@agentxm/registry-auth 0.28.4-bootstrap.0

package/LICENSE

@@ -0,0 +1,110 @@
+# Functional Source License, Version 1.1, MIT Future License
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2025-2026 AgentXM, Inc.
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/src/auth-client.d.ts

@@ -0,0 +1,199 @@
+/**
+ * AuthClient Effect service — device flow login, token refresh, revocation, identity queries.
+ *
+ * Provides methods for the OAuth 2.0 Device Authorization Grant (RFC 8628)
+ * and related auth operations against the AgentXM registry API.
+ *
+ * Uses the generated registry client for HTTP transport and surfaces typed
+ * auth and registry failures; the application boundary owns envelope
+ * rendering.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as DateTime from "effect/DateTime";
+import * as ServiceMap from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { type Handle } from "@agentxm/extension-model/unstable/extensions/handle";
+import { type PublishVisibility } from "@agentxm/registry-protocol/unstable/publish/visibility";
+import { type PreviewPublicationSetRequest, type PreviewPublicationSetResponse, type Sha256Hex } from "@agentxm/registry-protocol/unstable/registry/publication-set";
+import { type NormalizedTokenResponse } from "./oauth-contract.js";
+import { RegistryUrl } from "@agentxm/registry-client";
+import { type AuthError, type StepUpRequest } from "./errors.js";
+export declare const OIDC_LOGIN_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
+export declare const BASELINE_REGISTRY_LOGIN_SCOPES: readonly ["extensions:read", "account:read"];
+export declare const DEFAULT_LOGIN_SCOPES: readonly ["openid", "profile", "email", "offline_access", "extensions:read", "account:read"];
+export interface DeviceFlowResponse {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete: string;
+    readonly interval: number;
+    readonly expires_in: number;
+}
+export declare const normalizeRequestedLoginScopes: (scopes?: ReadonlyArray<string>) => ReadonlyArray<string>;
+export interface LoginScopeOptions {
+    readonly scopes?: ReadonlyArray<string>;
+}
+export interface MeResponse {
+    readonly userId: string;
+    readonly userHandle: Handle;
+    readonly email: string;
+    readonly tokenType: string;
+    readonly scopes: ReadonlyArray<string>;
+    readonly orgs: ReadonlyArray<{
+        readonly id: string;
+        readonly handle: Handle;
+    }>;
+}
+export interface WhoamiResponse {
+    readonly handle: Handle;
+}
+export interface TokenPermissionsRequest {
+    readonly owners?: ReadonlyArray<string>;
+    readonly extensions?: ReadonlyArray<string>;
+    readonly permission?: "read" | "publish" | "admin";
+    readonly org_permission?: "read" | "write" | "admin";
+    readonly cidr?: ReadonlyArray<string>;
+    readonly bypass_mfa?: boolean;
+}
+export interface CreateTokenParams {
+    readonly name: string;
+    readonly expiresIn: number;
+    readonly permissions: TokenPermissionsRequest;
+}
+export interface CreatedTokenResponse {
+    readonly id: string;
+    readonly token: string;
+    readonly name: string;
+    readonly scopes: ReadonlyArray<string>;
+    readonly permissions: unknown;
+    readonly createdAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+}
+export interface TokenListItem {
+    readonly id: string;
+    readonly name: string | null;
+    readonly type: string;
+    readonly scopes: ReadonlyArray<string>;
+    readonly permissions: unknown;
+    readonly createdAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly lastUsedAt: DateTime.Utc | null;
+}
+export interface TokenListResponse {
+    readonly tokens: ReadonlyArray<TokenListItem>;
+    readonly hasMore: boolean;
+    readonly cursor: string | null;
+}
+export interface DeleteTokenOptions {
+    readonly stepUpRequestId?: string;
+}
+export interface CreateTokenOptions {
+    readonly stepUpRequestId?: string;
+}
+export interface BuildAuthorizeUrlParams {
+    readonly challenge: string;
+    readonly expiresAt?: DateTime.Utc;
+    readonly state: string;
+    readonly redirectUri: string;
+    readonly scopes?: ReadonlyArray<string>;
+}
+export interface ExchangePkceCodeParams {
+    readonly code: string;
+    readonly verifier: string;
+    readonly redirectUri: string;
+}
+export interface CreatePublishAuthorizationRequestParams {
+    readonly registryUrl: string;
+    readonly redirectUri: string;
+    readonly state: string;
+    readonly codeChallenge: string;
+    readonly publicationSet: PreviewPublicationSetRequest;
+}
+export interface PublishAuthorizationRequestResponse {
+    readonly requestId: string;
+    readonly authorizationUrl: string;
+    readonly expiresAt: DateTime.Utc;
+}
+export interface ExchangePublishAuthorizationCodeParams {
+    readonly registryUrl: string;
+    readonly code: string;
+    readonly verifier: string;
+    readonly redirectUri: string;
+}
+export interface PublishCapabilityResponse {
+    readonly accessToken: string;
+    readonly expiresAt: DateTime.Utc;
+    readonly scope: string;
+    readonly publishRequestId: string;
+    readonly visibilityContract: "v2";
+    readonly visibility: PublishVisibility;
+    readonly condition: string;
+    readonly publicationSetDigest: Sha256Hex;
+    readonly publicationDescriptorDigest: Sha256Hex;
+}
+export type PublishAuthorizationExchangeResponse = {
+    readonly status: "admitted";
+    readonly preview: PreviewPublicationSetResponse;
+    readonly grants: ReadonlyArray<PublishCapabilityResponse>;
+} | {
+    readonly status: "blocked";
+    readonly preview: PreviewPublicationSetResponse;
+    readonly grants: readonly [];
+};
+/** Result of a single poll iteration. */
+export type PollResult = {
+    readonly _tag: "Pending";
+} | {
+    readonly _tag: "SlowDown";
+} | {
+    readonly _tag: "Success";
+    readonly token: NormalizedTokenResponse;
+} | {
+    readonly _tag: "AccessDenied";
+} | {
+    readonly _tag: "ExpiredToken";
+};
+export interface AuthClientService {
+    readonly buildAuthorizeUrl: (params: BuildAuthorizeUrlParams) => string;
+    readonly getAuthorizationIssuer: () => string;
+    readonly exchangePkceCode: (params: ExchangePkceCodeParams) => Effect.Effect<NormalizedTokenResponse, AuthError>;
+    readonly createPublishAuthorizationRequest: (params: CreatePublishAuthorizationRequestParams) => Effect.Effect<PublishAuthorizationRequestResponse, AuthError>;
+    readonly exchangePublishAuthorizationCode: (params: ExchangePublishAuthorizationCodeParams) => Effect.Effect<PublishAuthorizationExchangeResponse, AuthError>;
+    readonly initiateDeviceFlow: (options?: LoginScopeOptions) => Effect.Effect<DeviceFlowResponse, AuthError>;
+    readonly pollDeviceToken: (deviceCode: string, interval: number) => Effect.Effect<NormalizedTokenResponse, AuthError>;
+    readonly refreshToken: (refreshTokenValue: string) => Effect.Effect<NormalizedTokenResponse, AuthError>;
+    readonly revokeToken: (token: string) => Effect.Effect<void, AuthError>;
+    readonly getMe: (accessToken: string) => Effect.Effect<MeResponse, AuthError>;
+    readonly getWhoami: (accessToken: string) => Effect.Effect<WhoamiResponse, AuthError>;
+    readonly createToken: (accessToken: string, params: CreateTokenParams, options?: CreateTokenOptions) => Effect.Effect<CreatedTokenResponse, AuthError>;
+    readonly listTokens: (accessToken: string, params?: {
+        readonly limit?: number;
+        readonly cursor?: string;
+    }) => Effect.Effect<TokenListResponse, AuthError>;
+    readonly waitForStepUpRequest: (accessToken: string, statusUrl: string, intervalSeconds: number) => Effect.Effect<void, AuthError>;
+    readonly deleteToken: (accessToken: string, tokenId: string, options?: DeleteTokenOptions) => Effect.Effect<void, AuthError>;
+}
+declare const AuthClient_base: ServiceMap.ServiceClass<AuthClient, "@agentxm/registry-auth/auth-client/AuthClient", AuthClientService>;
+export declare class AuthClient extends AuthClient_base {
+}
+export declare const readStepUpRequest: (error: {
+    readonly metadata?: {
+        readonly response?: {
+            readonly body?: unknown;
+        } | undefined;
+    } | undefined;
+}) => StepUpRequest | null;
+/**
+ * Execute a single device token poll (exported for testing).
+ *
+ * Transient HTTP failures are collapsed into AUTH_LOGIN_FAILED; this seam does
+ * not retry on its own. For the retrying variant, use `pollDeviceToken`.
+ */
+export declare const pollOnce: (httpClient: HttpClient.HttpClient, registryUrl: string, deviceCode: string) => Effect.Effect<PollResult, AuthError>;
+export declare const AuthClientLive: Layer.Layer<AuthClient, never, HttpClient.HttpClient | RegistryUrl>;
+export declare const AuthClientTest: (overrides?: Partial<AuthClientService>) => Layer.Layer<AuthClient, never, never>;
+export {};
+//# sourceMappingURL=auth-client.d.ts.map