@agentxm/registry-auth 0.28.11 → 0.28.13

package/dist/src/login.js

@@ -0,0 +1,155 @@
+/**
+ * Sign-in orchestration: flag coherence, persisted-credential policy, the
+ * existing-session decision, strategy selection, and the loopback →
+ * device-code fallback chain.
+ *
+ * The capability decides; the application supplies presentation through
+ * `AuthLoginPresenter` and platform integration through
+ * `AuthLoginInteraction`. No sign-in decision is taken outside this module.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore, makePersistedCredentialsUnsupportedError } from "./credential-store.js";
+import { initiateDeviceLogin, resumeDeviceLogin, runDeviceLogin, } from "./device-login.js";
+import { RegistryAuthFailed } from "./errors.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { runLoopbackLogin } from "./loopback-login.js";
+import { selectLoginStrategy } from "./login-strategy.js";
+import { loginStrategyEnvironment } from "./internal/environment.js";
+const usage = (detail) => new RegistryAuthFailed({ category: "usage", detail });
+/**
+ * The device-login options one sign-in request means. Exported so the option
+ * shaping is provable without substituting the flow it is handed to.
+ */
+export const deviceLoginOptions = (request, openBrowser) => ({
+    openBrowser,
+    restart: request.restart,
+    ...(request.scopes.length === 0 ? {} : { scopes: [...request.scopes] }),
+});
+/** The resume options one `--wait` request means. */
+export const resumeLoginOptions = (request) => request.timeoutSeconds === undefined ? {} : { timeoutSeconds: request.timeoutSeconds };
+/**
+ * How a loopback sign-in that could not complete is classified.
+ *
+ * A failed bind is recoverable — device-code sign-in replaces it — while an
+ * expired wait or a rejected callback is terminal and leaves credentials
+ * untouched.
+ */
+export const classifyLoopbackFailure = (error) => error._tag === "LoopbackLoginFallback"
+    ? new RegistryAuthFailed({
+        category: "auth",
+        detail: "Browser sign-in expired after 5 minutes. No credentials were changed.",
+        suggestions: [
+            { description: "Try browser sign-in again.", cmd: "axm login" },
+            {
+                description: "Use device-code sign-in on a remote or headless machine.",
+                cmd: "axm login --device-code",
+            },
+        ],
+        cause: error,
+    })
+    : new RegistryAuthFailed({
+        category: "auth",
+        detail: error.reason === "access_denied"
+            ? "Sign-in was cancelled. No credentials were changed."
+            : "The authorization callback was invalid and sign-in could not be completed. Run `axm login` to try again.",
+        suggestions: [{ description: "Try signing in again.", cmd: "axm login" }],
+        cause: error,
+    });
+const rejectIncoherentFlags = (request) => request.wait && request.deviceCode
+    ? Option.some(usage("--wait resumes an existing device sign-in and cannot be combined with --device-code."))
+    : request.wait && request.restart
+        ? Option.some(usage("--restart starts a replacement device sign-in and cannot be combined with --wait."))
+        : request.restart && !request.deviceCode
+            ? Option.some(usage("--restart requires --device-code."))
+            : !request.wait && request.timeoutSeconds !== undefined
+                ? Option.some(usage("--timeout requires --wait."))
+                : Option.none();
+/**
+ * Decide whether a session that is still valid should be replaced.
+ *
+ * Preapproval answers the one question a valid session raises, so a new
+ * sign-in starts in every mode. Without it, a mode that cannot ask keeps the
+ * session; a mode that can, asks.
+ */
+const shouldReplaceValidSession = (request, handle) => Effect.gen(function* () {
+    const presenter = yield* AuthLoginPresenter;
+    if (request.yes) {
+        if (!request.machineOutput)
+            yield* presenter.noteExistingSession(handle);
+        return true;
+    }
+    if (request.nonInteractive || request.machineOutput)
+        return false;
+    yield* presenter.noteExistingSession(handle);
+    const decision = yield* presenter.confirmSessionReplacement("Log in with a different account?");
+    return decision === "replace";
+});
+export const login = Effect.fn("Login.run")(function* (request, registryUrl) {
+    const credentials = yield* CredentialStore;
+    const presenter = yield* AuthLoginPresenter;
+    const registryHost = new URL(registryUrl).host;
+    const incoherent = rejectIncoherentFlags(request);
+    if (Option.isSome(incoherent))
+        return yield* Effect.fail(incoherent.value);
+    if (!credentials.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    if (request.wait) {
+        yield* resumeDeviceLogin(registryUrl, resumeLoginOptions(request));
+        return { _tag: "PendingSignInResumed" };
+    }
+    const existing = yield* credentials.load(registryUrl);
+    if (Option.isSome(existing)) {
+        const authClient = yield* AuthClient;
+        const identity = yield* presenter.withProgress({ _tag: "CheckingRegistrySession", registryHost }, () => authClient.getMe(existing.value.access_token).pipe(Effect.option));
+        if (Option.isSome(identity)) {
+            if (!(yield* shouldReplaceValidSession(request, identity.value.userHandle))) {
+                return {
+                    _tag: "SessionRetained",
+                    registryHost,
+                    handle: identity.value.userHandle,
+                };
+            }
+        }
+        else if (!request.machineOutput) {
+            yield* presenter.noteRejectedStoredCredentials;
+        }
+    }
+    const strategy = selectLoginStrategy({ deviceCode: request.deviceCode, nonInteractive: request.nonInteractive }, yield* loginStrategyEnvironment);
+    const scopeOptions = request.scopes.length === 0 ? {} : { scopes: [...request.scopes] };
+    const deviceOptions = (openBrowser) => deviceLoginOptions(request, openBrowser);
+    if (strategy === "device-code") {
+        if (!request.deviceCode)
+            yield* presenter.noteDeviceCodeFallback("remote-or-headless");
+        if (request.nonInteractive) {
+            yield* initiateDeviceLogin(registryUrl, deviceOptions(false));
+        }
+        else {
+            yield* runDeviceLogin(registryUrl, deviceOptions(false));
+        }
+        return { _tag: "SignInAttempted" };
+    }
+    if (request.nonInteractive) {
+        return yield* new RegistryAuthFailed({
+            category: "auth",
+            detail: "Loopback browser sign-in requires an interactive terminal. Use device-code sign-in instead.",
+            suggestions: [
+                {
+                    description: "Use device-code sign-in on a remote or headless machine.",
+                    cmd: "axm login --device-code",
+                },
+            ],
+        });
+    }
+    yield* Effect.suspend(() => runLoopbackLogin(registryUrl, { ...scopeOptions })).pipe(Effect.catchTag("LoopbackLoginFallback", (error) => error.reason === "bind_failed"
+        ? presenter
+            .noteDeviceCodeFallback("loopback-bind-failed")
+            .pipe(Effect.andThen(runDeviceLogin(registryUrl, deviceOptions(true))))
+        : Effect.fail(classifyLoopbackFailure(error))), Effect.catchTag("LoopbackCallbackRejected", (error) => Effect.fail(classifyLoopbackFailure(error))));
+    return { _tag: "SignInAttempted" };
+});
+//# sourceMappingURL=login.js.map

package/dist/src/logout.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Sign-out: revoke the session at the Registry, then erase the selected
+ * Registry's stored credentials.
+ *
+ * The local erase is unconditional. A remote revoke that fails leaves a token
+ * that expires on its own, and the outcome says so rather than reporting a
+ * clean sign-out.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** What one `logout` invocation settled on. */
+export type LogoutOutcome = {
+    readonly _tag: "NotSignedIn";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "SignedOut";
+    readonly registryHost: string;
+    readonly handle?: string;
+    /** False when the Registry did not confirm the revoke; the token expires on its own. */
+    readonly revokedRemotely: boolean;
+};
+export declare const logout: (registryUrl: string) => Effect.Effect<{
+    readonly _tag: "NotSignedIn";
+    readonly registryHost: string;
+} | {
+    readonly revokedRemotely: boolean;
+    readonly handle?: string & import("effect/Brand").Brand<"Handle">;
+    readonly _tag: "SignedOut";
+    readonly registryHost: string;
+}, import("./errors.ts").RegistryAuthFailed, AuthClient | CredentialStore | AuthLoginPresenter>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/src/logout.js

@@ -0,0 +1,37 @@
+/**
+ * Sign-out: revoke the session at the Registry, then erase the selected
+ * Registry's stored credentials.
+ *
+ * The local erase is unconditional. A remote revoke that fails leaves a token
+ * that expires on its own, and the outcome says so rather than reporting a
+ * clean sign-out.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** `normalizeHandle("@unknown")` — the anonymous credential sentinel. */
+const ANONYMOUS_HANDLE = "@unknown";
+export const logout = Effect.fn("Logout.run")(function* (registryUrl) {
+    const authClient = yield* AuthClient;
+    const credentials = yield* CredentialStore;
+    const presenter = yield* AuthLoginPresenter;
+    const registryHost = new URL(registryUrl).host;
+    const existing = yield* credentials.load(registryUrl);
+    if (Option.isNone(existing)) {
+        return { _tag: "NotSignedIn", registryHost };
+    }
+    const revoked = yield* presenter.withProgress({ _tag: "RevokingRegistrySession", registryHost }, () => authClient.revokeToken(existing.value.refresh_token).pipe(Effect.option));
+    yield* credentials.clear(registryUrl);
+    const handle = existing.value.handle;
+    return {
+        _tag: "SignedOut",
+        registryHost,
+        ...(handle === ANONYMOUS_HANDLE ? {} : { handle }),
+        revokedRemotely: Option.isSome(revoked),
+    };
+});
+//# sourceMappingURL=logout.js.map

package/dist/src/loopback-login.js

@@ -52,7 +52,7 @@ export const runLoopbackLogin = (registryUrl, options = {}) => Effect.scoped(Eff
     const verifier = makePkceVerifier();
     const challenge = makePkceChallenge(verifier);
     const state = makeOAuthState();
-    const server = yield* startLoopbackServer(state);
+    const server = yield* startLoopbackServer(state, "login");
     const authorizeUrl = authClient.buildAuthorizeUrl({
         challenge,
         expiresAt: DateTime.addDuration(yield* DateTime.now, LOOPBACK_TIMEOUT),
@@ -86,6 +86,7 @@ export const runLoopbackLogin = (registryUrl, options = {}) => Effect.scoped(Eff
         });
         return yield* persistLoginCredentials(registryUrl, token);
     }));
+    yield* server.complete;
     yield* emitLoginSuccess(registryUrl, handle);
 }));
 //# sourceMappingURL=loopback-login.js.map

package/dist/src/loopback-server.d.ts

@@ -29,11 +29,13 @@ export declare class LoopbackCallbackRejected extends LoopbackCallbackRejected_b
 export interface LoopbackServer {
     readonly port: number;
     readonly redirectUri: string;
+    readonly complete: Effect.Effect<void>;
     readonly awaitCallback: (timeoutMs: number) => Effect.Effect<LoopbackCallback, LoopbackLoginFallback | LoopbackCallbackRejected>;
 }
-export declare const startLoopbackServer: (expectedState: string) => Effect.Effect<{
+export declare const startLoopbackServer: (expectedState: string, purpose: "login" | "publish") => Effect.Effect<{
     port: number;
     redirectUri: string;
+    complete: Effect.Effect<void, never, never>;
     awaitCallback: (timeoutMs: number) => Effect.Effect<LoopbackCallback, LoopbackLoginFallback | LoopbackCallbackRejected, never>;
 }, LoopbackLoginFallback, import("effect/Scope").Scope>;
 export {};

package/dist/src/loopback-server.js

@@ -7,14 +7,14 @@ import * as Data from "effect/Data";
 import * as Deferred from "effect/Deferred";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
 export class LoopbackLoginFallback extends Data.TaggedError("LoopbackLoginFallback") {
 }
 export class LoopbackCallbackRejected extends Data.TaggedError("LoopbackCallbackRejected") {
 }
 const page = (title, content) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><main style="font-family: system-ui, sans-serif; margin: 3rem auto; max-width: 34rem;"><h1>${title}</h1><p>${content}</p></main></body></html>`;
-const successPage = page("You’re signed in to AgentXM.ai", 'Return to your terminal to continue. You can close this tab. <a href="https://agentxm.ai">AgentXM.ai</a>');
-const cancellationPage = page("Sign-in was cancelled", "No credentials were changed. Return to your terminal to try again.");
-const errorPage = page("AXM sign-in could not be completed", "Return to your terminal for details and recovery instructions.");
+const cancellationPage = page("Authorization was denied", "Return to your terminal for recovery instructions.");
+const errorPage = page("AXM authorization could not be completed", "Return to your terminal for details and recovery instructions.");
 const writeHtml = (response, statusCode, body) => {
     response.writeHead(statusCode, {
         "content-type": "text/html; charset=utf-8",
@@ -79,7 +79,7 @@ const makeCallbackOutcome = (request, expectedState) => {
         callback: { code, state, iss },
     };
 };
-export const startLoopbackServer = (expectedState) => Effect.gen(function* () {
+export const startLoopbackServer = (expectedState, purpose) => Effect.gen(function* () {
     const http = yield* Effect.tryPromise({
         try: () => import("node:http"),
         catch: (cause) => new LoopbackLoginFallback({
@@ -89,16 +89,58 @@ export const startLoopbackServer = (expectedState) => Effect.gen(function* () {
         }),
     });
     const callback = yield* Deferred.make();
+    const browserResponse = yield* Deferred.make();
+    const finish = (completed) => Effect.gen(function* () {
+        const pending = yield* Deferred.poll(browserResponse);
+        if (Option.isNone(pending))
+            return;
+        const response = yield* pending.value;
+        if (response.writableEnded || response.destroyed)
+            return;
+        const title = completed
+            ? purpose === "login"
+                ? "You’re signed in to AgentXM.ai"
+                : "Publish authorization received"
+            : "AXM authorization could not be completed";
+        const content = completed
+            ? purpose === "login"
+                ? "Your credentials have been saved. Return to your terminal to continue. You can close this tab."
+                : "AXM received permission for the reviewed publication. Return to your terminal to check the publish result. You can close this tab."
+            : "Return to your terminal for details and recovery instructions.";
+        yield* Effect.callback((resume) => {
+            const done = () => resume(Effect.void);
+            response.once("close", done);
+            response.end(`<style>#receipt{display:none}</style><section role="status"><h1>${title}</h1><p>${content}</p></section></main></body></html>`, done);
+            return Effect.sync(() => {
+                response.off("close", done);
+            });
+        });
+    });
     const listener = yield* Effect.acquireRelease(Effect.callback((resume) => {
         let acquired = false;
         const server = http.createServer((request, response) => {
+            if (Deferred.isDoneUnsafe(callback)) {
+                writeHtml(response, 409, page("Callback already received", "Return to the original tab or your terminal to check the result."));
+                return;
+            }
             const outcome = makeCallbackOutcome(request, expectedState);
-            writeHtml(response, outcome._tag === "success" ? 200 : 400, outcome._tag === "success"
-                ? successPage
-                : outcome.error._tag === "LoopbackCallbackRejected" &&
+            if (outcome._tag === "success") {
+                response.writeHead(200, {
+                    "content-type": "text/html; charset=utf-8",
+                    "cache-control": "no-store",
+                    "referrer-policy": "no-referrer",
+                    "x-content-type-options": "nosniff",
+                    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'",
+                });
+                response.write('<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>AXM authorization</title></head><body><main style="font-family:system-ui,sans-serif;margin:3rem auto;max-width:34rem;padding:1rem"><section id="receipt" role="status"><h1>Callback received</h1><p>AXM is finishing authorization. Check your terminal if this page stops updating.</p></section>');
+                Deferred.doneUnsafe(browserResponse, Effect.succeed(response));
+            }
+            else {
+                writeHtml(response, 400, outcome.error._tag === "LoopbackCallbackRejected" &&
                     outcome.error.reason === "access_denied"
                     ? cancellationPage
                     : errorPage);
+            }
             Deferred.doneUnsafe(callback, outcome._tag === "success"
                 ? Effect.succeed(outcome.callback)
                 : Effect.fail(outcome.error));
@@ -146,6 +188,7 @@ export const startLoopbackServer = (expectedState) => Effect.gen(function* () {
         },
         catch: () => undefined,
     }).pipe(Effect.ignore));
+    yield* Effect.addFinalizer(() => finish(false));
     listener.server.on("error", (cause) => {
         Deferred.doneUnsafe(callback, Effect.fail(new LoopbackLoginFallback({
             reason: "bind_failed",
@@ -156,6 +199,7 @@ export const startLoopbackServer = (expectedState) => Effect.gen(function* () {
     return {
         port: listener.port,
         redirectUri: `http://127.0.0.1:${listener.port}/callback`,
+        complete: finish(true),
         awaitCallback: (timeoutMs) => Deferred.await(callback).pipe(Effect.timeoutOrElse({
             duration: Duration.millis(timeoutMs),
             orElse: () => Effect.fail(new LoopbackLoginFallback({

package/dist/src/pending-publish-authorization-store.d.ts

@@ -0,0 +1,33 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+import { RegistryAuthFailed } from "./errors.js";
+export declare const PendingPublishAuthorizationSchema: Schema.Struct<{
+    readonly version: Schema.Literal<1>;
+    readonly purpose: Schema.Literal<"publish">;
+    readonly registryUrl: Schema.String;
+    readonly requestRef: Schema.String;
+    readonly requestId: Schema.String;
+    readonly authorizationUrl: Schema.String;
+    readonly expiresAt: Schema.decodeTo<Schema.DateTimeUtc, Schema.String, never, never>;
+    readonly interval: Schema.Int;
+    readonly publicationSetDigest: Schema.String;
+    readonly initiatorProof: Schema.String;
+}>;
+export type PendingPublishAuthorization = typeof PendingPublishAuthorizationSchema.Type;
+export interface PendingPublishAuthorizationStoreService {
+    readonly save: (pending: PendingPublishAuthorization) => Effect.Effect<void, RegistryAuthFailed>;
+    readonly load: (requestRef: string) => Effect.Effect<Option.Option<PendingPublishAuthorization>, RegistryAuthFailed>;
+    readonly clear: (requestRef: string) => Effect.Effect<void, RegistryAuthFailed>;
+}
+declare const PendingPublishAuthorizationStore_base: Context.ServiceClass<PendingPublishAuthorizationStore, "@agentxm/registry-auth/PendingPublishAuthorizationStore", PendingPublishAuthorizationStoreService>;
+export declare class PendingPublishAuthorizationStore extends PendingPublishAuthorizationStore_base {
+}
+export declare const PendingPublishAuthorizationStoreLive: Layer.Layer<PendingPublishAuthorizationStore, never, FileSystem.FileSystem | Path.Path>;
+export declare const PendingPublishAuthorizationStoreTest: (initial?: ReadonlyArray<PendingPublishAuthorization>) => Layer.Layer<PendingPublishAuthorizationStore, never, never>;
+export {};
+//# sourceMappingURL=pending-publish-authorization-store.d.ts.map

package/dist/src/pending-publish-authorization-store.js

@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+import { DateTimeUtcSchema } from "@agentxm/extension-model/unstable/date-time";
+import { RegistryAuthFailed } from "./errors.js";
+import { envOption } from "./internal/environment.js";
+export const PendingPublishAuthorizationSchema = Schema.Struct({
+    version: Schema.Literal(1),
+    purpose: Schema.Literal("publish"),
+    registryUrl: Schema.String,
+    requestRef: Schema.String,
+    requestId: Schema.String,
+    authorizationUrl: Schema.String,
+    expiresAt: DateTimeUtcSchema,
+    interval: Schema.Int.check(Schema.isGreaterThan(0)),
+    publicationSetDigest: Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/)),
+    initiatorProof: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43,128}$/)),
+});
+export class PendingPublishAuthorizationStore extends Context.Service()("@agentxm/registry-auth/PendingPublishAuthorizationStore") {
+}
+const storageError = (operation) => new RegistryAuthFailed({
+    category: "auth",
+    detail: `Could not ${operation} the private publish authorization record. Its public request URL cannot replace the missing proof.`,
+});
+export const PendingPublishAuthorizationStoreLive = Layer.effect(PendingPublishAuthorizationStore, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const homes = [
+        yield* envOption("AXM_USER_HOME"),
+        yield* envOption("HOME"),
+        yield* envOption("USERPROFILE"),
+    ];
+    const home = homes.find(Option.isSome);
+    const storageDirectory = home === undefined
+        ? Effect.fail(storageError("locate"))
+        : Effect.succeed(path.join(home.value, ".axm", "publish-authorizations"));
+    const filename = (directory, reference) => path.join(directory, `${createHash("sha256").update(reference).digest("hex")}.json`);
+    return {
+        save: (pending) => Effect.gen(function* () {
+            const directory = yield* storageDirectory;
+            yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
+            yield* fs.chmod(directory, 0o700);
+            const file = filename(directory, pending.requestRef);
+            const encoded = yield* Schema.encodeEffect(PendingPublishAuthorizationSchema)(pending);
+            yield* Effect.acquireUseRelease(fs.makeTempDirectory({ directory, prefix: "publish-" }), (temporaryDirectory) => Effect.gen(function* () {
+                const temporary = path.join(temporaryDirectory, "proof.json");
+                yield* fs.writeFileString(temporary, JSON.stringify(encoded), {
+                    mode: 0o600,
+                    flag: "wx",
+                });
+                yield* fs.link(temporary, file);
+            }), (temporaryDirectory) => fs
+                .remove(temporaryDirectory, { recursive: true, force: true })
+                .pipe(Effect.catch(() => Effect.void)));
+        }).pipe(Effect.mapError(() => storageError("save"))),
+        load: (reference) => Effect.gen(function* () {
+            const directory = yield* storageDirectory;
+            const file = filename(directory, reference);
+            if (!(yield* fs.exists(file)))
+                return Option.none();
+            const content = yield* fs.readFileString(file);
+            const pending = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(PendingPublishAuthorizationSchema))(content);
+            if (pending.requestRef !== reference)
+                return yield* storageError("validate");
+            return Option.some(pending);
+        }).pipe(Effect.mapError(() => storageError("read"))),
+        clear: (reference) => Effect.gen(function* () {
+            const directory = yield* storageDirectory;
+            yield* fs.remove(filename(directory, reference), { force: true });
+        }).pipe(Effect.mapError(() => storageError("remove"))),
+    };
+}));
+export const PendingPublishAuthorizationStoreTest = (initial = []) => {
+    const records = new Map(initial.map((record) => [record.requestRef, record]));
+    return Layer.succeed(PendingPublishAuthorizationStore, {
+        save: (pending) => Effect.sync(() => {
+            records.set(pending.requestRef, pending);
+        }),
+        load: (reference) => Effect.sync(() => Option.fromNullishOr(records.get(reference))),
+        clear: (reference) => Effect.sync(() => {
+            records.delete(reference);
+        }),
+    });
+};
+//# sourceMappingURL=pending-publish-authorization-store.js.map

package/dist/src/publish-authorization-polling.d.ts

@@ -0,0 +1,13 @@
+import { DeviceLoginInteraction } from "./device-login.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import * as Effect from "effect/Effect";
+import { AuthClient, type PublishAuthorizationExchangeResponse } from "./auth-client.js";
+import { RegistryAuthFailed } from "./errors.js";
+import { PendingPublishAuthorizationStore } from "./pending-publish-authorization-store.js";
+import type { PublishAuthorizationInput } from "./publish-authorization.js";
+export declare const readPublishAuthorizationReference: (reference: string, registryUrl: string) => Effect.Effect<{
+    requestId: string;
+    requestRef: string;
+}, RegistryAuthFailed, never>;
+export declare const runPollingPublishAuthorization: (input: PublishAuthorizationInput) => Effect.Effect<PublishAuthorizationExchangeResponse, import("./errors.js").AuthError, AuthClient | AuthLoginPresenter | DeviceLoginInteraction | PendingPublishAuthorizationStore>;
+//# sourceMappingURL=publish-authorization-polling.d.ts.map