@agentxm/registry-auth 0.28.12 → 0.28.13

package/dist/src/auth-client.d.ts

@@ -17,7 +17,7 @@ import * as ServiceMap from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { type Handle } from "@agentxm/extension-model/unstable/extensions/handle";
-import { type PublishVisibility } from "@agentxm/registry-protocol/unstable/publish/visibility";
+import { type PublishVisibility } from "@agentxm/registry-protocol/unstable/publish";
 import { type PreviewPublicationSetRequest, type PreviewPublicationSetResponse, type Sha256Hex } from "@agentxm/registry-protocol/unstable/registry/publication-set";
 import { type NormalizedTokenResponse } from "./oauth-contract.js";
 import { GeneratedRegistryClient, RegistryUrl } from "@agentxm/registry-client";

package/dist/src/auth-client.js

@@ -23,7 +23,7 @@ import * as Schedule from "effect/Schedule";
 import * as Schema from "effect/Schema";
 import { DateTimeUtcSchema } from "@agentxm/extension-model/unstable/date-time";
 import { normalizeHandle } from "@agentxm/extension-model/unstable/extensions/handle";
-import { PublishVisibilitySchema, } from "@agentxm/registry-protocol/unstable/publish/visibility";
+import { PublishVisibilitySchema, } from "@agentxm/registry-protocol/unstable/publish";
 import { PreviewPublicationSetResponseSchema, } from "@agentxm/registry-protocol/unstable/registry/publication-set";
 import {} from "./oauth-contract.js";
 import { GeneratedRegistryClient, executeRegistryRequest, RegistryUrl, captureRegistryErrorResponseBodies, getString, isHttpClientError, isRegistryClientError, isRegistryClientFailure, isTransientHttpClientError, mapRegistryFailure, } from "@agentxm/registry-client";

package/dist/src/credential-store.d.ts

@@ -68,8 +68,45 @@ export declare const makePersistedCredentialsUnsupportedError: () => AuthTokenPo
 export declare const CredentialStoreLive: Layer.Layer<CredentialStore, never, FileSystem.FileSystem | Path.Path>;
 /**
  * Decorates a credential store with a per-layer, per-origin read memo.
- * Successful empty reads are memoized; failures remain retryable. Every
- * successful write invalidates only the affected origin.
+ *
+ * Reads go through an `Effect.Cache` keyed by registry origin, which owns the
+ * concurrent-lookup sharing, per-key invalidation, and result-dependent expiry
+ * that this layer previously hand-rolled with a value map, a semaphore map, and
+ * a double-checked read.
+ *
+ * Capacity is `Number.POSITIVE_INFINITY`: the cache never evicts on size, which
+ * preserves the unbounded map this layer already used. The key space is the set
+ * of distinct registry origins a single process contacts — the configured
+ * registry plus any origins named by workspace extension sources — so there is
+ * no measured workload that justifies a numeric bound. The bound that matters
+ * is lifetime, and it is the layer's: the cache is created per
+ * `CredentialStoreSessionLive` construction and released with it, so a CLI
+ * session is its longest possible life.
+ *
+ * Expiry is result-dependent. Successful reads — including a successful empty
+ * read — live for the session, so repeated authentication paths pay one load
+ * per origin. Failed reads expire immediately, so a failure is never memoized
+ * and a later request retries against the store.
+ *
+ * Callers that arrive while a lookup is in flight share it rather than issuing
+ * their own; callers that arrive after a failed lookup resolves start a new
+ * one. That replaces the old per-origin semaphore, under which every waiter on
+ * a failing origin retried serially. Sharing is safe here because each auth
+ * path issues a single load and none of them depends on serial retry.
+ *
+ * `Effect.onInterrupt` is load-path scaffolding, not decoration. `Cache.get`
+ * runs its lookup on a detached daemon fiber and leaves the pending entry in
+ * the map when the only caller is interrupted, so without this guard the next
+ * read of that origin would await an abandoned lookup forever. Invalidating on
+ * interrupt restores the pre-cache behavior, where an interrupted read left
+ * nothing behind and the next read simply ran again.
+ *
+ * Known limitation, unchanged by this layer's move to `Cache` and not fixed by
+ * it: a `save` or `clear` whose invalidation lands while a read of the same
+ * origin is still in flight can be overwritten when that read populates the
+ * memo, leaving the pre-write value cached for the rest of the session. The
+ * previous value-map-and-semaphore memo lost the same invalidation through its
+ * own write-after-invalidate window.
  */
 export declare const CredentialStoreSessionLive: Layer.Layer<CredentialStore, never, CredentialStore>;
 export declare const CredentialStoreTest: (tier?: StorageTier, initialData?: CredentialFile, allowsPersistedCredentials?: boolean) => Layer.Layer<CredentialStore, never, never>;

package/dist/src/credential-store.js

@@ -20,12 +20,13 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as ServiceMap from "effect/Context";
+import * as Cache from "effect/Cache";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
-import * as Semaphore from "effect/Semaphore";
 import * as lockfile from "proper-lockfile";
 import { decodeHandleSync } from "@agentxm/extension-model/unstable/extensions/handle";
 import { AuthTokenPolicyRequired, RegistryAuthFailed } from "./errors.js";
@@ -340,57 +341,60 @@ export const CredentialStoreLive = Layer.effect(CredentialStore, Effect.gen(func
 }));
 /**
  * Decorates a credential store with a per-layer, per-origin read memo.
- * Successful empty reads are memoized; failures remain retryable. Every
- * successful write invalidates only the affected origin.
+ *
+ * Reads go through an `Effect.Cache` keyed by registry origin, which owns the
+ * concurrent-lookup sharing, per-key invalidation, and result-dependent expiry
+ * that this layer previously hand-rolled with a value map, a semaphore map, and
+ * a double-checked read.
+ *
+ * Capacity is `Number.POSITIVE_INFINITY`: the cache never evicts on size, which
+ * preserves the unbounded map this layer already used. The key space is the set
+ * of distinct registry origins a single process contacts — the configured
+ * registry plus any origins named by workspace extension sources — so there is
+ * no measured workload that justifies a numeric bound. The bound that matters
+ * is lifetime, and it is the layer's: the cache is created per
+ * `CredentialStoreSessionLive` construction and released with it, so a CLI
+ * session is its longest possible life.
+ *
+ * Expiry is result-dependent. Successful reads — including a successful empty
+ * read — live for the session, so repeated authentication paths pay one load
+ * per origin. Failed reads expire immediately, so a failure is never memoized
+ * and a later request retries against the store.
+ *
+ * Callers that arrive while a lookup is in flight share it rather than issuing
+ * their own; callers that arrive after a failed lookup resolves start a new
+ * one. That replaces the old per-origin semaphore, under which every waiter on
+ * a failing origin retried serially. Sharing is safe here because each auth
+ * path issues a single load and none of them depends on serial retry.
+ *
+ * `Effect.onInterrupt` is load-path scaffolding, not decoration. `Cache.get`
+ * runs its lookup on a detached daemon fiber and leaves the pending entry in
+ * the map when the only caller is interrupted, so without this guard the next
+ * read of that origin would await an abandoned lookup forever. Invalidating on
+ * interrupt restores the pre-cache behavior, where an interrupted read left
+ * nothing behind and the next read simply ran again.
+ *
+ * Known limitation, unchanged by this layer's move to `Cache` and not fixed by
+ * it: a `save` or `clear` whose invalidation lands while a read of the same
+ * origin is still in flight can be overwritten when that read populates the
+ * memo, leaving the pre-write value cached for the rest of the session. The
+ * previous value-map-and-semaphore memo lost the same invalidation through its
+ * own write-after-invalidate window.
  */
 export const CredentialStoreSessionLive = Layer.effect(CredentialStore, Effect.gen(function* () {
     const store = yield* CredentialStore;
-    const cache = yield* Ref.make(new Map());
-    const locks = yield* Ref.make(new Map());
-    const getLock = (registryUrl) => Ref.modify(locks, (current) => {
-        const existing = current.get(registryUrl);
-        if (existing !== undefined)
-            return [existing, current];
-        const created = Semaphore.makeUnsafe(1);
-        const updated = new Map(current);
-        updated.set(registryUrl, created);
-        return [created, updated];
-    });
-    const getCached = (registryUrl) => Effect.map(Ref.get(cache), (current) => {
-        const cached = current.get(registryUrl);
-        return cached === undefined
-            ? Option.none()
-            : Option.some(cached);
-    });
-    const invalidate = (registryUrl) => Ref.update(cache, (current) => {
-        const updated = new Map(current);
-        updated.delete(registryUrl);
-        return updated;
-    });
-    const load = (registryUrl) => Effect.gen(function* () {
-        const cached = yield* getCached(registryUrl);
-        if (Option.isSome(cached))
-            return cached.value;
-        const lock = yield* getLock(registryUrl);
-        return yield* lock.withPermits(1)(Effect.gen(function* () {
-            const afterWait = yield* getCached(registryUrl);
-            if (Option.isSome(afterWait))
-                return afterWait.value;
-            const loaded = yield* store.load(registryUrl);
-            yield* Ref.update(cache, (current) => {
-                const updated = new Map(current);
-                updated.set(registryUrl, loaded);
-                return updated;
-            });
-            return loaded;
-        }));
+    const cache = yield* Cache.makeWith((registryUrl) => store.load(registryUrl), {
+        capacity: Number.POSITIVE_INFINITY,
+        timeToLive: (exit) => Exit.isSuccess(exit) ? Duration.infinity : Duration.zero,
     });
     return {
         tier: store.tier,
         allowsPersistedCredentials: store.allowsPersistedCredentials,
-        load,
-        save: (registryUrl, handle, credentials) => store.save(registryUrl, handle, credentials).pipe(Effect.andThen(invalidate(registryUrl))),
-        clear: (registryUrl) => store.clear(registryUrl).pipe(Effect.andThen(invalidate(registryUrl))),
+        load: (registryUrl) => Cache.get(cache, registryUrl).pipe(Effect.onInterrupt(() => Cache.invalidate(cache, registryUrl))),
+        save: (registryUrl, handle, credentials) => store
+            .save(registryUrl, handle, credentials)
+            .pipe(Effect.andThen(Cache.invalidate(cache, registryUrl))),
+        clear: (registryUrl) => store.clear(registryUrl).pipe(Effect.andThen(Cache.invalidate(cache, registryUrl))),
     };
 }));
 // -----------------------------------------------------------------------------

package/dist/src/device-login.d.ts

@@ -120,7 +120,7 @@ export declare const initiateDeviceLogin: (registryUrl: string, options?: RunDev
         readonly resume: string;
     };
 }, import("./errors.js").AuthError, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore | DeviceLoginInteraction>;
-export declare const resumeDeviceLogin: (registryUrl: string, options?: ResumeDeviceLoginOptions) => Effect.Effect<undefined, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryClientFailure | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore>;
-export declare const runDeviceLogin: (registryUrl: string, options?: RunDeviceLoginOptions) => Effect.Effect<void, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | import("./errors.js").DeviceLoginDenied | import("./errors.js").DeviceLoginCodeExpired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryProblem | import("@agentxm/registry-client").RegistryRequestFailed | import("@agentxm/registry-client").RegistryOperationFailed | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore | DeviceLoginInteraction>;
+export declare const resumeDeviceLogin: (registryUrl: string, options?: ResumeDeviceLoginOptions) => Effect.Effect<undefined, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryClientFailure | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending | import("./errors.js").StepUpVerificationPending | import("./errors.js").AuthInteractionAbandoned, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore>;
+export declare const runDeviceLogin: (registryUrl: string, options?: RunDeviceLoginOptions) => Effect.Effect<void, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | import("./errors.js").DeviceLoginDenied | import("./errors.js").DeviceLoginCodeExpired | DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryProblem | import("@agentxm/registry-client").RegistryRequestFailed | import("@agentxm/registry-client").RegistryOperationFailed | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending | import("./errors.js").StepUpVerificationPending | import("./errors.js").AuthInteractionAbandoned, AuthClient | CredentialStore | AuthLoginPresenter | PendingDeviceLoginStore | DeviceLoginInteraction>;
 export {};
 //# sourceMappingURL=device-login.d.ts.map

package/dist/src/errors.d.ts

@@ -2,7 +2,7 @@ import type { HumanHandoffAction } from "@agentxm/registry-protocol/unstable/hum
 import { type RegistryClientFailure } from "@agentxm/registry-client";
 import type { SuggestedAction } from "@agentxm/registry-protocol/unstable/suggested-action";
 /** Every category a registry-auth failure can carry. Identical strings to the CLI error codes. */
-export declare const REGISTRY_AUTH_ERROR_CATEGORIES: readonly ["auth", "auth_denied", "auth_expired", "conflict", "internal", "not_found", "validation"];
+export declare const REGISTRY_AUTH_ERROR_CATEGORIES: readonly ["auth", "auth_denied", "auth_expired", "conflict", "internal", "not_found", "timeout", "usage", "validation"];
 export type RegistryAuthErrorCategory = (typeof REGISTRY_AUTH_ERROR_CATEGORIES)[number];
 declare const RegistryAuthFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "RegistryAuthFailed";
@@ -129,8 +129,32 @@ export declare class PublishAuthorizationPending extends PublishAuthorizationPen
     readonly timedOut: boolean;
 }> {
 }
+declare const StepUpVerificationPending_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "StepUpVerificationPending";
+} & Readonly<A>;
+/**
+ * A challenged Registry write is waiting on human verification. No challenged
+ * write has completed: the operation is retried exactly once, after the
+ * verification the carried handoff describes.
+ */
+export declare class StepUpVerificationPending extends StepUpVerificationPending_base<{
+    readonly action: HumanHandoffAction;
+    readonly timedOut: boolean;
+}> {
+}
+declare const AuthInteractionAbandoned_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthInteractionAbandoned";
+} & Readonly<A>;
+/**
+ * A person abandoned an auth interaction the capability asked the application
+ * to run (declining is not abandoning: it returns a decision).
+ */
+export declare class AuthInteractionAbandoned extends AuthInteractionAbandoned_base<{
+    readonly message: string;
+}> {
+}
 /** Every typed failure the registry-auth feature constructs. */
-export type RegistryAuthFailure = RegistryAuthFailed | AuthLoginRequired | AuthTokenPolicyRequired | DeviceLoginDenied | DeviceLoginCodeExpired | DeviceAuthorizationPending | PublishAuthorizationPending | StepUpRequired | AuthExchangeFailed;
+export type RegistryAuthFailure = RegistryAuthFailed | AuthLoginRequired | AuthTokenPolicyRequired | DeviceLoginDenied | DeviceLoginCodeExpired | DeviceAuthorizationPending | PublishAuthorizationPending | StepUpVerificationPending | AuthInteractionAbandoned | StepUpRequired | AuthExchangeFailed;
 export declare const isRegistryAuthFailure: (error: unknown) => error is RegistryAuthFailure;
 /**
  * Every failure a registry-auth use case can surface: the feature's own typed

package/dist/src/errors.js

@@ -18,6 +18,8 @@ export const REGISTRY_AUTH_ERROR_CATEGORIES = [
     "conflict",
     "internal",
     "not_found",
+    "timeout",
+    "usage",
     "validation",
 ];
 /**
@@ -74,6 +76,19 @@ export class AuthExchangeFailed extends Data.TaggedError("AuthExchangeFailed") {
 }
 export class PublishAuthorizationPending extends Data.TaggedError("PublishAuthorizationPending") {
 }
+/**
+ * A challenged Registry write is waiting on human verification. No challenged
+ * write has completed: the operation is retried exactly once, after the
+ * verification the carried handoff describes.
+ */
+export class StepUpVerificationPending extends Data.TaggedError("StepUpVerificationPending") {
+}
+/**
+ * A person abandoned an auth interaction the capability asked the application
+ * to run (declining is not abandoning: it returns a decision).
+ */
+export class AuthInteractionAbandoned extends Data.TaggedError("AuthInteractionAbandoned") {
+}
 export const isRegistryAuthFailure = (error) => error instanceof RegistryAuthFailed ||
     error instanceof AuthLoginRequired ||
     error instanceof AuthTokenPolicyRequired ||
@@ -81,6 +96,8 @@ export const isRegistryAuthFailure = (error) => error instanceof RegistryAuthFai
     error instanceof DeviceLoginCodeExpired ||
     error instanceof DeviceAuthorizationPending ||
     error instanceof PublishAuthorizationPending ||
+    error instanceof StepUpVerificationPending ||
+    error instanceof AuthInteractionAbandoned ||
     error instanceof StepUpRequired ||
     error instanceof AuthExchangeFailed;
 export const isAuthError = (error) => isRegistryAuthFailure(error) || isRegistryClientFailure(error);

package/dist/src/identity.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The authenticated identity of the selected Registry, and the credential
+ * lifecycle rule that governs reading it: a stored credential the Registry
+ * rejects is refreshed once and the read is retried, while a rejected ambient
+ * credential is reported as sign-in required.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import type * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import type { Handle } from "@agentxm/extension-model/unstable/extensions/handle";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+/** The Registry's canonical answer to "who is this credential". */
+export interface RegistryIdentity {
+    readonly user: Handle;
+    readonly registry: string;
+    readonly credentialType: string;
+    readonly scopes: ReadonlyArray<string>;
+    readonly resourceRestrictions: {
+        readonly extensions: ReadonlyArray<string> | null;
+    };
+    readonly expiresAt: DateTime.Utc | null;
+}
+/**
+ * Read the canonical Registry identity for the resolved credential.
+ *
+ * Only a credential this workspace stores can be refreshed: an ambient token
+ * the Registry rejects is the caller's to replace, so it maps to sign-in
+ * required rather than a silent refresh attempt.
+ */
+export declare const currentIdentity: (registryUrl: string) => Effect.Effect<{
+    user: string & import("effect/Brand").Brand<"Handle">;
+    registry: string;
+    credentialType: string;
+    scopes: readonly string[];
+    resourceRestrictions: {
+        readonly extensions: ReadonlyArray<string> | null;
+    };
+    expiresAt: DateTime.Utc | null;
+}, import("./errors.js").AuthError, AuthClient | CredentialStore>;
+/** The token an invocation would present to the selected Registry. */
+export declare const currentToken: (registryUrl: string) => Effect.Effect<string, import("./errors.js").AuthError, CredentialStore>;
+/** Both members keep `CredentialStore` in `R`; declared for the reader. */
+export type IdentityRequirements = AuthClient | CredentialStore;
+//# sourceMappingURL=identity.d.ts.map

package/dist/src/identity.js

@@ -0,0 +1,49 @@
+/**
+ * The authenticated identity of the selected Registry, and the credential
+ * lifecycle rule that governs reading it: a stored credential the Registry
+ * rejects is refreshed once and the read is retried, while a rejected ambient
+ * credential is reported as sign-in required.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { isRegistryClientFailure } from "@agentxm/registry-client";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { authLoginRequired } from "./errors.js";
+import { refreshStoredToken, resolveRequiredToken } from "./token-resolution.js";
+const isRejectedCredential = (error) => isRegistryClientFailure(error) && error.metadata?.response?.status === 401;
+/**
+ * Read the canonical Registry identity for the resolved credential.
+ *
+ * Only a credential this workspace stores can be refreshed: an ambient token
+ * the Registry rejects is the caller's to replace, so it maps to sign-in
+ * required rather than a silent refresh attempt.
+ */
+export const currentIdentity = Effect.fn("Identity.current")(function* (registryUrl) {
+    const authClient = yield* AuthClient;
+    const token = yield* resolveRequiredToken(registryUrl, {
+        missingTokenError: authLoginRequired("Not authenticated"),
+    });
+    const identity = yield* authClient.getMe(token.token).pipe(Effect.catch((error) => token._tag === "CredentialStore" && isRejectedCredential(error)
+        ? refreshStoredToken(token).pipe(Effect.flatMap((refreshed) => authClient.getMe(refreshed.token)))
+        : Effect.fail(error)), Effect.mapError((error) => isRejectedCredential(error)
+        ? authLoginRequired("Invalid or expired credential. Authenticate again.", error)
+        : error));
+    return {
+        user: identity.userHandle,
+        registry: registryUrl,
+        credentialType: identity.tokenType,
+        scopes: identity.scopes,
+        resourceRestrictions: identity.resourceRestrictions,
+        expiresAt: identity.expiresAt,
+    };
+});
+/** The token an invocation would present to the selected Registry. */
+export const currentToken = Effect.fn("Identity.currentToken")(function* (registryUrl) {
+    const token = yield* resolveRequiredToken(registryUrl, {
+        missingTokenError: authLoginRequired("No token available"),
+    });
+    return token.token;
+});
+//# sourceMappingURL=identity.js.map

package/dist/src/index.d.ts

@@ -10,7 +10,7 @@
  * @experimental This API is unstable and may change without notice.
  * @packageDocumentation
  */
-export { AuthExchangeFailed, AuthLoginRequired, AuthTokenPolicyRequired, authLoginRequired, DeviceAuthorizationPending, PublishAuthorizationPending, DeviceLoginCodeExpired, DeviceLoginDenied, isAuthError, isRegistryAuthFailure, REGISTRY_AUTH_ERROR_CATEGORIES, RegistryAuthFailed, StepUpRequired, type AuthError, type RegistryAuthErrorCategory, type RegistryAuthFailure, type StepUpRequest, } from "./errors.js";
+export { AuthExchangeFailed, AuthLoginRequired, AuthTokenPolicyRequired, authLoginRequired, DeviceAuthorizationPending, PublishAuthorizationPending, DeviceLoginCodeExpired, DeviceLoginDenied, AuthInteractionAbandoned, isAuthError, isRegistryAuthFailure, REGISTRY_AUTH_ERROR_CATEGORIES, RegistryAuthFailed, StepUpRequired, StepUpVerificationPending, type AuthError, type RegistryAuthErrorCategory, type RegistryAuthFailure, type StepUpRequest, } from "./errors.js";
 export type { CredentialEntry, CredentialFile, StorageTier, StoredCredentials, TokenSource, } from "./schema.js";
 export { CredentialEntrySchema, CredentialFileSchema, CredentialStoreTokenSource, EnvVarTokenSource, FileTokenSource, FlagTokenSource, RegistryAccountsSchema, } from "./schema.js";
 export type { CredentialStoreService, EnvironmentInfo } from "./credential-store.js";
@@ -28,6 +28,15 @@ export { LoopbackCallbackRejected, LoopbackLoginFallback, startLoopbackServer, }
 export { LoginDocumentSchema, LoginResultSchema, makeLoginResult, type LoginDocument, type LoginResult, } from "./login-output.js";
 export type { AuthLoginPresenterService, AuthLoginProgress, DeviceFlowPresentation, } from "./login-presenter.js";
 export { AuthLoginPresenter } from "./login-presenter.js";
+export type { DeviceCodeFallbackReason, SessionReplacementDecision, StepUpChallengePresentation, } from "./login-presenter.js";
+export { runWithStepUp, type StepUpOptions, type StepUpPresentation, type VerifiedWrite, } from "./step-up.js";
+export { selectedRegistry, type SelectedRegistry } from "./selected-registry.js";
+export { classifyLoopbackFailure, deviceLoginOptions, login, resumeLoginOptions, type LoginOutcome, type LoginRequest, } from "./login.js";
+export { logout, type LogoutOutcome } from "./logout.js";
+export { currentIdentity, currentToken, type RegistryIdentity } from "./identity.js";
+export { createToken, listTokens, parseExpiresInSeconds, revokeToken, tokenPermissions, validateExpiresInSeconds, MAX_TOKEN_LIFETIME_SECONDS, MIN_TOKEN_LIFETIME_SECONDS, type CreateTokenRequest, type CreatedToken, type TokenAuthorityRequest, } from "./tokens.js";
+export { hasCredentialsForAll } from "./login-suggestion.js";
+export { AuthEnvironment } from "./internal/environment.js";
 export { runPublishAuthorization, type PublishAuthorizationInput, } from "./publish-authorization.js";
 export { selectLoginStrategy, type LoginStrategy, type LoginStrategyEnvironment, type LoginStrategyOptions, } from "./login-strategy.js";
 export type { AuthLoginInteractionService } from "./login-interaction.js";

package/dist/src/index.js

@@ -11,7 +11,7 @@
  * @packageDocumentation
  */
 // Typed failures
-export { AuthExchangeFailed, AuthLoginRequired, AuthTokenPolicyRequired, authLoginRequired, DeviceAuthorizationPending, PublishAuthorizationPending, DeviceLoginCodeExpired, DeviceLoginDenied, isAuthError, isRegistryAuthFailure, REGISTRY_AUTH_ERROR_CATEGORIES, RegistryAuthFailed, StepUpRequired, } from "./errors.js";
+export { AuthExchangeFailed, AuthLoginRequired, AuthTokenPolicyRequired, authLoginRequired, DeviceAuthorizationPending, PublishAuthorizationPending, DeviceLoginCodeExpired, DeviceLoginDenied, AuthInteractionAbandoned, isAuthError, isRegistryAuthFailure, REGISTRY_AUTH_ERROR_CATEGORIES, RegistryAuthFailed, StepUpRequired, StepUpVerificationPending, } from "./errors.js";
 export { CredentialEntrySchema, CredentialFileSchema, CredentialStoreTokenSource, EnvVarTokenSource, FileTokenSource, FlagTokenSource, RegistryAccountsSchema, } from "./schema.js";
 export { canUsePersistedCredentials, CredentialStore, detectEnvironment, makePersistedCredentialsUnsupportedError, selectTier, } from "./credential-store.js";
 export { PendingDeviceLoginSchema, PendingDeviceLoginStore } from "./pending-device-login-store.js";
@@ -23,6 +23,18 @@ export { makeOAuthState, makePkceChallenge, makePkceVerifier, runLoopbackLogin,
 export { LoopbackCallbackRejected, LoopbackLoginFallback, startLoopbackServer, } from "./loopback-server.js";
 export { LoginDocumentSchema, LoginResultSchema, makeLoginResult, } from "./login-output.js";
 export { AuthLoginPresenter } from "./login-presenter.js";
+// Step-up verification protocol
+export { runWithStepUp, } from "./step-up.js";
+// The Registry this invocation authenticates against
+export { selectedRegistry } from "./selected-registry.js";
+// Sign-in, sign-out, identity, and token policy use cases
+export { classifyLoopbackFailure, deviceLoginOptions, login, resumeLoginOptions, } from "./login.js";
+export { logout } from "./logout.js";
+export { currentIdentity, currentToken } from "./identity.js";
+export { createToken, listTokens, parseExpiresInSeconds, revokeToken, tokenPermissions, validateExpiresInSeconds, MAX_TOKEN_LIFETIME_SECONDS, MIN_TOKEN_LIFETIME_SECONDS, } from "./tokens.js";
+export { hasCredentialsForAll } from "./login-suggestion.js";
+// Environment source for auth policy decisions (default: the process environment)
+export { AuthEnvironment } from "./internal/environment.js";
 export { runPublishAuthorization, } from "./publish-authorization.js";
 export { selectLoginStrategy, } from "./login-strategy.js";
 export { AuthLoginInteraction } from "./login-interaction.js";

package/dist/src/internal/environment.d.ts

@@ -1,16 +1,27 @@
 /**
  * Runtime environment detection for credential policy and login flows.
  *
- * Pure functions for env var / process checks. Effect-based for filesystem
- * checks. Mirrors the shared helpers the extracted kernels carry; a generic
- * utils package is deliberately not created.
+ * Environment values are read through Effect's `ConfigProvider`, whose default
+ * is the process environment. Tests and embedders replace the provider instead
+ * of mutating `process.env`, so no auth policy specification stubs globals.
  */
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as ServiceMap from "effect/Context";
 import * as FileSystem from "effect/FileSystem";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-/** Read an optional env var. Centralized access point for process.env. */
+/**
+ * The configuration source every auth environment decision reads. Defaults to
+ * the process environment; tests and embedders provide any `ConfigProvider`
+ * — `ConfigProvider.fromEnvRecord({ ... })` — instead of mutating globals.
+ */
+export declare const AuthEnvironment: ServiceMap.Reference<ConfigProvider.ConfigProvider>;
+/**
+ * Read an optional environment value. The single access point: every auth
+ * environment decision resolves through the ambient `ConfigProvider`.
+ */
 export declare const envOption: (name: string) => Effect.Effect<Option.Option<string>>;
-/** Returns true if SSH_CLIENT or SSH_TTY env var is set. */
+/** Returns true if SSH_CLIENT or SSH_TTY is set. */
 export declare const isSSH: Effect.Effect<boolean>;
 /** Returns true if running as root (uid 0). */
 export declare const isRoot: () => boolean;
@@ -20,4 +31,11 @@ export declare const isContainer: Effect.Effect<boolean, never, FileSystem.FileS
 export declare const isWSL: Effect.Effect<boolean, never, FileSystem.FileSystem>;
 /** Returns true if CI env var is set. */
 export declare const isCI: Effect.Effect<boolean>;
+/**
+ * The environment facts login-strategy selection reads. Assembled here so the
+ * strategy decision never touches globals.
+ */
+export declare const loginStrategyEnvironment: Effect.Effect<{
+    [k: string]: string;
+}, never, never>;
 //# sourceMappingURL=environment.d.ts.map

package/dist/src/internal/environment.js

@@ -1,19 +1,53 @@
 /**
  * Runtime environment detection for credential policy and login flows.
  *
- * Pure functions for env var / process checks. Effect-based for filesystem
- * checks. Mirrors the shared helpers the extracted kernels carry; a generic
- * utils package is deliberately not created.
+ * Environment values are read through Effect's `ConfigProvider`, whose default
+ * is the process environment. Tests and embedders replace the provider instead
+ * of mutating `process.env`, so no auth policy specification stubs globals.
  */
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as ServiceMap from "effect/Context";
 import * as FileSystem from "effect/FileSystem";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-// eslint-disable-next-line no-restricted-properties -- Centralized env var access point; all callers use these helpers
-const readEnv = (name) => process.env[name];
-/** Read an optional env var. Centralized access point for process.env. */
-export const envOption = (name) => Effect.sync(() => Option.fromUndefinedOr(readEnv(name)));
-/** Returns true if SSH_CLIENT or SSH_TTY env var is set. */
-export const isSSH = Effect.sync(() => readEnv("SSH_CLIENT") !== undefined || readEnv("SSH_TTY") !== undefined);
+/**
+ * Reads the live process environment on every lookup. Effect's own
+ * `ConfigProvider` default snapshots the environment the first time any
+ * program reads configuration; auth reads must observe the environment the
+ * invocation actually runs under.
+ */
+const processEnvironmentProvider = ConfigProvider.make((path) => 
+// eslint-disable-next-line no-restricted-properties -- the one process-environment read in registry-auth
+ConfigProvider.fromEnvRecord(process.env).load(path));
+/**
+ * The configuration source every auth environment decision reads. Defaults to
+ * the process environment; tests and embedders provide any `ConfigProvider`
+ * — `ConfigProvider.fromEnvRecord({ ... })` — instead of mutating globals.
+ */
+export const AuthEnvironment = ServiceMap.Reference("@agentxm/registry-auth/AuthEnvironment", {
+    defaultValue: () => processEnvironmentProvider,
+});
+/**
+ * The raw string a provider node carries. A `Record` or `Array` node still
+ * carries the value of the exact key when the environment also defines
+ * longer keys under it (`AXM_TOKEN` beside `AXM_TOKEN_FILE`).
+ */
+const nodeValue = (node) => node === undefined
+    ? Option.none()
+    : node._tag === "Value"
+        ? Option.some(node.value)
+        : Option.fromUndefinedOr(node.value);
+/**
+ * Read an optional environment value. The single access point: every auth
+ * environment decision resolves through the ambient `ConfigProvider`.
+ */
+export const envOption = (name) => Effect.gen(function* () {
+    const provider = yield* AuthEnvironment;
+    const node = yield* provider.load([name]).pipe(Effect.orElseSucceed(() => undefined));
+    return nodeValue(node);
+});
+/** Returns true if SSH_CLIENT or SSH_TTY is set. */
+export const isSSH = Effect.map(Effect.all([envOption("SSH_CLIENT"), envOption("SSH_TTY")]), ([client, tty]) => Option.isSome(client) || Option.isSome(tty));
 /** Returns true if running as root (uid 0). */
 export const isRoot = () => process.getuid?.() === 0;
 /** Returns true if /.dockerenv or /.containerenv exists. Requires FileSystem. */
@@ -42,4 +76,20 @@ export const isWSL = Effect.gen(function* () {
 });
 /** Returns true if CI env var is set. */
 export const isCI = Effect.map(envOption("CI"), (value) => Option.exists(value, (raw) => raw.length > 0 && raw !== "0" && raw.toLowerCase() !== "false"));
+/**
+ * The environment facts login-strategy selection reads. Assembled here so the
+ * strategy decision never touches globals.
+ */
+export const loginStrategyEnvironment = Effect.gen(function* () {
+    const env = yield* Effect.all({
+        SSH_CONNECTION: envOption("SSH_CONNECTION"),
+        SSH_CLIENT: envOption("SSH_CLIENT"),
+        SSH_TTY: envOption("SSH_TTY"),
+        DISPLAY: envOption("DISPLAY"),
+        WAYLAND_DISPLAY: envOption("WAYLAND_DISPLAY"),
+        CI: envOption("CI"),
+        CODESPACES: envOption("CODESPACES"),
+    });
+    return Object.fromEntries(Object.entries(env).flatMap(([key, value]) => Option.isSome(value) ? [[key, value.value]] : []));
+});
 //# sourceMappingURL=environment.js.map