@agentxm/registry-auth 0.28.11 → 0.28.13

package/dist/src/auth-client.d.ts

@@ -1,3 +1,4 @@
+import type { PublishAuthorizationDelivery, PublishAuthorizationPollingStatus } from "@agentxm/registry-protocol/unstable/publish-authorization";
 /**
  * AuthClient Effect service — device flow login, token refresh, revocation, identity queries.
  *
@@ -16,10 +17,10 @@ import * as ServiceMap from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { type Handle } from "@agentxm/extension-model/unstable/extensions/handle";
-import { type PublishVisibility } from "@agentxm/registry-protocol/unstable/publish/visibility";
+import { type PublishVisibility } from "@agentxm/registry-protocol/unstable/publish";
 import { type PreviewPublicationSetRequest, type PreviewPublicationSetResponse, type Sha256Hex } from "@agentxm/registry-protocol/unstable/registry/publication-set";
 import { type NormalizedTokenResponse } from "./oauth-contract.js";
-import { RegistryUrl } from "@agentxm/registry-client";
+import { GeneratedRegistryClient, RegistryUrl } from "@agentxm/registry-client";
 import { type AuthError, type StepUpRequest } from "./errors.js";
 export declare const OIDC_LOGIN_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
 export declare const BASELINE_REGISTRY_LOGIN_SCOPES: readonly ["extensions:read", "account:read"];
@@ -102,16 +103,20 @@ export interface ExchangePkceCodeParams {
 }
 export interface CreatePublishAuthorizationRequestParams {
     readonly registryUrl: string;
-    readonly redirectUri: string;
-    readonly state: string;
-    readonly codeChallenge: string;
+    readonly delivery: PublishAuthorizationDelivery;
     readonly publicationSet: PreviewPublicationSetRequest;
 }
 export interface PublishAuthorizationRequestResponse {
+    readonly interval: number;
     readonly requestId: string;
     readonly authorizationUrl: string;
     readonly expiresAt: DateTime.Utc;
 }
+export interface PublishAuthorizationPollingParams {
+    readonly registryUrl: string;
+    readonly requestId: string;
+    readonly initiatorProof: string;
+}
 export interface ExchangePublishAuthorizationCodeParams {
     readonly registryUrl: string;
     readonly code: string;
@@ -156,6 +161,8 @@ export interface AuthClientService {
     readonly getAuthorizationIssuer: () => string;
     readonly exchangePkceCode: (params: ExchangePkceCodeParams) => Effect.Effect<NormalizedTokenResponse, AuthError>;
     readonly createPublishAuthorizationRequest: (params: CreatePublishAuthorizationRequestParams) => Effect.Effect<PublishAuthorizationRequestResponse, AuthError>;
+    readonly pollPublishAuthorization: (params: PublishAuthorizationPollingParams) => Effect.Effect<PublishAuthorizationPollingStatus, AuthError>;
+    readonly exchangePublishAuthorization: (params: PublishAuthorizationPollingParams) => Effect.Effect<PublishAuthorizationExchangeResponse, AuthError>;
     readonly exchangePublishAuthorizationCode: (params: ExchangePublishAuthorizationCodeParams) => Effect.Effect<PublishAuthorizationExchangeResponse, AuthError>;
     readonly initiateDeviceFlow: (options?: LoginScopeOptions) => Effect.Effect<DeviceFlowResponse, AuthError>;
     readonly pollDeviceToken: (deviceCode: string, interval: number) => Effect.Effect<NormalizedTokenResponse, AuthError>;
@@ -167,6 +174,7 @@ export interface AuthClientService {
         readonly limit?: number;
         readonly cursor?: string;
     }) => Effect.Effect<TokenListResponse, AuthError>;
+    readonly getStepUpRequest: (accessToken: string, requestId: string) => Effect.Effect<GeneratedRegistryClient.StepUpRequestStatusResponse, AuthError>;
     readonly waitForStepUpRequest: (accessToken: string, statusUrl: string, intervalSeconds: number) => Effect.Effect<void, AuthError>;
     readonly deleteToken: (accessToken: string, tokenId: string, options?: DeleteTokenOptions) => Effect.Effect<void, AuthError>;
 }

package/dist/src/auth-client.js

@@ -23,10 +23,10 @@ import * as Schedule from "effect/Schedule";
 import * as Schema from "effect/Schema";
 import { DateTimeUtcSchema } from "@agentxm/extension-model/unstable/date-time";
 import { normalizeHandle } from "@agentxm/extension-model/unstable/extensions/handle";
-import { PublishVisibilitySchema, } from "@agentxm/registry-protocol/unstable/publish/visibility";
+import { PublishVisibilitySchema, } from "@agentxm/registry-protocol/unstable/publish";
 import { PreviewPublicationSetResponseSchema, } from "@agentxm/registry-protocol/unstable/registry/publication-set";
 import {} from "./oauth-contract.js";
-import { GeneratedRegistryClient, RegistryUrl, captureRegistryErrorResponseBodies, getString, isHttpClientError, isRegistryClientError, isRegistryClientFailure, isTransientHttpClientError, mapRegistryFailure, } from "@agentxm/registry-client";
+import { GeneratedRegistryClient, executeRegistryRequest, RegistryUrl, captureRegistryErrorResponseBodies, getString, isHttpClientError, isRegistryClientError, isRegistryClientFailure, isTransientHttpClientError, mapRegistryFailure, } from "@agentxm/registry-client";
 import { AuthExchangeFailed, DeviceLoginCodeExpired, DeviceLoginDenied, RegistryAuthFailed, StepUpRequired, } from "./errors.js";
 // -----------------------------------------------------------------------------
 // Constants
@@ -93,6 +93,29 @@ const PublishAuthorizationExchangeResponseSchema = Schema.Union([
         grants: Schema.Tuple([]),
     }),
 ]);
+const decodePublishAuthorizationExchange = Effect.fn("AuthClient.decodePublishAuthorizationExchange")(function* (registryUrl, response) {
+    if (!Schema.is(PublishAuthorizationExchangeResponseSchema)(response)) {
+        return yield* mapRegistryAuthError(registryUrl, "The Registry is incompatible with exact publish authorization", new Error("Invalid publish capability response"));
+    }
+    if (response.status === "blocked") {
+        return response;
+    }
+    return {
+        status: "admitted",
+        preview: response.preview,
+        grants: response.grants.map((grant) => ({
+            accessToken: grant.access_token,
+            expiresAt: grant.expires_at,
+            scope: grant.scope,
+            publishRequestId: grant.publish_request_id,
+            visibilityContract: grant.visibility_contract,
+            visibility: grant.visibility,
+            condition: grant.condition,
+            publicationSetDigest: grant.publication_set_digest,
+            publicationDescriptorDigest: grant.publication_descriptor_digest,
+        })),
+    };
+});
 const deriveAuthorizationOrigin = (registryUrl) => {
     const url = new URL(registryUrl);
     if (url.origin === "https://registry.agentxm.ai") {
@@ -101,14 +124,13 @@ const deriveAuthorizationOrigin = (registryUrl) => {
     if (url.origin === "https://registry-dev.agentxm.ai") {
         return "https://web-dev.agentxm.ai";
     }
-    if (url.host === "localhost:4300") {
-        return "http://localhost:4200";
-    }
-    if (url.host === "127.0.0.1:4300") {
-        return "http://127.0.0.1:4200";
-    }
-    if (url.hostname === "127.0.0.1") {
-        return `${url.protocol}//${url.hostname}:4200`;
+    const localHosts = ["localhost", "127.0.0.1", "[::1]"];
+    const registryPort = Number(url.port);
+    if (localHosts.some((host) => host === url.hostname) &&
+        Number.isInteger(registryPort) &&
+        registryPort >= 4300 &&
+        registryPort <= 4399) {
+        return `${url.protocol}//${url.hostname}:${String(registryPort - 100)}`;
     }
     return url.origin;
 };
@@ -298,24 +320,54 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
     const createPublishAuthorizationRequest = Effect.fn("AuthClient.createPublishAuthorizationRequest")(function* (params) {
         const publishClient = makeGeneratedAuthClient(httpClient, params.registryUrl);
         const publicationSet = yield* Schema.encodeUnknownEffect(GeneratedRegistryClient.PreviewPublicationSetRequest)(params.publicationSet).pipe(Effect.mapError((error) => mapRegistryAuthError(params.registryUrl, "Could not encode publish authorization request", error)));
-        const response = yield* publishClient
-            .AuthCreatePublishAuthorizationRequest({
+        const response = yield* executeRegistryRequest(publishClient.AuthCreatePublishAuthorizationRequest({
             payload: {
                 client_id: CLIENT_ID,
-                redirect_uri: params.redirectUri,
-                state: params.state,
-                code_challenge: params.codeChallenge,
-                code_challenge_method: "S256",
+                delivery: params.delivery,
                 publication_set: publicationSet,
             },
-        })
-            .pipe(Effect.mapError((error) => mapRegistryAuthError(params.registryUrl, "Could not create publish authorization request", error)));
+        }), {
+            operation: "createPublishAuthorizationRequest",
+            request: {
+                service: "registry",
+                method: "POST",
+                url: `${params.registryUrl.replace(/\/+$/, "")}/v1/auth/publish-requests`,
+            },
+            replaySafety: { kind: "mutation" },
+            mapError: (error) => mapRegistryAuthError(params.registryUrl, "Could not create publish authorization request; no automatic replacement was attempted", error),
+        });
         return {
+            interval: response.interval,
             requestId: response.request_id,
             authorizationUrl: response.authorization_url,
             expiresAt: response.expires_at,
         };
     });
+    const pollPublishAuthorization = Effect.fn("AuthClient.pollPublishAuthorization")(function* (params) {
+        const publishClient = makeGeneratedAuthClient(httpClient, params.registryUrl);
+        const requestRef = `${params.registryUrl.replace(/\/+$/, "")}/v1/auth/publish-requests/${params.requestId}`;
+        return yield* executeRegistryRequest(publishClient.AuthPollPublishAuthorization(params.requestId, {
+            payload: { initiator_proof: params.initiatorProof },
+        }), {
+            operation: "pollPublishAuthorization",
+            request: { service: "registry", method: "POST", url: `${requestRef}/status` },
+            replaySafety: { kind: "safe" },
+            mapError: (error) => mapRegistryAuthError(params.registryUrl, `Could not read publish authorization status. Resume the same command with --authorization-request ${requestRef}`, error),
+        });
+    });
+    const exchangePublishAuthorization = Effect.fn("AuthClient.exchangePublishAuthorization")(function* (params) {
+        const publishClient = makeGeneratedAuthClient(httpClient, params.registryUrl);
+        const requestRef = `${params.registryUrl.replace(/\/+$/, "")}/v1/auth/publish-requests/${params.requestId}`;
+        const response = yield* executeRegistryRequest(publishClient.AuthExchangePublishAuthorization(params.requestId, {
+            payload: { initiator_proof: params.initiatorProof },
+        }), {
+            operation: "exchangePublishAuthorization",
+            request: { service: "registry", method: "POST", url: `${requestRef}/exchange` },
+            replaySafety: { kind: "mutation" },
+            mapError: (error) => mapRegistryAuthError(params.registryUrl, `Publish authorization exchange did not complete. Resume with --authorization-request ${requestRef} to check its status before requesting new consent`, error),
+        });
+        return yield* decodePublishAuthorizationExchange(params.registryUrl, response);
+    });
     const exchangePublishAuthorizationCode = Effect.fn("AuthClient.exchangePublishAuthorizationCode")(function* (params) {
         const publishClient = makeGeneratedAuthClient(httpClient, params.registryUrl);
         const response = yield* publishClient
@@ -345,27 +397,7 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
                 })
                 : mapped;
         }));
-        if (!Schema.is(PublishAuthorizationExchangeResponseSchema)(response)) {
-            return yield* mapRegistryAuthError(params.registryUrl, "The Registry is incompatible with exact publish authorization", response);
-        }
-        if (response.status === "blocked") {
-            return response;
-        }
-        return {
-            status: "admitted",
-            preview: response.preview,
-            grants: response.grants.map((grant) => ({
-                accessToken: grant.access_token,
-                expiresAt: grant.expires_at,
-                scope: grant.scope,
-                publishRequestId: grant.publish_request_id,
-                visibilityContract: grant.visibility_contract,
-                visibility: grant.visibility,
-                condition: grant.condition,
-                publicationSetDigest: grant.publication_set_digest,
-                publicationDescriptorDigest: grant.publication_descriptor_digest,
-            })),
-        };
+        return yield* decodePublishAuthorizationExchange(params.registryUrl, response);
     });
     const initiateDeviceFlow = Effect.fn("AuthClient.initiateDeviceFlow")(function* (options) {
         const response = yield* client
@@ -496,6 +528,9 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
             cursor: decoded.cursor,
         };
     });
+    const getStepUpRequest = (accessToken, requestId) => makeGeneratedAuthClient(httpClient, registryUrl, accessToken)
+        .AuthGetStepUpRequest(requestId, undefined)
+        .pipe(Effect.mapError((error) => mapRegistryAuthError(registryUrl, "Could not read step-up request", error)));
     const waitForStepUpRequest = Effect.fn("AuthClient.waitForStepUpRequest")(function* (accessToken, statusUrl, intervalSeconds) {
         const parsedStatusUrl = new URL(statusUrl);
         const requestId = parsedStatusUrl.pathname.slice(parsedStatusUrl.pathname.lastIndexOf("/") + 1);
@@ -558,6 +593,8 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
         getAuthorizationIssuer,
         exchangePkceCode,
         createPublishAuthorizationRequest,
+        pollPublishAuthorization,
+        exchangePublishAuthorization,
         exchangePublishAuthorizationCode,
         initiateDeviceFlow,
         pollDeviceToken,
@@ -566,6 +603,7 @@ export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
         getMe,
         createToken,
         listTokens,
+        getStepUpRequest,
         waitForStepUpRequest,
         deleteToken,
     };
@@ -584,6 +622,8 @@ export const AuthClientTest = (overrides) => Layer.succeed(AuthClient, {
         category: "auth",
         detail: "Not implemented in test",
     })),
+    pollPublishAuthorization: () => Effect.fail(new RegistryAuthFailed({ category: "auth", detail: "Not implemented in test" })),
+    exchangePublishAuthorization: () => Effect.fail(new RegistryAuthFailed({ category: "auth", detail: "Not implemented in test" })),
     exchangePublishAuthorizationCode: () => Effect.fail(new RegistryAuthFailed({
         category: "auth",
         detail: "Not implemented in test",
@@ -613,6 +653,7 @@ export const AuthClientTest = (overrides) => Layer.succeed(AuthClient, {
         category: "auth",
         detail: "Not implemented in test",
     })),
+    getStepUpRequest: () => Effect.fail(new RegistryAuthFailed({ category: "auth", detail: "Not implemented in test" })),
     waitForStepUpRequest: () => Effect.fail(new RegistryAuthFailed({
         category: "auth",
         detail: "Not implemented in test",

package/dist/src/credential-store.d.ts

@@ -68,8 +68,45 @@ export declare const makePersistedCredentialsUnsupportedError: () => AuthTokenPo
 export declare const CredentialStoreLive: Layer.Layer<CredentialStore, never, FileSystem.FileSystem | Path.Path>;
 /**
  * Decorates a credential store with a per-layer, per-origin read memo.
- * Successful empty reads are memoized; failures remain retryable. Every
- * successful write invalidates only the affected origin.
+ *
+ * Reads go through an `Effect.Cache` keyed by registry origin, which owns the
+ * concurrent-lookup sharing, per-key invalidation, and result-dependent expiry
+ * that this layer previously hand-rolled with a value map, a semaphore map, and
+ * a double-checked read.
+ *
+ * Capacity is `Number.POSITIVE_INFINITY`: the cache never evicts on size, which
+ * preserves the unbounded map this layer already used. The key space is the set
+ * of distinct registry origins a single process contacts — the configured
+ * registry plus any origins named by workspace extension sources — so there is
+ * no measured workload that justifies a numeric bound. The bound that matters
+ * is lifetime, and it is the layer's: the cache is created per
+ * `CredentialStoreSessionLive` construction and released with it, so a CLI
+ * session is its longest possible life.
+ *
+ * Expiry is result-dependent. Successful reads — including a successful empty
+ * read — live for the session, so repeated authentication paths pay one load
+ * per origin. Failed reads expire immediately, so a failure is never memoized
+ * and a later request retries against the store.
+ *
+ * Callers that arrive while a lookup is in flight share it rather than issuing
+ * their own; callers that arrive after a failed lookup resolves start a new
+ * one. That replaces the old per-origin semaphore, under which every waiter on
+ * a failing origin retried serially. Sharing is safe here because each auth
+ * path issues a single load and none of them depends on serial retry.
+ *
+ * `Effect.onInterrupt` is load-path scaffolding, not decoration. `Cache.get`
+ * runs its lookup on a detached daemon fiber and leaves the pending entry in
+ * the map when the only caller is interrupted, so without this guard the next
+ * read of that origin would await an abandoned lookup forever. Invalidating on
+ * interrupt restores the pre-cache behavior, where an interrupted read left
+ * nothing behind and the next read simply ran again.
+ *
+ * Known limitation, unchanged by this layer's move to `Cache` and not fixed by
+ * it: a `save` or `clear` whose invalidation lands while a read of the same
+ * origin is still in flight can be overwritten when that read populates the
+ * memo, leaving the pre-write value cached for the rest of the session. The
+ * previous value-map-and-semaphore memo lost the same invalidation through its
+ * own write-after-invalidate window.
  */
 export declare const CredentialStoreSessionLive: Layer.Layer<CredentialStore, never, CredentialStore>;
 export declare const CredentialStoreTest: (tier?: StorageTier, initialData?: CredentialFile, allowsPersistedCredentials?: boolean) => Layer.Layer<CredentialStore, never, never>;

package/dist/src/credential-store.js

@@ -20,12 +20,13 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as ServiceMap from "effect/Context";
+import * as Cache from "effect/Cache";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
-import * as Semaphore from "effect/Semaphore";
 import * as lockfile from "proper-lockfile";
 import { decodeHandleSync } from "@agentxm/extension-model/unstable/extensions/handle";
 import { AuthTokenPolicyRequired, RegistryAuthFailed } from "./errors.js";
@@ -340,57 +341,60 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
 }));
 /**
  * Decorates a credential store with a per-layer, per-origin read memo.
- * Successful empty reads are memoized; failures remain retryable. Every
- * successful write invalidates only the affected origin.
+ *
+ * Reads go through an `Effect.Cache` keyed by registry origin, which owns the
+ * concurrent-lookup sharing, per-key invalidation, and result-dependent expiry
+ * that this layer previously hand-rolled with a value map, a semaphore map, and
+ * a double-checked read.
+ *
+ * Capacity is `Number.POSITIVE_INFINITY`: the cache never evicts on size, which
+ * preserves the unbounded map this layer already used. The key space is the set
+ * of distinct registry origins a single process contacts — the configured
+ * registry plus any origins named by workspace extension sources — so there is
+ * no measured workload that justifies a numeric bound. The bound that matters
+ * is lifetime, and it is the layer's: the cache is created per
+ * `CredentialStoreSessionLive` construction and released with it, so a CLI
+ * session is its longest possible life.
+ *
+ * Expiry is result-dependent. Successful reads — including a successful empty
+ * read — live for the session, so repeated authentication paths pay one load
+ * per origin. Failed reads expire immediately, so a failure is never memoized
+ * and a later request retries against the store.
+ *
+ * Callers that arrive while a lookup is in flight share it rather than issuing
+ * their own; callers that arrive after a failed lookup resolves start a new
+ * one. That replaces the old per-origin semaphore, under which every waiter on
+ * a failing origin retried serially. Sharing is safe here because each auth
+ * path issues a single load and none of them depends on serial retry.
+ *
+ * `Effect.onInterrupt` is load-path scaffolding, not decoration. `Cache.get`
+ * runs its lookup on a detached daemon fiber and leaves the pending entry in
+ * the map when the only caller is interrupted, so without this guard the next
+ * read of that origin would await an abandoned lookup forever. Invalidating on
+ * interrupt restores the pre-cache behavior, where an interrupted read left
+ * nothing behind and the next read simply ran again.
+ *
+ * Known limitation, unchanged by this layer's move to `Cache` and not fixed by
+ * it: a `save` or `clear` whose invalidation lands while a read of the same
+ * origin is still in flight can be overwritten when that read populates the
+ * memo, leaving the pre-write value cached for the rest of the session. The
+ * previous value-map-and-semaphore memo lost the same invalidation through its
+ * own write-after-invalidate window.
  */
 export const CredentialStoreSessionLive = Layer.effect(CredentialStore, Effect.gen(function* () {
     const store = yield* CredentialStore;
-    const cache = yield* Ref.make(new Map());
-    const locks = yield* Ref.make(new Map());
-    const getLock = (registryUrl) => Ref.modify(locks, (current) => {
-        const existing = current.get(registryUrl);
-        if (existing !== undefined)
-            return [existing, current];
-        const created = Semaphore.makeUnsafe(1);
-        const updated = new Map(current);
-        updated.set(registryUrl, created);
-        return [created, updated];
-    });
-    const getCached = (registryUrl) => Effect.map(Ref.get(cache), (current) => {
-        const cached = current.get(registryUrl);
-        return cached === undefined
-            ? Option.none()
-            : Option.some(cached);
-    });
-    const invalidate = (registryUrl) => Ref.update(cache, (current) => {
-        const updated = new Map(current);
-        updated.delete(registryUrl);
-        return updated;
-    });
-    const load = (registryUrl) => Effect.gen(function* () {
-        const cached = yield* getCached(registryUrl);
-        if (Option.isSome(cached))
-            return cached.value;
-        const lock = yield* getLock(registryUrl);
-        return yield* lock.withPermits(1)(Effect.gen(function* () {
-            const afterWait = yield* getCached(registryUrl);
-            if (Option.isSome(afterWait))
-                return afterWait.value;
-            const loaded = yield* store.load(registryUrl);
-            yield* Ref.update(cache, (current) => {
-                const updated = new Map(current);
-                updated.set(registryUrl, loaded);
-                return updated;
-            });
-            return loaded;
-        }));
+    const cache = yield* Cache.makeWith((registryUrl) => store.load(registryUrl), {
+        capacity: Number.POSITIVE_INFINITY,
+        timeToLive: (exit) => Exit.isSuccess(exit) ? Duration.infinity : Duration.zero,
     });
     return {
         tier: store.tier,
         allowsPersistedCredentials: store.allowsPersistedCredentials,
-        load,
-        save: (registryUrl, handle, credentials) => store.save(registryUrl, handle, credentials).pipe(Effect.andThen(invalidate(registryUrl))),
-        clear: (registryUrl) => store.clear(registryUrl).pipe(Effect.andThen(invalidate(registryUrl))),
+        load: (registryUrl) => Cache.get(cache, registryUrl).pipe(Effect.onInterrupt(() => Cache.invalidate(cache, registryUrl))),
+        save: (registryUrl, handle, credentials) => store
+            .save(registryUrl, handle, credentials)
+            .pipe(Effect.andThen(Cache.invalidate(cache, registryUrl))),
+        clear: (registryUrl) => store.clear(registryUrl).pipe(Effect.andThen(Cache.invalidate(cache, registryUrl))),
     };
 }));
 // -----------------------------------------------------------------------------

package/dist/src/device-login.d.ts

@@ -53,11 +53,15 @@ export declare const DeviceLoginPendingResultSchema: Schema.Struct<{
     readonly interval: Schema.Number;
     readonly resume: Schema.String;
     readonly action: Schema.Struct<{
-        readonly kind: Schema.Literal<"open-url">;
-        readonly url: Schema.String;
+        readonly purpose: Schema.Literal<"login">;
         readonly fallbackUrl: Schema.String;
         readonly code: Schema.String;
+        readonly kind: Schema.Literal<"open-url">;
+        readonly requestRef: Schema.String;
+        readonly registryUrl: Schema.String;
+        readonly url: Schema.String;
         readonly expiresAt: Schema.String;
+        readonly intervalSeconds: Schema.Number;
         readonly resume: Schema.String;
     }>;
 }>;
@@ -77,11 +81,15 @@ export declare const DeviceLoginPendingDocumentSchema: Schema.Struct<{
         readonly interval: Schema.Number;
         readonly resume: Schema.String;
         readonly action: Schema.Struct<{
-            readonly kind: Schema.Literal<"open-url">;
-            readonly url: Schema.String;
+            readonly purpose: Schema.Literal<"login">;
             readonly fallbackUrl: Schema.String;
             readonly code: Schema.String;
+            readonly kind: Schema.Literal<"open-url">;
+            readonly requestRef: Schema.String;
+            readonly registryUrl: Schema.String;
+            readonly url: Schema.String;
             readonly expiresAt: Schema.String;
+            readonly intervalSeconds: Schema.Number;
             readonly resume: Schema.String;
         }>;
     }>;
@@ -100,15 +108,19 @@ export declare const initiateDeviceLogin: (registryUrl: string, options?: RunDev
     readonly interval: number;
     readonly resume: string;
     readonly action: {
-        readonly kind: "open-url";
-        readonly url: string;
+        readonly purpose: "login";
         readonly fallbackUrl: string;
         readonly code: string;
+        readonly kind: "open-url";
+        readonly requestRef: string;
+        readonly registryUrl: string;
+        readonly url: string;
         readonly expiresAt: string;
+        readonly intervalSeconds: number;
         readonly resume: string;
     };
 }, import("./errors.js").AuthError, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore | DeviceLoginInteraction>;
-export declare const resumeDeviceLogin: (registryUrl: string, options?: ResumeDeviceLoginOptions) => Effect.Effect<undefined, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryClientFailure | import("./errors.js").AuthExchangeFailed, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore>;
-export declare const runDeviceLogin: (registryUrl: string, options?: RunDeviceLoginOptions) => Effect.Effect<void, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | import("./errors.js").DeviceLoginDenied | import("./errors.js").DeviceLoginCodeExpired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryProblem | import("@agentxm/registry-client").RegistryRequestFailed | import("@agentxm/registry-client").RegistryOperationFailed | import("./errors.js").AuthExchangeFailed, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore | DeviceLoginInteraction>;
+export declare const resumeDeviceLogin: (registryUrl: string, options?: ResumeDeviceLoginOptions) => Effect.Effect<undefined, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryClientFailure | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending | import("./errors.js").StepUpVerificationPending | import("./errors.js").AuthInteractionAbandoned, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore>;
+export declare const runDeviceLogin: (registryUrl: string, options?: RunDeviceLoginOptions) => Effect.Effect<void, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | import("./errors.js").DeviceLoginDenied | import("./errors.js").DeviceLoginCodeExpired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryProblem | import("@agentxm/registry-client").RegistryRequestFailed | import("@agentxm/registry-client").RegistryOperationFailed | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending | import("./errors.js").StepUpVerificationPending | import("./errors.js").AuthInteractionAbandoned, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore | DeviceLoginInteraction>;
 export {};
 //# sourceMappingURL=device-login.d.ts.map

package/dist/src/device-login.js

@@ -1,3 +1,4 @@
+import { HumanHandoffActionSchema } from "@agentxm/registry-protocol/unstable/human-handoff";
 /**
  * Shared device-code login flow for auth commands and guards.
  *
@@ -58,12 +59,10 @@ const persistLoginCredentials = (registryUrl, token) => Effect.gen(function* ()
     return Option.map(meResult, (me) => me.userHandle);
 });
 const DeviceLoginActionSchema = Schema.Struct({
-    kind: Schema.Literal("open-url"),
-    url: Schema.String,
+    ...HumanHandoffActionSchema.fields,
+    purpose: Schema.Literal("login"),
     fallbackUrl: Schema.String,
     code: Schema.String,
-    expiresAt: Schema.String,
-    resume: Schema.String,
 });
 export const DeviceLoginPendingResultSchema = Schema.Struct({
     status: Schema.Literal("pending-human"),
@@ -119,6 +118,10 @@ const makePendingResult = (pending, flow = "started") => {
         resume,
         action: {
             kind: "open-url",
+            purpose: "login",
+            requestRef: pending.verificationUriComplete,
+            registryUrl: pending.registryUrl,
+            intervalSeconds: pending.interval,
             url: pending.verificationUriComplete,
             fallbackUrl: pending.verificationUri,
             code: pending.userCode,
@@ -258,6 +261,8 @@ export const resumeDeviceLogin = (registryUrl, options = {}) => Effect.gen(funct
                 const action = makePendingResult(pending).action;
                 return Effect.fail(new DeviceAuthorizationPending({
                     timeoutSeconds,
+                    registryUrl: pending.registryUrl,
+                    intervalSeconds: pending.interval,
                     verificationUri: action.fallbackUrl,
                     verificationUriComplete: action.url,
                     userCode: action.code,

package/dist/src/errors.d.ts

@@ -1,17 +1,8 @@
-/**
- * Typed failures for the registry-auth feature. The producer owns the
- * category choice and user-facing wording; the application boundary converts
- * the carried fields into its error envelope verbatim. Failures that carry a
- * registry transport failure keep it intact so the boundary can restore the
- * exact evidence, metadata, and semantics the former in-place conversion
- * produced.
- *
- * @experimental This API is unstable and may change without notice.
- */
+import type { HumanHandoffAction } from "@agentxm/registry-protocol/unstable/human-handoff";
 import { type RegistryClientFailure } from "@agentxm/registry-client";
 import type { SuggestedAction } from "@agentxm/registry-protocol/unstable/suggested-action";
 /** Every category a registry-auth failure can carry. Identical strings to the CLI error codes. */
-export declare const REGISTRY_AUTH_ERROR_CATEGORIES: readonly ["auth", "auth_denied", "auth_expired", "conflict", "internal", "not_found", "validation"];
+export declare const REGISTRY_AUTH_ERROR_CATEGORIES: readonly ["auth", "auth_denied", "auth_expired", "conflict", "internal", "not_found", "timeout", "usage", "validation"];
 export type RegistryAuthErrorCategory = (typeof REGISTRY_AUTH_ERROR_CATEGORIES)[number];
 declare const RegistryAuthFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "RegistryAuthFailed";
@@ -80,6 +71,8 @@ declare const DeviceAuthorizationPending_base: new <A extends Record<string, any
  */
 export declare class DeviceAuthorizationPending extends DeviceAuthorizationPending_base<{
     readonly timeoutSeconds: number;
+    readonly registryUrl: string;
+    readonly intervalSeconds: number;
     readonly verificationUri: string;
     readonly verificationUriComplete: string;
     readonly userCode: string;
@@ -128,8 +121,40 @@ export declare class AuthExchangeFailed extends AuthExchangeFailed_base<{
     readonly failure: RegistryClientFailure;
 }> {
 }
+declare const PublishAuthorizationPending_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PublishAuthorizationPending";
+} & Readonly<A>;
+export declare class PublishAuthorizationPending extends PublishAuthorizationPending_base<{
+    readonly action: HumanHandoffAction;
+    readonly timedOut: boolean;
+}> {
+}
+declare const StepUpVerificationPending_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "StepUpVerificationPending";
+} & Readonly<A>;
+/**
+ * A challenged Registry write is waiting on human verification. No challenged
+ * write has completed: the operation is retried exactly once, after the
+ * verification the carried handoff describes.
+ */
+export declare class StepUpVerificationPending extends StepUpVerificationPending_base<{
+    readonly action: HumanHandoffAction;
+    readonly timedOut: boolean;
+}> {
+}
+declare const AuthInteractionAbandoned_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthInteractionAbandoned";
+} & Readonly<A>;
+/**
+ * A person abandoned an auth interaction the capability asked the application
+ * to run (declining is not abandoning: it returns a decision).
+ */
+export declare class AuthInteractionAbandoned extends AuthInteractionAbandoned_base<{
+    readonly message: string;
+}> {
+}
 /** Every typed failure the registry-auth feature constructs. */
-export type RegistryAuthFailure = RegistryAuthFailed | AuthLoginRequired | AuthTokenPolicyRequired | DeviceLoginDenied | DeviceLoginCodeExpired | DeviceAuthorizationPending | StepUpRequired | AuthExchangeFailed;
+export type RegistryAuthFailure = RegistryAuthFailed | AuthLoginRequired | AuthTokenPolicyRequired | DeviceLoginDenied | DeviceLoginCodeExpired | DeviceAuthorizationPending | PublishAuthorizationPending | StepUpVerificationPending | AuthInteractionAbandoned | StepUpRequired | AuthExchangeFailed;
 export declare const isRegistryAuthFailure: (error: unknown) => error is RegistryAuthFailure;
 /**
  * Every failure a registry-auth use case can surface: the feature's own typed

package/dist/src/errors.js

@@ -18,6 +18,8 @@ export const REGISTRY_AUTH_ERROR_CATEGORIES = [
     "conflict",
     "internal",
     "not_found",
+    "timeout",
+    "usage",
     "validation",
 ];
 /**
@@ -72,12 +74,30 @@ export class StepUpRequired extends Data.TaggedError("StepUpRequired") {
  */
 export class AuthExchangeFailed extends Data.TaggedError("AuthExchangeFailed") {
 }
+export class PublishAuthorizationPending extends Data.TaggedError("PublishAuthorizationPending") {
+}
+/**
+ * A challenged Registry write is waiting on human verification. No challenged
+ * write has completed: the operation is retried exactly once, after the
+ * verification the carried handoff describes.
+ */
+export class StepUpVerificationPending extends Data.TaggedError("StepUpVerificationPending") {
+}
+/**
+ * A person abandoned an auth interaction the capability asked the application
+ * to run (declining is not abandoning: it returns a decision).
+ */
+export class AuthInteractionAbandoned extends Data.TaggedError("AuthInteractionAbandoned") {
+}
 export const isRegistryAuthFailure = (error) => error instanceof RegistryAuthFailed ||
     error instanceof AuthLoginRequired ||
     error instanceof AuthTokenPolicyRequired ||
     error instanceof DeviceLoginDenied ||
     error instanceof DeviceLoginCodeExpired ||
     error instanceof DeviceAuthorizationPending ||
+    error instanceof PublishAuthorizationPending ||
+    error instanceof StepUpVerificationPending ||
+    error instanceof AuthInteractionAbandoned ||
     error instanceof StepUpRequired ||
     error instanceof AuthExchangeFailed;
 export const isAuthError = (error) => isRegistryAuthFailure(error) || isRegistryClientFailure(error);