@agentxm/registry-auth 0.28.4-bootstrap.0

package/dist/src/guard.js

@@ -0,0 +1,62 @@
+/**
+ * Auth guard combinator for commands that require authentication.
+ *
+ * Wraps an Effect with a pre-check for authentication. If no token is
+ * resolvable, fails immediately with an actionable error message directing
+ * the user to `axm login`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { RegistryUrl } from "@agentxm/registry-client";
+import { authLoginRequired, RegistryAuthFailed } from "./errors.js";
+import { CredentialStore, makePersistedCredentialsUnsupportedError } from "./credential-store.js";
+import { resolveRequestToken } from "./token-resolution.js";
+// -----------------------------------------------------------------------------
+// Constants
+// -----------------------------------------------------------------------------
+const AUTH_LOGIN_REQUIRED = authLoginRequired();
+// -----------------------------------------------------------------------------
+// Auth guard combinator
+// -----------------------------------------------------------------------------
+const isRemoteRegistryUrl = (registryUrl) => Effect.try({
+    try: () => {
+        const protocol = new URL(registryUrl).protocol;
+        return protocol === "http:" || protocol === "https:";
+    },
+    catch: (error) => new RegistryAuthFailed({
+        category: "validation",
+        detail: `Invalid registry URL: ${registryUrl}`,
+        suggestions: [{ description: "Check the registry URL in your settings." }],
+        cause: error,
+    }),
+});
+/**
+ * Wraps an Effect with an auth guard.
+ *
+ * - If the target registry is local, runs the inner effect directly.
+ * - If a token is already resolvable, runs the inner effect directly.
+ * - If no token: fails with `AUTH_LOGIN_REQUIRED`.
+ */
+export const withAuthGuard = (effect, options) => Effect.gen(function* () {
+    const defaultRegistryUrl = yield* RegistryUrl;
+    const targetRegistryUrl = options?.registryUrl ?? defaultRegistryUrl;
+    // Local registries do not require HTTP auth.
+    const isRemote = yield* isRemoteRegistryUrl(targetRegistryUrl);
+    if (!isRemote) {
+        return yield* effect;
+    }
+    const token = yield* resolveRequestToken(targetRegistryUrl, defaultRegistryUrl);
+    // Token available — proceed directly
+    if (Option.isSome(token)) {
+        return yield* effect;
+    }
+    const credStore = yield* CredentialStore;
+    if (!credStore.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    // No token — fail fast
+    return yield* AUTH_LOGIN_REQUIRED;
+});
+//# sourceMappingURL=guard.js.map

package/dist/src/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Registry-auth feature: login, logout, token, identity inspection, device
+ * and loopback flows, and credential lifecycle.
+ *
+ * Provides credential storage, environment detection, token resolution,
+ * auth middleware, and device login orchestration for authentication.
+ * Environment-backed Layers live behind `./live`; deterministic in-memory
+ * ports live behind `./testing`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+export { AuthExchangeFailed, AuthLoginRequired, AuthTokenPolicyRequired, authLoginRequired, DeviceAuthorizationPending, DeviceLoginCodeExpired, DeviceLoginDenied, isAuthError, isRegistryAuthFailure, REGISTRY_AUTH_ERROR_CATEGORIES, RegistryAuthFailed, StepUpRequired, type AuthError, type RegistryAuthErrorCategory, type RegistryAuthFailure, type StepUpRequest, } from "./errors.js";
+export type { CredentialEntry, CredentialFile, StorageTier, StoredCredentials, TokenSource, } from "./schema.js";
+export { CredentialEntrySchema, CredentialFileSchema, CredentialStoreTokenSource, EnvVarTokenSource, FileTokenSource, FlagTokenSource, RegistryAccountsSchema, } from "./schema.js";
+export type { CredentialStoreService, EnvironmentInfo } from "./credential-store.js";
+export { canUsePersistedCredentials, CredentialStore, detectEnvironment, makePersistedCredentialsUnsupportedError, selectTier, } from "./credential-store.js";
+export type { PendingDeviceLogin, PendingDeviceLoginStoreService, } from "./pending-device-login-store.js";
+export { PendingDeviceLoginSchema, PendingDeviceLoginStore } from "./pending-device-login-store.js";
+export { getCurrentUserHandle, resolveRequiredToken, resolveToken, resolveStoredToken, refreshStoredToken, resolveAmbientToken, resolveRequestToken, } from "./token-resolution.js";
+export type { AuthClientService, CreateTokenOptions, CreatePublishAuthorizationRequestParams, DeviceFlowResponse, ExchangePublishAuthorizationCodeParams, MeResponse, PollResult, PublishAuthorizationRequestResponse, PublishCapabilityResponse, } from "./auth-client.js";
+export { AuthClient, pollOnce, readStepUpRequest } from "./auth-client.js";
+export type { NormalizedTokenResponse } from "./oauth-contract.js";
+export type { DeviceLoginPendingResult, DeviceLoginInteractionService, ResumeDeviceLoginOptions, } from "./device-login.js";
+export { DeviceLoginPendingDocumentSchema, DeviceLoginPendingResultSchema, DeviceLoginInteraction, initiateDeviceLogin, resumeDeviceLogin, runDeviceLogin, type RunDeviceLoginOptions, } from "./device-login.js";
+export { makeOAuthState, makePkceChallenge, makePkceVerifier, runLoopbackLogin, type RunLoopbackLoginOptions, } from "./loopback-login.js";
+export { LoopbackCallbackRejected, LoopbackLoginFallback, startLoopbackServer, } from "./loopback-server.js";
+export { LoginDocumentSchema, LoginResultSchema, makeLoginResult, type LoginDocument, type LoginResult, } from "./login-output.js";
+export type { AuthLoginPresenterService, AuthLoginProgress, DeviceFlowPresentation, } from "./login-presenter.js";
+export { AuthLoginPresenter } from "./login-presenter.js";
+export { runPublishAuthorization, type PublishAuthorizationInput, } from "./publish-authorization.js";
+export { selectLoginStrategy, type LoginStrategy, type LoginStrategyEnvironment, type LoginStrategyOptions, } from "./login-strategy.js";
+export type { AuthLoginInteractionService } from "./login-interaction.js";
+export { AuthLoginInteraction } from "./login-interaction.js";
+export { withAuthGuard } from "./guard.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.js

@@ -0,0 +1,31 @@
+/**
+ * Registry-auth feature: login, logout, token, identity inspection, device
+ * and loopback flows, and credential lifecycle.
+ *
+ * Provides credential storage, environment detection, token resolution,
+ * auth middleware, and device login orchestration for authentication.
+ * Environment-backed Layers live behind `./live`; deterministic in-memory
+ * ports live behind `./testing`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+// Typed failures
+export { AuthExchangeFailed, AuthLoginRequired, AuthTokenPolicyRequired, authLoginRequired, DeviceAuthorizationPending, DeviceLoginCodeExpired, DeviceLoginDenied, isAuthError, isRegistryAuthFailure, REGISTRY_AUTH_ERROR_CATEGORIES, RegistryAuthFailed, StepUpRequired, } from "./errors.js";
+export { CredentialEntrySchema, CredentialFileSchema, CredentialStoreTokenSource, EnvVarTokenSource, FileTokenSource, FlagTokenSource, RegistryAccountsSchema, } from "./schema.js";
+export { canUsePersistedCredentials, CredentialStore, detectEnvironment, makePersistedCredentialsUnsupportedError, selectTier, } from "./credential-store.js";
+export { PendingDeviceLoginSchema, PendingDeviceLoginStore } from "./pending-device-login-store.js";
+// Token resolution
+export { getCurrentUserHandle, resolveRequiredToken, resolveToken, resolveStoredToken, refreshStoredToken, resolveAmbientToken, resolveRequestToken, } from "./token-resolution.js";
+export { AuthClient, pollOnce, readStepUpRequest } from "./auth-client.js";
+export { DeviceLoginPendingDocumentSchema, DeviceLoginPendingResultSchema, DeviceLoginInteraction, initiateDeviceLogin, resumeDeviceLogin, runDeviceLogin, } from "./device-login.js";
+export { makeOAuthState, makePkceChallenge, makePkceVerifier, runLoopbackLogin, } from "./loopback-login.js";
+export { LoopbackCallbackRejected, LoopbackLoginFallback, startLoopbackServer, } from "./loopback-server.js";
+export { LoginDocumentSchema, LoginResultSchema, makeLoginResult, } from "./login-output.js";
+export { AuthLoginPresenter } from "./login-presenter.js";
+export { runPublishAuthorization, } from "./publish-authorization.js";
+export { selectLoginStrategy, } from "./login-strategy.js";
+export { AuthLoginInteraction } from "./login-interaction.js";
+// Auth guard combinator
+export { withAuthGuard } from "./guard.js";
+//# sourceMappingURL=index.js.map

package/dist/src/internal/environment.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Runtime environment detection for credential policy and login flows.
+ *
+ * Pure functions for env var / process checks. Effect-based for filesystem
+ * checks. Mirrors the shared helpers the extracted kernels carry; a generic
+ * utils package is deliberately not created.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+/** Read an optional env var. Centralized access point for process.env. */
+export declare const envOption: (name: string) => Effect.Effect<Option.Option<string>>;
+/** Returns true if SSH_CLIENT or SSH_TTY env var is set. */
+export declare const isSSH: Effect.Effect<boolean>;
+/** Returns true if running as root (uid 0). */
+export declare const isRoot: () => boolean;
+/** Returns true if /.dockerenv or /.containerenv exists. Requires FileSystem. */
+export declare const isContainer: Effect.Effect<boolean, never, FileSystem.FileSystem>;
+/** Returns true if /proc/version contains "microsoft". Requires FileSystem. */
+export declare const isWSL: Effect.Effect<boolean, never, FileSystem.FileSystem>;
+/** Returns true if CI env var is set. */
+export declare const isCI: Effect.Effect<boolean>;
+//# sourceMappingURL=environment.d.ts.map

package/dist/src/internal/environment.js

@@ -0,0 +1,45 @@
+/**
+ * Runtime environment detection for credential policy and login flows.
+ *
+ * Pure functions for env var / process checks. Effect-based for filesystem
+ * checks. Mirrors the shared helpers the extracted kernels carry; a generic
+ * utils package is deliberately not created.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+// eslint-disable-next-line no-restricted-properties -- Centralized env var access point; all callers use these helpers
+const readEnv = (name) => process.env[name];
+/** Read an optional env var. Centralized access point for process.env. */
+export const envOption = (name) => Effect.sync(() => Option.fromUndefinedOr(readEnv(name)));
+/** Returns true if SSH_CLIENT or SSH_TTY env var is set. */
+export const isSSH = Effect.sync(() => readEnv("SSH_CLIENT") !== undefined || readEnv("SSH_TTY") !== undefined);
+/** Returns true if running as root (uid 0). */
+export const isRoot = () => process.getuid?.() === 0;
+/** Returns true if /.dockerenv or /.containerenv exists. Requires FileSystem. */
+export const isContainer = Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const dockerExists = yield* fs
+        .exists("/.dockerenv")
+        .pipe(Effect.catch(() => Effect.succeed(false)));
+    if (dockerExists)
+        return true;
+    const containerExists = yield* fs
+        .exists("/.containerenv")
+        .pipe(Effect.catch(() => Effect.succeed(false)));
+    return containerExists;
+});
+/** Returns true if /proc/version contains "microsoft". Requires FileSystem. */
+export const isWSL = Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const exists = yield* fs.exists("/proc/version").pipe(Effect.catch(() => Effect.succeed(false)));
+    if (!exists)
+        return false;
+    const content = yield* fs
+        .readFileString("/proc/version")
+        .pipe(Effect.catch(() => Effect.succeed("")));
+    return /microsoft/i.test(content);
+});
+/** Returns true if CI env var is set. */
+export const isCI = Effect.map(envOption("CI"), (value) => Option.exists(value, (raw) => raw.length > 0 && raw !== "0" && raw.toLowerCase() !== "false"));
+//# sourceMappingURL=environment.js.map

package/dist/src/live.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Environment-backed Layers for the registry-auth feature. Only application
+ * composition imports this module; feature logic keeps service requirements
+ * in its Effect environment.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export { AuthClientLive } from "./auth-client.js";
+export { AuthMiddlewareLive, makeAuthMiddlewareLive } from "./auth-middleware.js";
+export { CredentialStoreLive, CredentialStoreSessionLive } from "./credential-store.js";
+export { AuthLoginInteractionLive } from "./login-interaction.js";
+export { PendingDeviceLoginStoreLive } from "./pending-device-login-store.js";
+//# sourceMappingURL=live.d.ts.map

package/dist/src/live.js

@@ -0,0 +1,13 @@
+/**
+ * Environment-backed Layers for the registry-auth feature. Only application
+ * composition imports this module; feature logic keeps service requirements
+ * in its Effect environment.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export { AuthClientLive } from "./auth-client.js";
+export { AuthMiddlewareLive, makeAuthMiddlewareLive } from "./auth-middleware.js";
+export { CredentialStoreLive, CredentialStoreSessionLive } from "./credential-store.js";
+export { AuthLoginInteractionLive } from "./login-interaction.js";
+export { PendingDeviceLoginStoreLive } from "./pending-device-login-store.js";
+//# sourceMappingURL=live.js.map

package/dist/src/login-interaction.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Auth login interaction service.
+ *
+ * Best-effort platform integration for browser launch and clipboard copy.
+ * Provides both the CLI-specific AuthLoginInteraction and the core
+ * DeviceLoginInteraction service (used by core's runDeviceLogin).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/Context";
+import type { ChildProcessSpawner as ChildProcessSpawnerService } from "effect/unstable/process/ChildProcessSpawner";
+import { DeviceLoginInteraction } from "./device-login.js";
+interface CommandInvocation {
+    readonly command: string;
+    readonly args: ReadonlyArray<string>;
+    readonly stdinText?: string;
+}
+export interface AuthLoginInteractionService {
+    readonly openBrowser: (url: string) => Effect.Effect<boolean>;
+    readonly copyToClipboard: (text: string) => Effect.Effect<boolean>;
+}
+declare const AuthLoginInteraction_base: ServiceMap.ServiceClass<AuthLoginInteraction, "@agentxm/registry-auth/login-interaction/AuthLoginInteraction", AuthLoginInteractionService>;
+export declare class AuthLoginInteraction extends AuthLoginInteraction_base {
+}
+export declare const browserCommands: (url: string, platform?: NodeJS.Platform) => ReadonlyArray<CommandInvocation>;
+export declare const AuthLoginInteractionLive: Layer.Layer<DeviceLoginInteraction | AuthLoginInteraction, never, ChildProcessSpawnerService>;
+export interface AuthLoginInteractionTestState {
+    readonly openBrowserCalls: Array<string>;
+    readonly copyToClipboardCalls: Array<string>;
+}
+export declare const AuthLoginInteractionTest: (overrides?: {
+    readonly openBrowser?: (url: string) => Effect.Effect<boolean>;
+    readonly copyToClipboard?: (text: string) => Effect.Effect<boolean>;
+}) => {
+    layer: Layer.Layer<DeviceLoginInteraction | AuthLoginInteraction, never, never>;
+    state: AuthLoginInteractionTestState;
+};
+export {};
+//# sourceMappingURL=login-interaction.d.ts.map

package/dist/src/login-interaction.js

@@ -0,0 +1,108 @@
+/**
+ * Auth login interaction service.
+ *
+ * Best-effort platform integration for browser launch and clipboard copy.
+ * Provides both the CLI-specific AuthLoginInteraction and the core
+ * DeviceLoginInteraction service (used by core's runDeviceLogin).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/Context";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+import { DeviceLoginInteraction } from "./device-login.js";
+export class AuthLoginInteraction extends ServiceMap.Service()("@agentxm/registry-auth/login-interaction/AuthLoginInteraction") {
+}
+/**
+ * Best-effort command execution: `true` only when the process exits with code
+ * 0; every failure (spawn, stdin write, signal termination) collapses to
+ * `false`.
+ *
+ * The previous `node:child_process` implementation passed `windowsHide: true`;
+ * `ChildProcess.CommandOptions` has no equivalent, so a transient console
+ * window may appear on Windows.
+ */
+const runCommand = (spawner, invocation) => Effect.gen(function* () {
+    const handle = yield* spawner.spawn(ChildProcess.make(invocation.command, invocation.args, {
+        // Browser and clipboard helpers have no cwd-dependent behavior. Core
+        // deliberately does not depend on the CLI execution-directory service.
+        stdin: invocation.stdinText === undefined ? "ignore" : "pipe",
+        stdout: "ignore",
+        stderr: "ignore",
+    }));
+    if (invocation.stdinText !== undefined) {
+        // Write the payload, then close stdin (the handle's sink ends the pipe
+        // when the stream completes) so clipboard commands finish reading.
+        yield* Stream.run(Stream.make(new TextEncoder().encode(invocation.stdinText)), handle.stdin);
+    }
+    return (yield* handle.exitCode) === 0;
+}).pipe(Effect.scoped, Effect.catch(() => Effect.succeed(false)));
+const tryCommands = (spawner, invocations) => Effect.gen(function* () {
+    for (const invocation of invocations) {
+        const succeeded = yield* runCommand(spawner, invocation);
+        if (succeeded) {
+            return true;
+        }
+    }
+    return false;
+});
+export const browserCommands = (url, platform = process.platform) => {
+    switch (platform) {
+        case "darwin":
+            return [{ command: "open", args: [url] }];
+        case "win32":
+            return [
+                {
+                    command: "rundll32",
+                    args: ["url.dll,FileProtocolHandler", url],
+                },
+            ];
+        default:
+            return [{ command: "xdg-open", args: [url] }];
+    }
+};
+const clipboardCommands = (text) => {
+    switch (process.platform) {
+        case "darwin":
+            return [{ command: "pbcopy", args: [], stdinText: text }];
+        case "win32":
+            return [{ command: "clip", args: [], stdinText: text }];
+        default:
+            return [
+                { command: "wl-copy", args: [], stdinText: text },
+                { command: "xclip", args: ["-selection", "clipboard"], stdinText: text },
+                { command: "xsel", args: ["--clipboard", "--input"], stdinText: text },
+            ];
+    }
+};
+const makeInteraction = Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const impl = {
+        openBrowser: (url) => tryCommands(spawner, browserCommands(url)),
+        copyToClipboard: (text) => tryCommands(spawner, clipboardCommands(text)),
+    };
+    return impl;
+});
+export const AuthLoginInteractionLive = Layer.mergeAll(Layer.effect(AuthLoginInteraction, Effect.map(makeInteraction, (impl) => impl)), Layer.effect(DeviceLoginInteraction, makeInteraction));
+export const AuthLoginInteractionTest = (overrides) => {
+    const state = {
+        openBrowserCalls: [],
+        copyToClipboardCalls: [],
+    };
+    const impl = {
+        openBrowser: (url) => Effect.gen(function* () {
+            state.openBrowserCalls.push(url);
+            return yield* overrides?.openBrowser?.(url) ?? Effect.succeed(false);
+        }),
+        copyToClipboard: (text) => Effect.gen(function* () {
+            state.copyToClipboardCalls.push(text);
+            return yield* overrides?.copyToClipboard?.(text) ?? Effect.succeed(false);
+        }),
+    };
+    const layer = Layer.mergeAll(Layer.succeed(AuthLoginInteraction, impl), Layer.succeed(DeviceLoginInteraction, impl));
+    return { layer, state };
+};
+//# sourceMappingURL=login-interaction.js.map

package/dist/src/login-output.d.ts

@@ -0,0 +1,22 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import type { Handle } from "@agentxm/extension-model/unstable/extensions/handle";
+import { AuthLoginPresenter } from "./login-presenter.js";
+export declare const LoginResultSchema: Schema.Struct<{
+    readonly status: Schema.Literal<"logged-in">;
+    readonly registryHost: Schema.String;
+    readonly handle: Schema.optional<Schema.String>;
+}>;
+export declare const LoginDocumentSchema: Schema.Struct<{
+    result: Schema.Struct<{
+        readonly status: Schema.Literal<"logged-in">;
+        readonly registryHost: Schema.String;
+        readonly handle: Schema.optional<Schema.String>;
+    }>;
+}>;
+export type LoginResult = typeof LoginResultSchema.Type;
+export type LoginDocument = typeof LoginDocumentSchema.Type;
+export declare const makeLoginResult: (registryUrl: string, handle: Option.Option<Handle>) => LoginResult;
+export declare const emitLoginSuccess: (registryUrl: string, handle: Option.Option<Handle>) => Effect.Effect<void, never, AuthLoginPresenter>;
+//# sourceMappingURL=login-output.d.ts.map

package/dist/src/login-output.js

@@ -0,0 +1,32 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { AuthLoginPresenter } from "./login-presenter.js";
+export const LoginResultSchema = Schema.Struct({
+    status: Schema.Literal("logged-in"),
+    registryHost: Schema.String,
+    handle: Schema.optional(Schema.String),
+});
+const LoginDocumentFields = {
+    result: LoginResultSchema,
+};
+export const LoginDocumentSchema = Schema.Struct(LoginDocumentFields);
+export const makeLoginResult = (registryUrl, handle) => {
+    const registryHost = new URL(registryUrl).host;
+    return Option.match(handle, {
+        onNone: () => ({
+            status: "logged-in",
+            registryHost,
+        }),
+        onSome: (userHandle) => ({
+            status: "logged-in",
+            registryHost,
+            handle: userHandle,
+        }),
+    });
+};
+export const emitLoginSuccess = (registryUrl, handle) => Effect.gen(function* () {
+    const presenter = yield* AuthLoginPresenter;
+    yield* presenter.emitLoginSuccess(makeLoginResult(registryUrl, handle));
+});
+//# sourceMappingURL=login-output.js.map

package/dist/src/login-presenter.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Auth login presentation seam.
+ *
+ * The device, loopback, and publish-authorization flows report progress and
+ * present sign-in guidance exclusively through this service. The CLI runtime
+ * provides the renderer-backed implementation; wording, suggestion sets, and
+ * machine-mode document emission belong to that implementation, never to the
+ * auth feature.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/Context";
+import type { DeviceLoginPendingResult } from "./device-login.js";
+import type { LoginResult } from "./login-output.js";
+export type AuthLoginProgress = {
+    readonly _tag: "StartingDeviceAuthorization";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "WaitingForDeviceAuthorization";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "SavingCredentials";
+    readonly registryHost: string;
+} | {
+    readonly _tag: "WaitingForLoopbackAuthorization";
+    readonly registryHost: string;
+    readonly timeoutMinutes: number;
+} | {
+    readonly _tag: "CompletingSignIn";
+    readonly registryHost: string;
+};
+export interface DeviceFlowPresentation {
+    readonly verificationUri: string;
+    readonly verificationUriComplete: string;
+    readonly userCode: string;
+    readonly expiresInSeconds: number;
+    readonly browserOpened: boolean;
+    readonly copiedToClipboard: boolean;
+}
+export interface AuthLoginPresenterService {
+    /** Progress envelope for one login phase. */
+    readonly withProgress: <A, E, R>(progress: AuthLoginProgress, run: () => Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+    /**
+     * Machine-mode pending-document emission. Returns true when machine output
+     * consumed the result — the caller must then skip browser/clipboard side
+     * effects and human presentation.
+     */
+    readonly tryEmitPendingDeviceLogin: (result: DeviceLoginPendingResult) => Effect.Effect<boolean>;
+    /** Human presentation of the device flow after side effects have settled. */
+    readonly presentDeviceFlow: (presentation: DeviceFlowPresentation) => Effect.Effect<void>;
+    /** Human-path tail: sign-in is waiting for approval, with resume guidance. */
+    readonly notePendingApproval: (result: DeviceLoginPendingResult) => Effect.Effect<void>;
+    /** Machine login-document emission with human success fallback. */
+    readonly emitLoginSuccess: (result: LoginResult) => Effect.Effect<void>;
+    readonly presentLoopbackStart: (start: {
+        readonly redirectUri: string;
+        readonly authorizeUrl: string;
+    }) => Effect.Effect<void>;
+    readonly noteLoopbackBrowserOutcome: (opened: boolean) => Effect.Effect<void>;
+    readonly notePublishReview: (review: {
+        readonly browserOpened: boolean;
+        readonly candidateCount: number;
+        readonly authorizationUrl: string;
+    }) => Effect.Effect<void>;
+}
+declare const AuthLoginPresenter_base: ServiceMap.ServiceClass<AuthLoginPresenter, "@agentxm/registry-auth/login-presenter/AuthLoginPresenter", AuthLoginPresenterService>;
+export declare class AuthLoginPresenter extends AuthLoginPresenter_base {
+}
+export interface AuthLoginPresenterTestState {
+    readonly progress: Array<AuthLoginProgress>;
+    readonly pendingEmissions: Array<DeviceLoginPendingResult>;
+    readonly deviceFlowPresentations: Array<DeviceFlowPresentation>;
+    readonly pendingApprovals: Array<DeviceLoginPendingResult>;
+    readonly loginSuccesses: Array<LoginResult>;
+    readonly loopbackStarts: Array<{
+        readonly redirectUri: string;
+        readonly authorizeUrl: string;
+    }>;
+    readonly loopbackBrowserOutcomes: Array<boolean>;
+    readonly publishReviews: Array<{
+        readonly browserOpened: boolean;
+        readonly candidateCount: number;
+        readonly authorizationUrl: string;
+    }>;
+}
+export declare const AuthLoginPresenterTest: (overrides?: {
+    readonly tryEmitPendingDeviceLogin?: (result: DeviceLoginPendingResult) => Effect.Effect<boolean>;
+}) => {
+    layer: Layer.Layer<AuthLoginPresenter, never, never>;
+    state: AuthLoginPresenterTestState;
+};
+export {};
+//# sourceMappingURL=login-presenter.d.ts.map

package/dist/src/login-presenter.js

@@ -0,0 +1,58 @@
+/**
+ * Auth login presentation seam.
+ *
+ * The device, loopback, and publish-authorization flows report progress and
+ * present sign-in guidance exclusively through this service. The CLI runtime
+ * provides the renderer-backed implementation; wording, suggestion sets, and
+ * machine-mode document emission belong to that implementation, never to the
+ * auth feature.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/Context";
+export class AuthLoginPresenter extends ServiceMap.Service()("@agentxm/registry-auth/login-presenter/AuthLoginPresenter") {
+}
+export const AuthLoginPresenterTest = (overrides) => {
+    const state = {
+        progress: [],
+        pendingEmissions: [],
+        deviceFlowPresentations: [],
+        pendingApprovals: [],
+        loginSuccesses: [],
+        loopbackStarts: [],
+        loopbackBrowserOutcomes: [],
+        publishReviews: [],
+    };
+    const layer = Layer.succeed(AuthLoginPresenter, {
+        withProgress: (progress, run) => Effect.suspend(() => {
+            state.progress.push(progress);
+            return run();
+        }),
+        tryEmitPendingDeviceLogin: (result) => Effect.gen(function* () {
+            state.pendingEmissions.push(result);
+            return yield* overrides?.tryEmitPendingDeviceLogin?.(result) ?? Effect.succeed(false);
+        }),
+        presentDeviceFlow: (presentation) => Effect.sync(() => {
+            state.deviceFlowPresentations.push(presentation);
+        }),
+        notePendingApproval: (result) => Effect.sync(() => {
+            state.pendingApprovals.push(result);
+        }),
+        emitLoginSuccess: (result) => Effect.sync(() => {
+            state.loginSuccesses.push(result);
+        }),
+        presentLoopbackStart: (start) => Effect.sync(() => {
+            state.loopbackStarts.push(start);
+        }),
+        noteLoopbackBrowserOutcome: (opened) => Effect.sync(() => {
+            state.loopbackBrowserOutcomes.push(opened);
+        }),
+        notePublishReview: (review) => Effect.sync(() => {
+            state.publishReviews.push(review);
+        }),
+    });
+    return { layer, state };
+};
+//# sourceMappingURL=login-presenter.js.map

package/dist/src/login-strategy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Login strategy selection for interactive auth commands.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export type LoginStrategy = "loopback" | "device-code";
+export interface LoginStrategyOptions {
+    readonly deviceCode: boolean;
+    readonly nonInteractive: boolean;
+}
+export interface LoginStrategyEnvironment {
+    readonly SSH_CONNECTION?: string;
+    readonly SSH_CLIENT?: string;
+    readonly SSH_TTY?: string;
+    readonly DISPLAY?: string;
+    readonly WAYLAND_DISPLAY?: string;
+    readonly CI?: string;
+    readonly CODESPACES?: string;
+}
+export declare const selectLoginStrategy: (options: LoginStrategyOptions, env: LoginStrategyEnvironment) => LoginStrategy;
+//# sourceMappingURL=login-strategy.d.ts.map

package/dist/src/login-strategy.js

@@ -0,0 +1,25 @@
+/**
+ * Login strategy selection for interactive auth commands.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+const isTruthyEnvValue = (value) => value !== undefined && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+const isSshWithoutDisplay = (env) => {
+    const hasSsh = isTruthyEnvValue(env.SSH_CONNECTION) ||
+        isTruthyEnvValue(env.SSH_CLIENT) ||
+        isTruthyEnvValue(env.SSH_TTY);
+    const hasDisplay = isTruthyEnvValue(env.DISPLAY) || isTruthyEnvValue(env.WAYLAND_DISPLAY);
+    return hasSsh && !hasDisplay;
+};
+export const selectLoginStrategy = (options, env) => {
+    if (options.deviceCode || options.nonInteractive)
+        return "device-code";
+    if (isSshWithoutDisplay(env))
+        return "device-code";
+    if (isTruthyEnvValue(env.CI))
+        return "device-code";
+    if (isTruthyEnvValue(env.CODESPACES))
+        return "device-code";
+    return "loopback";
+};
+//# sourceMappingURL=login-strategy.js.map