@smthrs/sync 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/BranchServer.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The server-side handlers of {@link BranchRpcs}: a thin projection of the
+ * branch services onto the wire.
+ *
+ * Five procedures forward to the service that owns their boundary and add
+ * nothing: `Branch.Submit` to {@link BranchCommands}, and `Branch.Announce`,
+ * `Branch.Leave`, `Branch.Roster`, and `Branch.WatchRoster` to
+ * {@link BranchPresence}. Two enforce policy here, on top of what
+ * {@link BranchShare} checks: `Branch.CreateBranch` refuses any principal that
+ * is not an authenticated workspace, and `Branch.MintShare` verifies write
+ * access, refuses an expired parent, and caps the child at the parent's
+ * expiry. `BranchShare.mint` performs none of those checks, so an in-process
+ * host that mints through the service directly must gate the principal and
+ * the parent capability itself.
+ *
+ * @since 0.1.0
+ */
+import type * as Layer from "effect/Layer";
+import type * as Rpc from "effect/unstable/rpc/Rpc";
+import type * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+import * as BranchCommands from "./BranchCommands.ts";
+import * as BranchIds from "./BranchIds.ts";
+import * as BranchPresence from "./BranchPresence.ts";
+import { BranchRpcs } from "./BranchRpcs.ts";
+import * as BranchShare from "./BranchShare.ts";
+/**
+ * Provides the branch RPC handlers over the branch services.
+ *
+ * With {@link BranchPresence.layerNoop}, roster reads and watches fail with
+ * `unsupported`: unavailable presence cannot establish an empty roster.
+ *
+ * A roster watch emits the roster as of subscription, then re-lists on every
+ * presence change for the branch AND at least once per second, emitting
+ * only when the roster it read differs from the one it last sent.
+ *
+ * All three of those are triggers into ONE sequential reader. The roster is
+ * mutable state behind an effect, so concurrent readers can complete out of
+ * order, and a watcher that receives an older roster after a newer one keeps
+ * the older one: `changesWith` compares against the previous emission, not
+ * against the freshest state. Serializing the reads is what makes the last
+ * value a watcher holds the most recent one that was read.
+ *
+ * The periodic re-list is what makes expiry observable. A lapsed lease
+ * publishes nothing — the roster drops it the next time somebody lists — so a
+ * watch driven by change events alone never saw the LAST participant leave,
+ * and a burst of announcements on unrelated branches could slide the one
+ * notification this watch needed out of the shared feed. Both are bounded by
+ * one second: a departure is visible within 1 s of lease expiry,
+ * whether or not a survivor reports it.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerHandlers: Layer.Layer<Rpc.ToHandler<RpcGroup.Rpcs<typeof BranchRpcs>>, never, BranchShare.BranchShare | BranchPresence.BranchPresence | BranchCommands.BranchCommands | BranchIds.BranchIds>;
+//# sourceMappingURL=BranchServer.d.ts.map

package/dist/esm/BranchServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BranchServer.d.ts","sourceRoot":"","sources":["../../src/BranchServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAE1C,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,KAAK,QAAQ,MAAM,8BAA8B,CAAA;AAC7D,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAwC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,KAAK,CACrC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,CAAC,EAC/C,KAAK,EACH,WAAW,CAAC,WAAW,GACvB,cAAc,CAAC,cAAc,GAC7B,cAAc,CAAC,cAAc,GAC7B,SAAS,CAAC,SAAS,CAkGtB,CAAA"}

package/dist/esm/BranchServer.js

@@ -0,0 +1,168 @@
+/**
+ * The server-side handlers of {@link BranchRpcs}: a thin projection of the
+ * branch services onto the wire.
+ *
+ * Five procedures forward to the service that owns their boundary and add
+ * nothing: `Branch.Submit` to {@link BranchCommands}, and `Branch.Announce`,
+ * `Branch.Leave`, `Branch.Roster`, and `Branch.WatchRoster` to
+ * {@link BranchPresence}. Two enforce policy here, on top of what
+ * {@link BranchShare} checks: `Branch.CreateBranch` refuses any principal that
+ * is not an authenticated workspace, and `Branch.MintShare` verifies write
+ * access, refuses an expired parent, and caps the child at the parent's
+ * expiry. `BranchShare.mint` performs none of those checks, so an in-process
+ * host that mints through the service directly must gate the principal and
+ * the parent capability itself.
+ *
+ * @since 0.1.0
+ */
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as BranchCommands from "./BranchCommands.js";
+import * as BranchIds from "./BranchIds.js";
+import * as BranchPresence from "./BranchPresence.js";
+import { BranchId } from "./BranchProtocol.js";
+import { BranchRpcs } from "./BranchRpcs.js";
+import * as BranchShare from "./BranchShare.js";
+import * as Admission from "./internal/Admission.js";
+import { SyncError } from "./SyncError.js";
+import * as SyncPrincipal from "./SyncPrincipal.js";
+/**
+ * Whether two roster emissions say the same thing.
+ *
+ * `list` returns participants sorted by id, so the comparison is positional.
+ * The lease itself is part of the key: a heartbeat that only extends a lease
+ * IS a change the watcher wants, because it is the evidence the participant is
+ * still there.
+ *
+ * The rendering is JSON rather than delimiter-joined fields. Participant ids
+ * and display names are `NonEmptyString` with no charset constraint, so every
+ * separator is a character they may carry, including the control bytes this
+ * used to join on. Two rosters differing only in where a field boundary falls
+ * then rendered identically and a watcher never observed the change. JSON
+ * quotes and escapes each field, so distinct rosters render distinctly.
+ */
+const rosterKey = (participants) => JSON.stringify(participants.map((participant) => [
+    participant.participantId,
+    participant.displayName,
+    participant.sessionId,
+    participant.kind,
+    participant.where,
+    participant.watching,
+    participant.for_member,
+    participant.leaseExpiresAtMs,
+    participant.cursor === null ? null : [participant.cursor.cardId, participant.cursor.offset]
+]));
+const sameRoster = (left, right) => rosterKey(left) === rosterKey(right);
+/**
+ * Provides the branch RPC handlers over the branch services.
+ *
+ * With {@link BranchPresence.layerNoop}, roster reads and watches fail with
+ * `unsupported`: unavailable presence cannot establish an empty roster.
+ *
+ * A roster watch emits the roster as of subscription, then re-lists on every
+ * presence change for the branch AND at least once per second, emitting
+ * only when the roster it read differs from the one it last sent.
+ *
+ * All three of those are triggers into ONE sequential reader. The roster is
+ * mutable state behind an effect, so concurrent readers can complete out of
+ * order, and a watcher that receives an older roster after a newer one keeps
+ * the older one: `changesWith` compares against the previous emission, not
+ * against the freshest state. Serializing the reads is what makes the last
+ * value a watcher holds the most recent one that was read.
+ *
+ * The periodic re-list is what makes expiry observable. A lapsed lease
+ * publishes nothing — the roster drops it the next time somebody lists — so a
+ * watch driven by change events alone never saw the LAST participant leave,
+ * and a burst of announcements on unrelated branches could slide the one
+ * notification this watch needed out of the shared feed. Both are bounded by
+ * one second: a departure is visible within 1 s of lease expiry,
+ * whether or not a survivor reports it.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerHandlers = BranchRpcs.toLayer(Effect.gen(function* () {
+    const share = yield* BranchShare.BranchShare;
+    const presence = yield* BranchPresence.BranchPresence;
+    const commands = yield* BranchCommands.BranchCommands;
+    const ids = yield* BranchIds.BranchIds;
+    return BranchRpcs.of({
+        "Branch.CreateBranch": ({ ttlMs }) => Effect.gen(function* () {
+            const principal = yield* SyncPrincipal.SyncPrincipal;
+            if (!SyncPrincipal.isWorkspace(principal)) {
+                return yield* new SyncError({
+                    code: "unauthorized",
+                    message: "Creating a branch requires an authenticated workspace principal"
+                });
+            }
+            // Decoded, not branded: `BranchIds` is a host port whose `fresh` is
+            // typed `Effect<string>`, so a host id source yielding "" turned an
+            // asserted `BranchId` into a schema defect inside `mint` rather than
+            // the `SyncError` this handler declares.
+            const branchId = yield* Admission.decode(BranchId, yield* ids.fresh, "invalid_request");
+            const capability = yield* share.mint({
+                branchId,
+                capabilityId: yield* ids.fresh,
+                access: "write",
+                ttlMs
+            });
+            return { branchId: capability.claims.branchId, capability };
+        }),
+        "Branch.MintShare": ({ capability, access, ttlMs }) => Effect.gen(function* () {
+            const claims = yield* share.verify(capability, {
+                branchId: capability.claims.branchId,
+                access: "write"
+            });
+            const capabilityId = yield* ids.fresh;
+            const nowMs = yield* Clock.currentTimeMillis;
+            // ID generation may outlast the parent. Refuse before minting, and
+            // pass the absolute ceiling so the signing clock cannot extend it.
+            if (nowMs >= claims.expiresAtMs) {
+                return yield* new SyncError({
+                    code: "unauthorized",
+                    message: "The share capability has expired"
+                });
+            }
+            // A link never outlives the capability it was minted from.
+            return yield* share.mint({
+                branchId: claims.branchId,
+                capabilityId,
+                access,
+                ttlMs,
+                maxExpiresAtMs: claims.expiresAtMs
+            });
+        }),
+        "Branch.Submit": (payload) => commands.submit(payload),
+        "Branch.Announce": (payload) => presence.announce(payload),
+        "Branch.Leave": (payload) => Effect.as(presence.leave(payload), null),
+        "Branch.Roster": (payload) => presence.list(payload),
+        "Branch.PresenceOn": (payload) => presence.presenceOn(payload),
+        "Branch.WatchRoster": (payload) => Stream.merge(
+        // The subscription's own snapshot is a TRIGGER like the other two,
+        // not a fourth reader. Reading it here concurrently with them let
+        // the roster a change produced overtake it: `presence.list` is an
+        // effect against mutable state, three of them ran at once, and the
+        // slowest one won the merge. `changesWith` compares an emission only
+        // against the one before it, so the older roster passed the filter
+        // and the watcher's LAST value said a participant who had already
+        // left was still present, until the next change or lease tick.
+        Stream.succeed(undefined), Stream.merge(presence.changes.pipe(Stream.filter((branchId) => branchId === payload.branchId), Stream.map(() => undefined)), 
+        // A lapsed lease publishes nothing, so a watch driven only by
+        // change events never observes the LAST participant leaving, and
+        // an unrelated branch's burst can slide the one notification this
+        // watch needed out of the shared feed. Re-listing at least once per second
+        // bounds both: a departure is visible within 1 s of expiry, whether or not anyone reports it.
+        Stream.fromEffectRepeat(Effect.sleep(Math.min(presence.leaseMs, 1_000))).pipe(Stream.map(() => undefined)))).pipe(
+        // ONE reader, sequential by default, so a roster is read in the
+        // order its trigger arrived and every emission is at least as fresh
+        // as the one before it.
+        Stream.mapEffect(() => presence.list(payload)), 
+        // Deduplicated over the WHOLE stream, initial emission included.
+        // Applied to the change half alone, its first value always passed,
+        // so a change that left the roster identical still sent the watcher
+        // a second copy of what it had just been given.
+        Stream.changesWith(sameRoster), Stream.map((participants) => ({ participants })))
+    });
+}));
+//# sourceMappingURL=BranchServer.js.map

package/dist/esm/BranchServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BranchServer.js","sourceRoot":"","sources":["../../src/BranchServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAoB,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;GAcG;AACH,MAAM,SAAS,GAAG,CAAC,YAAwC,EAAU,EAAE,CACrE,IAAI,CAAC,SAAS,CACZ,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAChC,WAAW,CAAC,aAAa;IACzB,WAAW,CAAC,WAAW;IACvB,WAAW,CAAC,SAAS;IACrB,WAAW,CAAC,IAAI;IAChB,WAAW,CAAC,KAAK;IACjB,WAAW,CAAC,QAAQ;IACpB,WAAW,CAAC,UAAU;IACtB,WAAW,CAAC,gBAAgB;IAC5B,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;CAC5F,CAAC,CACH,CAAA;AAEH,MAAM,UAAU,GAAG,CACjB,IAAgC,EAChC,KAAiC,EACxB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAA;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,aAAa,GAOtB,UAAU,CAAC,OAAO,CACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAA;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAA;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;IAEtC,OAAO,UAAU,CAAC,EAAE,CAAC;QACnB,qBAAqB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAA;YACpD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;oBAC1B,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iEAAiE;iBAC3E,CAAC,CAAA;YACJ,CAAC;YACD,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,yCAAyC;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;YACvF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACnC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK;gBAC9B,MAAM,EAAE,OAAO;gBACf,KAAK;aACN,CAAC,CAAA;YACF,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;QAC7D,CAAC,CAAC;QACJ,kBAAkB,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE;gBAC7C,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;gBACpC,MAAM,EAAE,OAAO;aAChB,CAAC,CAAA;YACF,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;YAC5C,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;oBAC1B,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kCAAkC;iBAC5C,CAAC,CAAA;YACJ,CAAC;YACD,2DAA2D;YAC3D,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY;gBACZ,MAAM;gBACN,KAAK;gBACL,cAAc,EAAE,MAAM,CAAC,WAAW;aACnC,CAAC,CAAA;QACJ,CAAC,CAAC;QACJ,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1D,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;QACrE,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACpD,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9D,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAChC,MAAM,CAAC,KAAK;QACV,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,MAAM,CAAC,KAAK,CACV,QAAQ,CAAC,OAAO,CAAC,IAAI,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAC5B;QACD,8DAA8D;QAC9D,iEAAiE;QACjE,kEAAkE;QAClE,2EAA2E;QAC3E,8FAA8F;QAC9F,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAC3G,CACF,CAAC,IAAI;QACJ,gEAAgE;QAChE,oEAAoE;QACpE,wBAAwB;QACxB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CACjD;KACJ,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA","sourcesContent":["/**\n * The server-side handlers of {@link BranchRpcs}: a thin projection of the\n * branch services onto the wire.\n *\n * Five procedures forward to the service that owns their boundary and add\n * nothing: `Branch.Submit` to {@link BranchCommands}, and `Branch.Announce`,\n * `Branch.Leave`, `Branch.Roster`, and `Branch.WatchRoster` to\n * {@link BranchPresence}. Two enforce policy here, on top of what\n * {@link BranchShare} checks: `Branch.CreateBranch` refuses any principal that\n * is not an authenticated workspace, and `Branch.MintShare` verifies write\n * access, refuses an expired parent, and caps the child at the parent's\n * expiry. `BranchShare.mint` performs none of those checks, so an in-process\n * host that mints through the service directly must gate the principal and\n * the parent capability itself.\n *\n * @since 0.1.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Layer from \"effect/Layer\"\nimport * as Stream from \"effect/Stream\"\nimport type * as Rpc from \"effect/unstable/rpc/Rpc\"\nimport type * as RpcGroup from \"effect/unstable/rpc/RpcGroup\"\nimport * as BranchCommands from \"./BranchCommands.ts\"\nimport * as BranchIds from \"./BranchIds.ts\"\nimport * as BranchPresence from \"./BranchPresence.ts\"\nimport { BranchId, type Participant } from \"./BranchProtocol.ts\"\nimport { BranchRpcs } from \"./BranchRpcs.ts\"\nimport * as BranchShare from \"./BranchShare.ts\"\nimport * as Admission from \"./internal/Admission.ts\"\nimport { SyncError } from \"./SyncError.ts\"\nimport * as SyncPrincipal from \"./SyncPrincipal.ts\"\n\n/**\n * Whether two roster emissions say the same thing.\n *\n * `list` returns participants sorted by id, so the comparison is positional.\n * The lease itself is part of the key: a heartbeat that only extends a lease\n * IS a change the watcher wants, because it is the evidence the participant is\n * still there.\n *\n * The rendering is JSON rather than delimiter-joined fields. Participant ids\n * and display names are `NonEmptyString` with no charset constraint, so every\n * separator is a character they may carry, including the control bytes this\n * used to join on. Two rosters differing only in where a field boundary falls\n * then rendered identically and a watcher never observed the change. JSON\n * quotes and escapes each field, so distinct rosters render distinctly.\n */\nconst rosterKey = (participants: ReadonlyArray<Participant>): string =>\n  JSON.stringify(\n    participants.map((participant) => [\n      participant.participantId,\n      participant.displayName,\n      participant.sessionId,\n      participant.kind,\n      participant.where,\n      participant.watching,\n      participant.for_member,\n      participant.leaseExpiresAtMs,\n      participant.cursor === null ? null : [participant.cursor.cardId, participant.cursor.offset]\n    ])\n  )\n\nconst sameRoster = (\n  left: ReadonlyArray<Participant>,\n  right: ReadonlyArray<Participant>\n): boolean => rosterKey(left) === rosterKey(right)\n\n/**\n * Provides the branch RPC handlers over the branch services.\n *\n * With {@link BranchPresence.layerNoop}, roster reads and watches fail with\n * `unsupported`: unavailable presence cannot establish an empty roster.\n *\n * A roster watch emits the roster as of subscription, then re-lists on every\n * presence change for the branch AND at least once per second, emitting\n * only when the roster it read differs from the one it last sent.\n *\n * All three of those are triggers into ONE sequential reader. The roster is\n * mutable state behind an effect, so concurrent readers can complete out of\n * order, and a watcher that receives an older roster after a newer one keeps\n * the older one: `changesWith` compares against the previous emission, not\n * against the freshest state. Serializing the reads is what makes the last\n * value a watcher holds the most recent one that was read.\n *\n * The periodic re-list is what makes expiry observable. A lapsed lease\n * publishes nothing — the roster drops it the next time somebody lists — so a\n * watch driven by change events alone never saw the LAST participant leave,\n * and a burst of announcements on unrelated branches could slide the one\n * notification this watch needed out of the shared feed. Both are bounded by\n * one second: a departure is visible within 1 s of lease expiry,\n * whether or not a survivor reports it.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerHandlers: Layer.Layer<\n  Rpc.ToHandler<RpcGroup.Rpcs<typeof BranchRpcs>>,\n  never,\n  | BranchShare.BranchShare\n  | BranchPresence.BranchPresence\n  | BranchCommands.BranchCommands\n  | BranchIds.BranchIds\n> = BranchRpcs.toLayer(\n  Effect.gen(function*() {\n    const share = yield* BranchShare.BranchShare\n    const presence = yield* BranchPresence.BranchPresence\n    const commands = yield* BranchCommands.BranchCommands\n    const ids = yield* BranchIds.BranchIds\n\n    return BranchRpcs.of({\n      \"Branch.CreateBranch\": ({ ttlMs }) =>\n        Effect.gen(function*() {\n          const principal = yield* SyncPrincipal.SyncPrincipal\n          if (!SyncPrincipal.isWorkspace(principal)) {\n            return yield* new SyncError({\n              code: \"unauthorized\",\n              message: \"Creating a branch requires an authenticated workspace principal\"\n            })\n          }\n          // Decoded, not branded: `BranchIds` is a host port whose `fresh` is\n          // typed `Effect<string>`, so a host id source yielding \"\" turned an\n          // asserted `BranchId` into a schema defect inside `mint` rather than\n          // the `SyncError` this handler declares.\n          const branchId = yield* Admission.decode(BranchId, yield* ids.fresh, \"invalid_request\")\n          const capability = yield* share.mint({\n            branchId,\n            capabilityId: yield* ids.fresh,\n            access: \"write\",\n            ttlMs\n          })\n          return { branchId: capability.claims.branchId, capability }\n        }),\n      \"Branch.MintShare\": ({ capability, access, ttlMs }) =>\n        Effect.gen(function*() {\n          const claims = yield* share.verify(capability, {\n            branchId: capability.claims.branchId,\n            access: \"write\"\n          })\n          const capabilityId = yield* ids.fresh\n          const nowMs = yield* Clock.currentTimeMillis\n          // ID generation may outlast the parent. Refuse before minting, and\n          // pass the absolute ceiling so the signing clock cannot extend it.\n          if (nowMs >= claims.expiresAtMs) {\n            return yield* new SyncError({\n              code: \"unauthorized\",\n              message: \"The share capability has expired\"\n            })\n          }\n          // A link never outlives the capability it was minted from.\n          return yield* share.mint({\n            branchId: claims.branchId,\n            capabilityId,\n            access,\n            ttlMs,\n            maxExpiresAtMs: claims.expiresAtMs\n          })\n        }),\n      \"Branch.Submit\": (payload) => commands.submit(payload),\n      \"Branch.Announce\": (payload) => presence.announce(payload),\n      \"Branch.Leave\": (payload) => Effect.as(presence.leave(payload), null),\n      \"Branch.Roster\": (payload) => presence.list(payload),\n      \"Branch.PresenceOn\": (payload) => presence.presenceOn(payload),\n      \"Branch.WatchRoster\": (payload) =>\n        Stream.merge(\n          // The subscription's own snapshot is a TRIGGER like the other two,\n          // not a fourth reader. Reading it here concurrently with them let\n          // the roster a change produced overtake it: `presence.list` is an\n          // effect against mutable state, three of them ran at once, and the\n          // slowest one won the merge. `changesWith` compares an emission only\n          // against the one before it, so the older roster passed the filter\n          // and the watcher's LAST value said a participant who had already\n          // left was still present, until the next change or lease tick.\n          Stream.succeed(undefined),\n          Stream.merge(\n            presence.changes.pipe(\n              Stream.filter((branchId) => branchId === payload.branchId),\n              Stream.map(() => undefined)\n            ),\n            // A lapsed lease publishes nothing, so a watch driven only by\n            // change events never observes the LAST participant leaving, and\n            // an unrelated branch's burst can slide the one notification this\n            // watch needed out of the shared feed. Re-listing at least once per second\n            // bounds both: a departure is visible within 1 s of expiry, whether or not anyone reports it.\n            Stream.fromEffectRepeat(Effect.sleep(Math.min(presence.leaseMs, 1_000))).pipe(Stream.map(() => undefined))\n          )\n        ).pipe(\n          // ONE reader, sequential by default, so a roster is read in the\n          // order its trigger arrived and every emission is at least as fresh\n          // as the one before it.\n          Stream.mapEffect(() => presence.list(payload)),\n          // Deduplicated over the WHOLE stream, initial emission included.\n          // Applied to the change half alone, its first value always passed,\n          // so a change that left the roster identical still sent the watcher\n          // a second copy of what it had just been given.\n          Stream.changesWith(sameRoster),\n          Stream.map((participants) => ({ participants }))\n        )\n    })\n  })\n)\n"]}

package/dist/esm/BranchShare.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Share capabilities: the authorization boundary of a shared branch.
+ *
+ * A share link carries a capability, not a session. The capability names
+ * exactly one branch, one access level, and one expiry, and it is signed, so
+ * the holder cannot widen it. Every branch operation authorizes through
+ * `verify`, which is therefore the single place cross-branch access and
+ * expired links are refused.
+ *
+ * The signature is HMAC-SHA-256 over a length-prefixed encoding of the claims,
+ * led by a scheme label. Length prefixes matter: without them a branch id
+ * ending in the separator could be re-cut into a different, still-validly-
+ * signed claim set. The label matters for the same reason across schemes: a
+ * branch capability can never verify as a workspace capability even if one
+ * secret is misconfigured into both authorities. Web Crypto is used directly
+ * so the same module runs in the browser and on node.
+ *
+ * A `kid` inside the claims names the key that signed them, so a branch secret
+ * rotates the way the workspace secret already did: the new key signs, the
+ * retired key stays in the verification keyring, and the share links already
+ * out keep working until they expire.
+ *
+ * @since 0.1.0
+ */
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import { Access, BranchId, ShareCapability, ShareClaims } from "./BranchProtocol.ts";
+import * as shareSigner from "./internal/ShareSigner.ts";
+import type { SyncError } from "./SyncError.ts";
+/**
+ * The branch and access one authorization request needs.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface AuthorizeRequest {
+    readonly branchId: BranchId;
+    readonly access: Access;
+}
+/**
+ * What a freshly minted capability grants.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export declare const MintRequest: Schema.Struct<{
+    readonly branchId: Schema.brand<Schema.NonEmptyString, "@smthrs/sync/BranchProtocol/BranchId">;
+    readonly capabilityId: Schema.NonEmptyString;
+    readonly access: Schema.Literals<readonly ["read", "write"]>;
+    readonly ttlMs: Schema.Int;
+    /** Absolute expiry ceiling for a capability delegated from a parent. */
+    readonly maxExpiresAtMs: Schema.optionalKey<Schema.Int>;
+}>;
+/**
+ * What a freshly minted capability grants.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type MintRequest = typeof MintRequest.Type;
+/**
+ * Share capability operations.
+ *
+ * `mint` fails with a `SyncError` when the Web Crypto signing operation
+ * rejects or the absolute expiry ceiling has elapsed; `verify` fails with a
+ * `SyncError` when signing rejects or the capability is refused.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Service {
+    readonly mint: (request: MintRequest) => Effect.Effect<ShareCapability, SyncError>;
+    readonly verify: (capability: ShareCapability, request: AuthorizeRequest) => Effect.Effect<ShareClaims, SyncError>;
+}
+declare const BranchShare_base: Context.ServiceClass<BranchShare, "@smthrs/sync/BranchShare", Service>;
+/**
+ * The branch share-capability authority.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class BranchShare extends BranchShare_base {
+}
+/**
+ * Constructs a share authority that mints nothing and trusts nothing.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeNoop: (overrides?: Partial<Service>) => Service;
+/**
+ * Provides a share authority that refuses every capability.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerNoop: Layer.Layer<BranchShare>;
+/**
+ * One named signing key. The secret is `Redacted` so a keyring never renders
+ * it into logs or inspection output.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Key = shareSigner.Key;
+/**
+ * A keyring: the key that signs new capabilities plus every key still
+ * accepted for verification. Rotation adds a new active key and keeps the
+ * retired one in `keys` until its outstanding links expire, so rotating the
+ * branch secret no longer breaks every share link that is already out.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Keyring = shareSigner.Keyring;
+/**
+ * Constructs the HMAC-SHA-256 share authority over a keyring.
+ *
+ * Every key is imported up front, so a misconfigured keyring — an unknown
+ * active kid, a duplicate kid, or a key Web Crypto refuses — fails at
+ * construction rather than at the first request. Secrets enter as `Redacted`
+ * values: an authority never holds a plain string that a log, a span, or an
+ * inspection of the keyring could render.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeHmac: (keyring: Keyring) => Effect.Effect<Service, SyncError>;
+/**
+ * Provides the HMAC-SHA-256 share authority over a keyring.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerHmac: (keyring: Keyring) => Layer.Layer<BranchShare, SyncError>;
+/**
+ * Provides the branch share authority from configuration: the secret from
+ * `SMITHERS_SYNC_BRANCH_SECRET` (read as `Redacted`, never logged) and the key
+ * name from `SMITHERS_SYNC_BRANCH_KEY_ID`, defaulting to `primary`. Rotation
+ * beyond one configured key uses {@link layerHmac} with an explicit keyring.
+ *
+ * The names are the branch authority's own, not the workspace's: the scheme
+ * label makes one secret in both authorities survivable, not advisable, and a
+ * deployment that rotates one credential should not silently invalidate the
+ * other's outstanding capabilities.
+ *
+ * There is deliberately no default secret: a deployment that configures
+ * neither name fails to construct the authority, and every branch operation
+ * stays closed.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerConfig: Layer.Layer<BranchShare, SyncError | Config.ConfigError>;
+export {};
+//# sourceMappingURL=BranchShare.d.ts.map

package/dist/esm/BranchShare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BranchShare.d.ts","sourceRoot":"","sources":["../../src/BranchShare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEpF,OAAO,KAAK,WAAW,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;IAKtB,wEAAwE;;EAExE,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;AAEjD;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IAClF,QAAQ,CAAC,MAAM,EAAE,CACf,UAAU,EAAE,eAAe,EAC3B,OAAO,EAAE,gBAAgB,KACtB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;CAC3C;;AAED;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,gBAAmE;CAAG;AAIvG;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,OAQxD,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAA0C,CAAA;AA0CzF;;;;;;GAMG;AACH,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAkEzE,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CACjC,CAAA;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,CAAC,WAAW,CAOhF,CAAA"}

package/dist/esm/BranchShare.js

@@ -0,0 +1,213 @@
+/**
+ * Share capabilities: the authorization boundary of a shared branch.
+ *
+ * A share link carries a capability, not a session. The capability names
+ * exactly one branch, one access level, and one expiry, and it is signed, so
+ * the holder cannot widen it. Every branch operation authorizes through
+ * `verify`, which is therefore the single place cross-branch access and
+ * expired links are refused.
+ *
+ * The signature is HMAC-SHA-256 over a length-prefixed encoding of the claims,
+ * led by a scheme label. Length prefixes matter: without them a branch id
+ * ending in the separator could be re-cut into a different, still-validly-
+ * signed claim set. The label matters for the same reason across schemes: a
+ * branch capability can never verify as a workspace capability even if one
+ * secret is misconfigured into both authorities. Web Crypto is used directly
+ * so the same module runs in the browser and on node.
+ *
+ * A `kid` inside the claims names the key that signed them, so a branch secret
+ * rotates the way the workspace secret already did: the new key signs, the
+ * retired key stays in the verification keyring, and the share links already
+ * out keep working until they expire.
+ *
+ * @since 0.1.0
+ */
+import * as Clock from "effect/Clock";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import { Access, BranchId, ShareCapability, ShareClaims } from "./BranchProtocol.js";
+import * as Admission from "./internal/Admission.js";
+import * as shareSigner from "./internal/ShareSigner.js";
+/**
+ * What a freshly minted capability grants.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const MintRequest = Schema.Struct({
+    branchId: BranchId,
+    capabilityId: Schema.NonEmptyString,
+    access: Access,
+    ttlMs: Schema.Int.check(Schema.isGreaterThan(0)),
+    /** Absolute expiry ceiling for a capability delegated from a parent. */
+    maxExpiresAtMs: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))
+});
+/**
+ * The branch share-capability authority.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export class BranchShare extends Context.Service()("@smthrs/sync/BranchShare") {
+}
+const denied = shareSigner.unauthorized;
+/**
+ * Constructs a share authority that mints nothing and trusts nothing.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeNoop = (overrides = {}) => BranchShare.of({
+    // Both operations FAIL. `mint` used to die, which contradicted its own
+    // declared `Effect<ShareCapability, SyncError>` and left a consumer
+    // wired to this authority unable to tell "sharing is off" from a bug.
+    mint: () => Effect.fail(denied("Branch sharing is unavailable")),
+    verify: () => Effect.fail(denied("Branch sharing is unavailable")),
+    ...overrides
+});
+/**
+ * Provides a share authority that refuses every capability.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerNoop = Layer.succeed(BranchShare, makeNoop());
+/**
+ * Domain separation: the label leads the signed encoding, so a branch
+ * signature can never be replayed as a workspace signature (or any later
+ * scheme's) under a shared secret. `WorkspaceShare` has always led with its
+ * own label; a one-sided label protects one direction, and the branch side is
+ * the one anonymous share-link holders reach.
+ */
+const schemeLabel = "@smthrs/sync/BranchShare/v2";
+/** Length-prefixed so no two distinct claim sets share an encoding. */
+const canonical = (claims) => shareSigner.lengthPrefixed([
+    schemeLabel,
+    claims.kid,
+    claims.branchId,
+    claims.capabilityId,
+    claims.access,
+    String(claims.issuedAtMs),
+    String(claims.expiresAtMs)
+]);
+/**
+ * The claim fields, copied out of the capability the caller owns.
+ *
+ * `Schema.Class` instances are not frozen, and `verify` awaits Web Crypto
+ * between signing the claims and authorizing them. Reading the caller's object
+ * again after the await let an in-process holder of the same instance widen
+ * `access` — or move `expiresAtMs` — between the signature that was checked
+ * and the checks that follow it.
+ */
+const snapshot = (claims) => new ShareClaims({
+    kid: claims.kid,
+    branchId: claims.branchId,
+    capabilityId: claims.capabilityId,
+    access: claims.access,
+    issuedAtMs: claims.issuedAtMs,
+    expiresAtMs: claims.expiresAtMs
+});
+/**
+ * Constructs the HMAC-SHA-256 share authority over a keyring.
+ *
+ * Every key is imported up front, so a misconfigured keyring — an unknown
+ * active kid, a duplicate kid, or a key Web Crypto refuses — fails at
+ * construction rather than at the first request. Secrets enter as `Redacted`
+ * values: an authority never holds a plain string that a log, a span, or an
+ * inspection of the keyring could render.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeHmac = (keyring) => Effect.map(shareSigner.importKeyring(keyring, "branch"), (ring) => {
+    const mint = Effect.fn("BranchShare.mint")(function* (request) {
+        // Decoded, not read: the declared parameter type admits an empty
+        // branch id, an empty capability id and a non-positive ttl that the
+        // schema forbids, and reading them straight into `new ShareClaims`
+        // turned a caller's bad argument into a defect out of an operation
+        // whose type promises a `SyncError`. A `ttlMs` of 0 minted an
+        // already-expired capability instead of being refused.
+        const admitted = yield* Admission.decode(MintRequest, request, "invalid_request");
+        yield* Effect.annotateCurrentSpan({ branchId: admitted.branchId, access: admitted.access });
+        const issuedAtMs = yield* Clock.currentTimeMillis;
+        const maxExpiresAtMs = admitted.maxExpiresAtMs ?? Infinity;
+        if (issuedAtMs >= maxExpiresAtMs) {
+            return yield* Effect.fail(denied("The share capability has expired"));
+        }
+        const claims = new ShareClaims({
+            kid: ring.activeKid,
+            branchId: admitted.branchId,
+            capabilityId: admitted.capabilityId,
+            access: admitted.access,
+            issuedAtMs,
+            expiresAtMs: Math.min(issuedAtMs + admitted.ttlMs, maxExpiresAtMs)
+        });
+        return new ShareCapability({
+            claims,
+            signature: yield* shareSigner.signHmac(ring.active, canonical(claims))
+        });
+    });
+    const verify = Effect.fn("BranchShare.verify")(function* (capability, request) {
+        yield* Effect.annotateCurrentSpan({ branchId: request.branchId, access: request.access });
+        // Everything authorized below is read from these locals, never from
+        // the caller's objects, which may change while Web Crypto is awaited.
+        const claims = snapshot(capability.claims);
+        const signature = capability.signature;
+        const branchId = request.branchId;
+        const key = ring.verification.get(claims.kid);
+        if (key === undefined) {
+            return yield* Effect.fail(denied("The share capability names an unknown signing key"));
+        }
+        yield* shareSigner.verifyClaims({
+            key,
+            canonical: canonical(claims),
+            signature,
+            expiresAtMs: claims.expiresAtMs,
+            granted: claims.access,
+            requested: request.access,
+            subject: "The share capability",
+            // The one check this authority adds, run after the signature so a
+            // forged claim set is refused as a bad signature and never reported
+            // back as the branch it names.
+            scope: claims.branchId === branchId
+                ? Effect.void
+                : Effect.fail(denied(`The share capability is scoped to branch ${claims.branchId}`))
+        });
+        return claims;
+    });
+    return BranchShare.of({ mint, verify });
+});
+/**
+ * Provides the HMAC-SHA-256 share authority over a keyring.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerHmac = (keyring) => Layer.effect(BranchShare, makeHmac(keyring));
+/**
+ * Provides the branch share authority from configuration: the secret from
+ * `SMITHERS_SYNC_BRANCH_SECRET` (read as `Redacted`, never logged) and the key
+ * name from `SMITHERS_SYNC_BRANCH_KEY_ID`, defaulting to `primary`. Rotation
+ * beyond one configured key uses {@link layerHmac} with an explicit keyring.
+ *
+ * The names are the branch authority's own, not the workspace's: the scheme
+ * label makes one secret in both authorities survivable, not advisable, and a
+ * deployment that rotates one credential should not silently invalidate the
+ * other's outstanding capabilities.
+ *
+ * There is deliberately no default secret: a deployment that configures
+ * neither name fails to construct the authority, and every branch operation
+ * stays closed.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layerConfig = Layer.effect(BranchShare, Effect.gen(function* () {
+    const secret = yield* Config.Redacted("SMITHERS_SYNC_BRANCH_SECRET");
+    const kid = yield* Config.String("SMITHERS_SYNC_BRANCH_KEY_ID").pipe(Config.withDefault("primary"));
+    return yield* makeHmac({ activeKid: kid, keys: [{ kid, secret }] });
+}));
+//# sourceMappingURL=BranchShare.js.map