@agentxm/registry-auth 0.28.4-bootstrap.0

package/dist/src/loopback-login.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Authorization Code + PKCE login over a loopback redirect.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { DeviceLoginInteraction } from "./device-login.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { LoopbackCallbackRejected } from "./loopback-server.js";
+export interface RunLoopbackLoginOptions {
+    readonly scopes?: ReadonlyArray<string>;
+}
+export declare const makePkceVerifier: () => string;
+export declare const makePkceChallenge: (verifier: string) => string;
+export declare const makeOAuthState: () => string;
+export declare const runLoopbackLogin: (registryUrl: string, options?: RunLoopbackLoginOptions) => Effect.Effect<undefined, import("./errors.ts").AuthError | import("./loopback-server.js").LoopbackLoginFallback | LoopbackCallbackRejected, AuthClient | CredentialStore | AuthLoginPresenter | DeviceLoginInteraction>;
+//# sourceMappingURL=loopback-login.d.ts.map

package/dist/src/loopback-login.js

@@ -0,0 +1,91 @@
+/**
+ * Authorization Code + PKCE login over a loopback redirect.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import * as DateTime from "effect/DateTime";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { normalizeHandle } from "@agentxm/extension-model/unstable/extensions/handle";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore, makePersistedCredentialsUnsupportedError } from "./credential-store.js";
+import { DeviceLoginInteraction } from "./device-login.js";
+import { emitLoginSuccess } from "./login-output.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { LoopbackCallbackRejected, startLoopbackServer } from "./loopback-server.js";
+const UNKNOWN_HANDLE = normalizeHandle("@unknown");
+// Human approval window for the browser/login round trip. The issued
+// authorization code remains shorter-lived on the registry side.
+const LOOPBACK_TIMEOUT_MINUTES = 5;
+const LOOPBACK_TIMEOUT = Duration.minutes(LOOPBACK_TIMEOUT_MINUTES);
+export const makePkceVerifier = () => randomBytes(64).toString("base64url");
+export const makePkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+export const makeOAuthState = () => randomBytes(32).toString("base64url");
+const persistLoginCredentials = (registryUrl, token) => Effect.gen(function* () {
+    const authClient = yield* AuthClient;
+    const credStore = yield* CredentialStore;
+    const meResult = yield* authClient
+        .getMe(token.access_token)
+        .pipe(Effect.retry({ times: 1 }), Effect.option);
+    const handle = Option.match(meResult, {
+        onNone: () => UNKNOWN_HANDLE,
+        onSome: (me) => me.userHandle,
+    });
+    yield* credStore.save(registryUrl, handle, {
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        expires_at: token.expires_at,
+    });
+    return Option.map(meResult, (me) => me.userHandle);
+});
+export const runLoopbackLogin = (registryUrl, options = {}) => Effect.scoped(Effect.gen(function* () {
+    const authClient = yield* AuthClient;
+    const credStore = yield* CredentialStore;
+    const presenter = yield* AuthLoginPresenter;
+    const interaction = yield* DeviceLoginInteraction;
+    const registryHost = new URL(registryUrl).host;
+    if (!credStore.allowsPersistedCredentials) {
+        return yield* makePersistedCredentialsUnsupportedError();
+    }
+    const verifier = makePkceVerifier();
+    const challenge = makePkceChallenge(verifier);
+    const state = makeOAuthState();
+    const server = yield* startLoopbackServer(state);
+    const authorizeUrl = authClient.buildAuthorizeUrl({
+        challenge,
+        expiresAt: DateTime.addDuration(yield* DateTime.now, LOOPBACK_TIMEOUT),
+        state,
+        redirectUri: server.redirectUri,
+        ...(options.scopes === undefined ? {} : { scopes: options.scopes }),
+    });
+    yield* presenter.presentLoopbackStart({
+        redirectUri: server.redirectUri,
+        authorizeUrl,
+    });
+    const openedBrowser = yield* interaction.openBrowser(authorizeUrl);
+    yield* presenter.noteLoopbackBrowserOutcome(openedBrowser);
+    const callback = yield* presenter.withProgress({
+        _tag: "WaitingForLoopbackAuthorization",
+        registryHost,
+        timeoutMinutes: LOOPBACK_TIMEOUT_MINUTES,
+    }, () => server.awaitCallback(Duration.toMillis(LOOPBACK_TIMEOUT)));
+    const expectedIssuer = authClient.getAuthorizationIssuer();
+    if (callback.iss !== expectedIssuer) {
+        return yield* new LoopbackCallbackRejected({
+            reason: "invalid_callback",
+            message: "Authorization callback issuer did not match.",
+        });
+    }
+    const handle = yield* presenter.withProgress({ _tag: "CompletingSignIn", registryHost }, () => Effect.gen(function* () {
+        const token = yield* authClient.exchangePkceCode({
+            code: callback.code,
+            verifier,
+            redirectUri: server.redirectUri,
+        });
+        return yield* persistLoginCredentials(registryUrl, token);
+    }));
+    yield* emitLoginSuccess(registryUrl, handle);
+}));
+//# sourceMappingURL=loopback-login.js.map

package/dist/src/loopback-server.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Loopback callback listener for OAuth authorization-code login.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+export interface LoopbackCallback {
+    readonly code: string;
+    readonly state: string;
+    readonly iss: string;
+}
+declare const LoopbackLoginFallback_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LoopbackLoginFallback";
+} & Readonly<A>;
+export declare class LoopbackLoginFallback extends LoopbackLoginFallback_base<{
+    readonly reason: "bind_failed" | "timeout";
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const LoopbackCallbackRejected_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LoopbackCallbackRejected";
+} & Readonly<A>;
+export declare class LoopbackCallbackRejected extends LoopbackCallbackRejected_base<{
+    readonly reason: "access_denied" | "invalid_callback";
+    readonly message: string;
+}> {
+}
+export interface LoopbackServer {
+    readonly port: number;
+    readonly redirectUri: string;
+    readonly awaitCallback: (timeoutMs: number) => Effect.Effect<LoopbackCallback, LoopbackLoginFallback | LoopbackCallbackRejected>;
+}
+export declare const startLoopbackServer: (expectedState: string) => Effect.Effect<{
+    port: number;
+    redirectUri: string;
+    awaitCallback: (timeoutMs: number) => Effect.Effect<LoopbackCallback, LoopbackLoginFallback | LoopbackCallbackRejected, never>;
+}, LoopbackLoginFallback, import("effect/Scope").Scope>;
+export {};
+//# sourceMappingURL=loopback-server.d.ts.map

package/dist/src/loopback-server.js

@@ -0,0 +1,168 @@
+/**
+ * Loopback callback listener for OAuth authorization-code login.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Data from "effect/Data";
+import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+export class LoopbackLoginFallback extends Data.TaggedError("LoopbackLoginFallback") {
+}
+export class LoopbackCallbackRejected extends Data.TaggedError("LoopbackCallbackRejected") {
+}
+const page = (title, content) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><main style="font-family: system-ui, sans-serif; margin: 3rem auto; max-width: 34rem;"><h1>${title}</h1><p>${content}</p></main></body></html>`;
+const successPage = page("You’re signed in to AgentXM.ai", 'Return to your terminal to continue. You can close this tab. <a href="https://agentxm.ai">AgentXM.ai</a>');
+const cancellationPage = page("Sign-in was cancelled", "No credentials were changed. Return to your terminal to try again.");
+const errorPage = page("AXM sign-in could not be completed", "Return to your terminal for details and recovery instructions.");
+const writeHtml = (response, statusCode, body) => {
+    response.writeHead(statusCode, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+    });
+    response.end(body);
+};
+const makeCallbackOutcome = (request, expectedState) => {
+    if (request.method !== "GET") {
+        return {
+            _tag: "failure",
+            error: new LoopbackCallbackRejected({
+                reason: "invalid_callback",
+                message: "Unexpected callback method.",
+            }),
+        };
+    }
+    const host = request.headers.host ?? "127.0.0.1";
+    const url = new URL(request.url ?? "/", `http://${host}`);
+    if (url.pathname !== "/callback") {
+        return {
+            _tag: "failure",
+            error: new LoopbackCallbackRejected({
+                reason: "invalid_callback",
+                message: "Unexpected callback path.",
+            }),
+        };
+    }
+    const state = url.searchParams.get("state");
+    if (state !== expectedState) {
+        return {
+            _tag: "failure",
+            error: new LoopbackCallbackRejected({
+                reason: "invalid_callback",
+                message: "OAuth state did not match.",
+            }),
+        };
+    }
+    const error = url.searchParams.get("error");
+    if (error !== null) {
+        return {
+            _tag: "failure",
+            error: new LoopbackCallbackRejected({
+                reason: error === "access_denied" ? "access_denied" : "invalid_callback",
+                message: `Authorization failed: ${error}.`,
+            }),
+        };
+    }
+    const code = url.searchParams.get("code");
+    const iss = url.searchParams.get("iss");
+    if (code === null || iss === null) {
+        return {
+            _tag: "failure",
+            error: new LoopbackCallbackRejected({
+                reason: "invalid_callback",
+                message: "Authorization callback was incomplete.",
+            }),
+        };
+    }
+    return {
+        _tag: "success",
+        callback: { code, state, iss },
+    };
+};
+export const startLoopbackServer = (expectedState) => Effect.gen(function* () {
+    const http = yield* Effect.tryPromise({
+        try: () => import("node:http"),
+        catch: (cause) => new LoopbackLoginFallback({
+            reason: "bind_failed",
+            message: "Could not load the local HTTP server.",
+            cause,
+        }),
+    });
+    const callback = yield* Deferred.make();
+    const listener = yield* Effect.acquireRelease(Effect.callback((resume) => {
+        let acquired = false;
+        const server = http.createServer((request, response) => {
+            const outcome = makeCallbackOutcome(request, expectedState);
+            writeHtml(response, outcome._tag === "success" ? 200 : 400, outcome._tag === "success"
+                ? successPage
+                : outcome.error._tag === "LoopbackCallbackRejected" &&
+                    outcome.error.reason === "access_denied"
+                    ? cancellationPage
+                    : errorPage);
+            Deferred.doneUnsafe(callback, outcome._tag === "success"
+                ? Effect.succeed(outcome.callback)
+                : Effect.fail(outcome.error));
+        });
+        const onBindError = (cause) => {
+            if (acquired)
+                return;
+            acquired = true;
+            resume(Effect.fail(new LoopbackLoginFallback({
+                reason: "bind_failed",
+                message: "Could not bind a local callback port.",
+                cause,
+            })));
+        };
+        server.once("error", onBindError);
+        server.listen({ host: "127.0.0.1", port: 0, exclusive: process.platform === "win32" }, () => {
+            if (acquired)
+                return;
+            const address = server.address();
+            if (typeof address !== "object" || address === null) {
+                acquired = true;
+                server.close();
+                resume(Effect.fail(new LoopbackLoginFallback({
+                    reason: "bind_failed",
+                    message: "Could not determine the local callback port.",
+                })));
+                return;
+            }
+            acquired = true;
+            server.off("error", onBindError);
+            resume(Effect.succeed({
+                server,
+                port: address.port,
+            }));
+        });
+        return Effect.sync(() => {
+            if (!acquired)
+                server.close();
+        });
+    }), ({ server }) => Effect.try({
+        try: () => {
+            if (server.listening)
+                server.close();
+            server.closeAllConnections();
+        },
+        catch: () => undefined,
+    }).pipe(Effect.ignore));
+    listener.server.on("error", (cause) => {
+        Deferred.doneUnsafe(callback, Effect.fail(new LoopbackLoginFallback({
+            reason: "bind_failed",
+            message: "The local callback server failed.",
+            cause,
+        })));
+    });
+    return {
+        port: listener.port,
+        redirectUri: `http://127.0.0.1:${listener.port}/callback`,
+        awaitCallback: (timeoutMs) => Deferred.await(callback).pipe(Effect.timeoutOrElse({
+            duration: Duration.millis(timeoutMs),
+            orElse: () => Effect.fail(new LoopbackLoginFallback({
+                reason: "timeout",
+                message: "Timed out waiting for the browser callback.",
+            })),
+        })),
+    };
+});
+//# sourceMappingURL=loopback-server.js.map

package/dist/src/oauth-contract.d.ts

@@ -0,0 +1,7 @@
+import type * as DateTime from "effect/DateTime";
+export interface NormalizedTokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_at: DateTime.Utc;
+}
+//# sourceMappingURL=oauth-contract.d.ts.map

package/dist/src/oauth-contract.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth-contract.js.map

package/dist/src/pending-device-login-store.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Restricted local persistence for resumable OAuth device authorization.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ServiceMap from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { RegistryAuthFailed } from "./errors.js";
+export declare const PendingDeviceLoginSchema: Schema.Struct<{
+    readonly version: Schema.Literal<2>;
+    readonly registryUrl: Schema.String;
+    readonly deviceCode: Schema.String;
+    readonly userCode: Schema.String;
+    readonly verificationUri: Schema.String;
+    readonly verificationUriComplete: Schema.String;
+    readonly requestedScopes: Schema.$Array<Schema.String>;
+    readonly interval: Schema.Number;
+    readonly expiresAt: Schema.decodeTo<Schema.DateTimeUtc, Schema.String, never, never>;
+}>;
+export type PendingDeviceLogin = typeof PendingDeviceLoginSchema.Type;
+export interface PendingDeviceLoginStoreService {
+    readonly save: (pending: PendingDeviceLogin) => Effect.Effect<void, RegistryAuthFailed>;
+    readonly load: () => Effect.Effect<Option.Option<PendingDeviceLogin>, RegistryAuthFailed>;
+    readonly clear: () => Effect.Effect<void, RegistryAuthFailed>;
+}
+declare const PendingDeviceLoginStore_base: ServiceMap.ServiceClass<PendingDeviceLoginStore, "@agentxm/registry-auth/pending-device-login-store/PendingDeviceLoginStore", PendingDeviceLoginStoreService>;
+export declare class PendingDeviceLoginStore extends PendingDeviceLoginStore_base {
+}
+export declare const PendingDeviceLoginStoreLive: Layer.Layer<PendingDeviceLoginStore, never, FileSystem.FileSystem | Path.Path>;
+export declare const PendingDeviceLoginStoreTest: (initial?: PendingDeviceLogin) => Layer.Layer<PendingDeviceLoginStore, never, never>;
+export {};
+//# sourceMappingURL=pending-device-login-store.d.ts.map

package/dist/src/pending-device-login-store.js

@@ -0,0 +1,122 @@
+/**
+ * Restricted local persistence for resumable OAuth device authorization.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ServiceMap from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { DateTimeUtcSchema } from "@agentxm/extension-model/unstable/date-time";
+import { RegistryAuthFailed } from "./errors.js";
+import { envOption } from "./internal/environment.js";
+export const PendingDeviceLoginSchema = Schema.Struct({
+    version: Schema.Literal(2),
+    registryUrl: Schema.String,
+    deviceCode: Schema.String,
+    userCode: Schema.String,
+    verificationUri: Schema.String,
+    verificationUriComplete: Schema.String,
+    requestedScopes: Schema.Array(Schema.String),
+    interval: Schema.Number,
+    expiresAt: DateTimeUtcSchema,
+}).annotate({
+    identifier: "PendingDeviceLogin",
+    title: "Pending Device Login",
+    description: "One resumable OAuth device authorization flow.",
+});
+export class PendingDeviceLoginStore extends ServiceMap.Service()("@agentxm/registry-auth/pending-device-login-store/PendingDeviceLoginStore") {
+}
+const PENDING_LOGIN_FILENAME = "pending-login.json";
+const DIR_PERMISSIONS = 0o700;
+const FILE_PERMISSIONS = 0o600;
+const resolveHomeDir = (values) => {
+    for (const value of values) {
+        if (Option.isSome(value))
+            return value.value;
+    }
+    return "/tmp";
+};
+const storeError = (detail, cause) => new RegistryAuthFailed({ category: "auth", detail, cause });
+export const PendingDeviceLoginStoreLive = Layer.effect(PendingDeviceLoginStore, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const homeDir = resolveHomeDir([
+        yield* envOption("AXM_USER_HOME"),
+        yield* envOption("HOME"),
+        yield* envOption("USERPROFILE"),
+        yield* envOption("HOMEPATH"),
+    ]);
+    const directory = path.join(homeDir, ".axm");
+    const filePath = path.join(directory, PENDING_LOGIN_FILENAME);
+    const temporaryPath = path.join(directory, `${PENDING_LOGIN_FILENAME}.tmp`);
+    const ensureDirectory = Effect.gen(function* () {
+        yield* fs
+            .makeDirectory(directory, { recursive: true })
+            .pipe(Effect.mapError((error) => storeError("Could not create pending login storage", error)));
+        yield* fs.chmod(directory, DIR_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+    });
+    const save = Effect.fn("PendingDeviceLoginStore.save")(function* (pending) {
+        yield* ensureDirectory;
+        const encoded = yield* Schema.encodeEffect(PendingDeviceLoginSchema)(pending).pipe(Effect.mapError((error) => storeError("Could not encode pending login", error)));
+        yield* fs.chmod(temporaryPath, FILE_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+        yield* fs
+            .writeFileString(temporaryPath, JSON.stringify(encoded, null, 2), {
+            mode: FILE_PERMISSIONS,
+        })
+            .pipe(Effect.mapError((error) => storeError("Could not persist pending login", error)), Effect.tapError(() => fs.remove(temporaryPath).pipe(Effect.catch(() => Effect.void))));
+        yield* fs.chmod(temporaryPath, FILE_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+        yield* fs.rename(temporaryPath, filePath).pipe(Effect.mapError((error) => storeError("Could not persist pending login", error)), Effect.tapError(() => fs.remove(temporaryPath).pipe(Effect.catch(() => Effect.void))));
+        yield* fs.chmod(filePath, FILE_PERMISSIONS).pipe(Effect.catch(() => Effect.void));
+    });
+    const load = Effect.fn("PendingDeviceLoginStore.load")(function* () {
+        const exists = yield* fs.exists(filePath).pipe(Effect.catch(() => Effect.succeed(false)));
+        if (!exists)
+            return Option.none();
+        const content = yield* fs
+            .readFileString(filePath)
+            .pipe(Effect.mapError((error) => storeError("Could not read pending login", error)));
+        return yield* Schema.decodeUnknownEffect(Schema.fromJsonString(PendingDeviceLoginSchema))(content).pipe(Effect.map(Option.some), Effect.mapError((error) => new RegistryAuthFailed({
+            category: "auth",
+            detail: "Pending login storage was invalid and has been removed. Start a new device sign-in.",
+            suggestions: [
+                {
+                    description: "Start a new device sign-in.",
+                    cmd: "axm login --device-code --json",
+                },
+            ],
+            cause: error,
+        })), Effect.tapError(() => fs.remove(filePath).pipe(Effect.catch(() => Effect.void))));
+    });
+    const clear = Effect.fn("PendingDeviceLoginStore.clear")(function* () {
+        const exists = yield* fs.exists(filePath).pipe(Effect.catch(() => Effect.succeed(false)));
+        if (exists) {
+            yield* fs
+                .remove(filePath)
+                .pipe(Effect.mapError((error) => storeError("Could not clear pending login", error)));
+        }
+        const temporaryExists = yield* fs
+            .exists(temporaryPath)
+            .pipe(Effect.catch(() => Effect.succeed(false)));
+        if (temporaryExists) {
+            yield* fs.remove(temporaryPath).pipe(Effect.catch(() => Effect.void));
+        }
+    });
+    return { save, load, clear };
+}));
+export const PendingDeviceLoginStoreTest = (initial) => {
+    let value = initial === undefined ? Option.none() : Option.some(initial);
+    return Layer.succeed(PendingDeviceLoginStore, {
+        save: (pending) => Effect.sync(() => {
+            value = Option.some(pending);
+        }),
+        load: () => Effect.sync(() => value),
+        clear: () => Effect.sync(() => {
+            value = Option.none();
+        }),
+    });
+};
+//# sourceMappingURL=pending-device-login-store.js.map

package/dist/src/publish-authorization.d.ts

@@ -0,0 +1,11 @@
+import * as Effect from "effect/Effect";
+import type { PreviewPublicationSetRequest } from "@agentxm/registry-protocol/unstable/registry/publication-set";
+import { AuthClient, type PublishAuthorizationExchangeResponse } from "./auth-client.js";
+import { DeviceLoginInteraction } from "./device-login.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+export interface PublishAuthorizationInput {
+    readonly registryUrl: string;
+    readonly publicationSet: PreviewPublicationSetRequest;
+}
+export declare const runPublishAuthorization: (input: PublishAuthorizationInput) => Effect.Effect<PublishAuthorizationExchangeResponse, import("./errors.js").AuthError, AuthClient | AuthLoginPresenter | DeviceLoginInteraction>;
+//# sourceMappingURL=publish-authorization.d.ts.map

package/dist/src/publish-authorization.js

@@ -0,0 +1,79 @@
+import * as Effect from "effect/Effect";
+import { RegistryAuthFailed } from "./errors.js";
+import { AuthClient } from "./auth-client.js";
+import { DeviceLoginInteraction } from "./device-login.js";
+import { AuthLoginPresenter } from "./login-presenter.js";
+import { LoopbackCallbackRejected, LoopbackLoginFallback, startLoopbackServer, } from "./loopback-server.js";
+import { makeOAuthState, makePkceChallenge, makePkceVerifier } from "./loopback-login.js";
+const PUBLISH_AUTHORIZATION_TIMEOUT_MS = 10 * 60_000;
+const loopbackFailureToAuthFailure = (error) => {
+    if (error._tag === "LoopbackCallbackRejected" && error.reason === "access_denied") {
+        return new RegistryAuthFailed({
+            category: "auth",
+            detail: "Publish authorization was denied",
+            suggestions: [{ description: "Rerun publish when you are ready to review it again." }],
+            cause: error,
+        });
+    }
+    if (error._tag === "LoopbackLoginFallback" && error.reason === "timeout") {
+        return new RegistryAuthFailed({
+            category: "auth",
+            detail: "Publish authorization expired before approval",
+            suggestions: [{ description: "Rerun publish to create a new request." }],
+            cause: error,
+        });
+    }
+    return new RegistryAuthFailed({
+        category: "auth",
+        detail: `Publish loopback callback failed: ${error.message}`,
+        suggestions: [
+            {
+                description: "Check that local loopback connections to 127.0.0.1 are allowed, then rerun publish.",
+            },
+        ],
+        cause: error,
+    });
+};
+export const runPublishAuthorization = Effect.fn("Auth.runPublishAuthorization")(function* (input) {
+    return yield* Effect.scoped(Effect.gen(function* () {
+        const authClient = yield* AuthClient;
+        const presenter = yield* AuthLoginPresenter;
+        const interaction = yield* DeviceLoginInteraction;
+        const verifier = makePkceVerifier();
+        const challenge = makePkceChallenge(verifier);
+        const state = makeOAuthState();
+        const server = yield* startLoopbackServer(state).pipe(Effect.mapError(loopbackFailureToAuthFailure));
+        const request = yield* authClient.createPublishAuthorizationRequest({
+            registryUrl: input.registryUrl,
+            redirectUri: server.redirectUri,
+            state,
+            codeChallenge: challenge,
+            publicationSet: input.publicationSet,
+        });
+        const openedBrowser = yield* interaction.openBrowser(request.authorizationUrl);
+        yield* presenter.notePublishReview({
+            browserOpened: openedBrowser,
+            candidateCount: input.publicationSet.candidates.length,
+            authorizationUrl: request.authorizationUrl,
+        });
+        const callback = yield* server
+            .awaitCallback(PUBLISH_AUTHORIZATION_TIMEOUT_MS)
+            .pipe(Effect.mapError(loopbackFailureToAuthFailure));
+        const expectedIssuer = new URL(request.authorizationUrl).origin;
+        if (callback.iss !== expectedIssuer) {
+            return yield* new RegistryAuthFailed({
+                category: "auth",
+                detail: "Publish authorization callback issuer did not match",
+                cause: { expectedIssuer, receivedIssuer: callback.iss },
+            });
+        }
+        const capability = yield* authClient.exchangePublishAuthorizationCode({
+            registryUrl: input.registryUrl,
+            code: callback.code,
+            verifier,
+            redirectUri: server.redirectUri,
+        });
+        return capability;
+    }));
+}, Effect.satisfiesSuccessType());
+//# sourceMappingURL=publish-authorization.js.map

package/dist/src/schema.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Schema definitions for credential storage and token sources.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import type * as DateTime from "effect/DateTime";
+import * as Schema from "effect/Schema";
+import { type Handle } from "@agentxm/extension-model/unstable/extensions/handle";
+export declare const CredentialEntrySchema: Schema.Struct<{
+    readonly access_token: Schema.String;
+    readonly refresh_token: Schema.String;
+    readonly expires_at: Schema.decodeTo<Schema.DateTimeUtc, Schema.String, never, never>;
+    readonly active: Schema.Boolean;
+}>;
+export type CredentialEntry = Schema.Schema.Type<typeof CredentialEntrySchema>;
+export declare const RegistryAccountsSchema: Schema.Struct<{
+    readonly accounts: Schema.$Record<Schema.brand<Schema.String, "Handle">, Schema.Struct<{
+        readonly access_token: Schema.String;
+        readonly refresh_token: Schema.String;
+        readonly expires_at: Schema.decodeTo<Schema.DateTimeUtc, Schema.String, never, never>;
+        readonly active: Schema.Boolean;
+    }>>;
+}>;
+export type RegistryAccounts = Schema.Schema.Type<typeof RegistryAccountsSchema>;
+export declare const CredentialFileSchema: Schema.Struct<{
+    readonly version: Schema.Literal<1>;
+    readonly registries: Schema.$Record<Schema.String, Schema.Struct<{
+        readonly accounts: Schema.$Record<Schema.brand<Schema.String, "Handle">, Schema.Struct<{
+            readonly access_token: Schema.String;
+            readonly refresh_token: Schema.String;
+            readonly expires_at: Schema.decodeTo<Schema.DateTimeUtc, Schema.String, never, never>;
+            readonly active: Schema.Boolean;
+        }>>;
+    }>>;
+}>;
+export type CredentialFile = Schema.Schema.Type<typeof CredentialFileSchema>;
+declare const EnvVarTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "EnvVar";
+} & import("effect/Pipeable").Pipeable;
+export declare class EnvVarTokenSource extends EnvVarTokenSource_base<{
+    readonly token: string;
+}> {
+}
+declare const FlagTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "Flag";
+} & import("effect/Pipeable").Pipeable;
+export declare class FlagTokenSource extends FlagTokenSource_base<{
+    readonly token: string;
+}> {
+}
+declare const FileTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "File";
+} & import("effect/Pipeable").Pipeable;
+export declare class FileTokenSource extends FileTokenSource_base<{
+    readonly token: string;
+    readonly path: string;
+}> {
+}
+declare const CredentialStoreTokenSource_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "CredentialStore";
+} & import("effect/Pipeable").Pipeable;
+export declare class CredentialStoreTokenSource extends CredentialStoreTokenSource_base<{
+    readonly token: string;
+    readonly refresh_token: string;
+    readonly expires_at: DateTime.Utc;
+    readonly registryUrl: string;
+}> {
+}
+export type TokenSource = EnvVarTokenSource | FileTokenSource | FlagTokenSource | CredentialStoreTokenSource;
+export interface StoredCredentials {
+    readonly handle: Handle;
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_at: DateTime.Utc;
+}
+export type StorageTier = "keychain" | "restricted-file" | "plaintext-file";
+export {};
+//# sourceMappingURL=schema.d.ts.map