
+    email: user.email
+  });
+  await runtime.configStore?.setApiUrl(apiUrl);
+  runtime.io.stdout(`${user.email ?? "api-key"}	api-key-stored`);
+  return 0;
+}
 async function completeMfaLogin(loginResponse, parsed, runtime) {
   const challengeToken = stringFromRecord(loginResponse, "challengeToken", "API login response is missing MFA challenge token.");
   const mfaValue = (await promptSecret(runtime, "MFA code or recovery code: ")).trim();
@@ -17499,8 +17523,22 @@ function requiredPath(parsed) {
   }
   return value;
 }
+function apiBaseUrlResolution(parsed, runtime) {
+  const optionValue = optionalStringOption(parsed, "api-url");
+  if (optionValue) {
+    return { url: normalizeApiUrlOption(optionValue), source: "option" };
+  }
+  if (runtime.env.MYSKILLS_API_URL) {
+    return { url: normalizeApiUrlOption(runtime.env.MYSKILLS_API_URL), source: "env" };
+  }
+  const configuredApiUrl = runtime.configStore?.getApiUrl();
+  if (configuredApiUrl) {
+    return { url: normalizeApiUrlOption(configuredApiUrl), source: "config" };
+  }
+  return { url: DEFAULT_API_URL, source: "default" };
+}
 function apiBaseUrl(parsed, runtime) {
-  return String(parsed.options["api-url"] ?? runtime.env.MYSKILLS_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, "");
+  return apiBaseUrlResolution(parsed, runtime).url;
 }
 async function tokenOption(parsed, runtime) {
   return (await resolveToken(parsed, runtime))?.value ?? null;
@@ -17558,6 +17596,60 @@ async function promptSecret(runtime, label) {
   }
   return value;
 }
+async function promptOptionalText(runtime, label) {
+  if (!runtime.prompt) {
+    throw new CliError("Interactive input is unavailable. Set MYSKILLS_TOKEN for one-off commands.", 1);
+  }
+  return (await runtime.prompt.text(label)).trim();
+}
+async function loginApiUrl(parsed, runtime) {
+  const resolved = apiBaseUrlResolution(parsed, runtime);
+  if (resolved.source === "option" || resolved.source === "env" || !runtime.prompt) {
+    return resolved.url;
+  }
+  const defaultUrl = resolved.source === "config" ? resolved.url : DEFAULT_API_URL;
+  const input = await promptOptionalText(runtime, `API URL [${defaultUrl}]: `);
+  return input ? normalizeApiUrlOption(input) : defaultUrl;
+}
+async function loginAuthMethod(parsed, runtime) {
+  if (parsed.options["api-key"] === true) {
+    return "api-key";
+  }
+  const methodOption = optionalStringOption(parsed, "auth-method") ?? optionalStringOption(parsed, "method");
+  if (methodOption) {
+    return parseLoginAuthMethod(methodOption);
+  }
+  if (optionalStringOption(parsed, "email") || !runtime.prompt) {
+    return "password";
+  }
+  const input = await promptOptionalText(runtime, "Authentication method [password] (password/api-key): ");
+  return input ? parseLoginAuthMethod(input) : "password";
+}
+function parseLoginAuthMethod(input) {
+  const normalized = input.trim().toLowerCase();
+  if (normalized === "password" || normalized === "email" || normalized === "user" || normalized === "username") {
+    return "password";
+  }
+  if (normalized === "api-key" || normalized === "apikey" || normalized === "api" || normalized === "key") {
+    return "api-key";
+  }
+  if (normalized === "browser" || normalized === "web") {
+    throw new CliError("Browser login is not available in this CLI/API version yet. Choose password or api-key.", 2);
+  }
+  throw new CliError(`Authentication method must be one of: ${LOGIN_AUTH_METHODS.join(", ")}.`, 2);
+}
+function normalizeApiUrlOption(input) {
+  const trimmed = input.trim().replace(/\/+$/, "");
+  try {
+    const url2 = new URL(trimmed);
+    if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+    return trimmed;
+  } catch {
+    throw new CliError("API URL must be a valid http:// or https:// URL.", 2);
+  }
+}
 function authSessionFromResponse(response) {
   const user = response.user;
   let email3;
@@ -17666,7 +17758,7 @@ function parseArgs(argv) {
       continue;
     }
     const key = value.slice(2);
-    if (key === "json") {
+    if (key === "json" || key === "api-key") {
       options2[key] = true;
       continue;
     }
@@ -17696,7 +17788,8 @@ function helpText() {
     "  scan --path <file-directory-or-zip>",
     "  search [query] [--api-url <url>]",
     "  info <skill-slug> [--api-url <url>]",
-    "  login [--api-url <url>] [--email <email>]",
+    "  login [--api-url <url>] [--method <password|api-key>] [--email <email>]",
+    "  login --api-key [--api-url <url>]",
     "  logout [--api-url <url>] [--token <token>]",
     "  whoami [--api-url <url>] [--token <token>]",
     "  submit --path <file-directory-or-zip> [--api-url <url>] [--token <token>]",
@@ -17722,7 +17815,7 @@ function helpText() {
     "Options:",
     "  --version           Print CLI version.",
     "  --json              Print machine-readable JSON.",
-    "  --api-url <url>     API base URL. Defaults to MYSKILLS_API_URL or http://localhost:3001.",
+    "  --api-url <url>     API base URL. Defaults to MYSKILLS_API_URL, saved config, or http://localhost:3001.",
     "  --token <token>     Bearer token. Defaults to MYSKILLS_TOKEN, then stored login token."
   ].join("\n");
 }
@@ -17734,60 +17827,175 @@ var CliError = class extends Error {
   exitCode;
 };
 
-// src/token-store.ts
-import { chmod, mkdir as mkdir2, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+// src/config-store.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path3 from "node:path";
+function createFileConfigStore(env = process.env) {
+  const filePath = configFilePath(env);
+  let payload = readPayload(filePath);
+  return {
+    getApiUrl() {
+      return payload.apiUrl;
+    },
+    async setApiUrl(apiUrl) {
+      payload = {
+        ...payload,
+        apiUrl: apiUrl.replace(/\/+$/, "")
+      };
+      writePayload(filePath, payload);
+    }
+  };
+}
+function configFilePath(env) {
+  if (env.MYSKILLS_CONFIG_FILE) {
+    return path3.resolve(env.MYSKILLS_CONFIG_FILE);
+  }
+  if (env.MYSKILLS_CONFIG_DIR) {
+    return path3.join(path3.resolve(env.MYSKILLS_CONFIG_DIR), "config.json");
+  }
+  const baseDir = env.XDG_CONFIG_HOME ? path3.join(env.XDG_CONFIG_HOME, "myskills-app") : path3.join(os.homedir(), ".config", "myskills-app");
+  return path3.join(baseDir, "config.json");
+}
+function readPayload(filePath) {
+  try {
+    return parsePayload(readFileSync(filePath, "utf8"));
+  } catch (error51) {
+    if (isNodeError2(error51) && error51.code === "ENOENT") {
+      return { version: 1 };
+    }
+    throw error51;
+  }
+}
+function writePayload(filePath, payload) {
+  mkdirSync(path3.dirname(filePath), { recursive: true, mode: 448 });
+  writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}
+`, { mode: 384 });
+  chmodSync(filePath, 384);
+}
+function parsePayload(raw) {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Config file must contain a JSON object.");
+  }
+  const record2 = parsed;
+  if (record2.version !== 1) {
+    throw new Error("Config file has an unsupported format.");
+  }
+  return {
+    version: 1,
+    apiUrl: typeof record2.apiUrl === "string" && record2.apiUrl ? record2.apiUrl.replace(/\/+$/, "") : void 0
+  };
+}
+function isNodeError2(error51) {
+  return error51 instanceof Error && "code" in error51;
+}
+
+// src/token-store.ts
+import { chmod, mkdir as mkdir2, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import os2 from "node:os";
+import path4 from "node:path";
+var KEYRING_SERVICE = "ai.jarel.myskills.cli";
+function createTokenStore(env = process.env) {
+  const fileStore = createFileTokenStore(env);
+  if (env.MYSKILLS_TOKEN_STORE === "file" || env.MYSKILLS_TOKEN_FILE) {
+    return fileStore;
+  }
+  return createKeyringTokenStore(fileStore);
+}
 function createFileTokenStore(env = process.env) {
   const filePath = tokenFilePath(env);
   return {
     async get(apiUrl) {
-      return (await readPayload(filePath)).tokens[normalizeApiUrl(apiUrl)] ?? null;
+      return (await readPayload2(filePath)).tokens[normalizeApiUrl(apiUrl)] ?? null;
     },
     async set(apiUrl, token) {
-      const payload = await readPayload(filePath);
+      const payload = await readPayload2(filePath);
       payload.tokens[normalizeApiUrl(apiUrl)] = token;
-      await writePayload(filePath, payload);
+      await writePayload2(filePath, payload);
     },
     async delete(apiUrl) {
-      const payload = await readPayload(filePath);
+      const payload = await readPayload2(filePath);
       delete payload.tokens[normalizeApiUrl(apiUrl)];
       if (Object.keys(payload.tokens).length === 0) {
         await rm2(filePath, { force: true });
         return;
       }
-      await writePayload(filePath, payload);
+      await writePayload2(filePath, payload);
+    }
+  };
+}
+function createKeyringTokenStore(fallback) {
+  return {
+    async get(apiUrl) {
+      const keyringToken = await readKeyringToken(apiUrl);
+      return keyringToken ?? await fallback.get(apiUrl);
+    },
+    async set(apiUrl, token) {
+      if (await writeKeyringToken(apiUrl, token)) {
+        return;
+      }
+      await fallback.set(apiUrl, token);
+    },
+    async delete(apiUrl) {
+      await deleteKeyringToken(apiUrl);
+      await fallback.delete(apiUrl);
     }
   };
 }
+async function readKeyringToken(apiUrl) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    const raw = new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).getPassword();
+    return raw ? parseStoredToken(JSON.parse(raw)) : null;
+  } catch {
+    return null;
+  }
+}
+async function writeKeyringToken(apiUrl, token) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).setPassword(JSON.stringify(token));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function deleteKeyringToken(apiUrl) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).deletePassword();
+  } catch {
+  }
+}
 function tokenFilePath(env) {
   if (env.MYSKILLS_TOKEN_FILE) {
-    return path3.resolve(env.MYSKILLS_TOKEN_FILE);
+    return path4.resolve(env.MYSKILLS_TOKEN_FILE);
   }
   if (env.MYSKILLS_CONFIG_DIR) {
-    return path3.join(path3.resolve(env.MYSKILLS_CONFIG_DIR), "tokens.json");
+    return path4.join(path4.resolve(env.MYSKILLS_CONFIG_DIR), "tokens.json");
   }
-  const baseDir = env.XDG_CONFIG_HOME ? path3.join(env.XDG_CONFIG_HOME, "myskills-app") : path3.join(os.homedir(), ".config", "myskills-app");
-  return path3.join(baseDir, "tokens.json");
+  const baseDir = env.XDG_CONFIG_HOME ? path4.join(env.XDG_CONFIG_HOME, "myskills-app") : path4.join(os2.homedir(), ".config", "myskills-app");
+  return path4.join(baseDir, "tokens.json");
 }
-async function readPayload(filePath) {
+async function readPayload2(filePath) {
   try {
     const raw = await readFile3(filePath, "utf8");
-    return parsePayload(raw);
+    return parsePayload2(raw);
   } catch (error51) {
-    if (isNodeError2(error51) && error51.code === "ENOENT") {
+    if (isNodeError3(error51) && error51.code === "ENOENT") {
       return { version: 1, tokens: {} };
     }
     throw error51;
   }
 }
-async function writePayload(filePath, payload) {
-  await mkdir2(path3.dirname(filePath), { recursive: true, mode: 448 });
+async function writePayload2(filePath, payload) {
+  await mkdir2(path4.dirname(filePath), { recursive: true, mode: 448 });
   await writeFile2(filePath, `${JSON.stringify(payload, null, 2)}
 `, { mode: 384 });
   await chmod(filePath, 384);
 }
-function parsePayload(raw) {
+function parsePayload2(raw) {
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("Token store file must contain a JSON object.");
@@ -17823,7 +18031,10 @@ function parseStoredToken(input) {
 function normalizeApiUrl(apiUrl) {
   return apiUrl.replace(/\/+$/, "");
 }
-function isNodeError2(error51) {
+function keyringAccount(apiUrl) {
+  return `api-url:${Buffer.from(normalizeApiUrl(apiUrl)).toString("base64url")}`;
+}
+function isNodeError3(error51) {
   return error51 instanceof Error && "code" in error51;
 }
 
@@ -17943,8 +18154,9 @@ try {
   const exitCode = await runCli(process.argv.slice(2), {
     env: process.env,
     fetch: fetchImpl,
+    configStore: createFileConfigStore(process.env),
     prompt,
-    tokenStore: createFileTokenStore(process.env),
+    tokenStore: createTokenStore(process.env),
     io: {
       stdout: (line) => console.log(line),
       stderr: (line) => console.error(line)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jarel/myskills",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.1",
   "description": "Command-line client for publishing, discovering, installing, updating, and rolling back MySkills packages.",
   "license": "Apache-2.0",
   "private": false,
@@ -44,5 +44,8 @@
     "@myskills-app/skill-package": "0.1.0-alpha.0",
     "esbuild": "^0.28.1",
     "tsx": "^4.20.6"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.3.0"
   }
 }