@agentxm/registry-auth 0.28.12 → 0.28.13

package/dist/src/login-presenter.d.ts

@@ -13,6 +13,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as ServiceMap from "effect/Context";
 import type { DeviceLoginPendingResult } from "./device-login.js";
+import type { AuthInteractionAbandoned } from "./errors.js";
 import type { LoginResult } from "./login-output.js";
 export type AuthLoginProgress = {
     readonly _tag: "StartingDeviceAuthorization";
@@ -30,7 +31,42 @@ export type AuthLoginProgress = {
 } | {
     readonly _tag: "CompletingSignIn";
     readonly registryHost: string;
+} | {
+    readonly _tag: "CheckingRegistrySession";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "RevokingRegistrySession";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "ListingRegistryTokens";
+}
+/** A Registry write that the Registry may challenge for human verification. */
+ | {
+    readonly _tag: "RunningVerifiedWrite";
+    readonly operation: string;
+}
+/** The bounded wait while a person completes verification. */
+ | {
+    readonly _tag: "WaitingForHumanVerification";
+    readonly operation: string;
+}
+/** The one retry of the challenged write, after verification. */
+ | {
+    readonly _tag: "RetryingVerifiedWrite";
+    readonly operation: string;
 };
+/** What a person decided about replacing a session that is still valid. */
+export type SessionReplacementDecision = "replace" | "keep";
+/** Why sign-in fell back to the device-code flow. */
+export type DeviceCodeFallbackReason = "remote-or-headless" | "loopback-bind-failed";
+/** One step-up challenge, as a person needs to see it. */
+export interface StepUpChallengePresentation {
+    readonly action: string;
+    readonly target: string;
+    readonly verificationUrl: string;
+    readonly expiresAt: string;
+    readonly browserOpened: boolean;
+}
 export interface DeviceFlowPresentation {
     readonly verificationUri: string;
     readonly verificationUriComplete: string;
@@ -64,6 +100,19 @@ export interface AuthLoginPresenterService {
         readonly candidateCount: number;
         readonly authorizationUrl: string;
     }) => Effect.Effect<void>;
+    /** A still-valid session was found for the selected Registry. */
+    readonly noteExistingSession: (handle: string) => Effect.Effect<void>;
+    /** Stored credentials were rejected, so a new sign-in starts. */
+    readonly noteRejectedStoredCredentials: Effect.Effect<void>;
+    /** Sign-in fell back to the device-code flow for the carried reason. */
+    readonly noteDeviceCodeFallback: (reason: DeviceCodeFallbackReason) => Effect.Effect<void>;
+    /**
+     * Ask whether to replace a session that is still valid. Abandoning the
+     * question fails with `AuthInteractionAbandoned`; declining returns "keep".
+     */
+    readonly confirmSessionReplacement: (message: string) => Effect.Effect<SessionReplacementDecision, AuthInteractionAbandoned>;
+    /** Guidance for one pending step-up verification. */
+    readonly presentStepUpChallenge: (challenge: StepUpChallengePresentation) => Effect.Effect<void>;
 }
 declare const AuthLoginPresenter_base: ServiceMap.ServiceClass<AuthLoginPresenter, "@agentxm/registry-auth/login-presenter/AuthLoginPresenter", AuthLoginPresenterService>;
 export declare class AuthLoginPresenter extends AuthLoginPresenter_base {
@@ -84,9 +133,15 @@ export interface AuthLoginPresenterTestState {
         readonly candidateCount: number;
         readonly authorizationUrl: string;
     }>;
+    readonly existingSessions: Array<string>;
+    readonly rejectedStoredCredentials: Array<true>;
+    readonly deviceCodeFallbacks: Array<DeviceCodeFallbackReason>;
+    readonly sessionReplacementPrompts: Array<string>;
+    readonly stepUpChallenges: Array<StepUpChallengePresentation>;
 }
 export declare const AuthLoginPresenterTest: (overrides?: {
     readonly tryEmitPendingDeviceLogin?: (result: DeviceLoginPendingResult) => Effect.Effect<boolean>;
+    readonly confirmSessionReplacement?: (message: string) => Effect.Effect<SessionReplacementDecision, AuthInteractionAbandoned>;
 }) => {
     layer: Layer.Layer<AuthLoginPresenter, never, never>;
     state: AuthLoginPresenterTestState;

package/dist/src/login-presenter.js

@@ -24,6 +24,11 @@ export const AuthLoginPresenterTest = (overrides) => {
         loopbackStarts: [],
         loopbackBrowserOutcomes: [],
         publishReviews: [],
+        existingSessions: [],
+        rejectedStoredCredentials: [],
+        deviceCodeFallbacks: [],
+        sessionReplacementPrompts: [],
+        stepUpChallenges: [],
     };
     const layer = Layer.succeed(AuthLoginPresenter, {
         withProgress: (progress, run) => Effect.suspend(() => {
@@ -52,6 +57,23 @@ export const AuthLoginPresenterTest = (overrides) => {
         notePublishReview: (review) => Effect.sync(() => {
             state.publishReviews.push(review);
         }),
+        noteExistingSession: (handle) => Effect.sync(() => {
+            state.existingSessions.push(handle);
+        }),
+        noteRejectedStoredCredentials: Effect.sync(() => {
+            state.rejectedStoredCredentials.push(true);
+        }),
+        noteDeviceCodeFallback: (reason) => Effect.sync(() => {
+            state.deviceCodeFallbacks.push(reason);
+        }),
+        confirmSessionReplacement: (message) => Effect.gen(function* () {
+            state.sessionReplacementPrompts.push(message);
+            return yield* overrides?.confirmSessionReplacement?.(message) ??
+                Effect.succeed("replace");
+        }),
+        presentStepUpChallenge: (challenge) => Effect.sync(() => {
+            state.stepUpChallenges.push(challenge);
+        }),
     });
     return { layer, state };
 };

package/dist/src/login-suggestion.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Offline credential-presence probe.
+ *
+ * Answers "could this invocation be missing a private item because it is not
+ * signed in to that origin?" without contacting any Registry. A successful
+ * ambient or stored token suppresses the hint even when that identity cannot
+ * see the requested item.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { CredentialStore } from "./credential-store.js";
+/**
+ * Whether every remote origin among `locations` already has a credential this
+ * invocation would present. False when at least one does not.
+ */
+export declare const hasCredentialsForAll: (locations: ReadonlyArray<string>, defaultRegistryUrl: string) => Effect.Effect<boolean, never, CredentialStore>;
+//# sourceMappingURL=login-suggestion.d.ts.map

package/dist/src/login-suggestion.js

@@ -0,0 +1,34 @@
+/**
+ * Offline credential-presence probe.
+ *
+ * Answers "could this invocation be missing a private item because it is not
+ * signed in to that origin?" without contacting any Registry. A successful
+ * ambient or stored token suppresses the hint even when that identity cannot
+ * see the requested item.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { CredentialStore } from "./credential-store.js";
+import { resolveRequestToken } from "./token-resolution.js";
+const remoteOrigins = (locations) => {
+    const origins = new Set();
+    for (const location of locations) {
+        try {
+            const url = new URL(location);
+            if (url.protocol === "http:" || url.protocol === "https:")
+                origins.add(url.origin);
+        }
+        catch {
+            // Invalid source locations are reported by their owning resolution path.
+        }
+    }
+    return [...origins];
+};
+/**
+ * Whether every remote origin among `locations` already has a credential this
+ * invocation would present. False when at least one does not.
+ */
+export const hasCredentialsForAll = (locations, defaultRegistryUrl) => Effect.forEach(remoteOrigins(locations), (origin) => resolveRequestToken(origin, defaultRegistryUrl).pipe(Effect.map(Option.isSome), Effect.catch(() => Effect.succeed(false)))).pipe(Effect.map((present) => present.every((hasCredential) => hasCredential)));
+//# sourceMappingURL=login-suggestion.js.map

package/dist/src/login.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Sign-in orchestration: flag coherence, persisted-credential policy, the
+ * existing-session decision, strategy selection, and the loopback →
+ * device-code fallback chain.
+ *
+ * The capability decides; the application supplies presentation through
+ * `AuthLoginPresenter` and platform integration through
+ * `AuthLoginInteraction`. No sign-in decision is taken outside this module.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { type RunDeviceLoginOptions } from "./device-login.js";
+import { RegistryAuthFailed } from "./errors.js";
+import type { LoopbackCallbackRejected, LoopbackLoginFallback } from "./loopback-server.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** The invocation's sign-in inputs, parsed from the command line. */
+export interface LoginRequest {
+    /** Preapproval: start a new sign-in without asking about a valid session. */
+    readonly yes: boolean;
+    readonly deviceCode: boolean;
+    readonly restart: boolean;
+    /** Resume and wait for a pending device sign-in instead of starting one. */
+    readonly wait: boolean;
+    readonly timeoutSeconds?: number;
+    readonly scopes: ReadonlyArray<string>;
+    /** No terminal is available to run a sign-in flow interactively. */
+    readonly nonInteractive: boolean;
+    /** The invocation reports through a machine document rather than prose. */
+    readonly machineOutput: boolean;
+}
+/** What one `login` invocation settled on. */
+export type LoginOutcome = 
+/** A valid session was found and kept; nothing was written. */
+{
+    readonly _tag: "SessionRetained";
+    readonly registryHost: string;
+    readonly handle: string;
+}
+/** A sign-in flow ran; the presenter reported its result. */
+ | {
+    readonly _tag: "SignInAttempted";
+}
+/** A pending device sign-in was resumed. */
+ | {
+    readonly _tag: "PendingSignInResumed";
+};
+/**
+ * The device-login options one sign-in request means. Exported so the option
+ * shaping is provable without substituting the flow it is handed to.
+ */
+export declare const deviceLoginOptions: (request: Pick<LoginRequest, "restart" | "scopes">, openBrowser: boolean) => RunDeviceLoginOptions;
+/** The resume options one `--wait` request means. */
+export declare const resumeLoginOptions: (request: Pick<LoginRequest, "timeoutSeconds">) => {
+    readonly timeoutSeconds?: number;
+};
+/**
+ * How a loopback sign-in that could not complete is classified.
+ *
+ * A failed bind is recoverable — device-code sign-in replaces it — while an
+ * expired wait or a rejected callback is terminal and leaves credentials
+ * untouched.
+ */
+export declare const classifyLoopbackFailure: (error: LoopbackLoginFallback | LoopbackCallbackRejected) => RegistryAuthFailed;
+export declare const login: (request: LoginRequest, registryUrl: string) => Effect.Effect<{
+    readonly _tag: "PendingSignInResumed";
+    readonly registryHost?: never;
+    readonly handle?: never;
+} | {
+    readonly _tag: "SessionRetained";
+    readonly registryHost: string;
+    readonly handle: string & import("effect/Brand").Brand<"Handle">;
+} | {
+    readonly _tag: "SignInAttempted";
+    readonly registryHost?: never;
+    readonly handle?: never;
+}, RegistryAuthFailed | import("./errors.js").AuthLoginRequired | import("./errors.js").AuthTokenPolicyRequired | import("./errors.js").DeviceLoginDenied | import("./errors.js").DeviceLoginCodeExpired | import("./errors.js").DeviceAuthorizationPending | import("./errors.js").StepUpRequired | import("@agentxm/registry-client").RegistryProblem | import("@agentxm/registry-client").RegistryRequestFailed | import("@agentxm/registry-client").RegistryOperationFailed | import("./errors.js").AuthExchangeFailed | import("./errors.js").PublishAuthorizationPending | import("./errors.js").StepUpVerificationPending | import("./errors.js").AuthInteractionAbandoned, AuthClient | CredentialStore | AuthLoginPresenter | import("./pending-device-login-store.ts").PendingDeviceLoginStore | import("./device-login.js").DeviceLoginInteraction>;
+//# sourceMappingURL=login.d.ts.map

package/dist/src/login.js

@@ -0,0 +1,155 @@
+/**
+ * Sign-in orchestration: flag coherence, persisted-credential policy, the
+ * existing-session decision, strategy selection, and the loopback →
+ * device-code fallback chain.
+ *
+ * The capability decides; the application supplies presentation through
+ * `AuthLoginPresenter` and platform integration through
+ * `AuthLoginInteraction`. No sign-in decision is taken outside this module.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore, makePersistedCredentialsUnsupportedError } from "./credential-store.js";
+import { initiateDeviceLogin, resumeDeviceLogin, runDeviceLogin, } from "./device-login.js";
+import { RegistryAuthFailed } from "./errors.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { runLoopbackLogin } from "./loopback-login.js";
+import { selectLoginStrategy } from "./login-strategy.js";
+import { loginStrategyEnvironment } from "./internal/environment.js";
+const usage = (detail) => new RegistryAuthFailed({ category: "usage", detail });
+/**
+ * The device-login options one sign-in request means. Exported so the option
+ * shaping is provable without substituting the flow it is handed to.
+ */
+export const deviceLoginOptions = (request, openBrowser) => ({
+    openBrowser,
+    restart: request.restart,
+    ...(request.scopes.length === 0 ? {} : { scopes: [...request.scopes] }),
+});
+/** The resume options one `--wait` request means. */
+export const resumeLoginOptions = (request) => request.timeoutSeconds === undefined ? {} : { timeoutSeconds: request.timeoutSeconds };
+/**
+ * How a loopback sign-in that could not complete is classified.
+ *
+ * A failed bind is recoverable — device-code sign-in replaces it — while an
+ * expired wait or a rejected callback is terminal and leaves credentials
+ * untouched.
+ */
+export const classifyLoopbackFailure = (error) => error._tag === "LoopbackLoginFallback"
+    ? new RegistryAuthFailed({
+        category: "auth",
+        detail: "Browser sign-in expired after 5 minutes. No credentials were changed.",
+        suggestions: [
+            { description: "Try browser sign-in again.", cmd: "axm login" },
+            {
+                description: "Use device-code sign-in on a remote or headless machine.",
+                cmd: "axm login --device-code",
+            },
+        ],
+        cause: error,
+    })
+    : new RegistryAuthFailed({
+        category: "auth",
+        detail: error.reason === "access_denied"
+            ? "Sign-in was cancelled. No credentials were changed."
+            : "The authorization callback was invalid and sign-in could not be completed. Run `axm login` to try again.",
+        suggestions: [{ description: "Try signing in again.", cmd: "axm login" }],
+        cause: error,
+    });
+const rejectIncoherentFlags = (request) => request.wait && request.deviceCode
+    ? Option.some(usage("--wait resumes an existing device sign-in and cannot be combined with --device-code."))
+    : request.wait && request.restart
+        ? Option.some(usage("--restart starts a replacement device sign-in and cannot be combined with --wait."))
+        : request.restart && !request.deviceCode
+            ? Option.some(usage("--restart requires --device-code."))
+            : !request.wait && request.timeoutSeconds !== undefined
+                ? Option.some(usage("--timeout requires --wait."))
+                : Option.none();
+/**
+ * Decide whether a session that is still valid should be replaced.
+ *
+ * Preapproval answers the one question a valid session raises, so a new
+ * sign-in starts in every mode. Without it, a mode that cannot ask keeps the
+ * session; a mode that can, asks.
+ */
+const shouldReplaceValidSession = (request, handle) => Effect.gen(function* () {
+    const presenter = yield* AuthLoginPresenter;
+    if (request.yes) {
+        if (!request.machineOutput)
+            yield* presenter.noteExistingSession(handle);
+        return true;
+    }
+    if (request.nonInteractive || request.machineOutput)
+        return false;
+    yield* presenter.noteExistingSession(handle);
+    const decision = yield* presenter.confirmSessionReplacement("Log in with a different account?");
+    return decision === "replace";
+});
+export const login = Effect.fn("Login.run")(function* (request, registryUrl) {
+    const credentials = yield* CredentialStore;
+    const presenter = yield* AuthLoginPresenter;
+    const registryHost = new URL(registryUrl).host;
+    const incoherent = rejectIncoherentFlags(request);
+    if (Option.isSome(incoherent))
+        return yield* Effect.fail(incoherent.value);
+    if (!credentials.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    if (request.wait) {
+        yield* resumeDeviceLogin(registryUrl, resumeLoginOptions(request));
+        return { _tag: "PendingSignInResumed" };
+    }
+    const existing = yield* credentials.load(registryUrl);
+    if (Option.isSome(existing)) {
+        const authClient = yield* AuthClient;
+        const identity = yield* presenter.withProgress({ _tag: "CheckingRegistrySession", registryHost }, () => authClient.getMe(existing.value.access_token).pipe(Effect.option));
+        if (Option.isSome(identity)) {
+            if (!(yield* shouldReplaceValidSession(request, identity.value.userHandle))) {
+                return {
+                    _tag: "SessionRetained",
+                    registryHost,
+                    handle: identity.value.userHandle,
+                };
+            }
+        }
+        else if (!request.machineOutput) {
+            yield* presenter.noteRejectedStoredCredentials;
+        }
+    }
+    const strategy = selectLoginStrategy({ deviceCode: request.deviceCode, nonInteractive: request.nonInteractive }, yield* loginStrategyEnvironment);
+    const scopeOptions = request.scopes.length === 0 ? {} : { scopes: [...request.scopes] };
+    const deviceOptions = (openBrowser) => deviceLoginOptions(request, openBrowser);
+    if (strategy === "device-code") {
+        if (!request.deviceCode)
+            yield* presenter.noteDeviceCodeFallback("remote-or-headless");
+        if (request.nonInteractive) {
+            yield* initiateDeviceLogin(registryUrl, deviceOptions(false));
+        }
+        else {
+            yield* runDeviceLogin(registryUrl, deviceOptions(false));
+        }
+        return { _tag: "SignInAttempted" };
+    }
+    if (request.nonInteractive) {
+        return yield* new RegistryAuthFailed({
+            category: "auth",
+            detail: "Loopback browser sign-in requires an interactive terminal. Use device-code sign-in instead.",
+            suggestions: [
+                {
+                    description: "Use device-code sign-in on a remote or headless machine.",
+                    cmd: "axm login --device-code",
+                },
+            ],
+        });
+    }
+    yield* Effect.suspend(() => runLoopbackLogin(registryUrl, { ...scopeOptions })).pipe(Effect.catchTag("LoopbackLoginFallback", (error) => error.reason === "bind_failed"
+        ? presenter
+            .noteDeviceCodeFallback("loopback-bind-failed")
+            .pipe(Effect.andThen(runDeviceLogin(registryUrl, deviceOptions(true))))
+        : Effect.fail(classifyLoopbackFailure(error))), Effect.catchTag("LoopbackCallbackRejected", (error) => Effect.fail(classifyLoopbackFailure(error))));
+    return { _tag: "SignInAttempted" };
+});
+//# sourceMappingURL=login.js.map

package/dist/src/logout.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Sign-out: revoke the session at the Registry, then erase the selected
+ * Registry's stored credentials.
+ *
+ * The local erase is unconditional. A remote revoke that fails leaves a token
+ * that expires on its own, and the outcome says so rather than reporting a
+ * clean sign-out.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** What one `logout` invocation settled on. */
+export type LogoutOutcome = {
+    readonly _tag: "NotSignedIn";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "SignedOut";
+    readonly registryHost: string;
+    readonly handle?: string;
+    /** False when the Registry did not confirm the revoke; the token expires on its own. */
+    readonly revokedRemotely: boolean;
+};
+export declare const logout: (registryUrl: string) => Effect.Effect<{
+    readonly _tag: "NotSignedIn";
+    readonly registryHost: string;
+} | {
+    readonly revokedRemotely: boolean;
+    readonly handle?: string & import("effect/Brand").Brand<"Handle">;
+    readonly _tag: "SignedOut";
+    readonly registryHost: string;
+}, import("./errors.ts").RegistryAuthFailed, AuthClient | CredentialStore | AuthLoginPresenter>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/src/logout.js

@@ -0,0 +1,37 @@
+/**
+ * Sign-out: revoke the session at the Registry, then erase the selected
+ * Registry's stored credentials.
+ *
+ * The local erase is unconditional. A remote revoke that fails leaves a token
+ * that expires on its own, and the outcome says so rather than reporting a
+ * clean sign-out.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** `normalizeHandle("@unknown")` — the anonymous credential sentinel. */
+const ANONYMOUS_HANDLE = "@unknown";
+export const logout = Effect.fn("Logout.run")(function* (registryUrl) {
+    const authClient = yield* AuthClient;
+    const credentials = yield* CredentialStore;
+    const presenter = yield* AuthLoginPresenter;
+    const registryHost = new URL(registryUrl).host;
+    const existing = yield* credentials.load(registryUrl);
+    if (Option.isNone(existing)) {
+        return { _tag: "NotSignedIn", registryHost };
+    }
+    const revoked = yield* presenter.withProgress({ _tag: "RevokingRegistrySession", registryHost }, () => authClient.revokeToken(existing.value.refresh_token).pipe(Effect.option));
+    yield* credentials.clear(registryUrl);
+    const handle = existing.value.handle;
+    return {
+        _tag: "SignedOut",
+        registryHost,
+        ...(handle === ANONYMOUS_HANDLE ? {} : { handle }),
+        revokedRemotely: Option.isSome(revoked),
+    };
+});
+//# sourceMappingURL=logout.js.map

package/dist/src/selected-registry.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The Registry this invocation authenticates against.
+ *
+ * Which Registry is selected is transport configuration, so the value itself
+ * belongs to the Registry client. What a caller needs from it is an
+ * authentication concern: the endpoint every use case in this package takes,
+ * and the host a person is told they are signing in to, signing out of, or
+ * identified on. Publishing both here is what lets a caller name the selected
+ * Registry without reaching into the transport package for its configuration
+ * tag.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { RegistryUrl } from "@agentxm/registry-client";
+/** The selected Registry, as an endpoint and as a host a person reads. */
+export interface SelectedRegistry {
+    /** The endpoint every registry-auth use case takes. */
+    readonly url: string;
+    /** The host, for the operation names and result documents that show it. */
+    readonly host: string;
+}
+/** Read the selected Registry's endpoint and its human-readable host. */
+export declare const selectedRegistry: Effect.Effect<SelectedRegistry, never, RegistryUrl>;
+//# sourceMappingURL=selected-registry.d.ts.map

package/dist/src/selected-registry.js

@@ -0,0 +1,18 @@
+/**
+ * The Registry this invocation authenticates against.
+ *
+ * Which Registry is selected is transport configuration, so the value itself
+ * belongs to the Registry client. What a caller needs from it is an
+ * authentication concern: the endpoint every use case in this package takes,
+ * and the host a person is told they are signing in to, signing out of, or
+ * identified on. Publishing both here is what lets a caller name the selected
+ * Registry without reaching into the transport package for its configuration
+ * tag.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { RegistryUrl } from "@agentxm/registry-client";
+/** Read the selected Registry's endpoint and its human-readable host. */
+export const selectedRegistry = Effect.map(RegistryUrl, (url) => ({ url, host: new URL(url).host }));
+//# sourceMappingURL=selected-registry.js.map

package/dist/src/step-up.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Step-up verification: the protocol that carries one challenged Registry
+ * write through human verification and retries it exactly once.
+ *
+ * The capability owns challenge detection, request-reference validation,
+ * resumption and terminal-status rules, expiry, the bounded wait, and the
+ * retry-once contract. The application supplies only presentation and browser
+ * launch through the login presenter and interaction ports.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { StepUpVerificationPending, type AuthError } from "./errors.js";
+import { AuthLoginInteraction } from "./login-interaction.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+/** How one challenged write names itself to a person watching the terminal. */
+export interface StepUpPresentation {
+    /** Lifecycle label for the challenged write itself. */
+    readonly operationLabel: string;
+    /** Lifecycle label for the bounded wait on human verification. */
+    readonly waitingLabel: string;
+}
+/** The invocation's verification inputs, parsed from the command line. */
+export interface StepUpOptions {
+    /** Resume this exact pending request instead of issuing a fresh challenge. */
+    readonly resumeReference?: string;
+    /** Bounded wait, in whole seconds, for the person to verify. */
+    readonly waitForHumanSeconds?: number;
+    /** No terminal is available to guide a person through verification. */
+    readonly unattended: boolean;
+}
+/** A challenged write that completed, and whether verification was needed. */
+export interface VerifiedWrite<A> {
+    readonly value: A;
+    readonly stepUpCompleted: boolean;
+}
+/**
+ * Run a Registry write that may be challenged, carry the challenge through
+ * human verification, and retry the write exactly once with the verified
+ * request id.
+ *
+ * The write is never replayed without verification, and a wait that elapses
+ * while the request is still valid resolves to `StepUpVerificationPending`
+ * rather than a failure of the write.
+ */
+export declare const runWithStepUp: <A, E, R>(operation: (stepUpRequestId?: string) => Effect.Effect<A, E, R>, presentation: StepUpPresentation, options: StepUpOptions, registryUrl: string) => Effect.Effect<VerifiedWrite<A>, E | AuthError | StepUpVerificationPending, R | AuthClient | AuthLoginInteraction | AuthLoginPresenter | CredentialStore>;
+//# sourceMappingURL=step-up.d.ts.map