@agentxm/registry-auth 0.28.11 → 0.28.13

package/dist/src/publish-authorization-polling.js

@@ -0,0 +1,176 @@
+import { DeviceLoginInteraction } from "./device-login.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { publicationSetDigest } from "@agentxm/registry-protocol/unstable/registry/publication-set";
+import { AuthClient } from "./auth-client.js";
+import { PublishAuthorizationPending, RegistryAuthFailed } from "./errors.js";
+import { makePkceChallenge, makePkceVerifier } from "./loopback-login.js";
+import { PendingPublishAuthorizationStore, } from "./pending-publish-authorization-store.js";
+const invalidResume = (detail) => new RegistryAuthFailed({
+    category: "validation",
+    detail,
+    recover: "Resume with the original publication inputs and requestRef. To request new consent, rerun publish without --authorization-request.",
+});
+export const readPublishAuthorizationReference = (reference, registryUrl) => Effect.try({
+    try: () => {
+        const url = new URL(reference);
+        const registry = new URL(registryUrl);
+        const match = /^\/v1\/auth\/publish-requests\/(pubreq_[a-z0-9]{26})$/.exec(url.pathname);
+        if (url.origin !== registry.origin ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            match?.[1] === undefined)
+            throw new Error("Invalid reference");
+        return { requestId: match[1], requestRef: url.href };
+    },
+    catch: () => invalidResume("The authorization request URL must identify a publish request on the selected Registry."),
+});
+const pendingHuman = (pending, timedOut = false) => new PublishAuthorizationPending({
+    timedOut,
+    action: {
+        kind: "open-url",
+        purpose: "publish",
+        registryUrl: pending.registryUrl,
+        requestRef: pending.requestRef,
+        url: pending.authorizationUrl,
+        expiresAt: DateTime.formatIso(pending.expiresAt),
+        intervalSeconds: pending.interval,
+        resume: `Rerun the same publish command with unchanged inputs and --authorization-request ${pending.requestRef}. Add --wait-for-human SECONDS for a bounded wait.`,
+    },
+});
+export const runPollingPublishAuthorization = Effect.fn("Auth.runPollingPublishAuthorization")(function* (input) {
+    const auth = yield* AuthClient;
+    const store = yield* PendingPublishAuthorizationStore;
+    const expectedDigest = publicationSetDigest(input.publicationSet.candidates);
+    const pending = yield* Effect.gen(function* () {
+        if (input.authorizationRequest !== undefined) {
+            const reference = yield* readPublishAuthorizationReference(input.authorizationRequest, input.registryUrl);
+            const saved = yield* store.load(reference.requestRef);
+            if (Option.isNone(saved))
+                return yield* invalidResume("The private proof for this publish request is unavailable on this machine. A public URL alone cannot resume it.");
+            if (saved.value.registryUrl !== input.registryUrl ||
+                saved.value.requestId !== reference.requestId ||
+                saved.value.publicationSetDigest !== expectedDigest)
+                return yield* invalidResume("The publication set, archive bytes, visibility inputs or Registry changed. This request cannot authorize the changed material; review a new request.");
+            return saved.value;
+        }
+        const initiatorProof = makePkceVerifier();
+        const request = yield* auth.createPublishAuthorizationRequest({
+            registryUrl: input.registryUrl,
+            publicationSet: input.publicationSet,
+            delivery: {
+                kind: "polling",
+                proof_challenge: makePkceChallenge(initiatorProof),
+                proof_challenge_method: "S256",
+            },
+        });
+        const reference = yield* readPublishAuthorizationReference(`${input.registryUrl.replace(/\/+$/, "")}/v1/auth/publish-requests/${request.requestId}`, input.registryUrl);
+        const value = {
+            version: 1,
+            purpose: "publish",
+            registryUrl: input.registryUrl,
+            ...reference,
+            authorizationUrl: request.authorizationUrl,
+            expiresAt: request.expiresAt,
+            interval: request.interval,
+            publicationSetDigest: expectedDigest,
+            initiatorProof,
+        };
+        yield* store.save(value);
+        return value;
+    });
+    const expired = () => new RegistryAuthFailed({
+        category: "auth_expired",
+        detail: "This publish authorization expired. Review a new request; no capability was acquired.",
+        recover: "Rerun publish without --authorization-request to request new consent.",
+    });
+    const now = yield* DateTime.now;
+    const remaining = DateTime.toEpochMillis(pending.expiresAt) - DateTime.toEpochMillis(now);
+    if (remaining <= 0) {
+        yield* store.clear(pending.requestRef);
+        return yield* expired();
+    }
+    if (input.authorizationRequest === undefined &&
+        input.waitForHumanSeconds === undefined &&
+        input.unattended === true)
+        return yield* pendingHuman(pending);
+    if (input.authorizationRequest === undefined && input.unattended !== true) {
+        const interaction = yield* DeviceLoginInteraction;
+        const presenter = yield* AuthLoginPresenter;
+        const browserOpened = yield* interaction.openBrowser(pending.authorizationUrl);
+        yield* presenter.notePublishReview({
+            browserOpened,
+            candidateCount: input.publicationSet.candidates.length,
+            authorizationUrl: pending.authorizationUrl,
+        });
+    }
+    const wait = Effect.gen(function* () {
+        while (true) {
+            const status = yield* auth.pollPublishAuthorization({
+                registryUrl: pending.registryUrl,
+                requestId: pending.requestId,
+                initiatorProof: pending.initiatorProof,
+            });
+            if (status.purpose !== "publish" ||
+                status.publication_set_digest !== expectedDigest ||
+                DateTime.toEpochMillis(status.expires_at) !== DateTime.toEpochMillis(pending.expiresAt))
+                return yield* invalidResume("The Registry returned a different publication binding or deadline. This request cannot be resumed.");
+            if (status.status === "expired") {
+                yield* store.clear(pending.requestRef);
+                return yield* expired();
+            }
+            if (status.status === "denied") {
+                yield* store.clear(pending.requestRef);
+                return yield* new RegistryAuthFailed({
+                    category: "auth_denied",
+                    detail: "Publish authorization was cancelled. No publication was authorized.",
+                    recover: "Request new consent by rerunning publish without --authorization-request.",
+                });
+            }
+            if (status.status === "exchanged") {
+                yield* store.clear(pending.requestRef);
+                return yield* new RegistryAuthFailed({
+                    category: "conflict",
+                    detail: "This publish authorization was already exchanged. Verify the prior publication results before requesting new consent; the capabilities cannot be replayed.",
+                    recover: "Rerun publish with the original inputs to verify existing versions and request consent for any remaining material.",
+                });
+            }
+            if (status.status === "approved")
+                return;
+            if (input.unattended === true && input.waitForHumanSeconds === undefined)
+                return yield* pendingHuman(pending);
+            const current = yield* DateTime.now;
+            const left = DateTime.toEpochMillis(pending.expiresAt) - DateTime.toEpochMillis(current);
+            if (left <= 0)
+                return yield* expired();
+            yield* Effect.sleep(Math.min(status.interval * 1000, left));
+        }
+    });
+    const bound = Math.min(remaining, input.waitForHumanSeconds === undefined ? remaining : input.waitForHumanSeconds * 1000);
+    const result = yield* wait.pipe(Effect.timeoutOption(bound));
+    if (Option.isSome(result)) {
+        // A lost exchange response is not retried: a later resume observes the
+        // retained request and takes explicit publication-outcome recovery.
+        const exchange = yield* auth.exchangePublishAuthorization({
+            registryUrl: pending.registryUrl,
+            requestId: pending.requestId,
+            initiatorProof: pending.initiatorProof,
+        });
+        if (exchange.preview.publicationSetDigest !== expectedDigest ||
+            exchange.grants.some((grant) => grant.publishRequestId !== pending.requestId ||
+                grant.publicationSetDigest !== expectedDigest))
+            return yield* invalidResume("The exchanged capabilities do not match the reviewed publication set.");
+        return exchange;
+    }
+    const afterWait = yield* DateTime.now;
+    if (DateTime.toEpochMillis(pending.expiresAt) <= DateTime.toEpochMillis(afterWait)) {
+        yield* store.clear(pending.requestRef);
+        return yield* expired();
+    }
+    return yield* pendingHuman(pending, true);
+}, Effect.satisfiesSuccessType());
+//# sourceMappingURL=publish-authorization-polling.js.map

package/dist/src/publish-authorization.d.ts

@@ -6,6 +6,9 @@ import { AuthLoginPresenter } from "./login-presenter.js";
 export interface PublishAuthorizationInput {
     readonly registryUrl: string;
     readonly publicationSet: PreviewPublicationSetRequest;
+    readonly unattended?: boolean;
+    readonly authorizationRequest?: string;
+    readonly waitForHumanSeconds?: number;
 }
-export declare const runPublishAuthorization: (input: PublishAuthorizationInput) => Effect.Effect<PublishAuthorizationExchangeResponse, import("./errors.js").AuthError, AuthClient | AuthLoginPresenter | DeviceLoginInteraction>;
+export declare const runPublishAuthorization: (input: PublishAuthorizationInput) => Effect.Effect<PublishAuthorizationExchangeResponse, import("./errors.js").AuthError, AuthClient | AuthLoginPresenter | DeviceLoginInteraction | import("./pending-publish-authorization-store.ts").PendingPublishAuthorizationStore>;
 //# sourceMappingURL=publish-authorization.d.ts.map

package/dist/src/publish-authorization.js

@@ -1,3 +1,4 @@
+import { runPollingPublishAuthorization } from "./publish-authorization-polling.js";
 import * as Effect from "effect/Effect";
 import { RegistryAuthFailed } from "./errors.js";
 import { AuthClient } from "./auth-client.js";
@@ -35,6 +36,16 @@ const loopbackFailureToAuthFailure = (error) => {
     });
 };
 export const runPublishAuthorization = Effect.fn("Auth.runPublishAuthorization")(function* (input) {
+    if (input.waitForHumanSeconds !== undefined &&
+        (!Number.isSafeInteger(input.waitForHumanSeconds) || input.waitForHumanSeconds <= 0))
+        return yield* new RegistryAuthFailed({
+            category: "validation",
+            detail: "--wait-for-human must be a positive whole number of seconds.",
+        });
+    if (input.unattended === true ||
+        input.authorizationRequest !== undefined ||
+        input.waitForHumanSeconds !== undefined)
+        return yield* runPollingPublishAuthorization(input);
     return yield* Effect.scoped(Effect.gen(function* () {
         const authClient = yield* AuthClient;
         const presenter = yield* AuthLoginPresenter;
@@ -42,12 +53,16 @@ export const runPublishAuthorization = Effect.fn("Auth.runPublishAuthorization")
         const verifier = makePkceVerifier();
         const challenge = makePkceChallenge(verifier);
         const state = makeOAuthState();
-        const server = yield* startLoopbackServer(state).pipe(Effect.mapError(loopbackFailureToAuthFailure));
+        const server = yield* startLoopbackServer(state, "publish").pipe(Effect.mapError(loopbackFailureToAuthFailure));
         const request = yield* authClient.createPublishAuthorizationRequest({
             registryUrl: input.registryUrl,
-            redirectUri: server.redirectUri,
-            state,
-            codeChallenge: challenge,
+            delivery: {
+                kind: "loopback",
+                redirect_uri: server.redirectUri,
+                state,
+                code_challenge: challenge,
+                code_challenge_method: "S256",
+            },
             publicationSet: input.publicationSet,
         });
         const openedBrowser = yield* interaction.openBrowser(request.authorizationUrl);
@@ -57,7 +72,9 @@ export const runPublishAuthorization = Effect.fn("Auth.runPublishAuthorization")
             authorizationUrl: request.authorizationUrl,
         });
         const callback = yield* server
-            .awaitCallback(PUBLISH_AUTHORIZATION_TIMEOUT_MS)
+            .awaitCallback(Math.min(PUBLISH_AUTHORIZATION_TIMEOUT_MS, input.waitForHumanSeconds === undefined
+            ? PUBLISH_AUTHORIZATION_TIMEOUT_MS
+            : input.waitForHumanSeconds * 1000))
             .pipe(Effect.mapError(loopbackFailureToAuthFailure));
         const expectedIssuer = new URL(request.authorizationUrl).origin;
         if (callback.iss !== expectedIssuer) {
@@ -73,6 +90,8 @@ export const runPublishAuthorization = Effect.fn("Auth.runPublishAuthorization")
             verifier,
             redirectUri: server.redirectUri,
         });
+        if (capability.status === "admitted")
+            yield* server.complete;
         return capability;
     }));
 }, Effect.satisfiesSuccessType());

package/dist/src/selected-registry.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The Registry this invocation authenticates against.
+ *
+ * Which Registry is selected is transport configuration, so the value itself
+ * belongs to the Registry client. What a caller needs from it is an
+ * authentication concern: the endpoint every use case in this package takes,
+ * and the host a person is told they are signing in to, signing out of, or
+ * identified on. Publishing both here is what lets a caller name the selected
+ * Registry without reaching into the transport package for its configuration
+ * tag.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { RegistryUrl } from "@agentxm/registry-client";
+/** The selected Registry, as an endpoint and as a host a person reads. */
+export interface SelectedRegistry {
+    /** The endpoint every registry-auth use case takes. */
+    readonly url: string;
+    /** The host, for the operation names and result documents that show it. */
+    readonly host: string;
+}
+/** Read the selected Registry's endpoint and its human-readable host. */
+export declare const selectedRegistry: Effect.Effect<SelectedRegistry, never, RegistryUrl>;
+//# sourceMappingURL=selected-registry.d.ts.map

package/dist/src/selected-registry.js

@@ -0,0 +1,18 @@
+/**
+ * The Registry this invocation authenticates against.
+ *
+ * Which Registry is selected is transport configuration, so the value itself
+ * belongs to the Registry client. What a caller needs from it is an
+ * authentication concern: the endpoint every use case in this package takes,
+ * and the host a person is told they are signing in to, signing out of, or
+ * identified on. Publishing both here is what lets a caller name the selected
+ * Registry without reaching into the transport package for its configuration
+ * tag.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { RegistryUrl } from "@agentxm/registry-client";
+/** Read the selected Registry's endpoint and its human-readable host. */
+export const selectedRegistry = Effect.map(RegistryUrl, (url) => ({ url, host: new URL(url).host }));
+//# sourceMappingURL=selected-registry.js.map

package/dist/src/step-up.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Step-up verification: the protocol that carries one challenged Registry
+ * write through human verification and retries it exactly once.
+ *
+ * The capability owns challenge detection, request-reference validation,
+ * resumption and terminal-status rules, expiry, the bounded wait, and the
+ * retry-once contract. The application supplies only presentation and browser
+ * launch through the login presenter and interaction ports.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { StepUpVerificationPending, type AuthError } from "./errors.js";
+import { AuthLoginInteraction } from "./login-interaction.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** How one challenged write names itself to a person watching the terminal. */
+export interface StepUpPresentation {
+    /** Lifecycle label for the challenged write itself. */
+    readonly operationLabel: string;
+    /** Lifecycle label for the bounded wait on human verification. */
+    readonly waitingLabel: string;
+}
+/** The invocation's verification inputs, parsed from the command line. */
+export interface StepUpOptions {
+    /** Resume this exact pending request instead of issuing a fresh challenge. */
+    readonly resumeReference?: string;
+    /** Bounded wait, in whole seconds, for the person to verify. */
+    readonly waitForHumanSeconds?: number;
+    /** No terminal is available to guide a person through verification. */
+    readonly unattended: boolean;
+}
+/** A challenged write that completed, and whether verification was needed. */
+export interface VerifiedWrite<A> {
+    readonly value: A;
+    readonly stepUpCompleted: boolean;
+}
+/**
+ * Run a Registry write that may be challenged, carry the challenge through
+ * human verification, and retry the write exactly once with the verified
+ * request id.
+ *
+ * The write is never replayed without verification, and a wait that elapses
+ * while the request is still valid resolves to `StepUpVerificationPending`
+ * rather than a failure of the write.
+ */
+export declare const runWithStepUp: <A, E, R>(operation: (stepUpRequestId?: string) => Effect.Effect<A, E, R>, presentation: StepUpPresentation, options: StepUpOptions, registryUrl: string) => Effect.Effect<VerifiedWrite<A>, E | AuthError | StepUpVerificationPending, R | AuthClient | AuthLoginInteraction | AuthLoginPresenter | CredentialStore>;
+//# sourceMappingURL=step-up.d.ts.map

package/dist/src/step-up.js

@@ -0,0 +1,174 @@
+/**
+ * Step-up verification: the protocol that carries one challenged Registry
+ * write through human verification and retries it exactly once.
+ *
+ * The capability owns challenge detection, request-reference validation,
+ * resumption and terminal-status rules, expiry, the bounded wait, and the
+ * retry-once contract. The application supplies only presentation and browser
+ * launch through the login presenter and interaction ports.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Clock from "effect/Clock";
+import * as DateTime from "effect/DateTime";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { isRegistryClientFailure } from "@agentxm/registry-client";
+import { AuthClient, readStepUpRequest } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { authLoginRequired, RegistryAuthFailed, StepUpRequired, StepUpVerificationPending, } from "./errors.js";
+import { AuthLoginInteraction } from "./login-interaction.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { resolveRequiredToken } from "./token-resolution.js";
+const invalidReference = (detail, recover) => new RegistryAuthFailed({
+    category: "validation",
+    detail,
+    ...(recover === undefined ? {} : { recover }),
+});
+/** Request references may only address the selected Registry's step-up resource. */
+const readRequestReference = (reference, registryUrl) => Effect.try({
+    try: () => {
+        const url = new URL(reference);
+        const registry = new URL(registryUrl);
+        const match = /^\/v1\/auth\/step-up\/requests\/(step_[a-z0-9]+)$/.exec(url.pathname);
+        if (url.origin !== registry.origin ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            match?.[1] === undefined)
+            throw new Error("Invalid step-up reference");
+        return match[1];
+    },
+    catch: () => invalidReference("The step-up request URL must identify a step-up request on the selected Registry.", "Use the requestRef from this Registry's pending-human result."),
+});
+const pendingVerification = (stepUp, registryUrl, timedOut) => new StepUpVerificationPending({
+    timedOut,
+    action: {
+        kind: "open-url",
+        purpose: "step-up",
+        requestRef: stepUp.statusUrl,
+        registryUrl,
+        url: stepUp.verificationUrl,
+        expiresAt: stepUp.expiresAt,
+        intervalSeconds: stepUp.intervalSeconds,
+        resume: `Rerun the same command with the same inputs and --step-up-request ${stepUp.statusUrl}. Add --wait-for-human SECONDS for a bounded wait.`,
+    },
+});
+/** The challenge a failure carries, whether typed or still on the wire. */
+const challengeOf = (failure) => failure instanceof StepUpRequired
+    ? failure.stepUp
+    : isRegistryClientFailure(failure)
+        ? readStepUpRequest(failure)
+        : null;
+/**
+ * Run a Registry write that may be challenged, carry the challenge through
+ * human verification, and retry the write exactly once with the verified
+ * request id.
+ *
+ * The write is never replayed without verification, and a wait that elapses
+ * while the request is still valid resolves to `StepUpVerificationPending`
+ * rather than a failure of the write.
+ */
+export const runWithStepUp = (operation, presentation, options, registryUrl) => Effect.gen(function* () {
+    const authClient = yield* AuthClient;
+    const interaction = yield* AuthLoginInteraction;
+    const presenter = yield* AuthLoginPresenter;
+    const waitSeconds = options.waitForHumanSeconds;
+    if (waitSeconds !== undefined && (!Number.isSafeInteger(waitSeconds) || waitSeconds <= 0)) {
+        return yield* invalidReference("--wait-for-human must be a positive number of seconds.");
+    }
+    const resumedId = options.resumeReference === undefined
+        ? undefined
+        : yield* readRequestReference(options.resumeReference, registryUrl);
+    const initial = resumedId === undefined
+        ? yield* presenter.withProgress({ _tag: "RunningVerifiedWrite", operation: presentation.operationLabel }, () => Effect.result(operation()))
+        : undefined;
+    if (initial !== undefined && Result.isSuccess(initial)) {
+        return { value: initial.success, stepUpCompleted: false };
+    }
+    const challenge = initial !== undefined && Result.isFailure(initial) ? challengeOf(initial.failure) : null;
+    if (initial !== undefined && Result.isFailure(initial) && challenge === null) {
+        return yield* Effect.fail(initial.failure);
+    }
+    const token = yield* resolveRequiredToken(registryUrl, {
+        missingTokenError: authLoginRequired("Not authenticated"),
+    });
+    const resumed = resumedId === undefined
+        ? undefined
+        : yield* authClient.getStepUpRequest(token.token, resumedId);
+    if (resumed !== undefined && resumed.status !== "pending" && resumed.status !== "verified") {
+        return yield* new RegistryAuthFailed({
+            category: resumed.status === "expired"
+                ? "auth_expired"
+                : resumed.status === "cancelled"
+                    ? "auth_denied"
+                    : "conflict",
+            detail: `The step-up request is ${resumed.status}. It cannot be resumed.`,
+            recover: "Review the result of the previous request before explicitly starting a new command without --step-up-request.",
+        });
+    }
+    const stepUp = challenge ??
+        (resumed !== undefined && resumedId !== undefined
+            ? {
+                requestId: resumedId,
+                statusUrl: new URL(`/v1/auth/step-up/requests/${resumedId}`, registryUrl).href,
+                verificationUrl: new URL(`/step-up/${resumedId}`, authClient.getAuthorizationIssuer())
+                    .href,
+                expiresAt: DateTime.formatIso(resumed.expires_at),
+                intervalSeconds: 2,
+                action: presentation.operationLabel,
+                target: presentation.operationLabel,
+            }
+            : null);
+    if (stepUp === null) {
+        return yield* new RegistryAuthFailed({
+            category: "auth",
+            detail: "The Registry did not return a verification request.",
+        });
+    }
+    const challengeId = yield* readRequestReference(stepUp.statusUrl, registryUrl);
+    if (challengeId !== stepUp.requestId) {
+        return yield* invalidReference("The Registry returned mismatched step-up references.");
+    }
+    const now = yield* Clock.currentTimeMillis;
+    const remaining = Date.parse(stepUp.expiresAt) - now;
+    if (!Number.isFinite(remaining) || remaining <= 0) {
+        return yield* new RegistryAuthFailed({
+            category: "auth_expired",
+            detail: "The step-up request has expired.",
+        });
+    }
+    if (resumed?.status !== "verified") {
+        if (options.unattended && waitSeconds === undefined) {
+            return yield* pendingVerification(stepUp, registryUrl, false);
+        }
+        const opened = options.unattended
+            ? false
+            : yield* interaction.openBrowser(stepUp.verificationUrl);
+        yield* presenter.presentStepUpChallenge({
+            action: stepUp.action,
+            target: stepUp.target,
+            verificationUrl: stepUp.verificationUrl,
+            expiresAt: stepUp.expiresAt,
+            browserOpened: opened,
+        });
+        const waited = yield* presenter.withProgress({ _tag: "WaitingForHumanVerification", operation: presentation.waitingLabel }, () => authClient
+            .waitForStepUpRequest(token.token, stepUp.statusUrl, stepUp.intervalSeconds)
+            .pipe(Effect.timeoutOption(Duration.millis(Math.min(remaining, waitSeconds === undefined ? remaining : waitSeconds * 1000)))));
+        if (Option.isNone(waited)) {
+            if ((yield* Clock.currentTimeMillis) >= Date.parse(stepUp.expiresAt)) {
+                return yield* new RegistryAuthFailed({
+                    category: "auth_expired",
+                    detail: "The step-up request has expired.",
+                });
+            }
+            return yield* pendingVerification(stepUp, registryUrl, true);
+        }
+    }
+    const value = yield* presenter.withProgress({ _tag: "RetryingVerifiedWrite", operation: presentation.operationLabel }, () => operation(stepUp.requestId));
+    return { value, stepUpCompleted: true };
+});
+//# sourceMappingURL=step-up.js.map

package/dist/src/testing.d.ts

@@ -11,4 +11,5 @@ export { DeviceLoginInteractionTest, type DeviceLoginInteractionTestState, } fro
 export { AuthLoginInteractionTest, type AuthLoginInteractionTestState, } from "./login-interaction.js";
 export { AuthLoginPresenterTest, type AuthLoginPresenterTestState } from "./login-presenter.js";
 export { PendingDeviceLoginStoreTest } from "./pending-device-login-store.js";
+export { PendingPublishAuthorizationStoreTest } from "./pending-publish-authorization-store.js";
 //# sourceMappingURL=testing.d.ts.map

package/dist/src/testing.js

@@ -11,4 +11,5 @@ export { DeviceLoginInteractionTest, } from "./device-login.js";
 export { AuthLoginInteractionTest, } from "./login-interaction.js";
 export { AuthLoginPresenterTest } from "./login-presenter.js";
 export { PendingDeviceLoginStoreTest } from "./pending-device-login-store.js";
+export { PendingPublishAuthorizationStoreTest } from "./pending-publish-authorization-store.js";
 //# sourceMappingURL=testing.js.map

package/dist/src/tokens.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Granular access-token policy: the expiry grammar and its bounds, the
+ * permission payload the Registry accepts, and the human-verification
+ * requirement on every token write.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthClient, type CreatedTokenResponse, type TokenPermissionsRequest } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { RegistryAuthFailed } from "./errors.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { type StepUpOptions } from "./step-up.js";
+/** A token may live no less than an hour and no more than a year. */
+export declare const MIN_TOKEN_LIFETIME_SECONDS = 3600;
+export declare const MAX_TOKEN_LIFETIME_SECONDS = 31536000;
+/** The authority a new token carries. */
+export interface TokenAuthorityRequest {
+    readonly owners: ReadonlyArray<string>;
+    readonly extensions: ReadonlyArray<string>;
+    readonly permission: Option.Option<"read" | "publish" | "admin">;
+    readonly orgPermission: Option.Option<"read" | "write" | "admin">;
+    readonly cidr: ReadonlyArray<string>;
+    readonly bypassMfa: boolean;
+}
+export interface CreateTokenRequest extends TokenAuthorityRequest {
+    readonly name: string;
+    /** Relative lifetime (`7d`, `30d`, `1y`) or an absolute ISO timestamp. */
+    readonly expires: string;
+    readonly verification: StepUpOptions;
+}
+export interface CreatedToken {
+    readonly token: CreatedTokenResponse;
+    readonly stepUpCompleted: boolean;
+}
+/**
+ * Read the requested lifetime. Relative forms are exact multiples; an
+ * absolute timestamp becomes the distance from now.
+ */
+export declare const parseExpiresInSeconds: (raw: string) => Effect.Effect<number, RegistryAuthFailed>;
+/** Enforce the accepted lifetime window. */
+export declare const validateExpiresInSeconds: (expiresIn: number) => Effect.Effect<number, RegistryAuthFailed>;
+/** Only the authority a caller actually asked for reaches the Registry. */
+export declare const tokenPermissions: (request: TokenAuthorityRequest) => TokenPermissionsRequest;
+export declare const createToken: (request: CreateTokenRequest, registryUrl: string) => Effect.Effect<{
+    token: CreatedTokenResponse;
+    stepUpCompleted: boolean;
+}, import("./errors.js").AuthError, AuthClient | CredentialStore | AuthLoginPresenter | import("./login-interaction.ts").AuthLoginInteraction>;
+export declare const revokeToken: (tokenId: string, verification: StepUpOptions, registryUrl: string) => Effect.Effect<{
+    tokenId: string;
+    stepUpCompleted: boolean;
+}, import("./errors.js").AuthError, AuthClient | CredentialStore | AuthLoginPresenter | import("./login-interaction.ts").AuthLoginInteraction>;
+export declare const listTokens: (registryUrl: string) => Effect.Effect<import("./auth-client.js").TokenListResponse, import("./errors.js").AuthError, AuthClient | CredentialStore | AuthLoginPresenter>;
+/** Declared for the reader; every member keeps these in `R`. */
+export type TokenRequirements = AuthClient | CredentialStore | AuthLoginPresenter;
+//# sourceMappingURL=tokens.d.ts.map