@smthrs/control 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/Credential.js

@@ -0,0 +1,190 @@
+/**
+ * Credential storage boundary.
+ *
+ * Credentials are capabilities. They must never enter flow input, plan
+ * digests, journal payloads, or model context, so only a {@link CredentialRef}
+ * — an id and a human-readable connection name — crosses the browser-safe
+ * contract. Plaintext exists in exactly two places: inside a `Redacted` handed
+ * to `create`/`rotate`, and inside the `Redacted` returned by `resolve`.
+ *
+ * The implementation composes two ports:
+ *
+ * - {@link CredentialStore} persists an opaque sealed record and enforces
+ *   compare-and-set on writes, so concurrent rotations cannot interleave.
+ *   `rotate` with `expected` extends that compare to the secret itself: the
+ *   secret it checks and the version it writes over come from one read, so a
+ *   writer that commits in between, in any process, is refused.
+ * - {@link CredentialCipher} seals and opens the secret under host-managed
+ *   keys. `WebCryptoCipher` is the browser and Node adapter; a host with no
+ *   secure key material fails with the typed `Unavailable`.
+ *
+ * Authorization is a host decision, injected as {@link Options.authorize}. A
+ * reference is also authenticated on every operation: caller-owned fields are
+ * snapshotted before policy effects run, and a caller cannot present a forged
+ * or stale `CredentialRef` because the snapshotted name must still match the
+ * stored record.
+ *
+ * @since 0.1.0
+ */
+import { Context, Effect, Layer, Option, Redacted } from "effect";
+import { CredentialConflict, InvalidInput, Unauthorized, Unavailable } from "./ControlError.js";
+import * as CredentialCipher from "./CredentialCipher.js";
+import * as CredentialStore from "./CredentialStore.js";
+// String.prototype.isWellFormed without the ES2024 lib, which every package
+// compiling this source would also need. A loop, not a regex: a match would
+// leave the rejected secret in the legacy RegExp.input static.
+const wellFormed = (value) => {
+    for (let index = 0; index < value.length; index++) {
+        const unit = value.charCodeAt(index);
+        if (unit >= 0xdc00 && unit <= 0xdfff)
+            return false;
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const low = value.charCodeAt(++index);
+            if (!(low >= 0xdc00 && low <= 0xdfff))
+                return false;
+        }
+    }
+    return true;
+};
+/**
+ * Service tag for credential resolution.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export const Credential = Context.Service("/control/Credential");
+const unavailable = () => new Unavailable({
+    feature: "credential storage",
+    ticket: "control-credential-storage"
+});
+/**
+ * A credential implementation that explicitly reports unavailable storage.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeNoop = () => Credential.of({
+    list: Effect.fn("Credential.list")(() => Effect.fail(unavailable())),
+    get: Effect.fn("Credential.get")(() => Effect.fail(unavailable())),
+    create: Effect.fn("Credential.create")(() => Effect.fail(unavailable())),
+    resolve: Effect.fn("Credential.resolve")(() => Effect.fail(unavailable())),
+    rotate: Effect.fn("Credential.rotate")(() => Effect.fail(unavailable())),
+    revoke: Effect.fn("Credential.revoke")(() => Effect.fail(unavailable()))
+});
+/**
+ * Layer for the unavailable credential-storage boundary.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerNoop = Layer.succeed(Credential, makeNoop());
+const referenceOf = (value) => Object.freeze({
+    id: value.id,
+    name: value.name
+});
+const cipherContextOf = (value) => Object.freeze({
+    id: value.id,
+    name: value.name,
+    version: value.version
+});
+const missing = (id) => 
+// Deliberately indistinguishable from a denied reference: telling an
+// unauthorized caller which ids exist is itself a leak.
+new Unauthorized({ message: `Credential ${id} is not available to this caller` });
+/**
+ * Constructs a working credential boundary over a store and a cipher.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const make = (options) => {
+    const authorize = options.authorize ?? (() => Effect.void);
+    const store = options.store;
+    const cipher = options.cipher;
+    /** Reads the record `reference` names, refusing a forged or stale one. */
+    const authenticate = (operation, reference) => Effect.gen(function* () {
+        const snapshot = referenceOf(reference);
+        yield* authorize(operation, Option.some(snapshot));
+        const record = yield* store.read(snapshot.id);
+        if (Option.isNone(record))
+            return yield* Effect.fail(missing(snapshot.id));
+        if (record.value.name !== snapshot.name)
+            return yield* Effect.fail(missing(snapshot.id));
+        return record.value;
+    });
+    const put = (record, secret) => Effect.gen(function* () {
+        if (!wellFormed(Redacted.value(secret))) {
+            return yield* Effect.fail(new InvalidInput({ issue: "Credential secret must be well-formed Unicode" }));
+        }
+        // The metadata written beside this blob is also its authenticated data;
+        // moving the blob to another id, name, or version must make it unreadable.
+        const context = cipherContextOf(record);
+        const sealed = yield* cipher.seal(secret, context);
+        const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+        yield* store.write({ ...record, ...sealed, updatedAtMs: now });
+        return referenceOf(record);
+    });
+    return Credential.of({
+        list: Effect.fn("Credential.list")(function* () {
+            yield* authorize("list", Option.none());
+            const records = yield* store.list();
+            return records.map(referenceOf);
+        }),
+        get: Effect.fn("Credential.get")(function* (id) {
+            const record = yield* store.read(id);
+            if (Option.isNone(record))
+                return yield* Effect.fail(missing(id));
+            const reference = referenceOf(record.value);
+            yield* authorize("get", Option.some(reference));
+            return reference;
+        }),
+        create: Effect.fn("Credential.create")(function* (input) {
+            const snapshot = Object.freeze({
+                reference: referenceOf(input),
+                secret: input.secret
+            });
+            yield* authorize("create", Option.some(snapshot.reference));
+            return yield* put({
+                id: snapshot.reference.id,
+                name: snapshot.reference.name,
+                ciphertext: "",
+                nonce: "",
+                version: 1,
+                updatedAtMs: 0
+            }, snapshot.secret);
+        }),
+        resolve: Effect.fn("Credential.resolve")(function* (reference) {
+            const record = yield* authenticate("resolve", reference);
+            return yield* cipher.open({ ciphertext: record.ciphertext, nonce: record.nonce }, cipherContextOf(record));
+        }),
+        rotate: Effect.fn("Credential.rotate")(function* (reference, secret, options) {
+            const expected = options?.expected;
+            const record = yield* authenticate("rotate", reference);
+            if (expected !== undefined) {
+                const stored = yield* cipher.open({ ciphertext: record.ciphertext, nonce: record.nonce }, cipherContextOf(record));
+                if (Redacted.value(stored) !== Redacted.value(expected)) {
+                    return yield* Effect.fail(new CredentialConflict({ id: record.id, expectedVersion: record.version, actualVersion: record.version }));
+                }
+            }
+            // `put` writes over exactly the version read above, so the secret just
+            // compared is still the stored one when the write commits.
+            return yield* put({ ...record, version: record.version + 1 }, secret);
+        }),
+        revoke: Effect.fn("Credential.revoke")(function* (reference) {
+            const record = yield* authenticate("revoke", reference);
+            yield* store.remove(record.id);
+        })
+    });
+};
+/**
+ * Provides a working credential boundary over the ambient store and cipher.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layer = (options = {}) => Layer.effect(Credential)(Effect.gen(function* () {
+    const store = yield* CredentialStore.CredentialStore;
+    const cipher = yield* CredentialCipher.CredentialCipher;
+    return make({ store, cipher, ...(options.authorize === undefined ? {} : { authorize: options.authorize }) });
+}));
+//# sourceMappingURL=Credential.js.map

package/dist/esm/Credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credential.js","sourceRoot":"","sources":["../../src/Credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAyB,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtH,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAEvD,4EAA4E;AAC5E,4EAA4E;AAC5E,+DAA+D;AAC/D,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;YAAE,OAAO,KAAK,CAAA;QAClD,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAA;YACrC,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAgED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAA4C,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;AAEzG,MAAM,WAAW,GAAG,GAAgB,EAAE,CACpC,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,4BAA4B;CACrC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAe,EAAE,CACvC,UAAU,CAAC,EAAE,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;CACzE,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;AAoB9D,MAAM,WAAW,GAAG,CAAC,KAAqD,EAAiB,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC;IACZ,EAAE,EAAE,KAAK,CAAC,EAAE;IACZ,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,CAAC,CAAA;AAEJ,MAAM,eAAe,GAAG,CACtB,KAA+E,EACrD,EAAE,CAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,EAAE,EAAE,KAAK,CAAC,EAAE;IACZ,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,OAAO,EAAE,KAAK,CAAC,OAAO;CACvB,CAAC,CAAA;AAEJ,MAAM,OAAO,GAAG,CAAC,EAAU,EAAgB,EAAE;AAC3C,qEAAqE;AACrE,wDAAwD;AACxD,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,kCAAkC,EAAE,CAAC,CAAA;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAc,EAAE;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,0EAA0E;IAC1E,MAAM,YAAY,GAAG,CACnB,SAAoB,EACpB,SAAwB,EACiD,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QACxF,OAAO,MAAM,CAAC,KAAK,CAAA;IACrB,CAAC,CAAC,CAAA;IAEJ,MAAM,GAAG,GAAG,CACV,MAAoC,EACpC,MAAiC,EAC8C,EAAE,CACjF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAA;QACzG,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACvE,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEJ,OAAO,UAAU,CAAC,EAAE,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC;YAC1C,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;YACnC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACjC,CAAC,CAAC;QACF,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAC,EAAE;YAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACpC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;YACjE,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3C,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC/C,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAK;YACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAA;YACF,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;YAC3D,OAAO,KAAK,CAAC,CAAC,GAAG,CACf;gBACE,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI;gBAC7B,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,CAAC;gBACV,WAAW,EAAE,CAAC;aACf,EACD,QAAQ,CAAC,MAAM,CAChB,CAAA;QACH,CAAC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAS;YAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACxD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EACtD,eAAe,CAAC,MAAM,CAAC,CACxB,CAAA;QACH,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAS,EAAE,MAAM,EAAE,OAAO;YACzE,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAA;YAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAC/B,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EACtD,eAAe,CAAC,MAAM,CAAC,CACxB,CAAA;gBACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAC1G,CAAA;gBACH,CAAC;YACH,CAAC;YACD,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAS;YACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YACvD,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChC,CAAC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,UAAyD,EAAE,EAK3D,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,eAAe,CAAA;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,CAAA;IACvD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;AAC9G,CAAC,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Credential storage boundary.\n *\n * Credentials are capabilities. They must never enter flow input, plan\n * digests, journal payloads, or model context, so only a {@link CredentialRef}\n * — an id and a human-readable connection name — crosses the browser-safe\n * contract. Plaintext exists in exactly two places: inside a `Redacted` handed\n * to `create`/`rotate`, and inside the `Redacted` returned by `resolve`.\n *\n * The implementation composes two ports:\n *\n * - {@link CredentialStore} persists an opaque sealed record and enforces\n *   compare-and-set on writes, so concurrent rotations cannot interleave.\n *   `rotate` with `expected` extends that compare to the secret itself: the\n *   secret it checks and the version it writes over come from one read, so a\n *   writer that commits in between, in any process, is refused.\n * - {@link CredentialCipher} seals and opens the secret under host-managed\n *   keys. `WebCryptoCipher` is the browser and Node adapter; a host with no\n *   secure key material fails with the typed `Unavailable`.\n *\n * Authorization is a host decision, injected as {@link Options.authorize}. A\n * reference is also authenticated on every operation: caller-owned fields are\n * snapshotted before policy effects run, and a caller cannot present a forged\n * or stale `CredentialRef` because the snapshotted name must still match the\n * stored record.\n *\n * @since 0.1.0\n */\n\nimport { Context, Effect, Layer, Option, Redacted } from \"effect\"\nimport { CredentialConflict, InvalidInput, type PersistenceError, Unauthorized, Unavailable } from \"./ControlError.ts\"\nimport * as CredentialCipher from \"./CredentialCipher.ts\"\nimport * as CredentialStore from \"./CredentialStore.ts\"\n\n// String.prototype.isWellFormed without the ES2024 lib, which every package\n// compiling this source would also need. A loop, not a regex: a match would\n// leave the rejected secret in the legacy RegExp.input static.\nconst wellFormed = (value: string): boolean => {\n  for (let index = 0; index < value.length; index++) {\n    const unit = value.charCodeAt(index)\n    if (unit >= 0xdc00 && unit <= 0xdfff) return false\n    if (unit >= 0xd800 && unit <= 0xdbff) {\n      const low = value.charCodeAt(++index)\n      if (!(low >= 0xdc00 && low <= 0xdfff)) return false\n    }\n  }\n  return true\n}\n\n/**\n * A journal-safe name for a stored connection credential.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface CredentialRef {\n  readonly id: string\n  readonly name: string\n}\n\n/**\n * One credential operation, as seen by a host authorization policy.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Operation = \"list\" | \"get\" | \"create\" | \"resolve\" | \"rotate\" | \"revoke\"\n\n/**\n * How {@link Credential.rotate} compares before it writes.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface RotateOptions {\n  /** The secret the caller last saw; the rotation commits only over it. */\n  readonly expected?: Redacted.Redacted<string> | undefined\n}\n\n/**\n * Adapter-bound credential resolution. References are safe to list and\n * persist; only `resolve` crosses into a secret-bearing adapter boundary.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Credential {\n  readonly list: () => Effect.Effect<ReadonlyArray<CredentialRef>, Unavailable | Unauthorized>\n  readonly get: (id: string) => Effect.Effect<CredentialRef, Unavailable | Unauthorized>\n  readonly create: (\n    options: { readonly id: string; readonly name: string; readonly secret: Redacted.Redacted<string> }\n  ) => Effect.Effect<CredentialRef, Unavailable | Unauthorized | CredentialConflict | InvalidInput>\n  readonly resolve: (\n    reference: CredentialRef\n  ) => Effect.Effect<Redacted.Redacted<string>, Unavailable | Unauthorized | PersistenceError>\n  /**\n   * Replaces the secret. With `expected`, replaces it only while the stored\n   * secret still equals `expected`, and otherwise fails `CredentialConflict`\n   * at the stored version without writing.\n   */\n  readonly rotate: (\n    reference: CredentialRef,\n    secret: Redacted.Redacted<string>,\n    options?: RotateOptions | undefined\n  ) => Effect.Effect<\n    CredentialRef,\n    Unavailable | Unauthorized | CredentialConflict | InvalidInput | PersistenceError\n  >\n  readonly revoke: (reference: CredentialRef) => Effect.Effect<void, Unavailable | Unauthorized>\n}\n\n/**\n * Service tag for credential resolution.\n *\n * @category services\n * @since 0.1.0\n */\nexport const Credential: Context.Service<Credential, Credential> = Context.Service(\"/control/Credential\")\n\nconst unavailable = (): Unavailable =>\n  new Unavailable({\n    feature: \"credential storage\",\n    ticket: \"control-credential-storage\"\n  })\n\n/**\n * A credential implementation that explicitly reports unavailable storage.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeNoop = (): Credential =>\n  Credential.of({\n    list: Effect.fn(\"Credential.list\")(() => Effect.fail(unavailable())),\n    get: Effect.fn(\"Credential.get\")(() => Effect.fail(unavailable())),\n    create: Effect.fn(\"Credential.create\")(() => Effect.fail(unavailable())),\n    resolve: Effect.fn(\"Credential.resolve\")(() => Effect.fail(unavailable())),\n    rotate: Effect.fn(\"Credential.rotate\")(() => Effect.fail(unavailable())),\n    revoke: Effect.fn(\"Credential.revoke\")(() => Effect.fail(unavailable()))\n  })\n\n/**\n * Layer for the unavailable credential-storage boundary.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop = Layer.succeed(Credential, makeNoop())\n\n/**\n * The collaborators a working credential boundary needs.\n *\n * `authorize` is the host's policy hook. It defaults to allowing every\n * operation, which is correct for a single-principal local process; a server\n * composition supplies its own and gets typed `Unauthorized` failures for free.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Options {\n  readonly store: CredentialStore.Service\n  readonly cipher: CredentialCipher.Service\n  readonly authorize?:\n    | ((operation: Operation, reference: Option.Option<CredentialRef>) => Effect.Effect<void, Unauthorized>)\n    | undefined\n}\n\nconst referenceOf = (value: { readonly id: string; readonly name: string }): CredentialRef =>\n  Object.freeze({\n    id: value.id,\n    name: value.name\n  })\n\nconst cipherContextOf = (\n  value: { readonly id: string; readonly name: string; readonly version: number }\n): CredentialCipher.Context =>\n  Object.freeze({\n    id: value.id,\n    name: value.name,\n    version: value.version\n  })\n\nconst missing = (id: string): Unauthorized =>\n  // Deliberately indistinguishable from a denied reference: telling an\n  // unauthorized caller which ids exist is itself a leak.\n  new Unauthorized({ message: `Credential ${id} is not available to this caller` })\n\n/**\n * Constructs a working credential boundary over a store and a cipher.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (options: Options): Credential => {\n  const authorize = options.authorize ?? (() => Effect.void)\n  const store = options.store\n  const cipher = options.cipher\n\n  /** Reads the record `reference` names, refusing a forged or stale one. */\n  const authenticate = (\n    operation: Operation,\n    reference: CredentialRef\n  ): Effect.Effect<CredentialStore.SealedRecord, Unavailable | Unauthorized> =>\n    Effect.gen(function*() {\n      const snapshot = referenceOf(reference)\n      yield* authorize(operation, Option.some(snapshot))\n      const record = yield* store.read(snapshot.id)\n      if (Option.isNone(record)) return yield* Effect.fail(missing(snapshot.id))\n      if (record.value.name !== snapshot.name) return yield* Effect.fail(missing(snapshot.id))\n      return record.value\n    })\n\n  const put = (\n    record: CredentialStore.SealedRecord,\n    secret: Redacted.Redacted<string>\n  ): Effect.Effect<CredentialRef, Unavailable | CredentialConflict | InvalidInput> =>\n    Effect.gen(function*() {\n      if (!wellFormed(Redacted.value(secret))) {\n        return yield* Effect.fail(new InvalidInput({ issue: \"Credential secret must be well-formed Unicode\" }))\n      }\n      // The metadata written beside this blob is also its authenticated data;\n      // moving the blob to another id, name, or version must make it unreadable.\n      const context = cipherContextOf(record)\n      const sealed = yield* cipher.seal(secret, context)\n      const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis)\n      yield* store.write({ ...record, ...sealed, updatedAtMs: now })\n      return referenceOf(record)\n    })\n\n  return Credential.of({\n    list: Effect.fn(\"Credential.list\")(function*() {\n      yield* authorize(\"list\", Option.none())\n      const records = yield* store.list()\n      return records.map(referenceOf)\n    }),\n    get: Effect.fn(\"Credential.get\")(function*(id) {\n      const record = yield* store.read(id)\n      if (Option.isNone(record)) return yield* Effect.fail(missing(id))\n      const reference = referenceOf(record.value)\n      yield* authorize(\"get\", Option.some(reference))\n      return reference\n    }),\n    create: Effect.fn(\"Credential.create\")(function*(input) {\n      const snapshot = Object.freeze({\n        reference: referenceOf(input),\n        secret: input.secret\n      })\n      yield* authorize(\"create\", Option.some(snapshot.reference))\n      return yield* put(\n        {\n          id: snapshot.reference.id,\n          name: snapshot.reference.name,\n          ciphertext: \"\",\n          nonce: \"\",\n          version: 1,\n          updatedAtMs: 0\n        },\n        snapshot.secret\n      )\n    }),\n    resolve: Effect.fn(\"Credential.resolve\")(function*(reference) {\n      const record = yield* authenticate(\"resolve\", reference)\n      return yield* cipher.open(\n        { ciphertext: record.ciphertext, nonce: record.nonce },\n        cipherContextOf(record)\n      )\n    }),\n    rotate: Effect.fn(\"Credential.rotate\")(function*(reference, secret, options) {\n      const expected = options?.expected\n      const record = yield* authenticate(\"rotate\", reference)\n      if (expected !== undefined) {\n        const stored = yield* cipher.open(\n          { ciphertext: record.ciphertext, nonce: record.nonce },\n          cipherContextOf(record)\n        )\n        if (Redacted.value(stored) !== Redacted.value(expected)) {\n          return yield* Effect.fail(\n            new CredentialConflict({ id: record.id, expectedVersion: record.version, actualVersion: record.version })\n          )\n        }\n      }\n      // `put` writes over exactly the version read above, so the secret just\n      // compared is still the stored one when the write commits.\n      return yield* put({ ...record, version: record.version + 1 }, secret)\n    }),\n    revoke: Effect.fn(\"Credential.revoke\")(function*(reference) {\n      const record = yield* authenticate(\"revoke\", reference)\n      yield* store.remove(record.id)\n    })\n  })\n}\n\n/**\n * Provides a working credential boundary over the ambient store and cipher.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = (\n  options: { readonly authorize?: Options[\"authorize\"] } = {}\n): Layer.Layer<\n  Credential,\n  never,\n  CredentialStore.CredentialStore | CredentialCipher.CredentialCipher\n> =>\n  Layer.effect(Credential)(Effect.gen(function*() {\n    const store = yield* CredentialStore.CredentialStore\n    const cipher = yield* CredentialCipher.CredentialCipher\n    return make({ store, cipher, ...(options.authorize === undefined ? {} : { authorize: options.authorize }) })\n  }))\n"]}

package/dist/esm/CredentialCipher.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Browser-safe encryption port for credential material.
+ *
+ * The cipher is the only place plaintext exists outside a `Redacted`. Keys are
+ * host-managed: an adapter receives a key from its host and never persists one
+ * through {@link CredentialStore}, so a stolen store is ciphertext and nothing
+ * else.
+ *
+ * @since 0.1.0
+ */
+import { Context as EffectContext, Effect, Layer, type Redacted } from "effect";
+import { type PersistenceError, Unavailable } from "./ControlError.ts";
+/**
+ * One encrypted secret: base64 ciphertext and the nonce it was sealed under.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Sealed {
+    readonly ciphertext: string;
+    readonly nonce: string;
+}
+/**
+ * Credential metadata authenticated with one sealed secret.
+ *
+ * Every field is immutable because the same values must be written beside the
+ * ciphertext and supplied again when it is opened.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Context {
+    readonly id: string;
+    readonly name: string;
+    readonly version: number;
+}
+/**
+ * Authenticated encryption over credential plaintext.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export interface Service {
+    readonly seal: (plaintext: Redacted.Redacted<string>, context: Context) => Effect.Effect<Sealed, Unavailable>;
+    /**
+     * Fails with `PersistenceError` on operation `credential.open` when the
+     * record does not open: a malformed nonce, or ciphertext that fails
+     * authentication under this key and context.
+     */
+    readonly open: (sealed: Sealed, context: Context) => Effect.Effect<Redacted.Redacted<string>, Unavailable | PersistenceError>;
+}
+declare const CredentialCipher_base: EffectContext.ServiceClass<CredentialCipher, "/control/CredentialCipher", Service>;
+/**
+ * Service key for credential encryption.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class CredentialCipher extends CredentialCipher_base {
+}
+/**
+ * Constructs a cipher from an implementation record.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: (implementation: Service) => Service;
+/**
+ * The typed failure a host reports when no secure key material is reachable.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const unavailable: () => Unavailable;
+/**
+ * A cipher that reports unavailable key material for every operation.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeNoop: (overrides?: Partial<Service>) => Service;
+/**
+ * Provides a cipher that reports unavailable key material.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerNoop: (overrides?: Partial<Service>) => Layer.Layer<CredentialCipher>;
+export {};
+//# sourceMappingURL=CredentialCipher.d.ts.map

package/dist/esm/CredentialCipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialCipher.d.ts","sourceRoot":"","sources":["../../src/CredentialCipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAC/E,OAAO,EAAE,KAAK,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEtE;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC7G;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,CACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,KACb,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAAC,CAAA;CAC9E;;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,qBAErC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,gBAAgB,OAAO,KAAG,OAA8C,CAAA;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAO,WAI3B,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,OAKxD,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CACnC,CAAA"}

package/dist/esm/CredentialCipher.js

@@ -0,0 +1,56 @@
+/**
+ * Browser-safe encryption port for credential material.
+ *
+ * The cipher is the only place plaintext exists outside a `Redacted`. Keys are
+ * host-managed: an adapter receives a key from its host and never persists one
+ * through {@link CredentialStore}, so a stolen store is ciphertext and nothing
+ * else.
+ *
+ * @since 0.1.0
+ */
+import { Context as EffectContext, Effect, Layer } from "effect";
+import { Unavailable } from "./ControlError.js";
+/**
+ * Service key for credential encryption.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export class CredentialCipher extends EffectContext.Service()("/control/CredentialCipher") {
+}
+/**
+ * Constructs a cipher from an implementation record.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const make = (implementation) => CredentialCipher.of(implementation);
+/**
+ * The typed failure a host reports when no secure key material is reachable.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const unavailable = () => new Unavailable({
+    feature: "credential encryption",
+    ticket: "control-credential-storage"
+});
+/**
+ * A cipher that reports unavailable key material for every operation.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeNoop = (overrides = {}) => make({
+    seal: Effect.fn("CredentialCipher.seal")(() => Effect.fail(unavailable())),
+    open: Effect.fn("CredentialCipher.open")(() => Effect.fail(unavailable())),
+    ...overrides
+});
+/**
+ * Provides a cipher that reports unavailable key material.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerNoop = (overrides = {}) => Layer.succeed(CredentialCipher)(makeNoop(overrides));
+//# sourceMappingURL=CredentialCipher.js.map

package/dist/esm/CredentialCipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialCipher.js","sourceRoot":"","sources":["../../src/CredentialCipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAA;AAC/E,OAAO,EAAyB,WAAW,EAAE,MAAM,mBAAmB,CAAA;AA+CtE;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,aAAa,CAAC,OAAO,EAA6B,CACtF,2BAA2B,CAC5B;CAAG;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,cAAuB,EAAW,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,cAAc,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAgB,EAAE,CAC3C,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,uBAAuB;IAChC,MAAM,EAAE,4BAA4B;CACrC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAA8B,EAAE,EAAW,EAAE,CACpE,IAAI,CAAC;IACH,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,GAAG,SAAS;CACb,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAA8B,EAAE,EAAiC,EAAE,CAC3F,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Browser-safe encryption port for credential material.\n *\n * The cipher is the only place plaintext exists outside a `Redacted`. Keys are\n * host-managed: an adapter receives a key from its host and never persists one\n * through {@link CredentialStore}, so a stolen store is ciphertext and nothing\n * else.\n *\n * @since 0.1.0\n */\n\nimport { Context as EffectContext, Effect, Layer, type Redacted } from \"effect\"\nimport { type PersistenceError, Unavailable } from \"./ControlError.ts\"\n\n/**\n * One encrypted secret: base64 ciphertext and the nonce it was sealed under.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Sealed {\n  readonly ciphertext: string\n  readonly nonce: string\n}\n\n/**\n * Credential metadata authenticated with one sealed secret.\n *\n * Every field is immutable because the same values must be written beside the\n * ciphertext and supplied again when it is opened.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Context {\n  readonly id: string\n  readonly name: string\n  readonly version: number\n}\n\n/**\n * Authenticated encryption over credential plaintext.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Service {\n  readonly seal: (plaintext: Redacted.Redacted<string>, context: Context) => Effect.Effect<Sealed, Unavailable>\n  /**\n   * Fails with `PersistenceError` on operation `credential.open` when the\n   * record does not open: a malformed nonce, or ciphertext that fails\n   * authentication under this key and context.\n   */\n  readonly open: (\n    sealed: Sealed,\n    context: Context\n  ) => Effect.Effect<Redacted.Redacted<string>, Unavailable | PersistenceError>\n}\n\n/**\n * Service key for credential encryption.\n *\n * @category services\n * @since 0.1.0\n */\nexport class CredentialCipher extends EffectContext.Service<CredentialCipher, Service>()(\n  \"/control/CredentialCipher\"\n) {}\n\n/**\n * Constructs a cipher from an implementation record.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (implementation: Service): Service => CredentialCipher.of(implementation)\n\n/**\n * The typed failure a host reports when no secure key material is reachable.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const unavailable = (): Unavailable =>\n  new Unavailable({\n    feature: \"credential encryption\",\n    ticket: \"control-credential-storage\"\n  })\n\n/**\n * A cipher that reports unavailable key material for every operation.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeNoop = (overrides: Partial<Service> = {}): Service =>\n  make({\n    seal: Effect.fn(\"CredentialCipher.seal\")(() => Effect.fail(unavailable())),\n    open: Effect.fn(\"CredentialCipher.open\")(() => Effect.fail(unavailable())),\n    ...overrides\n  })\n\n/**\n * Provides a cipher that reports unavailable key material.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop = (overrides: Partial<Service> = {}): Layer.Layer<CredentialCipher> =>\n  Layer.succeed(CredentialCipher)(makeNoop(overrides))\n"]}

package/dist/esm/CredentialStore.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Browser-safe persistence port for encrypted credential material.
+ *
+ * The store only ever sees a {@link SealedRecord}: an opaque connection name
+ * plus ciphertext. Plaintext never reaches this boundary, so an adapter can be
+ * backed by anything — SQL, Web Storage, a remote vault — without becoming a
+ * place a secret can leak from.
+ *
+ * Writes are compare-and-set on `version`. A writer that read version *n*
+ * commits version *n + 1*; a concurrent writer that read the same *n* is
+ * refused with {@link ControlError.CredentialConflict} rather than silently
+ * overwriting the winner.
+ *
+ * @since 0.1.0
+ */
+import { Context, Effect, Layer, Option } from "effect";
+import { CredentialConflict, Unavailable } from "./ControlError.ts";
+/**
+ * One credential at rest: opaque metadata plus the sealed secret.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface SealedRecord {
+    readonly id: string;
+    readonly name: string;
+    /** Base64 ciphertext produced by a `CredentialCipher`. */
+    readonly ciphertext: string;
+    /** Base64 per-record nonce. Never reused across versions. */
+    readonly nonce: string;
+    /** Monotonic write counter; 1 for a freshly created credential. */
+    readonly version: number;
+    readonly updatedAtMs: number;
+}
+/**
+ * The persistence operations `Credential` needs.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export interface Service {
+    readonly list: () => Effect.Effect<ReadonlyArray<SealedRecord>, Unavailable>;
+    readonly read: (id: string) => Effect.Effect<Option.Option<SealedRecord>, Unavailable>;
+    /** Commits `record` only if the stored version is `record.version - 1`. */
+    readonly write: (record: SealedRecord) => Effect.Effect<void, Unavailable | CredentialConflict>;
+    readonly remove: (id: string) => Effect.Effect<void, Unavailable>;
+}
+declare const CredentialStore_base: Context.ServiceClass<CredentialStore, "/control/CredentialStore", Service>;
+/**
+ * Service key for encrypted credential persistence.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class CredentialStore extends CredentialStore_base {
+}
+/**
+ * Constructs a store from an implementation record.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: (implementation: Service) => Service;
+/**
+ * A store that reports unavailable persistence for every operation.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeNoop: (overrides?: Partial<Service>) => Service;
+/**
+ * Provides a store that reports unavailable persistence.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerNoop: (overrides?: Partial<Service>) => Layer.Layer<CredentialStore>;
+/**
+ * Constructs a process-local store.
+ *
+ * Browser-safe and durable for the lifetime of the process only; it exists so
+ * the credential contract can be exercised without a host adapter, and as the
+ * fallback a short-lived worker can use.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeMemory: () => Service;
+/**
+ * Provides a process-local store.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerMemory: Layer.Layer<CredentialStore>;
+export {};
+//# sourceMappingURL=CredentialStore.d.ts.map

package/dist/esm/CredentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialStore.d.ts","sourceRoot":"","sources":["../../src/CredentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,CAAA;IAC5E,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,CAAA;IACtF,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,kBAAkB,CAAC,CAAA;IAC/F,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;CAClE;;AAED;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,oBAEpC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,gBAAgB,OAAO,KAAG,OAA6C,CAAA;AAQ5F;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,OAOxD,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CACnC,CAAA;AAErD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,QAAO,OAkC7B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAA2C,CAAA"}

package/dist/esm/CredentialStore.js

@@ -0,0 +1,101 @@
+/**
+ * Browser-safe persistence port for encrypted credential material.
+ *
+ * The store only ever sees a {@link SealedRecord}: an opaque connection name
+ * plus ciphertext. Plaintext never reaches this boundary, so an adapter can be
+ * backed by anything — SQL, Web Storage, a remote vault — without becoming a
+ * place a secret can leak from.
+ *
+ * Writes are compare-and-set on `version`. A writer that read version *n*
+ * commits version *n + 1*; a concurrent writer that read the same *n* is
+ * refused with {@link ControlError.CredentialConflict} rather than silently
+ * overwriting the winner.
+ *
+ * @since 0.1.0
+ */
+import { Context, Effect, Layer, Option } from "effect";
+import { CredentialConflict, Unavailable } from "./ControlError.js";
+/**
+ * Service key for encrypted credential persistence.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export class CredentialStore extends Context.Service()("/control/CredentialStore") {
+}
+/**
+ * Constructs a store from an implementation record.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const make = (implementation) => CredentialStore.of(implementation);
+const unavailable = () => new Unavailable({
+    feature: "credential storage",
+    ticket: "control-credential-storage"
+});
+/**
+ * A store that reports unavailable persistence for every operation.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeNoop = (overrides = {}) => make({
+    list: Effect.fn("CredentialStore.list")(() => Effect.fail(unavailable())),
+    read: Effect.fn("CredentialStore.read")(() => Effect.fail(unavailable())),
+    write: Effect.fn("CredentialStore.write")(() => Effect.fail(unavailable())),
+    remove: Effect.fn("CredentialStore.remove")(() => Effect.fail(unavailable())),
+    ...overrides
+});
+/**
+ * Provides a store that reports unavailable persistence.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerNoop = (overrides = {}) => Layer.succeed(CredentialStore)(makeNoop(overrides));
+/**
+ * Constructs a process-local store.
+ *
+ * Browser-safe and durable for the lifetime of the process only; it exists so
+ * the credential contract can be exercised without a host adapter, and as the
+ * fallback a short-lived worker can use.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeMemory = () => {
+    const records = new Map();
+    // SQL adapters serialize each row on both sides of storage. Copying here
+    // keeps the in-memory double from granting callers mutable access to state a
+    // durable store would have isolated.
+    const copy = (record) => structuredClone(record);
+    return make({
+        list: Effect.fn("CredentialStore.list")(() => Effect.sync(() => Array.from(records.values(), copy))),
+        read: Effect.fn("CredentialStore.read")((id) => Effect.sync(() => Option.map(Option.fromNullishOr(records.get(id)), copy))),
+        write: Effect.fn("CredentialStore.write")((record) => Effect.suspend(() => {
+            const current = records.get(record.id);
+            const actual = current?.version ?? 0;
+            if (actual !== record.version - 1) {
+                return Effect.fail(new CredentialConflict({
+                    id: record.id,
+                    expectedVersion: record.version - 1,
+                    actualVersion: actual
+                }));
+            }
+            records.set(record.id, copy(record));
+            return Effect.void;
+        })),
+        remove: Effect.fn("CredentialStore.remove")((id) => Effect.sync(() => {
+            records.delete(id);
+        }))
+    });
+};
+/**
+ * Provides a process-local store.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerMemory = Layer.sync(CredentialStore)(makeMemory);
+//# sourceMappingURL=CredentialStore.js.map

package/dist/esm/CredentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialStore.js","sourceRoot":"","sources":["../../src/CredentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAkCnE;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAA4B,CAC9E,0BAA0B,CAC3B;CAAG;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,cAAuB,EAAW,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC,CAAA;AAE5F,MAAM,WAAW,GAAG,GAAgB,EAAE,CACpC,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,4BAA4B;CACrC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAA8B,EAAE,EAAW,EAAE,CACpE,IAAI,CAAC;IACH,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,GAAG,SAAS;CACb,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAA8B,EAAE,EAAgC,EAAE,CAC1F,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAY,EAAE;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC/C,yEAAyE;IACzE,6EAA6E;IAC7E,qCAAqC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAoB,EAAgB,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC5E,OAAO,IAAI,CAAC;QACV,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACpG,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAC3E;QACD,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CACnD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,kBAAkB,CAAC;oBACrB,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,eAAe,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC;oBACnC,aAAa,EAAE,MAAM;iBACtB,CAAC,CACH,CAAA;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;YACpC,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC,CAAC,CACH;QACD,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpB,CAAC,CAAC,CACH;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAiC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,CAAA","sourcesContent":["/**\n * Browser-safe persistence port for encrypted credential material.\n *\n * The store only ever sees a {@link SealedRecord}: an opaque connection name\n * plus ciphertext. Plaintext never reaches this boundary, so an adapter can be\n * backed by anything — SQL, Web Storage, a remote vault — without becoming a\n * place a secret can leak from.\n *\n * Writes are compare-and-set on `version`. A writer that read version *n*\n * commits version *n + 1*; a concurrent writer that read the same *n* is\n * refused with {@link ControlError.CredentialConflict} rather than silently\n * overwriting the winner.\n *\n * @since 0.1.0\n */\n\nimport { Context, Effect, Layer, Option } from \"effect\"\nimport { CredentialConflict, Unavailable } from \"./ControlError.ts\"\n\n/**\n * One credential at rest: opaque metadata plus the sealed secret.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface SealedRecord {\n  readonly id: string\n  readonly name: string\n  /** Base64 ciphertext produced by a `CredentialCipher`. */\n  readonly ciphertext: string\n  /** Base64 per-record nonce. Never reused across versions. */\n  readonly nonce: string\n  /** Monotonic write counter; 1 for a freshly created credential. */\n  readonly version: number\n  readonly updatedAtMs: number\n}\n\n/**\n * The persistence operations `Credential` needs.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Service {\n  readonly list: () => Effect.Effect<ReadonlyArray<SealedRecord>, Unavailable>\n  readonly read: (id: string) => Effect.Effect<Option.Option<SealedRecord>, Unavailable>\n  /** Commits `record` only if the stored version is `record.version - 1`. */\n  readonly write: (record: SealedRecord) => Effect.Effect<void, Unavailable | CredentialConflict>\n  readonly remove: (id: string) => Effect.Effect<void, Unavailable>\n}\n\n/**\n * Service key for encrypted credential persistence.\n *\n * @category services\n * @since 0.1.0\n */\nexport class CredentialStore extends Context.Service<CredentialStore, Service>()(\n  \"/control/CredentialStore\"\n) {}\n\n/**\n * Constructs a store from an implementation record.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (implementation: Service): Service => CredentialStore.of(implementation)\n\nconst unavailable = (): Unavailable =>\n  new Unavailable({\n    feature: \"credential storage\",\n    ticket: \"control-credential-storage\"\n  })\n\n/**\n * A store that reports unavailable persistence for every operation.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeNoop = (overrides: Partial<Service> = {}): Service =>\n  make({\n    list: Effect.fn(\"CredentialStore.list\")(() => Effect.fail(unavailable())),\n    read: Effect.fn(\"CredentialStore.read\")(() => Effect.fail(unavailable())),\n    write: Effect.fn(\"CredentialStore.write\")(() => Effect.fail(unavailable())),\n    remove: Effect.fn(\"CredentialStore.remove\")(() => Effect.fail(unavailable())),\n    ...overrides\n  })\n\n/**\n * Provides a store that reports unavailable persistence.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop = (overrides: Partial<Service> = {}): Layer.Layer<CredentialStore> =>\n  Layer.succeed(CredentialStore)(makeNoop(overrides))\n\n/**\n * Constructs a process-local store.\n *\n * Browser-safe and durable for the lifetime of the process only; it exists so\n * the credential contract can be exercised without a host adapter, and as the\n * fallback a short-lived worker can use.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeMemory = (): Service => {\n  const records = new Map<string, SealedRecord>()\n  // SQL adapters serialize each row on both sides of storage. Copying here\n  // keeps the in-memory double from granting callers mutable access to state a\n  // durable store would have isolated.\n  const copy = (record: SealedRecord): SealedRecord => structuredClone(record)\n  return make({\n    list: Effect.fn(\"CredentialStore.list\")(() => Effect.sync(() => Array.from(records.values(), copy))),\n    read: Effect.fn(\"CredentialStore.read\")((id) =>\n      Effect.sync(() => Option.map(Option.fromNullishOr(records.get(id)), copy))\n    ),\n    write: Effect.fn(\"CredentialStore.write\")((record) =>\n      Effect.suspend(() => {\n        const current = records.get(record.id)\n        const actual = current?.version ?? 0\n        if (actual !== record.version - 1) {\n          return Effect.fail(\n            new CredentialConflict({\n              id: record.id,\n              expectedVersion: record.version - 1,\n              actualVersion: actual\n            })\n          )\n        }\n        records.set(record.id, copy(record))\n        return Effect.void\n      })\n    ),\n    remove: Effect.fn(\"CredentialStore.remove\")((id) =>\n      Effect.sync(() => {\n        records.delete(id)\n      })\n    )\n  })\n}\n\n/**\n * Provides a process-local store.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerMemory: Layer.Layer<CredentialStore> = Layer.sync(CredentialStore)(makeMemory)\n"]}